The IT Nerd

Since Apple released AirTags, there’s been a glaring hole in terms of how they can be used. Which is that if you’re on Team Android, there is no way for you to detect them unlike those who are on Team iPhone. Today that changes. What Google refers to as “Unknown tracker alerts” is rolling out to Android phones that are running Android 6 or higher. A Google blog post details what this covers. There’s also a video that covers this as well:

This functionality doesn’t require a separate app and will hit your phone sometime this month.

A critical design flaw in the Google Cloud Build service discovered by Orca Security can let attackers escalate privileges, providing them with practically full, unauthorized access to Google Artifact Registry code repositories.

Dubbed Bad.Build, the flaw could permit attackers to infiltrate a Google Cloud Build account to run API calls against the artifact registry and take control over application images allowing them to inject malicious code, resulting in vulnerable applications and supply chain attacks.

• “The first and immediate impact is disrupting the applications relying on these images. This can lead to DOS, data theft and spreading malware to users.
• “As we have seen with the SolarWinds and recent 3CX and MOVEit supply chain attacks, this can have far reaching consequences,” said Orca security researcher Roi Nisimi.

The Google Security Team implemented a partial fix after Orca reported the issue by revoking the logging.privateLogEntries.list permission from the default Cloud Build Service Account, which is unrelated to Artifact Registry.

• “[…] Google’s fix doesn’t revoke the discovered Privilege Escalation vector. It only limits it – turning it into a design flaw that still leaves organizations vulnerable to the larger supply chain risk,” Nisimi said. 

Dave Ratner, CEO, HYAS had this comment:  

“Bad.Build is another example of what seems like a growing number of supply chain attacks.  These can be incredibly difficult to detect, and equally valuable for attackers to quickly spread across multiple organizations.    

“A Protective DNS strategy, deployed across both the corporate and production environments, or wherever the cloud is utilized, can be the early warning signal that anomalous activity is occurring, and can provide the visibility and observability required to implement a business resiliency strategy not just against Bad.Build but against the inevitable supply chain attacks that will follow.”

Hopefully Google does a full fix of this because this a pretty bad vulnerability.

Today, Google Canada announced that applications are open for the 2023 Code Next Connect program. Code Next is a virtual computer science training program for high school students in the United States and Canada, giving them the tools they need to succeed in tech roles. 2023 is the first year the program is open to Canadian students. 

Since 2018, Google Canada has been working with school boards, educators and students from across Canada to deliver computer science (CS) programming in the classroom. Its mission is to educate and engage students, particularly marginalized students and those with barriers to access in computer science, as a catalyst to empower the future of learning and work.

In just under five years, Google Canada has reached hundreds of thousands of Canadian students with its CS programming, and this year it’s expanding its offerings to reach even more students with the launch of Code Next Connect. The virtual computer science education program helps Black, Indigenous, Latinx and women-identifying high school students develop skills and tech social capital needed to pursue high-achieving careers in tech. 

Code Next Connect is best suited for students in grades 9 and 10, and focuses on building critical skills in computational thinking, engineering and leadership. Students also receive mentorship opportunities from Google engineers, and deep-dives in career opportunities.

You can find more information about Code Next Connect here, and interested applicants can apply here until August 5. The program launches in October 2023  and runs until June 2024.

Today, Google revealed the 12 cloud-native startups that have been selected to participate in its inaugural North American Google for Startups Accelerator: Cloud program, involving startups from both the U.S. and Canada. Excited to share that two Canadian startups, Toronto-based healthcare startup, Oncoustics and Vancouver-based animal care startup, OneCup AI will join ten other cloud-native startups as part of the 2023 accelerator program.

This 10-week virtual accelerator is designed to prepare for the next phase of their growth journey. Participating startups will learn from the best of Google’s programs, products, people and technology, through cloud-focused deep dives and workshops on product design and customer acquisition, along with technical project support and leadership development for startup founders. 

The complete list of 2023 startups selected from across Canada and the U.S., along with a brief description of each, is below. 

