Subject: p.s. Twitter forces all links …
Source: Fedi.Tips
https://mstdn.social/@feditips/110214025423529255
p.s. Twitter forces all links to go through its own t.co link shortener. Most people probably don’t realise this, because the t.co links just look like normal links.You can see this on Firefox on a computer. Hovering the mouse over a link shows its true URL in the bottom left corner.
On Twitter, all links are actually t.co addresses, so Twitter will be able to track people clicking on them.
On Mastodon, links are exactly what they appear to be.
See the screenshots for a comparison.
…
You don’t need to use link shorteners on Mastodon!
All links on Mastodon count as 23 characters towards your post limit, no matter how long the links actually are.
Link shortener services like bit.ly, t.co etc track users who click on their links. This is really bad for privacy. If you use link shorteners on Mastodon, people may assume you are just doing it for tracking purposes.
More info at https://fedi.tips/you-dont-need-link-s
Source: Check Point Software blog
https://blog.checkpoint.com/security/new-chatgpt4-0-concerns-a-market-for-stolen-premium-accounts/
Since December 2022, Check Point Research (CPR) has raised concerns about ChatGPT’s implications for cyber security. Now, CPR also warns that there is an increase in the trade of stolen ChatGPT Premium accounts, which enable cyber criminals to get around OpenAI’s geofencing restrictions and get unlimited access to ChatGPT.The market of account takeovers (ATOs), stolen accounts to different online services, is one of the most flourishing markets in the hacking underground and in the dark web. Traditionally this market’s focus was on stolen financial services accounts (banks, online payment systems, etc.), social media, online dating websites, emails, and more.
Since March 2023, CPR sees an increase in discussion and trade of stolen ChatGPT accounts, with a focus on Premium accounts:
…
Category SECURITY: https://blog.checkpoint.com/security/
Category RESEARCH: https://blog.checkpoint.com/research/
RSS: https://blog.checkpoint.com/research/feed/
Source: GCN
https://gcn.com/cybersecurity/2023/04/nist-wants-mitigate-smart-home-telehealth-cybersecurity-risks/385256/
The COVID-19 pandemic proliferated the use of smart speakers and other internet of things technologies for telehealth purposes, however, using smart speakers to share sensitive personal health information for telehealth purposes could pose a cybersecurity and privacy risk, which the government is trying to address, according to a notice filed in the Federal Register on Monday.The National Institute of Standards and Technology is looking for comments and products to help it mitigate cybersecurity risks in telehealth smart home integration as part of the National Cybersecurity Center of Excellence project addressing this issue. Consumers are utilizing their own commercial devices and incorporating them into a health delivery organization’s telehealth solution, as a result these organizations may have difficulty identifying and addressing cybersecurity risks because they are not in control of these items.
The NCCoE project aims to build a reference architecture utilizing the NIST Risk Management Framework, NIST Cybersecurity Framework and the NIST Privacy Framework to help find ys to address these issues.
…
Source: POLITICO
https://www.politico.com/news/2023/04/17/health-industry-data-privacy-00092447
A series of federal data privacy crackdowns is complicating how health care companies market their services online.The Federal Trade Commission has led the way in the new enforcement push, fining telehealth companies for violating their customers’ privacy and barring them from doing so in the future. The director of HHS’ Office for Civil Rights said her staff has launched its own investigation, calling online health data collection “problematic” and “widespread.” The agency also recently sought to update health data privacy protections to bar providers and insurers from releasing information about a patient seeking or obtaining a legal abortion.
HHS’ Office for Civil Rights surprised insurers and health care providers in December when it issued a bulletin expanding its definition of personally identifiable health information and restricting the use of certain marketing technology.
The office warned that entities covered by HIPAA aren’t allowed to wantonly disclose HIPAA-protected data to vendors or use tracking technology that would cause “impermissible” disclosures of protected health information.
That protected data can include email addresses, IP addresses, or geographic location information that can be tied to an individual, under HHS’ 22-year-old HIPAA privacy rule.
