Sergej Dergatsjev

Another Tuesday another unpatched vulnerabilities's report: This time, a usenix report about unpatched vulnerabilities across IT sysytems of dutch municipalities. While this maybe specific to one industry but the challenges of "patching being hard" are universal. As always, making it easier to apply patches will be a game-changer for the cyber industry. Koalalab Abhishek Anand UseNix report: https://lnkd.in/g6tNTP_D https://lnkd.in/g8f7zaT5

12

1 Comment

Security researcher Johann Rehberger recently reported a vulnerability in ChatGPT that allowed attackers to store false information and malicious instructions in a user’s long-term memory settings. The vulnerability abused long-term conversation memory, a feature OpenAI began testing in February and made more broadly available in September. Memory with ChatGPT stores information from previous conversations and uses it as context in all future conversations. That way, the LLM can be aware of details such as a user’s age, gender, philosophical beliefs, and pretty much anything else, so those details don’t have to be inputted during each conversation. Rehberger privately reported the finding to OpenAI in May. That same month, the company closed the report ticket. A month later, the researcher submitted a new disclosure statement. This time, he included a PoC that caused the ChatGPT app for macOS to send a verbatim copy of all user input and ChatGPT output to a server of his choice. While OpenAI has introduced a fix that prevents memories from being abused as an exfiltration vector, the researcher said, untrusted content can still perform prompt injections that cause the memory tool to store long-term information planted by a malicious attacker. LLM users who want to prevent this form of attack should pay close attention during sessions for output that indicates a new memory has been added. They should also regularly review stored memories for anything that may have been planted by untrusted sources... #informationsecurity #cybersecurity #security #artificialintelligence #ai #chatgpt #openai #vulnerabilities #memory #cyberawareness

32

13 Comments

🇪🇺𝐄𝐮𝐫𝐨𝐩𝐞 𝐒𝐡𝐨𝐮𝐥𝐝 𝐍𝐎𝐓 𝐅𝐚𝐢𝐥 𝐭𝐨 𝐀𝐜𝐭! “𝑰𝒕’𝒔 𝒕𝒊𝒎𝒆 𝒕𝒐 𝒔𝒉𝒊𝒇𝒕 𝒕𝒐 𝒂 𝒘𝒂𝒓𝒕𝒊𝒎𝒆 𝒎𝒊𝒏𝒅𝒔𝒆𝒕 𝒂𝒏𝒅 𝒕𝒖𝒓𝒃𝒐-𝒄𝒉𝒂𝒓𝒈𝒆 𝒐𝒖𝒓 𝒅𝒆𝒇𝒆𝒏𝒔𝒆 𝒑𝒓𝒐𝒅𝒖𝒄𝒕𝒊𝒐𝒏 𝒂𝒏𝒅 𝒔𝒑𝒆𝒏𝒅𝒊𝒏𝒈.” – NATO Secretary General Mark Rutte. I want to add that we need a “𝐜𝐲𝐛𝐞𝐫 𝐰𝐚𝐫𝐭𝐢𝐦𝐞 𝐦𝐢𝐧𝐝𝐬𝐞𝐭.” *Neutrality in cyberspace is no longer acceptable.* 📌NOTE: These are my thoughts, not those of any other organization. Adversaries now disrupt infrastructure, destabilize economies, and erode trust without conflict. As someone who trains cyber warfare units globally, I often see military cyber commanders struggle to project the necessary power in cyberspace. I understand that while essential, Europe’s commitment to human rights and the rule of law ⚖️ must not hinder the urgent evolution of cyberspace operations strategies and policies. I know this is a delicate EU topic. The EU and NATO should adopt a more assertive and proactive approach when maneuvering in cyberspace. 𝐖𝐡𝐚𝐭’𝐬 𝐭𝐡𝐞 𝐬𝐨𝐥𝐮𝐭𝐢𝐨𝐧? A paradigm shift. A fierce and aggressive stance that prioritizes solid cyberspace operations while respecting fundamental legal principles. There’s no time for hesitation. 𝑁𝑎𝑡𝑖𝑜𝑛𝑠, 𝑝𝑜𝑙𝑖𝑐𝑦𝑚𝑎𝑘𝑒𝑟𝑠, 𝑎𝑛𝑑 𝑑𝑒𝑓𝑒𝑛𝑠𝑒 𝑙𝑒𝑎𝑑𝑒𝑟𝑠: 𝑇ℎ𝑖𝑠 𝑖𝑠 𝑦𝑜𝑢𝑟 𝑐𝑎𝑙𝑙 𝑡𝑜 𝑎𝑐𝑡𝑖𝑜𝑛. 𝑇ℎ𝑒 𝑠ℎ𝑖𝑓𝑡 𝑏𝑒𝑔𝑖𝑛𝑠 𝑤𝑖𝑡ℎ 𝑦𝑜𝑢. 𝐸𝑚𝑏𝑟𝑎𝑐𝑒 𝑎 𝑐𝑦𝑏𝑒𝑟 𝑤𝑎𝑟𝑡𝑖𝑚𝑒 𝑚𝑖𝑛𝑑𝑠𝑒𝑡 𝑡𝑜𝑑𝑎𝑦 𝑡𝑜 𝑠𝑎𝑓𝑒𝑔𝑢𝑎𝑟𝑑 𝑡𝑜𝑚𝑜𝑟𝑟𝑜𝑤. Cyber Security Forum Initiative #CSFI

