SpaceXAI open-sourced Grok Build under Apache 2.0 after privacy backlash over broad directory uploads from its terminal AI coding agent.
The post SpaceXAI Open-Sources Grok Build After Privacy Backlash appeared first on TechRepublic.
SpaceXAI open-sourced Grok Build under Apache 2.0 after privacy backlash over broad directory uploads from its terminal AI coding agent.
The post SpaceXAI Open-Sources Grok Build After Privacy Backlash appeared first on TechRepublic.
The past two years have transformed the world of software development, but there’s at least one area that remains largely untouched by artificial intelligence: the operating-system layer inside phones, vehicles, and other connected devices.
A Seattle startup called logcat.ai has raised $2.55 million to change that.
Co-founded by CEO Varun Chitre and CTO Tarun Vashisth, two engineers with years of experience building device software, logcat.ai is developing a system of AI agents that autonomously hunt down bugs across the kernel, modem, and firmware of devices running Android or Linux.
The pre-seed round was led by Founders’ Co-op, with participation from Act One Ventures, TheFounderVC, Shorewind Capital, Clayoquot Capital, and Alumni Ventures.
“It’s one of the toughest areas of software engineering, and it doesn’t get a lot of exposure. Operating-system engineering is virtually hidden today,” Chitre said in an interview.
It’s also a challenge for many companies given a shortage of engineers who specialize in the field, compared to the much larger population of developers who build apps and software that run on top of the operating system.
How it works: An engineer using logcat.ai uploads the log files a device generates when something goes wrong — such as bug reports and kernel logs — and logcat.ai’s software analyzes them together to find the root cause and point to where in the code to fix it. Each finding cites the exact log line it came from, so an engineer can check the work.
Currently, logcat.ai finds the root cause and recommends a fix. The larger plan is to have the AI write the fixes, test them, and eventually build new features on its own, with engineers approving the work before it’s deployed.
The long-term goal, Chitre said, is to become the standard tool for building and maintaining operating systems on new and existing hardware — from smartphones to cars to robots and other embedded systems — so a company can ship without a full-stack specialist on staff.
“We’re moving toward a world where software and intelligence extend far beyond our laptops and phones, yet the tooling to build high-quality products for that world is still missing,” said Aviel Ginzburg, general partner at Founders’ Co-op, in a statement.
He called Chitre and Vashisth “one of the only teams in the world truly up for the challenge.”
Traction: The company says it has served hundreds of engineering teams in a public beta, analyzed more than 10 billion lines of trace data, and run thousands of automated investigations. It’s generating revenue but isn’t ready to disclose numbers or customers.
Competitive landscape: Chitre said logcat.ai’s main competition isn’t another product but in-house scripts and the knowledge locked in a few senior engineers’ heads. App-level crash tools like Google’s Crashlytics and Sentry stop at the app layer and don’t do the deeper system debugging.
Specialist vendors and the contract manufacturers that build devices are potential partners more than rivals, Chitre said, since they face the same engineer shortage.
GeekWire first reported on logcat.ai in March, in a Startup Radar roundup.
The team: Chitre and Vashisth met at Esper, the Bellevue, Wash.-based device-management company, where they worked together for more than seven years. They started logcat.ai because they had spent years doing debugging by hand and knew what was missing.
Chitre has spent more than 13 years in the field, getting operating systems to boot and run on new hardware and porting new Android releases and Linux kernels onto older devices. He was also a maintainer of LineageOS, a widely used open-source version of Android.
Vashisth has led engineering teams working across Android, Linux, and iOS, and brings a background in large-scale distributed systems. At Esper, he rose to senior software engineering manager. His prior experience includes platform-architecture engineering at Target.
For now, the company is just the two founders: Chitre in the Seattle area, Vashisth in Bengaluru, India. They plan to hire about 10 people over the next year, with a distributed team working remotely from wherever they can find the specialized talent.
They know those hires won’t be easy to find, given the scarcity of people in the field. “That’s the same shortage our product exists to address,” Chitre said, “and we’re not exempt from it.”
Welcome back, aspiring cyberwarriors!
