• Search for:
    22Jul, 2024
    Six Opportunities for Scientists and Engineers to Learn Programming Using AI Tools Such as ChatGPT
    Six Opportunities for Scientists and Engineers to Learn Programming Using AI Tools Such as ChatGPT

    In today’s scientific and engineering advancement era, AI technologies are revolutionizing how researchers approach programming and data analysis tasks. Here are some opportunities where AI tools like ChatGPT are making a significant impact: personalized tutorials tailored to specific domains, assistance learning complex data visualization libraries and new programming languages, refactoring and understanding legacy code, and challenging assumptions in scientific coding practices. These tools not only expedite learning and enhance productivity but also encourage deeper critical evaluation, fostering innovation and improving code quality across scientific disciplines.

    OPPORTUNITY 1: Using AI to Create Customized Programming Tutorials for Your Domain

    Harnessing AI tools to create personalized programming tutorials tailored to specific scientific or engineering domains is paramount. Traditional tutorials often use generic datasets such as “iris” or “mtcars,” which may lack relevance to learners outside those fields. For example, a geologist learning Python could benefit from tutorials using geological survey data rather than standard datasets like flower measurements or car specifications.

    OPPORTUNITY 2: Using AI to Learn Complex Data Visualization Libraries

    Scientific programmers frequently navigate intricate data visualization tasks. AI can simplify learning complex libraries like Matplotlib or ggplot2 by generating tutorials that align with specific research needs. For instance, a marine biologist aiming to visualize biodiversity trends could receive tailored tutorials on creating dynamic scatterplots that differentiate fish species by color, shape, and size.

    OPPORTUNITY 3: Refactoring Exploratory Code into Maintainable Software

    In scientific research, initial exploratory code often evolves into long-term solutions requiring clarity and maintainability. AI can assist by analyzing code structures and recommending improvements. For example, AI tools can suggest refactoring options such as modularizing analysis scripts or standardizing variable naming conventions, enhancing code readability and sustainability.

    OPPORTUNITY 4: Understanding Inherited Legacy Code

    Scientists frequently inherit complex legacy codes from previous researchers. AI tools can aid by providing detailed explanations and supplementary documentation to demystify inherited codebases. For example, when inheriting climate modeling algorithms, AI can clarify the logic behind temperature variance calculations, facilitating quicker adaptation and modification for new research purposes.

    OPPORTUNITY 5: Learning New Programming Languages on Demand

    Adapting to new programming languages is crucial in scientific endeavors where specific libraries or tools may necessitate rapid skill acquisition. AI can expedite this process by translating example code snippets between languages. For instance, a bioinformatician needing to implement genetic sequence analysis in Julia can utilize AI to translate existing Python scripts into Julia syntax, accelerating the learning curve within their existing computational workflow.

    OPPORTUNITY 6: Questioning Assumptions in Scientific Code

    Ensuring scientific code aligns with accurate assumptions is critical for reliable research outcomes. AI tools can serve as critical evaluators, prompting researchers to justify algorithmic choices and statistical methods. For example, AI can question the rationale behind statistical tests chosen for genomic data analysis, promoting deeper scrutiny of scientific hypotheses and ensuring robust methodological integrity.

    Conclusion

    AI tools like ChatGPT present significant opportunities for scientists and engineers to enhance their programming proficiency and streamline research workflows. By leveraging AI’s capabilities alongside human expertise, researchers can optimize coding practices, accelerate learning of new technologies, and foster rigorous scientific inquiry.

    Reference: https://ieeecs-media.computer.org/media/marketing/cedge_digital/ce-jul24-final.pdf

    26Dec, 2023
    MySQL Servers, Docker Hosts Infected With DDoS Malware

    Attackers are targeting MySQL servers and Docker hosts to plant malware capable of launching distributed denial-of-service (DDoS) attacks, according to a warning from researchers at the AhnLab Security Emergency Response Center.

