Microsoft Security Response Center (MSRC)
Microsoft Security Response Center (MSRC)
  • 199
  • 198 771
Zero Day Quest: Microsoft's Bug Bounty Program and AI Research
Lynn Miyashita, Andrew Paverd, and Aideen Fay provide valuable insights into Microsoft's approach to bug bounties and new vulnerability categories for AI research.
Resources for AI Security Researchers:
• Microsoft Researcher Recognition Program: www.microsoft.com/en-us/msrc/researcher-recognition-program
• Leaderboards: msrc.microsoft.com/leaderboard
• Microsoft Bounty Program: aka.ms/bounty
• AI Bounty Program: aka.ms/aibounty
• AI Bug Bar: aka.ms/aibugbar
Researcher Blogs:
• Bing Chat Data Exfiltration PoC and Fix: embracethered.com/blog/posts/2023/bing-chat-data-exfiltration-poc-and-fix/
• M365 Copilot Prompt Injection & Data Exfiltration: embracethered.com/blog/posts/2024/m365-copilot-prompt-injection-tool-invocation-and-data-exfil-using-ascii-smuggling/
Additional Tools and Programs
• Microsoft’s Adaptive Prompt Injection Challenge: llmailinject.azurewebsites.net/
• Bugcrowd University: www.bugcrowd.com/hackers/bugcrowd-university/
• HackerOne’s Hacker101: www.hackerone.com/hackers/hacker101
Events and Conferences:
• Microsoft BlueHat Conference: www.microsoft.com/bluehat/
Research and Reading:
• arXiv Research Papers: arxiv.org/
• Book: Not with a Bug, But with a Sticker: www.amazon.com/Not-Bug-But-Sticker-Learning/dp/1119883989
Vulnerability Reports and Bug Bars:
• Online Services Bug Bar: www.microsoft.com/en-us/msrc/olsbugbar
• Windows Bug Bar: aka.ms/windowsbugbar
MSRC Researcher Portal:
• MSRC Researcher Portal: aka.ms/secure-at
มุมมอง: 249

