Wallarm Introduces Industry-First Penetration Testing Service for Agentic AI Systems

Posted in Commentary with tags on February 19, 2025 by itnerd

Wallarm, the leader in API and AI security solutions, is pleased to announce a groundbreaking offer for the enterprise security community: penetration testing for Agentic AI systems. This industry-first offer is designed to help organizations assess and secure their AI-driven systems from emerging threats.

As enterprises increasingly turn to Agentic AI — advanced AI systems capable of autonomous decision-making, continuous learning, and sophisticated action-taking — concerns about security vulnerabilities in these complex systems are mounting. In fact, Wallarm’s recent API ThreatStats report demonstrated that 57% of AI powered APIs are available externally, and 89% relied on insecure authentication methods, such as static keys. Wallarm’s penetration testing service focuses on key attack vectors like jailbreaking, injections, and other security threats that can compromise the integrity and performance of Agentic AI.

The service, powered by Wallarm’s advanced cybersecurity analysts, provides businesses with a detailed report highlighting vulnerabilities and offering insights into how to safeguard these cutting-edge technologies. By leveraging Wallarm’s expertise in API security, companies can ensure that their Agentic AI systems remain secure in an increasingly connected world.

With AI agents becoming a cornerstone of enterprise operations, Wallarm’s service is a timely initiative to help organizations understand and mitigate the unique security challenges of this new frontier in AI technology.

How to Learn More

Interested parties can request a free Agentic AI penetration test by following the link below and submitting a request. Wallarm’s security experts will then conduct a thorough analysis of the AI system’s vulnerabilities and provide a detailed report with actionable recommendations. For more information, please visit https://www.wallarm.com/solutions/protect-agentic-ai.

Foxit Announces Launch of PDF SDK for Desktop 10.1.0 and PDF Conversion SDK 2.1.0

Posted in Commentary with tags on February 19, 2025 by itnerd

Foxit today announced the launch of Foxit PDF SDK for Desktop 10.1.0 and Foxit PDF Conversion SDK 2.1.0, featuring powerful new tools and enhancements to streamline PDF processing and empower developers. The new updates introduce advanced compliance tools, improved OCR accuracy, faster processing speeds, enhanced conversion workflows, and expanded APIs for greater flexibility and precision in PDF development.

Foxit PDF SDK 10.1.0 New Features and Functionality:

The latest version of Foxit PDF SDK focuses on improving compliance, enhancing conversion workflows, boosting performance, and adding powerful new features. Key highlights include:

  • Compliance & Standards – New preflight functionality ensures document compliance with PDF/E and PDF/X standards
  • DWG2PDF – Improved conversion progress tracking, output log control, and color conversion policies
  • Libre Office2PDF – Multi-threaded conversion capabilities for Linux, driven by a binary engine
  • Enhanced OCR Capabilities – Upgraded OCR features include skew correction, image denoising, and multi-core processing, enabling faster and more accurate image-based text recognition
  • Performance Boosts – Optimization and form file import speeds have been dramatically improved, reducing processing times from minutes or hours to seconds
  • New APIs and Features – Developers can now access regular expression search, advanced image processing, text processing, and more
  • Foxit PDF2Office – Flexible library initialization, driven by a binary engine

Additional New Features:

  • PDF3D – Support for retrieving and presetting 3D views, along with default view resets
  • Annotations – Separate transparency settings for border and fill colors, JavaScript-based sub-actions in link annotations, and retrieval of annotations by unique IDs
  • TextSearch – Enhanced with regular expression support
  • Rendering – Improved support for rendering PDF pages to 1bpp bitmap and Linux PDF print devices

Foxit PDF Conversion SDK 2.1.0 New Features and Functionality:

Foxit PDF Conversion SDK 2.1.0 introduces significant enhancements for developers working with complex conversion processes. Key updates include:

  • Foxit Office2PDF – Official integration of Foxit Office2PDF as an add-on, with new features like outline conversion in Word2PDF and workbook conversion options in Excel2PDF.
  • Enhanced Conversion Flexibility – More conversion options, including the ability to remove trailing spaces, insert page breaks, and output images during conversion. It also introduces support for restricted PDF file conversion.
  • New Class and API – ConvertCheckCallback, allowing for more flexible conversion checks.
  • Updated APIs – New APIs for handling PDF-to-Office conversions, such as PDF2Office, PDF2Word, PDF2Excel, and PDF2PowerPoint, now offering more control over conversion processes and better handling of complex layouts and formatting.

