Security experts at Crowdstrike recorded a surge in “hands-on-keyboard” threats in 2023, with the average time it took to move laterally from initial access dropping 35% annually to just 62 minutes.  The researchers noted that this so-called “breakout time” is a critical factor in how successful attacks are, as it signifies how long defenders have to detect and contain threats before attackers are able to conduct reconnaissance, establish persistence, and locate their targets.

Major technology companies recently signed a pact to take "reasonable precautions" to prevent Artificial Intelligence (AI) tools from being used to disrupt democratic elections. Executives from Adobe, Amazon, Google, IBM, Meta, Microsoft, OpenAI, and other companies have announced a new framework for responding to AI-generated deepfakes aimed at deceiving voters. The companies have not committed to banning or removing deepfakes. The accord instead specifies how they will attempt to detect and label deceptive AI content distributed on their platforms.

Mustang Panda, a China-linked threat actor, has targeted Asian countries with a variant of the PlugX backdoor called DOPLUGS. DOPLUGS has primarily targeted people in Taiwan and Vietnam. Other targets have been in Hong Kong, India, Japan, Malaysia, Mongolia, and China. Mustang Panda, also known as BASIN, Bronze President, Camaro Dragon, Earth Preta, HoneyMyte, RedDelta, Red Lich, Stately Taurus, TA416, and TEMP.Hex, relies heavily on PlugX. This article continues to discuss the PlugX variant used by Mustang Panda.

President Joe Biden will be issuing an Executive Order (EO) to strengthen US maritime cybersecurity amid increased reliance on digital technology in the shipping sector.  The Order is part of the White House’s ambition to bolster the nation’s supply chains and critical infrastructure, as set out in the Administration’s National Cybersecurity Strategy published in March 2023.  The new EO will give new powers to the Department of Homeland Security to directly address maritime cyber threats.

A team of researchers from China and the US have discovered a new potential attack on biometric security. Their paper titled "PrintListener: Uncovering the Vulnerability of Fingerprint Authentication via the Finger Friction Sound" describes a side-channel attack on the Automatic Fingerprint Identification System (AFIS). The attack exploits the sound characteristics of a user's finger swiping on a touchscreen to pull fingerprint pattern details.

Penn Engineers' groundbreaking new chip provides faster performance, lower energy consumption, and enhanced privacy. Since many computations can take place at the same time, sensitive information does not need to be stored in a computer's working memory, making a computer with such technology nearly unhackable. The new chip performs Artificial Intelligence (AI) computations using light waves rather than electricity, potentially resulting in significant increases in processing speed and energy efficiency. This article continues to discuss the new chip said to be virtually unhackable.

Apple recently unveiled PQ3, a new post-quantum cryptographic protocol for iMessage that is designed to protect encrypted communications even against future quantum computing attacks.  End-to-end encryption is present by default in many popular messaging applications, but the actual level of protection depends on the cryptographic protocols they use and how they are implemented.

Researchers from the University of Florida and CertiK have demonstrated a new set of attacks dubbed VoltSchemer that can inject voice commands to manipulate a smartphone's voice assistant via the magnetic field emitted by an off-the-shelf wireless charger. VoltSchemer can also be used to physically damage a mobile device or to heat items near the charger to a high temperature. The attack manipulates the charger's behavior using electromagnetic interference. The team tested nine of the world's best-selling wireless chargers, exposing security flaws in these products.

Google and Mozilla recently released Chrome and Firefox software updates to resolve multiple vulnerabilities in both browsers, including high-severity memory safety bugs. On Tuesday, Chrome 122 was released in the stable channel with patches for 12 security defects, including eight that were reported by external researchers. Two of these are high-severity flaws, the most severe of them, based on the paid bug bounty reward, being an out-of-bounds memory access bug in Blink.

A team of researchers in India developed a hybrid approach to improving the security of online applications, particularly within cloud computing. They have showed that merging two techniques, homomorphic encryption and the Squirrel Search Algorithm (SSA), significantly enhances the security of cloud computing models. Encryption is essential in protecting data from unauthorized access or breaches. The team assessed the effectiveness of their approach by measuring upload and download times, as well as encryption and decryption times.