Agregátor RSS

A Sherlock Holmes Approach to Cybersecurity: Eliminate the Impossible with Exposure Validation

The Hacker News - 29 Říjen, 2024 - 12:00
Sherlock Holmes is famous for his incredible ability to sort through mounds of information; he removes the irrelevant and exposes the hidden truth. His philosophy is plain yet brilliant: “When you have eliminated the impossible, whatever remains, however improbable, must be the truth.” Rather than following every lead, Holmes focuses on the details that are needed to move him to the solution. In
Kategorie: Hacking & Security

A Sherlock Holmes Approach to Cybersecurity: Eliminate the Impossible with Exposure Validation

The Hacker News - 29 Říjen, 2024 - 12:00
Sherlock Holmes is famous for his incredible ability to sort through mounds of information; he removes the irrelevant and exposes the hidden truth. His philosophy is plain yet brilliant: “When you have eliminated the impossible, whatever remains, however improbable, must be the truth.” Rather than following every lead, Holmes focuses on the details that are needed to move him to the solution. InThe Hacker Newshttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus

The Hacker News - 29 Říjen, 2024 - 11:59
The Dutch National Police, along with international partners, have announced the disruption of the infrastructure powering two information stealers tracked as RedLine and MetaStealer. The takedown, which took place on October 28, 2024, is the result of an international law enforcement task force codenamed Operation Magnus that involved authorities from the U.S., the U.K., Belgium, Portugal, and
Kategorie: Hacking & Security

Dutch Police Disrupt Major Info Stealers RedLine and MetaStealer in Operation Magnus

The Hacker News - 29 Říjen, 2024 - 11:59
The Dutch National Police, along with international partners, have announced the disruption of the infrastructure powering two information stealers tracked as RedLine and MetaStealer. The takedown, which took place on October 28, 2024, is the result of an international law enforcement task force codenamed Operation Magnus that involved authorities from the U.S., the U.K., Belgium, Portugal, and Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Merde! Macron's bodyguards reveal his location by sharing Strava data

The Register - Anti-Virus - 29 Říjen, 2024 - 11:32
It's not just the French president, Biden and Putin also reportedly trackable

The French equivalent of the US Secret Service may have been letting their guard down, as an investigation showed they are easily trackable via the fitness app Strava.…

Kategorie: Viry a Červi

Leave the Internet Archive alone!

Computerworld.com [Hacking News] - 29 Říjen, 2024 - 11:00

The web has been a mixed blessing for people who care about information. Yes, it’s made it easier than ever to access facts and opinions from around the globe — but it also throws out older data as quickly as it brings in new data. (And let’s not even talk about propaganda!)

One shining beacon for recording truthful and accurate records throughout the web’s history has been the Internet Archive.

The Archive was created by Brewster Kahle, who, beginning in 1980, wanted “to build a library of everything.”  His first step in that direction was creating the Internet’s first distributed search system, the Wide Area Information Server (WAIS)

When he founded the Archives in 1996, his ambitious goal was to provide “universal access to all knowledge.” Kahle and his friends have been remarkably successful. Today, the Archives holds digital copies of 44 million books and texts, 15 million audio recordings, 10.6 million videos, 4.8 million images, a million software programs, and even a copy of Computerworld from 1969. 

To do this, he created the Internet Archive and its associated projects, including the Wayback Machine, which allows users to view archived versions of more than 866 billion saved web pages, and the Open Library project, which aims to create a web page for every published book.

It’s that last project that got the Archives into legal hot water. During the COVID-19 pandemic, Kahle opened the library for free ebook borrowing via the Controlled Digital Lending (CDL) program. Publishing companies were not amused and the Internet Archive lost the resulting lawsuit, Hachette v. Internet Archive. The court rejected the Archive’s fair use defense, finding that its digital lending practices infringed on publishers’ copyrights. 

That’s a huge problem on its own. The Internet Archive is a 501(c)(3) non-profit with a gross revenue in its most recent 990 filing of only $30.5 million. For the size of the job it’s undertaken, it’s grossly underfinanced. 

Recently, though, adding insult to injury, the Archive has been subjected to one cyber-attack after another.The first major incident occurred Oct. 9-10 and involved two simultaneous attacks: First, hackers exploited a GitLab token, compromising the Archive’s source code and stealing user data from 31 million accounts. Concurrently, a pro-Palestinian group called SN BlackMeta launched a Distributed Denial of Service (DDoS) attack, temporarily knocking the site — and the Wayback Machine — offline.

