The news is out that the DoD and the NSA is about to open an AI Security Center. Here’s why they are doing this:
The AI Security Center will become the focal point for developing best practices, evaluation methodology and risk frameworks with the aim of promoting the secure adoption of new AI capabilities across the national security enterprise and the defense industrial base.
The new entity will consolidate the agency’s various artificial intelligence, security-related activities.
“The AI Security Center will work closely with U.S. Industry, national labs, academia across the [intelligence community] and Department of Defense and select foreign partners,” Nakasone said during a discussion hosted by the National Press Club in Washington.
Emily Phelps, Director, Cyware had this comment:
“In an era where technological advancements are both an advantage and a potential threat, centralizing expertise and capabilities can foster rapid development while ensuring that vulnerabilities are addressed quickly. Collaborative initiatives with the Defense Department, intelligence community, academia, and international partners can provide a holistic approach to AI-supported security. It’s crucial for the US to not only maintain but enhance its leadership in AI, ensuring that its innovative capabilities remain protected.”
This is a really good move by the NSA. It puts the smartest minds on the topic in one place. Which will make it way easier to respond to whatever curve balls that AI has in store for all of us.
Malwarebytes Discovers That The Bing AI Chatbot Delivers Ads With Malicious Links
Posted in Commentary with tags AI, Malwarebytes on September 29, 2023 by itnerdMalwarebytes has research on Bing and its AI Chatbot being leveraged by threat actors to deliver ads with malicious links. In short, it’s a malvertizing campaign in which attackers take over the ad accounts of legitimate businesses to create targeted malicious ads:
Ads can be inserted into a Bing Chat conversation in various ways. One of those is when a user hovers over a link and an ad is displayed first before the organic result. In the example below, we asked where we could download a program called Advanced IP Scanner used by network administrators. When we place our cursor over the first sentence, a dialog appears showing an ad and the official website for this program right below it:
Users have the choice of visiting either link, although the first one may be more likely to be clicked on because of its position. Even though there is a small ‘Ad’ label next to this link, it would be easy to miss and view the link as a regular search result.
Upon clicking the first link, users are taken to a website (mynetfoldersip[.]cfd) whose purpose is to filter traffic and separate real victims from bots, sandboxes, or security researchers. It does that by checking your IP address, time zone, and various other system settings such as web rendering that identifies virtual machines.
Real humans are redirected to a fake site (advenced-ip-scanner[.]com) that mimics the official one while others are sent to a decoy page. The next step is for victims to download the supposed installer and run it.
The MSI installer contains three different files but only one is malicious and is a heavily obfuscated script:
Upon execution, the script reaches out to an external IP address (65.21.119[.]59) presumably to announce itself and receive an additional payload.
Lovely.
Emily Phelps, Director, Cyware had this comment:
“With advancing technologies and a rapidly evolving digital landscape, threat actors are able to exploit human trust in established entities at scale. Addressing these risks requires more than awareness training and traditional security controls. End users must understand the risks and proceed with caution, but platforms must also bolster their security posture to adapt to these threats. It’s critical to employ continuous and rigorous testing to ensure they remain a step ahead of potential online adversaries.”
Add this to the attack surface that you have to defend yourself against as I didn’t have “malware delivered by ads on an AI chatbot” on my cybersecurity BINGO card. But I should have expected it as threat actors are getting very crafty these days.
Leave a comment »