• Aiden Automotive (San Ramon, CA): Aiden is the first software solution to provide streaming 2-way communication directly with the vehicle and across vehicle brands. Aiden provides simple and intuitive 100% GDPR and CCPA compliant consent management, enabling car owners to choose which digital services they desire.
• Binarly (Santa Monica, CA): Binarly’s agentless, enterprise-class AI-powered firmware security platform helps protect from advanced threats below the operating system. The company’s technology solves firmware supply chain security problems by identifying vulnerabilities, malicious firmware modifications and providing firmware SBOM visibility without access to the source code. Binarly’s cloud-agnostic solutions give enterprise security teams actionable insights, and reduce the cost and time to respond to security incidents.
• Duality.ai (San Mateo, CA): Duality AI is an augmented digital twin platform that provides end-to-end workflows for predictive simulation and high fidelity visualization. The platform helps close data gaps for machine learning teams working on perception problems and helps robotics teams speed up design and validation of their autonomy software.
• HalloAI (Provo, UT): Hallo is an AI-powered language learning platform for speaking. Press a button and start speaking any language with an AI teacher in 3 seconds.
• Harmonic Discovery (New York, NY): Harmonic Discovery uses machine learning to design multi-targeted kinase drugs for cancer and autoimmune diseases.
• MLtwist (Santa Clara, CA): MLtwist helps you bring your AI to the world faster. We give data scientists and ML engineers access to the easiest and best way to get out of the weeds of data pipelines and back to what they enjoy and do best – design, build, and deploy AI.
• Oncoustics (Toronto, ON): Oncoustics is creating advanced solutions for low-cost and non-invasive surveillance, diagnostics, and treatment monitoring of diseases with high unmet clinical need through the use of patented AI-based solutions running on ultrasound scans. Using a handheld point of care ultrasound, Oncoustics’ first solution allows clinicians to obtain a liver health assessment within 5 minutes.
• OneCup AI (Vancouver, BC): OneCup uses Computer vision for Animal Care. Our AI, BETSY, is the eyes of the rancher when the rancher is away.
• Passio AI (Menlo Park, CA): Passio AI is a mobile AI platform that helps developers and companies build mobile applications powered by expert-level AI and computer vision
• RealKey (San Francisco, CA): RealKey is the first collaboration platform for finance (starting with mortgages), automating documentation collection/review, tasks, and communication for all parties (not just borrowers) involved in transactions to reduce time, effort, and costs to close.
• Sevco Security Inc. (Austin, TX): Sevco Security a leading IT asset visibility and cybersecurity company, that provides the industry’s first unified asset intelligence platform designed to address the new extended attack surface and create a trusted data repository of all devices, users and applications an organization uses.
• VESSL AI (San Jose, CA): VESSL is an end-to-end MLOps platform aiming to be the next Snowflake for AI. The platform enables MLEs to run ML workloads at any scale on any cloud, such as AWS, Google Cloud Platform, Oracle Cloud, and on-premises.

The full blog post is here.

Google Cloud’s latest blog post highlights the six ways Gmail users can use AI features to help save time and improve their workflow in their day-to-day. Both your work and social life can be filled with to-dos, so why not use AI to help with something like Gmail to keep the day interesting and productive? 

Along with the new “Help me write” feature in Gmail to help users in Workspace Labs make composing emails easier than ever, Gmail users have a number of access to a host of other AI-powered features — and have, in some cases, for years.

Below are some of the AI-powered features you may not know you have:

• “Help me write” can create entire email drafts for you based on simple prompts.
• Smart Compose is great to use when you aren’t looking for help writing an email draft from scratch, but you’d still love some suggestions along the way.
• Smart Reply to help generate up to three possible responses to emails you receive, in just two clicks.
• Tabbed inbox to make your inbox easier to navigate – not a maze of clutter to dig through. 
• Summary cards for those moments when you get a message with a lot of information, and just want the highlights. 
• And last but not least, Nudging, which reminds you to reply to or follow up on important messages, and is the first Gmail AI feature that runs on both emails you have received and sent. 

You can find the blog here.

Today, Google Canada announced the opening of applications for both the 2023 Google for Startups Accelerator: Black Founders and Women Founders programs. Committed to leveling the playing field for all founders in North America, this marks the fourth year both programs are open to startups in the U.S. and Canada.

As advancements in AI and machine learning prompt tech startups to grow, underrepresented founders continue to encounter disproportionate structural barriers – like lack of access to capital and support networks- preventing  opportunities to launch or scale their startups. In fact, studies have shown that: 

• In 2022, companies founded solely by women garnered just 2.1% of the total capital invested in venture-backed startups in the United States (source).
• In 2022, only 2% of venture capital funding raised in North America went to Black-led founders. More than 76% of Black Canadian founders surveyed believe their race is a barrier to success (source).

