• Search for:
    16Mar, 2023
    EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft

    Researchers warn that many electric vehicle (EV) charging management systems are affected by vulnerabilities that could allow hackers to cause disruption, steal energy, or obtain driver information. 

    The vulnerabilities were discovered by researchers working for SaiFlow, an Israel-based company that specializes in protecting EV charging infrastructure and distributed energy resources.

    The security holes are related to the communications between the charging system management service (CSMS) and the EV charge point (CP), specifically the use of the Open Charge Port Protocol (OCPP). The flaws have been confirmed to impact the CSMS offered by multiple vendors.

    The problem is related to the use of WebSocket communications by the OCPP and how it mishandles multiple connections. The protocol does not know how to handle more than one CP connection at a time and attackers could abuse this by opening a new connection to the CSMS. Another issue is related to what SaiFlow describes as “weak OCPP authentication and chargers identities policy”.

    By opening a new connection to the CSMS on behalf of a charge point, the attacker causes the original connection to be closed or to become nonfunctional. 

    According to SaiFlow, an attacker can exploit the weaknesses to launch a distributed denial-of-service (DDoS) attack that disrupts the electric vehicle supply equipment (EVSE) network. In addition, if an attacker can connect to the CSMS, they may be able to obtain drivers’ personal information, including payment card data, as well as other sensitive data, such as server credentials.

    In certain configurations, if the charger approves unknown driver identities, an attacker may be able to charge their vehicle without paying for it, the security firm said. 

    “Since the CSMS platforms are publicly accessible, it is possible for an attacker to hijack the connection remotely, without needing to gain credentials, access, or perform MITM attacks,” Ron Tiberg-Shachar, co-founder and CEO of SaiFlow, told SecurityWeek.

    Tiberg-Shachar believes it may be possible for a somewhat inexperienced hacker to carry out an attack, even with limited resources. 

    In order to conduct an attack, the hacker first needs to obtain a charger’s identity. This identity typically has a standard structure, making it easier for threat actors to enumerate the values of valid identifiers. 

    In the next phase, they need to obtain information on which CSMS platform the charger is connected to. The expert noted that the CSMS URL can be discovered using services such as Shodan or SecurityTrails. 

    SaiFlow has published a technical blog post describing the vulnerabilities and the attack scenarios. The company also provides recommendations for how these types of attacks can be mitigated. 

    It doesn’t seem like the vulnerabilities can be easily patched by vendors. 

    “We’ve approached many key players in the industry (and keep on doing so) to make them aware of our findings and how they can approach a solution,” Tiberg-Shachar said. “Additionally, we’ve made our solutions team available to support any specific technical questions, in an effort to reinforce vulnerabilities as quickly as possible. Our key goal is to support partners in scaling their charging infrastructure as quickly and safely as possible.”

    Resource : https://www.securityweek.com/ev-charging-management-system-vulnerabilities-allow-disruption-energy-theft/

    16Mar, 2023
    Does Your Help Desk Know Who’s Calling?

    Phishing, the theft of users’ credentials or sensitive data using social engineering, has been a significant threat since the early days of the internet – and continues to plague organizations today, accounting for more than 30% of all known breaches. And with the mass migration to remote working during the pandemic, hackers have ramped up their efforts to steal login credentials as they take advantage of the chaos and lack of in-person user verification.

    This has led to the revival of the old-school technique of vishing, which, like phishing online, involves using social engineering over the phone to steal sensitive information. Vishing attacks have been on the rise as a result, with 69% of companies experiencing them in 2021, up from 54% in 2020. These attacks often take the form of job or tech support scams and can be incredibly convincing. In August 2020, the FBI along with the CISA issued a warning regarding remote users being targeted by attackers spoofing organizations’ business numbers and impersonating the IT service desk.

    Vishing bypassing 2FA

    One of the most concerning aspects of vishing is the attackers’ ability to bypass two-factor authentication (2FA) security measures. 2FA is a popular form of multi-factor authentication that requires users to provide two types of information: a password and a one-time code sent via SMS.

    Attackers achieve this by impersonating a support representative and requesting the victim’s 2FA code over the phone. If the victim provides the code, the attacker can gain full access to their account, potentially leading to financial or personal information being compromised.

    Attackers impersonating as help desk support 

    A common instance is when individuals receive a pop-up alert claiming that their device has been breached or infected with malware and that professional phone support is required to fix the problem. Alternatively, victims may receive a call from an alleged tech support representative from a reputable software provider, claiming that malware has been detected on their machine. The attacker will try to convince the user to download remote access software under the pretext of corporate IT help desk representatives. This is the final phase of the scam, after which it’s checkmate for the unsuspecting victims and a potential payday for the attackers.

