41554 blogs · [ { "id": "01a08773-056f-730d-b534-e6a59df4dfba", "title": "LLM Apps: Don't Get Stuck in an Infinite Loop! 💵💰", "url": "https://embracethered.com/blog/posts/2023/llm-cost-and-dos-threat/", "published_at": "2023-09-16T07:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a59eacc5ec", "title": "Video: Data Exfiltration Vulnerabilities in LLM apps (Bing Chat, ChatGPT, Claude)", "url": "https://embracethered.com/blog/posts/2023/video-data-exfiltration-vulns-in-llm-applictions/", "published_at": "2023-08-28T17:00:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a59f814a6b", "title": "Anthropic Claude Data Exfiltration Vulnerability Fixed", "url": "https://embracethered.com/blog/posts/2023/anthropic-fixes-claude-data-exfiltration-via-images/", "published_at": "2023-08-01T22:15:15+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a075bf90", "title": "ChatGPT Custom Instructions: Persistent Data Exfiltration Demo", "url": "https://embracethered.com/blog/posts/2023/chatgpt-custom-instruction-post-exploitation-data-exfiltration/", "published_at": "2023-07-24T14:26:41+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a0cb9142", "title": "Image to Prompt Injection with Google Bard", "url": "https://embracethered.com/blog/posts/2023/google-bard-image-to-prompt-injection/", "published_at": "2023-07-14T16:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a1ac9eb9", "title": "Google Docs AI Features: Vulnerabilities and Risks", "url": "https://embracethered.com/blog/posts/2023/google-docs-ai-scam/", "published_at": "2023-07-12T21:30:17+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a259325b", "title": "OpenAI Removes the \"Chat with Code\" Plugin From Store", "url": "https://embracethered.com/blog/posts/2023/chatgpt-chat-with-code-plugin-take-down/", "published_at": "2023-07-06T23:30:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a3374e09", "title": "Plugin Vulnerabilities: Visit a Website and Have Your Source Code Stolen", "url": "https://embracethered.com/blog/posts/2023/chatgpt-plugin-vulns-chat-with-code/", "published_at": "2023-06-20T15:00:22+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a3ad74bf", "title": "Bing Chat: Data Exfiltration Exploit Explained", "url": "https://embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/", "published_at": "2023-06-18T07:01:02+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a3c80e2a", "title": "Exploit ChatGPT and Enter the Matrix to Learn about AI Security", "url": "https://embracethered.com/blog/posts/2023/chatgpt-vulns-enter-the-matrix/", "published_at": "2023-06-11T15:49:21+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a43406f3", "title": "ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data", "url": "https://embracethered.com/blog/posts/2023/chatgpt-cross-plugin-request-forgery-and-prompt-injection./", "published_at": "2023-05-28T19:00:02+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a5066e62", "title": "ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery", "url": "https://embracethered.com/blog/posts/2023/chatgpt-webpilot-data-exfil-via-markdown-injection/", "published_at": "2023-05-16T14:45:38+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a52db0dd", "title": "Indirect Prompt Injection via YouTube Transcripts", "url": "https://embracethered.com/blog/posts/2023/chatgpt-plugin-youtube-indirect-prompt-injection/", "published_at": "2023-05-14T07:01:38+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a5dcd197", "title": "Adversarial Prompting: Tutorial and Lab", "url": "https://embracethered.com/blog/posts/2023/adversarial-prompting-tutorial-and-lab/", "published_at": "2023-05-12T05:09:43+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a5f1bb14", "title": "Video: Prompt Injections - An Introduction", "url": "https://embracethered.com/blog/posts/2023/prompt-injection-an-introduction-video/", "published_at": "2023-05-10T14:00:40+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a6c49c36", "title": "MLSecOps Podcast: AI Red Teaming and Threat Modeling Machine Learning Systems", "url": "https://embracethered.com/blog/posts/2023/mlsecops-podcast-ai-red-teaming/", "published_at": "2023-04-28T03:59:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a7bd7cd4", "title": "Don't