Analysis of 400,000 healthy adults finds 4% higher mortality risk among those taking the supplements

Taking a daily multivitamin does not help people to live any longer and may actually increase the risk of an early death, a major study has found.

Researchers in the US analysed health records from nearly 400,000 adults with no major long-term diseases to see whether daily multivitamins reduced their risk of death over the next two decades.

Continue reading...

💾

© Photograph: Oleg Breslavtsev/Getty Images

💾

© Photograph: Oleg Breslavtsev/Getty Images

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime New Report Urges Public-Private Collaboration to Reduce Chemical, Nuclear AI Risks Chris Riotta (@chrisriotta) • June 25, 2024     The U.S. federal government warned that artificial intelligence lowers the barriers to conceptualizing and conducting […]

La entrada US DHS Warns of AI-Fueled Chemical and Biological Threats – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Artificial Intelligence & Machine Learning , Governance & Risk Management , Next-Generation Technologies & Secure Development Companies Eager for Tools Are Putting AI’s Transformative Power Ahead of Security Rashmi Ramesh (rashmiramesh_) • June 25, 2024     Oh, no – not all Ollama administrators have patched against the “Probllama” flaw. […]

La entrada Patched Weeks Ago, RCE Bug in AI Tool Still a ‘Probllama’ – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Healthcare , Industry Specific , Standards, Regulations & Compliance John Riggi of the American Hospital Association on HHS’ Upcoming Cyber Regulations Marianne Kolbasuk McGee (HealthInfoSec) • June 25, 2024     John Riggi, national cybersecurity and risk adviser, American Hospital Association White House efforts to ratchet up healthcare sector cybersecurity […]

La entrada Why New Cyber Penalties May Strain Hospital Resources – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 3rd Party Risk Management , Cybercrime , Fraud Management & Cybercrime More Victims of Campaign Against Data Warehousing Platform Snowflake Come to Light Mathew J. Schwartz (euroinfosec) • June 25, 2024     Attention Neiman Marcus shoppers: Your contact information may be for sale on a criminal forum. (Image: Shutterstock) […]

La entrada Luxury Retailer Neiman Marcus Suffers Snowflake Breach – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Immutable backups are essential in the fight against ransomware, and businesses should put protections in place to ensure attackers can’t alter or delete them. Acronis President Gaidar Magdanurov said data protection firms must address the threat of ransomware by implementing immutable storage and exposing APIs for seamless integration with security […]

La entrada Securing Data With Immutable Backups and Automated Recovery – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

ATLANTA — June TK, 2024 — Cyble, the leading provider of AI-driven cybersecurity solutions, has been recognized by Forrester (Nasdaq: FORR) in its report, The Attack Surface Management Solutions Landscape, Q2 2024 Report.  This report offers valuable insights for organizations seeking to evaluate and select an attack surface management (ASM) solution that aligns with their unique attack surfaces and threats. It provides an overview of the ASM solutions market, explores the value that security and risk (S&R) professionals can expect from ASM vendors, and offers guidance on vendor options based on company size and market focus. It also notes how ASM is essential for building a proactive program, offering valuable insights that enhance SecOps solutions.   “We provide organizations with the tools and insights they need to proactively identify and mitigate potential cyber threats before they escalate. Our inclusion in the Forrester report will only further the resolve," said Beenu Arora, Founder and CEO of Cyble. “Cyble develops AI-powered solutions that help businesses protect their digital assets and maintain a strong security posture, and we’re constantly innovating to help customers keep pace with the rapidly evolving threat landscape.”  Cyble Vision X, the successor to its award-winning Cyble Vision 2.0 threat intelligence platform elevates the user experience by empowering decision-makers with immediate access to critical information through its AI-powered insights and intuitive design. The platform covers the entire breach lifecycle, encompassing pre-breach, during-breach, and post-breach stages. 

Key Capabilities of Cyble Vision X include: 

• Attack Surface Management: Ensures digital security by identifying and mitigating threats.  

• Brand Intelligence: Comprehensive protection against online brand abuse, including brand impersonation, phishing, and fraudulent domains. 

• Cyber Threat Intelligence: Helps organizations gain insights and enhance their defense with AI-driven analysis and continuous threat monitoring. 

• Dark Web and Cyber Crime Monitoring: Helps organizations stay vigilant and ahead of cybercriminals 

• Third-Party Risk Management (TPRM):  Helps organizations identify, assess, and mitigate risks that may arise from a business's interactions with third parties. 

"By leveraging Cyble Vision X’s unmatched coverage, organizations gain total visibility and control over their attack surface, ensuring a robust security posture amid evolving cyber threats," added Arora.  Cyble’s ASM is powered by ODIN, a groundbreaking attack surface monitoring capability that scans the entire IPv4 and IPv6 space. ODIN empowers infosec teams with an accurate map of the internet, enabling them to fortify their security perimeter and proactively hunt for threats on their attack surface. To learn more about ODIN, Cyble Vision X, and how Cyble can help you stay ahead of cyber threats, visit www.cyble.com.  About Cyble:  Cyble, a trailblazer in Cyber Threat Intelligence, is committed to democratizing Dark Web Threat Intelligence through advanced AI and Machine Learning solutions. Recognized as one of the most sought-after workplaces, Cyble’s culture fosters innovation, collaboration, and professional growth.  With a proven track record in delivering cutting-edge research and proactive monitoring, Cyble stands at the forefront of the cybersecurity landscape. Headquartered in Atlanta, Georgia, with a global presence spanning Australia, Malaysia, Singapore, Dubai, Saudi Arabia, and India, Cyble is the trusted authority empowering organizations to proactively combat evolving cyber threats. Media Contact  Matt McLoughlin  matt@gregoryfca.com Cyble Inc.  enquiries@cyble.com  Ph: +1 678 379 3241  

Centre for Long-Term Resilience calls on next government to log incidents to mitigate risks

The UK needs a system for recording misuse and malfunctions in artificial intelligence or ministers risk being unaware of alarming incidents involving the technology, according to a report.

The next government should create a system for logging incidents involving AI in public services and should consider building a central hub for collating AI-related episodes across the UK, said the Centre for Long-Term Resilience (CLTR), a thinktank.

Continue reading...

💾

© Photograph: Jonathan Raa/NurPhoto/REX/Shutterstock

💾

© Photograph: Jonathan Raa/NurPhoto/REX/Shutterstock

UK researchers say study shows stopping use of the drugs is possible at scale without costly therapy

Almost half of long-term antidepressant users could stop taking the medication with GP support and access to internet or telephone helplines, a study suggests.

Scientists said more than 40% of people involved in the research who were well and not at risk of relapse managed to come off the drugs with advice from their doctors.

Continue reading...

💾

© Photograph: Liudmila Dutko/Alamy

💾

© Photograph: Liudmila Dutko/Alamy

The high-severity CVE-2024-5806 allows cyberattackers to authenticate to the file-transfer platform as any valid user, with accompanying privileges.

This case remains alarming despite his release. The battle for press freedom must be vigorously pursued

Julian Assange should never have been charged with espionage by the US. The release of the WikiLeaks founder from custody in the UK is good news, and it is especially welcome to his family and supporters. He is due to plead guilty to a single charge of conspiring to obtain and disclose classified US national defence documents at a hearing early on Wednesday, but is not expected to face further jail time. The court in Saipan, a remote Pacific island which is a US territory, is expected to approve the deal, crediting him for the five years he has already spent on remand in prison.

His opportunity to live with his young family comes thanks to Australian diplomacy under the prime minister, Anthony Albanese, who had made clear his desire for a resolution, and the Biden administration’s keenness to get a controversial case off its plate, particularly in an election year. Seventeen of the charges have been dropped. The one that remains, however, is cause for serious alarm. It was the Trump administration that brought this case. But while the Biden administration has dropped 17 of the 18 charges, it insisted on a charge under the 1917 Espionage Act, rather than the one first brought against him of conspiracy to commit computer intrusion.

Continue reading...