Blackmeta said it hit the site because it belongs to the United States, which supports Israel in the ongoing Palestine-Israel conflict. Uhm, no, no it doesn’t. The only cause the Internet Archive espouses is freedom of information, and it has no connection with the US government. 

Maybe it should. I could argue that the National Archives and Records Administration (NARA) should track the public web, but it doesn’t. 

Then, on Oct. 20, the Internet Archive suffered yet another security breach: This time, hackers exploited unrotated Zendesk, the help desk support program’s application programming interface (API) tokens, to access the Archive’s support platform. 

The results have been one mess after another. Many of the Archive’s services, including the Wayback Machine, have gone dark. In addition, people are worried that some of the data stored by the Archive has been deleted or compromised. 

Operators managed to get the site back up, and a few days ago, Kahle told CBC Radio, “It’s just so sad. It’s great to be back up, and we have millions of people now accessing the site again.” 

That didn’t last. Since then, it’s been hammered yet again!

Enough already — crashing the Internet Archive won’t make a lick of difference to the world’s geopolitical problems. No one will get rich from ripping off the Internet Archive users. There is no point in messing with the Archive. None!

The Archive is a useful library. That’s it. That’s all. And that’s enough.  

In particular, the Archive keeps the only real records of what’s been on the Web. As we put more of our records and news on the Web and nowhere else, that’s vitally important for historians and other people who appreciate knowing who said what to whom and when. 

The Archive needs to be preserved, not vandalized. I’m reminded of the dim-minded protestors whose big idea was to throw pumpkin soup on the Mona Lisa. Quick! What were they protesting?  

You don’t know, do you? 

It was about the right to healthy, sustainable food.

That attack made no difference whatsoever. 

Vandalism, whether on a politically neutral, useful website or on world-famous art, is not helpful; it’s only harmful. And, in the Internet Archive’s case, it’s also pointless. 

More by Steven J. Vaughan-Nichols:

>

>
Kategorie: Hacking & Security

Meta, Apple say the quiet part out loud: The genAI emperor has no clothes

Computerworld.com [Hacking News] - 29 Říjen, 2024 - 11:00

Amidst the mountains of vendor cheerleading for generative AI efforts, often amplified by enterprise board members, skeptical CIOs tend to feel outnumbered. But their cynical worries may now have some company, in the form of a report from Apple and an interview from Meta — both of which raise serious questions about whether genAI can actually do much of what its backers claim.

The debate involves some fairly amorphous terms, at least when spoken in a computing environment context — things like reasoning and logic. When a large language model (LLM), for example, proposes a different and ostensibly better way to do something, is it because its sophisticated algorithm has figured out a better way? Or is it just wildly guessing, and sometimes it gets lucky? Or did it hallucinate something and accidentally say something helpful?

Would a CIO ever trust a human employee with such tendencies? Not likely, but IT leaders are regularly tasked with integrating genAI tools into the enterprise environment by corporate executives expecting miracles.

   

The conclusions drawn by AI experts from Apple and Meta may help CIOs set more realistic expectations about what genAI models can and cannot do, now and in the near future.

GenAI is not that intelligent

The Apple report, which was the more detailed research effort, is also the more damning of the two. Its authors stated:

“Our findings reveal that LLMs exhibit noticeable variance when responding to different instantiations of the same question. Specifically, the performance of all models declines when only the numerical values in the question are altered.

“Furthermore, we investigate the fragility of mathematical reasoning in these models and demonstrate that their performance significantly deteriorates as the number of clauses in a question increases… When we add a single clause that appears relevant to the question, we observe significant performance drops (up to 65%) across all state-of-the-art models, even though the added clause does not contribute to the reasoning chain needed to reach the final answer.”

What does mathematical reasoning have to do with AI-powered business applications? The Apple research team spelled it out:

“Mathematical reasoning is a crucial cognitive skill that supports problem-solving in numerous scientific and practical applications. Consequently, the ability of large language models (LLMs) to effectively perform mathematical reasoning tasks is key to advancing artificial intelligence and its real-world applications.”

What today’s state-of-the-art LLMs do is not logical reasoning, the researchers concluded:

“Current LLMs are not capable of genuine logical reasoning; instead, they attempt to replicate the reasoning steps observed in their training data… It may resemble sophisticated pattern matching more than true logical reasoning.”

