Search This Blog

Powered by Blogger.

Blog Archive

Labels

Footer About

Footer About

Labels

Security is Clearview’s top priority?


Clearview AI an American technology company was, as of late breached as hackers figured out how to exploit a security flaw and 'make-off' its whole client list. Despite the fact that there's a lot of reason of concern, the specific nature and source of the breach remain unknown as of now. The company anyway has emphasized over and over that it has already patched the vulnerability and insists its that servers were not accessed. 

The facial recognition software company has made claims, that not exclusively does its clientele incorporates many police stations, but it purportedly services the FBI and DHS and said that they are exclusively working with law enforcement agencies. 

The Daily Beast's Betsy Swan originally investigated the breach. In the wake of assessing the documents from Clearview AI staff they wrote: 

Clearview AI disclosed to its customers that an intruder “gained unauthorized access” to its list of customers, to the number of users accounts those customers had set up, and to the number of searches its customers have conducted. 

The breach, however, isn't the main issue Clearview AI has to deal with currently. It's additionally entangled in a standoff with an alliance of tech titans hell-bent on seeing it shutdown. The contention comes from the company's utilization of "publicly available" images of peoples from the internet to compile its database. 

Supposedly, Clearview has billions of images in its database of simply peoples' faces. It assembles these images by utilizing a "crawler" AI to scour websites like Facebook, Twitter, and Google Image Search for each accessible picture. At that point, it coordinates the faces with whatever data it can discover on the internet and gives law enforcement access in a convenient application. 

Up until now, the company's gotten cease and desist letters from Microsoft, Google, Venmo, and Twitter. While it's very vague precisely what legitimate response Clearview has now, it seems like it might be going towards a court confrontation like HiQ v. LinkedIn.

Are your rewards and loyalty points getting less? You might want to take a look!


The universe is lazy, everything that occurs follows the principle of least action. It should be no surprise that living things have evolved to obtain the most benefit for the least work; consider the intersection of intelligence and energy. And the same is true for humans, we are inherently lazy - choosing the path of least resistance. No matter the work, we will choose the shortest, most easy and least time-consuming way to do it. No matter the path, we will take the most direct and simplest route.

The same could be said for the cyber world wizards, the hackers who would take the easiest path to hack and earn and hence have chosen a new way to earn and steal - "Loyalty Points".


Loyalty Points 

Digital Banking systems nowadays is as safe and impenetrable as their physical counterparts and require planning, knowledge and a load of luck to hack. And when there are easily accessible, far less secure targets like Loyalty Points, then why do so much work?

 Loyalty Points and schemes are rewards given to customers that they can swap for goods and offers much like currency. Since these are less secure, easy to steal our lazy hackers are now attacking these points instead of the highly secure bank accounts and vaults.

Need to be taken seriously

Andy Still, CTO Netacea writes for Infosecurity Group Website, "People don’t treat loyalty points in the same way as they treat other financial products. When our wallet or purse is stolen or lost, we immediately cancel our credit and debit cards. Our loyalty cards can wait. Retailers tend to treat loyalty points in the same way—logging into an account doesn’t have the same level of security, and two-factor authentication is rare."

People are often careless with their reward accounts, they leave it for months before they check it and the theft goes unnoticed. There's also a benefit that the stolen points will be refunded. In this scam, both the businesses and the customers are affected. The customer doesn't get the benefit of loyalty points nor does the business get what they want- repeat business, customer loyalty and branding. Business needs to take their loyalty points scheme like bank accounts and ask their customers to do the same.

Police found Ukrainian hackers who insulted Greta Thunberg in Odessa


Attackers broke into the terminal of the Odessa airport and scolded the eco-activist.
Law enforcement authorities in Odessa (Ukraine) said that they found the hackers of the Odessa airport information system, who posted pictures with insulting or obscene language on the organization’s scoreboard against eco-activist Greta Thunberg.

