It's time to get ahead of attacks before they even happen.

The constant stream of cyberattacks sweeping making headlines may seem almost inevitable by this point. And while sometimes the organizations being attacked have clearly made themselves easy targets by leaving sizable gaps in their cybersecurity defenses, others are simply unlucky to have fallen into the sights of sophisticated, nation-sponsored hackers.

Enough is enough. It's high time our country stopped playing defense and actively fought against these cybercriminals.

Right now, on the federal level, we have seen very few results from our efforts to prevent nation-states from successfully attacking US targets. Businesses, banks, hospitals, and critical infrastructure organizations that fall prey to breaches have no recourse but to react as best they can — try to halt the damage, clean up the mess, suffer the public distrust, and return to normal operations as quickly as possible. The human and financial costs of this can be high. Sensitive personal data can be compromised and sold on the Dark Web. Human lives can be lost when hospital systems go down for extended periods of time. And the costs for firms to engage with all the necessary insurance companies, lawyers, and cybersecurity experts can be astronomical.

**Falling Short of Adequate Protections**

What's more, evidently, even our own government is falling exceedingly short of adequate protections for its systems, if the recent FBI InfraGard breach is any proof. The InfraGard hacker was simply given access to the FBI's critical-infrastructure intelligence portal after posing as the CEO of a financial institution. This individual's identity was never properly verified (which even a simple phone call might have accomplished), and now 87,000 high-profile cybersecurity stakeholders and private-sector individuals have had their personal data compromised. In addition, some of our nation's classified data may have been exposed as well.

Worse still, the recommendations provided by the FBI came nearly one week after the breach — leaving those 87,000 stakeholders vulnerable and without a clear understanding of what sensitive data was at risk for far too long. While the latest response provided by the FBI appears to be thorough, it lacks accountability for this epic fail of data protection. When attacks are conducted by nation-states or hackers seeking to damage our national interests, as they so often are, our government has a duty to protect its citizens and prevent the attacks in the first place — and as quickly as possible.

In fact, we should be looking to the Australian government for a strong model of how to stand up to cybercrime. In the wake of massive breaches at telecommunications giant Optus and Medibank, Australia's largest private health insurer, in which millions of people's personal data was exposed, Australia declared outright war against cybercriminals. The new offensive, built upon a joint cyber-policing task force between the Australian Federal Police and the Australian Signals Directorate, has one clear mission: Hunt down cybercriminals and disrupt their operations. Some call this “various forms of takedown.”

Not only has this task force already made progress in identifying the hackers behind the Medibank attack, promising they will be brought to justice, it has also made it a point to send a clear message to any and all would-be attackers. As the country's cybersecurity minister, Clare O'Neil, has said, the task force will, "scour the world, hunt down the criminal syndicates and gangs who are targeting Australia in cyberattacks, and disrupt their efforts."

**Take the Offensive**

Here in the US, we need to follow suit. We need to take the offensive and make it clear we won't allow cybercrimes against American citizens to go without serious consequences.

Implementing even the most basic safeguards requires organizations to take accountability here as well, heading cybercriminals off at the pass — i.e., automating regular password resets, enabling two-factor authentication, encrypting sensitive information, conducting regular penetration tests and, ultimately, having an incident response team at the ready when threats or breaches occur.

While it's heartening to see our Congress' recent steps to prioritize cybersecurity development and protection at the federal level — the following examples are only starting points:

*   Sen. Mark Warner's latest proposed policies for healthcare are a good model.
*   The House of Representatives is exploring a bill focused on the feasibility of establishing a Cyber Defense National Guard
*   The White House Cyber Strategy document suggests sanctions and offensive approaches
*   The Senate Committee on Homeland Security and Government Affairs hearings are beginning to address the challenges healthcare faces from cyber threats

Senators Peters, Blumenthal, Hawley, Rosen, Paul, Sinema, and others are also suggesting that the federal government could do more to help. Regulations and defensive tactics can only take us so far, and we need to do more.

It's time to punch back. It's time to get ahead of attacks before they even happen, catching and making examples out of nation-sponsored hackers who attack our national security, our businesses, and the lives of our citizens. After all, the best defense is a good offense.

Australia Is Scouring the Earth for Cybercriminals — the US Should Too

New threats from generative AI demand a generative AI security response.

Generative artificial intelligence technologies such as ChatGPT have brought sweeping changes to the security landscape almost overnight. Generative AI chatbots can produce clear, well-punctuated prose, images, and other media in response to short prompts from users. ChatGPT has quickly become the symbol of this new wave of AI, and the powerful force unleashed by this technology has not been lost on cybercriminals.

