Archive for October 23, 2024

AI repository Hugging Face loaded with malicious files to steal info

Posted in Commentary with tags on October 23, 2024 by itnerd

OODA Loop reports today that “Hackers Have Uploaded Thousands Of Malicious Files To Hugging Face Repository” based on input from Protect AI.  

The OODA Loop story reads in part: “The old Trojan horse computer viruses that tried to sneak malicious code onto your system have evolved for the AI era,” said Ian Swanson, Protect AI’s CEO and founder.

  “The Seattle, Washington-based startup found over 3,000 malicious files when it began scanning Hugging Face earlier this year. Some of these bad actors are even setting up fake Hugging Face profiles to pose as Meta or other technology companies to lure downloads from the unwary, according to Swanson. A scan of Hugging Face uncovered a number of fake accounts posing as companies like Facebook, Visa, SpaceX and Swedish telecoms giant Ericsson. One model, which falsely claimed to be from the genomics testing startup 23AndMe, had been downloaded thousands of times before it was spotted…”

Mali Gorantla, Chief Scientist at AppSOC had this to say:

  “It should surprise no one that Hugging Face has become a magnet for malware and bad actors. In the last year, the number of AI models available on Hugging Face has tripled, now topping 1 million. Data scientists and AI developers love experimenting with this vast amount of open-source data to build and train new AI applications. The problem is that most security teams have little visibility into what models or datasets have been downloaded or where they exist. I can’t think of a more obvious place to embed malware, infiltrate corporate defenses, and hide your tracks.”

Security teams need to change their tactics so that they have visibility and are able to uncover this sort of thing. Because this is clearly the next “big thing” that threat actors are engaged in.

ESET Bulks Up its ESET HOME Security Offerings to Protect Against AI-Driven Threats

Posted in Commentary with tags on October 23, 2024 by itnerd

 ESET today announced its upgraded consumer offering, ESET HOME Security, with new features, such as ESET Folder Guard, Multithread Scanning, and Identity Protection featuring Dark Web Monitoring. These enhancements to ESET HOME Security, as an all-in-one solution for consumers, correspond to the increasing number of advanced, automated, and AI-driven threats targeting individuals and address growing concerns about data privacy, ransomware attacks, phishing, and scams.  

ESET HOME Security is available across all major operating systems—Windows, macOS, Android, iOS—and covers all typical smart home devices. Improvements have been made to enhance the existing layers of protection, including upgrades to the Link Scanner and Password Manager. Security for Mac users has been improved with a new unified Firewall offering both basic and advanced setup options in the main Graphical User Interface (GUI).  

Some of the top new and improved features include:  

New Dark Web Monitoring — ESET Identity Protection is now available in Canada, providing users with advanced tools to safeguard their personal information. This feature scours the dark web, black market chat rooms, blogs, and other data sources for the illegal trading and selling of personal data. ESET’s cutting-edge technology delivers prompt alerts, enabling users to take immediate action and mitigate potential identity theft risks. 

New ESET Folder Guard — This technology helps protect Windows users’ valuable data from malicious apps and threats, such as ransomware, worms, and wipers (malware that can damage users’ data). Users can create a list of protected folders — files in these folders can’t be modified or deleted by untrusted applications.   

New Multithread Scanning  Improves scanning performance for multi-core processor devices using Windows by distributing scanning requests among available CPU cores. There can be as many scanning threads as the machine has processor cores. 

Improved Gamer Mode — This feature is for users who demand uninterrupted usage of their software without pop-up windows and want to minimize CPU usage. The improved version allows users to create a list of apps automatically starting gamer mode. For cautious players, there is also a new option to display interactive alerts while gamer mode is running.  

This robust all-in-one security product is an ideal solution for all who have concerns beyond general cybersecurity, and it includes privacy protection, identity protection, performance optimization, device protection, and smart home protection. Because in a world of advanced cyberthreats, quality matters. 

More information about the consumer offering and subscription tiers can be found here

Unit 42 Research: Novel Jailbreaking Technique ‘Deceptive Delight’

Posted in Commentary with tags on October 23, 2024 by itnerd

Today, Palo Alto Networks Unit 42 shares that it has identified a new jailbreaking technique, ‘Deceptive Delight,’ which can bypass the safety guardrails of state-of-the-art LLMs to generate unsafe content. The findings highlight significant vulnerabilities in AI systems, revealing the urgent need for enhanced security measures to prevent the misuse of Gen AI technologies.

