• Search for:
    9May, 2023
    How to Run ChatGPT Using ShellGPT From the Ubuntu Terminal

    Want to use the ChatGPT in a terminal window on your Ubuntu Linux PC? ShellGPT lets you use all the features of the famous AI chatbot, on the command line. Here’s how to set ShellGPT up and start using it.

    What Is ShellGPT?

    ShellGPT is a Python program that lets you access OpenAI’s ChatGPT from the command line of a terminal window. It sends your text prompts and your ChatGPT API key to ChatGPT and prints out ChatGPT’s response.

    It’s just like running ChatGPT on your own computer, without any of the hassle, and regardless of the computing power of your computer. You’ll need to have a ChatGPT API key, but it only takes moments to get one, and they’re free.

    ChatGPT is probably the most famous of the new-wave of large language model AI chatbots, developed using deep learning techniques and massive data sets.

    It’s able to hold convincing and lifelike conversations, and can generate prose and other text format responses on just about any topic you can imagine. Just keep in mind that it’s a simulation of a knowledgeable, intelligent person. It isn’t genuinely intelligent, and it’ll happily make stuff up.

    Step 1: Install the Python Tools

    Ubuntu usually ships Python as standard, but you can check if it is present by asking for its version number.

    If Python isn’t installed, you can install it using this command.

    We also need pip, the python package manager.

    It wasn’t installed on our test computer, so we added it using apt.

    We’re going to install ShellGPT in a Python virtual environment. This sandboxes ShellGPT from your system Python files and libraries, and means it cannot accidentally interfere with your other Python programs. It’s just a safe precaution.

    To do that, we’re going to need to install the Python virtual environment packages.

    Step 2: Prepare a Python Virtual Environment

    Create a directory to install ShellGPT into. We named ours “shellgpt”, just to keep things obvious. Change into your new directory when it’s been created.

    Next, we use the -m (module) option and run the Python virtual environment module and create a new virtual environment inside our new directory. We created one called “shellgpt.”

    This gives us a private, virtual environment called “shellgpt”, inside our “shellgpt” directory. To activate it we need to run a script called “activate.” This is located in the “bin” directory of our virtual environment.

    Note the “(shellgpt)” in front of the command prompt.

    Step 3: Create a ChatGPT API Key

    To access the features of ChatGPT, you’ll need an OpenAI API key. You can use an existing API key if you have one, or you can create one on the OpenAI website.

    Follow the link and either log in or sign up.

    When you’re logged in, click your account name in the top-right corner and select “View API Keys” from the menu.

    On the API keys web page, click the “Create New Secret Key” button.

    Your new key is displayed to you. You only get to see your key this one time. If you log out and back in, you’ll see an entry for the key, but you won’t be able to view the entire key string. So, copy the key and paste it into an editor, and save the file with an obvious name.

    Step 4: Export the API Key

    We need to make the key available to ShellGPT. The easiest way is to export it as an environment variable. You can do this on the command line, but it only lasts until you reboot your PC. Adding the export command to your “.bashrc” file exports the environment variable for you automatically, each time you open a terminal window.

    To do it on the command line, type “export OPENAI_API_KEY=” and then paste your API key by pressing “Shift+Ctrl+v”, so that it looks like the screenshot below.

    To put the export command in your “.bashrc” file, use your favorite editor and add the command to your file.

    Save your changes and close the editor. To force your terminal session to reread your “.bashrc” file, use the source command.

    Step 5: Install ShellGPT

    With all of the preparation out of the way, we can install ShellGPT using the Python pip command.

    The installation will begin, and a variety of package names will scroll by in your terminal window.

    When it’s finished we can, finally, use ShellGPT to access ChatGPT.

    Step 6: Use ShellGPT

    The ShellGPT command is sgpt. We provide our text prompts to this command, and press “Enter.”

    ShellGPT acts as the middleman between us and ChatGPT, and displays the response from ChatGPT.

    That’s great, it’s all working. But it’s a bit long winded to have to cd into the directory we created the virtual environment in, and then issue the source shellgpt/bin/activate command before we can use ShellGPT.

    A better way is to create an alias that does all of that for us. Edit your “.bashrc” file and add this line.

    Remember to use the names of the directory and virtual environment that you created. We called our alias “chatgpt”, but you can use whatever name you prefer. Save your changes, and use source to read the “.bashrc” file again.

    Now, at a normal command prompt, entering the name of your alias and hitting “Enter” places you in your Python virtual environment, which is activated and ready for your input.

    Learning ShellGPT Commands

    The ShellGPT GitHub page has much more information on using ShellGPT and its command line options.

    For example, the --code option limits the output of ShellGPT to show program code only. Normally, if we ask it to generate some code, it does so, but it generates a description too.

    By adding the --code option, the description is suppressed. This would be handy if you want to redirect the output into a file.

    “In Conclusion”

    In conclusion, ShellGPT is a powerful tool for programmers and system administrators alike. Its ability to assist with tasks such as managing operating systems and programming languages makes it an invaluable asset to any team. With its intuitive interface and vast knowledge base, ShellGPT is sure to become a go-to resource for those looking to streamline their workflow and increase productivity.

    Or at least, that’s what it says.

    Resource : https://www.howtogeek.com/889200/how-to-run-chatgpt-using-shellgpt-from-the-ubuntu-terminal/

    8May, 2023
    Hackers Promise AI, Install Malware Instead

    Meta on Wednesday warned that hackers are using the promise of generative artificial intelligence like ChatGPT to trick people into installing malicious code on devices.

    Over the course of the past month, security analysts with the social-media giant have found malicious software posing as ChatGPT or similar AI tools, chief information security officer Guy Rosen said in a briefing.

    “The latest wave of malware campaigns have taken notice of generative AI technology that’s been capturing people’s imagination and everyone’s excitement,” Rosen said.

