RESEARCH
December 2024: jailbreaks from the wild, flawed 5G cores, deceived FIDO2 keys
OT and industrial securityRansomware
December 2024 is the month of the ACM CCS proceedings. Jailbreaks collected from the web bypass the safeguards of major LLMs. Fuzzing LTE and 5G cores finds 119 vulnerabilities and satellite modems show 18 new attacks. Even FIDO2 keys can be deceived, while address poisoning on Ethereum costs victims millions of dollars.
Archive: reconstruction written in November 2026
1. "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
ACM Conference on Computer and Communications Security · Xinyue Shen, Zeyuan Chen, Michael Backes A, Yun Shen et al. · AI & LLM Security
In short: 1,405 jailbreak prompts collected online bypass the safeguards of six popular LLMs.
JailbreakHub analyses 1,405 jailbreak prompts from December 2022 to December 2023 and identifies 131 communities producing them, increasingly on aggregator sites. Across 107,250 questions in 13 forbidden scenarios, the safeguards of six popular LLMs fail to hold. Five prompts reach 95% success on GPT-3.5 and GPT-4, and the oldest stayed online for a long time.
Why it matters. Commercial model safeguards can be bypassed with public prompts: customer-facing LLM uses cannot rely on them alone.
2. RANsacked: A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces
ACM Conference on Computer and Communications Security · Nathaniel Bennett, Zhu Wei-dong, Benjamin Simon, Ryon Kennedy et al. · Systems & Software Security
In short: Fuzzing LTE and 5G core interfaces finds 119 vulnerabilities, with 93 CVEs.
Cellular cores take input from base stations and devices, yet few techniques test them. The authors build a fuzzing framework and ASNFuzzGen, which compiles ASN.1 specifications into test modules. Across seven open-source and commercial cores they find 119 vulnerabilities with 93 CVEs, stemming from common implementation mistakes, later patched with the vendors.
Why it matters. Mobile networks are shared infrastructure: a flaw common to several vendors can disrupt service for many customers at once.
3. A Comprehensive Analysis of Security Vulnerabilities and Attacks in Satellite Modems
ACM Conference on Computer and Communications Security · Lingjing Yu, Jingli Hao, Jun Ma, Yong Sun et al. · CPS & IoT Security
In short: First security analysis of satellite modems: 16 vulnerabilities and 18 new attacks.
Satellite modems govern communication when the satellite acts only as a relay, yet they are more accessible and less protected. The authors take apart commercial modems, measure those exposed on the Internet and find 16 vulnerabilities across the satellite interface, ground network and hardware. With AirSecAnalyzer, on nine real modems, they show 18 new attacks.
Why it matters. Ships, remote sites and emergency networks depend on these devices: a weak link rarely considered in assessments.
4. TDXdown: Single-Stepping and Instruction Counting Attacks against Intel TDX
ACM Conference on Computer and Communications Security · Luca Wilke, Florian Sieck, Thomas Eisenbarth · Hardware & Side Channels
In short: Intel TDX's single-stepping countermeasures can be bypassed.
Intel TDX protects whole virtual machines in the cloud and includes a defense against single-stepping, the most powerful side-channel attack on trusted execution environments. The authors show for the first time that both detection and prevention can be bypassed by deceiving the monitor about elapsed time, and that a design flaw makes prevention itself exploitable.
Why it matters. Confidential computing is sold as a guarantee for cloud data: its hardware protections need verifying, not assuming.
5. Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays exploiting Limited Display Authenticators
ACM Conference on Computer and Communications Security · Ahmed Tanvir Mahdad, Mohammed Jubur, Nitesh Saxena · Identity & Authentication
In short: An overlay attack tricks users into approving an attacker's login with their FIDO2 key.
FIDO2 keys are considered among the strongest second factors. FIDOLA exploits operating system limits and the keys' small displays to inject hidden login sessions: users think they are signing in to one service but approve the attacker's request, even for a different, more sensitive service such as a financial one. The FIDO specification does not address this scenario.
Why it matters. Even strong authentication leaves room for deception: worth knowing when weighing MFA as a key control.
6. Characterizing Ethereum Address Poisoning Attack
ACM Conference on Computer and Communications Security · Shixuan Guan, Kai Li · Blockchain & DeFi
In short: Address poisoning on Ethereum caused potential losses of up to 144 million dollars.
The attack exploits address shortening in wallets and explorers: the attacker plants transfers from near-identical addresses in the victim's history and waits for a mistaken payment. Poison-Hunter, run on blocks from November 2022 to February 2024, finds millions of phishing transfers, mostly against USDC and USDT holders, and over 1,800 victims.
Why it matters. A fraud that exploits the interface and user habit: relevant to covers for digital asset custody and payment fraud.
