Category: News

Warnings to AnyDesk and Mastodon administrators, a lesson from a Cloudflare breach, and more.

Welcome to Cyber Security Today. It’s Monday, February 5th, 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

IT administrators allowing the use of the AnyDesk remote desktop connection software should immediately force users to change their passwords. This is because the developer realized hackers recently got into the company’s production systems. In addition to changing passwords, IT must mandate the use of multifactor authentication as an additional login step if it hasn’t already done so. AnyDesk revealed the compromise on Friday. On Saturday researchers at Resecurity said at least two crooks are already offering to sell 18,000 credentials apparently stolen from AnyDesk customers. The cost of buying those 18,000 passwords? US$15,000 in cryptocurrency. Resecurity has warned that particular group of users that their credentials are at risk. Compromising an AnyDesk installation could lead to compromise of the IT system.

Employees need to be warned that threat actors often try to trick people into installing AnyDesk so they can remotely access computers. Scams include emails or phone calls pretending to be from Microsoft or another company saying they need to install AnyDesk to clean their Windows computer. Another scam is a communication claiming to be from AnyDesk support saying they need remote access to the person’s computer or their Android or Apple smartphone.

Administrators overseeing instances of the Mastodon social networking platform need to update their servers. Due to a vulnerability attackers can impersonate and take over any remote account. All versions of Mastodon are vulnerable.

The consequences to some companies of the compromise last October of identity and access management provider Okta continue to emerge. Last week security provider Cloudflare said a threat actor accessed the Atlassian servers that run its internal source code management system, its corporate wiki and its bug database. How did the attacker do it? By using one access token and three Cloudflare service account credentials that were among credentials stolen from Okta in October. Cloudflare’s mistake? Most, but not all of its credentials were rotated after being told of that attack. Why not rotate them all? Because staff thought those particular accounts weren’t used. The lesson: Don’t assume anything when password credentials have to be revoked, rotated, reset or whatever you call it.

Four vulnerabilities have been found that could allow an attacker to escape the confines of a Docker or Kubernetes container, whose goal is, as the name suggests, to contain nasty people. The discovery by researchers at Snyk means that developers using containers and container build tools need to update those applications as soon as patches are released by their vendors.

Another U.S. company has reported the high cost of a cyberattack. Cleaning products manufacturer Clorox said in a regulatory filing that so far the August cyberattack has cost it US$49 million in IT recovery and related costs. That included having to take systems off line, which resulted in disruption of business operations for weeks. Clorox may get some insurance coverage for some expenses.

A U.S. regulator says the “shoddy” cybersecurity and data retention practices of an American company called Blackbaud caused a huge data theft and ransomware attack in 2020. Blackbaud provides data services to nonprofits, schools, healthcare providers and businesses. Among the victims were universities and charities in the U.S., Canada and the U.K. The U.S. Federal Trade Commission said last week that Blackbaud didn’t monitor attempts by hackers to break into its networks, didn’t segment data for security, didn’t ensure sensitive data that wasn’t needed was deleted or adequately implement multifactor authentication. The attacker was in its system for three months. Blackbaud paid a ransom of about US$250,000, but never verified the attacker actually deleted stolen data. And it waited nearly two months do notify customers about the theft of their data. As part of a proposed settlement with the FTC Blackbaud will have to develop a comprehensive IT security program, and delete personal data it doesn’t have to hold.

News is now coming from Interpol that law enforcement agencies from 50 countries including the U.S., Canada and China participated last fall in the seizure of servers behind phishing, malware and ransomware attacks. So far Operation Synergia has seen 31 people arrested or detained.

Finally, a former CIA software developer has been sentenced to 40 years in prison for sending classified agency documents to the WikiLeaks website and possession of child pornography. Joshua Schulte wasn’t a model employee. In 2016 he was transferred from his work at the time to another branch because of a dispute with another developer. In his new post his administrator privileges were soon revoked. However, he kept secret server adminin privileges which allowed him to steal documents in the largest data breach in CIA history and send them to WikiLeaks from his home computer. While investigating the theft of those documents from the home computer the FBI cam across the child porn.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 5, 2024 – Warnings to AnyDesk and Mastodon administrators, a lesson from a Cloudflare breach, and more first appeared on IT World Canada.

Canada moves closer to the EU on addressing issues of digital technology. IBM demonstrates how deep fakes can be a new risk area, in what seems like a scene out of Die Hard, researchers show how a digital highjacking could happen and scientists use 3D printing to create functioning brain cells.

All this and more on the, “Master, I’ve got the brain” edition of Hashtag Trending. I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US.

Listeners will probably notice that we cover a lot of stories about the EU and its legislation, partly because in key areas, the EU seems to be in the lead with its approach to regulating both AI and big tech – as opposed to the theatre that we see in the US government.

In a recent announcement, it appears that the government of Canada agrees with our assessment.

The Minister of Innovation, Science and Industry, the Honourable François-Philippe Champagne, and the European Union (EU) Commissioner for Internal Market, Thierry Breton announced the implementation of a Canada-EU Digital Partnership, which was concluded at the Canada–European Union Summit 2023 held in Canada in November.

They issued this joint statement following their virtual meeting:

“The Digital Partnership will help the EU and Canada address new challenges in digital transformation that impact research, industry, society and the broader economy.

“It aims to focus on increasing cooperation on artificial intelligence (AI), quantum science and semiconductors; public policy related to online platforms; secure international connectivity; and cyber security. These priorities will be discussed at the officials’ level through a Digital Dialogue in February.

“On semiconductors, the EU and Canada intend to cooperate to address future disruptions in the semiconductor supply chain by exploring monitoring and early warning mechanisms. They intend to exchange information on public support to the sector.

“On AI, the EU and Canada intend to set up regular channels of communication and exchange information through workshops, including on AI governance and international standards.

“On quantum science, the EU and Canada will expand mutually beneficial collaboration to accelerate research, development and innovation while promoting jobs and the utilization of quantum technologies in the broader economy.

“On online platforms, the EU and Canada intend to continue to cooperate and exchange information on measures to ensure transparency, fairness and accountability and to make the Internet a safer and more inclusive place for users.

