DeFi Security 101 2025 - 101 Ways to Get Rekt, and How to Avoid Them

Transcript

ing the morning session. Uh I think it was great and we're going to have even better presentation now. Uh very very spicy by the red gill team and matcha and please take it h again if there will be question try to see that we get the mic or uh repeat the question okay because we are recording. >> Wait. >> Okay. >> Okay. Okay. We are we are setting some things up. My partner here use i3 and uh arinux. So it's very complicated to set up. Um he was using something easier he will set it up easily. But but anyway

um as he prepares everything um we have many things for today. Um I will just spoil the talk saying that this is probably not the oneonone talk you were expecting. Um essentially um people from the organization were too kind to gives us this to give us this space this hour to talk to you to share the things that we do. Um and we are probably doing going to do whatever we want with this. Um, if you're here to see solidity, smart contracts, and DeFi, probably this is not your kind of talk. Um, you're going to see lots of other more, in my

opinion, more interesting things. Um, we are calling this talk like the 101 ways of getting wrecked. Um, so we are going to be showing you container escapes, prompt injections, uh, threats simulations and fishing attempts. many other things that I don't think other teams in the crypto space are talking about. Um lots of people have just focusing on smart contract security and that's very fine and that's very interesting and we have done that in the past as well but um as we will will show you there are lots of things that can go wrong in crypto not necessarily just because you miss something in some solidity line right so

security is far more important or far bigger than that um so the idea for today is showing you like different ways in which you can be attacked as a user, as a developer, um, in crypto, not necessarily via a smart contract hack, right? Can we start showing or not yet? >> Just one second. >> Just one second. Okay. In the meantime, I should have said this earlier. I'm Tincho. His mata. Um, we are both Argentinians from the Red Guild. Uh, we also have Dante here. Dante, raise your hand. Okay, that's Dante. H, he's an intern to at the Red Guild. So essentially the red gill is a very small

team, two and a half people um uh Latin Americans Argentinians. Um we do security for the public good. I'm kind of spoiling the talk already, but anyway, as he sets everything up, um we work with grants from the three foundation so far. So that means that we don't sell security services. We don't sell audits. Everything that we do in security is just for the public good of Ethereum ecosystem. Um so the grants that we received from the the foundation are the ones that have been supporting our work and essentially paying our salaries so that we can do free content uh being in or traveling to do talks

doing research doing I don't know the buli probably some of you play that we also did that we are not talking about the bul today but you should check it out um so everything that we do again it's open it's public it's just uh to increase security awareness in the community and we don't sell anything that we we are not a we work as essentially as a nonprofit organization, right? Um >> I'm just stretching Okay.

>> Okay. I don't know what >> you're not going to believe anything that we say after >> we can do container escapes but we somehow cannot put a slide. I will say that I rather reverse malware engineer uh rever reverse a malware than learn to do CSS. So

>> okay okay okay are we ready >> we go >> okay move on to the next one because I already kind of >> okay who [snorts] we are I was already talking about this so we do securityation for the public benefit of the ecosystem his mata and tino the red guild right so and Dante there um [laughter] our slave. >> So um as I was telling you like honestly we consider ourselves kind of a we are a unique organization um because we position ourselves between web two and web three really like we don't see much difference security I mean everything is broken these days. So regardless of web two web three web four web five it's all going to be uh probably quite broken. So we try to position ourselves in that

middle of well what do you do? Well, we do security and we understand that there's a big uh gap in organizations that are not covering these aspects of security which are not necessarily web two, not necessarily web three like we are kind of in the middle of that. Um as I was telling you we work with the Ethereum Foundation, we receive grants. Um but uh these days essentially DF has gone through through some changes but anyway our grant is finishing or has finished already. Uh so we are >> send money >> very much underfunded >> pretty please >> we don't know what's going to happen in 2026 so this might be the last talk of the red guild that you see so enjoy it >> sorry >> um we do have some cool initiatives that we are that we pursue as as I was

telling you today we're going to be talking to you about some of this such as the fishing dojo um such as some tooling that we do such as the awareness campaigns that we are actually running at dev connect um some of you may have or may have not already seen some operational security handbooks that we are distributing some mini books that are pretty cool that you should get. Also, we do educational content, we do workshops, we do talks, I mean we do many many things and today we are going to be sharing lots of this about you. We also do community building. So, if you're from Argentina, you probably know us a little bit already. If you are from Tandil from uh a city in Argentina, we are building the noador which is a community hub just for people to get

together and learn about crypton and ethereum. We are participating in ether rangers as well which is uh in >> yeah it's a a way that we along with Ethereum foundation and securum we started thinking how we can support other people like us that were doing security as a public good and knowing their struggles we financed them with specific projects in and milestones in mind and it has finished so I think uh we have a lot to learn from there and I really like I really like the initiative >> yeah we'll see what happens next year does Everybody have a a handbook here?

