ThinkstScapes Research Roundup - Q4 - 2023

LLMs ain't making life any easier

Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs

Tsung-Yin Hsieh, Ben Nassi, Vitaly Shmatikov, and Eugene Bagdasaryan

[Slides] [Paper] [Code]

Tree of Attacks: Jailbreaking Black-Box LLMs Automatically

Anay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi

[Paper] [Code]

Avoiding the basilisk's fangs: State-of-the-art in AI LLM detection

Jacob Torrey

[Slides] [Code] [Video]

Dystopian much: The Rise of the Influence Machines

Nea Paw

[Blog] [Video]

Problems in well-trodden areas

SMTP Smuggling – Spoofing E-mails Worldwide

Timo Longin

[Blog] [Video]

Blind CSS Exfiltration: Exfiltrate unknown web pages

Gareth Heyes

[Slides] [Blog] [Code]

OLE object are still dangerous today – Exploiting Microsoft Office

wh1tc and Zhiniang Peng

[Slides] [Demo Videos]

The Nightmare of Apple’s OTA Update

Mickey Jin

[Slides] [Blog] [Video]

Reflecting on our efforts

Evaluating the Security Posture of Real-World FIDO2 Deployments

Dhruv Kuchhal, Muhammad Saad, Adam Oest, and Frank Li

[Paper]

Talking about Pros and Cons

Jacob Torrey

[Slides] [Video]

NCC Group’s 2022 & 2023 Research Report

NCC Group

[Paper] [Blog]

A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lessons Learned

Orange Tsai

[Slides] [Video]

Nifty sundries

Breaking "DRM" in Polish trains

MrTick, Redford, and q3k

[Video]

Detection and Blocking with BPF via YAML

Kevin Sheldrake

[Slides] [Code]

AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech Synthesis

Zhiyuan Yu, Shixuan Zhai, and Ning Zhang

[Paper] [Code]

A Good Fishman Knows All the Angles: A Critical Evaluation of Google's Phishing Page Classifier

Changqing Miao, Jianan Feng, Wei You, Wenchang Shi, Jianjun Huang, and Bin Liang

[Paper] [Code]

Spoofing DNS Records by Abusing DHCP DNS Dynamic Updates

Ori David

[Blog] [Code] 

Operation Triangulation: What You Get When Attack iPhones of Researchers

Boris Larin, Leonid Bezvershenko, and Georgy Kucherin

[Blog] [Video]

Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke Eavesdropping

Jingyang Hu, Hongbo Wang, Tianyue Zheng, Jingzhi Hu, Zhe Chen, Hongbo Jiang, and Jun Luo

[Paper] [Code]