Foxit PDF SDK for Desktop 10.1.0 and Foxit PDF Conversion SDK 2.1.0 are now generally available (GA). To learn more, please visit: https://developers.foxit.com/news/latest-release/.

Deepgram Achieves Key Milestone on Path to Delivering Next-Gen, Enterprise-Grade Speech-to-Speech Architecture

Posted in Commentary with tags on February 19, 2025 by itnerd

Deepgram has announced a significant technical achievement in speech-to-speech (STS) technology for enterprise use cases. The company has successfully developed a speech-to-speech model that operates without relying on text conversion at any stage, marking a pivotal step toward the development of contextualized end-to-end speech AI systems. This milestone will enable fully natural and responsive voice interactions that preserve nuances, intonation, and emotional tone throughout real-time communication. When fully operationalized, this architecture will be delivered to customers via a simple upgrade from our existing industry-leading architecture. By adopting this technology alongside Deepgram’s full-featured voice AI platform, companies will gain a strategic advantage, positioning themselves to deliver cutting-edge, scalable voice AI solutions that evolve with the market and outpace competitors.

Advancements Over Existing Architectures

Existing speech-to-speech (STS) systems are based on architectures that process speech through sequential stages, such as speech-to-text, text-to-text, and text-to-speech. These architectures have become the standard for production deployments for their modularity and maturity, but eliminating text as an intermediary offers opportunities to improve latency and better preserve emotional and contextual nuances.

Meanwhile, multimodal LLMs like GeminiGPT-4o, and Llama have evolved beyond text-only capabilities to accept additional inputs such as images, videos, and audio. However, despite these advancements, they struggle to capture the fluidity and nuance of human-like conversation. These models still rely on a turn-based framework, where audio input is tokenized and processed within a textual domain, restricting real-time interactivity and expressiveness.

To advance the frontier of speech AI, Deepgram is setting the stage for end-to-end STS models, which offer a more direct approach by converting speech to speech without relying on text. Recent research on speech-to-speech models, such as Hertz and Moshi, has highlighted the significant challenges in developing models that are robust and reliable enough for enterprise use cases. These difficulties stem from the inherent complexities of modeling conversational speech and the substantial computational resources required. Overcoming these hurdles demands innovations in data collection, model architecture, and training methodologies.

Delivering Speech-to-Speech with Latent Space Embeddings

Deepgram is transforming speech-to-speech modeling with a new architecture that fuses the latent spaces of specialized components, eliminating the need for text conversion between them. By embedding speech directly into a latent space, Deepgram ensures that important characteristics such as intonation, pacing, and situational and emotional context are preserved throughout the entire processing pipeline. What sets Deepgram apart is its approach to fusing the hidden states—the internal representations that capture meaning, context, and structure—of each individual function: Speech-to-Text (STT), Large Language Model (LLM), and Text-to-Speech (TTS). This fusion is the first step toward training a controllable single, true end-to-end speech model, enabling seamless processing while retaining the strengths of each best-in-class component. This breakthrough has significant implications for enterprise applications, facilitating more natural conversations while maintaining the control and reliability businesses require.

