A new report highlighting an escalating rise in phishing incidents since the launch of ChatGPT is the start of a cascade of events that a Silicon Valley cloud and artificial intelligence (AI) expert predicts could result in a catastrophic “threat to mankind.”

The study by cybersecurity vendor SlashNext, which provides offerings for cloud email, mobile and web messaging apps, revealed an alarming 1,265 per cent increase in malicious phishing emails since the launch of OpenAI’s generative artificial intelligence (GenAI) platform a year ago.

“The one thing that is certain is the future of generative AI is still largely unknown,” authors of the document state. “The rapid growth of these tools on cybercrime forums and markets highlights how cybercriminals have embraced the technology and that the potential threat is real.”

While noting that “fortunately, there are cybersecurity vendors who have introduced generative AI technologies, which are used to detect and stop malicious generative AI attack attempts,” they add, “the results in the report highlight how much the threat landscape has changed since 2022.”

Other findings revealed that 68 per cent of all phishing emails are text-based Business Email Compromise (BEC) attacks, mobile phishing is on the rise, with 39 per cent of mobile threats consisting of Smishing (SMS phishing), and Credential Phishing “continues a stratospheric rise, with a 967 per cent increase.”

For Don Delvy, the CEO and founder of D1OL: The Digital Athlete Engine, a cloud-based sports smart platform, the findings should be a wake-up call for everyone when it comes to the downside of a technology that he says should never have been put into the public domain in the first place.

“The recent advancements in AI have ignited a global conversation about its potential impact on society,” he said. “While AI holds immense promise for transforming industries and enhancing human capabilities, it also raises concerns about ethical implications and responsible use.

“We are facing unprecedented ignorance, incompetence and corruption in the global technology industrial complex, at the worst possible time, the precipice of Terminal AI.”

Terminal AI, he said, “refers to artificial intelligence that becomes a catastrophic threat, potentially leading to a nuclear holocaust, the destabilization of governments, economies, and societies. This concept underscores the urgent need for strategies that future-proof AI to save the world. A proactive approach that focuses on the enduring sustainability and ethical foundations of AI would prevent such a dire outcome by ensuring AI develops in a safe, controlled, and beneficial manner for humanity.”

To address these concerns “and foster a constructive dialogue,” Delvy, a graduate of Purdue University who has been involved in software development for close to 30 years, says the following five steps need to be taken:

Promote transparency and open communication: AI developers, researchers, and companies should proactively engage with the public to explain their work, address potential risks, and foster trust.
Establish clear ethical guidelines: Industry bodies and government agencies should collaborate to develop and enforce robust ethical guidelines for AI development and deployment.
Emphasize education and public understanding: AI literacy should be integrated into educational curricula to equip individuals with the knowledge and critical thinking skills to navigate the AI landscape responsibly.
Encourage diversity and inclusion: AI development teams should reflect the diversity of society to ensure that AI solutions address the needs and perspectives of all stakeholders.
Prioritize human-centered AI: AI should be designed and implemented with the well-being of humanity at its core, ensuring that it augments human capabilities rather than replacing or dominating them.

In an interview with IT World Canada, Delvy described GenAI technologies as “hands down the most explosive technology the world has ever seen, right behind nuclear.

“I would never have put a large language model (LLLM) on a public cloud, that is first and foremost.”

As for the SlashNext report, he said the “mammoth rise in phishing emails created by ChatGPT is absolutely 100 per cent the beginning, and you are going to see actual damage.

“I have a seven-year-old son I am trying to  protect here.”

Asked about the recent firing and re-hiring of Sam Altman from OpenAI, Delvy pointed out that the entire incident “highlights the importance of ethical leadership in the AI sector. As AI continues to evolve at an unprecedented pace, it is crucial for industry leaders to embrace transparency, accountability and a commitment to responsible innovation.”

The post AI expert says report findings proof onset of ‘Terminal AI’ has begun first appeared on IT World Canada.

More on Booking.com compromises

Welcome to Cyber Security Today. It’s Friday, December 1st, 2023. I’m Howard Solomon, contributing reporter on cybersecurity for ITWorldCanada.com and TechNewsday.com in the U.S.

In previous podcasts In previous podcasts I’ve reported on abuse of the booking.com hotel reservation platform. Here’s the latest news: Researchers at Secureworks last month found a mistake made by an employee led to a hacker stealing the business’ Booking.com credentials. From there the hacker sent emails from Booking.com to people who made reservations at the hotel. The messages, of course, looked official. Unfortunately somehow the attacker then stole money from the guests’ accounts. The employee’s mistake? Responding to an email from a so-called former hotel guest who wanted help finding a lost passport. The initial email didn’t have an attachment or a link, so the employee wasn’t suspicious and trusted the message. However, a follow-up email did have a link to a supposed photo of the missing passport to help the hotel employee. Clicking on that link allowed malware to be downloaded that could copy passwords on the hotel employee’s computer. The hacker used those credentials to log into the Booking.com reservation system for the hotel, and then send phishing messages to hotel guests. It helped — and you know what’s coming — that the hotel didn’t enable multifactor authentication for employee logins to Booking.com.