“On secure and resilient connectivity, the EU and Canada intend to exchange information to encourage the development of secure and high-quality connectivity. The partners will also explore actions to develop secure and high quality connectivity between Europe, North America and Asia, for example, potential routes in the Arctic or North Atlantic.

“On cyber security, the EU and Canada intend to collaborate on the implementation of cyber security regulatory frameworks, including in the areas of critical infrastructure protection and cyber security of products.

“On digital identity, digital credentials and trust services, both sides intend to promote interoperability through pilot projects.

It’s a lot to take in but this marks a big move for Canada to become a partner with the EU. There’s a link to the full announcement in the show notes.

Sources include: Cision (link to full announcement)

Just to show the contrast, here’s a story from over the weekend on US regulations.

In an unprecedented surge, AI-related lobbying efforts have skyrocketed by 185% in 2023, with over 450 organizations now actively participating in shaping the future of artificial intelligence regulation.

This significant increase, analyzed by OpenSecrets for CNBC, highlights the tech industry’s urgency in influencing policy amidst the Biden administration’s push for regulatory frameworks. Companies such as ByteDance, Tesla, and Nvidia, along with entities spanning sectors from Big Tech and startups to finance and academia, have joined the lobbying frenzy. This diverse coalition aims to ensure that forthcoming AI regulations foster innovation while addressing ethical and societal concerns.

The landscape of AI lobbying has evolved dramatically, from a handful of organizations before 2017 to a broad spectrum of industries now advocating for their interests. The collective lobbying expenditure topped $957 million in 2023, covering AI among other issues.

The U.S. government has responded with initiatives like President Biden’s executive order on AI, setting the stage for developing standards and assessments aimed at safe and equitable AI deployment. As the industry and policymakers navigate these complex discussions, the focus remains on balancing technological advancement with ethical considerations and societal impact.

Sources include: CNBC

IBM researchers have uncovered a new method for hijacking voice calls using generative AI, a development that could have significant implications for financial institutions and others who manage sensitive data. This technique, known as “audio-jacking,” allows cybercriminals to manipulate ongoing conversations by cloning voices and intervening in real-time discussions.

By exploiting low-cost AI tools, scammers can easily impersonate individuals, swapping out spoken content with fabricated responses. For example, during a conversation about bank accounts, an AI chatbot could substitute a victim’s bank account number with that of the attacker, diverting funds to the wrong destination.

The process begins with malware installation on the victim’s phone or compromising a voice-calling service, after which the chatbot scans for specific keywords to trigger the voice swap. Despite the potential for misuse, IBM’s experiment also revealed some hurdles, including delays in the cloned voice’s response and the varying quality of voice mimicry.

Cybersecurity experts caution that generative AI is making voice scams more believable, with some attacks requiring as little as three seconds of someone’s voice to create a convincing clone. However, the effectiveness of these scams can be mitigated by vigilance and simple verification techniques during suspicious calls.

Source include: Axios

In a scenario reminiscent of a movie plot, researchers have shown how criminals could remotely manipulate data in aviation apps, potentially affecting aircraft takeoff and landing procedures. This vulnerability, discovered in an app used by Airbus pilots, highlights the growing concern over cybersecurity in aviation. While the actual risk of exploitation is considered low due to specific conditions required for an attack, the study underscores the importance of securing digital flight systems against potential threats. Airbus has since addressed the issue, reinforcing the continuous effort to safeguard flight operations from cyber vulnerabilities.

Sources include: The Register.

In a groundbreaking development, researchers have successfully created the first functional 3D-printed brain tissue, paving the way for revolutionary advances in the study of the brain’s function and neurological disorders. This innovative work was conducted by experts at the University of Wisconsin-Madison, where they developed printed tissue capable of growing and functioning akin to typical brain tissue. The primary aim of this 3D-printed brain model is to facilitate research into neurological and neurodevelopmental disorders, including Alzheimer’s and Parkinson’s disease.

Researchers highlighted the potential of this model as a powerful tool in understanding the communication between brain cells and various parts of the human brain.

The printed tissue, designed to be thin to ensure optimal nutrient and oxygen intake, allowed cells to form networks mirroring those in human brains. These networks facilitate active communication through neurotransmitters, enabling neurons to send signals to one another. Remarkably, the tissue incorporated different brain cells, such as those from the cerebral cortex and the striatum, which could interact in specific ways despite their distinct origins.

This breakthrough not only offers new insights into the complex communication and network development within human brain tissue but also stands to revolutionize stem cell biology, neuroscience, and our understanding of various neurological and psychiatric disorders. The precision of this 3D printing approach allows for control over cell types and their arrangement, a feature not present in brain organoids, which are miniature lab-grown organs used for brain research.

Source include: Interesting Engineering,

I’m not scared about this. Are you? I mean, what could go wrong?

Hashtag Trending goes to air five days a week with a daily news show and every Saturday, we have an interview show called the Weekend Edition.

We love your comments. Please let us know what you think. You can reach me at jlove@itwc.ca  or leave a comment under the show notes at www.itworldcanada.com/podcasts.

I’m your host Jim Love, thanks for listening and have a Marvelous Monday.

The post Scientists create functioning brain cells using 3D printing: Hashtag Trending, Monday February 5th, 2024 first appeared on IT World Canada.

I watch far too many YouTube videos – so you don’t have to.

I’ve read a lot about the Vision Pro from Apple but these crazy guys give a really good and objective view of the Vision Pro. It’s far better than the fanboy raves or the corporate blah-blah. If you are interested in finding our what Apple’s Vision Pro is but like me, aren’t going to spend thousands of dollars to find out – check this out.

Here’s what they the talk about in the video. It’s rough notes but it’s what I remember. It’s a mixture of points and quotes from the video. Of course, check it out for yourself. This is just a guide:

That’s my “best of YouTube” for the Apple Vision Pro.  Let me know if these are helpful or useful. I’ll try to give you only the videos that I find appear to be honest, factual and informative.

The post Apple’s New Vision Pro: The Best of YouTube first appeared on IT World Canada.