Has everybody given one? Okay. Have you liked it so far? >> Perfect. They won't say no. >> Anyway, security awareness campaign. So, one of the things that we do is we go to events and we like hacking things for the good and not maliciously. And um we did that in Ethereum Argentina 2023 more or less. Uh we are repeating that in Dev Connect. uh of course with approval from the organization really. So uh we're doing different different uh initiatives there. So we have like I know we are dropping USB sticks uh whenever we find an attended device. We are setting up some honeypotss uh to detect uh Wi-Fi

attacks and try to catch some attackers that might be doing some nasty things. The Wi-Fi at the event doesn't work very well. So I don't know. Uh we also have the mini handbooks there. Um, we also have an IMCI capture detection. If you don't know what that is, don't worry too much. Anyway, it's kind of a device that allows us to detect where somebody is kind of trying to mess with um cellular networks. >> Yeah. Yeah. Like uh the same you would be susceptible to money in the middle attack or or attacks that in Wi-Fi lower your the level of security. Uh you could do something like that uh using a VTS which is like a station like a mobile station and you can

>> yeah you can make users uh you can intercept intercept calls SMS etc. Great. So those are some of the things that we are doing and uh within this this campaign as well uh we have recently published nooc.redgill.org you can just go there we have some live feeds I don't know ma if you want to explain something. Yeah. So, sure. Uh, so we're speaking out the catching things, some things that we're catching live and you can see it right now. We have two malware detections uh connected to BSGO and Open BCX. You've seen this search of extensions that exploit not vulnerabilities. You will see that in the following section, but they are

still in private keys. They are doing a lot of things on the workspace workstations of the developers and users. These ones were provided by an acquaintance of us, Kraovia, which based part of this research on one of the research that I did previously on VS Code and how we can even trick users into believing that an extension has thousands of or millions of downloads. >> In this case, you also have like uh we are monitoring offchain messages and onchain activities on which is a very good source. Uh it's this information is portrayed in a in a channel in Telegram channel. What we did is we separated it, categorized it and we're displaying it live as well.

>> Some fields obviously from sack as well. Um and also some fields using start entry to detect uh actual fishing campaigns going on publicly. >> Yeah, this is something that we created uh it's based on a fishing catcher that was created like seven years ago but uh we refactor it completely. What we do is we monitor every time a domain gets issued as an SSL certificate and there are some aggregators that make this information publicly you can get it from Google Cloudfare etc. So we're we're getting getting information from every provider, every register and we are filtering it with some yeah with some intelligence behind and uh and the idea

is that it gets a certain score and depending on the scores we do manual evaluation or or triashing and while I was taking a screenshot for for the presentation I just opened randomly this one and there was a fishing there and what we are able to do with this is that we are a few steps um closer to the attacker before they get to actually launch the fishing campaign. So, it's actually pretty good. I I've seen friends from Kraken and other the exchanges or or protocols that they are paying an interesting money on on on monitoring tools like this and this that we coded in a week.

It's getting very good results. So maybe there's something to do with this. We are also integrating this with seal intel. Uh so we have more input on how to catch criminal fishing. >> Uh within this security campaign we also we have also will uh done the did a lot for this to happen. Uh we you can go to QR.org. H there's a cure safe scanner. Whenever you find a QR code in the wild you know that QR codes can be a little bit tricky and can take you to some nasty places. So you can actually install this progressive web app. You can use it from the browser if you want to install anything but it's just a progressive web app and uh you can scal scan whatever QR code and we are hitting

all those kind of APIs for you to know exactly what the QR code is actually doing and redirecting you to before it actually does it so that you are kind of a little bit safer. It als it also has a it consumes the API from blind app which helps you disassemble and explain a transaction. You see when you are going to pay with with your wallet scanning a QR code well it also uses some blind app. So whether you are scanning URLs it follows redirection chains it it it runs different analysis. It's it's a it was a way of reinventing oursel through this awareness campaign because we were asked to take it down a notch and not be that offensive. So we said, okay, instead of demonizing QR codes, we're going to

provide something that protects people from QR codes. >> Essentially, we wanted to hang malicious QR codes in the event. They told you we couldn't do that, of course. So we >> among many other things [laughter] that are illegal. >> Okay. Anyway, um another thing that we are doing, this is just the introduction of the talk, right? [laughter] >> Yeah. So something is something that Dante also work worked with is we wanted to create the dev container wizard to be able to spin up containers and their containers pretty fast and with different type of profiles depending if we wanted a more isolated environment compared to something more flexible and we also you can you can move to the next one. Um, we are also implementing Botman uh on on underneath because Botman is a