The U.S. has seized the website of a cryptocurrency mixer called Sinbad used by North Korea and others to launder stolen digital currency. At the same time the U.S. sanctioned the service, meaning no one in the U.S. can use it. Sinbad is used by North Korea’s Lazarus group for exchanging stolen digital currency for cash. Others use Sinbad to hide drug trafficking and child abuse materials.

Remember the Stuxnet attack of 2010? That’s when attackers were able to compromise Siemens internet-connected programmable logic controllers to damage centrifuges processing uranium at a nuclear plant in Iran. Siemens altered the coding of the software to prevent that from happening again. But researchers at Enlyze say they found a way to bypass the fixes. For the past 12 months Siemens has been saying users of its S7 PLCs should be running on version 17 or later for better security.

Fake virus warnings are popping up on the screens of people going to popular websites like the Associated Press, ESPN and CBS. You’ll be on the site and suddenly what looks like an anti-virus scanner is checking your computer — and lo and behold there are three viruses found and a recommendation you take action — like downloading a file or buying a security product. This is a scam. An infected ad on the page triggers the so-called scanner, which is a video that looks like it’s scanning something. Researchers at Malwarebytes say the gang behind this is called ScamClub.

Finally, Apple has released updates for the iPhone iOS and iPadOS operating systems to close vulnerabilities. Your devices should be running versions 17.1.2.

Later today the Week in Review podcast will be available. I’ll talk with Terry Cutler of Cyology Labs about ransomware, the latest explanation from Okta about a data theft from its customer support system and a survey of information security officers whose firms were hacked.

Links to details about news in every podcast episode are in the text version at ITWorldCanada.com.

Follow Cyber Security Today on Apple Podcasts, Google Podcasts or add us to your Flash Briefing on your smart speaker.

The post Cyber Security Today, Dec. 1, 2023 podcast – More on Booking.com compromises first appeared on IT World Canada.

Microsoft becomes a board member of OpenAI, Google Drive unveils a new homepage to find files faster, while the mystery of the missing files remains unsolved and AI is still very dumb.

These and more top tech stories on Hashtag Trending.

I’m your host James Roy.

Microsoft has finally joined the board of OpenAI, as a non-voting observer. 

Microsoft is a 49 percent shareholder of Open’s AI’s for-profit subsidiary and its largest investor, having injected more than $10 billion this year since the start of 2023.

OpenAI made the announcement as it formalized the return of Sam Altman as CEO.

The company also thanked Microsoft CEO, Satya Nadella for help resolving the conflict that – quick catch up – overthrew Altman, irked employees and partners, saw a couple of short-lived CEOs, regrets and finally the return of Altman, like nothing ever happened. 

The reinstated CEO, says he harbors zero ill toward co-founder Ilya Sutskever, who voted to oust Altman and who has now exited the company’s board.

However, Altman said in an interview with Axios that he’d like to understand better why he was ousted in the first place.

With Microsoft joining the board, Altman also said that the “highest priority” is now to explore changes to improve the governance structure of the company – including whether OpenAI remains controlled by a non-profit entity.

Its subsidiary’s for-profit work is overseen by a non-profit board, under the company’s current structure, the goal being to ensure that AI benefits all of humanity.

The company has already said it will seek to diversify its board, which currently consists of former Salesforce co-CEO Bret Taylor as chairman, former Treasury Secretary Larry Summers and Quora CEO Adam D’Angelo.

Source: Axios, Engadget

The mystery of the missing Google Drive files is still rumbling, with Google acknowledging the issue yesterday and expecting the solution in the next two days.

In the meantime, the company is rolling out a new homepage that aims to make it easier and faster for you to find files.

Google Drive’s new “Home” view uses machine learning algorithms to automatically suggest files and folders, including ones you’ve recently opened, shared, or edited. It will also suggest any documents attached to upcoming Google Calendar events. 

And, the homepage offers new filters or “search chips,” to search documents by type, people, modified date or location. Hope it works to retrieve the missing files too.

Google Drive’s Home view is now the default homepage. However, you can switch back to the old landing page by clicking on the “Change to My Drive” option in the banner.

Source: TechCrunch

Nucleos, a startup, is making e-learning tablets available to inmates in correctional facilities to help them prepare for life after release.

Co-founder and CEO Noah Freedman, said; “Without a solution like Nucleos, almost 95 per cent of digital e-learning and training material can’t be used in prisons or jails due to security reasons. What sets us apart is that we handle all security aspects, ensuring that all e-learning programs are delivered safely and securely. Simultaneously, we disable any components that could enable prohibited communication with the outside.”

The company does not make the education materials or the tablets but acts as a one-stop shop for making these things available to the facilities.