    Attackers impersonating the help desk is clearly working: in July 2020, Twitter experienced a major security breach when hackers used a vishing scam to successfully access dozens of high-profile accounts, including those of Barack Obama, Joe Biden, Jeff Bezos, and Elon Musk. The attackers used these accounts to tweet a bitcoin scam, resulting in the swift theft of over $100,000. Unlike traditional scams, these attacks target carefully selected individuals by gathering extensive information about them from social media and other public sources. This information is then used to identify employees who are most likely to cooperate and have access to the desired resources, at which point attackers are primed and ready to wreak havoc.

    A twist as attackers call the help desk & impersonate end-users 

    Social engineering attacks are carefully fabricated with collected data and can be used to impersonate an end-user on a call to the help desk. An experienced attacker can easily acquire answers to security questions from various sources, especially knowing end-users put too much personal information on social media and the web.

    Microsoft said that LAPSUS$, a known threat group, calls on a targeted organization’s help desk and attempts to convince support personnel to reset a privileged account’s credentials. The group would use previously gathered information, have an English-speaking caller speak with the help desk. They would be able to answer common recovery prompts such as “first street you lived on” or “mother’s maiden name” from data collected to convince help desk personnel of authenticity.

    In another attempt to reach the help desk, slack was used. Electronic Arts had 780GB of source code downloaded by hackers presumed to also be LAPSUS$. The threat actors used the authentication cookies to impersonate an already-logged-in employee’s account and access EA’s Slack channel, then convinced an IT support employee into granting them access to the company’s internal network.

    How can your Help Desk know who’s really calling

    Verifying user identity in the vishing age is more important than ever. With the rise of cyber-attacks and social engineering, it’s crucial for organizations to have security measures in place to safeguard their employees, protect their sensitive information, and prevent unauthorized access.

    One effective way to safeguard against these types of attacks is to implement a secure service desk solution, which allows for the verification of user accounts with existing data beyond just knowledge-based authentication. This can be achieved by sending a one-time code to the mobile number associated with the user’s account or using existing authentication services to verify callers.

    Enforcing user authentication is another key aspect of Specops Secure Service Desk. This ensures that information and password resets are only offered to authorized users, which is essential for protecting high-security accounts and adhering to regulatory requirements. With a Secure Service Desk, you can remove the opportunity for user impersonation by requiring verification with something the user has and not just relying on something the user – or an attacker – may know.

    In addition to verifying and enforcing user authentication, a secure service desk also allows for the secure reset or unlocking of user accounts. This is done only after the user has been successfully verified and can be combined with a self-service password reset tool to assist with account unlocks and the password reset process.

    With vishing scams showing no signs of slowing down, investing in Specops Secure Service Desk solution could be a critical step for organizations looking to protect their people from even the subtlest of social engineering attempts. By instilling a comprehensive and effective way to verify user identity, enforce user authentication, and reset or unlock user accounts, would-be victims can rest assured that they’ll always know who’s really calling.

    Resource : https://thehackernews.com/2023/03/does-your-help-desk-know-whos-calling.html

    15Mar, 2023
    Digital twins could be the key to successful automation

    Automation has delivered significant benefits for organizations that have taken the necessary steps to adopt it, but let’s face facts: The journey to successful automation typically isn’t an easy one. Despite best-laid plans, barriers and pain points continue to plague automation programs, creating bottlenecks, stifling scale and throttling better returns.

    Given the challenges of automation — for instance, heavy maintenance burdens can eat away at ROI, and a lack of visibility on automation estates can result in redundancies and inflated costs — it is little wonder that digital twinning and its innate ability to successfully address issues is beginning to resonate.

    Tracing its origins to NASA’s space program in the 1960s, digital twinning in automation can best be defined as a digital copy of an automated process that resides in a separate repository to the robotics process automation (RPA) platform where the actual automation is developed, deployed and orchestrated.

    Advantages of digital twins

    The primary advantage of the digital twin is that it evolves as automation evolves. As a result, if any changes are applied to the automation in the RPA platform, those same changes are reflected in the twin, ideally in real-time or at least near real-time.

    Operational metrics (including runs, last time run, number of issues, utilizations, and success rates) are also accessible and displayed where the twin resides so that it can be monitored and continuously improved.

