Holistic IT security research & consulting
Berlin
Joined December 2020
- Tweets33
- Following0
- Followers1.6K
- Likes4
Our bank's AI agents was vulnerable to indirect prompt injection and XSS. We created PoCs, where we inject the payload and instructions via a malicious PDF or transaction reference.
positive.security/blog/banki…
We looked at the internals of JavaScript/TypeScript's most popular utility libraries and found interesting issues.
The post contains hacking challenges/live demos.
We recommend checking it out if you work with the affected libraries.
positive.security/blog/lodas…
At #38c3, we presented our #BlinkenCity research, which started as a fun art project idea, and ended up as a plausible European #blackout scenario.
youtube.com/watch?v=DAf-T3bF…
Details: positive.security/blog/blink…
The system is also used for street lamp control, allowing for a scaled-up “Project #Blinkenlights” art installation that transforms an entire city into a screen (for astronauts)
We leverage indirect prompt injection to trick Auto-GPT (GPT-4) into executing arbitrary code and discovered vulnerabilities that allow escaping its sandboxed execution environment.
positive.security/blog/auto-…
The Auto-GPT team has now also published GitHub security advisories and reserved CVE numbers:
- github.com/Significant-Gravi…
- CVE-2023-37273, CVE-2023-37274, CVE-2023-37275
Our article on DIY AirTags is now also available in German!
Zu finden im @MakeMagazinDE (1/2023) und @mac_and_i (2/2023)
Fabian was interviewed (in German) by Deutschlandfunk about the new tracking protection standard by Google and Apple (featuring a "backdoor" near-owner bit)
deutschlandfunk.de/zwielicht…
The popular Ruby library "Ransack" can be abused to exfiltrate sensitive data via character by character brute-force.
We compromised multiple applications this way and found hundreds more that could be vulnerable.
positive.security/blog/ransa…
The latest @make magazine features an article of ours on "DIY #AirTags".
It contains:
- Brief explanation of the Find My protocol
- Introduction of @seemoolab's OpenHaystack
- Summary of our research (Send My & Find You)
- Example use cases for such (enhanced) DIY trackers
urlscan.io leaks API keys, shared documents, password reset links, team invites, and other sensitive data.
We identified one culprit to be other security tools that accidentally make their scans public and put their users at risk.
positive.security/blog/urlsc…
An unpatched vulnerability in the popular dompdf PHP library allows for remote code execution via a malicious font+PHP polyglot file.
positive.security/blog/dompd…
The exploit files and demo application are available here: github.com/positive-security…
We built a stealth AirTag clone that is not detected by Apple’s tracking protection. It works by only sending one beacon per generated public key.
positive.security/blog/find-…
The source code for the ESP32 firmware and macOS retrieval application used in our experiment can be found here: github.com/positive-security…
We present a simple yet effective technique to get a high-resolution image from a pixelated video in order to recover redacted information (with no guessing involved)
positive.security/blog/video…
Microsoft Teams: 1 feature, 4 vulnerabilities
We stumbled upon several vulnerabilities in Team's link preview feature, out of which MS only fixed one so far.
positive.security/blog/ms-te…
