Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

aim.security

Post reply on HN
Print view View original

21–30 of 100 posts

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#21

Post by bstsb »

filbert42 wrote: post #16
bstsb wrote: post #7

Earlier quoted context omitted.

the classification seems very high (9.3). looks like they've said User Interaction is none, but from reading the writeup looks like you would need the image injected into a response prompted by a user?

if I understand it correctly, user's prompt does not need to be related to the specific malicious email. It's enough that such email was "indexed" by Copilot and any prompt with sensitive info request could trigger the leak.

yeah but i wouldn't really class that as "zero-click" etc. maybe Low interaction required

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#22

Post by smcleod »

This reads like it was written to make it sound a lot more complicated than the security failings actually are. Microsoft have been doing a poor job of security and privacy - but a great job of making their failings sound like no one could have done better.

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#23

Post by [deleted] »

smcleod wrote: post #22

This reads like it was written to make it sound a lot more complicated than the security failings actually are. Microsoft have been doing a poor job of security and privacy - but a great job of making their failings sound like no one could have done better.

[deleted]

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#24

Post by soulofmischief »

bstsb wrote: post #5

this seems to be an inherent flaw of the current generation of LLMs as there's no real separation of user input. you can't "sanitize" content before placing it in context and from there prompt injection is almost always possible, regardless of what else is in the instructions

Double LLM architecture is an increasingly common mitigation technique. But all the same rules of SQL injection still apply: For anything other than RAG, user input should not directly be used to modify or access anything that isn't clientside.

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#25

Post by reaperducer »

hiatus wrote: post #20
bstsb wrote: post #5

this seems to be an inherent flaw of the current generation of LLMs as there's no real separation of user input. you can't "sanitize" content before placing it in context and from there prompt injection is almost always possible, regardless of what else is in the instructions

It's like redboxing all over again.

It's like redboxing all over again.

There are vanishingly few phreakers left on HN.

/Still have my FŌN card and blue box for GTE Links.

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#27

Post by Fr0styMatt88 »

reaperducer wrote: post #25
hiatus wrote: post #20

Earlier quoted context omitted.

It's like redboxing all over again.

It's like redboxing all over again. There are vanishingly few phreakers left on HN. /Still have my FŌN card and blue box for GTE Links.

Great nostalgia trip, I wasn’t there at the time so for me it’s second-hand nostalgia but eh :)

https://youtu.be/ympjaibY6to

Re: EchoLeak – 0-Click AI Vulnerability Enabling Data Exfiltration from 365 Copilot

#30

Post by moontear »

bix6 wrote: post #12

Love the creativity. Can users turn off copilot to deny this? O365 defaults there now so I’m guessing no?

O365 defaults there now? I‘m not sure I understand.

The Copilot we are talking about here is M365 Copilot which is around 30$/user/month. If you pay for the license you wouldn’t want to turn it off would you? Besides that the remediation steps are described in the article and MS also did some things in the backend.

Post reply on HN