#USA #San Francisco #SquareX #DLP #Data Splicing

SquareX Set to Unveil Data Splicing Attacks at BSides San Francisco

In the rapidly evolving landscape of cybersecurity, SquareX is poised to shed light on a critical vulnerability in data protection systems at the upcoming BSides San Francisco 2025. Researchers Jeswin Mathai and Audrey Adeline will present their findings on a new class of attacks termed Data Splicing Attacks. This will explore how attackers can exfiltrate sensitive files and clipboard data while bypassing prominent Data Loss Protection (DLP) vendors.

The Importance of Data Loss Protection (DLP)

DLP systems are integral to any security framework within enterprises. A data breach can lead to significant repercussions, including loss of intellectual property, regulatory infractions, financial penalties, and long-lasting damage to a company’s reputation. With more than 60% of corporate data already stored in cloud environments, web browsers have emerged as essential tools for employees to generate and share information. However, this makes browsers a prime target not only for external threats but also for insider attacks. Unfortunately, traditional endpoint and cloud DLP solutions have limited visibility and control over data interactions within browsers.

The Unique Challenges of Browser Security

As organizations navigate the complexities of modern data management, maintaining data lineage within browser environments presents unique hurdles. Employees often juggle multiple personal and professional identities, leading to a myriad of sanctioned and unsanctioned SaaS applications. This increased fragmentation allows sensitive data to flow between multiple platforms without sufficient oversight from IT departments. In environments where users can subscribe to SaaS services independently, the risk of loss becomes even more pronounced.

A Game Changer in Insider Threats and Cyber Attacks

According to Audrey Adeline, one of the lead researchers, “Data splicing attacks fundamentally change the game for both insider threats and external attackers looking to siphon information from organizations. Utilizing new browser features that were introduced after existing DLP solutions, these attacks leverage architectural vulnerabilities to exfiltrate data without being scrutinized.” As more businesses rely on browsing and cloud storage, the exposure to these vulnerabilities grows, placing vast amounts of sensitive data at risk.

The Open-Source Toolkit: Angry Magpie

During their talk, SquareX will also unveil the Angry Magpie, an open-source toolkit that enables penetration testers and red teams to evaluate their existing DLP strategies and gauge their vulnerability to data splicing attacks. This move is aimed at empowering organizations to proactively assess their risk landscape in the wake of increasing threats that target browser interactions.

A Call to Action

SquareX’s research serves as a clarion call for enterprises and security vendors to reassess their data loss protection methodologies in light of this new threat. As they prepare for their presentation, the team emphasizes the critical need for improved data security strategies in a world where browser reliance is only expected to increase.

After BSides San Francisco, the SquareX team will continue their discussions at RSAC 2025, showcasing their findings and solutions further at Booth S-2361 in the South Expo.

Meet the Speakers

Jeswin Mathai

Currently serving as Chief Architect at SquareX, Jeswin Mathai leads infrastructure design and has delivered talks at renowned security conferences, including DEF CON and Black Hat. His contributions to open-source projects have gained notable recognition in the cybersecurity realm.

Audrey Adeline

As a researcher, Audrey heads the Year of Browser Bugs (YOBB) initiative at SquareX, where she has uncovered significant browser vulnerabilities. A proponent of cybersecurity education, she has participated in various initiatives in collaboration with Stanford University and has a background at Sequoia Capital.

About SquareX

SquareX is at the forefront of browser security, combining innovative technology with a research-driven approach to combat emerging threats. Their groundbreaking Browser Detection and Response platform enables organizations to actively combat client-side web attacks and mitigate risks associated with insider threats and malicious attempts to compromise sensitive data.

For more information about SquareX and its initiatives, interested parties can contact Junice Liew at email.