💾

© Photograph: WikiLeaks/AFP/Getty Images

💾

© Photograph: WikiLeaks/AFP/Getty Images

Seventy years after research linked cigarettes with cancer, tighter controls have been delayed once again

Seventy years ago, the British government recognised that smoking caused lung cancer, thanks to a breakthrough in medical science. In an interview to mark the anniversary, Sir Richard Peto, a pioneer in this area, highlighted one way in which the discovery was significant. It led, he said, to a boost for public health comparable with 19th-century improvements in sewerage and water quality.

The shift in attitudes to smoking did not happen suddenly. The tobacco and vapes bill championed by Rishi Sunak, which fell when he called an election, was the culmination of a decades-long process. If the law is resurrected by the next government – as seems likely given the inclusion of similar measures in Labour’s manifesto – it will become illegal to sell tobacco to anyone born since 2009, and vapes will be more tightly controlled.

Continue reading...

💾

© Photograph: Tolga Akmen/EPA

💾

© Photograph: Tolga Akmen/EPA

Britons increasingly seeking cheap weight loss surgery and hair transplants abroad

The NHS is having to provide emergency care to rising numbers of patients suffering serious complications following weight loss surgery and hair transplants abroad amid a “boom” in medical tourism, doctors have warned.

Medics said they were being left to “pick up the pieces” as more Britons seeking cheap operations overseas return with infections and other issues. In some cases, patients are dying as a result of botched surgeries performed in other countries.

Continue reading...

💾

© Photograph: Caiaimage/Robert Daly/Getty Images

💾

© Photograph: Caiaimage/Robert Daly/Getty Images

Source: www.databreachtoday.com – Author: 1 Critical Infrastructure Security , Incident & Breach Response , Network Firewalls, Network Access Control US Cyber Defense Agency Says Major Cyberattack Result of Vulnerable Ivanti Products Chris Riotta (@chrisriotta) • June 24, 2024     CISA’s Chemical Security Assessment Tool houses sensitive private sector chemical security plans. (Image: Shutterstock) The […]

La entrada CISA Confirms Cyberattack on Critical Chemical Security Tool – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Cybercrime , Fraud Management & Cybercrime , Incident & Breach Response Auto Dealership Software Firm Says Restoring Service Will Take ‘Days and Not Weeks’ Chris Riotta (@chrisriotta) • June 24, 2024     CDK Global supplies software solutions to an estimated 15,000 car dealerships in the U.S. and Canada. (Image: […]

La entrada CDK Begins Restoring Systems Amid Ransomware Payment Reports – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Endpoint Security , Hardware / Chip-level Security Chipmaker Arm Is Not an Alliance Member Akshaya Asokan (asokan_akshaya) • June 24, 2024     CHERI backers hope a new alliance will result in industry adoption of the memory safety chip architecture. (Image: Shutterstock) Developers of a computer hardware project for stopping […]

La entrada CHERI Backers Form Alliance to Promote Memory Safety Chip – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Cyberwarfare / Nation-State Attacks , Fraud Management & Cybercrime , Geo Focus: Asia Espionage Group Used SoftEther VPN Client to Exploit Targeted Networks Jayant Chakravarti (@JayJay_Tech) • June 24, 2024     Taipei city skyline (Image: Shutterstock) A Chinese state-sponsored group tracked as RedJuliett is using open-source VPN client SoftEther […]

La entrada Chinese Hackers Caught Spying on Taiwanese Firms – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Chris Schueler Chief Executive Officer, Simeio Chris Schueler, as Chief Executive Officer, drives the overall vision and strategy for Simeio. He is a proven leader with extensive experience in Go To Market, Operations, and Product Development in the managed security services space. He joined Simeio from Trustwave; leading all aspects […]

La entrada Live Webinar | Taking the Challenges Out of Identity Security – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Thank you for registering with ISMG Complete your profile and stay up to date Need help registering? Contact Support Original Post url: https://www.databreachtoday.com/webinars/webinar-just-in-time-access-reducing-risks-improving-velocity-w-5696 Category & Tags: – Views: 0

La entrada Webinar | Just-In-Time Access: Reducing Risks and Improving Velocity – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Bruce Johnson Senior Director, Enterprise Security, TekStream Bruce Johnson has over 38 years of experience in the information technology industry, including security, infrastructure architecture, software development, and management of multiple portfolios. He has experience in Splunk, security solutions, cloud migration, portal, content workflow, integration, and project management. As the senior […]

La entrada Webinar | Transforming Cybersecurity with Collaborative MDR Solution – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Account Takeover Fraud , AI-Based Attacks , Anti-Phishing, DMARC Presented by KnowBe4     60 mins     Social engineering and phishing are not just IT buzzwords; they are potent threats capable of causing devastating damage to your organization. Bad actors and the technology they use to infiltrate your defenses […]

La entrada Webinar | Everything You Can Do to Fight Social Engineering and Phishing – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 The average large company has close to 3,000 vendors. Payment fraud is the top risk to companies across the globe. Business email compromise is continually on the rise, and now attackers can use generative AI to refine their social engineering techniques. We need FinSecOps, said Johnny Deutsch, co-founder and CEO […]

La entrada Fighting Payment Fraud by Integrating Security Into Finance – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

John Podesta, Biden’s top climate official, calls for other big economies to step in to help poorer states

The US will “continue to be a leader” in climate finance, the White House’s top climate official has promised, though without specifying how much it would provide to poor countries.

John Podesta, senior adviser to Joe Biden on international climate policy, also defended the large-scale US expansion of gas production, saying the world was fortunate America was strengthening its supply, given the demand for non-Russian sources after the invasion of Ukraine.

Continue reading...

💾

© Photograph: Jordan Vonderhaar/Bloomberg via Getty Images

💾

© Photograph: Jordan Vonderhaar/Bloomberg via Getty Images

When transitioning to remote work, the dynamics drastically change from working within a dedicated office environment tailored to the tasks at hand. Adjusting to this new setting can pose challenges in ensuring responsible handling of sensitive company data. In this article, The Cyber Express (TCE) Team delves into essential cybersecurity measures your company should implement or may already have in place. TCE also emphasizes actions one can take personally, whether they're accessing networks from home or public locations. Both employers and employees share the responsibility of adhering to strong security protocols, especially with the rise of cyber threats. As organizations increasingly prioritize data protection and server security, it's crucial to stay informed about the latest cybersecurity tips for remote work environments. Keep reading to discover key steps to strengthen your cybersecurity posture while working remotely.

Cybersecurity Tips for Remote Workers

Cyber hygiene encompasses all practices and steps taken to prevent your accounts and devices from becoming vulnerable to cyber threats. It's about maintaining the cleanliness of your digital identity and understanding the real-life consequences that neglecting it can bring. In this article, The Cyber Express (TCE) team will highlight common cyber hygiene mistakes that jeopardize hygiene. These mistakes can range from overlooked steps like using password managers, firewalls, and VPNs, to ignoring seemingly basic practices such as regular software updates and strong password creation. Keep reading to discover how these actions can significantly impact your cybersecurity:

Common Cyber Hygiene Mistakes

Ignoring Software Updates

Software updates include new patches for security vulnerabilities discovered since the last update. Ignoring these updates exposes systems to potential attacks that exploit known weaknesses. Hackers target outdated software because vulnerabilities are public knowledge. Regularly updating all software, including operating systems and applications, is crucial for maintaining security. Automated updates are effective in ensuring software remains up-to-date without relying on manual checks.

Lack of Good Email and Phishing Practices

Email remains a common target for cyberattacks like phishing and malware distribution. Clicking on links or downloading attachments from unfamiliar or suspicious sources can compromise data security. Phishing emails often appear legitimate but aim to steal sensitive information. Practice caution by verifying senders' identities, checking for suspicious domain names or altered spellings, and using spam filtering tools. Avoid sharing personal information via email to prevent identity theft and fraud.

Using Weak, Guessable Passwords

Weak passwords like "password123" are easily guessed or cracked using automated tools, posing a significant security risk. Reusing passwords across multiple accounts amplifies this risk—if one account is compromised, others sharing the password become vulnerable. Create strong passwords with a mix of uppercase and lowercase letters, numbers, and special characters unrelated to personal information. Consider using password managers for generating and securely storing complex passwords.