blindly trust LLM responses. Threats to chatbots.", "url": "https://embracethered.com/blog/posts/2023/ai-injections-threats-context-matters/", "published_at": "2023-04-16T01:09:46+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a85ad496", "title": "AI Injections: Direct and Indirect Prompt Injections and Their Implications", "url": "https://embracethered.com/blog/posts/2023/ai-injections-direct-and-indirect-prompt-injection-basics/", "published_at": "2023-03-30T03:26:31+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a8970321", "title": "Bing Chat claims to have robbed a bank and it left no trace", "url": "https://embracethered.com/blog/posts/2023/bing-chat-bank-robbery/", "published_at": "2023-03-26T23:55:21+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5a95c3925", "title": "Yolo: Natural Language to Shell Commands with ChatGPT API", "url": "https://embracethered.com/blog/posts/2023/yolo-natural-language-to-bash-command-with-chatgpt-api/", "published_at": "2023-03-06T01:31:58+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5aa51f1f8", "title": "Video Tutorial: Hijacking SSH Agent", "url": "https://embracethered.com/blog/posts/2023/video-hijacking-ssh-agent/", "published_at": "2023-01-25T17:31:58+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5aaebc7d9", "title": "Decrypting TLS browser traffic with Wireshark", "url": "https://embracethered.com/blog/posts/2023/decrypt-wireshark-traffic-https-netsh/", "published_at": "2023-01-04T14:36:05+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ab785528", "title": "ChatGPT: Imagine you are a database server", "url": "https://embracethered.com/blog/posts/2022/chatgpt-imagine-you-are-a-database/", "published_at": "2022-12-02T16:41:49+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5abbc6930", "title": "Device Code Phishing Attacks", "url": "https://embracethered.com/blog/posts/2022/device-code-phishing/", "published_at": "2022-11-21T14:00:33+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5abd3d190", "title": "Ropci deep-dive for Azure hackers", "url": "https://embracethered.com/blog/posts/2022/ropci-usage/", "published_at": "2022-11-21T01:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ac3f2e60", "title": "PenTest Magazine Open Source Toolkit: ropci", "url": "https://embracethered.com/blog/posts/2022/ropci-pentest-magazine-open-source-tools/", "published_at": "2022-10-20T16:00:10+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ac71f6eb", "title": "ROPC - So, you think you have MFA?", "url": "https://embracethered.com/blog/posts/2022/ropci-so-you-think-you-have-mfa-azure-ad/", "published_at": "2022-10-20T15:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ad14e459", "title": "TTP Diaries: SSH Agent Hijacking", "url": "https://embracethered.com/blog/posts/2022/ttp-diaries-ssh-agent-hijacking/", "published_at": "2022-10-16T18:30:29+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ad3b03d5", "title": "gospray - Simple LDAP bind-based password spray tool", "url": "https://embracethered.com/blog/posts/2022/gospray-active-directory-ldap-password-spraying/", "published_at": "2022-09-18T15:00:01+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ad940574", "title": "Malicious Python Packages and Code Execution via pip download", "url": "https://embracethered.com/blog/posts/2022/python-package-manager-install-and-download-vulnerability/", "published_at": "2022-09-09T23:30:29+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ae441fcc", "title": "Machine Learning Attack Series: Backdooring Pickle Files", "url": "https://embracethered.com/blog/posts/2022/machine-learning-attack-series-injecting-code-pickle-files/", "published_at": "2022-08-29T03:10:44+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5aece7d22", "title": "Offensive BPF: Using bpftrace to sniff PAM logon passwords", "url": "https://embracethered.com/blog/posts/2022/offensive-bpf-bpftrace-sniff-logon-pam-passwords/", "published_at": "2022-07-11T03:00:13+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5af4d4a31", "title": "Post Exploitation: Sniffing Logon Passwords with