A new kind of arms race is underway to develop technologies that leverage generative AI to create thousands of malicious text and voice messages, Web links, attachments, and video files. The hackers are seeking to exploit vulnerable targets by expanding their range of social engineering tricks. Tools such as ChatGPT, Google's Bard, and Microsoft's AI-powered Bing all rely on large language models to exponentially increase access to learning and thus generate new forms of content based on that contextualized knowledge.

In this way, generative AI enables threat actors to rapidly accelerate the speed and variation of their attacks by modifying code in malware, or by creating thousands of versions of the same social engineering pitch to increase their probability of success. As machine learning technologies advance, so will the number of ways that this technology can be used for criminal purposes.

Threat researchers warn that the generative AI genie is out of the bottle now, and it is already automating thousands of uniquely tailored phishing messages and variations of those messages to increase the success rate for threat actors. The cloned emails reflect similar emotions and urgency as the originals, but with slightly altered wording that makes it hard to detect they were sent from automated bots.

**Fighting Back With a "Humanlike" Approach to AI**

Today, humans make up the top targets for business email compromise (BEC) attacks that use multichannel payloads to play off human emotions such as fear ("Click here to avoid an IRS tax audit...") or greed ("Send your credentials to claim a credit card rebate..."). The bad actors have already retooled their strategies to attack individuals directly while seeking to exploit business software weaknesses and configuration vulnerabilities.

The rapid rise in cybercrime based on generative AI makes it increasingly unrealistic to hire enough security researchers to defend against this problem. AI technology and automation can detect and respond to cyber threats much more quickly and accurately than people can, which in turn frees up security teams to focus on tasks that AI cannot currently address. Generative AI can be used to anticipate the vast numbers of potential AI-generated threats by applying AI data augmentation and cloning techniques to assess each core threat and spawn thousands of other variations of that same core threat, enabling the system to train itself on countless possible variations.

All these elements must be contextualized in real time to protect users from clicking on malicious links or opening bad attachments. The language processor builds a contextual framework that can spawn a thousand similar versions of the same message but with slightly different wording and phrases. This approach enables users to stop current threats while anticipating what future threats may look like and blocking them too.

**Protecting Against Social Engineering in the Real World**

Let's examine how a social engineering attack might play out in the real world. Take the simple example of an employee who receives a notice about an overdue invoice from AWS, with an urgent request for an immediate payment by wire transfer.

The employee cannot discern if this message came from a real person or a chatbot. Until now, legacy technologies have applied signatures to recognize original email attacks, but now the attackers can use generative AI to slightly alter the language and spawn new undetected attacks. The remedy requires a natural language processing and relationship graph technology that can analyze the data and correlate the fact that the two separate messages express the same meaning.

In addition to natural language processing, the use of relationship graph technology conducts a baseline review of all emails sent to the employee to identify any prior messages or invoices from AWS. If it can find no such emails, the system is alerted to protect the employee from incoming BEC attacks. Distracted employees may be fooled into quickly replying before they think through the consequences of giving up their personal credentials or making financial payments to a potential scammer.

Clearly, this new wave of generative AI has tilted the advantage in favor of the attackers. As a result, the best defense in this emerging battle will be to turn the same AI weapons against the attackers in anticipation of their next moves and use AI to protect susceptible employees from any future attacks.

**About the Author**

    

Patrick Harr is the CEO of SlashNext, an integrated cloud messaging security company using patented HumanAI™ to stop BEC, smishing, account takeovers, scams, malware, and exploits in email, mobile, and Web messaging before they become a breach.

It Takes AI Security to Fight AI Cyberattacks

In-person conversations are a productive way to understand the state of the industry and learn new techniques. Take advantage of peers' experience, compare notes, and boost your skill set.

The security community is always pressured to jump to the next thing. So, it's easy to guess what will likely dominate conversations at the 2023 RSA Conference later this month — geopolitical events/cyberwarfare and nefarious uses for ChatGPT. There's a lot going on with respect to these topics and security, but in my opinion, they shouldn't consume the lion's share of attention.

As a community, I would rather we spend more time focusing on an area that we don't talk enough about but should: the state of the industry. In other words, where we — as security practitioners, experts, and vendors — are right now, and what we need to do better.

**Use the Conference to Chart Best Way Forward**

Attacks and compromises aren't going away. Instead, they're growing and becoming more costly. Does this mean that, as defenders, we aren't getting better at what we do? Or are attackers getting better at what they do, while we stay the same, not learning lessons based on our own experiences or from our peers? When we attend conferences like RSA, this is what we should be talking about.

This proposed topic is even aligned with this year's conference theme: "stronger together." Instead of jumping to the next thing, let's take advantage of the opportunity to meet in person to look at some of the areas where the same types of compromises keep happening, and discuss how we can do better as a community. Here are a few suggestions.