Neglecting Antivirus and Antimalware Programs

Antivirus and antimalware programs are essential for detecting and removing malicious software that can compromise data security. Failure to install or update these programs leaves devices vulnerable to viruses, ransomware, and spyware. Regular scans and real-time protection features mitigate potential infections, safeguarding against cyber threats.

Not Implementing Two-Factor Authentication (2FA)

Two-factor authentication adds an extra layer of security by requiring a second verification method, such as a code sent to a phone or facial recognition, in addition to a password. Ignoring 2FA leaves accounts reliant solely on passwords, vulnerable if passwords are compromised. Enable 2FA where available, especially for accounts containing sensitive information, to enhance security.

Failing to Back Up Data

Regular data backups are crucial for protecting against data loss due to hardware failures, malware, or accidental deletion. Backups stored in multiple locations, including external drives or cloud services, ensure data can be restored if the primary source is compromised. Automated backup solutions simplify this process, minimizing the risk of significant data loss.

Using Unsecured Wi-Fi Networks

Public or unsecured Wi-Fi networks expose transmitted data to interception by cybercriminals. Hackers can easily capture login credentials, personal information, and financial data transmitted over these networks. Avoid accessing sensitive accounts or financial transactions over public Wi-Fi. Use a virtual private network (VPN) to encrypt internet connections and secure data transmission. Ensure home Wi-Fi networks are secured with strong passwords and encryption protocols.

Failing to Utilize Firewalls

Firewalls prevent unauthorized access between devices and the internet, essential for blocking external threats like hackers attempting to breach systems. Both hardware and software firewalls monitor and control network traffic based on predefined security rules. Enable firewalls on all connected devices, including computers and routers, to fortify network security against external threats.

Neglecting Device Encryption

Device encryption converts data into unreadable code, protecting it from unauthorized access if devices are lost or stolen. Ignoring encryption leaves sensitive information vulnerable to exploitation by anyone gaining physical access to devices. Enable built-in encryption tools offered by modern operating systems to ensure data remains secure against unauthorized access.

Sharing Excessive Information on Social Media

Oversharing personal details on social media increases vulnerability to social engineering attacks and identity theft. Information like birthdates, addresses, and family member names can be exploited to guess weak passwords or craft personalized phishing attacks. Protect yourself by limiting personal information shared online, adjusting privacy settings, and exercising caution with friend requests from unknown individuals.

Small increase in temperature of intruding water could lead to very big increase in loss of ice, scientists say

A newly identified tipping point for the loss of ice sheets in Antarctica and elsewhere could mean future sea level rise is significantly higher than current projections.

A new study has examined how warming seawater intrudes between coastal ice sheets and the ground they rest on. The warm water melts cavities in the ice, allowing more water to flow in, expanding the cavities further in a feedback loop. This water then lubricates the collapse of ice into the ocean, pushing up sea levels.

Continue reading...

💾

© Photograph: Planet Observer/Universal Images Group/Getty Images

💾

© Photograph: Planet Observer/Universal Images Group/Getty Images

Meet Zakir Hussain Rangwala, CEO of BD Software Distribution Pvt. Ltd., a seasoned expert with over two decades in the IT and cybersecurity realms. His journey spans from navigating traditional virus protections to spearheading AI-driven defence strategies against today's sophisticated cyber threats. In this interview with The Cyber Express, Rangwala shares pivotal insights on cybersecurity dynamics, leadership strategies, and the future of digital security.

Zakir Hussain Interview Excerpts

TCE: With over 20 years of experience in the IT and cybersecurity industry, you must have seen many changes. What significant shifts in cybersecurity threats and defences have you witnessed over the years, and how have these changes impacted your approach to securing digital environments? Zakir Hussain: Over the past two decades, cybersecurity has evolved significantly from basic virus and malware defences to tackling advanced threats such as ransomware, nation-state attacks, and zero-day exploits. Initially centered on perimeter defences, the shift is now towards zero-trust models and sophisticated threat detection. The proliferation of cloud computing, IoT, and remote work has widened attack surfaces, requiring continuous monitoring and AI-driven analytics. Today, effective cybersecurity demands a proactive, layered approach that incorporates real-time threat intelligence, ongoing user education, and resilient defence mechanisms. This holistic strategy is essential to safeguarding complex digital environments against evolving cyber threats. TCE: Given your extensive expertise in antivirus and security solutions, what do you believe are the most critical features that a security solution should offer to effectively protect against today's sophisticated threat landscape? Are there any particular technologies or strategies that you consider indispensable? Zakir Hussain: In the current complex threat environment, an effective security solution must encompass several critical features: real-time threat detection, AI-driven analytics, and thorough endpoint protection. Zero Trust Architecture is essential, enforcing rigorous identity verification for all access attempts. Behavioural analysis plays a pivotal role in detecting anomalies in user and network behaviours. Robust encryption protocols secure data both in storage and transit. Automated incident response capabilities facilitate rapid mitigation of breaches. Integration of threat intelligence ensures defences stay ahead of emerging threats. Moreover, ongoing user education and frequent security assessments are indispensable for maintaining a strong security posture amidst continuous digital advancements. TCE: Educating and convincing distributors and partners about the importance of advanced cybersecurity measures can be challenging. How do you approach this task, and what strategies have proven most effective in gaining their buy-in and ensuring they understand the critical nature of robust cybersecurity? Zakir Hussain: Educating and convincing distributors and partners about advanced cybersecurity requires a multifaceted strategy. We provide interactive training sessions focusing on real-world cyber threats and their implications. Use case studies to illustrate the consequences of inadequate security. We provide educations to demonstrate the long-term benefits of cybersecurity investments. Foster open communication and provide ongoing support to address concerns. Implement pilot programs to showcase the effectiveness of advanced measures. Building a collaborative relationship based on shared responsibility is crucial for gaining their buy-in and commitment to enhancing cybersecurity practices. Marketing assistance, including co-branded materials and campaigns, aids partners in effectively showcasing our solutions. TCE: Emerging technologies like AI and machine learning are increasingly becoming part of the cybersecurity landscape. In your opinion, what role do these technologies play in the future of cybersecurity, and how can they be leveraged to enhance threat detection and response capabilities? Zakir Hussain: AI and machine learning are transformative in cybersecurity, revolutionizing threat detection and response capabilities. By analyzing vast datasets in real time, they identify patterns and anomalies that signal cyber threats. Machine learning models adapt to new attack vectors, enhancing accuracy in threat prediction and prevention. AI automates response actions swiftly, mitigating risks faster than manual methods. These technologies also bolster user behaviour analytics, pinpointing insider threats and minimizing false alarms. Leveraging AI and machine learning enables organizations to adopt a proactive, resilient defence stance against evolving and sophisticated cyber threats. TCE: With the proliferation of digital downloads and online services, ensuring their security is paramount. What specific measures do you recommend for safeguarding these platforms against cyber threats, and how can organizations implement these measures effectively? Zakir Hussain: To protect digital downloads and online services, organizations must prioritize secure coding practices, routine code reviews, and vulnerability assessments. Strong encryption for data in transit and at rest, coupled with multi-factor authentication (MFA), is essential to thwart unauthorized access. Regular updates and comprehensive patch management are vital to maintain system security. Web application firewalls (WAFs) should be deployed to defend against common threats such as SQL injection and cross-site scripting. Continuous threat monitoring and a well-defined incident response plan are critical for timely threat mitigation. Effective implementation requires ongoing staff training, strict adherence to security policies, and regular system audits to ensure robust protection. TCE: What initially motivated you to enter the field of IT and cybersecurity, and how has your passion for this field evolved over the years? Are there any pivotal moments or experiences that particularly influenced your career path? Zakir Hussain: I was initially drawn to IT and cybersecurity by a fascination with technology's transformative potential and a desire to solve complex puzzles. Over the years, my passion has evolved through hands-on experience, witnessing the critical importance of safeguarding digital infrastructures and data against evolving threats. Pivotal moments include encountering real-world cyber incidents that underscored the impact of security breaches, and collaborating with diverse teams globally, which broadened my perspective on international cybersecurity challenges. These experiences continue to fuel my commitment to advancing security measures and promoting resilient digital environments in an increasingly interconnected world. TCE: As a team leader, how do you keep your team motivated and informed about the latest developments in cybersecurity? What strategies do you use to foster a culture of continuous learning and adaptability within your team? Zakir Hussain: As a team leader in cybersecurity, I prioritize motivation and continuous learning by fostering an environment where knowledge sharing and professional development are central. Regular team meetings and online sessions keep everyone informed about the latest cybersecurity developments and trends. Encouraging participation in industry conferences, webinars, and certification programs ensures ongoing skill enhancement. I promote a culture of adaptability by encouraging experimentation with new tools and techniques, emphasizing learning from both successes and challenges. Recognizing and celebrating achievements further boosts morale, reinforcing the team's dedication to staying at the forefront of cybersecurity practices. TCE: In light of your extensive experience with distributors and channel partners, what advice would you give to someone looking to build strong, effective relationships within the cybersecurity industry? How can these relationships be leveraged to enhance cybersecurity efforts? Zakir Hussain: Establishing robust relationships with distributors and channel partners in cybersecurity hinges on trust, communication, and mutual benefit. Take the time to comprehend their business objectives and obstacles. Assist with training, marketing tools, and joint sales initiatives. Collaborate closely on customer deployments and incident responses. Regularly exchange insights on emerging threats and industry trends to foster a proactive alliance. By aligning goals and leveraging respective strengths, these partnerships can bolster cybersecurity efforts, enabling broader market reach, quicker response capabilities, and more enhanced solutions that address the evolving demands of customers effectively.