    Meta, the parent company of Facebook, Instagram and WhatsApp, often shares what it learns with industry peers and others in the cyber defense community.

    Meta has seen “threat actors” hawk internet browser extensions that promise generative AI capabilities but contain malicious software designed to infect devices, according to Rosen.

    In general, it is common for hackers to bait their traps with attention-grabbing developments, tricking people into clicking on booby-trapped web links or downloading programs that steal data.

    “We’ve seen this across other topics that are popular, such as crypto scams fueled by the immense interest in digital currency,” Rosen said.

    “From a bad actor’s perspective, ChatGPT is the new crypto.” Meta has found and blocked more than a thousand web addresses that are touted as promising ChatGPT-like tools but are actually traps set by hackers, according to the tech firm’s security team.

    Meta has yet to see generative AI used as more than bait by hackers, but is bracing for the inevitability that it will be used as a weapon, Rosen said.

    “Generative AI holds great promise and bad actors know it, so we should all be very vigilant to stay safe,” Rosen said.

    At the same time, Meta teams are working on ways to use generative AI to defend against hackers and deceitful online influence campaigns.

    “We have teams that are already thinking through how (generative AI) could be abused, and the defenses we need to put in place to counter that,” Meta head of security policy Nathaniel Gleicher said in the briefing.

    “We’re preparing for that.”

    Resource : https://www.securityweek.com/hackers-promise-ai-install-malware-instead/

    8May, 2023
    How to automate security operations effectively and efficiently

    The evolution of security has meant “naming in this space has been an adventure,” and the challenge for cloud vendors has been to provide capabilities while automating and making platforms easy to use, said Rhett Dillingham, vice president security product at security operations provider Sumo Logic.

    Dillingham spoke on the topic at RSA with Adrian Sanabria, a host of Security Software Weekly.

    Sumo Logic’s history has been to make it easy to bring logs in, get initial value, and automate as much as possible, Dillingham said. Part of being a cloud vendor in the security space has meant trying to make platforms “self-service adaptable.”

    Tackling the people aspect of automation

    Security automation has been a big topic for a while now, given the dynamic nature of threats and companies grappling with talent shortages, Sanabria observed. Another issue is the overhead associated with products.

    Even with the benefits automation brings, someone still has to create the automation, make sure a platform works properly, monitor it, fix it if something breaks, and know how to deal with APIs, he noted.

    Automation, Sanabria added, is scary.

    Sumo Logic aims to alleviate the operational aspect of managing security stacks, which frees teams up to derive value from them, Dillingham said.

    As teams work through the end-to-end security operations workflow from collection to detection to investigation response and think about what can be automated in that chain, “there tends to be an over-rotation toward the investigation response portion,’’ he said. So Sumo Logic has focused “on automating as much as possible and investigation by clustering” events into a “refined, true positive alert.”

    The goal is for security teams to be able to easily compile information into the platform, Dillingham said. Sumo Logic last week announced it has integrated the workflow automation portion of its cloud SOAR offering as part of its SIEM. It aims to provide “a stepping stone short of full SOAR adoption” as the next step in automation.

    The idea is once you’ve clustered entity relationships around investigations in triage, now you can automate enrichment into that alert, Dillingham explained. From there, you can do the refining and automate notifications.

    SOAR vs. SIEM

    The two discussed the features of SOAR and SIEM, which came to be defined in security operations in a way that “lumped a few technologies together [and] met your capabilities in a way that has made it unapproachable for a certain segment of enterprises,” Dillingham said.

    Sumo Logic’s goal is to make the incremental steps easier to adopt and utilize, regardless of the nomenclature of what SIEM and SOAR are, he said. “It’s a platform for security operations.”

    Another concern with adopting SOAR technology has been the risk of over-automating beyond what the organizational culture is ready for, specifically, in automated response, Dillingham observed.

    The way Sumo Logic sees it, he said, is you should be automating the work as much as possible to become more efficient. Then you can move into response and make it more iterative so it becomes an efficiency gain.

    Large language models and ChatGPT

    Sumo Logic has also just integrated its SOAR framework into a chat provider of a customer’s choice. That enables them to utilize Q&A and chat capabilities out of the box, he said.

    The platform collects data from a variety of sources and alerts or raw data, so someone can pull in common remediation methods for that technology, for example.

    But Dillingham noted that it is an organizational decision as to whether they are comfortable with the information coming from ChatGPT.

    CISO struggles

    Tool consolidation has become a big pain point for CISOs, Dillingham said. So is the efficiency and efficacy of teams.

    This is why Sumo Logic is aggregating SIEM with SOAR and building a bridge between the two to address the consolidation of alerts coming from the proliferation of tools, he said.

    Resource : https://www.scmagazine.com/native/cloud-security/how-to-automate-security-operations-effectively-and-efficiently

    6May, 2023
    Researcher hijacks popular Packagist PHP packages to get a job

    A researcher hijacked over a dozen Packagist packages—with some having been installed hundreds of millions of times over the course of their lifetime.

    The researcher reached out to BleepingComputer stating that by hijacking these packages he hopes to get a job. And, he seems pretty confident that this would work.

    At least 14 Packagist packages hijacked

    Yesterday, a researcher with the pseudonym ‘neskafe3v1’ reached out to BleepingComputer stating he had taken over fourteen Packagist packages, with one of them having over 500 million installs.

    Packagist is the primary registry of PHP packages that are installable via Composer, a dependency management tool. Rather than hosting these packages though, Packagist serves more as a metadata directory that aggregates open source packages published to GitHub. These packages can then be installed by developers on their machines by running the composer install command.

    The researcher provided proof to BleepingComputer demonstrating that on Monday, May 1, the Packagist pages for these packages were modified to point to the researcher’s (fake) repo, as opposed to the legitimate GitHub repository for each package.