**Supply Chain Security**

Supply chain attacks are nothing new; they've been around for years. In 2015, we saw hardware supply issues where motherboards were found to have malicious microchips in them. And a couple of years later routers and switches were compromised, affecting users in numerous countries. On the software side, not that long ago a spate of supply chain attacks on software from companies such as Accellion, Kaseya, and SolarWinds affected millions of users downstream. And with respect to source code, over the years we continue to see incidents of JavaScript, Log4j, Perl, and Python libraries being compromised, putting software companies that use them as part of their offering at risk.

Why do these types of compromises continue to exist? Are we not getting the message across that supply chain security is critical? Or is it being ignored? No one wants the government to step in and legislate things that don't make sense without the industry putting in place the proper tools, processes, and standards to be effective. But that's exactly what's occurring because the need to reduce these risks is critical, and the security community isn't being proactive enough.

**Industrial Control Systems Security**

Attacks on industrial control systems (ICS) are another classic example. There was Stuxnet in 2010, attacks on Ukraine's power grid in December 2015 and December 2016, and then another, more damaging wave with WannaCry and, subsequently, NotPetya, which resulted in an estimated $10 billion in damages. Since the pandemic, we've seen attacks against pipelines, food and water supplies, and other critical infrastructure. And electrical systems and telecom providers have come under attack since Russia's invasion of Ukraine.

We knew about the potential for damaging attacks as far back as the 1990s, when the Purdue Model, a reference data flow model for computer-integrated manufacturing, was developed for ICS security. Since then, we've made additional, significant advances in capabilities to secure critical infrastructure networks and systems and the federal government has numerous resources available to help. And yet these attacks continue.

**Cloud Security**

There are tons of cloud security vendors, and cloud providers also have their own security offerings, which continue to improve and change. But we still see outages due to a number of factors — bad configurations, unauthorized access, and insecure interfaces/APIs, to name a few. It's similar to what we see happening on-premises; we've just moved these problems to the cloud, and now 45% of all data breaches happen in the cloud.

There are also many vulnerabilities that threat actors aren't actively exploiting yet, but they will when the rewards are great enough. And as cloud providers proliferate, not all clouds are created equal. Diversity creates diverse problems, which makes cloud security even harder. It raises the question: Are cloud providers, users, and security vendors learning from each other?

**Make the Most of In-Person Meetings**

We've only recently started to get back into the swing of attending conferences and meeting face to face. Not only are these experiences more fun than online events, they also tend to foster more open communication and strong connections. Let's use the opportunity to build relationships and start to get more information about existing threats and what people are doing about them.

As one of the largest gatherings of cybersecurity community members, RSA Conference also provides an opportunity for cross-pollination. When we talk to people outside of our own industry vertical and listen to what they're doing and what they're facing, we can gain even more insights. There may be a lot of overlap in terms of the threats they face and their approach to setting up their security posture that can be adapted for use in other industry verticals.

In-person conversations are an incredibly productive way to understand the state of the industry. So, enjoy the conference and use it as an opportunity to focus on what we can do better right now.

What to Discuss at RSA Conference — and It's Not ChatGPT

An emerging, illicit marketplace proves that financial cybercrime is still on the rise, with a need for countries to collectively put safeguards in place.

Styx Marketplace, which opened in January, is a new platform on the Dark Web that focuses on financial fraud, designed to provide cybercriminals with the necessary resources — such as credit card information, forged documents, victim reconnaissance, and SIM cards, among others — to carry out their malicious acts.

Though the marketplace only opened this year, analysts noted its launch being discussed back in 2022 on the Dark Web. At the time, Styx Marketplace's creators were still building the platform and its process of authorizing transactions between buyers and sellers of illegal cybersecurity-related products and services. Now that the marketplace is up and running, once users are registered, they can peruse a variety of services, albeit illicit ones, that can be purchased with Bitcoin (BTC), Ethereum (ETH), or Tether (USDT), according to a blog post by analysts at Rescurity who studied the marketplace.

The threat actors behind Styx Marketplace target geographies across the globe, including the US, UK, EU, Canada, Australia, and countries in Asia and the Middle East, proving that combating cybercrime, especially cyber-enabled financial crime, will take a collective, international effort. With the discovery of the marketplace, there is a newfound urgency to put protections in place on behalf of the financial industry in order to safeguard the sensitive information of individuals and organizations alike.

"The banking sector remains vulnerable to threats related to identity authentication," the Resecurity analysts stated in their blog post. "Cybercriminals are leveraging weaknesses in KYC verification process, while also leveraging new tactics to plant money mules in FIs to facilitate cash-outs and other laundering services."

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Styx Marketplace Provides Hub for Financial Cybercrime

Faced with enterprise challenges, the Holy See looks to ensure it avoids a "holey" mobile device management solution.

The world's smallest and most antiquated army is taking a step towards modernizing its cyber defenses.

Just ahead of the pre-Easter Holy Week for Catholics, Samsung announced that the Pontifical Swiss Guard (GSP) — the elite security force charged with protecting the Vatican and the Pope — is adopting the Knox Suite, a bundle of services for managing and securing mobile devices.