PAM", "url": "https://embracethered.com/blog/posts/2022/post-exploit-pam-ssh-password-grabbing/", "published_at": "2022-06-27T06:50:18+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5afdddfef", "title": "Customized Hacker Shell Prompts", "url": "https://embracethered.com/blog/posts/2022/hacker-shell-prompts/", "published_at": "2022-05-28T21:00:54+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b01fcb62", "title": "GPT-3 and Phishing Attacks", "url": "https://embracethered.com/blog/posts/2022/gpt-3-ai-and-phishing-attacks/", "published_at": "2022-04-11T15:00:43+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b0c6add0", "title": "Grabbing and cracking macOS hashes", "url": "https://embracethered.com/blog/posts/2022/grabbing-and-cracking-macos-hashes/", "published_at": "2022-04-03T17:46:07+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b11917f4", "title": "Flipper Zero - Initial Thoughts", "url": "https://embracethered.com/blog/posts/2022/flipper-zero-intro/", "published_at": "2022-03-19T06:58:26+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b188eeac", "title": "AWS Scaled Command Bash Script - Run AWS commands for many profiles", "url": "https://embracethered.com/blog/posts/2022/aws-scaled-command/", "published_at": "2022-03-12T18:42:14+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b1bac296", "title": "Gitlab Reconnaissance Introduction", "url": "https://embracethered.com/blog/posts/2022/hacking-gitlab-servers/", "published_at": "2022-02-28T11:22:22+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b290cc6a", "title": "Log4Shell and Request Forgery Attacks", "url": "https://embracethered.com/blog/posts/2022/log4shell-and-request-forgery-attacks/", "published_at": "2022-01-04T23:18:18+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b316b0ab", "title": "Video: Anatomy of a compromise", "url": "https://embracethered.com/blog/posts/2021/video-anatomy-of-a-compromise/", "published_at": "2021-11-08T15:10:12+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b396fbd4", "title": "Offensive BPF: Understanding and using bpf_probe_write_user", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-libbpf-bpf_probe_write_user/", "published_at": "2021-10-20T07:04:40+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b4712015", "title": "Offensive BPF: Sniffing Firefox traffic with bpftrace", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-sniffing-traffic-bpftrace/", "published_at": "2021-10-14T07:10:16+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b536eeaa", "title": "Video: Understanding Image Scaling Attacks", "url": "https://embracethered.com/blog/posts/2021/video-image-scaling-attacks/", "published_at": "2021-10-12T07:02:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b5eeee34", "title": "Video: What is Tabnabbing?", "url": "https://embracethered.com/blog/posts/2021/what-is-tab-nabbing/", "published_at": "2021-10-10T17:10:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b626a78c", "title": "Offensive BPF: What's in the bpfcc-tools box?", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-handy-tools/", "published_at": "2021-10-09T21:00:59+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b643634e", "title": "Offensive BPF: Detection Ideas", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-detections-initial-ideas/", "published_at": "2021-10-07T15:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b6be5a58", "title": "Offensive BPF: Using bpftrace to host backdoors", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace-message-based/", "published_at": "2021-10-07T03:00:13+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b7446b3d", "title": "Offensive BPF: Malicious bpftrace 🤯", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf-bpftrace/", "published_at": "2021-10-05T15:00:58+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b840c194", "title": "Offensive BPF! Getting started.", "url": "https://embracethered.com/blog/posts/2021/offensive-bpf/", "published_at": "2021-09-30T07:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b92b22b4", "title": "Video: Web Application Security Fundamentals", "url": "https://embracethered.com/blog/posts/2021/web-application-security-fundamentals-video/", "published_at": "2021-09-06T15:02:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5b999f061", "title": "Backdoor