Welcome to Cyber Security Today. This is the Week in Review for the week ending Friday, February 2nd, 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In a few minutes David Shipley of Beauceron Security will be here to discuss recent news.

That includes more revelations from 23andMe and from Microsoft about their recent data breaches; the Canadian government investigating a hack at Global Affairs, this country’s foreign service; the FBI’s testimony before Congress on the cyber threat from China; Canada’s proposed cybersecurity law for critical infrastructure providers and the $27 million cost to Johnson Controls of a ransomware attack.

Also in the news in the past seven days, administrators of Ivanti Connect Secure VPN and Policy Secure gateways were told of the discovery of two new vulnerabilities they have to take action on.

A cyberattack against Fulton County, which includes the city of Atlanta, forced the temporary closing of some government IT systems. That included phone lines, the ability to file documents online with the court system, paying property taxes, accessing property records used for buying and selling land, the ability to pay water bills online and more. The county continues to work on restoring services.

Meanwhile one or more students at an innovation academy accessed the school district’s IT system without authorization. This is unconnected to the attack on the county.

Three Americans were charged with stealing more than US$400 million in a 2022 SIM-swapping attack. Security reporter Brian Krebs believes the funds were stolen from the now-defunct FTX cryptocurrency exchange.

Linux administrators and application developers were warned to make sure they’re running the latest version of the operating system. That’s because researchers at Qualys discovered four vulnerabilities.

The AlphV/BlackCat ransomware gang is trying to stay alive after the FBI took its infrastructure down in December. It may now be lying about successful attacks to get headlines — and possibly to trick victims into paying. That’s according to a researcher at RedSense. He told the news site Dark Reading this week that while AlphV claimed an attack on a defence contractor, but other than a few screen shots there’s no evidence the company was compromised.

And Juniper Networks released updates to fix high-severity vulnerabilities in its SRX and EX series firewalls.

(The following is an edited transcript of the first of the discussion topics. To hear the full conversation play the podcast)

Howard: Topic one: Timing is everything: The genetic testing service 23andMe gave new details about its huge data breach last week, and the Canadian government admitted the IT network of its foreign affairs department was hacked.

What do these incidents have in common? It took a while for them to be detected. In the case of 23andMe, hackers were in its system for five months. In the case of Global Affairs, the attacker was in the system for a month before detection. David, what does this say?

David Shipley: First, this kind of presence for that length of time is to the right of the median dwell time for cyber attacks, as measured in reports by Mandiant. Dwell time is the time criminals are in a network before either attacking with things like ransomware or being discovered by defenders. Dwell times have generally been trending down from 21 days in 2021 to eight to 10 days in 2022. Keep in mind median is one measurement. It’s not necessarily average. Average can be skewed by folks to the left or right of the median, so it’s really interesting. These attacks should have been caught sooner. I suspect if attacks were using normal tools in the 23andMe case that are regularly present in the IT environment — what we regularly call living-off-the-land — it’s going to be hard to spot unless the company has a very, very good monitoring program. And again, in the case of 23andMe, given that this was using a multitude of breached user accounts unless they were watching for logins from geographies outside of the private country of the user they’d likely have no clue what was happening — other than potentially looking for failed login attack patterns.

In the case of Global Affairs, I am deeply, deeply interested in learning more about what the VPN tool the government referenced as being an integral part of the breach. Was this a zero-day vulnerability or was it a more routine misconfiguration? Was this a known vulnerability? If so, why wasn’t it patched? I can’t imagine December 20th [when the hack reportedly started] was a great time for the IT team there [at Shared Services Canada] to be doing anything. I really hope we get more transparency from the federal government on what happened, how it happened and lessons learned. If they were using a commercial vendor product, this could be beneficial for many other organizations to learn from.

Howard: I thought that detection is one of the prime parts of a cyber security strategy.

David: It is, but it’s certainly not the only part of of a strategy. And you know, people’s perception of what detection actually is capable of doing, what catching something that’s abnormal when it looks and walks and talks everything that’s normal because you know … Stop and step back for second. Global Affairs will have logins from countries around the world. That’s where staff are. That’s where their embassies are, working remotely from internet service networks associated with those various countries. So a lot of the easy ways that people might detect things get a lot harder. It’s tough, but they do have some really really good tooling. So what I’m hoping is that we learn more about who the attackers were.

Howard: Well, 23andMe didn’t know about the incident until the hackers advertised that they had stolen data.

David: This wins the award for the worst possible way you can learn about a breach.

Howard; This was the second hack at Canada’s Department of Global Affairs in two years. Does that say something about government security?

David: I’ll use a hockey analogy: First shots on goal on the federal government are astronomical, Everybody’s trying to get into the net, so they’re never going to be perfect defenders. They’re too big of a target for too many players who have the money and patience to keep taking shots until they score. Second, we really need the government to come out and give us a sense of whether this was regular cybercrime, which would be disappointing to see get past its defenses, or another nation-state which frankly is much more understandable. It’s what we do to other countries. This is exactly the kind of target our intelligence agencies would be going for. It’s part of the great game and frankly, it’s fair game in spying This is what I would expect but I would like to understand the context.

Howard: Well, the Canadian government hasn’t given details about how Global Affairs was hacked two years ago. You know, silence isn’t golden.

David: It’s incredibly frustrating. We need the federal government to follow the leadership that some of the provinces like Nova Scotia have displayed. They did a great job being transparent and accountable during the MoveIT breach. And we need the federal government to lead by example, particularly in a time when they’re going to be passing legislation that will force others to provide it with information about their cyber incidents. It should do the same as a measure of good faith.

…… ….

Howard: Topic 6: American cyber leaders rip China.

In testimony on Wednesday before Congress, FBI director Christopher Wray complained China is attempting to preposition malware on the IT systems of U.S. critical infrastructure providers to strike whenever it wants. He also said the FBI had, with a court order, disrupted a [Chinese] botnet of hijacked American routers whose goal was to spread malware. That botnet was created by the group that security researchers call Volt Typhoon. The congressional committee also heard complaints about China from the Director of the Department of Homeland Security, the Cyber Security and Infrastructure Security Agency and the commander of U.S. Cyber Command. How likely is it that this saber-rattling will affect China’s cyber strategy?