This technical advancement builds on Deepgram’s expertise in enterprise speech AI, with over 200,000 developers using its platform, more than 50,000 years of audio processed, and over 1 trillion words transcribed. Key benefits of the new architecture include:

  • Optimized latency design for faster, more responsive interactions
  • Enhanced naturalness, preserving emotional context and conversational nuances
  • Native ability to handle complex, multi-turn conversations
  • Unified, end-to-end training across the entire model, creating a more cohesive and inherently adaptive system that fine-tunes its understanding and response generation directly in the audio space

Utilizing Transfer Learning for Cost-Efficient, High-Accuracy Speech-to-Speech

Deepgram’s research in the space is accelerated by its use of transfer learning and best-in-class pre-trained models, allowing it to achieve high accuracy with significantly less training data than traditional methods. Without latent techniques, training a model at the scale needed for speech-to-speech would require over 80 billion hours of audio—more than humanity has ever recorded. However, Deepgram’s latent space embeddings and transfer learning approach achieve superior comprehension while significantly reducing costs, maintaining interpretability, and accelerating enterprise deployment. This efficiency enables Deepgram to deliver scalable, end-to-end speech AI that meets the demands of real-world voice applications.

Empowering Developers with Full Debuggability

One of the requirements in enterprise speech-to-speech modeling is the ability to understand and troubleshoot each step of the process. This is particularly challenging when text conversion between steps isn’t involved, as verifying both the accuracy of the initial perception and the alignment of the spoken output with the intended response is not straightforward. Deepgram recognized this need and addressed it by designing a new architecture that enables debuggability throughout the entire process.

This architecture allows developers to inspect and understand how the system processes spoken dialogue. The design incorporates speech modeling of perception, natural language understanding/generation, and speech production, preserving distinct capabilities during training. Through the ability to decode intermediate representations back to text at specific points, developers can gain insight into what the model perceives, thinks, and generates, ensuring its internal representation aligns with the model output and stays true to the intent of the business user, addressing hallucination concern in scaled business use cases. This capability allows the user to peer into each step throughout generation, helping refine models, improve performance, and deliver more accurate, lifelike, and reliable speech-to-speech solutions.

Beyond Speech-to-Speech – A Complete, Enterprise-Ready Voice AI Stack

While building an advanced speech-to-speech (STS) model is a major technical achievement, enterprises need more than just a model—they need a complete, scalable platform that ensures seamless deployment, adaptability, and cost efficiency. Deepgram delivers not just cutting-edge STS technology, but an enterprise-ready infrastructure designed for real-world applications.

Seamless Integration & Continuous Improvement – Once Deepgram’s end-to-end STS model moves to production, businesses will be able to adopt this breakthrough directly through our developer-friendly voice agent API from within the current Deepgram platform. Through continued innovation, enterprises will benefit from the latest advancements, ensuring seamless integration and a future-proof platform for their voice AI applications.

Enterprise-Grade Performance & Cost Efficiency – Built for low customer COGS, our platform enables enterprises to deploy high-performance voice AI without excessive costs. This ensures scalability, whether for customer service automation, real-time voice agents, or multilingual applications.

Full-Featured Platform and High-Performance Runtime – Deepgram’s platform includes powerful capabilities such as:

  • Adaptability – Dynamically fine-tune models for specific industry language, ensuring high accuracy across diverse applications without needing constant retraining.
  • Automation – Streamline transcription, model updates, and data processing, reducing overhead and accelerating deployment.
  • Synthetic data generation – Generate synthetic voice data to improve model training, even with limited real-world data, enhancing accuracy for niche use cases.
  • Data curation – Clean, manage, and organize training data to ensure high-quality, relevant input, improving model performance.
  • Model hot-swapping – Seamlessly switch between different models to optimize performance for specific tasks.
  • Integrations – Effortlessly integrate Deepgram’s voice AI with cloud platforms, enterprise systems, and third-party applications, embedding it within existing workflows.

With Deepgram, enterprises don’t just get speech-to-speech—they get the most advanced, enterprise-ready voice AI platform, designed for real-world deployment and long-term innovation.

For more information about Deepgram’s novel approach for speech-to-speech, read the technical brief. To learn more about Deepgram’s suite of voice AI infrastructure, visit www.deepgram.com.

