PacSec jp

PacSec is a cutting edge international security conference held in Tokyo as a series with CanSecWest, EU-SecWest & BA-Con.

[dragosr @dragosr]

It seemed appropriate for a talk on LLMs to generate my slides and images live during the presentation using a conversation with GPT-4o. The prompt to generate the points was about 25 pages of long form text to frame the content. It worked. :-)

[dragosr @dragosr]

What I'm going to be talking about in Copenhagen at the Honeynet Annual Workshop are some key security challenges associated with LLMs. Topics include various attack vectors like adversarial prompt crafting, data poisoning, model inversion, and jailbreaking techniques. We will discuss current defense mechanisms, including semantic-based filtering, real-time anomaly detection, and adaptive defense systems. The presentation also covers interdisciplinary approaches, ethical considerations, and the use of explainable AI (XAI) techniques. By examining testing methodologies, standardized datasets, and evaluation criteria, this talk aims to provide researchers and practitioners with insights to improve the robustness and resilience of LLMs against security threats.

https://t.co/uPHm8uMy0j

[Adel Ka @0x4D31]

the @ProjectHoneynet conference is happening now in copenhagen! it’s our first event since the pandemic. kicking off with @dragosr’s keynote on red teaming llms; and he’s generating slides on the fly w/ gpt-4o.

[PacSec jp @PacSecjp]

(ΦωΦ+)ﾎﾎｩ....

[dragosr @dragosr]

It seemed appropriate for a talk on LLMs to generate my slides and images live during the presentation using a conversation with GPT-4o. The prompt to generate the points was about 25 pages of long form text to frame the content. It worked. :-)

[PacSec jp @PacSecjp]

(ΦωΦ)ﾌﾌﾌ…

[dragosr @dragosr]

I just posted my list of citations from my HoneyNet Project LLM Attack and Defense talk at
https://t.co/nj6UEJinJM

If you want to catch up with what is happening in LLM security research, here is a reading list of 100 research papers to summarize with your favorite LLM.

[PacSec jp @PacSecjp]

(ΦωΦ)ﾌﾌﾌ… check out details.
https://t.co/ES1rLHDPku

[dragosr @dragosr]

We are still proceeding with our plans for the PURPLE TEST - Red Team LLM vs Blue LLM Team Competition. Delayed, but we have the contest infrastructure nearly operational, and about a dozen teams have enlisted to compete on both the blue and red side, so far, I expect more by the time we get it running smoothly. We are running the first test sessions on-line. More news will be posted as available.

[PacSec jp @PacSecjp]

(ΦωΦ)ﾌﾌﾌ… at Briefings day on 27May2024, Copenhagen Denmark.
https://t.co/YeSodKOi15

[dragosr @dragosr]

I'm going to be giving a presentation on Red-Teaming LLMs at the Honeynet Project annual workshop conference in Denmark on May 27-29. Hope to see you there with all the other folks comparing notes about threats.

https://t.co/Ktc2Vm0SCX

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference Day2 starting, many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
get on LLM Purple Test!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

CanSecWest 2024 Presentation:

Electric Vehicle Chargers: Observations from Pwn2Own Automotive 2024

by Jonathan Andersson, Trend Micro Research Labs
(And a reminder that we are giving a 20% discount to automotive industry participants. Contact: [email protected])

https://t.co/IgAC0y5Q5L

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ get on LLM Purple Test at #CanSecWest 2024
https://t.co/ES1rLHDhuW
conference Day2 starting, many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)

[dragosr @dragosr]

Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. https://t.co/FOMJnRlARD

[PacSec jp @PacSecjp]

∠(　˙-˙ )／ #CanSecWest 2024 is on. get on to LLM Purple Test competition! https://t.co/ES1rLHDPku
conference starting today, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey

[dragosr @dragosr]

Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. https://t.co/FOMJnRlARD

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference open today, Badge counters open 10am, sessions start noon.
many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
LLM Purple Test is also on!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

CanSecWest 2024 Presentation:

The Cat is Out of the Bag: Regulating AI in Canada

Anna Manley - Manley Law Inc. / ACTI

The Artificial Intelligence and Data Act (Bill C-27) is in the first reading stage in Parliament. The legislation purports to regulate AI as part of sweeping reforms related to technology in Canada. Will this regulation change the application of AI to cybersecurity? Are there loopholes? Is it too early for regulation? Will regulation go too far or not far enough?