Two prominent unions are teaming up to challenge Amazon, reports the New York Times — "after years of organizing Amazon workers and pressuring the company to bargain over wages and working conditions." Members of the Amazon Labor Union "overwhelmingly chose to affiliate with the 1.3-million-member International Brotherhood of Teamsters" in a vote last Monday. While the Amazon Labor Union (or ALU) is the only union formally representing Amazon warehouse workers anywhere in America after an election in 2022, "it has yet to begin bargaining with Amazon, which continues to contest the election outcome." Leaders of both unions said the affiliation agreement would put them in a better position to challenge Amazon and would provide the Amazon Labor Union with more money and staff support... The Teamsters are ramping up their efforts to organize Amazon workers nationwide. The union voted to create an Amazon division in 2021, and O'Brien was elected that year partly on a platform of making inroads at the company. The Teamsters told the ALU that they had allocated $8 million to support organizing at Amazon, according to ALU President Christian Smalls, and that the larger union was prepared to tap its more than $300 million strike and defense fund to aid in the effort... The Teamsters also recently reached an affiliation agreement with workers organizing at Amazon's largest airplane hub in the United States, a Kentucky facility known as KCVG. Experts have said unionizing KCVG could give workers substantial leverage because Amazon relies heavily on the hub to meet its one- and two-day shipping goals. Their agreement with the Teamsters says the Amazon Labor Union will also "lend its expertise to assist in organizing other Amazon facilities" across America, according to the article.

Read more of this story at Slashdot.

In today's digital age, staying informed about the latest developments in cybersecurity is crucial. Cyber threats are constantly evolving, and staying ahead of these challenges requires up-to-date knowledge and proactive measures. TCE Cyberwatch is here to provide you with a comprehensive weekly roundup of the most significant cybersecurity news, trends, and insights. Each week, we delve into the latest breaches, emerging threats, advancements in security technology, and critical updates from the cybersecurity world. Whether it's a major data breach affecting millions, a new vulnerability discovered in popular software, or innovative strategies to enhance your defenses, TCE Cyberwatch covers it all. Read on and find out what was the most relevant news in the world of cybersecurity this week.

TCE Cyberwatch: A Weekly Round Up

CISA Issues Urgent Advisories to Patch Critical Flaws in Industrial Control Systems

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued 20 advisories to address vulnerabilities in Industrial Control Systems (ICS). These advisories offer detailed technical information and mitigation strategies for various ICS components. Key vulnerabilities include CVE-2024-33500 in Siemens Mendix Applications, which poses remote exploitation risks due to improper privilege management, and issues in Siemens SIMATIC S7-200 SMART devices that can lead to denial-of-service attacks. Additional affected systems include Siemens TIA Administrator, SCALANCE devices, Fuji Electric’s Tellus Lite, and Rockwell Automation’s FactoryTalk View SE. CISA stresses the importance of timely updates, network access restrictions, and strict adherence to security protocols. Although no public exploits have been identified, CISA recommends proactive measures such as network segmentation and secure remote access to bolster ICS resilience against cyber threats. Read More

Microsoft Vows Security Overhaul After U.S. Report

Microsoft has faced severe criticism over its cybersecurity measures, highlighted by a U.S. Cyber Safety Review Board (CSRB) report detailing multiple security failures. These failures include a July 2023 attack by Chinese actors on senior U.S. officials' email accounts. Despite pledges to prioritize security, issues have been compounded by the flawed rollout of the Windows Recall feature. In a House Committee hearing, Microsoft President Brad Smith acknowledged these failings, accepted responsibility, and outlined plans for improvement. These measures include integrating security into executive bonuses and employee reviews, adding 1,600 security engineers, and expanding senior-level oversight. Microsoft is also addressing all CSRB recommendations and enhancing identity protection, network security, and threat detection. Smith emphasized the ongoing battle against cyberattacks, noting that Microsoft detects nearly 4,000 password-based attacks per second. Read More

Over 300 Fake Paris 2024 Sites Target Olympic Ticket Buyers

As the Paris 2024 Summer Olympics approach, security researchers and officials have identified over 300 fraudulent ticketing sites exploiting legitimate Olympics branding to scam users. One notable site, paris24tickets[.]com, appeared professional and ranked highly in Google search results, misleading users into providing personal and financial information. Proofpoint researchers exposed this site as entirely fraudulent, collecting sensitive data instead of processing ticket orders. The French Gendarmerie Nationale has identified 338 scam sites since March 2023, shutting down 51 and putting 140 on notice. Scammers use ads and targeted emails to attract victims, often offering fake discounts. Captain Etienne Lestrelin advises against buying tickets outside official sources, warning that excessively cheap tickets are likely scams and could involve buyers in criminal activities. Read More

Tesla's $45 Billion Payout: Court Battle Looms Over Coercion Claims

Tesla's efforts to reinstate Elon Musk's $45 billion pay package continue to face legal challenges despite shareholder support. The package was nullified by a Delaware judge due to concerns over board independence. Tesla's chair plans to resubmit the deal to the court, but plaintiffs argue the vote was coerced and legally flawed. Richard Tornetta's lawyer, representing the plaintiffs, claims the new vote does not address the initial issues. Legal experts predict ongoing court battles in Delaware, with possible appeals to the state’s supreme court. They also highlight potential coercion by Musk, who threatened to develop AI and robotics outside Tesla if the vote failed. Future pay deals will be governed by Texas law following Tesla's incorporation move, but existing litigation remains in Delaware. Read More

MFA Failure Exposes Millions: Medibank Fined for Massive Data Breach

A lack of multi-factor authentication (MFA) likely caused the Medibank data breach, exposing the personal data of 9.7 million customers in October 2022. The Australian Information Commissioner’s report revealed that hackers stole an IT service desk operator’s credentials via malware on a home device. The compromised VPN lacked MFA, allowing unauthorized access. Ignored security alerts further enabled the attackers to extract 520GB of sensitive data. Medibank's inadequate cybersecurity measures, highlighted in a 2020 risk assessment, included excessive access privileges and the absence of MFA. This negligence led to legal action by Australia's privacy regulator, with potential fines exceeding AU$2 million. Sanctions and arrests followed for the hackers involved. The breach underscores the critical need for MFA, proper alert management, regular security audits, and employee training. Read More

META Stealer Ups the Ante: Encrypted Builds, Custom Stubs in v5.0 Update

META Stealer v5.0 has launched, introducing advanced features and heightened security for this information-stealing malware. Key improvements include TLS encryption for secure communication between the build and the control panel, similar to updates seen in other top stealers like Lumma and Vidar. The update also offers a new build system for generating unique builds, supported by a "Stub token" currency for creating Runtime stubs, enhancing customization. The "Crypt build" option encrypts builds to evade detection during scans, significantly boosting stealth capabilities. Additionally, the panel's security and licensing systems have been upgraded to minimize disruptions. While previous updates, such as version 4.3 in February 2023, introduced features like enhanced detection cleaning and Telegram integration for build creation, version 5.0 focuses on individualized security and continuous improvement. Read More In this week's edition of TCE Cyberwatch, we've covered critical cybersecurity updates, from CISA's advisories on industrial control systems to Microsoft's pledges for security improvements and the exposure of fraudulent Olympic ticketing sites. As cyber threats continue to evolve, staying informed and proactive is essential. By keeping abreast of the latest news and trends, you can better protect your digital assets and stay ahead in the ongoing battle against cyberattacks. Stay vigilant and informed with TCE Cyberwatch.

