#021 - Cyber AI Chronicle - AI Technology Can Increase The Attack Surface

PRESENTED BY

Cyber AI Chronicle

By Simon Ganiere · 26^th May 2024

Welcome back!

Project Overwatch is a cutting-edge newsletter at the intersection of cybersecurity, AI, technology, and resilience, designed to navigate the complexities of our rapidly evolving digital landscape. It delivers insightful analysis and actionable intelligence, empowering you to stay ahead in a world where staying informed is not just an option, but a necessity.

Table of Contents

• What I learned this week

  • TL;DR

  • AI Technology Can Increase The Attack Surface

• Worth a full read

  • Wiz Researcher discovers critical vulnerability in …

    • Key Takeaway

  • The Real Danger Lurking in the NVD Backlog

    • Key Takeaway

  • Proofpoint’s 2024 Voice of the CISO Report

    • Key Takeaway

• Research Paper

  • Smart Validator: A Framework for Automatic Identif …

• Some more reading

• Wisdom of the week

• Contact

What I learned this week

TL;DR

• Microsoft is in the news..again…and the security teams are raising an eyebrow (if not both). After having disclosed that security is a top priority…they release a function named Recall…which basically takes a screenshot every five(!) seconds and then leverage a local AI model to be able to search that content. Don’t get me wrong Microsoft is not the only one. Slack has been facing a significant backslash as well. Their policy includes the ability to ingest customers’ data to train their model. Yes, that means your message, content and files.
  I wanted to deep dive on those topics, but more particularly on the Microsoft Recall announcement. » READ MORE

• Google seems to be doing Google things…they feel the pressure from the market in terms of AI and like in the past with social media they are trying to add AI feature everywhere. The latest being that AI Overview in the search results…and obviously not working brilliantly as illustrated by the recommendation to add some glue to make cheese stick on pizza…as I mentioned previously not everything has to be AI driven 😉 

• On the security side, another week and another bunch Microsoft and Google Chrome of vulnerabilities being actively exploited that you have hopefully already patched (if you haven’t please go apply the patches and then come back to finish reading this newsletter). Still on the vulnerability management topic, some really worrying news on the status of the NVD. I did mention this in the past already but the latest stats are really not looking great. A whooping 93% of the new vulnerabilities have NOT been analysed but the NVD since February. » READ MORE

• On the back of last week tutorial, I have now added a section Research Paper. Obviously leveraging the previous work. Will check if I keep this every week or only when there is interesting research paper.

• In a lighter but sad note, ICQ is shutting down…not making me feel any younger but definitely nostalgic 😔