David: I don’t think it’s going to affect it a whit. I think we also need to recognize the Americans are doing this to China, they were doing it to Russia. You’d be insane as a modern country to not be trying to get a foothold in these things as part of a holistic conflict strategy that might involve a proportional response. You know — you get hacked, the power grid goes down in Cincinnati and maybe you turn power off in Shanghai as a proportional response, versus let’s go straight to World War III. This is the Great Game. I find the timing fascinating, and the reason I say that is I was reading CNN earlier this week and we had President Biden and President Xi saying China’s agreed not to do election interference.

By the way, President Biden, free advice: Canada signed a nonaggression treaty with China back in the day under Prime Minister Trudeau about cyber after they raided our cookie jar and they didn’t keep their end of the bargain. So keep your election non-interference receipt with a big grain of salt.

Howard: This bot was composed of home office routers from Cisco Systems and Netgear that are no longer able to get or qualify for security updates. Once again old equipment is a security risk.

David: This goes back to something we were talking about in 2023 which had to do with internet of things regulation in security, reasonable lifespans for equipment and reasonable expectations for customers to keep them secure. Maybe we have to get to the point of saying, ‘As a responsible maker of technologies that can have a dual purpose — that is, they can be a great home router but also can become part of a zombie bot army used by the Chinese to shut down the power in Cincinnati — you have to keep these things patched and updated for 10 years. These patches have to flow through, ideally by default, automatically. Two things: People who are busy moving their regular lives aren’t trying to be cyber security network engineers at home. And that at the end of an equipment’s life you actually have to make it stop working when when there’s a reasonable notice period. ‘This thing is going to be out of security in 12 months and we’ve notified you and at the end of that 12 months it’s not going to be able to connect to the internet anymore.’ Maybe that’s the solution for home internet routers so they can’t be a threat to national security.

The post Cyber Security Today, Week in Review for the week ending Feb. 2, 2024 first appeared on IT World Canada.

For the second meeting in a row, Conservative MPs shortened witnesses’ testimony at committee meetings looking into proposed cybersecurity legislation for overseeing critical infrastructure providers. They did it by bringing forward and forcing debate on other business.

What’s before the public safety and national security committee is Bill C-26, which would do two things: Amend the Telecommunications Act, and create a new Critical Cyber Systems Protection Act (CCSPA). Both would impose new cybersecurity obligations on critical infrastructure providers like telecom companies, banks, and energy companies

On Monday — when long-awaited hearings on Bill C-26 first started — the Conservatives cut into the time Industry and Defence Department witnesses could be questioned on the legislation by bringing forward a motion to start looking into the increase of carjacking in Canada. [See our coverage of Monday’s session here]. When a motion is tabled, committee work stops until it is voted on.

On Thursday, shortly after two witnesses gave their five minute opening statements, the Conservatives again stopped the hearing by raising a motion to start looking into the Liberal cabinet’s use of the Emergency Act during last year’s Ottawa protests over COVID restrictions. This even though another Parliamentary committee is already looking into that incident.

Liberal, NDP and Bloc Quebecois MPs on the committee protested that this was the second time this week the agenda of the committee had been — properly according to committee rules — diverted. Their protests were determined enough that the Conservatives were forced to agree to suspend debate on the second motion to another time, so hearing the witnesses could continue.

However, so much time was eaten up — almost an hour — that MPs didn’t get a chance to question Trevor Neiman of the Business Council of Canada and Byron Holland, CEO of the Canadian Internet Registry Authority (CIRA) after the pair had each given five-minute introductory statements. Instead, they left and the committee heard from other witnesses scheduled for the second hour of the session.

The legislation would allow the government to designate services and systems that are vital to national security or public safety.

The government could also designate the operators, or classes of operators, responsible for their protection. Firms would have to show the government they have a cybersecurity program, and report certain cyber incidents.

Among the controversial parts: the Minister of Industry would have the power to order telecom providers to do “anything” necessary to secure the Canadian telecommunications system. Under the CCSPA, the cabinet would have a similar power over designated critical infrastructure providers. Civil rights groups worry that “anything” gives the government unchecked power. The Telecommunications Act, though, includes examples of orders the minister can give, such as the removal of a product from a provider’s network.

While critical infrastructure providers include manufacturers, food producers and processors, interprovincial transport, pipeline and energy companies, banks and internet operators, the government has said initially the legislation would only apply to high-risk companies.

Neiman, the Business Council’s vice-president of policy, said the group is asking for “targeted amendments” to the CCSPA in several areas including:

— “fair and reasonable limitations” on the federal cabinet’s power to issue cybersecurity orders to critical infrastructure firms. Otherwise, Neiman said, the cabinet could give an order regardless of whether it would be effective or reduce risk to a critical cybersecurity system. As the wording stands now, he said, there would be no obligation for the cabinet to consider the costs to companies of complying with an order, if there are reasonable alternatives to an order, or to consider the possible effects on competition or customers;

— putting a risk-based methodology into the legislation that would put fewer and less onerous obligations on low-risk firms with well-established cybersecurity programs.

Holland suggested three changes to C-26:

—  any cabinet orders issued to firms under the CCSPA should be first examined by the Clerk of the Privy Council — the head of the civil service — and the Deputy Minister of Justice, who is usually a career civil servant;

— the CCSPA should limit the ability of the government to use cybersecurity data collected from companies for only cybersecurity and information assurance purposes;

— and the government should have to report annually to Parliament on how many orders it has given companies under the act.

After Neiman and Holland left — without being questioned by MPs because time had run out for their session — the committee heard from Aaron Shull, managing director of the Centre for International Governance Innovation, a Waterloo, Ont.-based think tank, and Sharon Polsky, president of the Privacy and Access Council of Canada, who made a joint submission with several civil rights groups including the National Council of Canadian Muslims.

“I think the bill is pretty good as it stands,” Shull said. However, he added, it should include a tax incentive to encourage small and medium-sized businesses to invest in cybersecurity.