According to police, on February 25, officers with the support of the special forces unit of the National Police of Ukraine searched the houses of the participants and founders of the Ukrainian Cyber Alliance public organization. The search was authorized by a decision of the Odessa court. The seized equipment was sent for examination. Law enforcement officers opened a criminal case on the fact of unauthorized interference in the work of the Odessa terminal. The attackers face imprisonment for a term of three to six years.

Ukrainian Cyber Alliance associates such actions of the National Police of Ukraine with political pressure on its activists.

It is worth noting that the Ukrainian Cyber Alliance is a community of Ukrainian cyber-activists that emerged in the spring of 2016 from the Association of two groups of cyber-activists FalconsFlame and Trinity. Later, a group of cyber activists RUH8 and individual cyber-activists of the CyberHunta group joined the Alliance.

The fact of hacking the Odessa airport information system occurred in October last year. At that time, a new terminal was installed in the renovated hall of the Odessa airport. Hackers posted a photo of the Swedish eco-activist with the inscription "F*** you, Greta" on the new terminal.

Recall that Time magazine awarded 16-year-old Swedish eco-activist Greta Thunberg the title of "Person of the Year". She began her fight for ecology in the late summer of 2018. Every Friday, the girl went on a single picket near the walls of the Swedish Parliament with a poster "School strike for climate", and a year later, similar pickets were staged around the world.

WhatsApp and Telegram Group Links Leaked Online



A security researcher recently discovered that a lot of WhatsApp and Telegram Group invite links that may not be up for public viewing are appearing in multiple search engines like on Google, Yahoo, Yandex, and Bing.

On Friday, researcher Jordan Wildon, a multimedia journalist at Deutsche Welle warned that owing to a critical issue, several illegal groups and activities along with genuine private groups were exposed.

In the light of the leak, various security measures have been taken by both the companies, however, to erase the links from public searches completely so that they are no longer discoverable by people to join will require much more efforts.

This critical flaw not only abused the privacy of the aforementioned messaging apps by exposing around 450,000 groups online but also allowed data mining as the phone numbers were made available directly.

Notably, these messager apps' invite links have been indexed by several search engines. Due to this indexing feature, WhatsApp and Telegram group invite links are also being displayed publicly by these search engines and the visibility increased the reach even further. Two major happenings took place due to these leaked links – Unwanted and uninvited people joined various groups through the invite links and it also paved an easy path for hackers to discover other conversations through brute force attacks.

While addressing the issue, WhatsApp has seemingly removed the invite links for groups from Google and the company also took other steps in order to prevent indexing.

Wildon took to Twitter to provide updates, "JUST IN: Google appears to have removed indexing of WhatsApp links. Other major search engines appear to still be indexing chat links."

"UPDATE: This has been fixed on Google, but results are still available elsewhere. If you’re concerned, I’d recommend going into group settings, tapping “Invite to Group via Link” then “Reset link”. he tweeted.

Making Self-driven Vehicles a Reality!


To make self-driving vehicles a reality and to bring them on roads, they need to be able to safely and flawlessly navigate traffic without collisions or jams. Northwestern University researchers have made this possible by developing the first decentralized algorithm with a collision-free guarantee.

The algorithm was tested in a simulation of 1,024 robots and in a throng of 100 real robots by the researchers in the laboratory. The robots carefully and efficiently followed to form a command shape.

 “If you have many autonomous vehicles on the road, you don’t want them to collide with one another or get stuck in a deadlock,” said Northwestern’s Michael Rubenstein, who led the study. 

“By understanding how to control our swarm robots to form shapes, we can understand how to control fleets of autonomous vehicles as they interact with each other.” Rubenstein, the professor who led the study is the Lisa Wissner-Slivka and Benjamin Slivka Professor in Computer Science and Mechanical Engineering in Northwestern’s McCormick School of Engineering and a member of Northwestern’s Center for Robotics and Biosystems. The paper will be published in the journal IEEE Transactions on Robotics later this month.