Key findings detail that Deceptive Delight:

  • Achieves a 65% attack success rate against open-source and proprietary AI models, significantly outperforming the 5.8% attack success rate achieved when sending unsafe topics directly to these models without using any jailbreak techniques.
  • Embeds unsafe topics within benign narratives, cleverly tricking LLMs into producing harmful content while focusing on seemingly harmless details.
  • Employs a multi-turn approach, where the model is prompted progressively across multiple interactions, enhancing both the relevance and severity of the unsafe output generated and increasing the likelihood of harmful content creation.

You can find the full blog here.

On Now! Nikon Pop-Up Experience at Yorkdale Mall

Posted in Commentary with tags on October 23, 2024 by itnerd

From now until October 24, Nikon Canada is hosting a Nikon Pop-Up Experience at Yorkdale Mall in Toronto!

Inspired by its heritage models, the Nikon Zfc and Zf cameras, the concept of Nikon’s Pop-Up is a retro diner with antique furniture and neon lights. It also has the opportunity to check out Nikon’s latest cameras.

At the ‘Nikon Diner’ there will be an ‘IG Worthy’ vintage-style photobooth where visitors will be able to take home physical photos.

Guests will be encouraged to share their photobooth image on social using the #NikonCreators and #NikonDiner hashtags for a chance to win a Zfc kit! Visitors will also be able to engage in “diner chats” with Nikon ambassadors and creators, who will share photo and video tips and tricks.

Visit the ‘Nikon Diner’ at Yorkdale during mall hours between Oct 17th-24th! It is located right next to Canada Goose near Entrance E.

Wallarm Releases Q3 2024 API ThreatStats Report

Posted in Commentary with tags on October 23, 2024 by itnerd

Wallarm, a global leader in API security, today unveiled its API ThreatStats Report for Q3 2024, revealing critical insights into the increasing number of API vulnerabilities and breaches impacting industries worldwide. The report confirms the trend of increasing numbers of API vulnerabilities across sectors and an escalating threat landscape specifically targeting APIs due to their accessibility and valuable data.

Wallarm’s researchers uncovered a 21% increase in API vulnerabilities from the second quarter of 2024. Additionally, the vulnerabilities had an average Common Vulnerability Scoring System (CVSS) score of 7, with many scoring at 7.5, indicating high severity and reflecting how easily threat actors can exploit API issues. The substantial growth in discovered vulnerabilities highlights the expanding threat landscape, where APIs remain a primary target for cyberattacks across multiple sectors.

Key insights on API Q3 data breaches include:

  • Client-Side API Vulnerabilities Expose Hidden Risks Not Covered by the OWASP API Top-10: Many breaches this quarter, like those at Hotjar, Business Insider, and Explore Talent, originated from client-side API flaws, such as OAuth misconfigurations and Cross-Site Scripting (XSS), which the OWASP API Top-10 does not adequately address. Developers often mistakenly consider OAuth a security improvement, but it becomes a critical weakness when misconfigured, enabling account takeovers and large-scale data exposure. These incidents reveal that client-side API security needs more attention and a dedicated approach to prevent such breaches.
  • API Misconfigurations Amplify Breach Scale: Poorly secured APIs, especially those with weak authentication and authorization controls, lead to large-scale breaches because attackers can access and download entire datasets, not just isolated portions. This finding was evident in incidents at Deutsche Telekom and Fractal ID, where unauthenticated API access allowed attackers to exploit massive amounts of personal data, tariff information, and user tracking. Unlike traditional malware attacks that may target random subsets of data, API breaches often result in complete data extraction, making the impact far more severe.
  • APIs Are a Common Weak Link Across Diverse Industries: This summer’s breaches affected a wide range of sectors, from telecommunications (Deutsche Telekom) and transportation (Metro Pacific Tollways Corporation) to blockchain and Web3 platforms (Fractal ID). These incidents prove that no industry is immune, and API vulnerabilities are a universal challenge across traditional and cutting-edge tech landscapes. Securing APIs requires consistent, industry-wide efforts to address evolving attack vectors.

As detailed in the report, another key discovery this quarter is the integral role of API security in AI systems. There is no AI without APIs—they are essential in connecting models, data, and infrastructure. API vulnerabilities directly impact AI functionalities, and AI features can introduce unique vulnerabilities into APIs. Addressing AI exploits and API vulnerabilities is crucial for comprehensive security, as they are deeply interconnected.

The increase in API vulnerabilities emphasizes the urgency for businesses to stay vigilant and invest in comprehensive API security measures. Wallarm is the only solution that unifies best-in-class API protection and real-time blocking capabilities to protect the entire API and web application portfolio in multi-cloud,  cloud-native, and on-premise environments and empowers organizations to defend against these growing threats.

To download the full API ThreatStats Q3 2024 Report, visit http://www.wallarm.com/resources/q324-api-threatstats-report.