    According to AhnLab, attacks targeting MySQL on Windows have increased in frequency with vulnerable MySQL servers infected with ‘Ddostf’, a DDoS-capable botnet of Chinese origin that has been around since at least 2016.

    Malicious attackers, AhnLab warns, scan the internet for publicly-accessible MySQL servers using the TCP port 3306, and then attempt to compromise them either using weak credentials or exploiting known vulnerabilities.

    The attackers then upload a malicious DLL as a UDF (User-Defined Function) library, which allows them to execute commands on the infected system and to deploy and execute the Ddostf malware.

    Targeting both Linux and Windows environments, Ddostf achieves persistence and then collects system information and sends it to the command-and-control (C&C) server. It then waits for commands to launch DDoS attacks such as SYN, UDP, and HTTP GET/POST floods.

    “Although most of the commands supported by Ddostf are similar to those from typical DDoS bots, a distinctive feature of Ddostf is its ability to connect to a newly received address from the C&C server and execute commands there for a certain period,” AhnLab explained.

    The malware appears to be designed solely for launching DDoS attacks and the researchers believe the threat actor is operating a DDoS-for-hire service.

    OracleIV DDoS-capable malware

    Separately, Cado Security is warning in a new report that Docker hosts are being targeted with the OracleIV DDoS-capable malware, via the Docker Engine API, an HTTP API served by Docker Engine.

    Attackers are scanning for publicly-exposed instances of the Docker Engine API to deploy a malicious container that hosts Python malware compiled as an ELF executable.

    According to Cado, the accidentally exposed Docker Engine API instances have been a popular target for attackers in recent years, especially for deploying cryptocurrency miners. “Once a valid endpoint is discovered, it’s trivial to pull a malicious image and launch a container from it to carry out any conceivable objective. Hosting the malicious container in Dockerhub, Docker’s container image library, streamlines this process even further,” the company said.

    Cado said it observed attackers making HTTP POST requests to retrieve a malicious image from Dockerhub and spawn a container from it. The malicious Docker image, Cado says, has over 3,000 pulls and appears to be updated regularly.

    Baked within the image, OracleIV supports commands for UDP, UDP_PPS, SSL, SYN, HTTP/GET, and SLOW flood attacks, although some of the functions are not working.

    Resource : https://www.securityweek.com/mysql-servers-docker-hosts-infected-with-ddos-malware/

    23Dec, 2023
    Crypto Exchange Hack Guilty Plea, Rating AI Vulnerabilities, Intellexa Spyware 

    SecurityWeek is publishing a weekly cybersecurity roundup that provides a concise compilation of noteworthy stories that might have slipped under the radar.

    We provide a valuable summary of stories that may not warrant an entire article, but are nonetheless important for a comprehensive understanding of the cybersecurity landscape.

    Each week, we will curate and present a collection of noteworthy developments, ranging from the latest vulnerability discoveries and emerging attack techniques to significant policy changes and industry reports.

    Here are this week’s stories:  

    Ukrainian hackers target major Russian water utility 

    In revenge for the recent Russian attack on Kyivstar, Ukraine’s largest mobile network operator, Ukrainian hackers claim to have launched an attack on Rosvodokanal, the largest private water utility in Russia. The hackers claim to have stolen documents, encrypted 6,000 computers, and deleted 50 Tb of data, disrupting operations. Rosvodokanal is responsible for providing water to millions of consumers, but there do not appear to be any reports of the water supply being impacted by the attack. 

    Former security engineer admits hacking two cryptocurrency exchanges

    The US Justice Department announced that Shakeeb Ahmed has pleaded guilty to hacking two decentralized cryptocurrency exchanges, stealing over $12 million worth of cryptocurrency. The attacks were carried out in 2022 and targeted Nirvana Finance and Crema Finance. The DOJ described Ahmed as a former security engineer at an international technology company, which appears to be Amazon.

    Apple and Adobe patches

    Apple and Adobe have each released patches for a single vulnerability. Apple released macOS Sonoma 14.2.1 to address a WindowServer issue that involved content being unintentionally exposed when users shared their screen. Adobe released an Experience Manager Forms update to address an Apache Struts vulnerability that has been exploited in the wild. 