During pentests, it’s not uncommon to find a Grafana somewhere inside an organization’s infrastructure. Sometimes it can even be exposed directly to the Internet. It’s always worth checking Grafana for vulnerabilities, as it has been affected by multiple security issues over the years.
Grafana is an open-source monitoring and visualization platform used by organizations to display dashboards containing information collected from servers, applications, databases, cloud services and networking equipment. Administrators rely on it to monitor the health of their infrastructure in real time, making it one of the most widely deployed monitoring apps in enterprise environments. Since Grafana often connects to numerous backend services and contains valuable configuration information, compromising it can sometimes give hackers an excellent foothold into the rest of the network.
Of course, you could manually inspect every Grafana installation looking for known vulnerabilities, but that quickly becomes time-consuming, especially during larger engagements where multiple servers have to be assessed.
Fortunately, there is a Grafana-Final-Scanner. It’s a tool designed specifically to automate this process. Instead of manually checking every instance the scanner performs the work for you by checking whether the target is vulnerable to a collection of publicly known vulnerabilities.
We’ll begin by downloading the repository and installing its dependencies.
Loginkali > git clone https://github.com/Zierax/Grafana-Final-Scanner.git
kali > cd Grafana-Final-Scanner
kali > python3 -m venv venv
kali > source venv/bin/activate
kali > pip3 install -r requirements.txt
Once everything has been installed successfully, it’s worth taking a quick look at the list of vulnerabilities supported by the scanner.
At the time of writing, the tool is capable of checking for more than fifteen different Grafana vulnerabilities.
Now let’s point it at our target.
kali > python3 scanner.py -u https://target/grafana/login
After a short scan, the tool analyzes the target and reports any vulnerabilities it successfully identifies.
In our case, the results were promising. The scanner identified CVE-2024-8118 and an OAuth Authentication Bypass vulnerability. It also gave us the URL. We opened the page and the application asked us for an administrator key that we obviously didn’t have.
Fortunately, web applications don’t always behave exactly as their developers intended. Developers occasionally leave sensitive information inside the application’s front-end code. JavaScript, HTML comments, hardcoded credentials, authorization logic have all been discovered by hackers countless times over the years.
With that in mind, we opened the page’s HTML source code to see exactly how the authorization process was implemented. The comments were written in Russian, but the logic itself was fairly easy to understand.
Instead of verifying a specific administrator key, the application simply checked whether any key existed. So the validation routine wasn’t actually validating the value at all. It simply checked if some key was provided.
The next step was straightforward. We opened the browser’s Developer Console and manually created the expected key.
The application accepted it.
We bypassed the authentication and accessed the admin panel.
Finding a vulnerability is only part of the pentest. Understanding how the application behaves after exploitation is equally important. Sometimes the scanners get you only halfway there, while manual analysis can help you find the remaining pieces needed to fully demonstrate the impact.
It’s also a good reminder that developers occasionally leave sensitive information hidden inside client-side code. You never know what useful information may have been left behind.
While running the scanner from the command line works perfectly for testing targets, the project also includes a convenient web interface.
This can be useful during larger pentests where dozens of Grafana instances need to be assessed.
You can start it with this command:
kali > python scanner.py --serve --db vulndb.json
Grafana is one of the most common monitoring platforms you’ll encounter during internal and external penetration tests. Because it frequently contains sensitive operational data and often communicates with numerous backend systems, compromising it can sometimes provide hackers with an excellent entry point into an organization’s network.
Grafana-Final-Scanner can make it much easier to determine whether your Grafana is exposed to known vulnerabilities.
If you enjoy web application pentesting and would like to improve your skills for bug bounty hunting, we have our Web Application Hacking training. You’ll gain the practical knowledge and skills you need to start finding web application vulnerabilities.
The post Pentesting: Using Grafana to Pentest a Fitness App first appeared on Hackers Arise.
China warned organizations to remove certain Claude Code versions over alleged backdoor risks, while Anthropic called the feature anti-abuse protection.
The post China Warns of Claude Code ‘Backdoor’ Security Risk appeared first on TechRepublic.
China warned organizations to remove certain Claude Code versions over alleged backdoor risks, while Anthropic called the feature anti-abuse protection.
The post China Warns of Claude Code ‘Backdoor’ Security Risk appeared first on TechRepublic.