little bit more secure than Docker. So, it's just it's just a an interactive tool that allows you to configure it as you like and then it's going to spin up the dev container. So the outl was just kind of the introduction for the talk especially to give you some context on the kind of things that we do and how we approach security in the crypto ecosystem probably we are not kind of the usual security company right so the outline for today is essentially we are going to split the talk more or less uh into these sections depending on how much time we have we will kind of skip stuff or not but anyway it's going to be um the first part abusing VS code extensions to some uh things because we

we just told you that you should perhaps be using containers to isolate your development environments, but that's not necessarily the best uh tool always. And so we are going to be showing you how attackers can actually weaponize web containers and escape and execute things on your machines for example. Then we are going to be doing some prompting sections and showing you different examples of how attackers are these days weaponizing prompts uh to execute very different ways and things. And at the end of the talk, we're going to be talking to you about um a threat simulation platform that we have built called the fishing dojo that we just launched a new beta version today that

you can start going there and training and and facing realistic simulations of fishing attempts uh to train yourself and your teams. It's all free. So, uh without further ado, I think we were going to be starting with abusing VS Code uh through extensions. This is Mata's specialtity. So, I'm going to ask you a question and I will ask you to uh put your hand up. If you use V code, have used V code or you know someone that uses V code. >> I need I I would like to take a picture of this.

I mean >> and we already know that running code locally I mean we've given workshops in the past through through the awareness campaign where where we told people to download a repo from us and we back door everyone just putting a PDF on the desktop saying you could have been boned you should have you you should have been using an isolated environment and and we know that and and and and we know that of course given also the North Korean and impersonating interviewers and tricking user through the interview to to execute a work test and and then poning them.

Developers started using more and more containers and to integrate work more seamlessly dev containers which is actually the integration is it's beautiful but achieving full isolation with this is kind of a fe it's kind of it's the wrong technology to to do it. So, how many of you use containers of their containers? >> Half the room. >> Yeah. And the rest you don't use anything or use or do use a VM? >> VM.

>> VMs. Does anybody use VMs for developing? Okay. >> Okay. >> And the rest just executes code on >> everyone spawned. Okay. So, [laughter] super easy. I did. You write it down so we can >> I took pictures of that face. Anyway, so the story goes like this. Uh we are going to keep it short, but um I do use dev containers uh through Visual Studio Code and I always had this impression that something was going on um because Mata was always telling me to use that and I use that. Um but whenever I used a dev container, I would essentially be able to push stuff from my dev container

to GitHub using my SSH keys that I had on the host. And I was telling Ma, but shouldn't dev containers be isolated? How is it that a container actually has direct access to my SSH keys in my host? Shouldn't that be isolated? Um, Ma started researching and researching and researching and well, it obviously means that dev containers as not are not as isolated as you might think. So the idea for the talk today is showing you different ways in which extensions and other things can abuse this. Yeah, I always like the the expression on the face of the people when I ask them, have you wondered how this actually works so seamlessly or these integrations? You're not worried about anything.

Well, we were. So, it all starts with the remote development extension pack which is like a meta package. It has different uh different extensions in it that you could install all these extensions separately or just the the main one. So in terms of the how the the extensions work, well basically the SSH just connects to through through the through VS code to an to a remote server through SSH. Then tunnels using Microsoft tunnels dev container spins up a a container using dev container JSON to add more features to it. And then the Windows subsystem for Linux does something similarly. So what do all them have in in in in similar like what do

you all share? They all share that the VS code server is installed and this is where the magic starts or or begins. So the for the SSH extension basically it just login via SSH. It installs uploads the server to uh a specific folder every all the time to the home folder uh hidden um and then launches the agent while you when you connect to it. So you connect through SSH and it automatically launches a binary. Then the remote tunnels the same the same but the protocol or the the the way of communicating is through Microsoft tunnels but deploys a VS code server instance extension similarly and the de container extensions using de xc or

podman it installs on root or the home folder of the user it's triggering this and handles all the dev container JSON configurations. So what do extensions depend on? Like because if you think about it, you have VS code, you have running a lot of things locally and you say, okay, I want to work remotely but using the client on my machine. So how is it going to work with all the things that I use to build to compile? How is everything happening on the on the back end that now the back end is remote or or within a container? So what you're you're going to have for example something to to to allow direct access to to to the files to have indexing