"The Short Happy Reign of the CD-ROM" was just one article in a Fast Company series called 1994 Week. As the week rolled along they also re-visited Yahoo, Netscape, and how the U.S. Congress "forced the videogame industry to grow up." But another article argues that it's in web pages from 1994 that "you can start to see in those weird, formative years some surprising signs of what the web would be, and what it could be." It's hard to say precisely when the tipping point was. Many point to September '93, when AOL users first flooded Usenet. But the web entered a new phase the following year. According to an MIT study, at the start of 1994, there were just 623 web servers. By year's end, it was estimated there were at least 10,000, hosting new sites including Yahoo!, the White House, the Library of Congress, Snopes, the BBC, sex.com, and something called The Amazing FishCam. The number of servers globally was doubling every two months. No one had seen growth quite like that before. According to a press release announcing the start of the World Wide Web Foundation that October, this network of pages "was widely considered to be the fastest-growing network phenomenon of all time." As the year began, Web pages were by and large personal and intimate, made by research institutions, communities, or individuals, not companies or brands. Many pages embodied the spirit, or extended the presence, of newsgroups on Usenet, or "User's Net." (Snopes and the Internet Movie Database, which landed on the Web in 1993, began as crowd-sourced projects on Usenet.) But a number of big companies, including Microsoft, Sun, Apple, IBM, and Wells Fargo, established their first modest Web outposts in 1994, a hint of the shopping malls and content farms and slop factories and strip mines to come. 1994 also marked the start of banner ads and online transactions (a CD, pizzas), and the birth of spam and phishing... [B]ack in '94, the salesmen and oilmen and land-grabbers and developers had barely arrived. In the calm before the storm, the Web was still weird, unruly, unpredictable, and fascinating to look at and get lost in. People around the world weren't just writing and illustrating these pages, they were coding and designing them. For the most part, the design was non-design. With a few eye-popping exceptions, formatting and layout choices were simple, haphazard, personal, and — in contrast to most of today's web — irrepressibly charming. There were no table layouts yet; cascading style sheets, though first proposed in October 1994 by Norwegian programmer Håkon Wium Lie, wouldn't arrive until December 1996... The highways and megalopolises would come later, courtesy of some of the world's biggest corporations and increasingly peopled by bots, but in 1994 the internet was still intimate, made by and for individuals... Soon, many people would add "under construction" signs to their Web pages, like a friendly request to pardon our dust. It was a reminder that someone was working on it — another indication of the craft and care that was going into this never-ending quilt of knowledge. The article includes screenshots of Netscape in action from browser-emulating site OldWeb.Today (albeit without using a 14.4 kbps modems). "Look in and think about how and why this web grew the way it did, and what could have been. Or try to imagine what life was like when the web wasn't worldwide yet, and no one knew what it really was." Slashdot reader tedlistens calls it "a trip down memory lane," offering "some telling glimpses of the future, and some lessons for it too." The article revisits 1994 sites like Global Network Navigator, Time-Warner's Pathfinder, and Wired's online site HotWired as well as 30-year-old versions of the home pages for Wells Fargo and Microsoft. What did they miss? Share your own memories in the comments. What do you remember about the web in 1994?

Read more of this story at Slashdot.

America's National Labor Relations Board "has filed a complaint against Amazon..." reports the Verge, "that alleges the company 'unlawfully disciplined and terminated an employee' after they assisted in organizing walkouts last May in protest of Amazon's new return-to-work [three days per week] directives, issued early last year." [T]housands of Amazon employees signed petitions against the new mandate and staged a walkout several months later. Despite the protests and pushback, according to a report by Insider, in a meeting in early August 2023, Jassy reaffirmed the company's commitment to employees returning to the office for the majority of the week. The NLRB complaint alleges Amazon "interrogated" employees about the walkout using its internal Chime system. The employee was first put on a performance improvement plan by Amazon following their organizing efforts for the walkout and later "offered a severance payment of nine weeks' salary if the employee signed a severance agreement and global release in exchange for their resignation." According to the NLRB's lawyers, all of that was because the employee engaged in organizing, and the retaliation was intended to discourage "...protected, concerted activities...." The NLRB's general counsel is seeking several different forms of remediation from Amazon, including reimbursement for the employee's "financial harms and search-for-work and work related expenses," a letter of apology, and a "Notice to Employees" that must be physically posted at the company's facilities across the country, distributed electronically, and read by an Amazon rep at a recorded videoconference. Amazon says their actions were entirely unrelated to the workers activism against their return-to-work policies. An Amazon spokesperson told the Verge that instead, the employee "consistently underperformed over a period of nearly a year and repeatedly failed to deliver on projects she was assigned. Despite extensive support and coaching, the former employee was unable to improve her performance and chose to leave the company."

Read more of this story at Slashdot.

An anonymous reader shared this report from the OMG Ubuntu blog: Those of you who own a Framework Laptop 13 — consider me jealous, btw — or are considering buying one in the near future, you may be interested to know that a RISC-V motherboard option is in the works. DeepComputing, the company behind the recently-announced Ubuntu RISC-V laptop, is working with Framework Computer Inc, the company behind the popular, modular, and Linux-friendly Framework laptops, on a RISC-V mainboard. This is a new announcement; the component itself is in early development, and there's no tentative price tag or pre-order date pencilled in... [T]he Framework RISC-V mainboard will use soldered memory and non-upgradeable eMMC storage (though it can boot from microSD cards). It will 'drop into' any Framework Laptop 13 chassis (or Cooler Master Mainboard Case), per Framework's modular ethos... Framework mentions DeepComputing is "working closely with the teams at Canonical and Red Hat to ensure Linux support is solid through Ubuntu and Fedora", which is great news, and cements Canonical's seriousness to supporting Ubuntu on RISC-V. "We want to be clear that in this generation, it is focused primarily on enabling developers, tinkerers, and hobbyists to start testing and creating on RISC-V," says Framework's announcement. "The peripheral set and performance aren't yet competitive with our Intel and AMD-powered Framework Laptop Mainboards." They're calling the Mainboard "a huge milestone both for expanding the breadth of the Framework ecosystem and for making RISC-V more accessible than ever... DeepComputing is demoing an early prototype of this Mainboard in a Framework Laptop 13 at the RISC-V Summit Europe next week, and we'll be sharing more as this program progresses." And their announcement included two additional updates: "Just like we did for Framework Laptop 16 last week, today we're sharing open source CAD for the Framework Laptop 13 shell, enabling development of skins, cases, and accessories." "We now have Framework Laptop 13 Factory Seconds systems available with British English and German keyboards, making entering the ecosystem more affordable than ever." "We're eager to continue growing a new Consumer Electronics industry that is grounded in open access, repairability, and customization at every level."

Read more of this story at Slashdot.