    Beyond changes and operational metrics, a digital twin in automation enables an organization to compile accurate documentation and detailed audit trails for the entire automation estate and maintain it in a single, centralized repository. Doing so not only addresses the problem of misplaced or lost process design documents, but also solves one of the major pain points of automating: An inability to visualize and understand how automations have changed over time.

    Maintaining digital twins for all automations in a central location — regardless of the RPA platform in which they are designed, deployed and orchestrated — vastly improves automation standardization, governance and visibility. Particularly for companies that employ a multi-platform automation strategy, a single repository allows for greater visibility into the complexity of all processes, as well as the systems and applications with which they interact.

    This not only vastly improves oversight of the entire automation estate, but allows for faster recognition of potential issues and redundancies and identification of automations that can be retired to lower costs and increase returns.

    Less maintenance required

    Digital twinning also reduces the need for maintenance. By serving as a canvas for automation, a digital twin can be quickly reviewed to identify where an error has occurred and how it can be corrected, saving both time and money.

    It also flips the change management process. Rather than waiting for an automation to fail before taking corrective action, digital twins enable proactive steps to be taken as soon as a potential malfunction is detected or in advance of a regulatory change or application update.

    Finally, digital twins enable accelerated and simplified RPA platform migrations because the feasibility assessments to evaluate the effort needed to switch destination platforms can be more easily performed. Because a digital version of up-to-date automation exists, exporting automation with a mapping engine that requires only minor modifications dramatically reduces the effort needed and removes manual recoding.

    Forging new partnerships

    This will prove to be particularly important in the year ahead as more organizations look to migrate from their legacy RPA platforms to next-generation intelligent automation solutions.

    Migrations will be further complicated as new partnerships are being formed among well-established solution providers using information from Internet of Things (IoT). At least three digital twin-focused industry standards groups have already emerged to assist in guiding the technology forward.

    While there can be little doubt that digital twins in automation provide a palpable source for understanding what is delivering value (and what isn’t), implementing digital twins is likely to get more complicated as parameters, design principles and even basic assumptions change.

    Some digital twins still rely on older simulations and monitoring, while others have built-in AI solutions that rely on evolving data to keep parameters up-to-date.

    All of this suggests that while their benefits will likely vary from one organization to the next, digital twins undoubtedly will see even wider use in the future. With compound annual growth rates generally projected to approach 40% annually, some analysts are already predicting 2023 as a banner year for the digital twin.

    Spurred by new developments — including the ability to proactively search for and harvest data — expect the digital twin market to grow from its current level of $6.9 billion to more than $73.5 billion by 2027. More organizations will recognize the persistent problems digital twins can address and the benefits, from increased efficiency to greater ROI that they offer.  

    Resource : https://venturebeat.com/automation/digital-twins-could-be-the-key-to-successful-automation/

    15Mar, 2023
    How AI can ease those data management woes

    Data is the new oil, but raw data is no good in and of itself. Like oil, data assets have to be gathered entirely and accurately and sent through different refining processes to create value for end users. This is the general data lifecycle — an area where artificial intelligence (AI) is going to play a major role for enterprises.

    Initially, managing the data lifecycle was a task small enough to be handled manually by a team of experts. The volume of information was not that much, the sources were just a handful and the possible applications were also limited. But with the transition to the cloud, and the introduction of new sources, both the volume and diversity of data have surged.

    “Data management is no longer wholly focused on relational data,” Adam Ronthal, research VP in Gartner’s ITL data and analytics group, told VentureBeat. “Document, graph, time-series, wide-column, key-value, ledger and other targeted data stores all provide specific optimizations for different types of data, and different use cases. Sometimes, these are combined in a single data management platform — a multimodel database; sometimes, they remain as best-fit, targeted point solutions.”

    This increase in volume and diversity of information has rendered traditional ways of data management ineffective. Today, a company that selects, manages and optimizes (cleaning and enhancing) each dataset component individually will end up wasting a lot of time — cleaning and transformation alone can take days or weeks — and capital.

    The situation is comparable to Yahoo having used human experts to manually evaluate and catalog a deluge of web pages. The company dedicated plenty of resources but could evaluate only a small portion of the internet and struggled to keep the evaluations up to date.

    Bringing AI into data management

    Just as Google with its automated algorithms took over internet domination from Yahoo, evaluating web pages more quickly and at vastly lower cost, today AI is set to revolutionize the data lifecycle.

    According to Ronthal, applications of AI in data management rely on metadata analysis and activation. This allows the model to detect deviations in data usage from system design and (ideally automatically) correct them. This is augmented data management: using AI/ML to automate and optimize data management, allowing organizations to spend less time managing and optimizing infrastructure and more time building core business value.

