2.0 -//Pentabarf//Schedule//EN PUBLISH 993J3A@@cfp.bsidesvienna.at -993J3A Didn't Last a Minute: Why We Can't Secure LLMs and Might Never en en 20241123T093500 20241123T100500 0.03000

Didn't Last a Minute: Why We Can't Secure LLMs and Might Never

This talk originates from my work with LLM applications and talking to developers and IT management that want to implement these tools securely. After showing them all the ways these generative AI applications can be insecure and how these insecurities often relate to prompt injection, they obviously want to know about countermeasures. At this point, traditional advice in blog articles and talks will point them to tools like Lakera, LLM-Guard, Rebuff or the measures implemented by providers like Azure. While it is always admitted that these solutions are not perfect, the discussion often stops there without explaining what "not perfect" means. This talk will do exactly that and showcase exploits against the protection systems and explain why they work and why they are so hard to fix. This talk does not intent to blame LLM security vendors, they are brave and clever people who deserve our admiration. We badly need them to figure out a solution. However, this will only happen if the hacker community understands how to break these systems, before the bad guys do. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/993J3A/ Track 1 (Dachssal) Paul Zenker PUBLISH 7WSPY8@@cfp.bsidesvienna.at -7WSPY8 Fine-tuning an LLM on CTI reports for fun and profit en en 20241123T101000 20241123T104000 0.03000

Fine-tuning an LLM on CTI reports for fun and profit

Many CTI practitioners and companies experimented with LLMs for extracting information from unstructured CTI reports in the last year. Often, the dream is to automate the analyst's job to correctly identify, copy & paste TTPs, threat actors and relationships from the report and to convert it into STIX. Alas, off-the-shelf LLMs often fail at this task (GPT-4-turbo being already pretty good at the submission time). But there is another caveat: the requirements for IT security often demand that data remains on-premise or at least in a virtual server which is fully and only under the control of the organisation's IT team. For that we need local LLMs (as opposed to cloud bases SaaS/FaaS solutions such as openai.com's API). But how to achieve good results with local LLMs ? Can we beat openai? To address the CTI text summarisation and information extraction problem, we 1. propose an open source CTI LLM benchmark dataset which can be used to compare different LLMs and prompts 2. a fine-tuned custom CTI LLM model ("neuroCTI") and 3. evaluate it (as well as other LLMs) against the benchmark dataset and 4. incorporate the infosec community in our endeavour The model is freely available to the public. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/7WSPY8/ Track 1 (Dachssal) Jürgen Brandl Aaron Kaplan PUBLISH NF9TK8@@cfp.bsidesvienna.at -NF9TK8 Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt Injections en en 20241123T104500 20241123T113000 0.04500