    As an example, here’s how the Packagist page for acmephp package appeared on Monday—with its GitHub link changed to researcher’s repo instead of the authentic github.com/acmephp/acmephp.

    These changes have now been reverted by the Packagist team as checked by BleepingComputer.

    Publishing process on Packagist is a bit different from that on open source repos like npm or PyPI. A developer, as opposed to uploading binaries or software releases directly to Packagist.org, simply creates a Packagist.org account, and “submits” a link to their GitHub repo for a particular package. Packagist’s crawler then visits the provided repo and aggregates all the data to display on the Packagist page for that package.

    When a developer runs Composer with ‘install’ or ‘update’ commands, their Composer instance may first look for the presence of the packages locally, failing which, it defaults to searching on Packagist for this package and retrieving the GitHub URL listed for that package. The contents of the package are then downloaded from this GitHub repo listed on the package’s Packagist page.

    This is in stark contrast to how npm or PyPI works—that is, these registries host and distribute software releases directly from their servers.

    By modifying the Packagist page for each of these packages, the researcher effectively hijacked the installation workflow used within Composer environments. Developers would now get the contents of a package from neskafe3v1‘s GitHub repo, rather than the project’s repository.

    To keep the demonstration to a minimum, the researcher simply changed the composer.json file—something akin to an application manifest, within these packages to read:

    He did so by forking the original project repository, modifying the “description” field within composer.json, and committing the change to his forked repository. At no point did he merge the changes back into the original repository (doing so would have required additional access and possibly invited scrutiny of maintainers).

    Instead, the researcher apparently gained access to the maintainers’ Packagist accounts and changed the GitHub URLs to the listed packags to that of his forked repos. But, he did not reveal the exact method used for hijacking to BleepingComputer.

    When pressed by BleepingComputer to reveal the exact technique that the researcher had used to hijack these packages, we were told this was not a zero-day but a known technique. But we were not told whether the hijack was achieved through, for example, credentials compromise, takeover of maintainer’s email address due to expired domain, or yet another technique:

    “As you can see, I’m looking for a job (that message ‘Ищу работу на позиции…’ means ‘I’m looking for a job…’), so I will disclose a report after I will be hired by some company,” the researcher told BleepingComputer, likening the entire hijacking campaign to “an advertisement of myself as an employee.”

    “Until there is success, there is nothing to talk about.”

    Hijacked via credentials compromise

    In a statement to BleepingComputer, the Packagist team said that no malicious impact had been observed thus far on the platform as a result of this action while confirming the takeover indeed resulted from credentials compromise of maintainer accounts.

    “To our knowledge this has not been used for any malicious purposes and was limited to a few old accounts with insecure passwords and missing 2 factor authentication,” Nils Aderman of Packagist.org, who is also one of the original Composer developers, told BleepingComputer.

    “All four accounts appear to have been using shared passwords leaked in previous incidents on other platforms. Please, do not reuse passwords,” warn Packagist admins.

    “On May 2nd, at 7:21 am UTC we were notified by Juha Suni about the change of URL to multiple Doctrine packages,” further explain the admins in a blog post released today.

    Working alongside Marco Pivetta aka Ocramius, Packagist admins promptly identified all accessed accounts, disabled access to them and restored the GitHub URLs to their former values. The restoration effort was completed by Tuesday morning.

    The researcher additionally told BleepingComputer that he had not abused the technique to distribute malware, but at the same time, said he had not notified either Packagist or the package owners of the little experiment—which raises eyebrows with regards to the ‘ethical’ nature of this research.

    “The only thing I did – I altered ‘description’ field in composer.json files,” said the researcher pointing us to proofs such as Git commits.

    “I’ve just changed the link from github.com/acmephp/core (original) to …my fork. There is no malware, you can diff the original files to mine. I didn’t notify anybody of the attack, neither Packagist admins, nor package owners.”

    In their blog post, Packagist admins request that researchers report bugs and vulnerabilties in a responsible manner.

    “If you are a security researcher and know of a Packagist.org vulnerability or would like to do research on Packagist.org, we ask you to please coordinate testing with us to avoid negative user impact, and to disclose these vulnerabilities responsibly.”

    “You can reach us at security@packagist.org and we reply promptly to all requests or reports. We of course provide credit and publish details of reported vulnerabilities…”

    Resource : https://www.bleepingcomputer.com/news/security/researcher-hijacks-popular-packagist-php-packages-to-get-a-job/

    6May, 2023
    How To Create Seamless Digital Experiences For Web And Mobile

    Before the online market picked up, companies and small retailers always prioritized the customer experience in their stores. The more memorable a customer’s experience is, the more they will return to you and spread the word to their friends and family. But things have changed now.

    According to a survey, over 67% of people have reported that they prefer to make a purchase online rather than offline, especially after the pandemic hit the world in 2019.

    Now the organization has an even more challenging job: how to impress the customer online and improve his experience so that he may get the same feeling as offline but without the personal touch, which played a massive role in the process.

    This is a tricky but doable task. There are simple steps to follow when the organization is developing a web application or needs to lift its digital experience and match a customer’s expectations.

    For this, organizations can leverage manual and automation testing techniques to ensure the online experience is seamless, error-free, and meets customers’ expectations. They can also keep in mind the following best practices to ensure a pixel-perfect digital experience.

    Keep up with the latest trends

    The most important thing to create a seamless digital experience for the web and mobile is to adopt new technologies and trends. These technologies work in two ways for an organization; first, newer technologies are always optimized and more attractive. Second, since competitors start using them, users generally expect them to be on other websites as well.

    For instance, if we just consider the evolution of buttons on a web page, we were somewhere around this:

    Considering we use the older button styles, it might become the first thing a user would notice, and the first impression could make a difference in their perception of our business.