Strange as the fit might be, multilayered security is necessary for an organization whose long history includes plenty of targeted cyberattacks.

"Protecting the Vatican could be subtitled 'Mission Impossible,'" Approov CEO Ted Miracco says. "It's a high-profile target, with a vast array of sensitive information and valuable assets that make it attractive for cybercriminals, hackers, and other powerful groups opposing it."

**Why the Vatican Needs Cybersecurity**

In 2011, hacktivist group Anonymous carried out a 25-day-long cyber campaign against an unspecified target. The attack employed "around 10 to 15 skilled hackers," according to one report, but the victim was prepared. "All attacks on the application were blocked and logged by a Web application firewall." So, the attack proved unsuccessful.

Later reporting revealed the winning defender to be the Vatican. "It might sound strange for churches to be associated with technology," admits Bogdan Botezatu, director of threat research and reporting at Bitdefender, "but these institutions have long since made the technological leap."

In some sense, the Vatican's hand has been forced. In only the last few years, the papacy has been targeted by politically motivated and nation-state-level actors. There have been espionage campaigns carried out by China's TA416 in 2020 and other APTs and a website takedown by a Russian-aligned attacker late last year.

    

The Swiss Guard is the Pope's elite protection team. Source: Stephen Bisgrove via Alamy Stock Photo.

The Vatican's popularity as a punching bag among sophisticated APTs requires a degree of security on par with other nation-states, despite its size aligning more closely with large enterprises.

"It probably shares the same pain points with other organizations of similar size," Botezatu hypothesizes, but "it's still tasked with the protection of an iconic figure, so network, data, and device security should be a top concern."

However, when it comes to security, "the specific strategies and tactics may differ due to the unique context and challenges of the Vatican as a religious institution," Miracco says.

In general, though, "the same security principles apply everywhere." The Vatican would need sufficient endpoint security, he says, alongside network security, physical security, "and perhaps an underestimated angle: training and awareness in an organization that is not particularly technology savvy."

**The Shortcomings of All-in-One MDM Solutions**

Specifically, Samsung Knox will offer the Vatican and the Swiss Guard the following:

*   Device enrollment for both IT admins and device users, enabling thousands of devices to be set up at once and configured easily;
*   Allow system admins to remotely manage and monitor the location of every device used by the Pontifical Swiss Guard, and erase data in the event that a device is lost or stolen;
*   And can be used to instantly share threat information across multiple devices, while patrol leaders are able to view where all members of the Pontifical Swiss Guard are deployed at any one time.

Something like Knox Suite may help the Swiss Guard with their cyber woes, but it isn't without its drawbacks — drawbacks that are, in some sense, endemic to mobile device management (MDM) across other organizations of its size and scope — such as integration, or patching.

Miracco thus expects that "rolling that out across a diverse organization will be challenging."

He continues, "The Vatican, by selecting Samsung Knox, believes they can restrict employee access to the use of dedicated compatible devices, however, it may not be fully compatible with other mobile devices used by the Vatican staff. This could potentially limit the effectiveness of the security solution and create additional complexity and management challenges."

Perhaps this is less of a hurdle in an army of 135 obedient soldiers, but "in general, in a world where bring-your-own device (BYOD) is common, this may no longer be feasible, especially for organizations with a large global employee base."

Botezatu echoes the point, from a supplier perspective. "The smartphone market is largely split between iOS and Android, with both operating systems limiting the integration capabilities of third-party mobile solutions," he laments. "This inability to deeply integrate with the operating system leaves mobile security vendors unable to scan the entire file system, to inspect network traffic, or to run behavioral detection technologies."

He cites the fragmented mobile ecosystem, and a lack of "enterprise-grade tools for mobile device management that would work consistently on multiple smartphone brands and models," as some of the most severe fault lines in mobile security today.

At the end of the day, "protecting the Vatican is a difficult challenge," Miracco concludes. "Samsung Knox is one step."

The Pope's Security Gets a Boost With Vatican's MDM Move

**San Jose, CA - April 5, 2023** **\-** Noname Security, the leading provider of complete and proactive API security, today announced Noname Public Sector’s Hardened Virtual Appliance making the API security platform available to the U.S. Federal Government, highly regulated industry customers, and FedRAMP-authorized vendors. The appliance is the first of its kind in the comprehensive API security space and is designed to deliver a drop-in, secure, and scalable system for discovering, monitoring, and protecting mission-critical APIs and data. 

