Security Now Examines AI Patching Limits, Prompt Injection and Router Backdoors
· 2:52:00 · Watch on YouTube ↗
Summary
Security Now discusses limitations in AI-generated security patches, proposes an untested approach to detecting prompt injection, and reviews researchers' findings of remote-command implants in ZBT routers.
Key points
- The discussion emphasizes that AI-generated vulnerability patches still require expert review to establish whether they fully mitigate the issue without introducing erroneous changes.
- Steve Gibson describes research in which models continued recognizing commands inside untrusted content despite role tags intended to distinguish data from instructions.
- Gibson proposes monitoring model activations through the dialogue manager and aborting processing when detected roles conflict with expected roles. The proposal is untested and depends on detection resisting adversarial manipulation.
- Research attributed to Jacob Baines describes an Endless Doors implant in a ZBTLink AX3000 router, using a customized RCTL client to receive commands and execute them as root without server authentication.
- Researchers demonstrated an interactive root shell through a controlled command server. The implant's outbound connection avoids requiring an externally reachable listening port.
- A separate Deep Orange router, identified as a white-labeled ZBT-W826-T2, reportedly contained Speaking stone and Dark Lantern implants in older firmware, including unauthenticated command execution on the WAN interface.
Article Details
- Topics
- [17:57] Prompt injection, role confusion and separating instructions from untrusted data
- [33:51] Proposed activation monitoring to detect role confusion and abort unsafe processing
- [40:01] Research into remote-command implants in white-labeled ZBT routers
- [01:00:15] Limitations of randomized role tags and external dialogue managers
- [01:24:39] Harness design and model security
- [01:51:53] AI-generated security patches and the continuing need for expert validation
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 47[.]107[.]224[.]89 | Command-and-control address configured in the customized RCTL implant found on the ZBTLink AX3000 router. |
MITRE ATT&CK
People
Jacob BainesResearcher quoted describing the investigation of a ZBTLink AX3000 router, its remote-command implant and a demonstrated interactive root shell.Kevin DurbanSecurity engineer whose listener feedback raises harness-level approaches to improving model security.Steve GibsonSecurity Now host who analyzes prompt-injection research and proposes an untested dialogue-manager defense based on monitoring model activations.Wesley GregoryListener who proposes randomized hashes on role tags as a possible prompt-injection defense; the discussion explains limitations of that approach.