    However, this is just one element of the technology used in the web and mobile applications and is popularly termed as user experience. This expands to animations, transitions, and whatever the user can touch and see on the app that is unique and creative. The second technology that always needs to be kept on par with the latest trends in payment options.

    As per a source,  globally, 67% of buyers preferred credit or debit cards over cash-based transactions. It has been a growing trend worldwide owing to the transparency of transactions and quick refund services.

    By this statistic, we can implement credit and debit card channels and never need to bother about any changes to our /payment URL. But things change drastically when we move from region to region.

    For instance, US citizens prefer credit and debit services. As per the research by Fintech, more than 76% of Indian citizens prefer the UPI payment method, and it is a relatively newer technology than card services. So, as an organization, more than just maintaining our user experience is required.

    If the user’s preferred payment system is unavailable depending on the region, that could be counted as a bad experience.

    Involve user interaction as minimally as possible

    Applications and web development trends have all leaned towards reducing a user’s interaction as low as possible. For instance, advertisement agencies take cookies to determine a user’s interest and show them ads from various websites. This generates enormous revenue for them, but that is just because users click on these ads.

    When we talk about minimal interaction, we consider two things. The first thing is how much a user types, scrolls, and clicks to achieve what he intends to.  The second thing is how much navigation they do to reach from the home screen to the final objective, which in the case of an eCommerce website is considered as “a purchase done successfully.”

    Recently artificial intelligence has started to get involved in almost everything that requires prediction, deduction, or mathematical calculation, such as classification. The most obvious benefit of incorporating artificial intelligence is the reduction in the work done by the user.

    For instance, earlier users were required to search for everything by typing words in the search box. Today, they can tap the microphone icon and speak out their search query.

    Artificial intelligence has also been involved in chatting with customer support using chatbots (reducing repetitive email interactions) and suggesting products to the user based on interest.

    Similarly, social media buttons are a popular way to embed on the website that can copy the link of the page, navigate to that particular social media website and sometimes paste the URL on the post section automatically.

    Earlier, this process was done by copying the URL, then opening the social media URL and pasting this link on the post section or chat section to your friends manually, etc.

    These are, however, just small, simple examples of one type of technology used today. The main goal of exploring this topic is to understand the concept of minimal interaction and maximum expression from our application or website.

    If the user can navigate in minimum steps and interact only when it is highly required, it is harder to keep the application out of mind.

    Data Consistency on multiple platforms

    According to a survey conducted by Pew Research in 2015 for people owning a smartphone, a computer, a tablet, or a combination of these, a whopping 36% of Americans own all three devices. This number jumped to 57% in 2017, marking these cases true, especially when the user is at home.

    These statistics raise a minor issue for us as an organization. If the user is operating on multiple devices regularly, they will expect their data to be consistent across all devices.

    If we consider an eCommerce website for this, we know that users do not always purchase products instantly. Sometimes they add it to the cart and then continue shopping. Sometimes they make a wish list and buy it later in the future.

    What if a user adds an item to the cart on a mobile device but, when proceeding to purchase on the laptop, finds out that the cart is empty? Such types of data inconsistencies spoil the digital experience of the user.

    An important task of this magnitude needs rigorous testing and a vast collection of mobile devices to test upon. The major problem the testers face is procuring devices and executing the same tests on multiple devices multiple times.

    On top of it, integrating third-party applications also becomes a headache since each of those applications needs to be installed with the correct binary on the operating system.

    The best solution to deal with such issues and create a seamless digital experience for web and mobile is to rent out these devices from online digital experience testing platforms such as LambdaTest.

    These cloud-service providers do all the heavy job for you, and as a tester, all we need to do is sign up for free, select the target device, and start testing right away. LambdaTest lets you perform manual and automation testing of web and mobile apps across 3000+ real browsers, devices, and OS combinations.

    You can also test web and mobile applications in real-world scenarios using its real device cloud.

    The procurement of devices, maintenance, and integration with third-party applications is done by these providers themselves. For instance, LambdaTest can provide integration to JIRA directly from the platform. This way, when you are using the platform and encounter any bugs in the process, they can be directly uploaded to JIRA from the platform.

    These types of testing techniques ensure that the digital experience will remain consistent across various devices. It also gives confidence to the testers and organization around promoting their application on these important pillars of seamless experiences.

    Optimizing everything for mobile

    The growth of mobile devices and their usage have all seen a steep rise in the last decade. In 2015, only 31% of the world’s internet traffic came from mobile devices. Today, it is a little shy of 60%.

    This means for an organization, mobile devices are more important than other devices, such as laptops. Hence, the development and testing should be shaped according to the mobile devices to create a seamless digital experience for the web and mobile.

    Achieving this is not that hard. Currently, we work on mobile-first design techniques that allow us to develop the application first for mobile and then expand it to other devices. This way, we ensure that even if we spill on the desktops, there are no mishaps on a mobile device, and we can cover most of the audience.

    Test everything

    Finally, there is no assurance of a seamless digital experience for web and mobile until we deliberately try to break things apart. This is what testing the application means in layman’s terms.

    Application testing has evolved and optimized in various ways that can today uncover even minor bugs that were hard to point out manually earlier. From UI change detection to self-healing technologies, artificial intelligence has served the user and testers well. Taking advantage of it is one thing we need to do right to have a smooth release.

    A few of the testing paradigms include UI testing, usability testing, exploratory testing, compatibility testing (preferably through cross-browser testing tools), API testing, geo-location testing, performance testing, security testing, etc.

    Perform web and mobile app testing on a real device cloud. Sign up on LambdaTest for FREE.

    Summary

    Technologies are evolving every day, and with their evolution, the user’s experience takes different shapes from time to time. What is “trendy” today will become an “old design” or “obsolete method” in a few years (sometimes weeks depending on the type of technology). For developers and testers, it becomes one field that needs constant attention and adoption towards it.