    Many organizations have already started using AI- and ML-driven techniques to touch various components of data management, bringing improvements in speed and cost-efficiency.

    For instance, in January 2023, Google and Aible, a company bringing an AI-first approach to the data journey, worked with a Fortune 500 enterprise and enabled it to analyze over 75 datasets with over 100 million rows of data across 150 million variable combinations. The total compute cost: $80, less than a thousandth of the cost of traditional methods.

    Aible also published 25 case studies with Intel highlighting how enterprises across geographies and verticals benefitted from AI in less than 30 days and drove value across functions.

    Overall, Ronthal notes, AI augmentation can have an impact on multiple disciplines of data management, including:

    • Metadata management: Here, AI and ML can be used to explore and define the data’s metadata, evaluating metadata faster and more accurately, with reduced redundancy. Similarly, augmented data management functions can automatically catalog data elements during data extraction, access and processing.
    • Data integration: AI can be used to automate the integration development process, by recommending or deploying repetitive integration flows, such as source-to-target mappings.
    • Data quality: AI and ML can be used to extend profiling, cleansing, linking, identifying and semantically reconciling master data in different data sources.
    • DBMS: In addition to enhancing performance and cost-based query optimization, AI and ML can automate many current manual management operations, including managing configurations, elastic scaling, storage, indexes and partitions, and database tuning.
    • FinOps: AI and ML can be applied to budget and cost optimization problems and make recommendations about resource usage, pricing models, and second- and third-order effects of making changes in highly interconnected environments.

    Priya Krishnan, head of product management for data and AI at IBM, highlighted similar applications.

    “AI is being used to ingest, identify and classify datasets from a variety of sources,” she said. “It continuously mines content to surface unseen patterns and trends, providing organizations with greater visibility and actionable insights to aid in decision-making. Businesses are using AI to automate otherwise manual tasks like data capture, de-duplication, anomaly detection and data validation. They are also training models to apply regulatory policies and ethical standards automatically, ensuring those principles are embedded from the beginning.”

    Resource : https://venturebeat.com/data-infrastructure/how-ai-can-ease-data-management-woes/

    14Mar, 2023
    NASA To Measure Forest Health from Above

    In places across the U.S., tree cover is shrinking – forests are burned by wildfires on the West Coast and drowned by rising sea levels along the East. From the ground, it’s hard to assess the scale of the losses and the effects disappearing trees have on atmospheric carbon dioxide levels and climate change.

    NASA research scientist Jon Ranson is working to improve new technologies for studying trees from above, so future Earth-observing missions can more accurately assess forest health.

    “Trees do a huge service for the planet, in terms of sequestering carbon dioxide, taking it out of the atmosphere and putting it into wood,” Ranson said, “but trees are very sensitive to our changing climate. We’re trying to see the changes going on in forest ecosystems. If you detect things early enough, you might be able to do something about it.”

    When measured from aircraft and satellites, the wavelengths of light reflected by plants tell scientists about the amount of photosynthesis occurring, and therefore how much atmospheric carbon dioxide trees take up and store. The current standard for studying vegetation is called NDVI, or Normalized Differential Vegetation Index, which is the average of two broad portions of the infrared spectrum. NASA’s NDVI record goes back 40 years, providing a low-resolution but accurate picture of forest health.

    While NDVI is good at assessing vegetation quantity and vigor broadly, Ranson said, breaking down infrared and visible light into many more wavelengths, a technology called hyperspectral imaging, can provide insight on plants’ water content, chlorophyll and even changes in health. 

    “Vegetation has these broad spectral properties,” said Ian Adams, Earth Sciences Division Technologist at NASA’s Goddard Space Flight Center. “With hyperspectral imaging, you get lots of different measurements at smaller, closer together frequencies. There is a lot more information we can pull out if we can get better spectral resolution.”

    By dramatically increasing the number of frequencies available for researchers to study, Ranson’s work serves the priorities of the National Academies of Science’s most recent Earth Science decadal survey, which determines the field’s long-term priorities. The survey lists “surface topography and vegetation,” including forests, as a key area of study in need of more advanced technology.

     “Strategically for NASA, and more broadly for the remote sensing community, hyperspectral is one of the areas we see as the future,” Adams said.

    To make use of hyperspectral imaging by future orbital missions, data analysis techniques are first proven closer to the ground.