Polsky complained the bill could allow the government to force companies to create backdoors, break encryption, “or go on a fishing expedition to find whatever information the government wants, including what’s in your emails and your texts, your cellphone and vehicle locations, purchasing information, donor details, so that it can make an order — and the order will be secret until the target realizes something’s up.

“With a nod to Eastern European regimes a hundred years ago, this bill lets the [Industry] minister compel any person, under threat of punitive fines, to provide any information within any time, subject to any conditions that might be specified, or authorize anyone to enter and seize any information in [IT systems], but without the checks and balances that are the mainstay of democracy.”

In short, the bill makes it impossible for organizations to comply with privacy laws, she said. Nor is there an obligation for the government to consult with the federal Privacy Commissioner to ensure personal information handed over is adequately safeguarded.

The joint submission says the CCSPA should be amended in several ways. One is to make it clear that the Industry Minister can’t issue an action order unless there are reasonable grounds to believe it is necessary. Before issuing an order, the Industry Minster should have to consult with the Minister of Public Safety and a body of industry experts.

The law should also make it clear that the cabinet can only ask a firm to comply with an order to protect a critical cyber system only “against a material threat.”

The post Tories again cause testimony on proposed cybersecurity bill to be shortened first appeared on IT World Canada.

AI fakes are making trouble for facial recognition logins, and more.

Welcome to Cyber Security Today. It’s Friday, February 2nd, 2024. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

US

 AI-generated fake biometric images are so good that in two years many firms won’t accept facial recognition alone for identity verification and authentication. That’s the conclusion of researchers at Gartner. Some organizations allow facial scanning for logging into applications. But deepfake images are becoming so good that by 2026 30 per cent of firms will insist on a second factor or more for those wanting to log in through facial recognition. Current security technologies aren’t good enough to spot good fake images. Gartner says CISOs should choose identity authentication vendors that show they can handle these new types of attacks.

The recent discovery of vulnerabilities in Ivanti Connect Secure and Policy Secure gateways is so serious that American government agencies have been told to disconnect the devices from their networks by midnight tonight. To bring those devices back online a complete reset is required as well as upgrading to the latest device software. After that the admin and user passwords and API keys have to be reset. Departments must also assume the domain account associated with the devices has been compromised and take action by March 1st. In addition, government agencies have to continue hunting for compromises on any IT systems that were recently connected to Invanti devices.

Researchers at Cado Security have discovered another threat group going after poorly-protected Docker containers. The Commando Cat cryptojacking campaign leverages compromised Docker instances as an initial vector. Then the service is used to run a number of payloads that steal credentials for cloud services like Amazon AWS and Microsoft Azure, and install a cryptocurrency miner. The report says the attacker targets exposed Docker API endpoints, so administrators have to make sure these parts of containers are well protected.

Finally, poor digital hygiene of key IT and network employees is putting carriers and companies in Europe, Asia, Africa and Latin America at risk. That’s the conclusion of researchers at Resecurity. Several threat actors on the dark web are selling over 1,500 login credentials of telecom network administrators and engineers from a number of providers, the researchers say. Probably these are hackers who picked up on the recent successful hack of the internet registry login credentials of an employee of Spain’s Orange Espagne. That apparently prompted hackers to look for other telecom employees who don’t have multifactor authentication on their internet registry login accounts. A threat actor with internet registry control over a telecom provider can do nasty things. IT leaders be warned: Staff who have login privileges to their organization’s internet registry account must enable multifactor authentication or risk losing access to the account.

Later today the Week in Review podcast will be out. David Shipley of Beaceron Security and I will discuss the FBI warnings on China’s cyber threat, hacks at 23andMe and Microsoft, an attack on a Canadian government email system and more.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Feb. 2, 2024 – AI fakes are making trouble for facial recognition logins, and more first appeared on IT World Canada.

Gemini Pro looks poised to give OpenAI some real competition for a change, TikTok loses access to a huge amount of popular music, there is finally a fix for the Pixel phone storage bug (but you’re probably not going to like it), and the US Senate hearings on social media are like social media itself, high on emotion, light on accuracy, and big on theatrics…

All this and more in this anti-social edition of Hashtag Trending. I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US.

The competition between Google and OpenAI intensifies with the global rollout of Gemini Pro on Bard.

Some reports are saying that this new Gemini Pro release potentially surpasses OpenAI’s GPT-4.

Gemini Pro, now integrated into Bard, will be accessible in over 40 languages across more than 230 countries. And unless I’m severely mistaken, Canada still appears to be left off the list. Although you can reach it with a VPN, I can only access it this way.

The Gemini upgrade introduces a text-to-image generation feature powered by the Imagen-2 model, which is touted to outperform OpenAI’s Dall.E2. In my brief test before we went to air, it was impressive and fast. But in an equally quick test of the writing ability of Bard versus OpenAI, ChatGPT is still ahead of Bard in terms of the flow of its prose. And it might just be me, but Bard seems to always give a great description and a bit of an overstatement of its own abilities. I did an earlier test of Bard versus ChatGPT, and Bard rated itself as superior on a task it didn’t complete. I’ll be testing on the weekend and I’ll update you all on Monday.

To ensure ethical use and distinguish AI-generated images from human-created art, Bard will use SynthID to embed digitally recognizable watermarks in the images it generates.

Bard’s Gemini Pro upgrade includes features that directly compete with ChatGPT Pro’s integration of GPTs. Google’s strategic releases, including the ‘Help me Write’ feature in Google Chrome and the integration of Gemini capabilities in Samsung’s new Galaxy AI smartphones, highlight its aggressive push in the generative AI domain.

Additionally, Google’s Lumiere, a text-to-video generation model, may have an edge over OpenAI, which has yet to release a similar offering.

Google seems to have gotten their mojo back and are actually releasing generative AI features and not just doing videos and announcements. Bard recently secured the second position on the HuggingFace Chat Bot Arena Leaderboard surpassing GPT-4.

All of this makes OpenAI’s response, potentially with the release of GPT-5, eagerly awaited as the competition heats up.

Google’s new offering positions it as a formidable contender in the generative AI space. But something tells me that OpenAI will not simply just roll over and play dead.

