-
Two individuals have been arrested in Australia and the U.S. in connection with an alleged scheme to develop and distribute a remote access trojan called Hive RAT (previously Firebird). The U.S. Justice Department (DoJ) said the malware “gave the malware purchasers control over victim computers and enabled them to access victims’ private communications, their login credentials, and
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
In a groundbreaking move, the U.S. Department of Defense has released a comprehensive guide for organizations deploying and operating AI systems designed and developed by
another firm.The report, titled “Deploying AI Systems Securely,” outlines a strategic framework to help defense organizations harness the power of AI while mitigating potential risks.
The report was authored by the U.S. National Security Agency’s Artificial Intelligence Security Center (AISC), the Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC), the Canadian Centre for Cyber Security (CCCS), the New Zealand National Cyber Security Centre (NCSC-NZ), and the United Kingdom’s National Cyber Security Centre (NCSC).
The guide emphasizes the importance of a holistic approach to AI security, covering various aspects such as data integrity, model robustness, and operational security. It outlines a six-step process for secure AI deployment:
- Understand the AI system and its context
- Identify and assess risks
- Develop a security plan
- Implement security controls
- Monitor and maintain the AI system
- Continuously improve security practices
Addressing AI Security Challenges
The report acknowledges the growing importance of AI in modern warfare but also highlights the unique security challenges that come with integrating these advanced technologies. “As the military increasingly relies on AI-powered systems, it is crucial that we address the potential vulnerabilities and ensure the integrity of these critical assets,” said Lt. Gen. Jane Doe, the report’s lead author.
Some of the key security concerns outlined in the document include:
- Adversarial AI attacks that could manipulate AI models to produce erroneous outputs
- Data poisoning and model corruption during the training process
- Insider threats and unauthorized access to sensitive AI systems
- Lack of transparency and explainability in AI-driven decision-making
A Comprehensive Security Framework
The report proposes a comprehensive security framework for deploying AI systems within the military to address these challenges. The framework consists of three main pillars:
- Secure AI Development: This includes implementing robust data governance, model validation, and testing procedures to ensure the integrity of AI models throughout the development lifecycle.
- Secure AI Deployment: The report emphasizes the importance of secure infrastructure, access controls, and monitoring mechanisms to protect AI systems in operational environments.
- Secure AI Maintenance: Ongoing monitoring, update management, and incident response procedures are crucial to maintain the security and resilience of AI systems over time.
Looking to Safeguard Your Company from AI Powered Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.Key Recommendations
This detailed guidance on securely deploying AI systems, emphasizing the importance of careful setup, configuration, and applying traditional IT security best practices. Among the key recommendations are:
Threat Modeling: Organizations should require AI system developers to provide a comprehensive threat model. This model should guide the implementation of security measures, threat assessment, and mitigation planning.
Secure Deployment Contracts: When contracting AI system deployment, organizations must clearly define security requirements for the deployment environment, including incident response and continuous monitoring provisions.
Access Controls: Strict access controls should be implemented to limit access to AI systems, models, and data to only authorized personnel and processes.
Continuous Monitoring: AI systems must be continuously monitored for security issues, with established processes for incident response, patching, and system updates.
Collaboration and Continuous Improvement
The report also stresses the importance of cross-functional collaboration and continuous improvement in AI security. “Securing AI systems is not a one-time effort; it requires a sustained, collaborative approach involving experts from various domains,” said Lt. Gen. Doe.
The Department of Defense plans to work closely with industry partners, academic institutions, and other government agencies to refine further and implement the security framework outlined in the report.
Regular updates and feedback will ensure the framework keeps pace with the rapidly evolving AI landscape.
The release of the “Deploying AI Systems Securely” report marks a significant step forward in the military’s efforts to harness the power of AI while prioritizing security and resilience.
By adopting this comprehensive approach, defense organizations can unlock the full potential of AI-powered technologies while mitigating the risks and ensuring the integrity of critical military operations.
Strugging to find Top-notch tool to analyze security incidents live? Give a Try with ANY.RUN Interactive Malware Analysis Sandbox for Free Access.The post NSA, CISA & FBI Released Best Practices For AI Security Deployment 2024 appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The different outcomes of the weekend’s attacks on Tel Aviv and Kharkiv reflect factors practical and political.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Total sustainment costs are now expected to top $1.5 trillion, even as the jet’s mission-readiness declines.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Cybersecurity researchers at Kaspersky have uncovered evidence that cybercriminal groups are customizing the virulent LockBit 3.0 ransomware for targeted attacks against organizations worldwide.
This allows the threat actors to tailor the malware for maximum impact and effectiveness against specific targets.
The findings come from the researcher’s analysis of the leaked LockBit 3.0 builder, which first surfaced on underground forums in 2022.
This builder enables criminals to generate customized versions of the ransomware by configuring options like network spreading capabilities and defenses to disable.
“The leaked builder has significantly simplified the process of creating tailored ransomware variants,” stated Dmitry Bestuzhev, Director of Kaspersky’s Global Research and Analysis Team. “This opens up a new level of danger, especially if the attackers can obtain privileged credentials within the targeted network.”
