“The legitimate Solana Python API project is known as ‘solana-py’ on GitHub, but simply ‘solana’ on the Python software registry, PyPI,” Sonatype researcher Ax Sharma
Author: Robert Timlick
-

Rogue PyPI Library Solana Users, Steals Blockchain Wallet Keys
Cybersecurity researchers have discovered a new malicious package on the Python Package Index (PyPI) repository that masquerades as a library from the Solana blockchain platform but is actually designed to steal victims’ secrets.
“The legitimate Solana Python API project is known as ‘solana-py’ on GitHub, but simply ‘solana’ on the Python software registry, PyPI,” Sonatype researcher Ax Sharma -

Researchers Uncover 10 Flaws in Google’s File Transfer Tool Quick Share
As many as 10 security flaws have been uncovered in Google’s Quick Share data transfer utility for Android and Windows that could be assembled to trigger remote code execution (RCE) chain on systems that have the software installed.
“The Quick Share application implements its own specific application-layer communication protocol to support file transfers between nearby, compatible devices,” -

New Malware Hits 300,000 Users with Rogue Chrome and Edge Extensions
An ongoing, widespread malware campaign has been observed installing rogue Google Chrome and Microsoft Edge extensions via a trojan distributed via fake websites masquerading as popular software.
“The trojan malware contains different deliverables ranging from simple adware extensions that hijack searches to more sophisticated malicious scripts that deliver local extensions to steal private data -

AI Data Breaches are Rising! Here’s How to Protect Your Company
Artificial intelligence (AI) is rapidly transforming industries. It offers businesses innovative solutions and automation capabilities. But with this progress comes a growing concern: AI data breaches. As AI becomes more integrated into our systems, the risks increase. The data it collects, analyzes, and utilizes becomes a target.
A recent study on AI security breaches revealed a sobering truth. In the last year, 77% of businesses have experienced a breach of their AI. This poses a significant threat to organizations. A breach can potentially expose sensitive data as well as compromise intellectual property and disrupt critical operations.
But wait before you hit the panic button. Let’s explore why AI data breaches are on the rise and what steps you can take to safeguard your company’s valuable information.
Why AI Data Breaches are Growing in Frequency
Several factors contribute to the increasing risk of AI data breaches:
- The Expanding Attack Surface: AI adoption is increasing fast. As it increases, so does the number of potential entry points for attackers. Hackers can target vulnerabilities in AI models and data pipelines. As well as the underlying infrastructure supporting them.
- Data, the Fuel of AI: AI thrives on data. The vast amount of data collected for training and operation makes a tempting target. This data could include customer information, business secrets, and financial records. And even personal details of employees.
- The “Black Box” Problem: Many AI models are complex and opaque. This makes it difficult to identify vulnerabilities and track data flow. This lack of transparency makes it challenging to detect and prevent security breaches.
- Evolving Attack Techniques: Cybercriminals are constantly developing new methods to exploit security gaps. Techniques like adversarial attacks can manipulate AI models. This can produce incorrect outputs or leak sensitive data.
The Potential Impact of AI Data Breaches
The consequences of an AI data breach can be far-reaching:
- Financial Losses: Data breaches can lead to hefty fines, lawsuits, and reputational damage. This can impact your bottom line significantly.
- Disrupted Operations: AI-powered systems are often critical to business functions. A breach can disrupt these functionalities, hindering productivity and customer service.
- Intellectual Property Theft: AI models themselves can be considered intellectual property. A breach could expose your proprietary AI models, giving competitors a significant advantage.
- Privacy Concerns: AI data breaches can compromise sensitive customer and employee information. This can raise privacy concerns and potentially lead to regulatory action.
Protecting Your Company from AI Data Breaches: A Proactive Approach
The good news is that you can take steps to mitigate the risk of AI data breaches. Here are some proactive measures to consider.
Data Governance
Put in place robust data governance practices. This includes:
- Classifying and labeling data based on sensitivity
- Establishing clear access controls
- Regularly monitoring data usage
Security by Design
Integrate security considerations into AI development or adoption. Standard procedures for AI projects should be:
- Secure coding practices
- Vulnerability assessments
- Penetration testing
Model Explainability
Invest in techniques like explainable AI (XAI) that increase transparency in AI models. This allows you to understand how the model arrives at its results and identify potential vulnerabilities or biases.
Threat Modeling
Conduct regular threat modeling exercises. This identifies potential weaknesses in your AI systems and data pipelines. This helps you rank vulnerabilities and allocate resources for remediation.
Employee Training
Educate your employees about AI security threats and best practices for data handling. Empower them to identify and report suspicious activity.
Security Patch Management
Keep all AI software and hardware components updated with the latest security patches. Outdated systems are vulnerable to known exploits, leaving your data at risk.
Security Testing
Regularly conduct security testing of your AI models and data pipelines. This helps identify vulnerabilities before attackers exploit them.
Stay Informed
Keep yourself updated on the latest AI security threats and best practices. You can do this by:
- Subscribing to reliable cybersecurity publications
- Attending industry conferences
- Seeking out online workshops on AI and security
Partnerships for Enhanced Protection
Consider working with a reputable IT provider that understands AI security. We can offer expertise in threat detection as well as a vulnerability assessment and penetration testing tailored to AI systems.
Additionally, explore solutions from software vendors who offer AI-powered anomaly detection tools. These tools can analyze data patterns. They identify unusual activity that might suggest a potential breach.
Get Help Building a Fortress Against AI Data Breaches
AI offers immense benefits. But neglecting its security risks can leave your company exposed. Do you need a trusted partner to help address AI cybersecurity?
Our team of experts will look at your entire IT infrastructure. Both AI and non-AI components. We’ll help you put proactive measures in place for monitoring and protection. Our team can help you sleep soundly at night in an increasingly dangerous digital space.
Contact us today to schedule a chat about your cybersecurity.
—
This Article has been Republished with Permission from The Technology Press.
-

