According to security researcher Sam Curry, vulnerabilities in a website dedicated to Kia vehicle owners could have allowed attackers to remotely control millions of cars.  Curry noted that the vulnerabilities could have allowed attackers to gain control of key vehicle functions in roughly 30 seconds, using only the car’s license plate.  Furthermore, the bugs allowed the attackers to harvest the victim’s personal information, such as name, address, email address, and phone number, and to create a second user on the vehicle, without the owner’s knowledge.

A new security protocol developed by researchers at the Massachusetts Institute of Technology (MIT) uses the quantum properties of light to ensure that data sent to and from a cloud server remains secure during deep-learning computations. Their protocol exploits quantum mechanics principles by encoding data into the laser light used in fiber optic communications systems, thus making it impossible for attackers to copy or intercept the information without being detected. The method provides security without compromising deep-learning model accuracy.

"The National Security Agency (NSA) joins the Australian Signals Directorate’s Australian Cyber Security Centre (ASD ACSC) and others in releasing the Cybersecurity Technical Report (CTR), 'Detecting and Mitigating Active Directory Compromises.' The guidance provides prevention and detection strategies for the most prevalent techniques used to target Active Directory (AD). Gaining control over AD gives malicious actors privileged access to all systems and users managed by AD, according to the CTR.

According to new guidelines published by the National Institute of Standards and Technology (NIST), using a mixture of character types in your passwords and regularly changing passwords are officially no longer best password management practices.  NIST’s latest version of its Password Guidelines suggests credential service providers (CSPs) stop recommending passwords using several character types and to stop mandating periodic password changes unless the authenticator has been compromised.

Security researchers at Cybernews have recently uncovered a massive data leak exposing the personal information of over 100 million US citizens.  The breach is attributed to a misconfigured database at background check firm MC2 Data, which allegedly left 2.2TB of sensitive data accessible online without password protection.

U.K. transport officials and police recently announced they are investigating a “cybersecurity incident” that hit the public Wi-Fi networks at the country’s biggest railway stations.  Passengers trying to log onto the Wi-Fi at stations including Manchester Piccadilly, Birmingham New Street, and 11 London terminuses on Wednesday evening were met by a page reading “We love you, Europe,” followed by an anti-Islam message listing a series of terror attacks.  Network Rail, which manages the stations, said the Wi-Fi had been switched off and no passenger data was taken.

Google recently announced that its secure-by-design approach to code development has significantly reduced memory safety vulnerabilities in Android.  Google has been battling memory safety issues in both Android and Chrome for years, including by migrating them to memory-safe programming languages, such as Rust, and the effort has paid off.

Researchers from ETH Zurich have discovered a way to beat CAPTCHA puzzles through the use of Artificial Intelligence (AI), which has sparked further concern regarding online security. CAPTCHA, which stands for "Completely Automated Public Turing Test to Tell Computers and Humans Apart," has been a well-established method for distinguishing humans from bots. However, the researchers' new AI system could solve image-based puzzles as effectively as humans, if not better. This article continues to discuss the study "Breaking reCAPTCHAv2."

Xiaoli Zhou of the School of Information Engineering at Sichuan Top IT Vocational Institute in Chengdu, China, conducted a study on integrating data augmentation and ensemble learning methods to improve the accuracy of Intrusion Detection Systems (IDS). Zhou focused on a Wasserstein Generative Adversarial Network with Gradient Penalty (WGAN-GP), an advanced version of the standard Machine Learning (ML) model capable of creating realistic data through a competition between two neural networks.

By grigby1