Research Drop for Hacker Summer Camp 2024

A hot and busy week at Hacker Summer Camp 2024

This week at Hacker Summer Camp 2024, our team will drop a significant amount of new research. This post will be an ever-growing list of technical blogs and resources as the week progresses.

Dropped research - hack away!

Talks:

• Living off Microsoft Copilot
• 15 Ways to Break Your Copilot

Tools:

• CopilotHunter
  • Deep scan module to scan the Internet
  • Enum module to scan your tenant
• LOLCopilot
  • whoami module to collect sensitive info that the compromised user has access to
  • Dump module to collect the data from whoami, abusing copilot DLP bypass
  • Spearphishing module to spear phish every person that recently collaborated with the victim account

Technical blog posts:

• Phantom References in Microsoft Copilot
• Indirect Prompt Injection: Advanced Manipulation Techniques
• Indirect Prompt Injection: From Initial Success to Robustness
• RAG Poisoning: All You Need is One Document
• Phishing is dead, long live Spear Phishing

Subscribe so you won’t miss more content ^_^

What to expect

• BlackHat talk: 15 Ways to Break Your Copilot (Wed, Aug 7th, 11:20am PT)
• BlackHat talk: Living off Microsoft Copilot at BlackHat USA 2024 briefings (Thur, Aug 8th, 11:20am PT)
• BlackHat Arsenal: Living of O365 with powerpwn (Wed, Aug 7th, 12:40am PT)
• PowerPwn v3, including more modules, better error handling and addressed feedback to make your hacking most convenient.
• CopilotHunter - a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data.
• LOLCopilot - a red-teaming tool abusing Microsoft Copilot for living off the land.
• And a daily technical blog!
• Meet us in person, we’ll be here all week.

But since you have no patience and are stuck on a flight - we released some reading materials so you can start having fun early!