Sources include: Analytics India and Bard.Google.com

TikTok users are facing the loss of access to songs from popular artists like Taylor Swift, Jon Batiste, and boygenius, all part of the Universal Music Group (UMG) roster.

This development follows the collapse of contract negotiations between TikTok and UMG. As a result, TikTok has started muting videos featuring songs from these artists.

The dispute centers around compensation and rights issues. UMG accuses TikTok of not compensating artists and songwriters adequately, not protecting human artists from the harmful effects of AI, and failing to address online safety issues. UMG’s stance is that TikTok’s compensation accounts for only a small fraction of total revenue, despite music being a core part of the TikTok experience.

UMG also raised concerns about AI-generated recordings flooding the platform, which they believe dilutes the royalty pool for artists. Additionally, UMG pointed out issues with problematic content on TikTok, including sexualized images of artists like Billie Eilish.

TikTok, on the other hand, has criticized UMG for putting “greed above the interests of their artists and songwriters.” The platform argues that it has reached artist-first agreements with other labels and publishers, and that UMG’s actions are not in the best interests of artists, songwriters, and fans.

This situation has led to shock and disappointment among TikTok users, particularly fans of the affected artists. Some users have even joked about moving to Instagram Reels as an alternative. The dispute highlights the ongoing challenges in the digital music industry, particularly around rights, compensation, and the use of AI-generated content.

Sources include: Devdiscourse

Google has released a fix for a major storage bug affecting Pixel phones, but the solution is far from user-friendly. The issue, which emerged after the January 2024 Google Play system update, locked some Pixel owners out of their phone’s local storage, rendering the devices nearly useless. Google’s response, posted on the Pixel Community Forums, requires users to manually intervene using developer tools and a command-line interface.

The process to fix the bug involves several technical steps: enabling Android’s Developer Options, downloading Google’s “SDK Platform-Tools” zip file, connecting the phone in the correct mode, and executing specific commands through a terminal. The commands involve uninstalling certain media components using the Android Debug Bridge (ADB), a tool typically used by developers for testing and debugging.

While this method promises no data loss for those who haven’t already wiped their devices, it poses a significant challenge for average users. The instructions are complex and require a level of technical expertise that many may not possess. Additionally, issues with ADB driver installation on Windows can further complicate the process, leading to errors and difficulties in running the necessary commands.

This situation highlights the challenges of addressing software issues in consumer electronics, where solutions may require technical skills beyond the average user’s capabilities. It also raises questions about the effectiveness of automatic updates and the need for more accessible solutions for resolving such critical issues.

Sources include: ArsTechnica

I have no idea what to report about the recent US Senate hearings that brought the leaders of social media companies in for what can only be described as theatre.

Don’t get me wrong, I’m not a Zuckerberg fan by any stretch of the imagination, but I have no idea what was gained by senators accusing him of being responsible for the suicides of children and pointing to the grieving parents.

Zuckerberg, caught off guard, was forced to apologize – but aside from humiliating him, there was theatre – no substantive discussion.

Robert F. Kennedy Junior attempted to be “cool” with a specific phrase that he’d picked up, which one of the CEOs had never heard.

One senator, Tom Cotton, repeatedly asked TikTok’s CEO Shou Zi Chew if he’d ever been a member of the Chinese communist party, and Chew had to tell him multiple times that Chew is Singaporean, not Chinese.

Short of saying, “you all look alike,” it’s hard to imagine how a senior US legislator could be any more racist or rude – you can take your pick which one.

And as for substantive discussions about deep fakes or real proposals about what can actually be done? I heard nothing.

If I missed it, I’ll stand corrected but once again, but I thinkit was Seth Myers who gave the best analysis – these guys didn’t look like they could operate their garage door opener.

Which makes for a good line, but the fact is that there are real issues in social media that require if not legislation, then at least some agreement or regulation.

But nothing will happen if it’s all political theatre, with a bunch of legislators who aren’t willing to engage in substantive discussions.

Sources include: MSNBC, YouTube highlights and several stories including Axios and one in The Register

Hashtag Trending goes to air five days a week with a daily news show and every Saturday, we have an interview show called the Weekend Edition.

We love your comments. Please let us know what you think. You can reach me at jlove@itwc.ca or leave a comment under the show notes at www.itworldcanada.com/podcasts.

I’m your host Jim Love, thanks for listening and have a thrilling Thursday.

The post Google gets its mojo working and threatens Open AI’s dominance: Hashtag Trending for Friday February 2nd, 2024 first appeared on IT World Canada.

Canada was the fifth most targeted country for cyber attacks in the world last year, according to the 2023 Blackberry Threat Report. These attacks hit our corporate and public infrastructure, and affect the livelihood and the lives of all Canadians.

Given the increase in threats, it is essential that Canada be able to attract and retain top cybersecurity talent. But how well are we doing at that?

Within that context, we should also be asking ourselves additional questions: How attractive are our cities to cybersecurity professionals? Which places are doing the best job? What can we all learn from that?

The Canadian Cybersecurity Network, Canada’s largest technology member network, in partnership with IT World Canada (ITWC), is looking to find out.

CyberTowns is a new research program which is conducting surveys and leveraging existing government and private sector data to discover which cities in Canada are doing the best job of welcoming and keeping precious cybersecurity talent in our country.

In this age of remote work, where workers have great choices about where they live, it’s even more important that we have a better understanding of what it takes to attract these essential workers. During the pandemic, we heard of a migration to smaller cities with a high quality of life. They offer access to nature, cultural resources, lower taxes, and some are investing in support for cyber security and learning, and in gathering places for tech resources.

Are these investments paying off?

CyberTowns will attempt to answer these and more key questions. The program will not only analyze data, but it will also recognize those municipalities that are most successful in attracting and retaining cybersecurity professionals.

Canadian cities with a population of over 100,000 have been the focus of the initial study, but there are plans to expand this as we move forward.

The CyberTowns awards will be presented during the Canadian Identity Summit (CIS) on April 30 in Ottawa. In addition to the awards, a report will be issued that shares the details of why some cities stood out from the rest, and what are they doing to attract, develop and retain talent in their communities.