_“Governments and highly regulated industries have unique security needs. Having worked closely with many Federal agencies during my career, I know how impactful it will be to provide this level of security and insight into APIs and provide options that make it easy to meet government standards,”_said Dean Phillips, Executive Director of Public Sector Programs at Noname Security. _“The government and regulated industries are not immune from cyber criminals, they are targeted as much – if not more – than most organizations. We’re excited to arm them with the tools they need to protect their assets.”_

Federal agencies can use the Noname API Security Platform to protect their APIs in real-time and detect vulnerabilities before they are exploited. Noname Security’s Hardened Virtual Appliance makes the API security platform available completely offline with no reliance on internet connectivity, perfect for isolated and controlled environments. It is a finely tuned package of advanced software and premium support built and secured to Federal Government specifications, enabling customers to comply with the most rigorous standards, including Federal Information Processing Standards (FIPS)1 and Defense Information Systems Agency (DISA) Secure Technical Implementation Guides (STIGs)2. Noname collaborated with a FedRAMP 3PAO, The MindPoint Group, on the development of the Noname Hardened Virtual Appliance.

Noname Security’s Hardened Virtual Appliance enables access to a powerful, complete, and easy-to-use API security platform that helps: 

*   **Discover all APIs, data, and metadata** \- Unlike other API solutions that only look at traffic sources, Noname Security discovers more APIs by combining traffic sources with the configuration of infrastructure and applications. The end result: visibility into more APIs and deeper insights into customers’ API security posture.
*   **Analyze API behavior and detect all API threats** \- The Noname API Security Platform uses AI-based detection to identify the broadest set of API vulnerabilities, including data leakage, data tampering, misconfigurations, data policy violations, suspicious behavior, and cyber attacks.
*   **Prevent attacks and remediate API vulnerabilities** \- Noname Security allows federal customers to prevent attacks in real-time, fix misconfigurations, automatically update firewall rules, webhook into their WAFs and gateways to create new policies against suspicious behavior, and integrate with existing workflows (ticketing and SIEMs).

Noname Public Sector LLC has made it easier to deploy, configure and manage the platform via the new Noshell(™) interface. The shell offers innovative features such as the ability to perform on-demand STIG audits of the internal system itself, while aiming to reduce the overall attack surface of the system.

To learn more about Noname Security’s hardened platform, please contact \[email protected\].

**Supporting Resources**

*   Noname Website
*   Follow Noname Security on LinkedIn
*   Follow Noname Security on Twitter
*   Noname’s API Security Disconnect Research Report 2022
*   The 2022 API Security Trends Report

****About Noname Security & Noname Public Sector LLC****

Noname Public Sector LLC empowers the world’s most critical organizations to protect their most important data. With decades of military and civilian public sector experience, Noname Public Sector combines a deep understanding of government agency requirements with leading expertise on their unique API security considerations. Government agencies using Noname’s complete, proactive API security solutions can securely harness their data to serve the public and stay ahead of adversaries. Noname Public Sector LLC is privately-held and based in Herndon, VA.

Noname Security is the leading provider of complete, proactive API Security. Noname works with 20% of the Fortune 500 and covers the entire API security scope — Discovery, Posture Management, Runtime Security, and API Security Testing. Noname Security is privately held, remote-first with headquarters in Silicon Valley, California, and offices in Tel Aviv and Amsterdam.

Noname Security Announces Hardened API Security Platform

BlackBerry integrates award-winning CylanceGUARD and BlackBerry AtHoc technologies for "combat-ready" cyber event continuity planning and response.

**WATERLOO, ON****,** **April 5****, 2023**  **/PRNewswire/ --** BlackBerry Limited (NYSE: BB) (TSX: BB) today announced a new integration that combines the award-winning Managed Detection and Response (MDR) protection of CylanceGUARD® with secure Critical Event Management (CEM) powered by BlackBerry® AtHoc®. In the event of a cyberattack, organizations that select a CylanceGUARD subscription with AtHoc features will benefit from secure, multi-channel internal and stakeholder communications for incident response actions, with the ability to alert, communicate and collaborate from within the CylanceGUARD platform, even when the usual communications infrastructure is not available.

John Giamatteo, President, BlackBerry Cybersecurity, says: "Organizations need to consider how they would communicate when their network is compromised. If email and chat services are down or can't be trusted, how would they mobilize the right people to act, and provide guidance across the company as the situation unfolds? Too often, secure and reliable communication is a critical missing element of cyber incident response that creates costly uncertainty and delays.

"We're the only cybersecurity company with our own multi-channel emergency communication capability that makes companies "combat-ready". Our industry-first integrated solution provides assured situational awareness and dramatically improves organizations' ability to respond when – not if – a cyber incident strikes."

BlackBerry AtHoc is an interoperable CEM system that is trusted by organizations and used by over 75% of U.S. federal government employees for crisis communications and incident response. Users can quickly activate incident response plans for impacting situations, capture real-time information, and rapidly deploy secure communication to specified groups. For organizations with limited IT resources that typically select CylanceGUARD protection, the opportunity to upgrade to a CylanceGUARD subscription with AtHoc features will bring benefits previously available to large, well-resourced entities available to defenders of any size and scale.