46

6 Comments

Mind reading is inching closer to reality. Top image = what the monkey saw. Bottom image = What the AI reconstructed from brain activity. Researchers at Radboud University just developed an AI system capable of reconstructing remarkably accurate images of what someone is looking at. Based on their brain activity recordings. > The team used both fMRI scans of humans and direct electrode recordings from a macaque monkey to capture brain activity while viewing images. > An improved AI system learned which parts of the brain to focus on, significantly enhancing reconstruction accuracy. > Lead researcher Umut Güçlü claims these are "the closest, most accurate reconstructions" to date. My take: While the study has some limitations (like using images already in the dataset), this research is still mind-blowing. From helping stroke victims communicate to recreating dreams, we’re likely seeing the early innings of a tech that will have major applications in society as it continues to improve.

108

20 Comments

UEFA Nations League Belgium vs Italy: Tactical Breakdown CB Projection in Central Space: Italy utilized their center-back stepping into central areas to create added dynamics in the attacking phase, facilitating progressive plays and overloads. Pinning and Overloading: The first line of Italian attackers focused on pinning Belgium's defensive line in specific zones. This tactic aimed to isolate the opposition's half-space or central areas, creating exploitable gaps. 'Circulation Support' Near Ball Zone: Cambiaso played as the free man near the ball zone, providing a consistent and threatening option for progression with his advanced positioning. Goal Sequence Analysis Intervention Zone Support: Strong positional support was maintained near the ball zone, ensuring quick transitions and dominance in duels. Dynamic Superiority: Italy capitalized on their anticipatory movements in attacking channels, combining pinning actions with off-the-ball runs to destabilize Belgium's defensive structure. Exploiting Passing Angles: Through sharp ball circulation, passing lanes were created behind Belgium’s defensive line, setting up opportunities to exploit with precise deliveries. Luciano Spalletti's Aggressive Positional Play Spalletti showcased his signature style with high-intensity positional play. The Italian side used overloads against Belgium's last defensive line to create gaps and exploit blind spots. This approach saw wingbacks and center-backs frequently pushing into advanced areas, generating threatening chances and maintaining control in key attacking zones. #FIFA #UEFA #ChampionsLeague #coachmoulayali

6

1 Comment

New Copilot in Windows 11 will take screenshots of everything you do on your PC so you can get back to it in case you forgot. A feature no one asked for. It is claimed the data will live on the device but it opens a door for privacy issues for no added value. I cannot think of a time when I needed to "get back to what I was doing" which cannot be done already. If I lost a file. I can search in explorer. Which is extremely poor but that's what it is made for. If I forgot a conversation I will search in teams or slack. If I lost an email, I will search in outlook or the mail client. When exactly is it better to search in the whole house when you know which room you should search for? The feature sounds more like groundwork for AI engine as a replacement of Desktop where AI will be used to launch apps from a given state and be the primary interface you interact with. But can we trust Microsoft for this?

