Podcast Detail

SANS Stormcast Wednesday, August 19th, 2026: Copilot as Whitstleblower; GEEKOM Bad Driver; Medusa Update; Encrypted AI

If you are not able to play the podcast using the player below: Use this direct link to the audio file: https://traffic.libsyn.com/securitypodcast/10058.mp3

previous
Podcast Logo
Copilot as Whitstleblower; GEEKOM Bad Driver; Medusa Update; Encrypted AI
00:00

My Next Class

Click HERE to learn more about classes Johannes is teaching for SANS

Podcast Transcript

 Hello and welcome to the Wednesday, August 19th, 2026
 edition of the SANS Internet Storm Center's Stormcast. My
 name is Johannes Ullrich, recording today from
 Jacksonville, Florida. And this episode is brought to you
 by the SANS.edu Graduate Certificate Program in Cyber
 Defense Operations. Varonis did publish some interesting
 insight into a co-pilot vulnerability that Microsoft
 patched with its last patch Tuesday. This vulnerability
 allows for the exfiltration of confidential data and I think
 it nicely shows how some of these AI systems are really
 hard to secure when it comes to access control. So there
 are a couple of issues here with this vulnerability. First
 of all, with Microsoft Copilot, you can create a URL
 that will automatically pre -fill the prompt. This was
 basically how the vulnerability was exploited.
 The user was tricked into clicking on a link which then
 basically opened co-pilot and pre-filled the prompt. To make
 things worse, there was also an auto run parameter which
 would execute the prompt, well, before any additional
 user interaction. And the intent here was really, you
 know, not that bad. They tried to make it easier to integrate
 co-pilot with other systems. Now, the problem is that co
 -pilot has access to data on your system. So Varonis
 experimented with prompts like, well, you know, what's
 my username? What's my password? And like, what's
 certain environment variables? And after some trial and
 error, they got success and were able to actually then
 incorporate some sensitive data in the prompt. Of course,
 the last part to the puzzle is how do you actually get the
 data out? And this is actually, again, very common
 with AI systems like this, that the AI system has the
 ability to retrieve data from web pages, like a common task
 would be summarize the data that's at this particular URL.
 So what Varonis did here is that they used the environment
 variable, for example, that co -pilot retrieved, built a URL,
 including that environment variable, and then asked co
 -pilot to summarize the content from that URL, which
 means co-pilot reached out the URL, that URL is then hosted
 on the attacker's website, the attacker sees the content of
 the environment variable as part of the URL, and you have
 data exfiltration. So I think the two big patterns here is
 once the data is accessible by the AI, then there is no more
 real good access control. Like Microsoft tried it, they tried
 to sort of build some constraints around what
 prompts you can ask, but there's always a workaround,
 always a way to ask the question that the safeguards
 don't work. The second big problem with many of these
 sort of chatbots and such is essentially server-side
 request forgery, where you can trick the bot into going out
 to arbitrary URLs. And if you can manipulate the URL to
 contain then sensitive content, or maybe you just
 have it reach out to an internal URL, sort of a more
 classic server-side request forgery, well, you have a
 vulnerability. Microsoft patched this vulnerability by
 not allowing some of these links as it did before, so
 essentially breaking some of the integration here, but
 that's at least the only way how we can make sure that
 these sort of no one-click attacks don't work against
 these AI assistants. And this is that the FBI and the
 Department of Health and Human Services did publish an
 updated report on the Medusa ransomware. They first
 published this report in April, but now updated it with
 new indicators of compromise and some additional
 information that they updated. One interesting thing is that
 initially it was sort of more believed to be sort of a
 healthcare-focused ransomware, and that's also why the
 Department of Health and Human Services is involved here, but
 apparently it is more opportunistic and basically
 takes other victims' money as well. The other thing is that
 they added some additional indicators of compromise. One
 that I found interesting is the site OS.site. This is
 often used by pen testers, too, so it's on particular
 sort of bug bounty hunters and such. It runs a public
 instance of Interact.sh, which is often used to basically
 detect exploitability. You get a ping back if the particular
 site or the URL that you attempted to access on that
 site was actually hit. So it's sort of a common site used in
 proof of concepts. Definitely something that you want to
 keep an eye on. I see this in a lot of malware and such also
 being used in a lot of sort of bots that we see sort of going
 around trying to find vulnerable sites. So
 definitely a domain to keep your list of suspect domains
 to watch out for. Well, I just mentioned the first story, how
 difficult it is to implement access control in AI models.
 Well, Google may have an interesting answer here. They
 call it HAIR, H-E-I-R. It's for homomorphic encryption in
 a mediary representation. Homomorphic encryption is not
 really used that much these days, but really here in AI,
 there's a nice use case for it. The idea behind
 homomorphic encryption is that you're able to actually
 operate on the data without decrypting it. So you can
 basically build models and everything without having to
 decrypt the data. It would be interesting to see what the
 computational overhead and such is of this particular
 algorithm, but they open sourced it. So it's free for
 anybody to use. And it appears Geekom, a company that's
 famous for its micro PCs, did distribute malware on one of
 its support websites. The malware came in the form of a
 network driver. Now, there is a little bit dispute here
 between the website videocarts .com. I'll link to that
 because they have, I think, a good sort of summary of what
 may have happened here. But Geekom, on the other hand,
 disputed some of the details here. It's not clear whether
 or not the network driver was actually malicious. I haven't
 seen sort of a malware analysis, but it does trigger
 several antivirus tools. So it's highly likely that this
 network driver is malicious. Now, Geekom's response in part
 did not actually dispute the maliciousness of the driver.
 They just said that this particular driver was no
 longer really active, was no longer current. And the
 website or the page it was hosted on wasn't really
 supposed to be live anymore. So it was just the legacy page
 they forgot to remove. It would still be a problem if
 back in the day they distributed a vulnerable
 driver. Apparently, this particular driver, the hash,
 was around according to virus total records since 2024. It
 did not ship with current systems. So if you have a
 Geekom system and you hadn't changed the drivers it came
 with, you shouldn't have a problem with it. Also, of
 course, only affects the Windows versions. So if you're
 running Windows on these systems, I know a lot of
 people sort of buy them as a little sort of Linux boxes as
 well. So double check that you don't run it. And if you are
 seeing the alert from antivirus and apparently
 Microsoft does flag this particular driver as
 malicious, then head to the link and check on Geekom
 sites. They have a little bit tips on how to then remove
 this particular driver. Well, and that's it for today. So
 thanks for listening. Thanks for liking. Thanks for
 recommending this podcast and talk to you again tomorrow.
 Bye.