Mark on Privacy

Passionate about privacy, technical in thinking, realistic in interpretation. CIPT, CIPM - opinions mine, mostly no one else's

[Mark on Privacy @PrivacyMV]

Our talk with @adamshostack at @AppSecCali is public now. Watch how to integrate #privacy into threat modeling using #EoPSTRIPED cards. Get the cards at @agilestationery. https://t.co/LzGEMaH8BS

[Mark on Privacy @PrivacyMV]

OWASP created a guide on how to test LLMs. Known as red teaming, the guide details techniques that can be used to test the security measures included in a GenAI, like edge-case analysis, adversarial prompt engineering, bias identification, etc. https://t.co/OC1p4UcRlf

[Mark on Privacy @PrivacyMV]

Here go my most noteworthy news from the past 2 months. Also, I'm working on a major refactor for ORK which I hope to drop end of month. https://t.co/uuG1XGSDAa

[Mark on Privacy @PrivacyMV]

The past months showed that getting LLMs to safely interpret queries is not straightforward. Google tried to react to previous prompt injections, but it is still vulnerable to delayed invocation. https://t.co/RsAoA7AyNz

[Mark on Privacy @PrivacyMV]

Sound and image synthetization is increasingly being used to impersonate colleagues or family members. The FBI recommends to have a countersign to identify scammers. https://t.co/bZgBuOXfqG

[Mark on Privacy @PrivacyMV]

Here my compilation of #security and #privacy news for Nov/Dec. First, I thought it was a lame 2 months, but there were actually some interesting articles:

[Mark on Privacy @PrivacyMV]

Attackers are using LLMs to generate customized content for their phishing campaigns. Fortunately, attackers also need to meet deadlines and leave obvious telltale signs. https://t.co/8tdFLvr42c

[Mark on Privacy @PrivacyMV]

Extensive cyber attacks against Romanian voting infrastructure. A total of 85.000 attacks were counted and access credentials for election-related websites were stolen and leaked on a Russian hacker forums. As a result, elections will need to be redone. https://t.co/Uf6nsI4qfe

[Mark on Privacy @PrivacyMV]

Infostealers on Play Store. They trick users into entering financial information and granting extra mobile app permissions,  leading to extortion, harassment, and financial loss. https://t.co/EV5ivdYHwX

[Mark on Privacy @PrivacyMV]

Vulnerabilities in Mazda’s infotainment. When given physical to in-car USB, it is possible to load software starting at boot. After that, an attacker can gain access to CAN bus… https://t.co/jEcZ22W7sH

[Mark on Privacy @PrivacyMV]

Cyber resiliency act: starting 2017, digital products (hw&sw) will require CE mark, indicating compliance to secure design and vulnerability mgmt. Obligations include encryption in transit, bill of materials, vulnerability disclosure, etc.

[Mark on Privacy @PrivacyMV]

German court challenges the recent conservative interpretation of international #datatransfers of personal data under #GDPR. When using international social networks, a reasonable expectation exists of some data transfer to non-EU countries. https://t.co/G50VHAbwkG

[Mark on Privacy @PrivacyMV]

Every month I collect the most relevant news from security/privacy for my coworkers, as a kind of awareness activity. These are a mix of non-technical interesting articles and some deep dives for our engineers. Here my list for Sept/Oct: #security #privacy #news

[Mark on Privacy @PrivacyMV]

Nice summary of #sessionhijacking methods, with Adversary-in-the-Middle, Browser-in-the-Middle, and infostealers. With the increasing adoption of 2FA, sessions are the new target for attackers and companies need to address these #cyberattacks. #AitM #BitM https://t.co/J0HJkZfEaJ

[Mark on Privacy @PrivacyMV]

Very interesting new method to trick people into downloading a malicious binary. It builds on the recent crazy CAPTCHA methods by convincing users that the binary is just another method to check you are human: https://t.co/JTbL6cREPo

[Mark on Privacy @PrivacyMV]

Indirect prompt #injection in Google #Gemini, that allows to control the chat output via Slides or emails. Basically the user can instruct the chat to answer in a given way when asked about a topic or a document. Very nice channel for phishing: https://t.co/izh90E85BW

[Mark on Privacy @PrivacyMV]

Indirect prompt injection is possible in ChatGpt that will allow persistence via the Memories feature. As a result, it is possible to have all future chat be sent to a non-vetted link. #chatgpt #promptinjection https://t.co/WIhwVs1Enk