7. "Better Be Computer or I'm Dumb": A Large-Scale Evaluation of Humans as Audio Deepfake Detectors
ACM Conference on Computer and Communications Security · Kevin Warren, Tyler Tucker, Anna Crowder, Daniel Olszewski et al. · Policy, Law & Society
In short: Over 1,200 people recognise real voices better than models, but are misled by their own preconceptions.
The first large-scale user study on audio deepfake detection, with over 1,200 participants and samples from the three most cited datasets. People classify human voices better than machine learning models and rely on language and intuition. But they are often misled by wrong ideas about synthetic voice, such as believing accents and background noise indicate a human.
Why it matters. In cloned-voice fraud the human ear is a weak control: payment requests need process-level verification.
8. Optimization-based Prompt Injection Attack to LLM-as-a-Judge
ACM Conference on Computer and Communications Security · Jiawen Shi, Zenghui Yuan, Yinuo Liu, Yue Huang et al. · AI & LLM Security
In short: An optimised sequence inserted into a response makes an LLM judge always pick that response.
LLMs used as judges pick the best answer in search, feedback-based training and tool selection. JudgeDeceiver uses a gradient-based method to compute a sequence to insert into the attacker's response, which is then chosen whatever the alternatives. It is far more effective than handcrafted injections, and the defenses tested are insufficient.
Why it matters. When an LLM decides which source or tool to use, that decision becomes a target for manipulation.
9. Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets
Network and Distributed System Security Symposium · Daniel Klischies, Philipp Mackensen, Veelasha Moonsamy · Web & Mobile Security
In short: Android chipset vulnerabilities are inherited across generations and hit thousands of phone models.
The first unified knowledge base links 3,676 vulnerabilities in 437 chipsets from the four main manufacturers to 6,866 smartphone models. The same flaws often carry over between chipset generations, the 90-day responsible disclosure period is seldom respected, and a single vulnerability affects hundreds to thousands of models, with updates often uncertain.
Why it matters. Company phones can stay vulnerable for long periods because of upstream delays the company does not control.
10. CanCal: Towards Real-time and Lightweight Ransomware Detection and Response in Industrial Environments
ACM Conference on Computer and Communications Security · Shenao Wang, Feng Dong, Hangfeng Yang, Jingheng Xu et al. · Malware & Threat Intelligence
In short: A lightweight system detects ransomware in real time in industrial settings without flooding analysts with false alarms.
Behavioural detection is too costly when it monitors every process; decoy-based detection gives too many false positives in large industrial clusters. CanCal filters suspicious processes across layers and analyses only those in depth, separating ransomware from legitimate operations. It ran for five months in a large industrial setting, with 1,761 ransomware samples and about 3 million events.
Why it matters. In plants a false alarm halts production as much as an attack: precise detection reduces both losses.
Trends of the month
Network Security
56 papers this month on this topic
The month's thread is shared communication infrastructure. Fuzzing LTE and 5G cores yields 93 CVEs across several vendors, satellite modems turn out to be exposed on the Internet and attackable, and Android chipset vulnerabilities carry over between product generations. In all three cases the same mistake repeats across many devices: for insurers it is an accumulation issue more than a single-client one.
Papers cited:
- RANsacked: A Domain-Informed Approach for Fuzzing LTE and 5G RAN-Core Interfaces
- A Comprehensive Analysis of Security Vulnerabilities and Attacks in Satellite Modems
- Vulnerability, Where Art Thou? An Investigation of Vulnerability Management in Android Smartphone Chipsets
AI & LLM Security
230 papers this month on this topic
With 230 papers, AI security remains the broadest topic. Two CCS papers show how fragile safeguards are: jailbreaks circulate in organised communities and work on commercial models, and an optimised sequence manipulates LLMs used as judges. Risk grows where a model makes decisions instead of people, for example when choosing sources or tools.
Papers cited:
- "Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Models
- Optimization-based Prompt Injection Attack to LLM-as-a-Judge
Identity & Authentication
72 papers this month on this topic
Three papers show how deceiving the user gets around controls considered solid. A FIDO2 key approves an attacker's login, the human ear misjudges synthetic voices because of common preconceptions, and on Ethereum near-identical addresses lead to mistaken transfers worth millions of dollars. The common point is the interface: anyone assessing anti-fraud controls should look at how users see and confirm a transaction.
Papers cited:
- Breaching Security Keys without Root: FIDO2 Deception Attacks via Overlays exploiting Limited Display Authenticators
- "Better Be Computer or I'm Dumb": A Large-Scale Evaluation of Humans as Audio Deepfake Detectors
- Characterizing Ethereum Address Poisoning Attack
How this digest is made
This issue belongs to the digest archive, reconstructed after the fact. The month's papers were collected from arXiv, the IACR ePrint archive and the main security conferences and journals; the selection also weighs the citations received since publication. An AI model assessed the candidates and wrote the summaries, which are based on the abstracts: the original paper is the reference for details.
Papers of the month assessed: 1853.