วีดีโอ

BlueHat 2024: S21: Breaking LLM Apps - Advances in Prompt Injection Exploitation by Johann Rehberger
มุมมอง 18121 วันที่ผ่านมา
BlueHat 2024: S21: Breaking LLM Applications - Advances in Prompt Injection Exploitation Presented by Johann Rehberger from embracethered.org Prompt Injection is a novel security threat that impacts large language model (LLM) applications. Confidentiality, Integrity, and Availability can all be impacted by a successful prompt injection exploit. This talk showcases many real-world exploit exampl...
Zero Day Quest - Learn to Red Team AI Systems Using PyRIT. Recorded December 2nd 2024
มุมมอง 668หลายเดือนก่อน
Rich Lundeen, Martin Pouliot, and Ram Shankar Siva Kumar discuss using PyRIT to find high-quality bugs in generative AI systems. Here are some additional resources to support your AI security research: • PyRIT: github.com/Azure/PyRIT • AI Bounty: aka.ms/aibounty • Microsoft Bounty Program: aka.ms/bounty • Submit a report to the MSRC: aka.ms/secure-at • MSRC Researcher Resource Center www.micros...
BlueHat 2024: S04: Creating a Transparent Cloud Industry
มุมมอง 134หลายเดือนก่อน
BlueHat 2024: S04: Creating a Transparent Cloud Industry Presented by Justin T Mourfield and Sesha Machiraju from Microsoft Abstract: Companies around the world leveraging cloud-based products inherently delegate much of the systems management to the Cloud Service Provider (CSP). This presents a unique and unprecedented challenge, ensuring the security of their environment and protection of dat...
BlueHat 2024: Day 2 Keynote: Amanda Silver, CVP, Microsoft Developer Division
มุมมอง 236หลายเดือนก่อน
Amanda Silver, CVP and Head of Product, Microsoft Developer Division and General Manager, First-Party Engineering Systems on "Protecting Microsoft’s Engineering Systems".
BlueHat 2024: LT04: Scaling Out Securing Open Source Presented by Zachary Steindler from Microsoft
มุมมอง 98หลายเดือนก่อน
BlueHat 2024: LT04: Lessons Learned: Scaling Out Securing Open Source Presented by Zachary Steindler from Microsoft Abstract: Programming language package repositories are juicy targets for attackers as they serve billions of requests per day. For the same reason, it's a great place for defenders to see high impact from security capabilities. And yet, each package repository ecosystem has uniqu...
BlueHat 2024: LT10: Firmware Security: Middle Child of Security Presented by Nithin Sade (Google)
มุมมอง 157หลายเดือนก่อน
BlueHat 2024: LT10: Firmware Security: The Middle Child of Security Presented by Nithin Sade (Google) Abstract: Firmware Security can often be de-prioritized in favor of other security focus areas. This lightening talk aims to bring attention to some of the recent firmware threats and challenges around managing firmware for enterprises. For e.g. BlackLotus, managing BIOS settings, Firmware Upda...
BlueHat 2024: LT01: World of Scams Presented by Amit Tambe (F-Secure)
มุมมอง 179หลายเดือนก่อน
BlueHat 2024: LT01: World of Scams - A systematic analysis of online scams using the Scam Tactics and Techniques Framework Presented by Amit Tambe from F-Secure Abstract: Online scams are a multi-billion-dollar industry that targets consumers on the Internet. According to Global Anti-Scam Alliance, over $1 trillion is lost to scams worldwide. Problem - The threat landscape news is fraught with ...
BlueHat 2024: LT09: SafeChatAI Presented by Ayobami Olatunji (Microsoft)
มุมมอง 76หลายเดือนก่อน
BlueHat 2024: LT09: SafeChatAI: Enhancing Cybersecurity Awareness Using Artificial Intelligence Presented by Ayobami Olatunji from Microsoft Abstract: The proliferation of digital devices and increased online communication have led to numerous cyber threats, particularly social engineering and phishing attacks, resulting in identity theft and impersonation. A significant factor contributing to ...
BlueHat 2024: LT06: Getting "In Tune" with an Enterprise by Brett Hawkins (IBM)
มุมมอง 218หลายเดือนก่อน
BlueHat 2024: LT06: Getting "In Tune" with an Enterprise: Detecting Microsoft Intune Lateral Movement Presented by Brett Hawkins from IBM Abstract: "Organizations continue to implement cloud-based services, a shift which has led to the wider adoption of hybrid identity environments that connect on-premises Active Directory with Microsoft Entra ID (formerly Azure AD). To manage devices in these ...
BlueHat 2024: LT03: My Best Frenemy Presented by Svetlana Gaivoronski and David B. Cross (Oracle)
มุมมอง 168หลายเดือนก่อน
BlueHat 2024: LT03: My Best Frenemy Presented by Svetlana Gaivoronski and David B. Cross (Oracle) Abstract: At Oracle, we maintain a robust security posture through the dynamic synergy of our Red Team and Blue Team, functioning as best frenemies. While the Red Team simulates attackers by seeking out vulnerabilities and testing our defenses, the Blue Team serves as vigilant defenders, monitoring...