8

9 Comments

In the past week we've seen OpenAI release GPT-4o and Google release a new version of Gemini Pro 1.5, together with their new Gemini Flash model. The big news about these announcements is efficiency, speed and cost. Yay! 🐢 The challenge with GPT-4 has been its slowness - whilst it's a great model, it's so slow that I've had to rule out using it in several situations. If you need to make multiple calls to the model (very common) and you have a user sitting waiting on a response, GPT-4 is not viable. Why is it slow? Because it's a large model and larger models use more compute and take longer to respond. 🏎️ Enter GPT-4o, which is much, much faster. Why is it faster? Because it's a better optimised model that uses less compute and is able to respond quicker. And it's cheaper - 50% of the cost of GPT-4-turbo. When you make lots of calls to a model, a 50% cost reduction is a big deal. ⚡️ Now let's look at Google. Gemini 1.5 Pro and its stablemate 1.5 Flash both bring significant optimisations: "1.5 Pro, despite using significantly less training compute, surpasses 1.0 Ultra, a state-of-the-art model, on text capabilities like math, science and reasoning, code, multilinguality and instruction following. Similarly, 1.5 Flash outperforms 1.0 Pro, despite being more lightweight and efficient." 💸 Emphasising the importance of faster, more efficient, cheaper models, Gemini Flash is a new class of model explicitly designed to address these requirements. Because often we need something that responds quickly and costs less. When I say costs less, Gemini Flash is around 1/10th the cost of Gemini Pro. 🔥 But Google's not done with Flash as a smaller, more efficient model. The Gemini Technical Report also talks about a further model, Flash-8B, which is still under development. It's an even smaller model, optimised for uses such as large-scale data labelling and high-throughput agents, where speed and cost are major drivers. Of course Flash-8B is smaller and not as good as 1.5 Pro, but it's probably *good enough* for a whole class of uses. Not everything requires the most sophisticated AI available. 👉 These new models may not have set the world on fire with dramatic new capability leaps, but they do set *my* world on fire with faster, cheaper, more efficient models. They use less energy, they generate less CO2 (remember, we have a climate emergency), they cost less to use and they respond faster. If you need high-end capability then GPT-4o and Gemini Pro 1.5 both push the envelope on capability. This feels like the advancement we need - the option to pay more for better models, or pay less for more optimised and faster models.

5

1 Comment

It's Friday, time to have some fun. My friend Christophe Hoarau developed a modern data stack simulator as a cookie clicker 🍪 In the game you can ingest new sources manually, build pipelines to get the data automatically, buy tool, tain models, hire people and get money out of the dashboards that you create! This is really cool (and as a cookie clicker enjoyer I like it) If you wanna try ➡️ https://lnkd.in/eBr5UTu2 PS : I also do a shoutout to Christophe last project which is an upskilling academy called Ada where you can learn stuff about Python, dbt, Airflow (everything about the Modern data stack actually) (it's in French). You can join using my link here: https://lnkd.in/eNwe5TQr (and I have a promocode for you if you want BLEF15)

154

18 Comments

To all CEOs, CISOs and managers in my network: I can highly recommend reading this insightful article if you want your business to be safe and resilient now and in the future: https://lnkd.in/e64CVjAA And a little birdie told me there will be a part 2 and 3 to this article, coming up soon!🦜

22

1 Comment

Really enjoyed facilitating a 3-hour workshop on API security testing for a group of about 30 testers at the Vereniging TestNet spring conference this morning. Through a number of hands on exercises, we (dis-)covered 6 out of the 10 vulnerabilities listed in the 2023 OWASP API security Top 10. Apart from learning more about API security, the main lesson I try and convey in this workshop is that getting started with API security testing doesn’t have to take more than an API client (such as Postman) and a healthy dose of curiosity and critical thinking.