XCSSET macOS Malware Reappears With New Attack Strategies

Posted in Commentary with tags on February 18, 2025 by itnerd

Microsoft has warned that a new variant of XCSSET malware is actively targeting macOS users. “The latest XCSSET malware features enhanced obfuscation methods, updated persistence mechanisms, and new infection strategies,”

Roger Grimes, Data-Driven Defense Evangelist at KnowBe4,commented:

“Downloading, running, or re-using any code from any repository is taking a big risk. If you download and reuse code that you yourself or someone you greatly trust did not write, you have to inspect it. This is a lesson the world has known about the threat of reusing other people’s code since the late 1970’s. In 1984, one of the co-creators of Unix, Ken Thompson, wrote a seminal paper on the trustworthiness of code titled Reflections on Trust. He summarized it by stating, “You can’t trust code that you did not totally create yourself.” He footnotes a 1974 paper on software security paper entitled Multics Security Evaluation: Vulnerability Analysis that says the same. Unfortunately, almost none of today’s programmers are taught basic ‘secure code’ skills, and hence each generation of programmers seems to have to learn the same mistakes of the past. We need all of today’s programming curriculums teaching secure coding, including the need to be wary of and inspect others’ code, and we need employers who hire programmers requesting that those programmers come with secure coding skills.”

“It’s a little ironic to see Microsoft pointing out and defending against Mac vulnerabilities and threats, especially before Apple does. But that’s testament to today’s interconnected world and the shift that Microsoft has made in better protecting the entire ecosystem.”

This is a reminder that Mac users are not immune to threats. They need to practise good computing habits such as these. Because threats like this one are starting to become more and more common on the Mac platform. Which means that you need to be on guard at all times.

Microsoft Tracks Storm-2372 Who Are Behind A Wave Of “Device Code Phishing” Attacks 

Posted in Commentary with tags on February 18, 2025 by itnerd

Researchers at Microsoft have discovered a group that has been dubbed Storm-2372 using “device code phishing” that tricks users into logging into productivity apps that allows the hackers to capture information from the log in (tokens) in order to access compromised accounts. The researchers believe this group could be aligned with Russia’s interests and tradecraft:

Today we’re sharing that Microsoft discovered cyberattacks being launched by a group we call Storm-2372, who we assess with medium confidence aligns with Russia’s interests and tradecraft. The attacks appear to have been ongoing since August 2024 and have targeted governments, NGOs, and a wide range of industries in multiple regions. The attacks use a specific phishing technique called “device code phishing” that tricks users to log into productivity apps while Storm-2372 actors capture the information from the log in (tokens) that they can use to then access compromised accounts. These tokens are part of an industry standard and, while these phishing lures used Microsoft and other apps to trick users, they do not reflect an attack unique to Microsoft nor have we found any vulnerabilities in our code base enabling this activity.

Roger Grimes, data-driven defense evangelist at KnowBe4, commented:

“The best piece of advice I can give anyone to fight phishing of any type is this: If you receive an unexpected message, no matter where received (e.g., in-person, email, browser, social media, SMS, etc.) and it is asking you to do something you’ve never done before, research it outside of the information given in the message before performing. If more people followed this advice, there would be far less successful phishing. This applies to device code phishing.”

“Device code phishing attacks aren’t new, but the use by a possible nation-state aggressor does significantly increase the risk to those targeted victims. And let’s remember that today’s most likely targeted victim is a regular person or regular company. Nation-states no longer focus on traditional nation-state targets like government or military agencies or contractors.”

“One of the most concerning aspects of this attack is the ability for the attacker to get the victim’s primary refresh token, which is a Microsoft Azure-only specialized authentication access token, which allows the attacker to access any of the involved apps the victim is using. When a traditional browser access control token is stolen, it gives the attacker access to only the involved site/service/app that the token was generated by. But the primary refresh token can be used to access any app the victim has access too. Its power is exponential.”

These are the sorts of attacks that can be mitigated if not stopped if there is more user awareness and training. Therefore I challenge organizations to go out and invest in user training as well as performing simulated attacks to that users will be less of a risk to your organization.

Xerox Printer Vulnerability Could Enable Windows Active Directory Credentials Exploit

Posted in Commentary with tags on February 18, 2025 by itnerd

Researchers have uncovered vulnerabilities in Xerox Versalink C7025 Multifunction printers (MFPs) that could have enabled pass-back attacks. This pass-back style attack leverages a vulnerability that allows a malicious actor to alter the MFP’s configuration and cause the MFP device to send authentication credentials back to the malicious actor which could have been used to capture authentication data.