BlueHat 2024: LT02: Creating a Developer-Friendly Security Tool by Susan Krkasharian (Microsoft)
มุมมอง 163หลายเดือนก่อน
BlueHat 2024: LT02: A Security Engineer’s Journey: Creating a Developer-Friendly Security Tool Presented by Susan Krkasharian from Microsoft Abstract: In this session, I will share my journey as a junior security engineer developing “AntiSSRF,” a secure software library designed to protect Microsoft services against Server-Side Request Forgery (SSRF) attacks. SSRF vulnerabilities, now present i...
BlueHat 2024: LT08: Ransomware Resilience: Turning the Tide Against Cyber Extortion by Tom Williams
มุมมอง 202หลายเดือนก่อน
BlueHat 2024: LT08: Ransomware Resilience: Turning the Tide Against Cyber Extortion by Tom Williams (True Zero Technologies) Abstract: Ransomware attacks have become a pervasive threat to global organizations, causing substantial financial losses over the past decade. The increase in successful ransomware attacks is driven by multiple factors and the issue has proven challenging to track by the...
BlueHat 2024: LT07: AI's got Muffins- the RAG-a-muffins!!! by Vivek Vinod Sharma (Microsoft)
มุมมอง 123หลายเดือนก่อน
BlueHat 2024: LT07: AI's got Muffins- the RAG-a-muffins!!! by Vivek Vinod Sharma (Microsoft) Abstract: Retrieval Augmented Generation [RAG] is heavily used for building GenAI apps. But what happens when RAG gets poisoned! We uncover the importance of RAG and how best to secure it from misuse and abuse in GenAI-LLM application development.
BlueHat 2024: LT05: Entitlements on macOS and why they matter by Yves Younan (Cisco Talos)
มุมมอง 96หลายเดือนก่อน
BlueHat 2024: LT05: Entitlements on macOS and why they matter by Yves Younan (Cisco Talos) Abstract: This short talk goes over what entitlements are on macOS, how they work and why they are important. They are different from how traditional permissions have worked in many operating systems. It is important for developers to understand how to use them. To prevent vulnerabilities like: blog.talos...
BlueHat 2024: Day 1 Keynote: Chris Wysopal (AKA Weld Pond), VeraCode / L0pht
มุมมอง 1.1Kหลายเดือนก่อน
BlueHat 2024: Day 1 Keynote: Chris Wysopal (AKA Weld Pond), VeraCode / L0pht
BlueHat 2024: S15: Embedding Sysmon Logs for Enhanced Threat Detection: A Practical Approach to RAG
มุมมอง 349หลายเดือนก่อน
BlueHat 2024: S15: Embedding Sysmon Logs for Enhanced Threat Detection: A Practical Approach to RAG
BlueHat 2024: S18: Minting Silver Bullets is Challenging
มุมมอง 179หลายเดือนก่อน
BlueHat 2024: S18: Minting Silver Bullets is Challenging
BlueHat 2024: S13: Patterns in the Shadows: Scaling Threat Hunting & Intel for Modern Adversaries
มุมมอง 426หลายเดือนก่อน
BlueHat 2024: S13: Patterns in the Shadows: Scaling Threat Hunting & Intel for Modern Adversaries
BlueHat 2024: S17: MSTIC - A Threat Intelligence Year in Review
มุมมอง 409หลายเดือนก่อน
BlueHat 2024: S17: MSTIC - A Threat Intelligence Year in Review
BlueHat 2024: S14: Scaling AppSec with an SDL for Citizen Development
มุมมอง 458หลายเดือนก่อน
BlueHat 2024: S14: Scaling AppSec with an SDL for Citizen Development
BlueHat 2024: S16: Three Decades of Network Security Evolution
มุมมอง 177หลายเดือนก่อน
BlueHat 2024: S16: Three Decades of Network Security Evolution
BlueHat 2024: S23: SLIP: Securing LLMs IP Using Weights Decomposition
มุมมอง 129หลายเดือนก่อน
BlueHat 2024: S23: SLIP: Securing LLMs IP Using Weights Decomposition
BlueHat 2024: S19: Lessons From Red Teaming 100 Generative AI Products
มุมมอง 289หลายเดือนก่อน
BlueHat 2024: S19: Lessons From Red Teaming 100 Generative AI Products
BlueHat 2024: S24: Automate AI Red Teaming in your existing tool chain with PyRIT
มุมมอง 375หลายเดือนก่อน
BlueHat 2024: S24: Automate AI Red Teaming in your existing tool chain with PyRIT
BlueHat 2024: S22: PyRIT: From LLM Security Research to Practical Attacks
มุมมอง 258หลายเดือนก่อน
BlueHat 2024: S22: PyRIT: From LLM Security Research to Practical Attacks
BlueHat 2024: S06: Deprecating Azure AD Graph API is Easy and Other Lies We Tell Ourselves
มุมมอง 503หลายเดือนก่อน
BlueHat 2024: S06: Deprecating Azure AD Graph API is Easy and Other Lies We Tell Ourselves
BlueHat 2024: S10: How Microsoft is Scaling DAST
มุมมอง 453หลายเดือนก่อน
BlueHat 2024: S10: How Microsoft is Scaling DAST
BlueHat 2024: S01: The two sides of UnOAuthorized
มุมมอง 515หลายเดือนก่อน
BlueHat 2024: S01: The two sides of UnOAuthorized
BlueHat 2024: S02: Tokens & Takeovers: Cloud-Powered Supply Chain Attacks
มุมมอง 326หลายเดือนก่อน
BlueHat 2024: S02: Tokens & Takeovers: Cloud-Powered Supply Chain Attacks

