Security Serengeti

This week, we have three related AI articles all dealing with trust, or lack thereof, in the results AI so confidently gives you.  This can range from poisoning of the training data to confident hallucinations, to faking interviews.  It's a brave new world out there.

Article 1 - The poisoning of ChatGPT

Article 2 - Lawyer cited 6 fake cases made up by ChatGPT; judge calls it “unprecedented”Supporting Articles:Professor Flunks All His Students After ChatGPT Falsely Claims It Wrote Their Papers

Article 3 - Github - Ecoute

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss company surveillance via JP Morgan Chase, and then the sentences handed down for the CSO of Uber and an Engineer at Ubiquiti.  

Article 1 - White House to study employer tools that monitor workersSupporting Articles:JP Morgan WADU? Surveillance next level?JPMorgan employees describe growing 'paranoia' as the company tracks their office attendance, calls, calendars, and more — with one worker even installing a 'mouse jiggler' to evade 'Big Brother'MOSAIC MULTIMODAL OBJECTIVE SENSING TO ASSESS INDIVIDUALS WITH CONTEXT

Article 2 - Uber’s Ex-Security Chief Leaves Court With No Jail Time for Covering Up Massive HackSupporting Articles:With Liberty and Justice for Some: How the Law Is Used to Destroy Equality and Protect the PowerfulRoss Ulbricht - Wikipedia

Article 3 - Ex-Ubiquiti dev jailed for 6 years after stealing internal corp data, extorting bosses

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss the latest AI trend of influencers simulating themselves (How long until work wants to simulate you?), and a couple of articles on threat intel!

Article 1 - Influencer Rents Out AI Version of Herself Which Immediately Goes RogueSupporting Articles:An influencer’s AI clone will be your girlfriend for $1 a minuteForever VoicesAmouranth releases AI companion to ‘satisfy needs of fans’

Article 2 - Are Ransomware Attacks Declining, or Has Reporting Worsened?

Article 3 - 79% of Cyber Pros Make Decisions Without Threat Intelligence

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we sat down to discuss how the Solarwinds breach was found 6 months earlier, but they couldn't get to the bottom of it, the FBI is claiming that China is winning the cyberwar, a new Dark Web Browser is launched, and court rules that cyberattacks are not covered under the acts of war exception in insurance.

Article 1 - SolarWinds Detected Six Months EarlierSupporting Articles:The DOJ Detected the SolarWinds Hack 6 Months Earlier Than First DisclosedThe Untold Story of the Boldest Supply-Chain Hack Ever

Article 2 - China has 50 hackers for every FBI cyber agent, says Bureau bossSupporting Articles:Internal Documents Show How Little the FBI Did to Correct Misuse of Section 702 DatabasesXKCD - Ballmer Peak

Article 3 - Searchlight Cyber launches Stealth Browser for safe dark web access

Article 4 - Insurers Can't Use War Argument: Court Rules in Favor of Merck in $1.4 Billion Cyberattack Coverage Case

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

It's all AI all day ladies and gentlemen!  First we discuss how the Singularity may not be around the corner, barring one pretty important breakthrough, then we discuss ChatGPT's data breach and poor coding practices.

Article 1 - We Aren't Close To Creating A Rapidly Self-Improving AISupporting Articles:IBM plans to replace 7,800 jobs with AI over time, pauses hiring certain positionsEconTalk - Replication, Reproducing Experiments, P-hackingThe Pace of Technology Adoption is Speeding Up

Article 2 - ChatGPT Confirms Data Breach, Raising Security Concerns

Article 3 - ChatGPT writes insecure code

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

David and Matthew have talked poorly about Threat Intel for years now.  It's only fair to give Threat Intel it's own time in the sun, and let it shine.  TI is represented today by Victor!

Supporting Links:The Cybersecurity “EASY” Button: A Framework for Security ProgramsJP 2-0, Joint Intelligence PublicationSTIX 2.1 SpecificationExcel-ing at Threat Intelligence Platform (TIP) Requirements

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

We are joined today by Friend of the Pod Victor, here to give us some of his insight as we discuss the latest security news, including FTX's atrocious security, Non-AI voices used in Swatting, and the latest from 3CX.

Article 1 - FTX's Cybersecurity Was Hilariously BadSupporting Articles:BlackRock CEO Larry Fink Says Firm Invested $24M in FTX: ReutersPDF Report Download Link

Article 2 - To improve security, consider how the aviation world stopped blaming pilotsSupporting Article:Wisconsin Passes Law Requiring Independent Investigations of Police Shootings

Article 3 - A Computer Generated Swatting Service Is Causing Havoc Across AmericaSupporting Article:Swatting as a Service

Article 4 - 3CX Breach Was a Double Supply Chain CompromiseSupporting Article:3CX Software Supply Chain Compromise Initiated by a Prior Software Supply Chain Compromise; Suspected North Korean Actor Responsible

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

Cofense released their annual State of Email Security 2023 report, so we take a deep dive and see what it has to offer.  A lot of non-surprises in there, but there are some goodies we pick out.  Then at the end, we discuss how ChatGPT could help out the bad guys!

Report - 2023 Annual State of Email Security Report

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

All AI, All the Time.  Today we talk about AI coworkers, Security Copilot from MS, the 3CX compromise, and a lowball offer from HM Treasury!

Article 1 - Just $10 to create an AI chatbot of a dead loved oneSupporting Article:Project December

Article 2 - Microsoft Security Copilot is a new GPT-4 AI assistant for cybersecuritySupporting Article:Introducing Microsoft Security Copilot: Empowering defenders at the speed of AI

Article 3 - 3CX thought supply chain attack was a false positiveSupporting Article:SmoothOperator | Ongoing Campaign Trojanizes 3CXDesktopApp in Supply Chain Attack

Article 4 - Psst! Infosec bigwigs: Wanna be head of security at HM Treasury for £50k?

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!

This week we discuss how the FBI and DoD have continued to progress their facial recognition tech, how AI is going to fundamentally change software architecture, customer service and cybersecurity, and finally... exploding USB drives are here!  

Article 1 - The FBI Tested Facial Recognition Software on Americans for Years, New Documents ShowSupporting Articles:JANUSQuestions about Facial RecognitionFACIAL RECOGNITION: POTENTIAL AND RISKIARPA LAUNCHES “DIVA” PROGRAM TO AUTOMATICALLY DETECT COMPLEX ACTIVITIES FROM VIDEOMOSAIC MULTIMODAL OBJECTIVE SENSING TO ASSESS INDIVIDUALS WITH CONTEXT

Article 2 - SPQA: The AI-based Architecture That’ll Replace Most Existing SoftwareSupporting Article:How to Estimate the Time and Cost to Train a Machine Learning Model

Article 3 - The Role of Customer Service in Cybersecurity

Article 4 - Journalist hurt by exploding USB bomb drive

If you found this interesting or useful, please follow us on Twitter @serengetisec and subscribe and review on your favorite podcast app!