You can read the details here: https://www.rapid7.com/blog/post/2025/02/14/xerox-versalink-c7025-multifunction-printer-pass-back-attack-vulnerabilities-fixed/

Martin Jartelius, CISO at Outpost24 had this comment:

“While the vulnerabilities in the Xerox VersaLink C7025 printer are important to address, they do not pose a high risk in most corporate environments, as these printers are typically not accessible from the internet. 

However, capturing authentication credentials could allow an attacker to move laterally within the organization, which becomes a concern if the network lacks proper segmentation.

The solution lies in strengthening security by restricting access to the printer’s administrative settings and ensuring the printer is configured correctly.

“The first step is to prevent unauthorized access by locking down the configuration page. Additionally, FTP and LDAP credentials both rely on plain-text protocols, which are outdated and vulnerable; even without changing any settings on the printer, a network tap could expose this information. To improve security, use authentication protocols that are inherently more secure and avoid using older protocols like FTP (defined in 1971) and LDAP (defined in 1997).

“The correct approach to mitigating these risks is universal, regardless of the printer model or software used: set a complex password for the admin account, avoid using Windows authentication accounts with elevated privileges (such as domain admin accounts for LDAP or scan-to-file SMB services), and prevent enabling the remote-control console for unauthenticated users. Implementing strong network security practices, including proper segmentation, will help protect critical systems and limit unnecessary connections between devices.” 

Regardless of the risk, any organization that has one of these printers should take a look at this to get the update that addresses this issue. And they should do so ASAP as now that this is out there, threat actors are going to use it to pwn the unsuspecting.

UPDATE: Jim Routh, Chief Trust Officer at Saviynt adds this:

“Both of the vulnerabilities identified related to administering Xerox printers and obtaining administrator credentials (CVE 2024-12510 and CVE 2024-12511) are indicative of the preference of cyber criminals today to pursue the acquisition of user credentials as the preferred method of attack on enterprises. In this case, threat actors focus on the administration of multifunction printers connected to enterprise networks that also have internet connectivity for users and administrators. In certain configurations with LDAP, user credentials to Windows Active Directory can be harvested for criminal activity. Both vulnerabilities are dependent on specific enterprise configuration settings and the potential for exploitation will vary from enterprise to enterprise. 

Reducing the need for credentials (passwordless options) is the most effective way to shrink this specific attack surface. Other methods include adjustments to configuration settings for LDAP and Windows device administration settings.”

A Browser Extension Is Now Out There To Keep Canadian Money In Canada’s Economy

Posted in Commentary with tags on February 18, 2025 by itnerd

It’s no secret that Canadians are mad about the completely unjustified tariffs imposed by Donald Trump on Canadians. That’s created a grassroots movement to keep as many Canadian dollars in Canada. To help with that, a reader tipped me off to this browser extension called Support Canadian. From the website:

Unfortunately leaving Amazon fully is difficult for many so the extension surfaces Canadian products to the top of any Amazon search you make.

And:

Visiting Walmart.ca? It suggests Canadian Tire. On Netflix? It flags CBC Gem or Crave. It has 500+ alternative websites based on some of Reddit’s largest Canadian-made lists.

And:

No tracking, no ads. I made it completely privacy-focused with no personal information requested. (You can see for yourself on the download page in the Privacy Section)

This browser extension has gained traction on Reddit and as the word gets out there, I am pretty sure that it’s going to get even more traction. You can download it here:

There’s no version for Safari currently, but I am sure that if the demand for that is there, it will come.

In my mind, this is a far more productive exercise than booing the US national anthem at hockey games because if enough people use this extension and alter their purchasing habits accordingly, then it will send a clear message that Canada will not be bullied by the US.

1.6 Million Clinical Research Records Exposed in Data Breach

Posted in Commentary with tags on February 18, 2025 by itnerd

A data breach involving DM Clinical Research — a Texas-based network of clinical trial sites — was discovered and reported to Website Planet by cybersecurity researcher Jeremiah Fowler.

