Whisper Leak Attack: AI Chatbots Vulnerable Despite Encryption

Microsoft researchers have identified a sophisticated side-channel attack called Whisper Leak that can infer conversation topics from encrypted AI chatbot traffic. Despite TLS encryption, the attack exploits patterns in packet sizes and timing to classify user prompts. Mitigations have been implemented by multiple vendors, but the risk remains significant, especially in regions with oppressive surveillance. The attack's effectiveness improves with more data, posing a threat to conversation confidentiality in sensitive contexts.

Latest mentioned: 11-10

Earliest mentioned: 11-07

Sources

gbhackers.com microsoft.com thehackernews.com securityaffairs.com securityonline.info

Also Read

Cyber-Attack Exploits Google Find Hub to Wipe Android Data

A new cyber-attack has been discovered exploiting Google’s Find Hub service to remotely wipe data from Android devices. The attack, linked to a long-running APT campaign, involved distributing malicious files disguised as stress-relief programs through a popular messenger. Attackers impersonated psychological counselors and human rights activists to gain trust. Once executed, the infected files obtained Google account credentials and triggered the Find Hub remote-wipe function, deleting all data on targeted smartphones and tablets. This marks the first confirmed case of a state-sponsored group abusing Google’s device management feature for destructive operations.

11-12Read more →