ความคิดเห็น

  • @zf4hp24
    @zf4hp24 2 วันที่ผ่านมา

    Excellent presentation. We need more of Joe discussing kernel internals and "gotchas".

  • @augustofilipe5553
    @augustofilipe5553 11 วันที่ผ่านมา

    Good lerson, continue this wy

  • @Rajputana1974
    @Rajputana1974 15 วันที่ผ่านมา

    thanks for sharing this info , I know the rest of the world will never find it interesting but I was a EC Graduate and learning about hacking these microcontroller is weirdly interesting...

  • @ndrixxx
    @ndrixxx 15 วันที่ผ่านมา

    Love the video! ZDQ is pretty cool, but I *may* be biased.

  • @tutankhamun-r2i
    @tutankhamun-r2i 18 วันที่ผ่านมา

    so when is the windows kernel code being open sourced on github!?

  • @aijaz5830
    @aijaz5830 20 วันที่ผ่านมา

    I cannot find Pyrit-Ship on burp or on Github

  • @Lorv0
    @Lorv0 24 วันที่ผ่านมา

    What local LLM model would you suggest for generating the adversarial prompts?

  • @sean8102
    @sean8102 หลายเดือนก่อน

    Fun fact: Microsoft's Pluton Security chip for PC's has it's origins from this, the security system/DRM system of the xbox one. Which still hasn't been cracked (or series x/s).

  • @TiagoAlexandrec
    @TiagoAlexandrec หลายเดือนก่อน

    Step one do an internship with Theo de Raadt, and in openssh, step 2 lean about asymetric authentication step 3 stop reinventing the wheel and do it properly. windows is the only env that has this issue LOL!

  • @nidhiverma4369
    @nidhiverma4369 หลายเดือนก่อน

    Great session.

  • @ndrixxx
    @ndrixxx หลายเดือนก่อน

    Cool tshirt, JBW. :) Love the talk.

  • @ndrixxx
    @ndrixxx หลายเดือนก่อน

    Great presentation! :) <3 AntiSSRF.

  • @heroldovlucifer7455
    @heroldovlucifer7455 หลายเดือนก่อน

    Reading books bad

  • @Sickcoin
    @Sickcoin หลายเดือนก่อน

    Bring some more researchers

  • @kantrasha
    @kantrasha 2 หลายเดือนก่อน

    Opening: Microsoft guy at Microsoft talk talks badly about C++ while proposing Rust as an alternative, right after mentioning bing as a powerful search engine.

  • @balajisbji5131
    @balajisbji5131 3 หลายเดือนก่อน

    SuperB Dinesh

  • @rishabh6210
    @rishabh6210 3 หลายเดือนก่อน

    Amazing

  • @TerryValdez-h8i
    @TerryValdez-h8i 4 หลายเดือนก่อน

    Coty Route

  • @subodhharde8123
    @subodhharde8123 4 หลายเดือนก่อน

    It's nice and interesting Presentation is also very nice 👌

  • @swatikaushik1
    @swatikaushik1 4 หลายเดือนก่อน

    Nice 👍

  • @namanshah8525
    @namanshah8525 4 หลายเดือนก่อน

    That’s pretty interesting !!

  • @AayushTygi
    @AayushTygi 4 หลายเดือนก่อน

    Nice presentation! 👍

  • @Ichinin
    @Ichinin 4 หลายเดือนก่อน

    FFS, What kind of newb recorded this? Film the presentation - not the presenter walking to the left and right.

    • @lypanov
      @lypanov 4 หลายเดือนก่อน

      Exactly. Unsubscribing given this trash.

  • @vallabhchole
    @vallabhchole 4 หลายเดือนก่อน

    👍🏻

  • @parthghughriwala6799
    @parthghughriwala6799 4 หลายเดือนก่อน

    Interesting!!!

  • @faanross
    @faanross 6 หลายเดือนก่อน

    brilliant, 5 years old can't believe i haven't heard more about it

    •  5 หลายเดือนก่อน

      Love your videos!

    • @faanross
      @faanross 5 หลายเดือนก่อน

      appreciate that thanks!

  • @Myself-yh9rr
    @Myself-yh9rr 7 หลายเดือนก่อน

    Though purple is not my favorite color it does look good there.

    • @M4XD4B0ZZ
      @M4XD4B0ZZ 3 หลายเดือนก่อน

      Purple silk screen looks great imo but i like the darker ones more

  • @Darkstar2342
    @Darkstar2342 8 หลายเดือนก่อน

    39:20 I think the biggest reason why the Xbox One security has lasted so long is that there are only a handful of Xbox One exclusive games (and except Forza and Halo 5 they are rather niche)... All other games are also available on Windows where they are much easier to crack/pirate (even Denuvo is not an obstacle anymore these days). So console hacking became rather uninteresting these days, at least for the Xbox ...

  • @MdMiraj2-m4o
    @MdMiraj2-m4o 8 หลายเดือนก่อน

    I need your help I don't understand how to solve my problem, I need your help

  • @normanhuntiii
    @normanhuntiii 10 หลายเดือนก่อน

    Great job to everyone. This is an important conversation. Also, great to see you in your element, Devin. Keep getting after it!

  • @pricedwayne
    @pricedwayne 10 หลายเดือนก่อน

    Outstanding conversation and facilitation!

  • @larrymyers5989
    @larrymyers5989 10 หลายเดือนก่อน

    I hope I can one day work for Microsoft. I’ve always been into tech and worked in tech. I just made some bad choices as a young man that affected my life.

