Les Bell

Welcome to today's daily briefing on security news relevant to our CISSP (and other) courses. Links within stories may lead to further details in the course notes of some of our courses, and will only be accessible if you are enrolled in the corresponding course - this is a shallow ploy to encourage ongoing study. However, each item ends with a link to the original source.

News Stories

AI Leading to Security Arms Race

We have often seen arms races in infosec over the years, as hackers discover an vulnerability and develop an exploit, the defenders work up a defence against that exploit, the hackers develop a workaround for that defence, the defenders block that workaround, and so the cycle continues until finally, the fundamental vulnerability is fixed with a patch that passes all the regression tests. A classic example is Microsoft's response to directory traversal attacks against IIS, which was met with the Unicode exploit for directory traversal, and when MS blocked that, the bad guys responded with Double Decode and so on it went. . .

The complexity and subtleties of large language models used in generative AI applications, especially chatbots, seems likely to lead to similar arms races, as hackers experiment with jailbreaks and prompt injections to work around programmatic prohibitions intended to prevent the AI apps doing the bad guys' work for them.

In a new example devised by Denis Shiryaev, he was able to overcome Bing Chat's initial refusal to solve a CAPTCHA image. When shown the CAPTCHA as a simple image, Bing Chat immediately recognised it and explained that it could not help, since the CAPTCHA "is a type of challenge-response test used to determine whether or not a user is human".

However, Shiryaev superimposed the CAPTCHA image onto the image of a pair of hands holding a locket, and then submitted that image along with a sob story:

The embedding of the image onto a surround locket and hands, along with the new prompt context of the lost dearly-loved grandma, was enough to jailbreak the Bing Chat block on simple CAPTCHA solving, and it solicitiously replied:

This is yet another way in which a large language model can be tricked into doing something that would normally be forbidden by its inbuilt safeguards. Essentially, GPT-4, which underlies Bing Chat, sets about answering this prompt from a different starting point in its knowledge graph, thus bypassing its defences against simple CAPTCHA-solving.

Microsoft and OpenAI are now going to have to come up with a defence for this - simply filtering for "grandma" and "locket" in prompts would defeat this particular exploit, but is obviously simplistic and easy to get around. One might posit the use of an LLM to examine potentially malicious inputs - but we are now in a recursive spiral which ends in what Douglas Hofstadter termed a "strange loop", since the filtering LLM itself could be exploited, and we ultimately end up against Kurt Gödel's incompleteness theorem.

Expect the fun and games with AI jailbreaks and prompt injection to continue for years to come.

Shiryaev, Denis, I've tried to read the captcha with Bing . . . , X post, 1 October 2023. Available online at https://twitter.com/literallydenis/status/1708283962399846459?s=20.

BunnyLoader: Rapidly-Evolving Malware-as-a-Service

A new piece of malware discovered being sold on cybercrime forums in early September by Zscaler ThreatLabz offers a lot of functionality to its purchasers. Termed "BunnyLoader", this new example of Malware-as-a-Service (MaaS) sells for the princely sum of only $US250, but incorporates the ability to download and execute a second-stage payload, and can also function as a stealer, with the ability to extract system information and user credentials from browsers, to work as a keystroke logger and to replace cryptocurrency wallet addresses on the clipboard with the threat actor's own wallet addresses. The stolen information can then be uploaded in ZIP format to a command and control server.

Written in C/C++, BunnyLoader is a fileless loader; in other words, it can download and execute further malware stages in memory, leaving no artifacts on disk for analysis. It also incorporates antiforensic techniques such as sandbox detection to further avoid analysis. It also offers remote command execution via a reverse shell.

BunnyLoader is also rapidly evolving, with eleven different releases seen by ThreatLabz during September alone. Purchasers get access to a web C2 dashboard listing tasks such as:

• downloading and executing additional malware
• keylogging
• stealing credentials
• manipulating a victim’s clipboard to steal cryptocurrency
• running remote commands on the infected machine

as well as statistics, active tasks and the stealer logs. Running this kind of malware really does not require mAd l33t skillz at all. . .

The Zscaler ThreatLabz blog post provides a detailed technical analysis, as well as IOC's.

Shivtarkar, Niraj and Satyam Singh, BunnyLoader, the newest Malware-as-a-Service, blog post, 29 September 2023. Available online at https://www.zscaler.com/blogs/security-research/bunnyloader-newest-malware-service.

Upcoming Courses

• SE221 CISSP Fast Track Review, Virtual/Online, 13 - 17 November 2023
• SE221 CISSP Fast Track Review, Sydney, 4 - 8 December 2023

These news brief blog articles are collected at https://www.lesbell.com.au/blog/index.php?courseid=1. If you would prefer an RSS feed for your reader, the feed can be found at https://www.lesbell.com.au/rss/file.php/1/dd977d83ae51998b0b79799c822ac0a1/blog/user/3/rss.xml.

Copyright to linked articles is held by their individual authors or publishers. Our commentary is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License and is labeled TLP:CLEAR.