#SecGemini

2025-04-05

There are more inconsistencies.

It states that affected systems need to have the "GlobalProtect gateway feature" enabled. The actual advisory states "firewalls configured with GlobalProtect gateway or GlobalProtect portal (or both)".
The stated patched versions are not including all of the advisory.
And I didn't even look into all those claims about which groups exploited this CVE.

This just blows my mind again. GitHub also made similar mistakes in their recent Copilot announcement [3].

I think it's just important to understand that it is not enough to just add a pop up saying "make sure to double check all AI responses" if Google cannot even be arsed to do that for the marketing material they release.
Everyone will just rely on the response.

As a side note: Wow, the resolution of the AI response screenshot is utter crap and someone even left their mouse pointer just hovered over the text. If this was in a pentest report I would read quality assurance for, I'd tell the author to go back and fix that!

[3] infosec.exchange/@faker/113680
#secgemini

2025-04-05

Another day, another AI is announced. This time its a cybersecurity AI by Google: Sec-Gemini v1 [1]. As always, lets look at the response of it that was included on their announcement post. Surely the response was vetted and confirmed by multiple people, right?

The prompt asks about CVE-2024-3400, and at first glance this appears ok.

But in the affected systems section it states:

> Also Hitachi Energy RTU500 firmware and Siemens Ruggedcom APE1808 firmware.

I cannot find any reference that this Hitachi device is vulnerable to that CVE. Hitachi has a nice interface to list all vulnerabilities of their devices [1], this CVE is not part of it.
In the Mitigation section any mention of Hitachi is also missing. Almost as if this device is not vulnerable.

[1] security.googleblog.com/2025/0
[2] hitachienergy.com/products-and

#secgemini

N-gated Hacker Newsngate
2025-04-04

🎉 just birthed another superhero, v1, to fight the evildoers of the realm! 🤖 One more experimental model to ensure we're all safely surfing, while villains plot their single, sinister loophole. Definitely not another shiny toy for data miners to play with! 🌐🔒
security.googleblog.com/2025/0

Client Info

Server: https://mastodon.social
Version: 2025.07
Repository: https://github.com/cyevgeniy/lmst