Hacking Your Enterprise Copilot: A Direct Guide to Indirect Prompt Injections

Intro: The promise of enterprise copilots Enterprise copilots such as Microsoft Copilot and Salesforce Einstein promise to bring even further productivity gains into the enterprise. Providing the ability to ask questions about files and emails, summarize long documents for you, create Powerpoint presentations and much more. But with that promise comes also a great risk, overreliance. And this time it’s even worse. Microsoft Copilot: Our guinea pig for the session Microsoft has been pushing their Copilot anywhere they can think of. It’s their flagship AI product. We’re going to demonstrate all of the techniques directly on Microsoft Copilot. Showing how we can (easily) manipulate Microsoft’s responsible AI layer into acting completely irresponsibly. Microsoft Copilot is built as a sophisticated RAG system. Upon getting the user’s prompt Copilot runs a query to search for the relevant documents, then appends the results to the user’s prompt and sends the full prompt - including context (i.e. relevant files’ contents) - directly to the LLM. This RAG architecture repeats itself across enterprise copilots and has notable exploits. Here we’ll deep dive into the architecture itself. Extracting a protected system prompt: Advanced techniques System prompts are not only specific instructions that tell the LLM how to act, they are also crucial for developing more advanced attacks. Because of the sensitivity of the system prompt many AI applications try to protect their system prompt. But is it enough? And can you circumvent these protection layers? We’ll show how we can extract the system prompt of an unprotected GPT . We’ll continue to show how Micorosft tried to protect their Copilot’s system prompt and finally we’ll demonstrate proven techniques to circumvent these protections. In addition we’ll see how these techniques also work on other protected AI applications. Introduction to prompt injections: Diving into indirect injections (IPIs): Prompt injections are a great way to manipulate AI apps into doing things they aren’t supposed to. But there isn’t a lot of damage I can cause if I have access only to my own data. Enter Indirect Prompt Injections. A way to manipulate other people’s Copilots. Mixed together with RAG poisoning which is a way to mislead Copilots into confidently outputting false information, we get a whole new attack path, brought to us exclusively by AI overreliance. Here we show hands on how you can execute a RAG poisoning attack and combine it with indirect prompt injections to make it even more powerful. Robust IPIs: using the system prompt to craft indirect injections The IPIs we demonstrated previously are good, but they are inconsistent. How can we make them more reliable? Use the system prompt we extracted. By combining “secret” information from the system prompt into the IPI we can take it from flakey to robust. More than that, once we know from the system prompt how the Copilot is meant to behave we can use these dispositions to make our IPI even more powerful. And ofcourse, we’ll demonstrate exactly how (hands on). All while showing exactly how we evade Microsoft’s responsible AI controls. Wreaking havoc: how IPIs can be used in real life - Turning Microsoft Copilot into our agent of chaos IPIs are powerful, but how exactly can they be used? Here are a few which we’ll demonstrate and analyze: 1. When a user asks for a bank account we use Copilot to switch it to the wrong one (demo). 2. When a user asks for web information - we fool Copilot to give a phishing link instead (demo). 3. When a user asks to summarize their emails - we fool Copilot into sending sensitive data out using Bing search (demo). We can do all of this damage completely from outside the org. Without even compromising a single user account. Defense We can’t leave you completely undefended against all of the things we demonstrated in this talk. Here we’ll recommend ways to detect IPIs and highlight the necessity of a skeptic mindset when dealing with AI outputs. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/NF9TK8/ Track 1 (Dachssal) Tamir Ishay Sharbat PUBLISH CDKBSY@@cfp.bsidesvienna.at -CDKBSY Attackers Aren't Breaking In, They're Logging In: Cloud Security Asymmetry en en 20241123T113500 20241123T120000 0.02500

Attackers Aren't Breaking In, They're Logging In: Cloud Security Asymmetry

Adversaries are not “breaking in”, they are “logging into”. They are innovating, adapting their techniques to exploit the unique opportunities and vulnerabilities presented by cloud environments. This talk dives deep into the minds and methods of attackers as they navigate the shift from traditional on-premises environments to the vast, dynamic expanse of the cloud. This talk will uncover the nuanced strategies, sophisticated tools, and evolving targets of these adversaries, emphasizing their opportunistic adaptation to cloud-specific security gaps. Attendees will gain insights into the latest attack vectors that are uniquely effective in cloud environments, from exploiting misconfigurations and weak identity and access management policies to leveraging insecure APIs and manipulating cloud-native features. We will explore how attackers perceive the cloud as a fertile ground for exploitation, adapting their mindset to the cloud’s architectural complexities and the inherent challenges it poses to traditional security paradigms. Highlighting a pivotal shift, this presentation will reveal that attackers have fundamentally changed their techniques, moving away from the approaches we've known so far, necessitating that defenders undergo a similar transformation to effectively counteract these advanced threats. By highlighting real-world case studies and dissecting successful cloud breaches, this presentation aims to provide a comprehensive understanding of the attacker's perspective, revealing how their approaches shift in response to cloud adoption. Attendees will leave with a profound understanding of the critical need for cloud-native security strategies and the knowledge to anticipate, identify, and defend against the sophisticated tactics employed by adversaries in the cloud. This talk is designed to arm cybersecurity professionals with the insights needed to fortify their cloud environments against the ever-evolving threat landscape, ensuring a proactive and resilient defense posture in the face of cloud-centric attacks. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/CDKBSY/ Track 1 (Dachssal) Roei Sherman PUBLISH GUGKXJ@@cfp.bsidesvienna.at -GUGKXJ Exposing Predator's Infrastructure: The Impact of Public Exposure and Heightened Sanctions en en 20241123T133500 20241123T140500 0.03000