Meta’s analysis comes by way of an interview with The Wall Street Journal featuring AI legend Yann LeCun, who today serves as the chief AI scientist at Meta. In the story, LeCun called the notion that AI will soon become advanced enough to pose a threat to humanity “complete B.S.” Like the Apple researchers, he said AI is a powerful tool but not truly intelligent, according to interviewer Christopher Mims:

“When a departing OpenAI researcher in May talked up the need to learn how to control ultra-intelligent AI, LeCun pounced. ‘It seems to me that before “urgently figuring out how to control AI systems much smarter than us,” we need to have the beginning of a hint of a design for a system smarter than a house cat,’ he replied on X.

“He likes the cat metaphor. Felines, after all, have a mental model of the physical world, persistent memory, some reasoning ability and a capacity for planning, he says. None of these qualities are present in today’s ‘frontier’ AIs, including those made by Meta itself.”

Later, the WSJ story lets LeCun make his central point:

“Today’s models are really just predicting the next word in a text, he says. But they’re so good at this that they fool us. And because of their enormous memory capacity, they can seem to be reasoning, when in fact they’re merely regurgitating information they’ve already been trained on.

“‘We are used to the idea that people or entities that can express themselves, or manipulate language, are smart — but that’s not true,’ says LeCun. ‘You can manipulate language and not be smart, and that’s basically what LLMs are demonstrating.’”

That is the key issue. Enterprises are putting far too much faith in genAI systems, says Francesco Perticarari, general partner at technology investment house Silicon Roundabout Ventures in London, England.

It’s easy to assume that the rare correct answers given by these tools are flashes of brilliance, rather than the genAI having gotten a lucky guess. But “the output is not based at all on reasoning. It is merely based on extremely powerful computing,” Perticarari said. 

Putting genAI in the driver’s seat

One frequently cited selling point for genAI is that some models have proven quite effective at passing various state bar exams. But those bar exams are ideal environments for genAI, because the answers are all published. Memorizations and regurgitation are ideal uses for genAI, but that doesn’t mean genAI tools have the skills, understanding, and intuition to practice law.

“The logic is that if genAI can pass the bar exam, it can handle my business, build systems that are robust and that work now,” said Alan Nichol, co-founder and CTO of AI vendor Rasa. “[Business leaders] are taking this dangerous, naive approach and just letting the LLM figure it out,” he said.

Nichol pointed to Apple’s analysis that the more complex and multilayered math problems got, the more the LLMs got lost and confused. 

“It’s supposed to understand this math, but something is definitely fishy. The medium through which they are doing [these calculations] is natural language. It’s fuzzy and imprecise,” he said. “Language models were never supposed to do a lot of these things. There are vanishingly few situations where you want your software to guess what it should be doing, what the next few steps should be.”

Nichol stressed that these systems, left to their own devices, are reckless. “Four out of five times, genAI doesn’t follow its own instructions,” he said. “You want it to guess business logic? It just doesn’t work and is extremely slow and consumes a tremendous amount of tokens.”

Perticarari from Silicon Roundabout Ventures is especially concerned about hallucinations coupled with the lack of meaningful guardrails. GenAI seems to easily overcome — or be tricked by a user into overcoming — many of the safeguards organizations attempt to place around it.

“If you have a one-year-old, you wouldn’t give her a loaded gun and then try and explain to her why she shouldn’t shoot you,” Perticarari said. “[GenAI is] not sentient. Humans are sentient and they assume the system is intelligent, too. Letting genAI run on autopilot to me is crazy. Don’t give anything to a black box.”

Fighting FOMO

Perticarari blames enterprise executives and board members for falling victim to countless AI sales pitches. He says that CIOs have to be the voice of sanity.

“It is always easy during a gold rush to sell hype. [Sales execs] just keep delivering endless layers of selling without really understanding,” Perticarari said. “CIOs need to ask, ‘How fundamental and vital is the task that [we] are outsourcing to genAI?’”

Jake Reynolds, the CTO at cybersecurity vendor Wirespeed, agrees. He maintains that a lot of the rush to genAI has been pushed by board members, and “the CIO had to tag along.”

Executives are giving in to FOMO (fear of missing out), thinking that “their largest competitor is doing it, so we are going to do it,” he said. “But it doesn’t deliver. Even with the more objective mathematics, it starts falling apart. Try to get consistency out of it. You can’t. The words it predicts changes every time you tweak a little knob… Are you really OK with your product only working 80% of the time?”