Microsoft Warns of Unpatched Office Vulnerability Leading to Data Exposure
Microsoft has disclosed an unpatched zero-day in Office that, if successfully exploited, could result in unauthorized disclosure of sensitive information to malicious actors.
The vulnerability, tracked as CVE-2024-38200 (CVSS score: 7.5), has been described as a spoofing flaw that affects the following versions of Office –Microsoft Office 2016 for 32-bit edition and 64-bit editions
Microsoft -

Experts Uncover Severe AWS Flaws Leading to RCE, Data Theft, and Full-Service Takeovers
Cybersecurity researchers have discovered multiple critical flaws in Amazon Web Services (AWS) offerings that, if successfully exploited, could result in serious consequences.
“The impact of these vulnerabilities range between remote code execution (RCE), full-service user takeover (which might provide powerful administrative access), manipulation of AI modules, exposing sensitive data, data -

Microsoft Reveals Four OpenVPN Flaws Leading to Potential RCE and LPE
Microsoft on Thursday disclosed four medium-severity security flaws in the open-source OpenVPN software that could be chained to achieve remote code execution (RCE) and local privilege escalation (LPE).
“This attack chain could enable attackers to gain full control over targeted endpoints, potentially resulting in data breaches, system compromise, and unauthorized access to sensitive information -

New Flaws in Sonos Smart Speakers Allow Hackers to Eavesdrop on Users
Cybersecurity researchers have uncovered weaknesses in Sonos smart speakers that could be exploited by malicious actors to clandestinely eavesdrop on users.
The vulnerabilities “led to an entire break in the security of Sonos’s secure boot process across a wide range of devices and remotely being able to compromise several devices over the air,” NCC Group security researchers Alex Plaskett and -

DOJ Charges Nashville Man for Helping North Koreans Get U.S. Tech Jobs
The U.S. Department of Justice (DoJ) on Thursday charged a 38-year-old individual from Nashville, Tennessee, for allegedly running a “laptop farm” to help get North Koreans remote jobs with American and British companies.
Matthew Isaac Knoot is charged with conspiracy to cause damage to protected computers, conspiracy to launder monetary instruments, conspiracy to commit wire fraud, intentional -

CISA Warns of Hackers Exploiting Legacy Cisco Smart Install Feature
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has disclosed that threat actors are abusing the legacy Cisco Smart Install (SMI) feature with the aim of accessing sensitive data.
The agency said it has seen adversaries “acquire system configuration files by leveraging available protocols or software on devices, such as abusing the legacy Cisco Smart Install feature.”
It also