As part of its commitment to support  underrepresented founders, the Google for Startups Accelerator is excited to open applications for the 2023 Google for Startups Accelerator: Women Founders and Google for Startups Accelerator: Black Founders cohorts.  Twelve startups from U.S. and Canada will be selected to participate in each accelerator program. These virtual accelerator programs are equity-free, three-month intensive bootcamps, giving founders the tools they need to prepare for the next phase of their growth journey.  

You can learn more about the 2023 cohort of the Google for Startups Accelerator program for both Black Founders and Women Founders programs in their blog post. I’ve also provided a quote from Iran Karimian, Startup Ecosystem Lead for Google Canada if you prefer. Applications for the Google for Startups Accelerator Black Founders and Women Founders programs are now open to startups across all sectors until July 25 and August 2, respectively.

Today Google Cloud made several announcements about how it is helping organizations get started with generative AI. Here are the highlights below:

• New generative AI consulting services & resources, including high-touch trainings for executives, on-demand learning programs and industry use case blueprints. 
• New customers leveraging Google Cloud’s generative AI technologies including Priceline, Mayo Clinic, GA Telesis and PhotoRoom.
• New innovations with Google Cloud partners including Datastax, Neo4j, Twilio, and Typeface. 
• General availability of Generative AI support in Vertex AI, our machine learning development platform.
• Pre-order availability of Duet AI for Google Workspace Enterprise, which embeds the power of generative AI across Workspace to help people write, visualize, organize, accelerate workflows, have richer meetings, and much more.

Today, Google Cloud announced the availability of passkey technology in Google Workspace and Google Cloud in an open beta, making it the first major cloud provider to bring passkeys to enterprise and public sector organizations. This will enable more than 9 million organizations to use passkeys instead of passwords.

Google has a blog post on this that you can find here. 

In early May, Google announced passkey availability for consumers. Beyond dramatically boosting security, passkeys might finally replace the password for good, making life easier for employees everywhere and their IT teams.

Additional announcement highlights include: 

• Google data (March – April 2023) shows that passkeys are 2x faster and 4x less error prone than passwords, and are also more secure than SMS, app-based one-time passwords, and other forms of traditional two-factor authentication (2FA).
• Passkeys can dramatically reduce the impact of phishing attacks, password fatigue, and other social engineering cyber attacks.  
• Snap Inc. has already leveraged passkeys to help reduce the burden of password management and strengthen security for their employees. 

Today, during Google’s annual Google Marketing Live, Google executives showcased the latest product innovations across Google Ads and Commerce to help businesses thrive. You can view the event here:

Google’s latest AI-powered marketing solutions include:

• A new conversational experience in Google Ads + updates to automatically created assets that make it even easier to create and scale campaigns
• Generative AI in Performance Max for creating cross-channel, rich creatives in just a few clicks
• Product Studio to easily create unique and tailored product imagery for free
• New ad format experiments coming to Search Generative Experience in Search Labs

Read about these and more on their Keyword blog:

• Introducing a new era of AI-powered ads with Google by Jerry Dischler, VP and GM of Ads, Google
• New tools to help small businesses connect with online shoppers by Matt Madrigal, VP/GM, Merchant Shopping

Google announced a new security feature that will allow all US Gmail users to be able to use Google’s dark web report to discover if their email address has been found on the dark web and also take action with guidance provided by Google, such as turning on two-step authentication.

Originally only available to Google One plans, all Gmail accounts will now be regularly reminded to check if their email has been linked to any data breaches that ended up on nefarious cybercrime forums.

“And if any matching info is found on the dark web, we’ll notify you and provide guidance on how you might protect that information,” said Google One Director of Product Management Esteban Kozak.

Google also announced that it upgraded the Safe Browsing service on Chrome and Android to catch and block 25% more phishing attempts, and that Google added a new spam view in Google Drive.

Roy Akerman, Co-Founder & CEO, Rezonate had this to say:

   “Google’s extension of its dark web report beyond Google One plans is a step in the right direction and part of Google’s responsibility in the ecosystem. This will reduce compromised accounts and further fraudulent attempts against businesses who’s corporate’s credentials were compromised. However, we seen with Google One existing customers, they may be aware their information is available in the dark web, yet no action is taken. Knowing is not enough, action must be taken to understand the potential risk and account changes must be put in place.”

I’ve always argued that if you give users the tools to protect themselves, and more importantly educate them on how to use those tools, that will help users to become more secure. Google has got the part right these tools existing mostly right as this needs to go beyond US users. But I hope Google really pushes to promote this so as to make sure that as many people as possible know these tools exist and how to use them. Because a single announcement won’t do.