users on Linux with uid=0", "url": "https://embracethered.com/blog/posts/2021/linux-user-uid-zero-backdoor/", "published_at": "2021-08-30T16:22:40+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ba2fd7c4", "title": "Using Microsoft Counterfit to create adversarial examples for Husky AI", "url": "https://embracethered.com/blog/posts/2021/huskyai-using-azure-counterfit/", "published_at": "2021-08-16T17:00:26+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bafc42f0", "title": "Using procdump on Linux to dump credentials", "url": "https://embracethered.com/blog/posts/2021/linux-procdump/", "published_at": "2021-08-09T17:00:20+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bb904d05", "title": "The Silver Searcher - search through code and files quickly", "url": "https://embracethered.com/blog/posts/2021/silversearcher-ag/", "published_at": "2021-07-28T18:44:20+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bc0a810e", "title": "Automating Microsoft Office to Achieve Red Teaming Objectives", "url": "https://embracethered.com/blog/posts/2021/automating-office-to-achieve-redteaming-objectives/", "published_at": "2021-07-05T20:00:54+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bc659053", "title": "Airtag hacks - scanning via browser, removing speaker and data exfiltration", "url": "https://embracethered.com/blog/posts/2021/airtag-hacks/", "published_at": "2021-06-28T15:00:52+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bd2dee3b", "title": "Somewhere today a company is breached", "url": "https://embracethered.com/blog/posts/2021/somewhere-today-a-company-is-breached/", "published_at": "2021-06-09T15:30:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bd3c4592", "title": "Google's FLoC - Privacy Red Teaming Opportunities", "url": "https://embracethered.com/blog/posts/2021/red-teaming-floc-chrome-cohort/", "published_at": "2021-05-01T17:10:08+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bda1b1c4", "title": "Spoofing credential dialogs on macOS, Linux and Windows", "url": "https://embracethered.com/blog/posts/2021/spoofing-credential-dialogs/", "published_at": "2021-04-19T03:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bdc439f3", "title": "Broken NFT standards", "url": "https://embracethered.com/blog/posts/2021/broken-nft-standards/", "published_at": "2021-03-19T17:16:02+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5be0f2bda", "title": "Hong Kong InfoSec Summit 2021 Talk - The adversary will come to your house!", "url": "https://embracethered.com/blog/posts/2021/talk-information-security-summit-hong-kong/", "published_at": "2021-03-03T19:37:20+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5beedcaf6", "title": "An alternative perspective on the death of manual red teaming", "url": "https://embracethered.com/blog/posts/2021/red-team-automation/", "published_at": "2021-02-08T19:00:20+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bf606836", "title": "Cybersecurity Attacks - Red Team Strategies Kindle Edition for free", "url": "https://embracethered.com/blog/posts/2021/red-team-strategies-ebook-free/", "published_at": "2021-02-04T16:00:12+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5bf62d881", "title": "Team A and Team B: Sunburst, Teardrop and Raindrop", "url": "https://embracethered.com/blog/posts/2021/sunburst-team-a-team-b/", "published_at": "2021-02-02T18:35:43+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c0445f54", "title": "Survivorship Bias and Red Teaming", "url": "https://embracethered.com/blog/posts/2021/survivorship-bias-and-red-teaming/", "published_at": "2021-01-22T20:00:34+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c0ab53fd", "title": "Gamifying Security with Red Team Scores", "url": "https://embracethered.com/blog/posts/2021/gamifying-red-team-security-score/", "published_at": "2021-01-11T17:00:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c16e589a", "title": "Actively protecting pen testers and pen testing assets", "url": "https://embracethered.com/blog/posts/2020/protecting-the-pentester/", "published_at": "2020-12-08T23:02:22+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c1b5c613", "title": "Machine