15 Ways to Break Your Copilot

Описание: Microsoft Copilot Studio is the technology that powers Microsoft's copilots, and the platform behind custom copilots built in the enterprise. The promise is that everyone can build a secure copilot, under the assumption that every bot will be secure by-default. Does it hold under scrutiny?

In this talk, we will show how Copilot Studio bots can easily be used to exfiltrate sensitive enterprise data circumventing existing controls like DLP. We will show how a combination of insecure defaults, over permissive plugins and wishful design thinking makes data leakage probable, not just possible. We will analyze how Copilot Studio puts enterprise data and operations in the hands of GenAI, and expose how this exacerbates the prompt injection attack surface, leading to a material impact on integrity and confidentiality.

Next, we will drop CopilotHunter, a recon and exploitation tool that scans for publicly accessible Copilots and uses fuzzing and GenAI to abuse them to extract sensitive enterprise data. We will share our findings targeting thousands of accessible bots, revealing sensitive data and corporate credentials.

Finally, we will offer a path forward by sharing concrete configurations and mistakes to avoid on Microsoft's platform, and generalized insights on how to build secure and reliable Copilots.

By:
Michael Bargury | CTO, Zenity
Avishai Efrati | Senior Security Researcher, Zenity

Full Abstract and Presentation Materials:
https://www.blackhat.com/us-24/briefi...