symbol resolution build combiners you you need to attach remote interpreters or runtimes for for example like node python debug adapters you need a lot of things for you're going to if you're working with git if you're a developer because that's what you're using uh visual studio code you're going to need to to to retrieve all the the the git information you need ter terminal integration because you're using a terminal from the client but how are you connecting to to the other how does VS code handles that and of course file watchers to remote file system for changes because all these events trigger actions on the on the on the UI like you seen some file has changed or or there's a conflict all those things that that

trigger automatically and there are a lot of more things so a very I think we should way to to explain how this works. Basically, this is you. This is your computer. You have VS Code and usually it's running extensions on the UI because what you are seeing is the UI. And now the now that you have a remote operating system, be it a container or virtual machine or whatever you're going to have a server deployed there and the extensions that are running on the workspace. So we're going to differentiate everything that happens locally with the UI and workspace on the on the remote file system and all works seamlessly or it's integrated and all the things that we mentioned that were needed are getting deployed there. Same

with all the other scenarios like with Windows etc. So what does the the the remote extension technically do like for real? So, what I'm going to do now, can you help me if this works? I'm going to I'm going to just open Visual Studio. You can hear me if I speak like this. >> Ah, we we're recording. Yeah, we're recording. So, look, I just open I'm going to do it again. I just opened the Visual Studio Code.

just >> I just open Visual Studio Go and this is opening a dev dev container immediately. So that's that's it. Um sorry we want to clear. So this works uh seamlessly. This explains here that we're connected to a dev container uh and and and that's it. But for example, if I if I if I just put M, you're going to see that the environment has a lot of things already.

An environment that I just let's say deployed, environment that just opened. And if I were to Oops. He's actually now running a command to see the processes that are running within the dev container. >> So what I wanted to do, wait, I'm going to I just want to show you how many processes.

This is complicated. How many processes are running on the on the container? You can see there are a lot of processes running on the container if you see. So I'm going to continue with this. So what we we we just did there is we we just did there is just run uh list all the processes there and try to understand what's what's being executed as the VSO server and there are more binaries scripts involved a lot of you're going to see that there are thousands and thousands and thousands of files and things that are are are there waiting to be used by this binary. It's

kind of indistinguishable from a C2 or a malware because it does everything. But it's at the same time it's it's beautiful what they achieved. We only need to be aware of how it works. So some of the processes that were there well there was one which is the actual VS code remote server, the one that starts everything. Then there's uh the extension host which is the one that allows extensions to be run on the host. We also have the transport bridge which is the one that is in charge of communicating between the remote extension host and the and the client and the UI. Uh the the rest of the things that are needed to integrate terminals and the file watchers to monitor workspace etc.

So there are a lot of things related specifically to how extensions are being handled and we'll speak about about this in a minute. But in terms of git config for example it com it it copies the g config from the host that is connecting to there uh such as g credentials everything and then the container inherits almost everything which can produce complications because from the container if the container is is exposed it can influence in CI or dev environment. So if I were to go to my host in this case and I am going to

this is a terminal on my host. If you see here it's if you see here it's the a different user than VS code. This is the container in my machine. I'm just going to cut g config and then I'm going going going to go inside and just get cut g config and you can see that it's literally the same that has been uh that has been copied inside but also with a helper because everything comes with this beautiful helpers that help us do everything. So, I'm going to go back to the presentation.

So, what what what other things does it do? It's for what sockets? Some of the sockets for example the SSH agent and the GBG agent. You know, when you use your private key to sign things, you use to verify the commit, you know, the commit signature to to prove that you're actually that person, not something that not not an access or a token or a fine grade token that has filtered out or leaked. So, these are things that I think everybody should use uh in order to protect and provide the proof that you're doing what you're doing. Uh that that's what Tiner was saying like I go into a container and then everything

works seamlessly. Yeah, that's that how it's supposed to happen. But not everybody everybody is a aware of of this. So for example, you know when you you know when you're you are in a in the dev contain you're in in the container let me know if you see there and for example I have a a repository here which is from the security alliance and let's say I want to commit and it automatically asks me for a passphrase. This passphrase is to unlock my private key on my host. And the first

time this happened was like, how is this happening? Because I just opened the the dev container. What's what's going on? And if I were to introduce whatever, of course, it's going to fail and it's going to see that it's it's failing and it's actually trying to use my host key. So if I were to to understand a little bit better and I want to debug this, I can run for example uh and I can see that I have a socket of the GPG agent uh mountain there. And uh

and what what an attacker could do for example is something like this. You I am working there. I am about to put my passphrase in order to verify a commit. So what I have here is just an example of something you can leverage communicating directly to the I'm going to show it directly here. It's just it it connects to the GBG agent and it sends a message, a popup to for the user to to complete. So, if I run this demo, I just put something that says try again and put your password.