    Ranson’s team fitted a Skyfish drone (UAV) from partner institution Virginia Tech with a visible and infrared (VIS/IR) hyperspectral camera and lidar equipment. They flew the imaging equipment over forests near Blacksburg, VA, in a region called Mountain Lake. Comparing their UAV observations with actual CO2 levels recorded by sensors on a nearby National Ecological Observatory Network tower, Ranson’s team was able to refine calculations about how much carbon the forest removed from the atmosphere.

    These comparisons allowed them to further refine techniques for interpreting the hyperspectral data. For instance, Plants stressed by too much sunlight may release pigments to shield their chloroplasts, a condition his sensors can detect. If plants get too much shade, they may grow leaves with larger surface-areas, which can cause the sensor to overestimate plant productivity. Ranson wants to add short-wave infrared sensors to better distinguish reflections from leaves and other parts of plants, eliminating another possible source of error.

    The view from space: Seeing the forest for the trees

    Ranson’s goal is to study forests on a global scale from space.

    “We’re trying to get the complete picture,” Ranson said. “So that when we go to space, we know how to find the answer to the question, ‘Are our forests healthy? And if not, why not?’”

    Scientists and engineers at Goddard have been developing a mission concept called Concurrent Artificially intelligent Spectrometry and Adaptive Lidar System, or CASALS. If selected, CASALS would send a satellite with lidar and hyperspectral cameras into space. A constellation of such satellites could take the frequent measurements necessary to assess changes in forest productivity over time, using models perfected by Ranson’s UAV flights.“Forests take up as much carbon as the ocean does, yet forests cover only 9 percent of Earth’s surface,” said Ranson. “So, if something goes wrong with our forests, it’s a dramatic issue. We’ve got this great, great resource in forests, and we need to care for them so they’ll care for us.”

    Resource : https://www.nasa.gov/feature/nasa-to-measure-forest-health-from-above

    14Mar, 2023
    Advancing Women in Cybersecurity – One CMO’s Journey

    The number of women in cybersecurity is on the rise. Recent research finds women hold 25% of cybersecurity jobs globally in 2022, up from 20% in 2019, and projected to reach 30% by 2025 and 35% by 2031. While the trend is moving in the right direction, women are still underrepresented. As an industry, we are leaving untapped talent on the table which we can ill-afford to do given the ongoing cybersecurity workforce gap.

    March is Women in Cybersecurity month and March 8 is International Women’s Day. So, I thought I’d take the opportunity to speak with a woman who has grown up in cybersecurity, Anna Tutt, CMO of Oort, to share her experiences and get her perspective on how we can help accelerate this growth.

    How did you get into cybersecurity? I started my career in the technology consulting space. But I quickly moved into cybersecurity when I was recruited by Sourcefire to do revenue operations rollout which was my background. In that role, I worked with all parts of the organization—sales, marketing, executive management—and got to grow quickly into a global programs role before the company was acquired by Cisco. Sourcefire was a great experience as a beginner in cybersecurity. I was surrounded by great mentors and industry leaders who I learned a tremendous amount from. I got hooked on the high growth environment and have used that to drive me in my career going forward. Every company I’ve joined since has been in a different area of cybersecurity. From the network to threat intelligence and OSINT, and most recently identity security. Each time, I’ve jumped into a whole new world I’ve had to learn.

    What do you see as the greatest challenges the industry faces right now? The environment we operate in is super noisy. I feel this as a marketing professional – with all the vendors out there it’s hard to know where to start – and security practitioners feel this too. The outcome of that is that you have security teams spinning their wheels, responding to red flags across all their systems and not working efficiently. And organizations are missing the basics. Last year 80% of hacking-related breaches used stolen and/or weak passwords, according to the Verizon 2022 Data Breach Investigations Report. We’re leaving the front door open. That’s why I joined Oort. I believe that identities are the easiest way in, and the most often ignored attack surface. Helping companies get a complete view of their identities is critical in order to stop account takeover and eventually moving towards zero trust.

    What uniquely valuable insights or perspectives do you think women bring to cybersecurity? Women often have an innate ability to multi-task and organize so we can get our arms around a lot, which is important in this profession. We also bring additional perspective and creativity which can help drive different solutions. Criminals are coming up with creative ways to attack us and we need creative ways to prevent them. Finally, empathy is very important. Being able to keep the customer in mind and humanize challenges changes discussions and helps us connect to our audiences better, which creates a win-win for vendors and users.