    Hundreds of TeamCity instances still vulnerable to attacks

    Hundreds of TeamCity instances are vulnerable to attacks exploiting CVE-2023-42793, according to Censys. The Russian cyberespionage group known as APT29 has been exploiting the vulnerability on a large scale since September 2023, according to government agencies.

    GWT vulnerability remains unpatched 8 years after discovery

    A potentially serious vulnerability affecting GWT, a popular open source web application framework, remains unpatched eight years after it was discovered, according to Bishop Fox. The flaw can expose application owners to unauthenticated server-side code execution. There have been several discussions on the security hole since 2015, but it still has not been fixed. Bishop Fox has published a blog post describing how the vulnerability can be exploited and how developers can check if their GWT-based application is affected. 

    AI vulnerability rating taxonomy for LLMs

    Bug bounty platform Bugcrowd has updated its Vulnerability Rating Taxonomy (VRT) to define how AI vulnerabilities in Large Language Models (LLMs) are classified, reported, and prioritized on its platform in an effort to enable hackers and customers to have a shared understanding of how these types of flaws are handled. 

    Payment fraud underground shows signs of recovery 

    Recorded Future has published its 2023 Payment Fraud report, which reveals that the payment fraud underground is showing signs of recovery following Russia’s crackdown on domestic cybercriminals and its invasion of Ukraine. The report also shows that the volume of stolen payment cards on carding shops has started to rebound. A total of 119 million cards were offered for sale, with a median fraud charge of $79. 

    Google shuts down thousands of YouTube channels 

    Google has terminated thousands of YouTube channels as part of investigations into influence campaigns linked to China, Russia, and Iran. Ads accounts, domains, and other resources linked to these campaigns were also blocked. Hundreds of YouTube accounts linked to campaigns in Turkey, Azerbaijan, Ethiopia, and Sudan also got the ax. 

    Intellexa and its Alien/Predator spyware products

    Cisco has published a new report detailing the evolution of Intellexa, ‘an intelligence agency-grade spyware vendor’ that emerged from the ashes of Cytrox, after it was bought. The report also dives into the vendor’s Alien/Predator line of implants, which were found to persist device reboots. 

    CISA finalizes Microsoft 365 secure configuration guidance

    US cybersecurity agency CISA announced that the final version of its Microsoft 365 Secure Configuration Baselines guidance, which includes input from a public comment period, is now available to the public. The guidance, which aims to help organizations improve the security and resilience of their M365 services, is accompanied by an updated SCuBAGear tool, enabling interested parties to assess their M365 services against CISA’s baselines.

    Resource : https://www.securityweek.com/in-other-news-crypto-exchange-hack-guilty-plea-rating-ai-vulnerabilities-intellexa-spyware/

    22Dec, 2023
    Indian tech giant HCL investigating ransomware attack

    Indian information technology company HCL Technologies reported a ransomware attack to regulators on Wednesday and said that it is investigating the incident.

    In a filing with the National Stock Exchange of India, the company said it “has become aware of a ransomware incident in an isolated cloud environment for one of its projects.”

    “There has been no impact observed due to this incident on the overall HCLTech network. Cybersecurity and data protection is a top priority for HCLTech,” the company’s secretary Manish Anand said.

    “A detailed investigation is underway in consultation with relevant stakeholders to assess the root cause and take remedial action as necessary. This is for your information and records.”

    HCL Technologies, based in Noida, is one of the largest tech companies in the world with more than 225,000 employees spread across 52 countries. The company reported revenues of $13 billion for fiscal 2023. HCL Technologies shares fell 3.24% on Wednesday.

    This is the latest ransomware attack in 2023 to target a major Indian corporation. The country’s largest drugmaker, Sun Pharmaceuticals, confirmed a ransomware attack in regulatory filings in March, warning that the incident involved the theft of company data and personal information.