It's been a 1,000 years since there was a significant volcanic eruption from Mount Rainier, CNN reminds readers. It's a full 60 miles from Tacoma, Washington — and 90 miles from Seattle. Yet "more than Hawaii's bubbling lava fields or Yellowstone's sprawling supervolcano, it's Mount Rainier that has many U.S. volcanologists worried." "Mount Rainier keeps me up at night because it poses such a great threat to the surrounding communities, said Jess Phoenix, a volcanologist and ambassador for the Union of Concerned Scientists, on an episode of CNN's series "Violent Earth With Liv Schreiber." The sleeping giant's destructive potential lies not with fiery flows of lava, which, in the event of an eruption, would be unlikely to extend more than a few miles beyond the boundary of Mount Rainier National Park in the Pacific Northwest. And the majority of volcanic ash would likely dissipate downwind to the east away from population centers, according to the US Geological Survey. Instead, many scientists fear the prospect of a lahar — a swiftly moving slurry of water and volcanic rock originating from ice or snow rapidly melted by an eruption that picks up debris as it flows through valleys and drainage channels. "The thing that makes Mount Rainier tough is that it is so tall, and it's covered with ice and snow, and so if there is any kind of eruptive activity, hot stuff ... will melt the cold stuff and a lot of water will start coming down," said Seth Moran, a research seismologist at USGS Cascades Volcano Observatory in Vancouver, Washington. "And there are tens, if not hundreds of thousands of people who live in areas that potentially could be impacted by a large lahar, and it could happen quite quickly." The deadliest lahar in recent memory was in November 1985 when Colombia's Nevado del Ruiz volcano erupted. Just a couple hours after the eruption started, a river of mud, rocks, lava and icy water swept over the town of Armero, killing over 23,000 people in a matter of minutes... Bradley Pitcher, a volcanologist and lecturer in Earth and environmental sciences at Columbia University, said in an episode of CNN's "Violent Earth"... said that Mount Rainier has about eight times the amount of glaciers and snow as Nevado del Ruiz had when it erupted. "There's the potential to have a much more catastrophic mudflow...." Lahars typically occur during volcanic eruptions but also can be caused by landslides and earthquakes. Geologists have found evidence that at least 11 large lahars from Mount Rainier have reached into the surrounding area, known as the Puget Lowlands, in the past 6,000 years, Moran said. Two major U.S. cities — Tacoma and South Seattle — "are built on 100-foot-thick (30.5-meter) ancient mudflows from eruptions of Mount Rainier," the volcanologist said on CNN's "Violent Earth" series. CNN's article adds that the US Geological Survey already set up a lahar detection system at Mount Rainier in 1998, "which since 2017 has been upgraded and expanded. About 20 sites on the volcano's slopes and the two paths identified as most at risk of a lahar now feature broadband seismometers that transmit real-time data and other sensors including trip wires, infrasound sensors, web cameras and GPS receivers."

Read more of this story at Slashdot.

Earlier this month Apple announced a partnership with OpenAI to bring ChatGPT to Siri. "Now, the Wall Street Journal reports that Apple and Facebook's parent company Meta are in talks around a similar deal," according to TechCrunch: A deal with Meta could make Apple less reliant on a single partner, while also providing validation for Meta's generative AI tech. The Journal reports that Apple isn't offering to pay for these partnerships; instead, Apple provides distribution to AI partners who can then sell premium subscriptions... Apple has said it will ask for users' permission before sharing any questions and data with ChatGPT. Presumably, any integration with Meta would work similarly.

Read more of this story at Slashdot.

Michigan's House of Representatives passed a bill requiring all the state's public high schools to offer a computer science course by the start of the 2027-28 school year. (The bill now goes to the Senate, according to a report from Chalkbeat Detroit.) Long-time Slashdot reader theodp writes: Michigan is also removing the requirement for CS teacher endorsements in 2026, paving the way for CS courses to be taught in 2027 by teachers who have "demonstrated strong computer science skills" but do not hold a CS endorsement. Michigan's easing of CS teaching requirements comes in the same year that New York State will begin requiring credentials for all CS teachers. With lobbyist Julia Wynn from the tech giant-backed nonprofit Code.org sitting at her side, Michigan State Rep. Carol Glavnille introduced the CS bill (HB5649) to the House in May (hearing video, 16:20). "This is not a graduation requirement," Glavnille emphasized in her testimony. Code.org's Wynn called the Bill "an important first step" — after all, Code.org's goal is "to require all students to take CS to earn a HS diploma" — noting that Code.org has also been closely collaborating with Michigan's Education department "on the language and the Bill since inception." Wynn went on to inform lawmakers that "even just attending a high school that offers computer science delivers concrete employment and earnings benefits for students," citing a recent Brookings Institute article that also noted "30 states have adopted a key part of Code.org Advocacy Coalition's policy recommendations, which require all high schools to offer CS coursework, while eight states (and counting) have gone a step further in requiring all students to take CS as a high school graduation requirement." Minutes from the hearing report other parties submitting cards in support of HB 5649 included Amazon (a $3+ million Code.org Platinum Supporter) and AWS (a Code.org In-Kind Supporter), as well as College Board (which offers the AP CS A and CSP exams) and TechNet (which notes its "teams at the federal and state levels advocate with policymakers on behalf of our member companies").

Read more of this story at Slashdot.

Slashdot reader unixbhaskar shared this report from Phoronix: Larry Finger who has contributed to the Linux kernel since 2005 and has seen more than 1,500 kernel patches upstreamed into the mainline Linux kernel has sadly passed away. His wife shared the news of Larry Finger's passing this weekend on the linux-wireless mailing list in a brief statement. Reactions are being shared around the internet. LWN writes: The LWN Kernel Source Database shows that Finger contributed to 94 releases in the (Git era) kernel history, starting with 2.6.16 — 1,464 commits in total. He will be missed... In part to his contributions, the Linux wireless hardware support has come a long way over the past two decades. Larry was a frequent contributor to the Linux Wireless and Linux Kernel mailing lists. (Here's a 2006 discussion he had about Git with Linus Torvalds.) Larry also answered 54 Linux questions on Quora, and in 2005 wrote three articles for Linux Journal. And Larry's GitHub profile shows 122 contributions to open source projects just in 2024. In Reddit's Linux forum, one commenter wrote, "He was 84 years old and was still writing code. What a legend. May he rest in peace."

Read more of this story at Slashdot.

OpenAI's 'Media Manager' Mocked, Amid Accusations of Robbing Creative Professionals "Amid the hype surrounding Apple's new deal with OpenAI, one issue has been largely papered over," argues the Executive Director of America's writer's advocacy group, the Authors Guild. OpenAI's foundational models "are, and have always been, built atop the theft of creative professionals' work." [L]ast month the company quietly announced Media Manager, scheduled for release in 2025. A tool purportedly designed to allow creators and content owners to control how their work is used, Media Manager is really a shameless attempt to evade responsibility for the theft of artists' intellectual property that OpenAI is already profiting from. OpenAI says this tool would allow creators to identify their work and choose whether to exclude it from AI training processes. But this does nothing to address the fact that the company built its foundational models using authors' and other creators' works without consent, compensation or control over how OpenAI users will be able to imitate the artists' styles to create new works. As it's described, Media Manager puts the burden on creators to protect their work and fails to address the company's past legal and ethical transgressions. This overture is like having your valuables stolen from your home and then hearing the thief say, "Don't worry, I'll give you a chance to opt out of future burglaries ... next year...." AI companies often argue that it would be impossible for them to license all the content that they need and that doing so would bring progress to a grinding halt. This is simply untrue. OpenAI has signed a succession of licensing agreements with publishers large and small. While the exact terms of these agreements are rarely released to the public, the compensation estimates pale in comparison with the vast outlays for computing power and energy that the company readily spends. Payments to authors would have minimal effects on AI companies' war chests, but receiving royalties for AI training use would be a meaningful new revenue stream for a profession that's already suffering... We cannot trust tech companies that swear their innovations are so important that they do not need to pay for one of the main ingredients — other people's creative works. The "better future" we are being sold by OpenAI and others is, in fact, a dystopia. It's time for creative professionals to stand together, demand what we are owed and determine our own futures. The Authors Guild (and 17 other plaintiffs) are now in an ongoing lawsuit against OpenAI and Microsoft. And the Guild's executive director also notes that there's also "a class action filed by visual artists against Stability AI, Runway AI, Midjourney and Deviant Art, a lawsuit by music publishers against Anthropic for infringement of song lyrics, and suits in the U.S. and U.K. brought by Getty Images against Stability AI for copyright infringement of photographs." They conclude that "The best chance for the wider community of artists is to band together."