    There’s a lot of FUD out there. What makes you optimistic about the war on cybercrime?
    Despite all the economic uncertainty this year, cybersecurity is proving to still be a priority. Companies are still planning to invest in additional security technologies and services. And vendors are getting funding to come up with creative ways to solve problems. I think that’s a testament to how much innovation and need there is in this space. At the end of the day there are more good guys than bad guys, and as long as the good guys keep investing and getting funding to fight against it, the bad guys are going to be on their back foot.

    What advice can you share with women thinking about getting into cybersecurity or still early in their careers? First, even if you’re not in a technical role, invest in building up your cyber acumen. The more you understand how security teams operate, the better you can do your job. Second, trust your gut when joining a company and know your worth. Women tend to go in with imposter syndrome. Do your homework and go in prepared and confident. And third, find a trusted resource – a mentor or two you can turn to for advice navigating opportunities and challenges and setting boundaries. I’ve been lucky to have great mentors in my career who have really helped me. Hold onto these people. 

    The theme for International Women’s Day is #EmbraceEquity. Do you have any advice for employers on recruiting and retaining women? Here again, I have gotten lucky and have found that the most successful employers are those that understand their values, define their policies and then live those values. Make diversity integral to your culture, talk about your policies in the interview process so candidates don’t have to ask and, starting at the top, walk the walk. If you don’t do these things, you risk ignoring a huge population that is wondering if you are looking at them differently. When you can leave those questions at the door, you can talk about what is important.

    Resource : https://www.securityweek.com/advancing-women-in-cybersecurity-one-cmos-journey/

    13Mar, 2023
    Girl With ‘AI Earrings’ in Dutch Museum Sparks Fierce Art Controversy Over Use of Artificial Intelligence

    At first glance it seems to be just a modern take on Johannes Vermeer’s masterpiece “Girl with a Pearl Earring”. But look more closely and things get a little strange.

    Firstly, there are two glowing earrings in the image hanging in the Mauritshuis museum in the Dutch city of The Hague. And aren’t those freckles on her face actually… a slightly inhuman shade of red?

    That’s because the work — one of several fan recreations replacing 1665 original while it’s on loan for a huge Vermeer show at Amsterdam’s Rijksmuseum — was made using artificial intelligence (AI).

    Its presence has sparked a fierce debate, with questions over whether it belongs in the hallowed halls of the Mauritshuis — and whether it should be classed as art at all.

    “It’s controversial, so people are for it or against it,” Mauritshuis press officer Boris de Munnick told AFP.

    “The people who selected this, they liked it, they knew that it was AI, but we liked the creation. So we chose it, and we hung it.”

    – ‘Incredible insult’ –

    Berlin-based digital creator Julian van Dieken submitted the image after Mauritshuis asked people to send in their versions of the famous painting for an installation called “My Girl with a Pearl”.

    Van Dieken said he had used the AI tool Midjourney — which can generate complex pictures on the basis of a prompt, using millions of images from the internet — and Photoshop.

    The Mauritshuis then chose it as one of five images out of 3,482 submitted by fans that would be printed and physically hung in the room where “Girl with a Pearl Earring” is normally housed.

    “It’s surreal to see it in a museum,” van Dieken wrote on Instagram.

    The budding artists ranged in age from three to 94, depicting the “Girl” in diverse styles ranging from a puppet to a dinosaur and a piece of fruit. 

    But the decision to choose an AI-generated image sparked a backlash.

    One artist said on the Instagram feed for the Mauritshuis exhibition that it was a “shame and an incredible insult”, and dozens of others piled in.

    A common complaint was that AI tools can breach the copyright of other artists by using their works as the base for artificially generated images.

    Artist Eva Toorenent, of the European Guild for Artificial Intelligence Regulation, criticised what she called “unethical technology”.

    “Without the work of human artists, this program could not generate works at all,” she was quoted as saying by the Dutch newspaper De Volkskrant.

    – ‘What is art?’ –

    “It’s such a difficult question — what is art, and what is not art?” said the Mauritshuis’s de Munnick.

    But he insisted that the museum, whose collection boasts three Vermeers and nearly a dozen Rembrandts, had not deliberately set out to make an artistic statement on AI.

    “Our opinion is, we think it’s a nice picture, we think it’s a creative process,” he said. “We’re not the museum to discuss if AI belongs in an art museum.”

    He admitted though that “up close, you see that the freckles are a little spooky.”

    Visitors to the Mauritshuis were equally divided, he added.

    “Younger people tend to say, it’s artificial intelligence, what’s new. Elderly people sometimes say we like the more traditional paintings.”

