'The prophecy is fulfilled': Popular 2020 XKCD comic predicted 'HEIF Heist' OpenAI hack and even mentions ImageMagick in spooky coincidence
- Hacktron chained a libheif heap overflow, reached through ImageMagick on OpenAI's Discourse forum, leveraging an OpenAI SSO flaw to briefly take over employee ChatGPT and Codex accounts
- The researchers themselves invoked XKCD #2347, whose 2020 alt text happens to name ImageMagick as the dependency that will one day break
- ImageMagick served as only the pathway to the actual vulnerable component, libheif, an obscure decoder pulled in indirectly across Slack, Meta, and GitHub Enterprise amongst other mediums
When Hacktron AI recently disclosed its months-long libheif research, the researchers reached for a familiar picture that also, to some degree, hints at what let them break into OpenAI in the first place.
They pointed readers to xkcd #2347, Randall Munroe's 2020 iconic web cartoon of all modern digital infrastructure balanced on a single load-bearing block that some random person in Nebraska has been thanklessly maintaining.
The comparison is relatively easy to follow,...
Copyright of this story solely belongs to www.techradar.com. To see the full text click HERE