Elias Bachaalany

Andrew Ng’s take on California's proposed law SB-1047 is spot on: “There are many things wrong with this bill, but I’d like to focus here on just one: It defines an unreasonable “hazardous capability” designation that may make builders of large AI models potentially liable if someone uses their models to do something that exceeds the bill’s definition of harm (such as causing $500 million in damage). That is practically impossible for any AI builder to ensure. If the bill is passed in its present form, it will stifle AI model builders, especially open source developers. Some AI applications, for example in healthcare, are risky. But as I wrote previously, regulators should regulate applications rather than technology. Technology refers to tools that can be applied in many ways to solve various problems.Applications are specific implementations of technologies designed to meet particular customer needs. Safety is a property of applications, not a property of technologies (or models), as Arvind Narayanan and Sayash Kapoor have pointed out. Whether a blender is a safe one can’t be determined by examining the electric motor. A similar argument holds for AI.” #publicpolicy #policy #ai #machinelearning #ml #compliance #technology #society #sb1047 #opensourcesoftware #oss

4

Simplify Cloud Security: ScoutSuite and Copilot Tutorial https://lnkd.in/gmp4vCpY

7

Are you scratching your head trying to figure out your new SBOM requirements? Our new phase of "Digitial Safety" will replace Cybersecurity with requirements seen in other fields of civic society. Knowing what is in your software, hardware, and silicon is no different from learning the materials used to build a skyscraper. SBOM requirements are inevitable. Check out Nigel Hanson's series of SBOM articles on Digitial Safety. https://lnkd.in/gYh-by7W . #sbom

9

Vigilocity is closely tracking this. https://lnkd.in/gGWcmUis

24

🚨 Case Study Alert: How DigiCert Traced Incident Breadcrumbs for Swift Resolution 🚨 Explore how rapid threat detection and remediation can make the difference between a minor issue and a major breach. See the full story and how WireX Systems' advanced tools helped DigiCert react in minutes. #CyberSecurity #ThreatRemediation #IncidentResponse #WireXSystems #DigiCert"

3

I did a deep dive into the browser fingerprint of an unmodified Headless Chrome instrumented with Puppeteer to see what are the main differences with a normal Chrome that still exists in 2024: https://lnkd.in/eSfUYpdR The usual inconsistencies, such as navigator.webdriver are still there (even though it can easily be deleted using--disable-blink-features=AutomationControlled) However, all the old inconsistencies I discussed in previous articles, such as the absence of navigator.languages and window.chrome, don't exist anymore.

33

4 Comments

ICYMI | February writeup on the susceptibility of our critical infrastructure to drone attacks... Scary stuff indeed. What makes this even more of a concern is this excerpt from a critical infrastructure attack in California back in 2013. "The U.S. could suffer a coast-to-coast blackout if saboteurs knocked out just nine of the countries 55,000 electric transmission substations".... #criticalinfrastructure #criticalcontrols #riskmanagement #riskassessment #cybersecurity #infosec #nerc

1

A large webshop fraud ring has been exposed, highlighting the importance of vigilance against online scams. The ring tricked victims into making fake purchases on bogus websites, stealing credit card information and attempting to process millions of dollars in fraudulent orders. They also resold stolen credit card details. This is a stark reminder of the ever-present threat of cybercrime. As security professionals, we can help educate our networks about online safety and best practices for identifying legitimate websites. #cybersecurity #webshopfraud #onlinesafety https://lnkd.in/ghzUiK4p

6

#binarygolf is upon us, and it's time to blog about some #Linux shellcoding! Read how I employed a TSX egg-hunting technique, as well as giving up and performing execve eventually, making a 46-byte Linux shellcode that solves the challenge: https://lnkd.in/dhVVpqgq

29

2 Comments

Researchers find serious TSA SQL injection bug in small service and at first TSA responds well, but then becomes less cooperative and turns to undermining the potential seriousness of the issue. https://ian.sh/tsa

13

1 Comment

Big news in the SIEM world! #Exabeam and #LogRhythm are merging to create a powerhouse in security operations. Interesting to see how this will impact the market. https://lnkd.in/er2HvJwR #informationsecurity #SIEM #Exabeam #LogRhythm #Cybersecurity #SecurityOps‍‍‍‍‍‍‍

16

Threat actors have leveled up their game with registered domain generation algorithms (RDGAs). Learn how they're exploiting this technique to register multiple domains at once, evading detection: https://gag.gl/IvgDm6 #Infoblox #RDGAs #DGAs #ThreatActors #Malware

1

Ever wondered how your computer can run multiple programs at once? Check out the latest LaurieWired video where we explore the Atlas Supercomputer, Memory Management Units, Translation Lookaside Buffers, as well as Spatial and Temporal locality! https://lnkd.in/grBvHhxt

158

Identity Deception in ITDR - Yes this is the old Honey Pots concepts There is another interesting concepts in ITDR called as Identity Deception, it is conceptually similar to honeypots used in networking. Both involve creating decoy elements designed to attract and engage potential attackers Honey Accounts: These are fake user accounts created within identity stores (like Active Directory) that are designed to attract attackers. When an unauthorized user attempts to access these accounts, it triggers alerts and allows security teams to respond quickly. Honeytokens: These are deceptive credential profiles placed in identity caches on endpoints. They serve as early warning signals when accessed by unauthorized users, helping to identify potential breaches before they escalate   These identities should be known to your ITDR systems though, this is not a way of checking which ITDR tool is more effective. https://lnkd.in/e7ckJxGQ #TheIdentityNavigator #iam #ITDR #IdentityAndAccessManagement

21

2 Comments

Evidence is emerging LLM's are linear representations of sequences https://lnkd.in/gY5NqKkT . I conjectured this in https://lnkd.in/gUBuWgEt

60

2 Comments