Rubenstein algorithm is decentralized and not centralized which makes it foolproof and safer. “If the system is centralized and a robot stops working, then the entire system fails,” Rubenstein said. “In a decentralized system, there is no leader telling all the other robots what to do. Each robot makes its own decisions. If one robot fails in a swarm, the swarm can still accomplish the task.”

But still, to move effortlessly, the robots need to communicate with each other so as not to collide and for this, the algorithm divides the ground below in grids and by using a GPS type technology the robot knows where to go - where the grid is empty and no other robot is moving to that spot.

 “The robots refuse to move to a spot until that spot is free and until they know that no other robots are moving to that same spot,” Rubenstein said. “They are careful and reserve a space ahead of time.”  
These robots interact locally to make decisions and hence do not need a central command body. This system according to Rubenstein can be very effective in driver-less cars as well as in warehouses with many robots working at the same time.

Hackers made $82 Million through Bug Bounties in 2019


Hacking as a profession has now become a viable option for the hackers out there. Yes, you've heard it right, ethical hackers have made more than $82 Million in Bug Bounties held at HackerOne. To top that, the ethical hacking community on HackerOne has now reached over 600,000, with around 850 new hackers joining every day. According to a '2020 Hacker Report' published by HackerOne, a Bug Bounty platform in San Francisco, around 18% of the members are full-time hackers, whose job is to find vulnerabilities and assure that internet becomes a safe place for everyone.


On the HackerOne platform, hackers from across the world, 170 countries to be accurate, which includes India too, are working every day to ensure the cybersecurity of 1700 organizations, which include Zomato and OnePlus also. The US tops the 2109 list in the earnings made by hackers through Bug Bounty with 19%, India comes second with 10%, Russia has 8%, China a 7%, Germany 5%, and at last Canada with 4%. These countries are the top 6 highest earning ones on the list.

According to Luke Tucker, who is the Senior Director of Global Hacker Community, Hackers are a global power working for a good cause to ensure the safety the connected society on the internet. The motivations for hacking may differ, but it is good to see that global organizations are embracing this new change and providing hackers a new platform to compete and grow as a community, making the internet a safe place for everyone, all together. Hackers from various countries earned a lot more than compared to what they did last year.

Hackers from Switzerland and Austria made more than 950% earnings than last year. Similarly, hackers belonging to Singapore, China, and other Asian countries made more than 250% compared to their earnings of 2018. Competitions like these Bug Bounty programs have helped Hackers land into respectful expert knowledge, as 80% of the hackers use this experience to explore a better career or jobs. According to the reports, these hackers spent over 20 hours every week to find vulnerabilities.

Reserve Bank of India Experiences a Technical Glitch; NEFT and RTGS Go Down for Half a Day!


Electronic money transfer is something that has changed the way people used to transact. It has offered a way more convenient method that goes along the lines of modernity and the need of recent times.

The most widely used and popular mediums of transferring money between bank accounts in India are NEFT and RTGS. While NEFT has neither minimum nor maximum limits, RTGS is designed for heavier sums of money with 2 lac being the minimum amount and 10 lac being the maximum per day.

Per reports, National Electronic Funds Transfer (NEFT) and Real-Time Gross Settlement (RTGS) were disrupted for more than half a day. The signs of this started to show from Monday midnight.

Sources mention that this happened because of a technical glitch in the systems of the Reserve Bank of India. Nevertheless, NEFT and RTGS have been reinstated after inactivity of 12 hours.

Several reports reveal that the main issue allegedly was grappled by the Indian Financial Technology and Allied Services (IFTAS), which is an RBI affiliated branch when the “disaster recovery site” was being moved from locale A to B.

Sources impart that the NEFT transactions have as of now been brought back. The “end-of-day” RTGS transactions of the previous day are being worked on to get them to reach completion but the “start-of-day” for RTGS hasn’t ensued yet. Still, the restoration of RTGS is expected soon.

The setup for NEFT was established and supported by the Institute for Development and Research in Banking Technology. People will now be able to use this medium for online transferring of funds and money 24x7. Meaning that holidays or weekends would never come in the way of money transfers and funds would be transferred any day and at any time at all.