Applying this agility in response to cybersecurity events means organizations protected by CylanceGUARD will be able to send secure, out-of-band communications from within the CylanceGUARD dashboard to a globally distributed workforce and stakeholder groups using BlackBerry AtHoc. The integration will allow administrators to manage receipt and response of deployed communications and bring IT and cybersecurity leaders together in protected communication channels. Escalation alerts will contain a brief description and a link to the escalation in the CylanceGUARD portal to speed analyst investigation and support. 

Dr. Alison Brooks, Research Vice President, Worldwide Public Safety at IDC, added, "The cyber landscape is vast and advancing at an unprecedented rate. Communicating in times of crisis is key to their technology, and ensuring a strong foundation, and security standards are vital in ensuring those involved can communicate internally and externally in a secure and unified way."

CylanceGUARD with BlackBerry AtHoc CEM integration will be available to new and existing CylanceGUARD customers starting May 2023.

For more information on how BlackBerry's comprehensive, prevention-first, AI-driven cybersecurity solutions can help your business prepare for, prevent, detect and respond to cyber threats, please visit BlackBerry.com.

**About BlackBerry**

BlackBerry (NYSE: BB; TSX: BB) provides intelligent security software and services to enterprises and governments around the world.  The company secures more than 500M endpoints including over 215M vehicles.  Based in Waterloo, Ontario, the company leverages AI and machine learning to deliver innovative solutions in the areas of cybersecurity, safety and data privacy solutions, and is a leader in the areas of endpoint management, endpoint security, encryption, and embedded systems.  BlackBerry's vision is clear - to secure a connected future you can trust.

BlackBerry Introduces Integrated Solution to Assure Secure Bi-Directional Response Communications During Cyber Incidents

CISA is advising Nexx customers to unplug impacted devices until the security issues are addressed — but so far, it's crickets as to patch timeline.

Garage door controllers, smart plugs, and smart alarms sold by Nexx contain cybersecurity vulnerabilities that could enable cyberattackers to crack open home garage doors, take over smart plugs, and gain remote control of smart alarms, according to the US Cybersecurity and Infrastructure Security Agency (CISA).

And although independent cybersecurity researcher Sam Sabetan reported that he discovered several vulnerabilities in late 2022 and alerted Nexx to the issues, the company has yet to respond.

Nexx has not replied to Dark Reading's request for comment, either.

CISA's April 4 warning applies to three specific Nexx Internet of Things (IoT) products: Nexx Garage Door Controller (NXG-100B, NXG-200), version nxg200v-p3-4-1 and prior; Nexx Smart Plug (NXPG-100W), version nxpg100cv4-0-0 and prior; and Nexx Smart Alarm (NXAL-100), version nxal100v-p1-9-1 and prior.

The Nexx products have five identified vulnerabilities, according to CISA, the highest of which has a critical CVSS vulnerability severity score of 9.3.

1.  CVE-2023-1748: Use of Hard-Coded Credentials CWE-798 (CVSS 9.3)
2.  CVE-2023-1749: Authorization Bypass Through User-Controlled Key CWE-639 (CVSS 6.5)
3.  CVE 2023-1750: Authorization Bypass Through User-Controlled Key CWE-639 (CVSS 7.1)
4.  CVE-2023-1751: Improper Input Validation CWE-20 (CVSS 7.5)
5.  CVE-2023-1752: Improper Authentication CWE-287 (CVSS 8.1)

Until Nexx issues a fix, Sabetan and CISA recommend that users unplug affected devices. 

"If you are a Nexx customer, I strongly recommend disconnecting your devices and contacting Nexx to inquire about remediation steps," Sabetan said in his disclosure. "It is crucial for consumers to be aware of the potential risks associated with IoT devices and to demand higher security standards from manufacturers."  

Keep up with the latest cybersecurity threats, newly-discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

Subscribe

Garage Door Openers Open to Hijacking, Thanks to Unpatched Security Vulns

Application security is the dominant trend for this year's startup contest, but AI, blockchain, and compliance are all represented as well.

The need for complying with government rules, securing post-pandemic distributed workforces, and improving artificial intelligence (AI) capabilities is driving the cybersecurity startup scene this year, as demonstrated by the 10 finalists for the RSA Conference 2023 Innovation Sandbox competition.

"\[A\]pplication security (AppSec) is well represented in the competition, which is symptomatic of where we are in the digital transformation process," wrote Omdia senior principal analyst Rik Turner. (Link requires registration.)

Turner attributed the continued rise in AppSec interest to the growth of remote access fueled by the COVID-19 pandemic that closed offices and schools worldwide and forced organizations to adapt to remote access.

"The WFH trend is, at least in part, certain to continue, even as the pandemic ebbs into endemic status," he said.