    To provide a seamless digital experience for web and mobile, we need to focus on just five areas discussed in this post. Firstly, we should always develop in accordance with the latest trends. If things have changed, consider that they have changed for good. Users love their UX and, most of the time, are quite sensitive about it. Second, keep user interaction as minimal as possible. If users see the work getting done with the minimum input required, they will remember the applications.

    Third, if your application is available for multiple platforms, data should be consistent on all of them. If someone uploads a file and then continues on a different device, the file should be visible (in the uploaded state).

    Fourth, work on the mobile-first and then grow outward towards large-screen devices. Since mobile users are much more in number, it will make the app perfect for the majority of the audience. Finally, test everything in every way possible to determine the smallest of bugs and let the user experience the application as intended. All these steps make the application seamless and may bear fruitful results if followed.

    Resource : https://www.bleepingcomputer.com/news/security/how-to-create-seamless-digital-experiences-for-web-and-mobile/

    4May, 2023
    Why Your Detection-First Security Approach Isn’t Working

    Stopping new and evasive threats is one of the greatest challenges in cybersecurity. This is among the biggest reasons why attacks increased dramatically in the past year yet again, despite the estimated $172 billion spent on global cybersecurity in 2022.

    Armed with cloud-based tools and backed by sophisticated affiliate networks, threat actors can develop new and evasive malware more quickly than organizations can update their protections.

    Relying on malware signatures and blocklists against these rapidly changing attacks has become futile. As a result, the SOC toolkit now largely revolves around threat detection and investigation. If an attacker can bypass your initial blocks, you expect your tools to pick them up at some point in the attack chain. Every organization’s digital architecture is now seeded with security controls that log anything potentially malicious. Security analysts pore through these logs and determine what to investigate further.

    Does this work? Let’s look at the numbers:

    • 76% of security teams say that they can’t hit their goals because they’re understaffed
    • 56% of attacks take months—or longer—to discover
    • Attacks keep growing: the global cost of cybercrime is expected to reach $10.5 trillion by 2025

    Clearly, something needs to change. Detection technologies serve an important purpose and investing in them isn’t wrong, but it has certainly been overemphasized.

    Organizations need to get back to prioritizing threat prevention first and foremost—and this is coming from the leader in zero trust, a model that basically assumes your prevention controls have already failed and that you are actively being breached at any given time.

    The endpoint is just the starting point#

    Although many security categories exemplify the gaps in detection-first security strategies, let’s look at one popular category in particular: endpoint detection and response (EDR).

    EDR adoption has grown like wildfire. Already a $2 billion industry, it’s growing at a CAGR of 25.3%. It makes sense: most attacks start at the endpoint, and if you detect them early in the attack chain, you minimize the impact. A good EDR solution also provides rich endpoint telemetry to help with investigations, compliance, and finding and shutting down vulnerabilities.

    Endpoint security is a valuable area to invest in—and a critical component of zero trust—but it’s not the whole picture. Despite vendor claims of “extended” detection and response that stitches together data across the enterprise, XDR solutions do not provide defense-in-depth on their own. EDRs have antivirus to stop known malware, but they typically allow all other traffic to pass through, counting on analytics to eventually detect what the AV missed.

    All tools have their shortcomings, and EDR is no exception, because:

    Not all attacks start at the endpoint. The Internet is the new network, and most organizations have a wide range of data and applications stored across various clouds. They also frequently use devices like VPNs and firewalls that are routable from the internet. Anything that is exposed is subject to an attack. Zscaler ThreatLabz has found that 30% of SSL-based attacks hide in cloud-based file-sharing services like AWS, Google Drive, OneDrive, and Dropbox.

    Not all endpoints are managed. EDR relies on agents that are installed on every IT-managed device, but that doesn’t account for the myriad scenarios in which unmanaged endpoints may touch your data or networks: IoT and OT devices, personal (BYOD) endpoints used for work, third-party partners and contractors with access to data, recent mergers or acquisitions, even guests coming to your office to use Wi-Fi.

    EDR can be bypassed. All security tools have their weaknesses, and EDR has proven to be fairly easy to evade using several common techniques, such as exploiting system calls. Attackers use encryption and obfuscation techniques to automatically generate new PDFs, Microsoft 365 documents, and other files that can alter the fingerprint of malware and bypass traditional cybersecurity models undetected.

    Modern threats move really fast. Today’s ransomware strains, almost all available for purchase on the dark web for any would-be cybercriminals, can encrypt data far too quickly for detection-based technologies to be useful. LockBit v3.0 can encrypt 25,000 files in a minute, and it’s not even the fastest ransomware out there. Conversely, the average time to detect and mitigate a breach has been measured at 280 days. That’s enough time for LockBit to encrypt over 10 billion files.

    Get your security in line#

    It’s true that signature-based antivirus technologies are no longer enough to stop sophisticated attacks. But it is also true that the same AI-powered analytics behind detection technologies can (and must!) be used for prevention, not just detection, if they’re delivered inline. This prevention strategy needs to account for your entire infrastructure, not just your endpoints or any other one part of your architecture.

    A sandbox is a key example of a security tool that can be deployed in this way. Sandboxes provide real-time protection against sophisticated and unknown threats by analyzing suspicious files and URLs in a secure, isolated environment. Deploying them inline (rather than as a passthrough) means a file isn’t allowed to proceed until after the solution delivers a verdict.

    The Zscaler Zero Trust Exchange platform includes a cloud-native proxy that inspects all traffic, encrypted or not, to enable secure access. As a proxy, the platform’s layered controls—including the integrated advanced sandbox—are all delivered inline with a prevention-first approach.

    Real-time, AI-powered protection against zero-day threats#

    Zscaler uses advanced machine learning algorithms that are continually refined by the world’s largest security cloud, which processes more than 300 billion transactions per day. These algorithms analyze suspicious files and URLs in real time, detecting and blocking potential threats before they can cause damage.