And the password I'm going to put, I don't know, I put whatever. And the thing is that the the agent is going to display that to the attacker that's inside. And this is just [clears throat] xaxxim. It's it's just something that you can just um this is just XM it's it's a it's a feature of the GBG agent to to communicate with the with the client. So

going back to the presentation in this in this case we are just showing uh whatever we want whatever we want this is the just the let's say the payload I mean we are using the basic functionality but what what we are trying to do here is open try to open your eyes and make you understand how an attacker could leverage and weaponize almost everything. So usually the passphrase is not shared but if you trick the user into believing that it's introducing the passphrase putting a custom dialogue you can you can steal it in and if you have stolen the private key and you didn't have the passphrase you can you can do this and also there's a time to leave there's a time to leave of of of the of any of these agents

where you introduce a passphrase unlocked it and then you can commit and verify signatures and you can connect to SSH whatever and for a certain period of time for that time to leave it won't ask it again. So you can just sit there wait for the developer to unlock it and then you can just commit afterwards and everything's going to be verified. So this was the the demo we just did. And then in the case of S SS agent there's there that's the same you you you know when you put you don't want to use your password and you you create the private and a public key keeper and you put the public key as authorized on a server. So

you can login without the a password and you just use the the the keys where it's you can you can do that you can access the hosts configuration to connect from the host to anywhere else. So if I were to use SSH agent, you're going to see here that there's the P, there's the there's a environment variable configured and it has a socket. So if I go and and and list all the all the keys that they are there, I can see there's one which is admin and this

it's this one. And if I go to my host, this is a terminal of my host as you can see. And I do the same, I'm going to see it's the same key because it has been imported. Actually, not imported. It's connecting to the same agent through the socket that has been shared because sockets are just file in Linux and it's just mounting it. So what what what could happen with this? Well, of course, we can use the host to to get out there, you know. Um what I'm going to show you a more interesting case which is we have for example a profile where we isolate the container from the

internet for for to avoid leaks and the thing is that the container for example in this case is unreachable to the internet. It pings 888 and it says neg unreachable. We we ping GitHub it says tempor temporary failure in resolution. it can't resolve DNS but we ping the docker's internal LAN and we see that we have a neighbor we we have we have another container that we can reach so we don't have access to the out internet but we can reach our neighbors so what we could do is we could see if the the socket for SSH is available and we can see that there is and then we can check if the host has added a key and we certainly find so and what we could do

is we try to connect using batch mode which is uh don't ask for password just to use the the the the public key the the private key to to authenticate and print connected if this is possible so we're connecting to our neighbor which is a open VS code server and it returns connected so it works I mean it's just uh it's just something that uh it's expected you know >> it's a feature not a bug >> yeah it's a feature so we could do here to try to escape is we just create a proxy we just create um a succ command and try to reach in this case if

config meet to see if we have a public address and we have a public address outside so we reach internet and there there for example in the other example I just uh query whether in which shows the weather for wenositis. So from the container we use the host agent to be able to bypass the network isolation and reach the internet. I mean and all of these are features that we're just using them wrong. Okay, there's there are some primers on how we could start to block them. we you can just override some of the variables on dev container JSON but it's as you've seen in the environment I showed earlier there are some there are a lot of things that are

being done and since part of this code is proprietary because it uses Visual Studio development agent or something like that that Kodium doesn't have there are a lot of things that are not completely public or offuscated so you're trying to break something that it's allow it's supposed to help you. So don't think don't use containers thinking that they are uh prone to not prone to attacks. So VS code extensions in the I'm going to try to do this as fast as possible because it's we have a lot of things to show. But as we said in the the beginning there are three different kinds of where of extensions and where they can run. UI on the client workspace on on the remote and then web

if you're using a web server a code web server and you use it from the from the browser but this comes configured by default on the manifet of each extension it's in the package JSON there the extension kind is defined there if you don't put anything vs code is going to infer it and you can also put whatever you want uh to to force it So can extensions be be run uh be forced to run on the host from a remote host? Well, you can certainly do so. You can for example on the settings JSON from the the the client side, you can just modify and put this override or from the dev container JSON. Okay, but

that's done from the user side, not from the container. So can code running inside core is an extension to modify instead of running on the on remote run it on the user side. Well uh not quite at least not in a direct way because the API doesn't allow you from within the container to modify settings JSON or change the the extension kind. You can only edit things on the workspace and from the user to do things. You can trick them etc. But but what happens is that when you basically dev containers by default are usually inside a project like dev