Reynolds encourages CIOs to slow down and be as minimalistic as practical. “We’re not laggards. We’re just realists about what the technology can really do,” he said. 

Judicious use of genAI tools can mitigate disappointment or worse, agrees Nichol. “We should just let the LLMs do what the LLMs are amazing at. Don’t let the LLM do everything.”

Kategorie: Hacking & Security

US finalizes curbs on investment in AI and critical technology in China

Computerworld.com [Hacking News] - 29 Říjen, 2024 - 10:45

The US government has announced new rules restricting investments in China’s AI and other tech sectors deemed threats to national security, expanding the existing restrictions that were so far limited to exports.

First introduced by the US Treasury in June, the rules are based on an executive order signed by President Joe Biden in August 2023.

They focus on three critical areas: semiconductors and microelectronics, quantum information technologies, and certain AI systems.

“This narrow set of technologies is core to the next generation of military, cybersecurity, surveillance, and intelligence applications,” the Treasury said in a statement.

The US already restricts or bans the export of many technologies covered by the new rules to certain countries. The new program complements existing export controls and inbound screening measures by blocking US investments from aiding the development of sensitive technologies in countries of concern, the Treasury added.

Fueling the trade war

This marks the latest development in the ongoing trade war between the US and China, which has already witnessed numerous restrictions.

Analysts are skeptical of the policy’s impact, cautioning that it may further intensify tensions and stifle innovation and growth.

“The scope of restrictions is now expanding beyond the sale of technology IP or chips to include investments in the Chinese tech sector,” said Neil Shah, VP of research and partner at Counterpoint Research. “This move aims to stifle Chinese tech companies on both fronts — limiting financial and technology inflows. Unfortunately, this will make it difficult for Chinese companies to innovate quickly and will further intensify the geopolitical tech cold war.”

This also means that if China retaliates — while protecting its own manufacturing ecosystem — it could affect large and small tech companies that still rely on China as a key market.

In a related move earlier this month, a Chinese industry body called for a security review of Intel’s products, signaling heightened scrutiny of US tech firms operating in the country.

Reports indicate, however, that trade restrictions have had a limited effect on slowing Chinese chip manufacturing as China continues to stockpile chipmaking equipment. There are also loopholes in the restrictions that Chinese companies are able to take advantage of.  

Impact on enterprises

Restrictions could stifle collaboration and knowledge exchange between nations, potentially slowing innovation by reducing opportunities to work on advanced projects.

“Companies might also need to reassess their strategic priorities, which may lead to an unnecessary increase in innovation costs,” said Charlie Dai, VP and principal analyst at Forrester. “On the other hand, regulatory concerns will force enterprises outside the US to further prioritize localization strategies to achieve self-sufficiency in critical areas, potentially leading to increasingly isolated innovation ecosystems.”

The new rules may also require US enterprises to closely monitor both domestic and international regulatory shifts and establish agile compliance programs to adapt swiftly to evolving requirements.

“These constraints can also diminish R&D investments and have profound long-term economic effects, stifling advancement in pivotal sectors like semiconductors, quantum computing, and AI, ultimately hampering overall technological progress,” said Thomas George, president of Cybermedia Research.

Opportunity for emerging markets

For other emerging markets, however, the tightened US restrictions could present new opportunities by attracting redirected foreign investments from US firms.

“As trade tensions rise and new regulations emerge, US companies increasingly move away from Chinese manufacturing,” said George. “Instead, they want to collaborate with countries such as India, Mexico, and Vietnam. This shift is crucial as it enhances companies’ resilience and allows them to navigate new US export controls more effectively.”

Companies should reduce dependency on any single country by diversifying supply chains to mitigate risks associated with regulatory changes in specific regions, according to Dai.

“Engaging with research and advisory firms can help them better understand the potential impact of various regulatory changes, prepare contingency plans, and develop strategies to assess and mitigate risks,” Dai said.