    The Mauritshuis were looking forward to the return of the real “Girl” in April, he added. The painting’s fame has increased in recent years due to a 1999 novel by US author Tracy Chevalier and an ensuing Hollywood film.

    “Well, she is beautiful in the (Rijksmuseum) exhibition… But we will be very happy when she is at home.”

    Resource : https://www.gadgets360.com/internet/news/girl-with-a-pearl-earring-ai-recreation-julian-van-dieken-criticism-mauritshuis-exhibit-johannes-vermeer-3850111

    13Mar, 2023
    AI is taking phishing attacks to a whole new level of sophistication

    92% of organizations have fallen victim to successful phishing attacks in the last 12 months, while 91% of organizations have admitted to experiencing email data loss, according to Egress

    Not surprisingly, 99% of cybersecurity leaders confess to being stressed about email security. Specifically, 98% are frustrated with their Secure Email Gateway (SEG), with 53% conceding that too many phishing attacks bypass it.

    “The growing sophistication of phishing emails is a major threat to organizations and needs to be urgently addressed,” said Jack Chapman, VP of Threat Intelligence, Egress. “The signature-based detection used by Microsoft 365 and secure email gateways (SEGs) can filter out many phishing emails with known malicious attachments and links, but cybercriminals want to stay one step ahead. They are evolving their payloads and increasingly turning to text-based attacks that utilize social engineering tactics and attacks from a known or trusted source, such as a compromised supply chain email address.”

    “Unfortunately, phishing attacks will only become more advanced in the future, as cybercriminals use AI-powered technologies, such as chatbots, to automate and improve their attacks, such as adding video and voice capabilities to text-based phishing,” Chapman concluded.

    Inbound and outbound email security

    The report investigates both inbound phishing attacks and outbound data loss and exfiltration, highlighting the importance of a holistic approach to email security.

    Interestingly, 71% of surveyed cybersecurity leaders view inbound and outbound email security as a unified issue to tackle, recognizing their interconnected nature. The survey goes on to examine the technical controls and security awareness and training (SA&T) programs in place to reduce email security risk.

    Sophistication of phishing emails cause major financial losses

    86% of surveyed organizations reported that they were negatively impacted by sophistication of phishing emails, and 54% suffered financial losses due to customer churn following a successful phishing attack.

    Additionally, 40% of incidents resulted in employees leaving the organization. Cybersecurity leaders found that 85% of successful account takeover (ATO) attacks began with a phishing email.

    Risky behavior lead to costly data loss

    The survey found that people making mistakes or taking risks to accomplish their tasks are more common than malicious insiders. In fact, 91% of cybersecurity leaders surveyed reported that data had been leaked externally by email.

    The top three causes for these incidents include reckless or risky employee behavior, such as transferring data to personal accounts for remote work, human error, including employees emailing confidential information to incorrect recipients, and malicious or self-serving data exfiltration, such as taking data to a new job.

    Furthermore, 49% of organizations surveyed experienced financial losses from customer churn following a data loss incident, and 48% of incidents resulted in employees leaving the organization.

    Too many phishing emails bypassing employee inboxes

    58% of cybersecurity leaders believed their SEG was not effective in preventing employees from accidentally emailing the wrong person or with the wrong attachment.

    Additionally, 53% of respondents reported too many phishing emails still made it to employees’ inboxes, while 50% of organizations found it takes a lot of administrative time to manage their SEG.

    Security awareness and training

    Although 98% of the surveyed organizations conducted some form of Security Awareness and Training (SA&T), 96% of them expressed concerns or limitations with their SA&T programs.

    59% of organizations reported that SA&T is necessary for compliance with regulations or cyber insurance, and 46% of organizations reported that employees tend to skip through SA&T as fast as possible.

    Additionally, 37% of organizations admitted they lack confidence that employees remember what they have been taught during SA&T, and 29% of organizations reported that employees find SA&T to be annoying.

    Email security is a necessity for stoping phishing attacks

    The report highlights that people need real-time teachable moments that alert them to threats and engage them at the point of risk to tangibly reduce the number of security incidents that occur.

    Data throughout the report highlights that advanced email security is a necessity for everyday business. Despite investments in traditional email security and SA&T, surveyed organizations remain highly vulnerable to phishing attacks, human error, and data exfiltration.

    The only way to change the situation is to use intelligent email security solutions that augment traditional SEGs and Microsoft 365, offering the defense-in-depth required with a layered security approach.