    Tata Power reported a cyberattack in October 2022 that affected its billion-dollar power business. Tata did not call the incident a ransomware attack but reported that it was forced to “restore” systems and segment the affected networks in order to protect other parts of their business.

    In April, India’s Computer Emergency Response Team (CERT-In) said that reported ransomware attacks on organizations in the country increased 53% throughout 2022.

    “IT & [Information Technology Enabled Services] was majorly impacted sector followed by Finance and Manufacturing. Ransomware players targeted critical infrastructure organizations and disrupted critical services in order to pressurize and extract ransom payments,” they said.

    Resource : https://therecord.media/hcl-india-ransomware-attack?&web_view=true

    19Dec, 2023
    MITRE Unveils EMB3D Threat Model for Embedded Devices Used in Critical Infrastructure

    MITRE has teamed up with the cybersecurity community and the industrial sector to create EMB3D, a threat model specifically designed for embedded devices used in critical infrastructure.

    EMB3D is the work of MITRE, Red Balloon Security, Narf Industries, and Niyo ‘Little Thunder’ Pearson of ONE Gas. 

    Its goal is to provide a collaborative framework that enables organizations to have a common understanding of the threats targeting embedded devices and how those threats can be mitigated. 

    The new threat model — recommended for manufacturers, vendors, asset owners, testers and security researchers — expands on resources such as ATT&CK, CVE and CWE, with a focus on embedded devices. It provides a knowledge base of threats, including ones seen in the wild and ones demonstrated through theoretic research and proofs of concept. 

    In order to help users create and tailor threat models to specific devices, threats are mapped to device properties. The mitigations suggested by EMB3D are exclusively focused on technical mechanisms that can be implemented by device vendors. 

    “The EMB3D model will provide a means for ICS device manufacturers to understand the evolving threat landscape and potential available mitigations earlier in the design cycle, resulting in more inherently secure devices,” Pearson said. “This will eliminate or reduce the need to ‘bolt on’ security after the fact, resulting in more secure infrastructure and reduced security costs.” 

    The framework will be continuously updated by its maintainers and the cybersecurity community with new information on threat actors, vulnerabilities and defenses. 

    EMB3D is in a pre-release review period, with device vendors, asset owners, academics and researchers being encouraged to review the framework before its official launch, which is scheduled for early 2024.

    Resource : https://www.securityweek.com/mitre-unveils-emb3d-threat-model-for-embedded-devices-used-in-critical-infrastructure/

    18Dec, 2023
    MongoDB Suffers Security Breach, Exposing Customer Data

    MongoDB on Saturday disclosed it’s actively investigating a security incident that has led to unauthorized access to “certain” corporate systems, resulting in the exposure of customer account metadata and contact information.

    The American database software company said it first detected anomalous activity on December 13, 2023, and that it immediately activated its incident response efforts.

    It further noted that “this unauthorized access has been going on for some period of time before discovery,” but emphasized it’s not “aware of any exposure to the data that customers store in MongoDB Atlas.” It did not disclose the exact time period of the compromise.

    In light of the breach, MongoDB recommends that all customers be on the lookout for social engineering and phishing attacks, enforce phishing-resistant multi-factor authentication (MFA), as well as rotate their MongoDB Atlas passwords.

    That’s not all. The company said it’s also experiencing elevated login attempts that are causing issues for customers attempting to log in to Atlas and its Support Portal. It, however, said the problem is unrelated to the security event.

    When reached for comment, MongoDB told The Hacker News that the incident is a matter of ongoing investigation and that it will “provide updates as soon as we can.”

    Resource : https://thehackernews.com/2023/12/mongodb-suffers-security-breach.html

    14Dec, 2023
    Cloud engineer gets 2 years for wiping ex-employer’s code repos

    Miklos Daniel Brody, a cloud engineer, was sentenced to two years in prison and a restitution of $529,000 for wiping the code repositories of his former employer in retaliation for being fired by the company. 

    First Republic Bank was a commercial bank in the U.S., employing over seven thousand people and having an annual revenue of $6.75 billion. The bank closed on May 1, 2023, and was sold to JPMorgan Chase.