What happened:

A non-password-protected database containing nearly 1.6million records was exposed. The leaked data includes PII and PHI, such as names, physical and email addresses, phone numbers, vaccine details, medical conditions, and more.

Why it matters:

The exposure of personal and medical data raises serious privacy concerns, potentially leading to identity theft, phishing attacks, extortion attempts, or unauthorized use of sensitive health information.

Read the report here: https://www.websiteplanet.com/news/dmclinicalresearch-report-breach/

Hammerspace Honored as the Top Data Storage Innovation in SiliconANGLE Media’s Tech Innovation CUBEd Awards

Posted in Commentary with tags on February 18, 2025 by itnerd

 Hammerspace today announced it has been named a winner of SiliconANGLE Media’s 2025 Tech Innovation CUBEd Awards as the “Top Data Storage Innovation.” 

The Hammerspace Global Data Platform has been honored for its groundbreaking approach to high-performance, enterprise data and storage management. In today’s landscape, where digital assets can no longer be isolated in data silos, the platform allows organizations to use existing data and infrastructure for AI/DL initiatives along with the original applications and use cases for the data.   

The Top Data Storage Innovation award recognizes the data storage solution that excels in providing robust, scalable and high-performance storage capabilities for modern enterprises as requirements for storing data evolve in the AI era or due to other factors.

The Tech Innovation CUBEd Awards recognize exceptional achievements in technological advancement, highlighting the diverse contributions of companies and individuals shaping the future of B2B and B2B2C technology. This technology awards program recognizes the most innovative companies (public, private and startups), visionary leaders and groundbreaking products that are pushing the boundaries of what’s possible. Hammerspace was selected from a competitive field of nominees by a panel of industry experts and technology leaders.

The newest update of Hammerspace’s software unlocks a new tier of storage by transforming local NVMe storage on GPU servers into a Tier 0 of ultra-fast, persistent shared storage. By activating previously “stranded” local NVMe storage seamlessly into the Hammerspace Global Data Platform, Tier 0 delivers data directly to GPUs at local NVMe speeds, unleashing this untapped potential. This breakthrough approach redefines both GPU computing performance and storage efficiency.

For more information on SiliconANGLE Media’s Tech Innovation CUBEd Awards, visit https://www.thecube.net/awards

New CompTIA CloudNetX equips IT professionals with the skills to design, manage and secure complex networks

Posted in Commentary with tags on February 18, 2025 by itnerd

A new certification to help experienced technology professionals navigate the intricate challenges of modern enterprise networks is available from CompTIA, Inc., the leading global provider of vendor-neutral information technology (IT) training and certification products.

CompTIA CloudNetX, the newest certification in the CompTIA’s Xpert Series, validates the advanced skills needed to design, engineer and integrate secure and scalable networking solutions in hybrid environments.

CompTIA CloudNetX is a vendor-neutral certification, a critical differentiator for IT professionals who work with hybrid networks and products from multiple vendors. The certification exam assesses hands-on capabilities on a range of topics, including:

  • Emerging technologies such as container networking, software-defined cloud interconnect and generative AI for automation and scripting.
  • Network security, including threats, vulnerabilities, and mitigations; identity and access management; and wireless security and appliance hardening. Zero Trust Architecture is another area of dedicated focus.
  • Analyzing business requirements to design and implement network solutions, ensuring candidates can align technical skills with organizational goals.

CompTIA CloudNetX was created for IT professionals with at least five years of experience as a systems architect, network architect, cloud network architect, infrastructure architect or enterprise architect.

Two new learning resources are available for the new certification. CertMaster Perform CloudNetX is a comprehensive eLearning resource to gain knowledge and practical experience through instructional lessons and live labs. CertMaster Labs CloudNetX offers hands-on practice and skills development through a browser-based lab environment, allowing learners to apply their knowledge in real IT environments. Both resources align with the CompTIA CloudNetX certification exam objectives. Visit https://www.comptia.org/certifications/cloudnetx for complete details.