How we attempt to regulate AI tells us much about how we view emerging technologies from both philosophical and practical perspectives. She’ll review the legal landscape of AI in Canada and discuss our attempts to regulate emerging technologies in the broader social and political context of who we are and where we’re going.

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference open today, Badge counters open 10am, sessions start noon.
many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
get on LLM Purple Test!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

Awesome! The folks at Google have joined our CanSecWest 2024 LLM Purple Test competition, and our prize pool is now up to $10K for defenders and attackers, thanks to sponsors from IOActive, Microsoft, Trend Micro, and Absolute. Pilot run on-line soon. https://t.co/FOMJnRlARD

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference open today, Badge counters open 10am, sessions start noon.
many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
LLM Purple Test is also on!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

CanSecWest 2024 Presentation:

Electric Vehicle Chargers: Observations from Pwn2Own Automotive 2024

by Jonathan Andersson, Trend Micro Research Labs
(And a reminder that we are giving a 20% discount to automotive industry participants. Contact: [email protected])

https://t.co/IgAC0y5Q5L

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference open today, Badge counters open 10am, sessions start noon.
many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
LLM Purple Test is also on!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

Apropos of Automotive Security. Ironically, it's one of the focus areas of our presentations this year at CanSecWest.

CanSecWest 2024 Presentation:

Death By A Thousand Cuts: Compromising Automotive Systems via Vulnerability Chains

Linfeng Xiao

The intersection of new energy vehicles, intelligent networking, and traditional automotive manufacturing has significantly blurred the lines between cybersecurity and physical security. As vehicles become increasingly connected, the paradigm of threats has shifted from physical attacks, such as those on car keys, to sophisticated cyber attacks originating from the internet. This change raises a critical question: are modern vehicles equipped to fend off such cyber threats effectively?

Our research aims to demonstrate the feasibility of remotely compromising a new energy vehicle without any physical interaction. With over 11 million new energy vehicles produced and sold globally, we embarked on a black box security analysis across various models. This journey took us from an initial lack of debugging access to successfully creating exploit chains that leverage multiple vulnerabilities for vehicle theft. Our methodology highlights the intricate process of identifying and chaining together remote code execution (RCE) and privilege escalation vulnerabilities to gain unauthorized control over the vehicle.

We delve into the technical specifics of discovering multiple RCE and privilege escalation vulnerabilities across different vehicle models and how these can be exploited via in-vehicle communication technologies. Our findings illustrate the potential for post-exploitation manipulation of critical vehicle components, including doors and windows, and even circumventing the Passive Entry Passive Start (PEPS) system. By expanding the attack surface for contactless assaults, we emphasize the broad implications of RCE vulnerabilities. The presentation concludes with an analysis of the current state of new energy vehicle security, offering targeted recommendations to automakers for enhancing their vehicles' resilience against cyber threats.

https://t.co/5twIAMRLIs

[PacSec jp @PacSecjp]

(*•̀ᴗ•́*)و ̑̑ #CanSecWest 2024 conference open today, Badge counters open 10am, sessions start noon.
many AI/ML & EV security talks in Agenda
https://t.co/3hDcaR4Hp0 (speaker/timeslot may change due to VISA issuance etc)
LLM Purple Test is also on!
https://t.co/ES1rLHDhuW

[dragosr @dragosr]

CanSecWest, 25th year. Take your chances @ RandomNewCon, or experience Vancouver's diversity, get pampered, fed well, by our experienced team (still only con with Second Breakfast), see leading edge research in our single track, and a 30m taxi to Grouse for day/night skiing or a short excursion before or after for North America's best skiing at Whistler. Your pick.
https://t.co/5twIAMRLIs

[PacSec jp @PacSecjp]

∠(　˙-˙ )／ #CanSecWest 2024 is on. sign up to LLM Purple Test competition! https://t.co/ES1rLHDPku
conference open Mar 20, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey
Pre Register while available >> https://t.co/AYkZTXgO2P

[PacSec jp @PacSecjp]