Francois Guay, founder of the Canadian Cybersecurity Network, says communities that do this well will have the benefit of being the safest from a cybersecurity point of view. “Canada must attract and develop the best, and keep data in Canada to safeguard against additional threats that are outside of our control.

“We welcome corporate and civic support of this unique venture. Take the survey here: https://canadiancybersecuritynetwork.com/cybertown.”

To join the discussions leading up the awards, join ITWC on Mar. 6 for our next Technicity virtual event – Smart Cities are Safe Cities – where a special panel will discuss these issues.

And mark your calendar for April 30 in Ottawa, where we will present the awards and launch the full report. For those who can’t make it in person, IT World Canada will provide full coverage.

The post How attractive are our Canadian cities to cybersecurity professionals – and why does it matter? first appeared on IT World Canada.

The Liberal government’s proposed law controlling the use of artificial intelligence applications is like a badly built racing car, a computing expert has told a Parliamentary committee.

But instead of putting the proposed Artificial Intelligence and Data Act (AIDA) in a garage, Andrew Clement, professor emeritus at the University of Toronto’s faculty of information, told the Commons industry committee Wednesday that the government should start all over again, with proper public consultation including a wide range of Canadians.

Andrew Clement testified by video conference. Screen shot via ParlVu

Innovation Minister François-Philippe Champagne, the bill’s sponsor, “wants to make Canada a world leader in AI governance. That’s a fine goal. But it’s as if we’re in an International Grand Prix,” Clement said. “Apparently to allay the fears of Canadians, he proudly entered a made-in-Canada contender. Beyond the proud Maple Leaf and him smiling at the wheel, his AIDA vehicle barely has a chassis and an engine.”

“He insisted he was merely being ‘agile,’ promising that if you just help propel him over the finish line, all will be fixed through regulations.”

But, Clement said, as a previous witness testified, there is no prize for first place in AI oversight. “Good governance isn’t a race, but an ongoing learning project.”

Among the problems: The Innovation Minister would have “sweeping powers,” Clement said, which puts him in conflict with his job to advance the AI industry. And the proposed AI data commissioner for overseeing the law should be an independent officer of Parliament, he said, not someone who, as the bill proposed, would report to the Innovation Minister.

“With so much uncertainty about the perils and promise of AI, public consultation with informed expertise is a vital precondition for establishing a sound legal foundation,” Clement added. But while Champagne said his department held more than 300 meetings, by Clement’s count, 220 were with businesses, including 36 with U.S. tech giants. Only nine were with civil society representing Canadians.

“Canada also needs to carefully study developments in the E.U., U.S., and elsewhere, before settling on its own approach,” Clement said.

Asked by one MP if AIDA in its current form would protect Canadians, Clement replied “I would say not.”

AIDA demands businesses deploying “high impact” AI technologies to use them responsibly. In particular they would have to develop and deploy applications in a way that mitigates the risks of harm and bias. There would be criminal prohibitions and penalties for using data obtained unlawfully for AI development, where the reckless deployment of AI poses serious harm, and where there is fraudulent intent to cause substantial economic loss through its deployment.

Clement is the latest witness to call AIDA flawed and say it has to be sent back to the drawing board. The Information Technology Industry Council filed a brief telling MPs that more consultation is needed but also recommended wording changes. Lorraine Krugel, vice president for privacy and data at the Canadian Bankers Association, asked for “targeted amendments” to the CPPA.

Meanwhile the European Parliament is on track to pass its own AI law this year.

The post Proposed Canadian AI law is like a race car without an engine, expert tells Parliamentary committee first appeared on IT World Canada.

Software problems are hitting automakers hard, Tesla’s shares take a hit as Elon Musk’s compensation is reversed by a judge in a shareholder lawsuit, a study concludes that poor performance is more likely for companies that are forcing return to office and does your Chrome browser look different? It might be the old Microsoft switcheroo…

All this and more on the earn while you learn edition of Hashtag Trending. I’m your host Jim Love, CIO of IT World Canada and TechNewsDay in the US.  

General Motors (GM) is facing issues with bugs in the systems of its electric vehicles. These have led to a range of problems, both technical and operational, impacting customers, the company’s reputation, and its financial performance. 

Owners of affected GM EVs, such as the Chevrolet Blazer EV, have experienced various technical problems including flickering screens, looping error messages, and issues with charging. These glitches not only degrade the user experience but also raise concerns about the reliability and safety of the vehicles. For example, a software malfunction in a car can potentially lead to critical failures in vehicle operations, posing safety risks.

These are not only affecting customer satisfaction, they are having a big impact on the bottom line of the auto maker. GM’s decision to halt sales of the Chevrolet Blazer EV due to software issues directly affects the company’s revenue and market share. Additionally, GM recorded a $1.7 billion accounting charge related to the high cost of stockpiled battery cells, which it won’t be able to fully recover. 

Software problems have forced GM to delay the launch of several key EV models, including the Chevrolet Equinox EV, Silverado EV RST, GMC Sierra EV Denali, and Cadillac Escalade IQ. These delays hinder GM’s ability to compete effectively in the rapidly growing EV market.

GM isn’t the only company that is struggling with this transition. 

Sounds easy to say, huh? Every company is now a software company. 

Those of us who grew up in IT know all too well that building quality software on tight time frames ain’t easy. And we know all too well about what project delays can do. 

Looks like GM and other automakers are finding this out the hard way.

Sources include: Axios

Tesla’s shares took a bit of a dive when a Delaware court voided CEO Elon Musk’s $56 billion compensation package. 

The ruling, based on the lawsuit filed by a Tesla shareholder, concluded that Tesla’s board failed to demonstrate the fairness of the compensation plan or evidence of substantial negotiation with Musk. 

This decision led to a 3 per cent drop in Tesla’s share price in after-hours trading.

The 2018 compensation package, the largest in public corporate history, was pivotal in making Musk a centibillionaire. It gave Musk stock options, contingent on Tesla achieving specific market capitalization and revenue targets. 

The court case questioned the fairness of this package, highlighting Musk’s control over Tesla and the flawed process leading to the board’s approval.