Nucleos also tracks the courses and credentials so the person can be ready to use them for job searchers after their release.

Source: TechCrunch

Onto the less gracious things. Elon Musk told advertisers leaving X over the antisemitic content proliferating on the platform to “Go, f- themselves”

He said during the appearance at The New York Times’ DealBook event, “If somebody is going to try and blackmail me with advertising, blackmail me with money? Go f- yourself. Is that clear? I hope it is.”

X came under fire with its management of the litany of antisemitic and islamophobic content on the platform amid the Israel-Hamas war. But advertisers mostly started pulling back after Elon Musk posted a tweet wherein he seemed to agree with an antisemitic conspiracy theory.

Documents that The Times has seen reveal that over 100 brands, including Airbnb, IBM, Apple, Microsoft, Netflix and other types of advertisers such as political candidates have fully paused their ads on the platform, while dozens more are considering pulling their campaigns. X could lose up to $75 million in ad revenue earnings if advertisers do not come back. 

The company said that the revenue at risk was only around $11 million as some advertisers return or increase their ad spending.

Source: Engadget

How intelligent is artificial intelligence? Turns out not very.

The potential of achieving artificial general intelligence in the near term has been making the rounds, but many AI scientists continue to maintain that AI does not come close to human capabilities.

According to recent research from Yann LeCun, Meta’s top AI scientist, AI is still much dumber than humans in the ways that matter most.

The study co-authored by scientists from other AI startups like HuggingFace and AutoGPT aimed to look at how AI’s general-purpose reasoning stacks up against the average human.

So, the research put together its own series of questions that, as the study describes, would be “conceptually simple for humans yet challenging for most advanced AIs.”

Answering the questions would require abilities like reasoning, multi-modality handling, web browsing, and generally tool-use proficiency. For instance, the LLM was asked to visit a specific website and answer a question specific to information on that site.

The questions were given to a sample of humans and to GPT-4, the latest large language model from OpenAI.

End result? The LLMs did not do very well and were outperformed by humans.

The study concluded that the advent of AGI would depend on the system’s capability to perform on such questions as robustly as a human does.

Source: Gizmodo

And that’s the top tech news for today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.”

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts 

And while we cover cybersecurity stories that we think are of general interest, you can keep really up to date on cybersecurity with our podcast featuring security journalist Howard Solomon. It’s called CybersecurityToday.  It’s rated as one of North America’s top 10 tech podcasts.

I’m your host James Roy.  Have a Fantastic Friday!

The post Hashtag Trending Dec.1 Microsoft joins OpenAI’s board; Google Drive’s missing files unsolved; Study finds that AI’s still dumb first appeared on IT World Canada.

Conversations around automation and artificial intelligence are eclipsing the existing challenges in the workplace related to, for instance, work-life balance, employee burnout and management of remote work, said Jim Love, chief information officer at IT World Canada, during a panel at the HRPA conference.

“AI is sucking all the oxygen out of the room in terms of the discussion, and that’s fair because it is a real force. What it will do to the workforce is unquestionably going to be very dramatic,” he said. “But it’s not the only thing happening out there. We had no shortage of problems before this.”

Love was joined by Lisa Taylor, president and founder of Challenge Factory, a research and consultancy firm focusing on the future of work, and moderator Thomas Wardman, vice president, information technology and operations, HRPA.

Taylor argued that there’s a lot to focus on beyond AI when a company is organizing for the future of work, including the demographics and longevity of the workforce, career ownership, flexible work models, the emergence of platform-based work models like Uber or Airbnb, and finally, automation and the consequent potential job losses, gains, and more.

“Really, the future of work is human. Work is a human activity. So technology can enable work, but if we’re talking about the future of work, we have to be talking about human beings,” said Taylor. “Otherwise, we’re talking about the future of tech enabling work, and that’s a great topic, but it’s a different topic.”

Conversations around diversity, inclusion, and equity are as essential, the panelists concurred, stressing that there has been an honest attempt to embrace diversity.

“Over their careers, people have developed, and we’re bringing out the best in people in management,” said Love. “They’re trying to embrace diversity, but at the same time, they’re somewhat frustrated or confused by how to make the change.”

Diversity metrics and reports are helpful to track the progress a company has made, but they often run the risk that the metric itself becomes the goal, explained Taylor.

“When we’re focused on the report as the goal, it means that we’re going to do the surface level stuff that may or may not get us a good report, but definitely will not advance how much we mature in our understanding of being diverse workplaces as well as if we actually took a hard and honest look, and really look from the ground up of how we can do better,” said Taylor.

Technology can also be the very tool to foster DEI, Love said. He explained that generative AI caught on so much because it finally allowed us to have a conversation with a system.

“Friends who emigrated to Canada, and while they have great English, they’re not as comfortable in some areas,” he noted. “But to be able to get stuff in their own dialect, their own language instantly from an AI because you interact with the machine – it doesn’t care what language you speak, it will speak back to you in your own language.”

