We Hack Purple Podcast 78 with Jason Haddix

In episode 78 of the We Hack Purple Podcast host Tanya Janca brings Jason Haddix on to talk about artificial intelligence, and (of course) how to hack it! Jason discussed how to use AI for both defense and offence, using plain language (conversational), rather than code, and what a red teaming exercise looks for such a system. We talked about what a large language model looks like, cleaning up data, and how easy it is to get them to do bad things. Jason invited everyone to the AI Village at Def Con this year, and so much more! There was also much love for Daniel Miessler, his articles on AI, and his newsletter Unsupervised Learning (https://danielmiessler.com/newsletter/). Listen to hear the whole thing!

More about Jason:
Jason Haddix AKA jhaddix is the CISO and “Hacker in Charge” at BuddoBot, a world-class adversary emulation and red teaming consultancy. He’s had a distinguished 18-year career in cybersecurity previously serving as the CISO of Ubisoft, Head of Trust/Security/Operations at Bugcrowd, Director of Penetration Testing at HP, and Lead Penetration Tester at Redspin. He has also held positions doing mobile penetration testing, network/infrastructure security assessments, and static analysis. Jason is a hacker, bug hunter and currently ranked 51st all-time on Bugcrowd’s bug bounty leaderboards. Currently, he specializes in recon, web application analysis, and emerging technologies. Jason has also authored many talks on offensive security methodology, including speaking at cons such as DEFCON, Besides, BlackHat, RSA, OWASP, Nullcon, SANS, IANS, BruCon, Toorcon and many more.

Jason Links!

Buddobot: A red team consultancy offering adversary simulation, emulation, red teaming, and penetration testing. We focus on year-long campaigns, and a purple mindset of defensive consulting.

https://buddobot.com/
  / buddobot  
  / mycompany  

Find Jason:

  / jhaddix  
https://www.jhaddix.com/
  / jhaddix  

Jason’s Newsletter:

https://executiveoffense.beehiiv.com/
Jason’s training happening in July:
https://tbhmlive.com/

Links to learn WAY MORE about AI
https://owasp.org/www-project-top-10-...
https://atlas.mitre.org/
https://danielmiessler.com/p/the-ai-a...
https://aivillage.org/large%20languag...
https://gandalf.lakera.ai/
https://incidentdatabase.ai/
https://github.com/Mooler0410/LLMsPra...
https://github.com/Azure/AI-Security-...
https://nvlpubs.nist.gov/nistpubs/ai/...
https://github.com/Trusted-AI/adversa...
https://learn.microsoft.com/en-us/sec...
https://github.com/moohax
  / moo_hax  

Very special thanks to our sponsor!
Semgrep Supply Chain’s reachability analysis lets you ignore the 98% of false positives in open source vulnerabilities and quickly find and fix the 2% of issues that are actually reachable.
Get Your Free Trial Here!
https://semgrep.dev/products/semgrep-...


Semgrep also makes a ludicrously fast static analysis tool They have a free and paid version of this tool, which uses an open-source engine, and offers additional community created ruleset! Check out Semgrep Code HERE https://semgrep.dev/products/semgrep-...



Join We Hack Purple!

Check out our brand new courses in We Hack Purple Academy (https://academy.wehackpurple.com/). Join us in the We Hack Purple Community (https://community.wehackpurple.com/): A fun and safe place to learn and share your knowledge with other professionals in the field. Subscribe to our newsletter (https://newsletter.wehackpurple.com/) for even more free knowledge! You can find us, in audio format, on Podcast Addict, Apple Podcast, Overcast, Pod, Amazon Music, Spotify, and more!