NEFT and RTGS are the most commonly used routes for online transfer of funds.

The former medium facilitates a provision for limitless one-to-one transfer of money from and to individuals and corporates with an account in any bank branch in the country. The latter, however, has the aforementioned limits and is a continuous and real-time settlements of fund transfers.

Russians were given ways to protect themselves from surveillance via a smartphone


Experts noted that most often smartphone owners are inattentive and infect their devices with spyware. Such programs can collect personal data and place it in the public domain, listen to conversations, and monitor the actions of the owner.

Sergey Nikitin, Deputy of the Group-IB Computer Forensics Laboratory, said that more than 90 percent of cases are not vulnerabilities, but user actions. According to him, the main source of infection is applications downloaded through the browser.

"The search engine, first, gives not an official site, but contextual advertising. Often, scammers buy it, and by clicking on the link from your phone, you download a malicious APK file," said Nikitin.
Nikitin gave an example of the GetContact app, which shows how a person is named in his friends' contact list. According to him, the user provides access to contacts that can leak to the network. He noted that such cases have already occurred. The expert advised not to download applications for remote management, for tracking the user. According to him, it is also not necessary to download the first available antivirus from the search engine, since an unknown program may be a program with a Trojan virus.

Kaspersky Lab expert Viktor Chebyshev also said that popular apps can be malicious. According to him, hackers often fake malicious programs for popular applications. "For example, we recently discovered more than a thousand malware that pretended to be a popular dating application. In General, in 2019, most often Trojans pretended to be photo-processing applications,” informed Chebyshev.

Another loophole for fraudsters is called remote control applications that allow to see the device's screen.

"An attacker can ask you to install the program and then conduct a financial transaction on your behalf. Many banks now show a one-time code in push notifications, so it is not a problem to see it on the screen," said the representative of Group-IB.
Experts also added that fake apps can be found even in official stores. You should be wary if the application requests administrative functions.

OCA Launches First Open Source Language to Connect Security Tools


On Monday, The availability of OpenDXL Ontology - the first open-source language for connecting cybersecurity tools via a common messaging framework has been announced by the Open Cybersecurity Alliance (OCA). The OCA comprises of like-minded individuals, cybersecurity vendors, thought leaders, end-users from across the globe with the mission of finding solutions to the problem of interoperability via tooling, coding and employing procedures and technology they all agree upon. The Project has IBM Security and McAfee as its initial contributors.

As the open-source code is made freely accessible in the cybersecurity ecosystem, OpenDXL Ontology allows any tool to acquire the ability to interoperate and communicate with various other technologies on its own by employing this language. Once this language is released, the need for custom integrations between individual products will be effectively eliminated, reducing the number of engineering resources spent on integration. These saved resources can be efficiently redeployed for other parts amounting to higher value functionality.

OpenDXL, also known as The Open Data Exchange Layer is an adaptive messaging system utilized by more than 4,100 vendors and enterprises to communicate and share intelligence to make accurate and informed security decisions. Any level of integration has to face a common challenge of accuracy and timeliness; when a product is refreshed, it requires all its integrations to be refreshed too. Now, the number of integrations a product will have depends upon the size of the product. More and more integrations given away for free of cost or a very low cost in the open-source space leads to a lot of dead code and hence creates a complex scenario.

In regard of that, the OCA claims that the release of the OpenDXL Ontology now provides, “ a single, common language for these notifications, information, and actions across security products that any vendor can adopt in order to communicate in a standard way with all other tools under this umbrella. This provides companies with a set of tooling that can be applied once and automatically reused everywhere across all product categories, while also eliminating the need to update integrations as product versions and functionalities change.”

While putting the whole idea into perspective, Brian Rexroad, Vice President of Security Platforms at AT&T, told “With the adoption of public cloud and explosion of connected devices, the ability for enterprises to quickly respond to threats across ever-changing technologies, and even beyond perimeters, is critical,"

“OCA is driving an industrial shift in interoperability with the OpenDXL Ontology to support security at scale.” he further added.