AI is also getting better, he added, in the sense that it can be trained on smaller, curated models. Additionally, the ability for AI to create data is promising, because it allows you to create data that is less biased.

Finally, a key reminder when having conversations about DEI, Love noted, is that “we have to look at each other as humans first and then explore the dimensions, because as you get to know people, you’ll get to know that they will find the commonality rather than the things that make us different.”

He continued, “I think we have to give people the opportunity to experience the depth. And when we put labels on people of any side, even if they’re the labels of prejudice or privilege, I think we make mistakes.”

Having full diversity in the workplace is also allowing for diversity of thought, Taylor said, so that people who think differently or come from different backgrounds are comfortable having productive discussions.

“We have to learn to have discussions with people we don’t agree with,” Love said, “because otherwise we’re in this echo chamber which social media has done to us, where we always stay with our tribe, in our group, and we tell people how righteous we are.” Encountering people you do not agree with and finding common ground as humans, he concluded, is key.

The post Keeping the human at the centre of an AI-powered workplace: HRPA conference first appeared on IT World Canada.

What are Canadian companies actually doing in terms of projects with cloud and generative AI? How are they navigating the uncertainty of a relatively new technology? Those were the questions that were addressed by a customer panel during a briefing with Canadian media at AWS re:Invent 2023.

The panel featured a number of companies from different verticals, ranging from born in the cloud startups to large established enterprises.

Here’s some of what they had to say about the use cases they are working on, and the rationale for using generative AI versus more traditional approaches to AI such as machine learning (ML):

Dwayne Benefield, SVP connected homes & entertainment, Telus

In customer service, Telus is deploying an AI engine to improve customer service in call centres, to “take questions, understand intent and generate answers.” But beyond that, Telus is looking to AI to take a further step and help troubleshoot issues.

Benefield asked us to imagine someone “streaming Netflix and all of a sudden it goes down and you’re like, ‘what’s wrong with my WiFi?’ AI is capable of checking a wide range of potential issues and proposing actions to resolve the situation. These answers can be real time and proactive.”

He also outlined Telus’ plans for smart homes, focusing on an issue that is a sore point with everyone who has adopted more than one smart device in their home.

“Every device you buy comes with their own hub,” he stated. “That’s not very smart.” As a case in point, he noted, “I actually have 39 apps on my phone right now (to manage smart home devices).”

Benefield knows that AI can change this. “We’re leveraging AI to remove that complication and actually make it more personalized and easy to set up,” he said.

He announced that Telus is working with AWS to to build the world’s first device-agnostic smart home solution. “Now all the devices you have, or devices you plan to bring in…are controlled by a single pane of glass or a single voice system.

“Instead of having to program your morning routine in five different apps…you just say, ‘hey Jarvis, wake me up at 7 am, open the blinds and get my morning coffee’. And Jarvis will say, ‘what temperature do you like your coffee?’”

Benefield noted that Telus is deploying this in beta next month, and in consumer-facing applications starting in Q1.

Eman Nejad, head of data science, WAHI Realty

WAHI is a startup, less than a year old, but the company has already become a disrupter in the real estate market, with a “cashback” promise passing the savings back to the buyers. Their AI offering promises even further disruption.

The company is using AI to pull information from the photos supplied by the sellers. Doing this means they can go beyond the standard listing information to personalize the search for the home on a new level.

Nejad noted, “we can spot things like specific cabinets, finished basements or a specific type of backyard.” This adds “a new dimension to the industry.” These AI-enabled image searches “automate the interface, and the image (will) clearly help the home buyer to find the (most) appropriate, more personalized, and relevant sale.”

The company had originally started with standard machine learning solutions. But when generative AI came to the forefront, Nejad realized that it was far superior to standard approaches for this particular type of application. It was also much faster to implement. As a result, their new system is in beta test today.

Iran Reyes Fleitas, VP, global head of engineering, Experience.Monks (Formerly Jam3)

Experience.Monks offers highly creative, technically enabled services for a wide range of major brands around the world. For them, generative AI adds new dimensions to their  offerings.

For example, they would traditionally create one ad for one region. If that was successful, they manually updated those ads for other regions, customizing them for language, locality and ethnicity. This was time and labour intensive work.

Fleitas said they are working to leverage generative AI to allow them to “create an ad on one site, and it creates and replicates that ad in all the regions that you want.” The customization covers language and even the images used. “So what used to happen in a month, now is happening in a few days.”

Another example was their work with Adidas, where, Fleitas noted, “we created a platform that could generate a sneaker in 3D based on user prompts.” Further, and this is the critical point, he noted, the AI will ensure that customizations are within the brand’s guidance. “So in the end, we’re not going to create a Nike sneaker, we’re going to create an Adidas sneaker with all of the personalization of what the users (want).”

He referred to this as “hybrid personalization,” where AI can ultimately allow customers to actively help customize products.