    According to the U.S. Department of Justice (DoJ) announcement, Brody was fired on March 11, 2020, from First Republic Bank (FRB) in San Francisco, where he worked as a cloud engineer.

    The court documents state that Brody’s employment was terminated after he violated company policies by connecting a USB drive containing pornography to company computers.

    Following his dismissal, Brody allegedly refused to return his work laptop and instead used his still-valid account to access the bank’s computer network and cause damages estimated to be above $220,000

    “Among other things, Brody deleted the bank’s code repositories, ran a malicious script to delete logs, left taunts within the bank’s code for former colleagues, and impersonated other bank employees by opening sessions in their names,” describes the U.S. DOJ announcement.

    “He also emailed himself proprietary bank code that he had worked on as an employee, which was valued at over $5,000.”

    Until his access to FRB’s network was eventually terminated on March 12, 2020, Brody had performed the following actions:

    • Ran a malicious script named “dar.sh” to wipe FRB’s servers
    • Deleted git logs and git commit history for the particular script
    • Accessed FRB’s GitHub repository and deleted the hosted code
    • Inserted ‘taunts’ in the code, including references to “grok”
    • Impersonated another cloud engineer at FRB to access the firm’s network and make configuration changes

    After the incident, Brody falsely reported to the San Francisco Police Department that the FRB-issued laptop had been stolen from his car.

    He continued to uphold this story when interviewed by United States Secret Service agents following his arrest in March 2021.

    Eventually, in April 2023, Brody pleaded guilty to lying about the laptop and to two charges concerning violation of the Computer Fraud and Abuse Act.

    In addition to the two-year prison term and the payment of the restitution, Brody will serve three years of supervised release.

    Resource : https://www.bleepingcomputer.com/news/security/cloud-engineer-gets-2-years-for-wiping-ex-employers-code-repos/

    13Dec, 2023
    50K WordPress sites exposed to RCE attacks by critical bug in backup plugin

    A critical severity vulnerability in a WordPress plugin with more than 90,000 installs can let attackers gain remote code execution to fully compromise vulnerable websites.

    Known as Backup Migration, the plugin helps admins automate site backups to local storage or a Google Drive account.

    The security bug (tracked as CVE-2023-6553 and rated with a 9.8/10 severity score) was discovered by a team of bug hunters known as Nex Team, who reported it to WordPress security firm Wordfence under a recently launched bug bounty program.

    It impacts all plugin versions up to and including Backup Migration 1.3.6, and malicious actors can exploit it in low-complexity attacks without user interaction.

    CVE-2023-6553 allows unauthenticated attackers to take over targeted websites by gaining remote code execution through PHP code injection via the /includes/backup-heart.php file.

    “This is due to an attacker being able to control the values passed to an include, and subsequently leverage that to achieve remote code execution. This makes it possible for unauthenticated threat actors to easily execute code on the server,” Wordfence said on Monday.

    “By submitting a specially-crafted request, threat-actors can leverage this issue to include arbitrary, malicious PHP code and execute arbitrary commands on the underlying server in the security context of the WordPress instance.”

    In the /includes/backup-heart.php file used by the Backup Migration plugin, an attempt is made to incorporate bypasser.php from the BMI_INCLUDES directory (defined by merging BMI_ROOT_DIR with the includes string) at line 118.

    However, BMI_ROOT_DIR is defined through the content-dir HTTP header found on line 62, thereby making BMI_ROOT_DIR subject to user control.

    Patch released within hours

    Wordfence reported the critical security flaw to BackupBliss, the development team behind the Backup Migration plugin, on December 6, with the developers releasing a patch hours later.

    However, despite the release of the patched Backup Migration 1.3.8 plugin version on the day of the report, almost 50,000 WordPress websites using a vulnerable version still have to be secured nearly one week later, as WordPress.org org download stats show.

    Admins are strongly advised to secure their websites against potential CVE-2023-6553 attacks, given that this is a critical vulnerability that unauthenticated malicious actors can exploit remotely.

