ThinkstScapes Research Roundup - Q4 - 2023

LLMs ain't making life any easierAbusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMsTsung-Yin Hsieh, Ben Nassi, Vitaly Shmatikov, and Eugene Bagdasaryan[Slides] [Paper] [Code]Tree of Attacks: Jailbreaking Black-Box LLMs AutomaticallyAnay Mehrotra, Manolis Zampetakis, Paul Kassianik, Blaine Nelson, Hyrum Anderson, Yaron Singer, and Amin Karbasi[Paper] [Code]Avoiding the basilisk's fangs: State-of-the-art in AI LLM detectionJacob Torrey[Slides] [Code] [Video]Dystopian much: The Rise of the Influence MachinesNea Paw[Blog] [Video]Problems in well-trodden areasSMTP Smuggling – Spoofing E-mails WorldwideTimo Longin[Blog] [Video]Blind CSS Exfiltration: Exfiltrate unknown web pagesGareth Heyes[Slides] [Blog] [Code]OLE object are still dangerous today – Exploiting Microsoft Officewh1tc and Zhiniang Peng[Slides] [Demo Videos]The Nightmare of Apple’s OTA UpdateMickey Jin[Slides] [Blog] [Video]Reflecting on our effortsEvaluating the Security Posture of Real-World FIDO2 DeploymentsDhruv Kuchhal, Muhammad Saad, Adam Oest, and Frank Li[Paper]Talking about Pros and ConsJacob Torrey[Slides] [Video]NCC Group’s 2022 & 2023 Research ReportNCC Group[Paper] [Blog]A 3-Year Tale of Hacking a Pwn2Own Target: The Attacks, Vendor Evolution, and Lessons LearnedOrange Tsai[Slides] [Video]Nifty sundriesBreaking "DRM" in Polish trainsMrTick, Redford, and q3k[Video]Detection and Blocking with BPF via YAMLKevin Sheldrake[Slides] [Code]AntiFake: Using Adversarial Audio to Prevent Unauthorized Speech SynthesisZhiyuan Yu, Shixuan Zhai, and Ning Zhang[Paper] [Code]A Good Fishman Knows All the Angles: A Critical Evaluation of Google's Phishing Page ClassifierChangqing Miao, Jianan Feng, Wei You, Wenchang Shi, Jianjun Huang, and Bin Liang[Paper] [Code]Spoofing DNS Records by Abusing DHCP DNS Dynamic UpdatesOri David[Blog] [Code] Operation Triangulation: What You Get When Attack iPhones of ResearchersBoris Larin, Leonid Bezvershenko, and Georgy Kucherin[Blog] [Video]Password-Stealing without Hacking: Wi-Fi Enabled Practical Keystroke EavesdroppingJingyang Hu, Hongbo Wang, Tianyue Zheng, Jingzhi Hu, Zhe Chen, Hongbo Jiang, and Jun Luo[Paper] [Code]