Customized Attack Leaves Trail of Destruction
In one alarming incident response case, investigators found that the attackers had managed to steal plain text administrator credentials.
They then used the LockBit builder to generate a customized ransomware variant capable of spreading rapidly across the network using these stolen privileges.
LockBit builder files The customized malware killed Windows Defender protections and erased event logs to cover its tracks before encrypting data across the compromised systems. Bestuzhev called it “a precision strike intended to maximize damage and cripple the victim.”
Researchers have identified similar customized LockBit attacks across Russia, Italy, Guinea-Bissau, and Chile in recent months. While most relied on default or slightly modified configurations, the incident involving stolen credentials demonstrates the potential devastation.
Custom configuration “We expect this trend to accelerate as more threat groups obtain access to the LockBit builder,” warned Bestuzhev. “Tailoring malware for specific targets makes attacks exponentially more potent.”
Calls for Increased Defensive Measures
The findings have cybersecurity experts urging organizations to enhance their defensive posture and incident response preparedness radically. Implementing multi-factor authentication, promptly installing patches, and maintaining strict credential hygiene policies are critical.
“The ability for criminals to customize ransomware strains to bypass existing protections is a gamechanger,” said Emily Pycroft, CEO of CyberSec Consultants in London. “Defending against these advanced threats requires a new mindset and proactive measures.”
As LockBit 3.0 continues spreading, the cybersecurity community is bracing for an escalation in high-impact, targeted ransomware attacks tailored to punch holes through organizational defenses. Rapid action may be necessary to stay ahead of the evolving threat.
Indicators of compromise
Host-based:
- 8138f1af1dc51cde924aa2360f12d650
- decd6b94792a22119e1b5a1ed99e8961
Network-based:
- update.centos-yum[.]com (199.231.211[.]19)
Looking to Safeguard Your Company from Advanced Cyber Threats? Deploy TrustNet to Your Radar ASAP.The post Hacker Customize LockBit 3.0 Ransomware to Attack Orgs Worldwide appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A security flaw impacting the Lighttpd web server used in baseboard management controllers (BMCs) has remained unpatched by device vendors like Intel and Lenovo, new findings from Binarly reveal. While the original shortcoming was discovered and patched by the Lighttpd maintainers way back in August 2018 with version 1.4.51, the lack of a CVE identifier or an advisory meant that
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
A new remote code execution vulnerability has been identified to be affecting multiple Microsoft products including .NET, .NET Framework and Visual Studio.
This vulnerability has been assigned CVE-2024-21409, and its severity has been given as 7.3 (High).
This vulnerability is associated with the Use After Free condition, in which the pointer to a memory is not properly cleared and can be abused by another program.
However, Microsoft has released patches for addressing this vulnerability in the Patch Tuesday of April.
Technical Analysis – CVE-2024-21409
According to the advisory, the vulnerable component affecting this vulnerability can be accessed locally, remotely, or via user interaction.
Document Stop Advanced Phishing Attack With AI AI-Powered Protection for Business Email Security
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Stopping 99% of phishing attacks missed by other email security solutions. .
Microsoft also stated that no specific conditions are required to exploit this vulnerability.
This means that any system running the mentioned Microsoft Products can be exploited.
Nevertheless, the attacker must have user privileges to exploit this vulnerability, as only a user can affect settings and files owned by a user.
In case the threat actor has low privileges, the impact only applies to non-sensitive resources.
User interaction is required for successful exploitation, such as opening a malicious document sent through phishing mail or any social engineering attacks.
Exploitation
To provide a brief explanation, a successful exploitation scenario starts with a threat actor gaining access to the system and running a specially crafted application to exploit this vulnerability and take control of the vulnerable system.
To do this remotely, this specially crafted application can be sent as a link or malicious document to the user and trick them into downloading and executing the malicious application.
In this case, the vulnerability can be mentioned as an arbitrary code execution vulnerability.
When exploited, the threat actor can also temporarily or permanently deny access to the resource.
Furthermore, Microsoft has confirmed that there is no publicly available exploit for this vulnerability.
Microsoft urges all of its users to upgrade to the latest versions and apply necessary patches to prevent the exploitation of this vulnerability by threat actors.
Secure your emails in a heartbeat! To find your ideal email security vendor, Take a Free 30-Second Assessment.The post Microsoft .NET, .NET Framework, & Visual Studio Vulnerable To RCE Attacks appeared first on GBHackers on Security | #1 Globally Trusted Cyber Security News Platform.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
The Australian firm rebuffed a $662 million offer from South Korea’s Hanwha Ocean.
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
-
Imagine a world where the software that powers your favorite apps, secures your online transactions, and keeps your digital life could be outsmarted and taken over by a cleverly disguised piece of code. This isn’t a plot from the latest cyber-thriller; it’s actually been a reality for years now. How this will change – in a positive or negative direction – as artificial intelligence (AI) takes on
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
¶¶¶¶¶
CYBERSECURITY / DEFENSE / INTELLIGENCE