49

5 Comments

🥑 𝐄𝐯𝐞𝐫 𝐰𝐨𝐧𝐝𝐞𝐫𝐞𝐝 𝐰𝐡𝐨 𝐞𝐱𝐚𝐜𝐭𝐥𝐲 𝐢𝐬 𝐚 𝐃𝐞𝐯𝐞𝐥𝐨𝐩𝐞𝐫 𝐀𝐝𝐯𝐨𝐜𝐚𝐭𝐞? Fun fact: they're affectionately called 'Avocados'! 🥑 To all developers/data scientists: Join us in the latest episode of "Diaries of a Data Scientist", where we unravel the mysteries of Developer Advocacy! In this episode WE: ▪️ Explore why companies are clamouring for Developer Advocate and why developers are equally intrigued, despite it being an unpaid gig (or is it really?). 🤔 ▪️ Learn about the profile of a Developer Advocate (in case you want to go this path), their key responsibilities, and the essential skills they bring to the table. 💼 ▪️ Discover the kind of individuals who thrive in this role and why they're crucial assets in bridging the gap between developers and companies. 🌐 ▪️ Plus, explore how this position is gaining popularity worldwide and uncover the salary ranges across different countries! 💰 Listen also on: 🎧 Spotify: https://lnkd.in/eCdJti7k 🎧 Apple: https://lnkd.in/eX-J4ztf 🎬 YouTube: https://lnkd.in/emFf4tzU If you like our podcast, please consider leaving a review on Spotify, subscribe on Youtube and leave a comment and/or 👍! This would help us a lot ♥️ #datascience #dods #diariesofadatascientist #aicommunity 🖇️ Useful links (unpaid advertisement, personal recommendations): Megan Lieu Tiffany Janzen - Developer relations: https://lnkd.in/ecFPyZz7 relations%2C abbreviated as DevRel,on purchases%2C of a product What is developer relations: https://lnkd.in/ea8z9jgB - Another interesting podcast episode on this topic: https://lnkd.in/e6TC_-nC, @Prismic - How to get into the role: https://lnkd.in/euts-SdX - Salary ranges: -- https://lnkd.in/e6dGfbrw (2024) -- https://lnkd.in/eARtaD9C developer advocate in Germany,about €6%2C500 per month. (2023) -- https://lnkd.in/enaZ8ywF (2024) P.S. To check current positions in the market, please type 'Developer Advocate' into the LinkedIn search bar ** Avocado picture from Etsy.

26

2 Comments

🇮🇹 We’re bringing the expert-level stack exploit development class to Rome, Italy for the first time in history! 🇮🇹 You don’t want to miss out on this unique opportunity to take the first of our 2 world-renowned classes on exploit development for Windows. ⭐️ Our classes are an amazing investment in your future. The content will definitely broaden your offensive cybersecurity skills and put yourself in the drivers seat of your career ⭐️ Just to set the expectations straight: We’re not selling boxes, pdf files, videos. We’re only doing real classes, in person, lead by Peter Van Eeckhoutte himself. He has been working in the field of exploit development since 2005 and teaching classes since 2011. At the same time, you can still learn at your own pace. In fact, you’ll leave the class with: ✅ An unprecedented understanding of the inner workings and mechanics. We won’t tell you to “just do this or that”, but you’ll understand exactly “why”. ✅ The courseware is quite detailed and verbose ✅ Investment protection; Just to indicate how much we care about your education, we include FREE access to a post-training support system. You can ask questions at any time and we’ll be more than happy to guide you into the right direction. Yes, even years after you took one of our classes. Sign up now for our class in Rome, or check out our schedules page for other timings/locations: https://lnkd.in/e-GhbBW

56

1 Comment

I often hear this question: "𝗜 𝗮𝗹𝗿𝗲𝗮𝗱𝘆 𝗵𝗮𝘃𝗲 𝗮𝗻 𝗮𝗻𝘁𝗶𝘃𝗶𝗿𝘂𝘀. 🦠 𝗜𝘀𝗻'𝘁 𝘁𝗵𝗮𝘁 𝗲𝗻𝗼𝘂𝗴𝗵 𝘁𝗼 𝘀𝗲𝗰𝘂𝗿𝗲 𝗺𝘆 𝗯𝘂𝘀𝗶𝗻𝗲𝘀𝘀 𝗰𝗼𝗺𝗽𝘂𝘁𝗲𝗿𝘀?" The answer is NO. It is not enough! Many cyber threats aren't viruses, so regular antivirus programs can't detect them. For example: ➡️ Your computers or network may have ports open where they should be closed. ➡️ There may be code obfuscation, a tactic to make computer code obscure or unclear so that humans or traditional antivirus programs can't understand it. ➡️ Your browser may be vulnerable to hijacking with many adverse consequences: - Spyware installation - Crashing browsers - Changing home pages to malicious websites - Stealing passwords and personal data - Redirection to phishing sites - Execution of other types of malware Therefore, it is wise to have multiple cybersecurity tools beyond an antivirus program. 🧰 Each can detect a different type of cyber threat. Book your Cybersecurity Strength Assessment call today and learn how to improve your business cybersecurity posture! #cyberthreat #wisechoice #antivirus #cybersecurity #cybersafety #lawfirm #smallbusiness #entrepreneur

