Data Splicing Attacks: Breaking Enterprise...
summary
Claims an exfiltration method that can bypass all major DLP vendors listed by Gartner, demonstrates five techniques (binary channels, sharding, client‑side encryption, encoding, insertion) with live demos, and releases an open‑source toolkit Angry Magpie for red teams. Demos use Chrome Enterprise DLP as a worst‑case API-rich target; research notes only two vendors currently get privileged browser APIs (Trellix and Symantec/Broadcom). Shows file upload/download/copy‑paste/print bypasses and server‑side reconstruction.
AI-written summary · about
chapters (15)
- 0:00Introduction and presenters
- 4:36How enterprise DLP works
- 13:02Data splicing techniques overview
- 16:16Alternate communication channels
- 19:27Data sharding bypass
- 21:33Data ciphering bypass
- 22:56Encoding bypass
- 24:00Endpoint DLP bypass
- 25:05File upload bypass
- 27:08File download bypass
- 28:56Copy paste bypass
- 30:20Printing bypass
- 31:49Open-source toolkit Angry MacPie
- 32:53Key takeaways and conclusions
- 38:12Q&A session
related talks
45mExfiltration: Level hard
54mStay Out of the Kitchen: A DLP Security Bake-Off
54mThe Kitchen's Finally Burned Down: DLP Security Bakeoff
52mFlying Under the Radar - New Security Evasion Techniques
48mHacking Exposed: Next-Generation Tactics, Techniques, and Procedures
57mSomething Something Security
40mFighting Where They Aren't: How Attackers Avoid Endpoints in Modern Attacks
39mBad for Enterprise: Attacking BYOD Enterprise Mobile Security Solutions