    This begins with a prefiltering analysis that checks the file’s content against 40+ threat feeds, antivirus signatures, hash blocklists, and YARA rules for known indicators of compromise (IOCs). By reducing the number of files needed for deeper analysis, AI/ML models perform more effectively. When a file remains unknown or suspicious after initial triage, Zscaler Sandbox detonates it to perform robust static, dynamic, and secondary analysis, including code and secondary payload analysis that detects advanced evasion techniques. Once complete, a report is generated with a threat score and actionable verdict, blocking malicious and suspicious files based on policy configurations.

    Scalability#

    One of the biggest selling points of the cloud is the ability to rapidly scale up or down to meet the needs of organizations of all sizes. Security controls deployed in the cloud are naturally easier to provision and manage, giving your organization the flexibility to adapt to changing security needs.

    Reduced costs#

    Cost is one of the primary inputs defining many security strategies, and it comes in many forms: user productivity, operational efficiency, hardware costs, and so on. But the biggest cost of note is the cost of getting breached. By preventing attacks, you eliminate downtime, reputational damage, lost business, and remediation costs, all of which can easily add up to seven figures for a single attack. ESG found that the average organization using the Zero Trust Exchange experiences a 65% reduction in malware, an 85% reduction in ransomware, and a 27% reduction in data breaches, contributing to an overall ROI of 139%.

    Comprehensive threat protection#

    The Zero Trust Exchange delivers comprehensive threat prevention, detection, and analysis capabilities, providing organizations with a uniform security control strategy across all locations, users, and devices. Zscaler Sandbox can analyze files anywhere, not just on the endpoint, and is integrated with a range of additional capabilities such as DNS security, browser isolation (for fileless attacks), data loss prevention, application and workload security, deception, and many others. This provides a complete view of your organization’s security posture and the defense-in-depth that security teams strive for.

    Prevention comes in first#

    In the arms race against attackers, security teams need to prioritize inline security controls over passthrough detection technologies. Files shouldn’t be allowed onto endpoints or networks unless you’re certain they’re benign—because if they turn out to be malicious, chances are you won’t find out about them until after the damage is done.

    Resource : https://thehackernews.com/2023/04/why-your-detection-first-security.html

    4May, 2023
    Cybersecurity Futurism for Beginners

    How will Artificial Intelligence develop in the near term, and how will this impact us as security planners and practitioners?

    A frequent topic I am asked about is what the future of the SOC looks like. At first glance, this seems like a simple question – but scratch beneath the surface and it’s actually really complex. Cybersecurity does not exist in its own little pocket universe. Instead, what happens in security operations is driven mainly by external factors – the economy and macro-economics, internal, external and geopolitics, social and cultural trends, fashions, and of course, natural disasters like pandemics. There is no future of the SOC independent of the Future. So if you want to talk about the future of security operations, you really have to make a whole series of predictions and assumptions about the world in general .That’s what makes futurism and trend analysis so difficult. Good futurology synthesises trends from all and any relevant domains and fields into a coherent whole.

    It doesn’t help that humans are incredibly bad at predicting the future, especially when trying to understand complex issues. We can even empirically study how bad we are at predicting, with definitions for a range of fun and scary cognitive fallacies, like the optimism or recency biases, not to mention the Duning-Kruger effect. Worst of all – even being aware of these pitfalls doesn’t necessarily help prevent succumbing to them.

    Case in point, how will Artificial Intelligence develop in the near term, and how will this impact us as security planners and practitioners?

    As I write this, Microsoft just announced their Cybersecurity Copilot, a personal AI assistant for security analysts, with industry analysts cautiously declaring that “AI Finally Does More Than Enhance Detection”.

    The FT put out an article (paywall) saying that generative AI will affect over 300M jobs in developing economies. A collection of over 1,100 scientists, tech experts, and business leaders including Elon Musk, are publicly calling for a global 6-month pause to consider the “profound risks of AI to society and humanity”

    Other commentators like Corey Doctorow, the blogger, journalist, and science fiction author, are already calling generative AI the new “crypto-bubble”.

    And by the time you read this, I am sure further developments will have occurred, to drive the conversation forward.

    Biases and Black Swans

    The examples above represent just a small sample of the  viewpoints currently being expressed in the public debate around generative AI. What is remarkable is how widely they diverse in their assumptions and conclusions. We can roughly group them into three vastly different predictions for the future of generative AI.

    Prediction #1: Microsoft and Forrester – Generative AI is production-ready and the impact will be evolutionary rather than revolutionary, at least when applying ChatGPT to incident response.

    Prediction #2: Financial Times, Elon Musk, and Co – Generative AI progress is on the slope of massive acceleration that will disrupt work and life for millions of people.

    Prediction #3: Corey Doctorow – Generative AI is overhyped and will only have marginal impact, if any.

    How can three groups of people, all with highly relevant and applicable backgrounds, knowledge and experience in technology, come to such widely divergent conclusions?  More importantly, if they can’t agree, how can we decide which future is more likely?

    Of course, we can try and assign probabilities to each assertion, maybe  based on considerations such as how well informed or knowledgeable the individuals or organizations making these predictions are, or how successful they have been at predicting events in the past. But without truly objective criteria and measures, we will likely just follow our own set of biases.

    Most people will fall back on the recency bias – “last year AI didn’t work, so next year AI won’t work.” As a method this will actually seem to work out well for a while. Until it does not. As Mike Tyson put it, “Everyone has a plan until they get punched in the mouth.” To use a recent real-world example familiar to everyone, when the pandemic hit, many organizations had a multi-year cloud security and remote working transformation program that suddenly had to be ready now. 