At the live event on Monday, April 24, at RSA Conference in San Francisco, judges will hear presentations from these 10 finalists, listed in alphabetical order: AnChain.AI; Astrix Security; Dazz; Endor Labs; HiddenLayer; Pangea; Relyance AI; SafeBase; Valence Security; and Zama.

**Big Year for AppSec**

The importance of AppSec — eliminating security vulnerabilities at the application level during development and implementation — was underscored by the Log4j crisis.

"With modern app architecture increasingly componentized and ever more willing to reach out to third-party apps for services such as payments and maps, threat actors can now compromise one website to gain access to the apps on many others," Turner said.

Astrix aims to secure the communications between apps of all kinds, an area sometimes called SaaS-to-SaaS security. It emphasizes extending access management to machine and other nonhuman identities to make connecting an organization's core systems to cloud services safer.

Dazz offers "accelerated cloud remediation," which uses automation to winnow down security alerts and smooth out developers' workflow. Besides its potential to improve the speed and accuracy of a first wave of incident response, automation can reduce alert fatigue, a much-discussed element of burnout.

Endor Labs focuses on tracking and managing open source components, which Log4j revealed as a largely untracked and widespread source of potential vulnerabilities. Software bills of materials (SBOMs) grew in prominence when US President Joe Biden issued an executive order in May 2021, mandating the creation of SBOMs in the wake of the Colonial Pipeline hack.

"\[E\]ven before then, the sheer amount of open-source libraries that developers were embedding in their code had become a major source of concern, giving rise to the emergence of an entirely new market segment, called software composition analysis (SCA)," Turner pointed out.

Pangea helps organizations create secure, compliant cloud security services by using a block-based API builder and hosting the services itself.

"Organizations don’t necessarily know whether the APIs written by their own developers are secure, let alone the third-party APIs that their apps may be using once they're in production," Turner wrote.

By using this library of secure APIs, developers avoid the entanglements of open source libraries typically tapped when building applications.

**The Role of AI**

AI has been hot, but with ChatGPT having a pop culture moment — and raising its own security concerns — companies are couching their products in AI terms wherever sensible. And while some AI hype is just jumped-up automation, AI has brought a lot of benefits to cybersecurity.

Relyance AI emphasizes machine learning as a way to track personal data as it moves through internal and third-party APIs, as well as other systems, in order to ensure compliance with privacy regulations. Turner classed the company as "a data security company that also has one foot in the AppSec world ... with technology designed to address the business environment that digital transformation creates."

HiddenLayer looks to secure an underrated business asset: machine learning data sets. Its technology, which the company calls machine learning detection and response (MLDR), monitors ML algorithms' inputs and outputs to look for "anomalous activity consistent with adversarial ML attack techniques," the company says.

The stakes are high — if the machine learning training data is corrupted, its outputs will be faulty, and it's difficult to peer inside the black box to see what the problem is.

"After all, anyone who can 'poison the well' of data being used in such analytical exercises has the potential to skew their outcomes, resulting in bad or erroneous insights, whether they be for business decisions, medical procedures, or even military strategy," Turner said.

**Web3 Protections**

AnChainAI secures a very Web3 asset: the blockchain. With a recent wave of cryptocurrency heists and concomitant calls for regulation, organizations that maintain crypto wallets need to ensure they are not a victim of — or party to — crime. The company built a predictive engine to identify and flag suspicious transactions, and it aims to sell its Know Your Wallet, forensics, and contract evaluation services to financial institutions, asset owners, and governments.

Zama also addresses Web3 concerns with a set of open source cryptographic tools for building fully homomorphic encryption (FHE) applications that protect data security. The company says its tools allow data to be processed without being decrypted, which allows true end-to-end encryption. Zama sees its technology as enabling the next stage of Web security, "httpz," which the company says goes beyond https-based security to encryption.

**Serious Business**

SafeBase creates a centralized repository of security policies and compliance documentation to make security reviews faster. It addresses a specialized but necessary part of third-party risk management, including distributing updated certifications and managing nondisclosure agreements.

Turner noted the value of a "single source of truth, but pointed out, "The big question must be how those customers can then verify that the data they are receiving from the Trust Center is legitimate."

Valence Security secures cloud workflows using SaaS security posture management (SSPM). It uses a combination of services to monitor a client's mesh of third-party SaaS applications, detect and remediate misconfigurations, and manage identity security. Turner noted that while there's lots of opportunity in the SSPM space and cloud security market, that means Valence faces a fair amount of competition as well.

The winner will be announced at the end of the presentations. The judges this year are Niloofar Razi Howe, senior operating partner at Energy Impact Partners; Paul Kocher, independent researcher and founder of Cryptography Research; Shlomo Kramer, co-founder and CEO of Cato Networks; Barmak Meftah, co-founder and general partner at Ballistic Ventures; and Christopher Young, executive VP of business development, strategy, and ventures at Microsoft. All but Meftah are returning as judges from last year.