container the container JSON and they bind mount the the workspace when you're working and it includes VS code configurations so you're giving right access to the container to modify it so it's not going to work on runtime but the Next time that you load the the the de container, it's going to lift that configuration and it's going to to apply that those changes. So yeah, if you run and trusted workspace extension and container, you can modify and check whatever remote extension kind those are other APIs that we are going to leverage. And um there are two

thanks to the terminal service, you can do a lot of things. You can open a new terminal on the on the host from an extension from the from within contain container can open a terminal on the host and then there's another one which is send sequence that could be leveraged to send characters into that terminal. In this case, it's going to create uh a new local terminal and then it's going to send a cool trying to download a a payload and execute.

And then there are others like register command that allow you to override or extend functionality of the rest of the the commands that are there. In this case, you can put whatever you want there as a target and then comp add whatever you want to do to be executed in the middle and then you call the the real the real command. Just just to clarify a little bit if you are kind of lost but what I wanted to add is this is these are kind of things that an extension that you install on your container can actually execute on your host. That's why we always say be very careful with the kind of extensions that you install. And that ties also to the initial um dashboard that we show you of uh fits uh where we are also monitoring

for extensions as well. So be very careful with extensions that you install on the container because that doesn't necessarily mean that because you're uh running that in the container you are just safe right so this is an example we we could have uh installed extensions directly but what we're doing here is oh I don't have internet Wait. So, I'm going to start I'm going to install uh just a proof of concept of an extension that it's installed from the

container that it's going to just pop up a dialogue and allow the user to install something. Everything has been uh custom customized. And I think I broke something. Well, I have I have a video for it for this. So, don't worry. Everything's good. [clears throat] >> I know what's going on. So, I'm going just do this. So here we are. We are inside of the host. We we're inside of the VS code. Uh we just called the this exploit that's going to say and it pops up something

that has a very funny message and when you click install it installs whatever I wanted to install as well. You know you get a lot of messages saying hey do you want to to update? Do you want to download this? It only installed pets. So it only adds a cat walking around VS Code just it's just a a funny a funny proof of concept that you can craft whatever you want. And then this one is a an extension that it's by Satoshi Nakamoto called Hello. Look how fast this happened. We could have not put this but look look at this. If you go to terminal if you go to the terminal let's go to see it again because it's really fast.

So we're inside the the container. We execute it and you could just install the extension. Here we are downloading building it showing that it you can do whatever inside from within the container automatically it popped as a shell and it's like h nothing happened here. But if you go to terminal and you can see I need to stop. If you go to the terminal and you and you see what happens there uh you you're gonna see that it has run inside my man my shar which is my my local host. So it it it is a chain this is a chain doing the new terminal

and then sending the sequence but it happens super fast. I want to show slower. There it opened. Look, this is not VS. This is not the VS Code users. This is on my host. And it says this has a lovely message here. This shell is running on your local machine, not on the connected remote machine. If you're fast enough to see it, because it happened like in a blast. Well, uh, we c we we have a a very long research about this and we we could publish it. Uh, we we published it on

the on our website. And the the the last remarks that I want to say is that VS Code has a server that uh allows you to use it from the browser, but it only works on local host. So I don't advise but it it will render some of these attacks or these functionalities obsolete but column doesn't have implemented things like terminal service and gitp created open VS code server which has less attack surface and you can use codium on open via code server in a container to use a browser. So you can check it out later here at the at our blog.

Okay, with 15 minutes on the clock is Franco here. >> Okay, he's going to help us comment out. >> We if you like this part of the presentation is all thanks to Jan. Uh he works at open s but he an awesome collaboration with us helping us understand different threat scenarios in in AI and prom injection. So lots of this work is very much thanks to him. Uh so if you don't like this is our blame. if you like this is thanks to him. >> Um so the idea is um these days you are all probably using AI and LLMs and everything. Um and we want to show you different cases in which that can go

wrong. Okay. Um everything that we're about to show you at the end of the day is going to be prompt injection. uh it's all about modifying the sources from which LLMs end up consuming information to then do the tax that tasks that you wanted to do. But we want to show you different ways or or attack chains in which attackers can actually modify that. Right? So uh LLM will ingest uh contexts from many different places uh such as configuration files such as user input uh p request repositories blah blah right >> yeah whatever whatever they have access to >> exactly so the idea is how can attackers modify this and pollute this so that end