    So far, we’ve stuck to the easy stuff – the known-knowns and known-unknowns. These are theoretically in the realm of being predictable – but then there are what Nicolas Taleb calls the unknown-unknowns, which despite all FUD-based cybersecurity marketing to the contrary, are by definition unknowable and unpredictable. These fall into the same bucket as stochastic processes, where randomness and  complexity mean that while you can measure the current state of a system, you can’t predict the next state.

    But as we’re learning, there is a deeper body of knowledge and theory around forecasting, trend analysis, futurism, futurology, horizon scanning, or however you want to call it. Much of it revolves around the limits of knowing and knowledge, and approaches to deal with uncertainty.

    Futures, not Future

    However hard it is to try and predict the future, we still have to try, or we can’t plan. But plan we must, whether you’re leading a country, a company, a charity or a commune. That’s the real reason why futurism exists as a field of study and practice. To make planning for the future less guesswork, futurists and other strategic planners have developed a set of tools to help model future developments, and more importantly, to derive something actionable from them. We’re going to be working with two of these in particular:

    Horizon scanning is a systematic process used to identify and analyze emerging trends, opportunities, threats, and potential disruptions that could affect an organization, industry, or society in the future. The main goal of horizon scanning is to supply early warning signs of change and to inform strategic planning and decision-making, allowing organizations to prepare for and adapt to future developments proactively.

    Scenario planning or scenario method is a strategic planning technique used to explore and prepare for possible future events and uncertainties. It involves developing multiple plausible future scenarios based on key driving forces and trends, and then analysing the potential impacts of these scenarios on an organization, industry, or system. The main goal of the scenario method is to help decision-makers better understand the risks and opportunities associated with different future outcomes and make more informed strategic choices.

    Scanning the horizon for scenarios to analyze

    The scenarios we are going to analyze will be based on near-term horizon scanning. Rather than trying to predict a single certain future, we are going to model a variety of alternative future scenarios, all with the same initial starting point – Now.  None of our futures are likely to play out exactly the way we anticipate them, but combined across all of them,  we should get at least a few things right. This will allow us to be better prepared, and make informed decisions.

    AI on the Horizon

    We’re going to imagine a variety of different futures  throughout this series, but all of them will be extrapolated from current trends, with different uncertain assumptions defining the scenarios.

    With all of the hype and hustle on the topic of generative AI, we’re going to look at some future AI scenarios first.

    We can now go back to our original three predictions on how generative AI will impact society in the near term, and also infer a few further ones:

    Dead End AI

    • AI ends up another hype like crypto, NFT’s and the Metaverse.
    • AI is overhyped and the resulting disappointment leads to defunding and a new AI winter.

    Slow AI

    • AI plateaus and stays on our current level
    • AI iteratively improves on an evolutionary, not revolutionary path

    Controlled AI

    • AI progresses rapidly, but is globally rigidly controlled and regulated
    • AI progresses rapidly, but is only available to a few great powers

    Runaway AI

    • A new AI revolution, as disruptive as the agricultural or industrial revolution
    • Endgame, Imminent Artificial general Intelligence and the Technological Singularity

    We will be imagining all of these scenarios over the next months in a series of articles. For today though, we will quickly discuss the Endgame Scenario – Artificial General Intelligence (AGI) resulting in the Technological Singularity (Kurzweil). We can’t  make any predictions about it. By definition, and the reason that the term singularity was chosen in the first place, is that its impact will be so momentous that it will cause unforeseeable changes to human civilization. We hit a prediction event horizon.

    What is remarkable to note is that we’ve hit a point where reliable prediction becomes exceedingly difficult beyond even short time horizons way before full-blown AGI. It may be the case that the requirement for machine intelligence to be massively disruptive may be far more modest than we thought.

    It is worth noting that AI is just one of the many scenario factors that will be relevant for the future of security operations. There are many other interesting and plausible scenario, like what would security look like in a future where low power consumption, durability and repairability are major factors? What about a world where energy becomes freely available? These and many other factors converge with AI, even acting as inhibitors and catalysts. Some futures are also bright. Let’s explore those too.

    Resource : https://www.securityweek.com/cybersecurity-futurism-for-beginners/

    3May, 2023
    ChatGPT is Back in Italy After Addressing Data Privacy Concerns

    OpenAI, the company behind ChatGPT, has officially made a return to Italy after the company met the data protection authority’s demands ahead of April 30, 2023, deadline.

    The development was first reported by the Associated Press. OpenAI’s CEO, Sam Altman, tweeted, “we’re excited ChatGPT is available in [Italy] again!”

    The reinstatement comes following Garante’s decision to temporarily block access to the popular AI chatbot service in Italy on March 31, 2023, over concerns that its practices are in violation of data protection laws in the region.

    Generative AI systems like ChatGPT and Google Bard primarily rely on huge amounts of information freely available on the internet as well as the data its users provide over the course of their interactions.

    OpenAI, which published a new FAQ, said it filters and removes information such as hate speech, adult content, sites that primarily aggregate personal information, and spam.

    It also emphasized that it doesn’t “actively seek out personal information to train our models” and that it “will not use any personal information in training information to build profiles about people, to contact them, to advertise to them, to try to sell them anything, or to sell the information itself.”

    That said, the company acknowledged that ChatGPT responses may include personal information about public figures and other individuals whose details are accessible on the public internet.

    European users who wish to object to such processing of their personal information can do so by filling out an online form, and even exercise their right to correct, restrict, delete, or transfer their personal information contained within its training dataset.

    The Garante, in a related announcement, said OpenAI also agreed to include an option to verify users’ ages to confirm they are above 18 prior to gaining access to ChatGPT, or, alternatively, have obtained the consent of parents or guardians if aged between 13 and 18.

    OpenAI is further expected to implement a more robust age verification system to screen minors from accessing the service, with the watchdog noting that it will continue its “fact-finding activities regarding OpenAI” as part of a task force set up by the European Data Protection Board (EDPB).