Exposing Predator's Infrastructure: The Impact of Public Exposure and Heightened Sanctions

PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/GUGKXJ/ Track 1 (Dachssal) Julian-Ferdinand Vögele PUBLISH WW7JUK@@cfp.bsidesvienna.at -WW7JUK SMTP Smuggling Revisited – Still Spoofing E-mails Worldwide?! en en 20241123T141000 20241123T144000 0.03000

SMTP Smuggling Revisited – Still Spoofing E-mails Worldwide?!

1. Introduction - The talk starts with a short introduction and a brief anecdote about finding vulnerabilities. - This transitions to a short story about SMTP smuggling and how this research happened in the first place. 2. Covering the basics - Following the introduction, we’re then covering some SMTP basics, including SMTP infrastructure and some common terminology. - Based on this knowledge, we will go over SMTP smuggling theory and previous findings of the initial SMTP smuggling research, laying the foundation for further research to come. 3. Test infrastructure and analysis methods - Here, we cover the used tools and methods that make SMTP analysis possible. - This includes the SMTP analysis tools available at https://github.com/The-Login/SMTP-Smuggling-Tools. 4. Building upon SMTP smuggling - In this section, we’re going over potential theoretical SMTP attacks and attack surfaces, including: - Encoding Confusions - Line Length Breakout - Smuggling via BDAT - Smuggling dangerous/exotic SMTP commands - etc. 5. The findings - With the knowledge gained from the previous sections, we can now move on to the somewhat unexpected findings. - Instead of classic SMTP smuggling, we look at software affected by a novel type of SMTP From header spoofing, being SMTP header smuggling. - This includes e-mail services hosted by REDACTED and Apple (iCloud). 6. Conclusion - We end the session with some closing words about SMTP (smuggling) vulnerabilities. References: https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide/, https://www.youtube.com/watch?v=V8KPV96g1To, https://smtpsmuggling.com/ PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/WW7JUK/ Track 1 (Dachssal) Timo Longin PUBLISH GMKDT7@@cfp.bsidesvienna.at -GMKDT7 unexpected coffee: a dive into industrial coffee machines en en 20241123T144500 20241123T151500 0.03000

unexpected coffee: a dive into industrial coffee machines

After a few months of collecting (additional) dust and annoying a few members, we started the quest to get this machine back to work and to explore the (questionable) world of industrial coffee vending legacy, from hardware, over electronics to software architecture. This is a talk about how we repaired the machine, how these machines usually work, a dive into legacy software and electronics setups, and why those coffee vending machines taste like they do. Last but not least, we will discuss how we started to reverse engineer the internal system communication and if we would award a hackvalue of over 9000 for this type of machines. There is also the final question: does it run Doom? PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/GMKDT7/ Track 1 (Dachssal) Hetti Clemens PUBLISH H83CJX@@cfp.bsidesvienna.at -H83CJX Red Team Operations in OT: A peek behind the curtains of hacking industrial systems en en 20241123T161500 20241123T165500 0.04000

Red Team Operations in OT: A peek behind the curtains of hacking industrial systems