(｡•̀ᴗ-)و ̑̑✧ arrived YVR? #CanSecWest 2024 conference open tomorrow Mar 20, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey
last minutes to register > https://t.co/AYkZTXgO2P
sign up to LLM Purple Test competition!
https://t.co/ES1rLHDPku

[dragosr @dragosr]

CanSecWest 2024 Presentation:

The Cat is Out of the Bag: Regulating AI in Canada

Anna Manley - Manley Law Inc. / ACTI

The Artificial Intelligence and Data Act (Bill C-27) is in the first reading stage in Parliament. The legislation purports to regulate AI as part of sweeping reforms related to technology in Canada. Will this regulation change the application of AI to cybersecurity? Are there loopholes? Is it too early for regulation? Will regulation go too far or not far enough?

How we attempt to regulate AI tells us much about how we view emerging technologies from both philosophical and practical perspectives. She’ll review the legal landscape of AI in Canada and discuss our attempts to regulate emerging technologies in the broader social and political context of who we are and where we’re going.

[PacSec jp @PacSecjp]

(｡•̀ᴗ-)و ̑̑✧ arrived YVR? #CanSecWest 2024 conference open tomorrow Mar 20, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey
last minutes to register >>> https://t.co/AYkZTXgO2P
sign up to LLM Purple Test competition!
https://t.co/ES1rLHDPku

[dragosr @dragosr]

CanSecWest 2024 Presentation:

Electric Vehicle Chargers: Observations from Pwn2Own Automotive 2024

by Jonathan Andersson, Trend Micro Research Labs
(And a reminder that we are giving a 20% discount to automotive industry participants. Contact: [email protected])

https://t.co/IgAC0y5Q5L

[PacSec jp @PacSecjp]

(｡•̀ᴗ-)و ̑̑✧ arrived YVR? #CanSecWest 2024 conference open tomorrow Mar 20, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey
last minutes to register > https://t.co/AYkZTXgO2P
sign up to LLM Purple Test competition!
https://t.co/ES1rLHDPku

[dragosr @dragosr]

Apropos of Automotive Security. Ironically, it's one of the focus areas of our presentations this year at CanSecWest.

CanSecWest 2024 Presentation:

Death By A Thousand Cuts: Compromising Automotive Systems via Vulnerability Chains

Linfeng Xiao

The intersection of new energy vehicles, intelligent networking, and traditional automotive manufacturing has significantly blurred the lines between cybersecurity and physical security. As vehicles become increasingly connected, the paradigm of threats has shifted from physical attacks, such as those on car keys, to sophisticated cyber attacks originating from the internet. This change raises a critical question: are modern vehicles equipped to fend off such cyber threats effectively?

Our research aims to demonstrate the feasibility of remotely compromising a new energy vehicle without any physical interaction. With over 11 million new energy vehicles produced and sold globally, we embarked on a black box security analysis across various models. This journey took us from an initial lack of debugging access to successfully creating exploit chains that leverage multiple vulnerabilities for vehicle theft. Our methodology highlights the intricate process of identifying and chaining together remote code execution (RCE) and privilege escalation vulnerabilities to gain unauthorized control over the vehicle.

We delve into the technical specifics of discovering multiple RCE and privilege escalation vulnerabilities across different vehicle models and how these can be exploited via in-vehicle communication technologies. Our findings illustrate the potential for post-exploitation manipulation of critical vehicle components, including doors and windows, and even circumventing the Passive Entry Passive Start (PEPS) system. By expanding the attack surface for contactless assaults, we emphasize the broad implications of RCE vulnerabilities. The presentation concludes with an analysis of the current state of new energy vehicle security, offering targeted recommendations to automakers for enhancing their vehicles' resilience against cyber threats.

https://t.co/5twIAMRLIs

[PacSec jp @PacSecjp]

(｡•̀ᴗ-)و ̑̑✧ arrived YVR? #CanSecWest 2024 conference open tomorrow Mar 20, many AI/ML & EV security talks in 2024 agenda
https://t.co/3hDcaR5fey
last minutes to register >> https://t.co/AYkZTXgO2P
sign up to LLM Purple Test competition!
https://t.co/ES1rLHDPku

[dragosr @dragosr]

So attendees to CanSecWest this week may see some unusual sights around town, as they are currently shooting Tron 3 here. They were racing light-cycles IRL a few nights ago, and the Bentall center was transformed into ENCOM...