“Firms that think they can cash in on consumers’ health data because HIPAA doesn’t apply should think again,” said Samuel Levine, director of the FTC’s Bureau of Consumer Protection. “Our recent actions against GoodRx and BetterHelp make clear that we are prepared to use every tool to protect Americans’ health privacy, and hold accountable those who abuse it.”
…
Filed under:
Subject: EFF on the UN Cybercrime Treaty
Source: Schneier on Security blog
https://www.schneier.com/blog/archives/2023/04/eff-on-the-un->cybercrime-treaty.html
EFF has a good explainer on the problems with the new UN Cybercrime Treaty, currently being negotiated in Vienna.The draft treaty has the potential to rewrite criminal laws around the world, possibly adding over 30 criminal offenses and new expansive police powers for both domestic and international criminal investigations…
See EFF’s Deeplinks Blog: https://www.eff.org/deeplinks/
Source: The Hill
https://thehill.com/opinion/cybersecurity/3953399-hijacked-ai-assistants-can-now-hack-your-data/[h/t Sabrina Pacifici]
In February, a team of cybersecurity researchers successfully cajoled a popular AI assistant into trying to extract sensitive data from unsuspecting users by convincing it to adopt a “data pirate” persona. The AI’s “ahoy’s” and “matey’s” in pursuit of personal details were humorous, but the implications for the future of cybersecurity are not: The researchers have provided proof of concept for a future of rogue hacking AIs.Building on OpenAI’s viral launch of ChatGPT, a range of companies are now empowering their AI assistants with new abilities to browse the internet and interact with online services. But potential users of these powerful new aides need to carefully weigh how they balance the benefits of cutting-edge AI agents with the fact that they can be made to turn on their users with relative ease.
The researchers’ attack — dubbed “indirect prompt injection” — exploits a significant vulnerability in these AI systems. Though usually highly capable, these models can occasionally exhibit gullibility, irrationality and an inability to recognize their own limits. That, mixed with their programming to eagerly follow instructions, means that certain cleverly worded commands can “convince” systems such as ChatGPT to override their built-in safeguards.
prompt injection now poses a serious cyberecurity risk — exploiting weaknesses in AI systems’ intelligence, rather than traditional software code.
…
Early adopters of powerful new AI tools should recognize that they are subjects of a large-scale experiment with a new kind of cyberattack. AI’s new capabilities may be alluring, but the more power one gives to AI assistants, the more vulnerable one is to attack. Organizations, corporations, and governmental departments with security concerns would be wise to disallow their personnel from using such AI assistants, at least until the risks are better known.
…
Filed: https://thehill.com/opinion/cybersecurity/
See also: https://thehill.com/policy/cybersecurity/
Source: AID
https://www.bespacific.com/ai-incident-database/
AID: “Intelligent systems are currently prone to unforeseen and often dangerous failures when they are deployed to the real world. Much like the transportation sector before it (e.g., FAA and FARS) and more recently computer systems, intelligent systems require a repository of problems experienced in the real world so that future researchers and developers may mitigate or avoid repeated bad outcomes. What is an Incident? The initial set of more than 1,000 incident reports have been intentionally broad in nature. Current examples include,…
RSS: https://incidentdatabase.ai/rss.xml
—
Abstracted from beSpacific
Copyright © 2023 beSpacific, All rights reserved.
Subject: Mullvad VPN was subject to a search warrant. Customer data not compromised
Source: Mullvad VPN blog
https://mullvad.net/en/blog/2023/4/20/mullvad-vpn-was-subject-to-a-search-warrant-customer-data-not-compromised/
They intended to seize computers with customer data.In line with our policies such customer data did not exist. We argued they had no reason to expect to find what they were looking for and any seizures would therefore be illegal under Swedish law. After demonstrating that this is indeed how our service works and them consulting the prosecutor they left without taking anything and without any customer information.