    WordPress administrators are also being targeted by a phishing campaign attempting to trick them into installing malicious plugins using fake WordPress security advisories for a fictitious vulnerability tracked as CVE-2023-45124 as bait.

    Last week, WordPress also fixed a Property Oriented Programming (POP) chain vulnerability that could allow attackers to gain arbitrary PHP code execution under certain conditions (when combined with some plugins in multisite installations).

    Resource : https://www.bleepingcomputer.com/news/security/50k-wordpress-sites-exposed-to-rce-attacks-by-critical-bug-in-backup-plugin/?&web_view=true

    11Dec, 2023
    Nvidia to expand ties with Vietnam, support AI development

    HANOI, Dec 11 (Reuters) – U.S. chipmaker Nvidia’s (NVDA.O) chief executive said on Monday the company will expand its partnership with Vietnam’s top tech firms and support the country in training talent for developing artificial intelligence and digital infrastructure.

    Nvidia, which has already invested $250 million in Vietnam, has so far partnered with leading tech companies to deploy AI in the cloud, automotive and healthcare industries, a document published by the White House in September showed when Washington upgraded diplomatic relations with Vietnam.

    “Vietnam is already our partner as we have millions of clients here,” Jensen Huang, Nvdia’s CEO said at an event in Hanoi in his first visit to the country.

    “Vietnam and Nvidia will deepen our relations, with Viettel, FPT, Vingroup, VNG being the partners Nvidia looks to expand partnership with,” Huang said, adding Nvidia would support Vietnam’s artificial training and infrastructure.

    Reuters reported last week Nvidia was set to discuss cooperation deals on semiconductors with Vietnamese tech companies and authorities in a meeting on Monday.

    Huang’s visit comes at a time when Vietnam is trying to expand into chip designing and possibly chip-making as trade tensions between the United States and China create opportunities for Vietnam in the industry.

    At Monday’s event, Vietnam’s investment minister Nguyen Chi Dzung said the country had been preparing mechanisms and incentives to attract investment projects in the semiconductor and artificial intelligence industries.

    Dzung also asked Nvidia to considering setting up a research and development facility in the country following Huang’s proposal to set up a base in Vietnam, after his meeting with the Vietnamese Prime Minister Pham Minh Chinh on Sunday.

    Resource : https://www.reuters.com/technology/nvidia-ceo-plans-expand-partnership-with-vietnam-support-vietnam-ai-development-2023-12-11/

    11Dec, 2023
    Nvidia CEO aims to set up a base in Vietnam

    HANOI, Dec 10 (Reuters) – Nvidia (NVDA.O) wishes to establish a base in Vietnam to develop the country’s semiconductor industry as it considers the Vietnamese market an important one, the Vietnamese government said, citing the U.S. chipmaker’s chief executive.

    In his first visit to the Southeast Asian country, Nvidia’s CEO, Jensen Huang, said the company viewed Vietnam as its home and affirmed its plans to set up a centre in the country.

    “The base will be for attracting talent from around the world to contribute to the development of Vietnam’s semiconductor ecosystem and digitalisation,” the Vietnamese government statement cited Huang after his meeting with Prime Minister Pham Minh Chinh.

    Nvidia, which has already invested $250 million in Vietnam, is set to discuss cooperation deals on semiconductors with Vietnamese tech companies and authorities in a meeting on Monday, Reuters reported on Friday.

    Vietnam, which is home to large chip assembling factories including Intel’s (INTC.O) biggest globally, is trying to expand into chip designing and possibly chip-making as trade tensions between the United States and China create opportunities for Vietnam in the industry.

    The chipmaker has already partnered with Vietnam’s leading tech companies to deploy AI in the cloud, automotive and healthcare industries, a document published by the White House in September showed when Washington upgraded diplomatic relations with Vietnam.

    Resource : https://www.reuters.com/technology/nvidia-ceo-aims-set-up-base-vietnam-2023-12-10/