    Resource : https://www.helpnetsecurity.com/2023/03/08/sophistication-of-phishing-emails/?web_view=true

    7Mar, 2023
    AI is making a long-running scam even more effective

    You’ve no doubt heard of the scam where the perpetrator calls up an elderly person and pretends to be their grandchild or some other close relative. The usual routine is to act in a distressed state, pretend they’re in a sticky situation, and ask for an urgent cash transfer to resolve the situation. While many grandparents will realize the voice isn’t that of their grandchild and hang up, others won’t notice and, only too keen to help their anxious relative, go ahead and send money to the caller’s account.

    A Washington Post report on Sunday reveals that some scammers have taken the con to a whole new level by deploying AI technology capable of cloning voices, making it even more likely that the target will fall for the ruse.

    To launch this more sophisticated version of the scam, criminals require “an audio sample with just a few sentences,” according to the Post. The sample is then run through one of many widely available online tools that use the original voice to create a replica that can be instructed to say whatever you want simply by typing in phrases.

    Data from the Federal Trade Commission suggests that in 2022 alone, there were more than 36,000 reports of so-called impostor scams, with more than 5,o00 of these happening over the phone. Reported losses reached $11 million.

    The fear is that with AI tools becoming more effective and more widely available, even more people will fall for the scam in the coming months and years.

    The scam still takes some planning, however, with a determined perpetrator needing to find an audio sample of a voice, as well as the phone number of the related victim. Audio samples, for example, could be located online via popular sites like TikTok and YouTube, while phone numbers could also be located on the web.

    The scam can take many forms, too. The Post cites an example where someone pretending to be a lawyer contacted an elderly couple, telling them their grandson was in custody for an alleged crime and that they needed more than $15,000 for legal costs. The bogus lawyer then pretended to hand the phone to their grandson, whose cloned voice pleaded for help to pay the fees, which they duly did.

    They only realized they’d been scammed when their grandson called them later that day for a chat. It’s thought the scammer may have cloned his voice from YouTube videos that the grandson posted, though it’s hard to be sure.

    Some are calling for the companies who make the AI technology that clones voices to be held responsible for such crimes. But before this happens, it seems certain that many others will lose money via this nefarious scam.

    To listen to an example of a cloned voice to see just how close to the original it can get, check out this Digital Trends article.

    Resource : https://www.digitaltrends.com/computing/ai-making-long-running-scam-more-effective/

    7Mar, 2023
    LastPass Says Hackers Targeted Employee’s Home PC to Access Secure Servers

    LastPass has been in the news a lot lately, and not because it’s the internet’s number one password manager, as it still proudly proclaims. The company is still reeling from a series of hacks last year that resulted in a trove of user data being stolen. This week, LastPass released new details of the attacks, explaining that the attacker targeted a senior LastPass engineer to gain access to the sensitive internal information that made the data theft possible.

    Problems started for LastPass in August 2022 when it notified users of a “security incident” involving proprietary company information. It said at the time that no user data was accessed, but in November, it announced a second attack that did target the passwords and other sensitive data people had stored on LastPass’ servers. The threat actor leveraged data stolen in the first phase of the attack in August, but how did they get that data in the first place? Well, it’s not pretty.

    LastPass explains in the latest investigation update that the attackers targeted a senior engineer at the company; one of only four people with access to the LastPass corporate vault. The employee in question was working from home, and their employer did not enforce any access restrictions. The DevOps engineer was accessing sensitive company data using a personal computer, which also ran a “media software package.” Other sources claim the media software in question is Plex, which reported a data breach around the same time. Using an undocumented vulnerability in the media software, the attacker installed a keylogger and waited for the engineer to enter the master password and two-factor code.

    That operation gave the threat actor the keys to the kingdom; they obtained decryption keys for the company’s AWS-hosted backups, including critical databases and other resources. Because of the way LastPass had implemented access auditing, nothing seemed amiss at first. The company didn’t know about the second attack until Amazon alerted it to unusual activity on the account. The attacker made off with user vaults that are only partially encrypted. The password data is secure, but the vaults include plain text URLs, emails, and IP addresses. Worse still, the passwords are only protected by the user’s master password, which could be weak on older accounts.

    In addition to the updated blog post, LastPass has published a rundown of all the data lost in the attacks. The company also provides a list of changes made to its security setup, but this is far from the first security issue for LastPass. It suffers a data breach of some sort almost every year, and it always says it has improved its security afterward. Perhaps LastPass, with millions of user passwords, is just too tempting a target. If you’ve got a LastPass account, it might be time to reevaluate.

    Resource : https://www.extremetech.com/internet/343423-lastpass-says-hackers-targeted-employees-home-pc-to-access-secure-servers