Read more of this story at Slashdot.

Tuesday a SpaceX Falcon Heavy rocket will launch a special satellite — a state-of-the-art weather-watcher from America's National Oceanic and Atmospheric Administration. It will complete a series of four GOES-R satellite launches that began in 2016. Space.com drills down into how these satellites have changed weather forecasts: More than seven years later, with three of the four satellites in the series orbiting the Earth, scientists and researchers say they are pleased with the results and how the advanced technology has been a game changer. "I think it has really lived up to its hype in thunderstorm forecasting. Meteorologists can see the convection evolve in near real-time and this gives them enhanced insight on storm development and severity, making for better warnings," John Cintineo, a researcher from NOAA's National Severe Storms Laboratory , told Space.com in an email. "Not only does the GOES-R series provide observations where radar coverage is lacking, but it often provides a robust signal before radar, such as when a storm is strengthening or weakening. I'm sure there have been many other improvements in forecasts and environmental monitoring over the last decade, but this is where I have most clearly seen improvement," Cintineo said. In addition to helping predict severe thunderstorms, each satellite has collected images and data on heavy rain events that could trigger flooding, detected low clouds and fog as it forms, and has made significant improvements to forecasts and services used during hurricane season. "GOES provides our hurricane forecasters with faster, more accurate and detailed data that is critical for estimating a storm's intensity, including cloud top cooling, convective structures, specific features of a hurricane's eye, upper-level wind speeds, and lightning activity," Ken Graham, director of NOAA's National Weather Service told Space.com in an email. Instruments such as the Advanced Baseline Imager have three times more spectral channels, four times the image quality, and five times the imaging speed as the previous GOES satellites. The Geostationary Lightning Mapper is the first of its kind in orbit on the GOES-R series that allows scientists to view lightning 24/7 and strikes that make contact with the ground and from cloud to cloud. "GOES-U and the GOES-R series of satellites provides scientists and forecasters weather surveillance of the entire western hemisphere, at unprecedented spatial and temporal scales," Cintineo said. "Data from these satellites are helping researchers develop new tools and methods to address problems such as lightning prediction, sea-spray identification (sea-spray is dangerous for mariners), severe weather warnings, and accurate cloud motion estimation. The instruments from GOES-R also help improve forecasts from global and regional numerical weather models, through improved data assimilation." The final satellite, launching Tuesday, includes a new sensor — the Compact Coronagraph — "that will monitor weather outside of Earth's atmosphere, keeping an eye on what space weather events are happening that could impact our planet," according to the article. "It will be the first near real time operational coronagraph that we have access to," Rob Steenburgh, a space scientist at NOAA's Space Weather Prediction Center, told Space.com on the phone. "That's a huge leap for us because up until now, we've always depended on a research coronagraph instrument on a spacecraft that was launched quite a long time ago."

Read more of this story at Slashdot.

The Roddenberry Foundation — named for Star Trek creator Gene Roddenberry — "announced Tuesday that this year's biennial award would focus on artificial intelligence that benefits humanity," reports the Los Angeles Times: Lior Ipp, chief executive of the foundation, told The Times there's a growing recognition that AI is becoming more ubiquitous and will affect all aspects of our lives. "We are trying to ... catalyze folks to think about what AI looks like if it's used for good," Ipp said, "and what it means to use AI responsibly, ethically and toward solving some of the thorny global challenges that exist in the world...." Ipp said the foundation shares the broad concern about AI and sees the award as a means to potentially contribute to creating those guardrails... Inspiration for the theme was also borne out of the applications the foundation received last time around. Ipp said the prize, which is "issue-agnostic" but focused on early-stage tech, produced compelling uses of AI and machine learning in agriculture, healthcare, biotech and education. "So," he said, "we sort of decided to double down this year on specifically AI and machine learning...." Though the foundation isn't prioritizing a particular issue, the application states that it is looking for ideas that have the potential to push the needle on one or more of the United Nations' 17 sustainable development goals, which include eliminating poverty and hunger as well as boosting climate action and protecting life on land and underwater. The Foundation's most recent winner was Sweden-based Elypta, according to the article, "which Ipp said is using liquid biopsies, such as a blood test, to detect cancer early." "We believe that building a better future requires a spirit of curiosity, a willingness to push boundaries, and the courage to think big," said Rod Roddenberry, co-founder of the Roddenberry Foundation. "The Prize will provide a significant boost to AI pioneers leading these efforts." According to the Foundation's announcement, the Prize "embodies the Roddenberry philosophy's promise of a future in which technology and human ingenuity enable everyone — regardless of background — to thrive." "By empowering entrepreneurs to dream bigger and innovate valiantly, the Roddenberry Prize seeks to catalyze the development of AI solutions that promote abundance and well-being for all."

Read more of this story at Slashdot.

Automated license plate readers "pose risks to public safety," argues the EFF, "that may outweigh the crimes they are attempting to address in the first place." When law enforcement uses automated license plate readers (ALPRs) to document the comings and goings of every driver on the road, regardless of a nexus to a crime, it results in gargantuan databases of sensitive information, and few agencies are equipped, staffed, or trained to harden their systems against quickly evolving cybersecurity threats. The Cybersecurity and Infrastructure Security Agency (CISA), a component of the U.S. Department of Homeland Security, released an advisory last week that should be a wake up call to the thousands of local government agencies around the country that use ALPRs to surveil the travel patterns of their residents by scanning their license plates and "fingerprinting" their vehicles. The bulletin outlines seven vulnerabilities in Motorola Solutions' Vigilant ALPRs, including missing encryption and insufficiently protected credentials... Unlike location data a person shares with, say, GPS-based navigation app Waze, ALPRs collect and store this information without consent and there is very little a person can do to have this information purged from these systems... Because drivers don't have control over ALPR data, the onus for protecting the data lies with the police and sheriffs who operate the surveillance and the vendors that provide the technology. It's a general tenet of cybersecurity that you should not collect and retain more personal data than you are capable of protecting. Perhaps ironically, a Motorola Solutions cybersecurity specialist wrote an article in Police Chief magazine this month that public safety agencies "are often challenged when it comes to recruiting and retaining experienced cybersecurity personnel," even though "the potential for harm from external factors is substantial." That partially explains why, more than 125 law enforcement agencies reported a data breach or cyberattacks between 2012 and 2020, according to research by former EFF intern Madison Vialpando. The Motorola Solutions article claims that ransomware attacks "targeting U.S. public safety organizations increased by 142 percent" in 2023. Yet, the temptation to "collect it all" continues to overshadow the responsibility to "protect it all." What makes the latest CISA disclosure even more outrageous is it is at least the third time in the last decade that major security vulnerabilities have been found in ALPRs... If there's one positive thing we can say about the latest Vigilant vulnerability disclosures, it's that for once a government agency identified and reported the vulnerabilities before they could do damage... The Michigan Cyber Command center found a total of seven vulnerabilities in Vigilant devices; two of which were medium severity and 5 of which were high severity vulnerabilities... But a data breach isn't the only way that ALPR data can be leaked or abused. In 2022, an officer in the Kechi (Kansas) Police Department accessed ALPR data shared with his department by the Wichita Police Department to stalk his wife. The article concludes that public safety agencies should "collect only the data they need for actual criminal investigations. "They must never store more data than they adequately protect within their limited resources-or they must keep the public safe from data breaches by not collecting the data at all."

Read more of this story at Slashdot.

"University of Zurich researchers have discovered that our brains process natural human voices and "deepfake" voices differently," writes Slashdot reader jenningsthecat. From the University's announcement: The researchers first used psychoacoustical methods to test how well human voice identity is preserved in deepfake voices. To do this, they recorded the voices of four male speakers and then used a conversion algorithm to generate deepfake voices. In the main experiment, 25 participants listened to multiple voices and were asked to decide whether or not the identities of two voices were the same. Participants either had to match the identity of two natural voices, or of one natural and one deepfake voice. The deepfakes were correctly identified in two thirds of cases. "This illustrates that current deepfake voices might not perfectly mimic an identity, but do have the potential to deceive people," says Claudia Roswandowitz, first author and a postdoc at the Department of Computational Linguistics. The researchers then used imaging techniques to examine which brain regions responded differently to deepfake voices compared to natural voices. They successfully identified two regions that were able to recognize the fake voices: the nucleus accumbens and the auditory cortex. "The nucleus accumbens is a crucial part of the brain's reward system. It was less active when participants were tasked with matching the identity between deepfakes and natural voices," says Claudia Roswandowitz. In contrast, the nucleus accumbens showed much more activity when it came to comparing two natural voices. The complete paper appears in Nature.