1

Google presents its new AI models: stronger, faster, more useful Right at the start of its I/O developer conference, Google presented new versions of its Gemini AI models. They are stronger, faster and, above all, more extensive than their predecessors. Project Astra also shows how Gemini can be useful in everyday life. Gemini 1.5 Pro - even more powerful Gemini is Google's personal AI assistant. The Pro model has now received some upgrades. In particular, the context window was enlarged to two million tokens. This means users can now feed the assistant more information at once. For example, up to 1,500 pages of text can be evaluated at once or up to 100 emails can be summarized. Gemini will soon be able to process an hour of video content or program code that is more than 30,000 lines long. Corresponding files can be uploaded directly from Google Drive. Google Messages users can also communicate directly with the AI via Gemini Live. This mobile-optimized and conversation-based feature aims to make using Gemini even more intuitive. This makes it particularly easy to ask questions. The assistant's answers can also be interrupted to ask further questions. Gemini Advanced subscribers will also be able to create their own personal version of the assistant using the new Gems feature. You can specify what the AI should do and how it should respond. A short instruction like "You are my running coach. Create a daily running plan for me and motivate me with positive messages" is enough. Gemini 1.5 Flash - even faster For applications where speed and efficiency are particularly important, Google has developed the new Flash version of Gemini. It is faster than the Pro version, but can still process large amounts of information. It is particularly suitable for summaries, chat applications, the creation of image and video subtitles, data extraction from long documents and tables. Gemini Nano - even more useful This version of Gemini is used, among other things, on Android mobile devices. It has been expanded beyond text input and now includes images. Google Circle to Search can already be used on a number of devices. In the future, a Gemini overlay will also be available that can be used in combination with other apps. Then Gemini will also better support TalkBack, a feature for people with impaired vision, through descriptions of the content on the screen. The AI also warns all users of potential phishing attempts during telephone conversations. Gemini Nano will also be built into Google Chrome in the future. Google Astra - The new AI agent With the intention of developing a useful helper in everyday life, Google has now presented a prototype of its new AI agent Astra in a video. The helper answers users' questions by continuously encoding video images, combining video and voice input into a timeline of events, and caching this information for efficient retrieval.

2

1 Comment

Microsoft SharePoint Bug Alert! A new bug in Microsoft SharePoint has been exploited, allowing hackers to breach corporate networks through a Remote Code Execution (RCE) vulnerability. • High-Risk Threat: Hackers are exploiting this SharePoint bug to gain unauthorized access to sensitive corporate data. • Potential Impact: Once in, attackers can access, modify, or steal valuable business information. • Stay Protected: Make sure your SharePoint system is up-to-date and regularly monitored for vulnerabilities. At Powerful IT Systems , we provide proactive security services to protect your business from cyber threats like this. Don’t wait for an attack—secure your network now! Need Help with Cybersecurity?

2

1 Comment

📌 Pandas vs. Polars: The Data Processing Evolution After spending considerable time mastering Pandas, I have come across a new challenger—Polars, which promises a 5-20x speed boost. Staying ahead in data science means embracing change, and Polars is making waves in performance. The SuperDataScience Podcast recently featured Ritchie Vink, CEO and Co-Founder of Polars, where he broke down how Polars outshines Pandas in speed and efficiency. This inspired me to dive in and see for myself. I have added Polars to my toolkit and will be running comparisons to experience the difference firsthand. If you’re serious about data science, tuning into podcasts like this is crucial for staying informed. 🐼 Let’s explore the future of data processing with Polars!

2

A long way from GenAI today. This was a 5 mb Hard Drive when it was invented. I have a 1 Tb thumb drive today in my pocket. How will we evolve todays technology. How will we look back at the first Generation GenAI? Foood for thought. Humans are amazing, but let us be aware that with great innovation comes those who will exploit it. Who could have imagined that todays data repositories would become the target of cyber criminals creating ransomware attacks and extorting money from the innocent. It is incumbent on us to not only imagine what good can be done with innovation, but also what the possibilities for exploitation are for said innovations. The world we live in means we need to design built in security and protections into every innovation humans bring to life. Why? because the very same human innovativness will create create exploitations we don’t need. love to hear your thoughts in the comments .

17

3 Comments

How to create a Semantic Graph for extracting knowledge from Videos! Multimodal LLM with Privacy and Security uniquely offered by www.Accure.AI! The only solution containerized within Kubernetes on-premises or in the cloud, with role based access controls, OAuth2.0 tokenization, and secure IoT integration support for video streams… I believe to achieve Sentient AI this is needed with a picture being worth a 1000 words, what’s a video worth? Let’s See!

1

1 Comment