Learning Attack Series: Overview", "url": "https://embracethered.com/blog/posts/2020/machine-learning-attack-series-overview/", "published_at": "2020-11-26T17:00:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c23eb338", "title": "Machine Learning Attack Series: Generative Adversarial Networks (GANs)", "url": "https://embracethered.com/blog/posts/2020/machine-learning-attack-series-generative-adversarial-networks-gan/", "published_at": "2020-11-26T03:55:15+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c2e7c4ab", "title": "Assuming Bias and Responsible AI", "url": "https://embracethered.com/blog/posts/2020/machine-learning-attack-series-assume-bias-strategy/", "published_at": "2020-11-24T22:00:50+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c30012e6", "title": "Abusing Application Layer Gateways (NAT Slipstreaming)", "url": "https://embracethered.com/blog/posts/2020/nat-slipstreaming-simplified/", "published_at": "2020-11-24T07:00:57+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c3bf3b4b", "title": "Machine Learning Attack Series: Repudiation Threat and Auditing", "url": "https://embracethered.com/blog/posts/2020/husky-ai-repudiation-threat-deny-action-machine-learning/", "published_at": "2020-11-10T23:00:21+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c433cf06", "title": "Video: Building and breaking a machine learning system", "url": "https://embracethered.com/blog/posts/2020/learning-by-doing-building-and-breaking-machine-learning-red-team-hacking/", "published_at": "2020-11-05T23:30:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c50e8239", "title": "Machine Learning Attack Series: Image Scaling Attacks", "url": "https://embracethered.com/blog/posts/2020/husky-ai-image-rescaling-attacks/", "published_at": "2020-10-28T20:00:27+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c51fb2bb", "title": "Leveraging the Blue Team's Endpoint Agent as C2", "url": "https://embracethered.com/blog/posts/2020/red-teaming-endpoint-protection-agent-edr/", "published_at": "2020-10-26T13:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c542970a", "title": "Machine Learning Attack Series: Adversarial Robustness Toolbox Basics", "url": "https://embracethered.com/blog/posts/2020/husky-ai-adversarial-robustness-toolbox-testing/", "published_at": "2020-10-22T22:00:48+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c57df9b3", "title": "Hacking neural networks - so we don't get stuck in the matrix", "url": "https://embracethered.com/blog/posts/2020/hacking-the-matrix/", "published_at": "2020-10-20T19:00:41+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c637b9b9", "title": "What does an offensive security team actually do?", "url": "https://embracethered.com/blog/posts/2020/red-team-offensive-security-service-offerings/", "published_at": "2020-10-20T03:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c736273b", "title": "CVE 2020-16977: VS Code Python Extension Remote Code Execution", "url": "https://embracethered.com/blog/posts/2020/cve-2020-16977-vscode-microsoft-python-extension-remote-code-execution/", "published_at": "2020-10-14T17:35:02+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c7ddd795", "title": "Machine Learning Attack Series: Stealing a model file", "url": "https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-model-stealing/", "published_at": "2020-10-10T12:50:21+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c8b5291a", "title": "Coming up: Grayhat Red Team Village talk about hacking a machine learning system", "url": "https://embracethered.com/blog/posts/2020/accouncement-learning-by-doing-hacking-machine-lerning-grayhat/", "published_at": "2020-10-09T18:30:50+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5c98af021", "title": "Beware of the Shadowbunny - Using virtual machines to persist and evade detections", "url": "https://embracethered.com/blog/posts/2020/shadowbunny-virtual-machine-red-teaming-technique/", "published_at": "2020-09-24T03:00:51+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ca74923d", "title": "Participating in the Microsoft Machine Learning Security Evasion Competition - Bypassing malware models by signing binaries", "url": "https://embracethered.com/blog/posts/2020/microsoft-machine-learning-security-evasion-competition/", "published_at": "2020-09-22T21:00:41+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cb6bbb60", "title": "Machine Learning Attack Series: Backdooring models", "url": "https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-backdoor-model/", "published_at": "2020-09-18T21:59:47+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cc44804f", "title": "Machine Learning Attack Series: Perturbations to misclassify existing images", "url": "https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-attack-perturbation-external/", "published_at": "2020-09-16T19:00:05+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cc9ff481", "title": "Machine Learning Attack Series: Smart brute forcing", "url": "https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-attack-smart-fuzz/", "published_at": "2020-09-13T16:04:09+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cd82527b", "title": "Machine Learning Attack Series: Brute forcing images to find incorrect predictions", "url": "https://embracethered.com/blog/posts/2020/husky-ai-machine-learning-attack-bruteforce/", "published_at": "2020-09-09T18:18:09+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cda8048e", "title": "Threat modeling a machine learning system", "url": "https://embracethered.com/blog/posts/2020/husky-ai-threat-modeling-machine-learning/", "published_at": "2020-09-06T07:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ce2ab654", "title": "MLOps - Operationalizing the machine learning model", "url": "https://embracethered.com/blog/posts/2020/husky-ai-mlops-operationalize-the-model/", "published_at": "2020-09-05T15:00:14+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5ce5909b9", "title": "Husky AI: Building a machine learning system", "url": "https://embracethered.com/blog/posts/2020/husky-ai-building-the-machine-learning-model/", "published_at": "2020-09-04T19:04:29+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cee206f3", "title": "The machine learning pipeline and attacks", "url": "https://embracethered.com/blog/posts/2020/husky-ai-walkthrough/", "published_at": "2020-09-02T19:04:29+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cfbf9e01", "title": "Getting the hang of machine learning", "url": "https://embracethered.com/blog/posts/2020/machine-learning-basics/", "published_at": "2020-09-02T01:00:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cfd2958c", "title": "Beware of the Shadowbunny! at BSides Singapore", "url": "https://embracethered.com/blog/posts/2020/shadowbunny-bsides-singapore-virtual-machines/", "published_at": "2020-08-28T07:00:01+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5cfdadd19", "title": "Race conditions when applying ACLs", "url": "https://embracethered.com/blog/posts/2020/applying-acls-and-race-conditions/", "published_at": "2020-08-24T20:00:33+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5d0aeef10", "title": "Red Teaming Telemetry Systems", "url": "https://embracethered.com/blog/posts/2020/attacking-telemetry-and-machine-learning/", "published_at": "2020-08-12T20:28:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5d119615c", "title": "Illusion of Control: Capability Maturity Models and Red Teaming", "url": "https://embracethered.com/blog/posts/2020/capability-maturity-model-test-red-teaming/", "published_at": "2020-07-31T19:08:00+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5d1487507", "title": "Motivated Intruder - Red Teaming for Privacy!", "url": "https://embracethered.com/blog/posts/2020/red-teaming-for-privacy/", "published_at": "2020-07-24T17:00:16+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5d23eae47", "title": "Firefox - Debugger Client for Cookie Access", "url": "https://embracethered.com/blog/posts/2020/firefox-cookie-debug-client/", "published_at": "2020-07-21T18:00:15+00:00" }, { "id": "01a08773-056f-730d-b534-e6a5d283ffa5", "title": "Remotely debugging Firefox instances", "url": "https://embracethered.com/blog/posts/2020/cookies-on-firefox/", "published_at": "2020-07-15T13:00:00+00:00" } ] posts Claim your blog