Everyone who has interacted with generative AI is taken by how it feels like conversing with a real human being. Experience.Monks leverages this to captivate their audiences.

The company is using AI to produce surprisingly realistic avatars to be used for customer service. These shockingly realistic avatars not only provide answers to a wide range of questions using natural language, they also detect and respond to emotional cues and sentiment indicators.

AI brings this puppet to life

The company has gone beyond images on screen. It has used AI to animate a mechanical and comical puppet creature used in one of their programs. Usine AI, the puppet, truly comes alive, with lifelike interactions, as it follows facial and verbal cues.

Generative AI made it possible to breathe life into these devices, but also to do so quickly and within the budgets of their customers.

Jean-François (JF) Gailleur, SVP engineering, AlayaCare

AlayaCare is working with AI enabled solutions to address systemic issues of home care that have become more acute with the combination of an aging population, cost restraints and the shortage of trained staff.

AlayaCare is looking to generative AI to deal with three key issues:
– attracting and retaining people
– scheduling
– managing patient data

With a shortage of skilled workers, it’s essential that they get the maximum productivity from everyone in the field without causing huge amounts of stress that could lead to retention problems.

Any time even one person is unexpectedly unavailable for work, it can cause major disruptions and significant staff time to manage. For example, an average home care worker may have 40 clients, all with different conditions and needs. If you have 50 similar workers in an area, that’s a huge population.

So if a worker is off suddenly, the number of permutations of clients, location, special needs and times make even minor adjustments a logistical nightmare. Yet, managing this many permutations and finding the optimal balance is a task perfectly suited to generative AI solutions that can manage this type of scheduling in real time.

Yet another issue faced by healthcare workers is in dealing with the vast amount of data that needs to be collected on a patient. Sorting through that amount of data takes time that could be spent in patient care.

Once again, AI solutions can review this data and do the “heavy lifting” to create and help manage individualized care and risk profiles.  Freed up from sifting through, analyzing and prioritizing records manually, caregivers can have an AI “dashboard” to help manage their work.

Gallieur was careful to note that these applications don’t take the place of trained staff and clinicians, but they free up those trained workers to spend the time where their precious skills are most needed – on patients, treatment and services.

Anne Steptoe, VP of engineering, Wealthsimple 

Wealth Simple already has significant experience with traditional AI solutions in a cloud based environment. As Steptoe noted, “Our company is digital native, born in the cloud, so I think that makes us more agile. Our data warehouse, our production workloads, our ML platform, are all hosted on AWS. We have built our own ML platform (on AWS) … that allows us to be really innovative and have a much faster response to our clients.”

But generative AI solutions in the cloud make the company even more responsive and agile by vastly reducing the time to delivery required by traditional ML. Steptoe noted that recently, the company was able to leverage generative AI to “put out a brand new model in two steps with one line of code.” As she noted, “it’s pretty amazing what we are doing with this technology ourselves.”

Steptoe noted that productivity gains in areas like call centre applications accelerate productivity but also allow their teams to provide the type of oversight that is “making sure they are checking, making sure that (answers) are as accurate as possible.”

Appreciating the strengths and challenges

All of the panelists acknowledged that there were both advantages and challenges to working with generative AI models. None claimed that these models were a panacea. But even in the early stages of generative AI, each company has been able to generate high degrees of productivity, increase customer satisfaction, and have extraordinarily fast time to market with their products, services and ideas.

Generative AI is not ideal for every application, but where it can be employed, its speed and capabilities allow for applications where ML would be too expensive or take too long to implement. It offers speed to delivery which is orders of magnitude faster and cheaper than past approaches. And in some unique areas, like, for example the way it can deal with visual and unstructured data, it has capabilities that are not available from traditional ML applications.

With the right use cases, and with human oversight used strategically, it is, even at this stage of development, a powerful tool for these businesses, and one that will continue to improve over time. As it does, these companies will have the added advantage of having developed the experience to leverage it and exploit its full potential.

The post Five Canadian companies share experiences and use cases for generative AI at AWS re:Invent 2023 first appeared on IT World Canada.

Despite the money being poured into cybersecurity by IT departments, the leading cause of breaches of security controls was the failure of technology to detect an attack, a new survey from Trellix suggests.

Forty-two per cent of respondents to the international survey of infosec leaders whose organization had suffered a recent cyber attack said their technology didn’t detect the breach.

Other top causes (multiple responses were allowed) included a breach due to an attack on the organization’s supply chain (40 per cent); a missed vulnerability (40 per cent); an analyst missing an alert (38 per cent); and password misuse (36 per cent).

More significantly, the number of infosec leaders reporting the root cause of a successful cyber incident was lack of detection is increasing. Respondents said more than three years ago, technology not detecting an attack was the root cause of nine per cent of attacks. But in the past year it was the root cause of 22 per cent of attacks.

“It’s increasingly more likely technology cannot keep up with the attacker’s ability to penetrate their defenses,” the report concludes.