Musk’s response to the ruling was critical of incorporating businesses in Delaware, and he suggested a poll about relocating Tesla’s incorporation to Texas.

But for the rest of us, the ruling highlights the challenges of ensuring fairness and transparency in executive compensation, protecting the rights of all shareholders, especially in high-profile, high-stakes situations like Musk and Tesla.

Sources include: CNBC 

They call it Nightshade. It’s a new tool developed by researchers at the University of Chicago, and it’s seen a remarkable uptake with 250,000 downloads in just five days. 

The tool is aimed at artists, and is designed to disrupt AI models that scrape and train on artworks without consent. 

Nightshade alters images at the pixel level, making them appear as entirely different content to machine learning algorithms. This “poisoning” of AI models can lead to the generation of inaccurate imagery based on user prompts.

The overwhelming response to Nightshade indicates a strong desire among artists to protect their work from unauthorized AI training. The tool’s popularity extends globally, reflecting widespread concerns over the use of unlicensed data in AI model training. Nightshade’s approach is to increase the cost of training on unlicensed data, making licensing images from creators a more viable option.

Following the success of Nightshade, the team, also known for their earlier tool Glaze, plans to release a combined version of both tools. Glaze, which has received 2.2 million downloads since April 2023, aims to protect an artist’s signature style from being learned by AI models. The combined tool will offer both defensive and offensive capabilities against AI model training on unlicensed artworks.

The project leader, Ben Zhao, has expressed surprise at the high level of enthusiasm for Nightshade and anticipates releasing an open-source version in the future. The team’s work highlights the growing tension between AI development and artists’ rights, emphasizing the need for ethical considerations in the training of AI models.

Sources include: VentureBeat

There’s a reason why one of my favourite phrases is that irony is dead. 

Meta, formerly known as Facebook, has argued against copyright protections when it comes to using online content for building AI models; it attempted to use the same law to protect its own AI model, Llama.

Meta’s argument to the US Copyright Office is that the vast amount of copyrighted text, imagery, and data used to train AI models, such as Llama, should not be protected under copyright law, considering it as “fair use.” This stance suggests that everything available on the internet is fair game for AI training purposes. 

But, when an initial version of Llama leaked online and was posted on GitHub, Meta invoked the Digital Millennium Copyright Act (DMCA) to demand its removal, asserting copyright over its own AI model.

Despite Meta’s efforts, the attempt to remove Llama from GitHub was unsuccessful. The GitHub user who posted Llama argued that the model’s specifications did not have sufficient originality to be copyrightable, as they were derived from works used to train Llama.

All of this from the company that makes billions by circulating everyone else’s content.

On a more serious note, the growth of AI may have finally force us to have a meaningful discussion about the balance between protecting intellectual property and fostering innovation in AI development.

Sources include: Business Insider 

And a couple of quick stories that caught my eye. I saw this one in Forbes and then looked up the study, and there’s a link in the show notes.

According to a recent research paper published by University of Pittsburgh, compelling evidence suggests that organizations are leveraging Return-To-Office mandates not to enhance firm value, but rather to reassert control and shift blame for poor performance onto employees. Contrary to the belief that RTO boosts company value, the study revealed that RTO mandates are more likely in firms with poor recent stock performance and have had no significant impacts on firm profitability or stock-returns.

You can check it out yourself.

And another story in Reuters noted that some of the big tech companies, Google, Microsoft, Meta and Amazon have taken a bit of a hit due to these companies’ investments in AI. It turns out that revenues are up, but so are costs and investors may be putting these companies in the penalty box. Alphabet (Google) shares fell by 6 per cent and that’s a lot. Wait til investors figure out how much Mark Zuckerberg has spent hoarding the world’s supply of GPU’s

Maybe this is why Microsoft announced that it’s put together a team to find ways to run AI in a less costly manner.  

Anyway, none of these companies will go broke and nobody will lose their job at the CEO level, but it points out that when hype takes over, there are going to be big swings in share prices in tech – and where have we seen that before?

Sources include: Reuters and the University of Pittsburg

Finally, 

If you think your Chrome browser looks a little different, maybe that’s because you shifted to Microsoft’s Edge without knowing it.  

How did that happen? Well, it turns out, according to Microsoft, that there is a bug that inadvertently might cause a switch of browsers for users of Windows 10 and 11. Now this came about because Microsoft had your best interests at heart – they wanted to simplify browser switching for you. 

Some of the more cynical among you might argue this incident reflects Microsoft’s strategy to push Edge and its services, including Bing, through less than clear system notifications and setup prompts. 

But what’s the big deal? Edge, utilizes the same Chromium engine as Chrome, and offers a similar browsing experience and a stronger integration of Microsoft’s ecosystem, from account sign-ins to Microsoft 365 applications.

You didn’t agree to it. Picky, picky, picky…

Seriously, we should always give clear consent to any change from our preferences. And we have to take Microsoft at their word that this is a bug, it is convenient that these types of bugs never seem to push people to Firefox.

And users are expressing some frustration at how pushy Microsoft is in trying to get you to shift over. Andrew Cunnigham, another tech writer complained in a recent post about being asked multiple times to shift his browser preferences. I can’t vouch for that; I use a Mac. 

And I’m not claiming that Apple is lily white pure on this either. Because for the last time, if I’d wanted Safari, I’d have chosen Safari. 

We wouldn’t tolerate this anywhere else. If instead of “do you want fries with that,” you never hear “here’s your fries you didn’t ask for. Don’t ask. It’s a bug.”

So it does point out the need for clear boundaries and user consent in software updates and changes.

Sources include: Ars Technica 

And that’s our show…

Hashtag Trending goes to air five days a week with a daily news show and every Saturday, we have an interview show called the Weekend Edition.  

We love your comments. Please let us know what you think. You can reach me at jlove@itwc.ca  or leave a comment under the show notes at www.itworldcanada.com/podcasts. 

I’m your host Jim Love, thanks for listening and have a Thrilling Thursday.

The post Hashtag Trending Feb.1-Software issues hit automakers; Poor performance linked to RTO mandates?; Microsoft continues to push Edge over Chrome first appeared on IT World Canada.