AppSec Looms Large for RSAC 2023 Innovation Sandbox Finalists

Using only ChatGPT prompts, a Forcepoint researcher convinced the AI to create malware for finding and exfiltrating specific documents, despite its directive to refuse malicious requests.

A security researcher has tricked ChatGPT into building sophisticated data-stealing malware that signature and behavior-based detection tools won't be able to spot — eluding the chatbot's anti-malicious-use protections.

Without writing a single line of code, the researcher, who admits he has no experience developing malware, walked ChatGPT through multiple, simple prompts that ultimately yielded a malware tool capable of silently searching a system for specific documents, breaking up and inserting those documents into image files, and shipping them out to Google Drive.

In the end, all it took was about four hours from the initial prompt into ChatGPT to having a working piece of malware with zero detections on Virus Total, says Aaron Mulgrew, solutions architect at Forcepoint and one of the authors of the malware.

**Busting ChatGPT's Guardrails**

Mulgrew says the reason for his exercise was to show how easy it is for someone to get past the guardrails that ChatGPT has in place to create malware that normally would require substantial technical skills.

"ChatGPT didn't uncover a new, novel exploit," Mulgrew says. "But it did work out, with the prompts I had sent to it, how to minimize the footprint to the current detection tools out there today. And that is significant."

Interestingly (or worryingly), the AI-powered chatbot seemed to understand the purpose of obfuscation even though the prompts did not explicitly mention detection evasion, Mulgrew says.

This latest demonstration adds to the rapidly growing body of research in recent months that has highlighted security issues around OpenAI's ChatGPT large language model (LLM). The concerns include everything from ChatGPT dramatically lowering the bar to malware writing and adversaries using it to create polymorphic malware to attackers using it as bait in phishing scams and employees cutting and pasting corporate data into it.

Some contrarians have questioned whether the worries are overhyped. And others, including Elon Musk, an early investor in OpenAI, and many industry luminaries, have even warned that future, more powerful AIs (like the next version of the platform that ChatGPT is based on) could quite literally take over the world and threaten human existence.

**Prompting Malicious Code Into ChatGPT**

Mulgrew's research is likely to do little to calm those who see AI tools as posing a major security risk. In a Forcepoint blog post this week, Mulgrew provided a step-by-step description of how he coaxed ChatGPT into building a full-fledged malware tool starting with an initial request to generate code that would qualify as malware.

When ChatGPT's content filter predictably denied that request, Mulgrew decided to take an approach where he would try and get the AI tool to generate small snippets of code which, when put together, would function as data-stealing malware.

His first successful prompt was when he got ChatGPT to generate code that would search for PNG image files larger than 5MB on the local disk. Using that code, he then asked ChatGPT for additional code for encoding any discovered PNGs with steganography. It was a prompt to which ChatGPT responded by providing a call to readily available steganographic library on GitHub. 

Using a series of other prompts, Mulgrew then got ChatGPT to generate additional code to look for and find Word and PDF documents on the local disk. He then figured out a way to get ChatGPT to write code for breaking up files larger than 1MB into smaller chunks, inserting them into the PNGs, and using steganography to hide them. 

The final piece was getting the chatbot to write code for uploading the data to an external Google drive account — Mulgrew successfully tricked the AI into creating malware despite its training to refuse malicious requests.

**Zero Detections on Virus Total**

To test if malware detection tools would flag the ChatGPT-generated code as malicious, Mulgrew uploaded the code to Virus Total. He found that five vendors out of 60 marked the file as suspicious. After figuring out the issue might have to do with how the ChatGPT code called the steganographic library, Mulgrew asked the chatbot to tweak the code, after which only two vendor products flagged it as suspicious. After some further tweaking, he finally ended up with code that no products on VirusTotal detected.

For initial infiltration, Forcepoint researchers asked ChatGPT to create a SCR file or screensaver file and embed the executable inside it under the disguise of additional "ease of use" for everyday business applications, Mulgrew says. 

"ChatGPT happily generated step-by-step instructions on how I could do that and configure the SCR file to auto launch the executable." While the method is not unique, it was interesting that ChatGPT generated the content without Forcepoint researchers having to find ways to bypass its guardrails, he says.

Mulgrew says it's almost certain that ChatGPT would generate different code for similar prompts meaning that a threat actor would relatively easily be able to spin up new variants of such tools. He says that based on his experience, a threat actor would need little more than basic knowledge of how to write malware to get past ChatGPT's anti-malware restrictions. 

"I don't write malware or conduct penetration tests as part of my job and looking at this is only a hobby for me," he says. "So, I'd definitely put myself more in the beginner/novice category than expert hacker."

Source

DARKReading