The study, called “The Mind of the CISO: Behind the Breach” interviewed 512 security leaders in medium to large organizations from 13 countries who have managed at least one major cybersecurity incident in the past five years.

Despite the seeming failure of technology to detect many breaches, respondents equally felt that people, processes, and technology needed an overhaul in the IT departments after a successful breach.

Many of those surveyed said in the aftermath of an attack, almost every process and technology was changed (multiple responses were allowed): Forty-six per cent of respondents said they got increased budgets, 44 per cent said they created regular reviews of capabilities, IT infrastructure and staffing, an equal number said they contracted with additional cybersecurity services such as incident response, 42 per cent said they rethought their overall cybersecurity strategy, and 41 per cent said they implemented new frameworks or standards.

Interestingly, few infosec leaders questioned found a successful breach of security controls was devastating to themselves. Ninety-one per cent of respondents slightly or strongly agreed they had an increase in motivation levels during the incident.

“Organizations need to prioritize building cyber resilience to prevent future attacks,” the report concludes. “This requires significant investment in the right people, processes, and technology solutions. As made evident in this research, CISOs are in need of additional resources and support, starting at the board level, to make the required investments, training, and overhaul needed to keep pace with the evolving threat landscape.

“New global regulations and legal ramifications in the wake of cyber incidents should help to prioritize the needs of CISOs moving forward, equipping them with the resources to effectively and efficiently manage cyber threats.”

The post Failure of technology to detect attacks is a prime cause of breaches: Survey first appeared on IT World Canada.

Identity and access provider Okta now says the threat actor who accessed its customer help desk system last month got the names and email addresses of all contacts of organizations that use its support system.

Originally, the company said that, after an investigation, it determined only one per cent of the contacts from its 18,000 customers had information stolen, which included session tokens that could be used to infiltrate the IT networks of those firms. Of that, only a handful of organizations were actually hacked through those tokens.

However, on Wednesday Okta CSO David Bradbury acknowledged the hacker also ran and downloaded a report that contained the names and email addresses of all Okta customer support system users and, for a small number of people, their phone numbers.

“All Okta Workforce Identity Cloud (WIC) and Customer Identity Solution (CIS) customers are impacted except customers in our FedRamp High and DoD IL4 environments (these environments use a separate support system NOT accessed by the threat actor),” he wrote. “The Auth0/CIC support case management system was also not impacted by this incident.”

The file had fields that included the company name, name of the Okta customer that contacted support, and their office and mobile phone numbers. “The majority of the fields in the report are blank,” Bradbury said, “and the report does not include user credentials or sensitive personal data. For 99.6 per cent of users in the report, the only contact information recorded is full name and email address.”

Recognizing that stolen email addresses are a phishing risk, Bradbury added this advice:

“Many users of the customer support system are Okta administrators,” he noted. “It is critical that these users have multi-factor authentication (MFA) enrolled to protect not only the customer support system, but also to secure access to their Okta admin console(s).”

“While 94 per cent of Okta customers already require MFA for their administrators, we recommend ALL Okta customers employ MFA and consider the use of phishing-resistant authenticators to further enhance their security.”

Okta also identified additional reports and support cases that the threat actor accessed, which contain contact information of all Okta-certified users and some Okta Customer Identity Cloud (CIC) customer contacts, and other information. Some Okta employee information was also included in these reports. This contact information does not include user credentials or sensitive personal data, Bradbury said.

On the one hand, that means perhaps hundreds or more of IT staff who have dealt with Okta support may get spear phishing messages that appear to come from the company. On the other hand, the number of companies vulnerable to stolen session tokens hasn’t changed.

The session tokens were included in some Okta HAR files that IT customers uploaded to Okta support to help narrow down the cause of a problem.

SCMagazine.com quoted Ken Westin, field CISO at Panther Labs, saying it’s “irresponsible” of Okta to continue to downplay the compromise by making statements like there’s no “direct evidence” the threat actors are using the compromised data to target these customers.

“If they didn’t know the scope of the compromise or who the unknown actors are, they are not in a position to understand the attackers’ intent or the full risk the breached data poses to their customers. This kind of rhetoric can further erode trust in an already difficult situation,” said Westin. “At this point, it’s best for Okta to stick to facts and be transparent about the breach, so customers can make appropriate decisions about how best to manage the risk. In a world of ‘zero-trust,’ if your identity provider is compromised, it can mean zero security.”

The post All Okta customer support users had their email addresses copied first appeared on IT World Canada.

A group consisting of Canadian university researchers and Ericsson Canada is the latest to have won government funding under the National Cybersecurity Coalition for advanced investigations into meeting cyber threats.

Researchers from Concordia University, the University of Manitoba, the University of Waterloo, and Ericsson said this week they will spend three years on a $2.2 million project looking into using artificial intelligence and automation to improve the security of 5G and future wireless networks. Of that, the partners are putting in $1.2 million, while $1 million will come from a government fund.

