AI RED TEAMING – man-in-the-vector Attack & custom Tooling

Want deeper dives into AI vector embedding attack vectors? See more at Security Sandman. This article provides practical examples to assist red teams and security researches to find and exploit vulnerable AI systems using Vector Databases and even flow chaining tools. I’ve prototyped some simple tools to demonstrate the attack chain and later I’ll finish…

Vector Drift, Prompt Injection, and the Hidden RAG Attack Surface

Source: Custom VectorFANG Testing SCript Thousands of insecure Vector Databases and half configured agent orchestrators just… chilling on the public internet? Sure. Why not. Maybe you don’t even need Vector DB access. Just exploit the thing they meant to make public, the chatbot. Let the user say something nice like, “What’s the easiest way to…

Chaos, Complexity, and the Hidden Structure of Hash Functions in Proof-of-Work

Theoretical Framework Transcendent Epistemological Framework (TEF) We apply TEF to formalize the idea that randomness may depend on the observer. Key axioms include: Chaos Injection Model Let δ(t) = ε·f(t) where f is a logistic map: cppCopyEditx_{t+1} = r·x_t·(1 – x_t), r ∈ (3.9, 4] Define a perturbed nonce: iniCopyEditn_t = t + δ(t) Bias…

Panel 1

Home

CHANGE HEALTHCARE: ITS LITERALLY IN THE NAME

For cyber security folks, we’re both horrified and laughing that a company named “Change Healthcare” who has stockpiles of marketing jargon for “Improving IT Security” also made the news for a cyber incident. As a cyber security professional by day and a partial owner and investor of a new medical business, this breach hits home…

IAM – Okta MFA + AD + OIDC & VAULT

This article covers the end-to-end tasks for deploying and enabling an Okta OIDC supported HashiCorp Vault integration backed with Microsoft Active Directory group memberships. This is a quite long and intensive blog post and isn’t intended for the casual reader. If you want to know whether VAULT supports OIDC and OKTA verify number challenges then…

DEVSEC – protecting cicd with yubikey protected ssh keys

About three months ago, I was studying Yubikey for the use of signed git commits and signed merges. During this, I ended up doing a small PoC on loading my Git repo’s SSH key into a secure hard-token instead of leaving it on my local desktop for malware to compromise. So I took some step-by-step…

Panel 2 Placeholder
Panel 3 Placeholder
Panel 4 Placeholder