Read more of this story at Slashdot.

Source: www.databreachtoday.com – Author: 1 Fraud Management & Cybercrime , Healthcare , Industry Specific Battle the Business Model With Business Resilience Planning, Failover Capabilities Mathew J. Schwartz (euroinfosec) • June 21, 2024     We shouldn’t become numb to the human cost of ransomware. (Image: Shutterstock) Never let ransomware become normalized. As Britain’s National Health […]

La entrada As Britain’s NHS Faces Data Leak, Never Normalize Ransomware – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Fraud Management & Cybercrime , Ransomware Different Countries Have Different Levels of Law Enforcement Involvement Sally Adam • June 20, 2024     In the early years of ransomware, many victims were reluctant to admit publicly that they had been hit for fear of negative press and customer attrition. See […]

La entrada Law Enforcement’s Role in Remediating Ransomware Attacks – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Cloud Security , Network Detection & Response , Next-Generation Technologies & Secure Development How Gigamon’s Technical Capabilities Boost Organizations’ Cybersecurity Information Security Media Group • June 20, 2024     Network security threats are ever-evolving, and all types of organizations work hard to face down emerging threats while maintaining robust […]

La entrada Corpay, UHN Secure Hybrid Cloud Infrastructure With Gigamon – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Source: www.databreachtoday.com – Author: 1 Finance & Banking , Fraud Management & Cybercrime , Fraud Risk Management It’s Time for Big Tech to Be Held Accountable for Rampant Online Fraud Suparna Goswami (gsuparna) • June 19, 2024     From account takeover threats to fake investment schemes, you don’t have to spend much time on […]

La entrada Ever Tried to Report a Scam on Facebook? Good Luck! – Source: www.databreachtoday.com se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Multiple AI companies are ignoring Robots.txt files meant to block the scraping of web content for generative AI systems, reports Reuters — citing a warning sent to publisher by content licensing startup TollBit. TollBit, an early-stage startup, is positioning itself as a matchmaker between content-hungry AI companies and publishers open to striking licensing deals with them. The company tracks AI traffic to the publishers' websites and uses analytics to help both sides settle on fees to be paid for the use of different types of content... It says it had 50 websites live as of May, though it has not named them. According to the TollBit letter, Perplexity is not the only offender that appears to be ignoring robots.txt. TollBit said its analytics indicate "numerous" AI agents are bypassing the protocol, a standard tool used by publishers to indicate which parts of its site can be crawled. "What this means in practical terms is that AI agents from multiple sources (not just one company) are opting to bypass the robots.txt protocol to retrieve content from sites," TollBit wrote. "The more publisher logs we ingest, the more this pattern emerges." The article includes this quote from the president of the News Media Alliance (a trade group representing over 2,200 U.S.-based publishers). "Without the ability to opt out of massive scraping, we cannot monetize our valuable content and pay journalists. This could seriously harm our industry." Reuters also notes another threat facing news sites: Publishers have been raising the alarm about news summaries in particular since Google rolled out a product last year that uses AI to create summaries in response to some search queries. If publishers want to prevent their content from being used by Google's AI to help generate those summaries, they must use the same tool that would also prevent them from appearing in Google search results, rendering them virtually invisible on the web.

Read more of this story at Slashdot.

Long-time Slashdot reader schwit1 shares CNBC's report on the U.S. car market: Back in February, used electric vehicle prices dipped below used gasoline-powered vehicle prices for the first time ever, and the pricing cliff keeps getting steeper as car buyers reject any "premium" tag formerly associated with EVs. The decline has been dramatic over the past year. In June 2023, average used EV prices were over 25% higher than used gas car prices, but by May, used EVs were on average 8% lower than the average price for a used gasoline-powered car in U.S. In dollar terms, the gap widened from $265 in February to $2,657 in May, according to an analysis of 2.2 million one to five year-old used cars conducted by iSeeCars. Over the past year, gasoline-powered used vehicle prices have declined between 3-7%, while electric vehicle prices have decreased 30-39%. "It's clear used car shoppers will no longer pay a premium for electric vehicles," iSeeCars executive analyst Karl Brauer stated in an iSeeCars report published last week. Electric power is now a detractor in the consumer's mind, with EVs "less desirable" and therefore less valuable than traditional cars, he said. The article notes there's been a price war among EV manufacturers — and that newer EV models might be more attractive due to "longer ranges and improved battery life with temperature control for charging." But CNBC also notes a silver lining. "As more EVs enter the used market at lower prices, the EV market does become available to a wider market of potential first-time EV owners."

Read more of this story at Slashdot.

"A Chinese launch of the joint Sino-French SVOM mission to study Gamma-ray bursts early Saturday saw toxic rocket debris fall over a populated area..." writes Space News: SVOM is a collaboration between the China National Space Administration (CNSA) and France's Centre national d'études spatiales (CNES). The mission will look for high-energy electromagnetic radiation from these events in the X-ray and gamma-ray ranges using two French and two Chinese-developed science payloads... Studying gamma-ray bursts, thought to be caused by the death of massive stars or collisions between stars, could provide answers to key questions in astrophysics. This includes the death of stars and the creation of black holes. However the launch of SVOM also created an explosion of its own closer to home.A video posted on Chinese social media site Sina Weibo appears to show a rocket booster falling on a populated area with people running for cover. The booster fell to Earth near Guiding County, Qiandongnan Prefecture in Guizhou province, according to another post... A number of comments on the video noted the danger posed by the hypergolic propellant from the Long March rocket... The Long March 2C uses a toxic, hypergolic mix of nitrogen tetroxide and unsymmetrical dimethylhydrazine (UDMH). Reddish-brown gas or smoke from the booster could be indicative of nitrogen tetroxide, while a yellowish gas could be caused by hydrazine fuel mixing with air. Contact with either remaining fuel or oxidizer from the rocket stage could be very harmful to individuals. "Falling rocket debris is a common issue with China's launches from its three inland launch sites..." the article points out. "Authorities are understood to issue warnings and evacuation notices for areas calculated to be at risk from launch debris, reducing the risk of injuries.

Read more of this story at Slashdot.

Slashdot reader DevNull127 writes: A free and open source ChatGPT clone — named LibreChat — lets its users choose which AI model to use, "to harness the capabilities of cutting-edge language models from multiple providers in a unified interface". This means LibreChat includes OpenAI's models, but also others — both open-source and closed-source — and its website promises "seamless integration" with AI services from OpenAI, Azure, Anthropic, and Google — as well as GPT-4, Gemini Vision, and many others. ("Every AI in one place," explains LibreChat's home page.) Plugins even let you make requests to DALL-E or Stable Diffusion for image generations. (LibreChat also offers a database that tracks "conversation state" — making it possible to switch to a different AI model in mid-conversation...) Released under the MIT License, LibreChat has become "an open source success story," according to this article, representing "the passionate community that's actively creating an ecosystem of open source AI tools." And its creator, Danny Avila, says in some cases it finally lets users own their own data, "which is a dying human right, a luxury in the internet age and even more so with the age of LLM's." Avila says he was inspired by the day ChatGPT leaked the chat history of some of its users back in March of 2023 — and LibreChat is "inherently completely private". From the article: With locally-hosted LLMs, Avila sees users finally getting "an opportunity to withhold training data from Big Tech, which many trade at the cost of convenience." In this world, LibreChat "is naturally attractive as it can run exclusively on open-source technologies, database and all, completely 'air-gapped.'" Even with remote AI services insisting they won't use transient data for training, "local models are already quite capable" Avila notes, "and will become more capable in general over time." And they're also compatible with LibreChat...

Read more of this story at Slashdot.