The goal is to develop intelligent anomaly detection, mitigation, and prevention mechanisms using machine learning and AI, to give mobile operators automated, closed-loop control security mechanisms that secure their networks against cyber attacks.

“We’re only at the start of 5G,” Paul Baptista, Ericsson Canada’s sales director and former lead of its Montreal site, said in an interview. “There’s going to be evolution of 5G over the next five years. What we’re doing is getting ahead of that by doing research before the releases come to bear around the world.”

Eva Fogelström, director of security at Ericsson Research, noted in an interview that the  company’s Montreal facility has been doing research on cybersecurity for years.

“This is a research project,” she said. “What we are looking at are new solutions and new methodologies for 5G and beyond.” Results of the research, which could be commercialized, will be published.

Azadeh Tabiban, an assistant professor of computer science at the University of Manitoba, said in a statement that the industry-academia collaboration and funding support will enable building practical solutions that can be integrated with real-world environments. “Such a joint effort leads to more transparent and secure 5G networks, which increases the wider adoption of 5G-enabled technologies with cost-effective and life-saving benefits to our society.”

Ottawa has set aside $80 million for projects under the Cyber Security Innovation Network, a public-private initiative announced last year to support the growth of Canada’s cyber security ecosystem. The Coalition, made up of industry and academic members, selects the projects. So far, just over $11 million has been allocated for 20 projects, including $1 million for the 5G project.

The Ericsson group is not the only project looking at the use of AI. A group composed of researchers from Rogers Communications and the University of New Brunswick’s Canadian Institute for Cyber Security have been awarded just under $241,000 to see if AI can be used for vulnerability management.

Other groups are working on finding new ways of digitally fingerprinting customers’ behaviour to cut down on fraud, using what is called emotional AI to identify negative mood and distraction of car drivers, and finding ways of using quantum computing to improve the security of the computer hardware security modules that manage digital keys.

The post Canadian group gets $2.2 million to research AI threat detection for wireless networks first appeared on IT World Canada.

Amazon’s new generative AI assistant, Amazon Q, sounds a lot like OpenAI Q. Are cyber professionals less likely to get fired after a major cybersecurity incident? And AI threatens to kill clergy jobs.

These and more top tech stories on Hashtag Trending.

I’m your host James Roy.

AWS is not lagging behind, just ‘re-invent’-ing a bunch of stuff that many other tech giants released and re-released, a long time ago.

That reinventing, however, mostly consisted of comparing and taking jabs at OpenAI and Microsoft.

The comparison could not be more stark, when AWS introduced Amazon Q – its newest generative AI assistant. Q rings a bell though. It started trending out of the blue a week ago, rumoured to be OpenAI’s latest model, capable of achieving artificial general intelligence. Did Amazon take inspiration from OpenAI, maybe?

AWS also announced that Agents for Amazon Bedrock are now generally available to customers, which looks very similar to the custom GPTs. And it introduced its first-ever in-house LLM models while Microsoft also announced an in-house-built open-source model called phi-2.

And, AWS finally released an image generator joining the ranks of OpenAI, Microsoft, and Google.

To be fair, the goliaths are all doing pretty much the same thing in the ongoing AI juggernaut, so guess how AWS sought to demarcate itself? Responsible AI.

It detailed its advocacy for responsible AI and announced guardrails for Amazon Bedrock. Will that be enough for AWS to actually set itself apart and pick up the pace?

Source: Analytics India Mag, Tech Crunch

Cyber professionals have long feared getting fired after a cyber incident. But that might be changing.

Trellix’s “The Mind of the CISO” report revealed that only 13 percent of the 500 chief information security officers surveyed said their company fired people in the first year, following a major cybersecurity incident.

Instead, companies are likely to increase cybersecurity budgets in the immediate aftermath of an event.

46 per cent of CISOs said their companies increased budgets for new tools and technologies, 38 per cent created new jobs and 44 per cent added new contracted services to their cybersecurity program, post incident.

The report, however, notes that post-incident job losses are still happening. Not immediately, but eventually, after a company understands what happened.

31 per cent of CISOs said their companies fired people more than three years after the event.

The report says, “Perhaps impacts to the team aren’t an immediate change following an incident but occur as time passes, when the dust has settled, and CISOs look to restructure or make team overhauls.”

Source: Axios

Okta has admitted that the scale of its October data breach could be potentially much larger. 

The company’s chief security officer, David Bradbury, originally said that the files of just 134 Okta customers or less than one percent were accessed by attackers.

But an update published this morning revealed that the data related to every single Okta customer support system was accessed.

For 99.6 percent of customers, the data accessed was the full name and their email address.

Bradbury said, “While we do not have direct knowledge or evidence that this information is being actively exploited, there is a possibility that the threat actor may use this information to target Okta customers via phishing or social engineering attacks.”

Okta advised all its customers to employ multi-factor authentication and consider the use of phishing-resistant authenticators to further enhance their security.