Kategorie: Hacking & Security

Test kombinovaného vysavače Roomba Combo 10 Max. Vypere si mop a nemusíte se o něj měsíc starat

Živě.cz - 29 Říjen, 2024 - 10:45
** Díky praní mopu jde o první zcela samostatnou Roombu pro suchý i mokrý úklid ** Mopovací hadřík po úklidu nejen vypere, ale i vysuší ** Aplikaci v češtině zvládne ovládat i vaše babička
Kategorie: IT News

GeekBench na Ryzen 7 9800X3D: Jednojádrově nad 9700X, vícejádrově blízko 7950X

CD-R server - 29 Říjen, 2024 - 10:00
Nové výsledky, které pocházejí z finální hardwarové / softwarové konfigurace Ryzen 7 9800X3D, staví výkon tohoto procesoru o trochu výš než starší úniky. Vícejádrově dokonce blízko 16 jádrům Zen 4…
Kategorie: IT News

V Německu už mohly létat elektrické taxíky. Nadějný startup Lilium je však před bankrotem

Živě.cz - 29 Říjen, 2024 - 09:45
V květnu roku 2019 jsme na Živě.cz informovali o německém startupu Lilium, který chtěl do šesti let přijít na trh s létajícími taxíky, jenž si zákazníci budou moci objednávat z aplikace v chytrém telefonu. Firma založená v roce 2015 měla ambiciózní plán – stát se lídrem v oblasti městské letecké ...
Kategorie: IT News

Five Eyes nations tell tech startups to take infosec seriously. Again

The Register - Anti-Virus - 29 Říjen, 2024 - 09:29
Only took 'em a year to dish up some scary travel advice, and a Secure Innovation … Placemat?

Cyber security agencies from the Five Eyes nations have delivered on a promise to offer tech startups more guidance on how to stay secure.…

Kategorie: Viry a Červi

iMac s čipem M4 je rychlejší a má kameru, která z vás nespustí oči. A konečně i 16 GB RAM v základu

Živě.cz - 29 Říjen, 2024 - 08:45
Apple včera odpoledne představil první ze tří nových počítačů postavených na čipech M4. Uživatelé se dočkali oživeného iMacu, který se sice na první pohled neliší od předchůdce (nepočítáme-li trochu jiné barevné odstíny), ale má několik užitečných novinek. [********************] ...
Kategorie: IT News

U.S. Government Issues New TLP Guidance for Cross-Sector Threat Intelligence Sharing

The Hacker News - 29 Říjen, 2024 - 08:36
The U.S. government (USG) has issued new guidance governing the use of the Traffic Light Protocol (TLP) to handle threat intelligence information shared between the private sector, individual researchers, and Federal Departments and Agencies. "The USG follows TLP markings on cybersecurity information voluntarily shared by an individual, company, or other any organization, when not in conflict
Kategorie: Hacking & Security

U.S. Government Issues New TLP Guidance for Cross-Sector Threat Intelligence Sharing

The Hacker News - 29 Říjen, 2024 - 08:36
The U.S. government (USG) has issued new guidance governing the use of the Traffic Light Protocol (TLP) to handle threat intelligence information shared between the private sector, individual researchers, and Federal Departments and Agencies. "The USG follows TLP markings on cybersecurity information voluntarily shared by an individual, company, or other any organization, when not in conflict Ravie Lakshmananhttp://www.blogger.com/profile/[email protected]
Kategorie: Hacking & Security

Znovu jsme hráli Grand Theft Auto: San Andreas. Gangsterka, kterou ani ledajaká novinka nepřekoná

Živě.cz - 29 Říjen, 2024 - 08:15
Ah shit, here we go again. Po 20 letech.
Kategorie: IT News

Digitální sledování zaměstnanců. Vede k vyšší efektivitě, ale také ke stresu a nedůvěře

Živě.cz - 29 Říjen, 2024 - 07:45
** Digitální sledování zaměstnanců od pandemie vzrostlo ** Někteří jsou motivovaní, jiní zažívají stres ** Firmy by měly balancovat mezi kontrolou a důvěrou
Kategorie: IT News

Ex-úřednice ministerstva: Intel postaví jen prázdnou továrnu, nemá zákazníky

CD-R server - 29 Říjen, 2024 - 07:40
Ministerstvo nevyplatilo Intelu $8,5 miliardy z dotace CHIPS Act a CEO společnosti Pat Gelsinger začíná být nervózní a vyzývá k dokončení transakce. Ex-úřednice ministerstva vysvětluje důvody…
Kategorie: IT News

Wanted. Top infosec pros willing to defend Britain on shabby salaries

The Register - Anti-Virus - 29 Říjen, 2024 - 07:26
GCHQ job ads seek top talent with bottom-end pay packets

While the wages paid by governments seldom match those available in the private sector, it appears that the UK's intelligence, security and cyber agency is a long way short of being competitive in its quest for talent.…

Kategorie: Viry a Červi
Syndikovat obsah