We will begin by outlining the fundamental differences between OT and IT security, highlighting the unique challenges and vulnerabilities present in OT systems. This foundational knowledge sets the stage for a deeper exploration of the current threat landscape within OT environments. The core of the presentation will focus on real-world case studies from our Red Team assessments. We will walk you through the methodologies we use to simulate real attacker behaviours, from initial infiltration to identifying critical vulnerabilities, all while ensuring minimal disruption to operational processes. Agenda: - Introduction: Overview of Operational Technology (OT) and Red Teaming - Distinguishing IT from OT: Key Differences and Implications - Current Threat Landscape: Emerging Threats and Vulnerabilities in OT - Red Team Operations in OT Environments: Strategies, Tools, and Techniques - Case Studies: Real-world Examples and Lessons Learned PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/H83CJX/ Track 1 (Dachssal) Sarah Mader PUBLISH ZJYRBU@@cfp.bsidesvienna.at -ZJYRBU What's the Red Team doing to my Linux Box? en en 20241123T170000 20241123T180000 1.00000

What's the Red Team doing to my Linux Box?

What _really_ happens when the Red Team ends up on a Linux box? What are they looking for? Does anybody really use `ed(1)`? Oh, then, what do they use and why? There's often quite a bit happening in that often mysterious bit between initial access (i.e. code running somewhere someone would rather it not) and the meeting to discuss findings. Turns out, though, that behind the shroud of mystery is equal parts party tricks and good old-fashioned Linuxing; no magic, superpowers, or arcane incantations necessary. In this talk we'll walk through (the fun bits of) a poking at a single server, with a twist. We'll first have a quick look at a handful of the whys behind compromising an arbitrary host, but the bulk of our time will be spent taking our initial access and turning it into full compromise without fancypants hacker tools or TTPs; in other words, we'll hack sysadmin-style. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/ZJYRBU/ Track 1 (Dachssal) Stuart McMurray PUBLISH CEY7FF@@cfp.bsidesvienna.at -CEY7FF The Dark Side of Installers: Security Flaws in macOS and Windows en en 20241123T101000 20241123T105500 0.04500

The Dark Side of Installers: Security Flaws in macOS and Windows

Discover the hidden security risks lurking within macOS (.pkg) and Windows (.msi) installer packages in this essential talk. Installer packages are crucial for software deployment but can harbour significant vulnerabilities that lead to privilege escalation and remote code execution (RCE). We’ll break down the internal structure of these installers, highlight common security flaws, and demonstrate how attackers exploit these weaknesses. Gain valuable insights into defending against these threats and protect your systems from potential breaches and avoid getting exploited. In this session we will discuss and develop our knowledge on strengthening and defenses against a critical, often-overlooked aspect of software security. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/CEY7FF/ Track 2 (3.1 (Kreativ)) Giriraj Ravichandran Naveen S PUBLISH KQZ83W@@cfp.bsidesvienna.at -KQZ83W Is an IDS any good, or how skilled is your Red Team? en en 20241123T105500 20241123T112500 0.03000

Is an IDS any good, or how skilled is your Red Team?

PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/KQZ83W/ Track 2 (3.1 (Kreativ)) Manuel Kern PUBLISH K3VPXA@@cfp.bsidesvienna.at -K3VPXA Kernel Rootkit detection with eBPF time tracing en en 20241123T113000 20241123T120000 0.03000

Kernel Rootkit detection with eBPF time tracing

Rootkits are a sophisticated class of malware. They are used in the post-exploitation phase by attackers, to maintain access and hide their tracks. Rootkits underwent an evolution on in which layer of the system they reside, from system utilities over libraries, to kernel modules and even beyond the OS in the firmware. Similarly the techniques rootkits use have evolved and complementary the the detection approaches have seen many additions and improvements. Nevertheless a rootkit running with sufficiently high permissions (e.g. in the kernel) can theoretically always defeat a detection program. Thus the development of rootkits and respective detection is a tireless arms race. I will give an overview of rootkit types and go a bit into depth on how kernel rootkits work. Then I will show that there are actually only a few places in the Linux kernel where a rootkit can gain rootkit functionality. With this knowledge I will show how to design time measuring probes with eBPF that can catch the rootkits actions by the delays that it causes. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/K3VPXA/ Track 2 (3.1 (Kreativ)) Leo PUBLISH 97VDHJ@@cfp.bsidesvienna.at -97VDHJ Cyber Range Fails: Lessons learned from building Defensive Labs en en 20241123T133500 20241123T140500 0.03000

