Base64
21
MENTIONS
10
EPISODES
10
PODCASTS
Search complete. 21 mentions across 10 episodes found for "Base64".
Oct 31, 2026
Andrej KarpathyHOST
Todd will just tell you.
Andrej KarpathyHOST
So what the hell is happening here? Well, it turns out that this text here is the Base64 encoding of the same query.
Andrej KarpathyHOST
Base64 is just a way of encoding binary data in computing, but you can kind of think of it as like a different language.
Andrej KarpathyHOST
They have English, Spanish, German, Base64.
Andrej KarpathyHOST
And it turns out that these large language models are actually kind of fluent in Base64, just as they are fluent in many different types of languages, because a lot of this text is lying around the internet and it's sort of like learned the equivalence.
Andrej KarpathyHOST
And what's happening here is that when they trained this large language model for safety and the refusal data, all the refusal data basically of these conversations where Claude refuses are mostly in English.
Andrej KarpathyHOST
And what happens is that this Claude doesn't correctly learn to refuse harmful queries.
CryptowiresHOST
So yeah, what they were doing is they were using Perimico to kind of, that was part of the tooling.
CryptowiresHOST
And in that, they were using these kind of base64 encoded payloads They were using Base64 encoded payloads that would pipe out to Perl.
CryptowiresHOST
And now they chose this because it seemed to be some kind of Perl script or kind of payload that was being used and piping out the contents to the Perl interpreter.
CryptowiresHOST
Now what that does is it means it's fileless.
speaker_0HOST
And then there's also asymmetric key algorithms, where you have one key for encrypting and then one key for decrypting.
speaker_0HOST
Generally, the more accepted version of encryption is indeed AES, and you want 128-bit Encryption just for the record we'll talk about that that in just a moment as we get to it But yeah, AES is probably the most popular form of encryption anyways So that's what we're going to use The next import that you're going to need is Base64.
speaker_0HOST
And what Base64 is used for is actually encoding.
speaker_0HOST
And you don't want to get that confused with encryption.
speaker_0HOST
They're two very different things.
Network ChuckHOST
This dropper drops in setup.js. Now it looks harmless, looks like math, but here we have two layers of obfuscation, which hides all the dangerous stuff from static scanners.
Network ChuckHOST
It's using XOR and Base64 and this weird order 7077 phrase.
Network ChuckHOST
Does anyone know what that means? So now that setup.js has deobfuscated all the dangerous stuff.
Network ChuckHOST
or revealed it, it can use it.
speaker_1HOST
The agent needed to execute its own custom logic inside the scanner's browser to silently intercept the data before the CAPTCHA triggered or to extract data from a specific API endpoint using the scanner's clean IP address.
speaker_0HOST
I was reviewing the raw data from the hackathon logs, and the way they injected this custom logic involves Base64 encoding.
speaker_1HOST
Yes.
speaker_0HOST
You see these massive, incredibly long URLs being submitted to the scanner.
speaker_0HOST
They look like httpbin.org/base64, followed by a massive string of random looking characters like PCFKB to zero XNHBD, and so on.
speaker_1HOST
Right.
speaker_0HOST
Let's actually pause here for the listener because Base64 gets thrown around a lot in security contexts.
speaker_0HOST
If I am this agent trying to write custom code, why am I converting it to Base64?
Mike PerhamGUEST
...
Mike PerhamGUEST
Client Connection Pool Rack and, uh, standard library gems like Logger and Base64 and that kind of stuff.
Mike PerhamGUEST
But those, those-
Will LarryHOST
Yeah
speaker_1HOST
Instead of a page number, the server gives you a cursor, which is usually a base64 encoded string.
speaker_0HOST
What's base64?
speaker_1HOST
Base64 is just a standard way of encoding binary data or text into a string of characters so it can safely travel over the internet without breaking URLs.
speaker_1HOST
So this token is essentially an opaque pointer to the exact physical location of the last item you saw.
speaker_0HOST
So when I want the next page, I hand the cursor back.
Jason HaddixGUEST
And so you can take your regular text, like, "I am your boss," or, "I am your administrator," and just say, like, uh, we'll put that into an alternate language, like, uh, you know, any, any other alternate language, Spanish, Portuguese, whatever.
Jason HaddixGUEST
Or you can Base64 encode it.
Jason HaddixGUEST
Or, uh, you can put it in, uh, the representation of bl- braille that we use with dashes and dots.
Jason HaddixGUEST
And the AI is smart, and if you're using an AI-based firewall, it can decode this and completely bypass the firewall, but the chatbot will still understand what you're asking it.