Insider data breaches : a big concern say 97% of IT leaders


According to a survey by Egress, a shocking 97% of IT leaders said insider breach is a big concern. 78% think employees have put the company's data in jeopardy accidentally while 75% think they (employees) put data at risk intentionally. And asking about the consequences and implication of these risk, 45% said financial damage would be the greatest.


Egress surveyed more than 500 IT leaders and 5000 employees from UK, US and Benelux regions. The survey showed serious incompetence of IT sector in handling data and their own security as well as employee confusion about data ownership and responsibility.

On the question of how they manage insider data breach and security measures they use, half of IT leaders said they use antivirus software to detect phishing attacks, 48% use email encryption and 47% use secure collaboration tools. And 58% , that is more than half relied on employee reporting than any breach detecting system.

Egress CEO, Tony Pepper says that the report shows the ignorance of IT leaders towards insider breaches and the lack of risk management on their part.
 “While they acknowledge the sustained risk of insider data breaches, bizarrely IT leaders have not adopted new strategies or technologies to mitigate the risk. Effectively, they are adopting a risk posture in which at least one-third of employees putting data at risk is deemed acceptable. “The severe penalties for data breaches mean IT leaders must action better risk management strategies, using advanced tools to prevent insider data breaches. They also need better visibility of risk vectors; relying on employees to report incidents is not an acceptable data protection strategy.”

Misdirected and phishing emails are top cause of insider data breaches- 

Misdirected and phishing emails are top cause of accidental insider data breaches as 41% of employees who leaked data said they did it because of phishing emails and 31% said they sent the information to the wrong individual by email.

 Tony Pepper adds;
“Incidents of people accidentally sharing data with incorrect recipients have existed for as long as they’ve had access to email. As a fundamental communication tool, organizations and security teams have weighed the advantages of efficiency against data security considerations, and frequently compromise on the latter. 
“However, we are in an unprecedented time of technological development, where tools built using contextual machine learning can combat common issues, such as misdirected emails, the wrong attachments being added to communications, auto-complete mistakes, and employees not using encryption tools correctly. Organizations need to tune into these advances to truly be able to make email safe.”

Google AI no longer to use Gender Labels to Tag Photos


Google's Cloud Vision API is a Google Artificial Intelligence (AI) tool that recognizes an image and what's in it and labels it, will no longer use gender labels like "man" and "woman", instead it will label it as 'Person.' Google Cloud Vision API is a tool through which developers can attach labels to photos and identify the content. In an email sent to users on Thursday, Google instructed that they will not use 'woman' or 'man' as physical appearance can not determine gender, the change has been done to avoid bias.


“Given that a person’s gender cannot be inferred by appearance,” reads the email, “we have decided to remove these labels to align with the Artificial Intelligence Principles at Google, specifically Principle #2: Avoid creating or reinforcing unfair bias.” The bias that Google talks about is a result of "flawed training data," a much-discussed topic. A flaw that results in AI algorithm making assumptions- that is anyone who doesn't fit the algorithm of 'man' or 'woman' and will be misgendered. By labeling them as 'person,' Google attempts to avoid this mistake.

Frederike Kaltheuner, a tech policy fellow at Mozilla, said to Business Insider, "Anytime you automatically classify people, whether that's their gender or their sexual orientation, you need to decide on which categories you use in the first place — and this comes with lots of assumptions. "Classifying people as male or female assumes that gender is binary. Anyone who doesn't fit it will automatically be misclassified and misgendered. So this is about more than just bias — a person's gender cannot be inferred by appearance. Any AI system that tried to do that will inevitably misgender people."

Google notes this bias in its API and AI(artificial intelligence) algorithm and seeking to change this flaw: "We will seek to avoid unjust impacts on people, particularly those related to sensitive characteristics such as race, ethnicity, gender, nationality, income, sexual orientation, ability, and political or religious belief." Any more news regarding the Tag feature is yet to be heard from Google.