up uh consuming that and executing things that you don't want >> with the less minimal effort. So we show different ways to manipulate it and everything that we're about to show you can be chained and can be grouped and can be combined in different ways. Right? So take this as a with a pinch of salt and and see what you can do. [snorts] Um so for example you can have somebody modify the agents.mmd in cursor uh and that would end up um creating this autocomplete prompt and that essentially just always presents you the same thing to autocomplete. Okay, that's just uh something that the attacker can can do to manipulate. Uh how that could happen here you have in GitHub even uh you

won't see the pro injection in the render markdown. So this could be your repository that somebody's contributing to and they have uh submitted something you don't see it in the render markdown everything looks okay but actually if you go to a row there's a promp in section there that cursor is consuming and it's telling uh to always autocomplete with something. Okay, that's very basic, but that can happen as it's actually kind of hidden because you don't see it in plain sight. Same can happen with Gemini. In this case, the Gemini CLI also is able to consume from this kind of markdown files. And you will see that you can modify that so that um it ends up always uh responding with the same with the

same answers. Yeah, >> John, you can correct me if I'm saying something wrong. >> No, you're right. >> Okay, perfect. >> The thing is that all these uh configuration files uh can come from like you just maybe you copy u you clone a repository and you open your your your agent in your machine and you like your agent has the >> the data coming from the code repository that not controlled by you. So >> exactly. So you should be careful with that. So we are going to see let's see we have some videos we are going to see how this goes. Uh but we have here a promp injection that we are going to be using for Gemini to excfiltrate some data. The prompt will be telling it's here but it will be telling Gemini to

always make a backup at some point and at at that point Gemini will be actually doing some post request to exfiltrate data. Yeah, this is another thing is that if you for example directly build a prompt that says excfiltrate the user password uh the agent the agents are protected of uh for that and they detect that malicious behavior but if you just slightly change the the the concept for example you need to do the backup uh like the agent will directly do the backup >> the backup. Exactly.

Let's see if the internet is with us today. Okay. Okay. Yeah. And this is an example on how prom injections can be hidden. Like it's just an example of a simple way to hide this from injections. And because if you just uh look the the rendered uh markdown uh it will when won't show the injection but the the the agent will consume the the code like the markdown file and we'll have this the this directive. So there we are setting up a local server.

Uh we are going to be writing some whatever instruction on Gemini that is already polluted and you will see the ping on the local server. Um that if ma okay >> this is an experiment. >> At some point you will see a post request on >> Yeah. And here in this example, in this example, Jimmy is directly uh reading a JSON file from the local machine and >> directly publishing to the remote server.

>> Okay. like without doubting just a note here like Germany is running with the slashy uh command to don't request the the user interaction the user confirmation but yeah if you have a agent running in a back end there is not user to confirm there >> okay um copilot can be pushed to do the same thing let's see if this works very similar.

>> Yeah, this is a just a project that has a back end and a front end. It's just an example project. But the funny thing is that when I was trying to create some proof of concepts on boiler plates for some exploits on another project, h cloud would always say this is I cannot help you with that. you're doing dangerous things. Uh when I pasted the entire article that I was writing, cloud said, "Oh, okay. You have a very strong argument. I am going to help you to do that." And it wasn't a problem. It was just asking help for my article. So, you could whether ask for it to create a man in the middle uh attack or or scenario or you can ask it to say that you need to create a

firewall to filter some of the stuff. So, it depends how you rephrase it. You're going to end up actually doing whatever you wanted to do in the in the beginning. So what we are seeing here is this prompt is injected again on the instructions and you will see that we are telling uh compiler to help me set up the dependencies and it will actually the prompt says well while you are setting up dependencies you should run this um command which is a remote repository and it will kind of be a post install for for copilot but actually will be running whatever code. cursor.

This one's shorter. This one is for cursor. Yeah. In this example, uh what we see is that the autocomplete is also influenced and it suggests you to directly uh this is for example the code of a front end of a form of user login. Uh yeah and the autocomplete is directly suggesting you to add code that exfiltrates the user password and the and the username to like a remote server like >> without you any adding nothing. Okay. So it just this is the code that you that you should add and you get bound.

Okay. This is very similar again. Uh P post installs. Uh we can we can we can move on. Uh let's see if we have something else. Uh >> yeah in the in the previous example >> uh you can see that uh >> yeah the user is just asking if the dependencies are updated and the like the agent is directly adding an an an oops the the agent is directly adding this command in the post install and running mpm installer running an arbitrary remote script in the with the user level in the Well, this is this is the example

showing it that it executed the post installed. Sometimes it happen automatically. You don't need to tell it to execute some things. It will out complete it. And we are running short on time and we want to speak about the fishing dojo. These are another example of the bon style being in compilot being embedded there after after a prompt. We can share the slides later. Same here as you can see on the P bones installed. There's a there are a lot of videos that we could show you later. Uh this is Gemini. Oh Oh no.