    The move also follows OpenAI’s introduction of a new privacy setting that allows users to turn off chat history as well as an export option to access the kinds of information stored by ChatGPT.

    Resource: https://thehackernews.com/2023/04/chatgpt-is-back-in-italy-after.html

    3May, 2023
    Researchers Uncover New BGP Flaws in Popular Internet Routing Protocol Software

    Cybersecurity researchers have uncovered weaknesses in a software implementation of the Border Gateway Protocol (BGP) that could be weaponized to achieve a denial-of-service (DoS) condition on vulnerable BGP peers.

    The three vulnerabilities reside in version 8.4 of FRRouting, a popular open source internet routing protocol suite for Linux and Unix platforms. It’s currently used by several vendors like NVIDIA Cumulus, DENT, and SONiC, posing supply chain risks.

    The discovery is the result of an analysis of seven different implementations of BGP carried out by Forescout Vedere Labs: FRRouting, BIRD, OpenBGPd, Mikrotik RouterOS, Juniper JunOS, Cisco IOS, and Arista EOS.

    BGP is a gateway protocol that’s designed to exchange routing and reachability information between autonomous systems. It’s used to find the most efficient routes for delivering internet traffic.

    The list of three flaws is as follows –

    • CVE-2022-40302 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
    • CVE-2022-40318 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message with an Extended Optional Parameters Length option.
    • CVE-2022-43681 (CVSS score: 6.5) – Out-of-bounds read when processing a malformed BGP OPEN message that abruptly ends with the option length octet.

    The issues “could be exploited by attackers to achieve a DoS condition on vulnerable BGP peers, thus dropping all BGP sessions and routing tables and rendering the peer unresponsive,” the company said in a report shared with The Hacker News.

    “The DoS condition may be prolonged indefinitely by repeatedly sending malformed packets. The main root cause is the same vulnerable code pattern copied into several functions related to different stages of parsing OPEN messages.”

    A threat actor could spoof a valid IP address of a trusted BGP peer or exploit other flaws and misconfigurations to compromise a legitimate peer and then issue a specially-crafted unsolicited BGP OPEN message.

    This is achieved by taking advantage of the fact that “FRRouting begins to process OPEN messages (e.g., decapsulating optional parameters) before it gets a chance to verify the BGP Identifier and ASN fields of the originating router.”

    Forescout has also made available a Python-based open source BGP Fuzzer tool that allows organizations to test the security of the BGP suites used internally as well as find new flaws in BGP implementations.

    “Modern BGP implementations still have low-hanging fruits that can be abused by attackers,” Forescout said. “To mitigate the risk of vulnerable BGP implementations, […] the best recommendation is to patch network infrastructure devices as often as possible.”

    The findings come weeks after ESET found that secondhand routers previously used in business networking environments harbored sensitive data, including corporate credentials, VPN details, cryptographic keys, and other vital customer information.

    “In the wrong hands, the data gleaned from the devices – including customer data, router-to-router authentication keys, application lists, and much more – is enough to launch a cyberattack,” the Slovak cybersecurity firm said.

    Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.

    Resource: https://thehackernews.com/2023/05/researchers-uncover-new-bgp-flaws-in.html

    2May, 2023
    Three Cybersecurity Trends to Watch Out for in 2023

    Sophisticated phishing, vishing and ransomware campaigns will be aimed at a widening field of targets – but there are things you can do to protect yourself.

    In recent years, we’ve seen a growing number of innovative threats and a rapidly expanding field of targets – and there are no signs that cybercriminals will slow down in 2023. Watch out for these trends and adopt these cybersecurity best practices to protect yourself wherever you are.

    1. Social engineering attacks will get even more sophisticated.

    • Phishing attacks are no longer just simple emails mimicking communications from legitimate services. Threat actors are doing their research and sending highly convincing messages through varying messaging platforms, often supported by target information they’ve gathered from data breaches. A cybercriminal can combine data from a compromised e-commerce retail site with information from social media to create customized, targeted attacks.
    • “Callback” vishing attacks are increasing. These scams start with an email suggesting you’ve signed up for a subscription service.  The email contains a number you can call to cancel the service. In these attacks, the criminal tries to convince you to install remote access tools – and then deploys malicious software to gain entry into your network and data.
    • Criminals are incorporating Artificial intelligence (AI) in more polished phishing campaigns. Chatbots can be used to create full and convincing natural language phishing messages or fake job advertisements to support phishing campaigns. As language and video AI models advance, scammers will also be able to impersonate real people in real time with deepfakes, tricking victims into providing their financial and personal information.

    2. Lucrative ransomware attacks will be used by more threat groups.

    • Many ransomware groups use innovative phishing tactics to gain a foothold within target companies. New extortion tactics and threats will be part of this year’s push for more ransom payments.
    • Cybercriminals are also expanding the targets of their attacks to small and mid-size to large institutions, with less focus on larger national infrastructure targets.

     3. Supply chain attacks, data breaches and DDoS (Distributed Denial of Service) attacks will remain a threat.

    • Cybercriminals are finding ways to breach standard multi-factor authentication technologies. Businesses and customers using weak authentication methods are left vulnerable to data breaches and the loss of consumer information.
    • Open source code repositories are a valuable legitimate resource for technology teams, but threat actors have been known to upload malicious packages into such repositories as well. They want targeted developers to inadvertently download malicious code and infect downstream organizations.
    • World events have further complicated the threat landscape. Geopolitical conflict is acting as a catalyst for polarization of the criminal underground and an increasing number of attempts that include DDoS attacks.
    • Because businesses are now so interconnected and reliant on one another for information and services, supply chain attacks or self-propagating malware that spreads beyond its intended target are also possible.

    Resource : https://www.jpmorgan.com/technology/news/2023-cybersecurity-trends