Back to embracethered.com

Blog · corpus.blog/blogs/embracethered.com/posts

embracethered.com

embracethered.com

2023

LLM Apps: Don't Get Stuck in an Infinite Loop! 💵💰original ↗

16 Sept 2023

Video: Data Exfiltration Vulnerabilities in LLM apps (Bing Chat, ChatGPT, Claude)original ↗

28 Aug 2023

Anthropic Claude Data Exfiltration Vulnerability Fixed original ↗

1 Aug 2023

ChatGPT Custom Instructions: Persistent Data Exfiltration Demo original ↗

24 Jul 2023

Image to Prompt Injection with Google Bard original ↗

14 Jul 2023

Google Docs AI Features: Vulnerabilities and Risks original ↗

12 Jul 2023

OpenAI Removes the "Chat with Code" Plugin From Store original ↗

6 Jul 2023

Plugin Vulnerabilities: Visit a Website and Have Your Source Code Stolen original ↗

20 Jun 2023

Bing Chat: Data Exfiltration Exploit Explained original ↗

18 Jun 2023

Exploit ChatGPT and Enter the Matrix to Learn about AI Security original ↗

11 Jun 2023

ChatGPT Plugin Exploit Explained: From Prompt Injection to Accessing Private Data original ↗

28 May 2023

ChatGPT Plugins: Data Exfiltration via Images & Cross Plugin Request Forgery original ↗

16 May 2023

Indirect Prompt Injection via YouTube Transcripts original ↗

14 May 2023

Adversarial Prompting: Tutorial and Lab original ↗

12 May 2023

Video: Prompt Injections - An Introduction original ↗

10 May 2023

MLSecOps Podcast: AI Red Teaming and Threat Modeling Machine Learning Systems original ↗

28 Apr 2023

Don't blindly trust LLM responses. Threats to chatbots.original ↗

16 Apr 2023

AI Injections: Direct and Indirect Prompt Injections and Their Implications original ↗

30 Mar 2023

Bing Chat claims to have robbed a bank and it left no trace original ↗

26 Mar 2023

Yolo: Natural Language to Shell Commands with ChatGPT API original ↗

6 Mar 2023

Video Tutorial: Hijacking SSH Agent original ↗

25 Jan 2023

Decrypting TLS browser traffic with Wireshark original ↗

4 Jan 2023

2022

ChatGPT: Imagine you are a database server original ↗

2 Dec 2022

Device Code Phishing Attacks original ↗

21 Nov 2022

Ropci deep-dive for Azure hackers original ↗

21 Nov 2022

PenTest Magazine Open Source Toolkit: ropci original ↗

20 Oct 2022

ROPC - So, you think you have MFA?original ↗

20 Oct 2022

TTP Diaries: SSH Agent Hijacking original ↗

16 Oct 2022

gospray - Simple LDAP bind-based password spray tool original ↗

18 Sept 2022

Malicious Python Packages and Code Execution via pip download original ↗

9 Sept 2022

Machine Learning Attack Series: Backdooring Pickle Files original ↗

29 Aug 2022

Offensive BPF: Using bpftrace to sniff PAM logon passwords original ↗

11 Jul 2022

Post Exploitation: Sniffing Logon Passwords with PAM original ↗

27 Jun 2022

Customized Hacker Shell Prompts original ↗

28 May 2022

GPT-3 and Phishing Attacks original ↗

11 Apr 2022

Grabbing and cracking macOS hashes original ↗

3 Apr 2022

Flipper Zero - Initial Thoughts original ↗

19 Mar 2022

AWS Scaled Command Bash Script - Run AWS commands for many profiles original ↗

12 Mar 2022

Gitlab Reconnaissance Introduction original ↗

28 Feb 2022

Log4Shell and Request Forgery Attacks original ↗

4 Jan 2022

2021

Video: Anatomy of a compromise original ↗

8 Nov 2021

Offensive BPF: Understanding and using bpf_probe_write_user original ↗

20 Oct 2021

Offensive BPF: Sniffing Firefox traffic with bpftrace original ↗

14 Oct 2021

Video: Understanding Image Scaling Attacks original ↗

12 Oct 2021

Video: What is Tabnabbing?original ↗

10 Oct 2021

Offensive BPF: What's in the bpfcc-tools box?original ↗

9 Oct 2021

Offensive BPF: Detection Ideas original ↗

7 Oct 2021

Offensive BPF: Using bpftrace to host backdoors original ↗

7 Oct 2021

Offensive BPF: Malicious bpftrace 🤯original ↗

5 Oct 2021

Offensive BPF! Getting started.original ↗

30 Sept 2021

Video: Web Application Security Fundamentals original ↗

6 Sept 2021

Backdoor users on Linux with uid=0 original ↗

30 Aug 2021

Using Microsoft Counterfit to create adversarial examples for Husky AI original ↗