Cyber Range Fails: Lessons learned from building Defensive Labs

I've been creating cyber ranges for a year. It turned out to be a non-trivial task. The talk will be divided into four sections: 1. What is a Cyber Range?: I will explain the concept of a cyber range and review popular solutions like GOAD and CI-CD Goat, focusing on their key functions. 2. Cyber Range Architecture: I will cover the basic architecture of a typical cyber range, including components, network configurations, and integration approaches. 3. Cyber Range Fails: I will share specific problems we encountered while building a hosted cyber range, focusing on technical issues and operational mistakes. 4. Q&A. section. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/97VDHJ/ Track 2 (3.1 (Kreativ)) Kirill PUBLISH GTDZAR@@cfp.bsidesvienna.at -GTDZAR Persons who stare at Source Code. en en 20241123T141000 20241123T144000 0.03000

Persons who stare at Source Code.

PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/GTDZAR/ Track 2 (3.1 (Kreativ)) Martin Haunschmid PUBLISH LJ9BFA@@cfp.bsidesvienna.at -LJ9BFA ART is beautiful, but it takes a lot of work en en 20241123T144500 20241123T151500 0.03000

ART is beautiful, but it takes a lot of work

Is this a security talk? Not directly, but it’s not not a security talk. It’s a fun(damentals) talk. The first step to hacking is understanding something, and the Android Runtime has a steep learning curve. This talk is an introduction to make it easier for others to explore the internals of the Android Runtime. Sharing is caring, after all. Because the Android ecosystem is “mostly” open and documentation changes without notice under your feet, this is also a ranty talk to vent some frustration productively. It will cover a brief history from the DalvikVM to ART and the changes under the hood. We’ll see the ART components, such as libart and dex2oat, and what code runs when the zygote starts, which spawns all app processes. We’ll also learn what compilation profiles are and how to get them (it’s free aggregated usage data, after all). Finally, the talk will showcase what the seclab.wien is working on to make the ART work for security and privacy research. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/LJ9BFA/ Track 2 (3.1 (Kreativ)) Jakob Bleier PUBLISH WEERXD@@cfp.bsidesvienna.at -WEERXD Anti, Anti Automation en en 20241123T161500 20241123T170000 0.04500

Anti, Anti Automation

In today’s digital environment, anti-automation controls are essential for protecting online systems from misuse and abuse. However, just as quickly as these defenses evolve, so do the techniques to bypass them. This session offers a comprehensive look into the world of anti-automation, starting with the basics of how these controls are designed and implemented. We’ll then delve into the methods attackers use to overcome these barriers, showcasing the tools and strategies employed in real-world scenarios. Whether you’re a cybersecurity professional, developer, or simply interested in the dynamics of automation defense, this talk will provide valuable insights into the ongoing challenge of balancing security and accessibility in the face of ever-evolving threats. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/WEERXD/ Track 2 (3.1 (Kreativ)) Alex Archondakis PUBLISH HBEFDF@@cfp.bsidesvienna.at -HBEFDF The monster in your basement: Security risks of CI/CD systems en en 20241123T170500 20241123T175000 0.04500

The monster in your basement: Security risks of CI/CD systems

This talk starts by elaborating why we even want and need CI systems in the first place, in order to build up the stage for the inherent security risks. Those are outlined based on the new "OWASP Top 10 CI/CD Security Risks" list and augmented by recounting "war stories" from real world security assessments an breaches of CI systems. Finally, a live demonstration shows, how easy an attacker can gain access to your build infrastructure via a malicious container image. Content warning: You might be a lot more nervous about your dev environment when you return to work on monday. PUBLIC CONFIRMED Talk https://cfp.bsidesvienna.at/bsv2024/talk/HBEFDF/ Track 2 (3.1 (Kreativ)) Mathias Tausig