  • @sudheer269
    @sudheer269 10 หลายเดือนก่อน

    Octo Tempest, Lapsus will love this talk

  • @kumpadamian182
    @kumpadamian182 ปีที่แล้ว

    Sería más bueno Wee UE se traduzca en español

  • @TimmyTSENGKaliOSCPpentest
    @TimmyTSENGKaliOSCPpentest ปีที่แล้ว

    anyone have AI pentest tool project working on?

  • @ricsip
    @ricsip ปีที่แล้ว

    There is a slightly longer version of this very same presentation (literally with the same title) on Platform Security Summit YT channel

  • @eniggma9353
    @eniggma9353 ปีที่แล้ว

    Great talk, thank you for sharing.

  • @MrTweetyhack
    @MrTweetyhack ปีที่แล้ว

    Microsoft will sue you

  • @mielole
    @mielole ปีที่แล้ว

    This doesn't feel like responsible disclosure to me. Sure, all of the attacks require physical access, and yet there is no mitigation strategy even discussed. Is facecam Windows Hello insecure too? Who knows...

  • @TonyFarley-gi2cv
    @TonyFarley-gi2cv ปีที่แล้ว

    See sweetheart the public shouldn't have a cloud if you have a clown inside the public you have a construction of someone else's business that you're learning brainwave structure through to learn the placement of someone else's organization or the rotation of weight of gravity's movement in someone else is mine

    • @ricsip
      @ricsip 9 หลายเดือนก่อน

      you should stop taking that new pill immediately!

  • @harrystein2000
    @harrystein2000 ปีที่แล้ว

    Thank you!

  • @watchrami
    @watchrami ปีที่แล้ว

    Actual review starts 20:52

  • @skraushaar
    @skraushaar ปีที่แล้ว

    How did the fucking Synaptics chip pass certification? Its hard to imagine scenarios where that chip makes it to market without fraud. Microsoft: More dog food, less dog shit. Your least technically savvy userbase uses the Surface line. The breach of trust with that product's implementation is outrageous. Disgarded broken keyboards could be used to spoof a user. Is there facility to wipe them? Nope. Its so dumb.

  • @thevibeinc
    @thevibeinc ปีที่แล้ว

    Mygawd BRO!! It seems as though public speaking makes you a little nervous which is common. You can clearly tell by your breathing. The gum chewing really amplifies all these little things. I really hate to be that person but this was serious topic and that gum, breathing, and savage borderline choke swallowing midsentence was too much.🥴 This is definitely your fault but I would definitely ask your bros why they all let you carry on without giving you a signal or even text. I ended up reformatting the transcript and listened to a gun free ai. Great information and appreciate the teams work!

  • @rickglorie
    @rickglorie ปีที่แล้ว

    This will result in some wild and totally unsecure NTLM hack, I guarantee it.

  • @beemeerm4332
    @beemeerm4332 ปีที่แล้ว

    Nice. Good job. I wish you tested Fingerprint cards (FPC) sensor to. I wonder if there was a specific reason not to?

    • @pizzlerot2730
      @pizzlerot2730 ปีที่แล้ว

      This was a specific case of integrated fingerprint sensors, representing the typical implementation of a direct-from-device-manufacturer fingerprint scanner utilized by Windows Hello for enhanced security, ie a typical use case for a Microsoft user (for example in the business world). The realm of third party fingerprint sensor peripherals is so vast in both size and quality that it would be very difficult to adequately evaluate in its own case study, much less in one also including integrated biometrics. Another big sticking point is that proper implementation of security standards with these integrated devices depends on Microsoft working with device manufacturers. That isn't really a thing in the peripherals market, except for maybe a couple of choice partners (maybe, idk for sure in this case, that's just how it usually goes), so it would really muddy the waters when it comes time to draw conclusions about what Microsoft could do to improve their security feature. Remember, at the end of the day, this is security science research, not consumer product testing; and effective research is all about controlling the variables.

  • @BillyONeal
    @BillyONeal ปีที่แล้ว

    "the problem is you have to turn credential guard on" 🤣🤣

  • @islandfireballkill
    @islandfireballkill ปีที่แล้ว

    Hopefully, they can fix this with a firmware and software update. Also totally astonishing that the Linux implementation is just completely unauthenticated.

  • @paulmackenzie5526
    @paulmackenzie5526 ปีที่แล้ว

    anyone ever get a ping in your head , or ears at the same kind of times. like a pattern >?

  • @chiwaukum5418
    @chiwaukum5418 ปีที่แล้ว

    Firmware in modern vehicles is going to be a huge vulnerability as well, I think... I doubt that most cars/trucks are well protected, and updating/overriding firmware could lead to some very interesting (if not outright catastrophic) attacks. A good subplot for a modern thriller movie... :)