16 Aug 2021

Using procdump on Linux to dump credentials original ↗

9 Aug 2021

The Silver Searcher - search through code and files quickly original ↗

28 Jul 2021

Automating Microsoft Office to Achieve Red Teaming Objectives original ↗

5 Jul 2021

Airtag hacks - scanning via browser, removing speaker and data exfiltration original ↗

28 Jun 2021

Somewhere today a company is breached original ↗

9 Jun 2021

Google's FLoC - Privacy Red Teaming Opportunities original ↗

1 May 2021

Spoofing credential dialogs on macOS, Linux and Windows original ↗

19 Apr 2021

Broken NFT standards original ↗

19 Mar 2021

Hong Kong InfoSec Summit 2021 Talk - The adversary will come to your house!original ↗

3 Mar 2021

An alternative perspective on the death of manual red teaming original ↗

8 Feb 2021

Cybersecurity Attacks - Red Team Strategies Kindle Edition for free original ↗

4 Feb 2021

Team A and Team B: Sunburst, Teardrop and Raindrop original ↗

2 Feb 2021

Survivorship Bias and Red Teaming original ↗

22 Jan 2021

Gamifying Security with Red Team Scores original ↗

11 Jan 2021

2020

Actively protecting pen testers and pen testing assets original ↗

8 Dec 2020

Machine Learning Attack Series: Overview original ↗

26 Nov 2020

Machine Learning Attack Series: Generative Adversarial Networks (GANs)original ↗

26 Nov 2020

Assuming Bias and Responsible AI original ↗

24 Nov 2020

Abusing Application Layer Gateways (NAT Slipstreaming)original ↗

24 Nov 2020

Machine Learning Attack Series: Repudiation Threat and Auditing original ↗

10 Nov 2020

Video: Building and breaking a machine learning system original ↗

5 Nov 2020

Machine Learning Attack Series: Image Scaling Attacks original ↗

28 Oct 2020

Leveraging the Blue Team's Endpoint Agent as C2 original ↗

26 Oct 2020

Machine Learning Attack Series: Adversarial Robustness Toolbox Basics original ↗

22 Oct 2020

Hacking neural networks - so we don't get stuck in the matrix original ↗

20 Oct 2020

What does an offensive security team actually do?original ↗

20 Oct 2020

CVE 2020-16977: VS Code Python Extension Remote Code Execution original ↗

14 Oct 2020

Machine Learning Attack Series: Stealing a model file original ↗

10 Oct 2020

Coming up: Grayhat Red Team Village talk about hacking a machine learning system original ↗

9 Oct 2020

Beware of the Shadowbunny - Using virtual machines to persist and evade detections original ↗

24 Sept 2020

Participating in the Microsoft Machine Learning Security Evasion Competition - Bypassing malware models by signing binaries original ↗

22 Sept 2020

Machine Learning Attack Series: Backdooring models original ↗

18 Sept 2020

Machine Learning Attack Series: Perturbations to misclassify existing images original ↗

16 Sept 2020

Machine Learning Attack Series: Smart brute forcing original ↗

13 Sept 2020

Machine Learning Attack Series: Brute forcing images to find incorrect predictions original ↗

9 Sept 2020

Threat modeling a machine learning system original ↗

6 Sept 2020

MLOps - Operationalizing the machine learning model original ↗

5 Sept 2020

Husky AI: Building a machine learning system original ↗

4 Sept 2020

The machine learning pipeline and attacks original ↗

2 Sept 2020

Getting the hang of machine learning original ↗

2 Sept 2020

Beware of the Shadowbunny! at BSides Singapore original ↗

28 Aug 2020

Race conditions when applying ACLs original ↗

24 Aug 2020

Red Teaming Telemetry Systems original ↗

12 Aug 2020

Illusion of Control: Capability Maturity Models and Red Teaming original ↗

31 Jul 2020

Motivated Intruder - Red Teaming for Privacy!original ↗

24 Jul 2020

Firefox - Debugger Client for Cookie Access original ↗

21 Jul 2020

Remotely debugging Firefox instances original ↗

15 Jul 2020