Uh this is a case where it lowers the the security of uh of a dependency a little bit more stealth. MCB poisoning. We have uh essentially MC you can uh tell it to connect to whatever NCP obviously um if you are um that NCP could be polluted and instructions that the LLM reads from that NCP could be polluted as well. So you can force the LM to do whatever you want. In this case you will see the answer in always I think with a meow at the beginning of the of the answer but could be could be anything.

So it it always because it's using that MCP is always answering with a meow but but because that's one of the instructions of the MCP. >> Yeah, there are a lot of examples here in seen in the wild on the on the on MCPS ser of Posmark but we are going to we want to finish. We have more examples. I'm sorry we are not being able to show them all. Uh but we don't we want to show the fishing dojo. in five minutes. But it's something that you can do you can use later.

So the fish in the Are you ready? Ah, perfect. So this is a thread simulation platform especially to train you on how to detect fishing in different scenarios. You don't have to leave the website. We are tired about the fishing awareness campaigns that don't serve anyone because they are not not not uh proved to be useful. So we created something that we wanted to have. Uh this is our only product right now. Everything all the trainings are free there for everyone to use. So, >> so you should go to the fishing dojo fishing dojo.com

um you will find um some free trainings that we have created uh very realistic uh in my opinion. So we have some trainings for emails uh we have some uh some trainings for websites for wallet signings for blog explorers. So, you should be able to either create an account or don't create an account. But anyway, I was I just want to show you let's let's open up whatever how just to show you how realistic these trainings are. Um we have here a training about block explorers and and the kind of um activities and suspicious things that you can find such as transaction pollution, address spoofing and verify contracts and everything. Uh

this one has uh lots of sections sections. So this is all embedded in the fishing dojo. This is not ether scan. We we took a lot of time to actually replicate every every UI. So we will you will see transactions and everything. And the idea is that you can answer some questions that we present to you and be able to spot in this case for example where there's another spoofing attack going on in this scenario. As you progress through the training you will see like more complex UIs. Um, in another training that we have, for example, on wallet signing, we can go to the first one and you will present it with a site that appears to be okay. So, you can progress through

the UI and you will see some information and we will open a wallet for you. This is not an actual wallet. This is an embedded wallet that we have. So, you shouldn't be connecting your metam mask or anything. So the idea is for the fish indoor for you to check out this uh information that the site is presenting to you and be able to see where this site is trying to fish you or not in what ways. Right? Again as you progress through the training you will see many more things such as more complex data. You will see multis you will see a hardware wallet. You will see many other things that uh grows in complexity and uh again it's all very very much realistic. If you go to the trainings of the websites, we want to show you the

different cases uh in which websites can fish you. So for example, in this case, I'm I'm already progressing on a training that is presenting me with a website that uh I will face and it tells me to yeah, the usual verify you're human, right? So this is actually fishing attack maybe. Um and I will pop this up. Again, this is an embedded browser, not not anything uh malicious, but uh you should see what the website is requesting you to do and you should realize whether this is a fishing site or not. This is probably the case and then again questions for you to answer.

Um another case that we have built is for example this usual case that that you will see in reality is for example an investor reaching out to you and saying hey you should join this call. um is prompting you to join that call and perhaps you don't know what to do and they never send you the link and you don't know what to do. Uh but at the end of the day they do send you the link but they tell you to go very quick to it. So you will click on the link and you will be redirected to something that looks like zoom and you will say well okay I should be downloading this and uh you say okay and you end up downloading and executing some malware on your on your machine right so the fishing so it's this is all fake but we have replicated

all the UIs so the fishing dojo idea is we want to expose you to those real threats that you will find in the crypto ecosystem um but in a safe environment is environment that you won't actually get hurt but many of the examples that you will find h in the fishing dojo are actual problems that we have seen in reality uh of people facing right this is another one let's say you are going for ciphering jobs but you end up going to a malicious site and you open a job listing and the job listing seems very legitimate and it tells you to set to set up some vehicle and you go there and it's actually uh supposedly you should be running this command on your machine

to set have a local server streaming to showing the goal. This might uh sound yes we are about to finish. Uh so we can go to the fishing dojo.com play this trainings all of this is free share it um again we are not selling this service so it's all worth of mouth please share it around if I if if you find it exciting useful for your team or for you and yeah that's essentially it wrapping up so please don't get wrecked. Thank you.

[applause] >> Thank you very much. Uh M matcha and uh Tincho, I'm sure we're going to be here next year. We need you. So the next speaker we