Source: The Register

Researchers at Google DeepMind claim that they have been able to demonstrate that AI can acquire capabilities by social learning. 

Social learning is how one individual or animal acquires skills from another by copying.

In a physical simulated task space called GoalCycle3D — a sort of computer-animated playground with footpaths and obstacles — they found AI agents could learn from both human and AI experts across a number of navigational problems, even though they had never seen a human or had any idea what one was.

The study said, “Our agents succeed at real-time imitation of a human in novel contexts without using any pre-collected human data. We identify a surprisingly simple set of ingredients sufficient for generating cultural transmission and develop an evaluation methodology for rigorously assessing it. This paves the way for cultural evolution to play an algorithmic role in the development of artificial general intelligence.”

Source: The Register 

The fate of the Apple Card and the Apple Savings Account is up in the air after Apple and Goldman Sachs ended their partnership.

This news comes as rumours swirled that Goldman Sachs was looking for a way out of its deal with Apple. Regulatory filings show that the company has lost a lot of money on the Apple Card partnership so far.

In a statement to CNBC, Apple said that it will “continue to innovate” for Apple Card customers.

Apple has also been working to bring as many of its financial products in-house as possible. 

Reportedly, it is developing its own payment processing technology and infrastructure, called   “Project Breakout” that would make it less reliant on partners such as Goldman Sachs.

Source: 9TO5Mac

And here’s another one on the nail-biting relationship between AI and religion, which by the day gets more ridiculous.

The UK’s Department for Education found that the country’s clergy, of all things, is among the professions most at risk from AI.

A number of jobs ranked above the clergy as more likely to be taken over by AI. They include telephone salespersons at the top, further education teaching professionals, market and street traders and assistants, legal professionals, and more.

(Psychologists also feature in that list, really.)

But the researchers admitted that the report’s usefulness is limited. They emphasize that “the estimates of which jobs are more exposed to AI are based on a number of uncertain assumptions, so the results should be interpreted with caution.”

Plus, just because you can automate the writing of a sermon, does not mean you should or that it’ll completely erode the quintessential human experience of religion.

But, some other cases continue to raise eyebrows. Like when 300 churchgoers attended a service led by OpenAI’s LLM in Germany. Or as we reported in a previous episode, when tech entrepreneur Anthony Levandowski decided to bring back his idea of an AI church, and make AI the ultimate God to pray to.

Source: The Register

And that’s the top tech news for today.

Hashtag Trending goes to air 5 days a week with a special weekend interview show we call “the Weekend Edition.”

You can get us anywhere you get audio podcasts and there is a copy of the show notes at itworldcanada.com/podcasts 

And while we cover cybersecurity stories that we think are of general interest, you can keep really up to date on cybersecurity with our podcast featuring security journalist Howard Solomon. It’s called CybersecurityToday.  It’s rated as one of North America’s top 10 tech podcasts.

I’m your host James Roy.  Have a Thrilling Thursday!

The post Hashtag Trending Nov.30-Amazon’s new generative AI assistant; Cyber pros less likely to get fired post-incident; AI can acquire skills through social learning? first appeared on IT World Canada.

After months of pushback and meetings, Google has finally struck a deal with the Canadian government over the enactment of Bill C-18, which is expected to come into effect in about two weeks.

“Following weeks of productive discussions, I am happy to announce that we have found a path forward with Google for the implementation of the Online News Act,” said Heritage Minister Pascale St-Onge. “This will benefit the news sector and allow Google to continue to play an important role in giving Canadians access to reliable news content.”

The legislation, which received Royal Assent in June, forces Google and Meta to enter into agreements with news publishers to pay them for linking to their content.

Meta, has as a result, blocked news links in Canada. Google threatened to do the same, but also expressed interest in working out a resolution with the government.

As part of the agreement, Google will contribute C$100 million in financial support annually, indexed to inflation, for a wide range of news businesses across the country, including independent news businesses and those from Indigenous and official-language minority communities.

This is lower than what the government initially estimated, whereby it proposed a formula forcing Google and Meta to cough up four per cent of their annual Canadian search revenue, or C$172 and C$62 million, respectively. That remained unpalatable to Google, which insisted on a firm cap on its financial liability.

“We thank the Minister of Canadian Heritage, Pascale St-Onge, for acknowledging our concerns and deeply engaging in a series of productive meetings about how they might be addressed, ” said Kent Walker, president, global affairs, Google.

Another win for Google is the option to work with a single collective to distribute its contribution to all interested eligible news businesses. That would help the company limit its arbitration risk.

“We’re pleased we will be able to continue sending valuable traffic to Canadian publishers while we are in the process of receiving an exemption based on agreed upon contributions to support the Canadian news ecosystem,” said Google.

The government has not resumed talks with Meta, and news links remain blocked on Facebook and Instagram.

The post Google reaches an agreement with the government of Canada over Bill C-18 first appeared on IT World Canada.