Avishai Ziv’s Post

Very well said Meredith Whittaker! "So let’s be very clear, again: mandating mass scanning of private communications fundamentally undermines encryption. Full stop. Whether this happens via tampering with, for instance, an encryption algorithm’s random number generation, or by implementing a key escrow system, or by forcing communications to pass through a surveillance system before they’re encrypted. We can call it a backdoor, a front door, or “upload moderation.” But whatever we call it, each one of these approaches creates a vulnerability that can be exploited by hackers and hostile nation states, removing the protection of unbreakable math and putting in its place a high-value vulnerability." Further to my previous posts about this very issue: >> https://lnkd.in/guiKM3un >> https://lnkd.in/gEM2kMm8 It's a VERY bad idea to break E2EE. E2EE is the first line of defense (the last line of defense is encryption of the data at rest). There is no security substitute for such encryption. You break it -- you invite attackers in. Instead of breaking good security, invest in new technologies that will allow enforcement of the law without breaking encryption or infringing privacy. Be innovative and visionary for once. Get out of your comfort zone and start working. No solution will ever be created without a good measure of blood, toil, tears, and sweat. Signal Messenger #endtoendencryption #e2ee #encryption #privacy

Urgent call to action: INVEST IN IDENTITY PROTECTION! Great insight by Dave Zilberman, but I'm afraid -- with the wrong conclusion. Dave is right on the money stating that most #databreaches have to do with breaching identities. Ample data to support that (such as Verizon's Data Breach Investigations Report -- DBIR). But sadly that doesn't translate into investment priorities on the part of the VCs. Look at the huge gap between current investments in #aisecurity & #cloudsecurity and those in #identityandaccessmanagement. It's almost indescribable. The results are ominous: There is a grave lack of innovation in the identity protection space, antiquated and easily reachable technologies (e.g. SSO, SAML, Kerberos), and easily stealable identity credentials (passwords, session tokens) -- all leading to massive data breaches. AI security or some vague cloud security won't help. Identity protection must be brought up to speed with the level and sophistication of the attackers. We're nowhere near. There isn't a moment to lose. Link: [www] newcomer[dot]co/p/wizs-billion-dollar-cyber-deal-norwest I wrote extensively about the need for a next-gen identity framework. Look up my posts about it. Eric Newcomer Newcomer #iam #identityprotection #decentralizedidentity #dataencryption

Further to the post below ⬇, in a conspicuously strange timing, Europol announces a major #databreach. "In May 2024 Europol suffered a data breach. Compromised data: Alliance employees, FOUO source code, PDFs, documents for recon and guidelines." Europol told Infosecurity Magazine in a statement that it is “aware of the incident and is assessing the situation.” I urge Europol to reconsider its new approach to E2EE and further extend its security controls to encrypt all sensitive data-at-rest. Reality is just too serious. Time has run out. Get on your game. https://lnkd.in/gNHNFiy8 #dataencryption #encryption

Marriott admits it falsely claimed for five years it was using #encryption during 2018 #databreach. "Marriott argued that its encryption level (AES-128) was so strong that the case against it should be dismissed." However, Marriott's attorneys admitted in an April 10 hearing that it had never used AES-128 during the time of the breach. In fact, it hadn’t been using any encryption at all at the time but rather had been using secure hash algorithm 1 (SHA-1), which is a #hashing mechanism and not encryption. Marriott disagrees that the issue is serious and that information has been lost. Usually, I add some snarky comments about these incidents. But I'll make an exception this time. You see -- Marriott's actions and responses are more hilarious than anything I can come up with. But it is alarming and tragic. Forget AI-based security and fancy posture management frameworks. If you don't encrypt your data and properly protect your users, no security magic dust will help. https://lnkd.in/g_6Yr-ww

Can Generative AI break biometric authentication? Yes. Voice authentication is already busted. Fingerprint authentication: Not easy, but certainly feasible. Recently, Open AI has kinda released its synthetic voice engine. 15 seconds of a voice recording is enough to generate AI-generated output. While synthetic voice based on real voice isn't new, OpenAI's ubiquity makes this a perfect tool to hack voice authentication. But the real deal here is authentication based on fingerprint biometrics. My conclusion: It's coming. Here's why & how: Hacking fingerprint authentication software isn't hard. The main challenge so far has been extracting the stored fingerprint image, or providing a fake fingerprint using a captured one from the real person. Meaning, a plain brute-force attack is hard and requires physical access to the phone AND opening the phone to hack the HW (see more in the below links). But with the plethora of leaked/stolen databases of biometric data, and the power of Generative AI, I believe it's now becoming feasible to GENERATE a fingerprint and use it via "regular" SW hack against the stored valid image. A fingerprint can be thought of as a large vector image. Unlike the common belief, fingerprints aren't completely random. There are some repetitive and predictable patterns and logic. That, with some stolen biometric data, is enough to generate a small enough number of AI-generated fake fingerprints that can be used against the stored image. This DOES NOT require physical access to the phone. Attackers can do all of it remotely: Access the phone remotely, and authenticate using the fake AI-generated biometrics, without the user even noticing. It can be done even when the phone is locked. Think about it. It's not as far-fetched as it sounds. It's coming, spelling major disruption on the most common and most trusted form of authentication. --- Links to sources mentioned above: 1️⃣ {OpenAI] Navigating the Challenges and Opportunities of Synthetic Voices: openai[dot]com/blog/navigating-the-challenges-and-opportunities-of-synthetic-voices 2️⃣ BrutePrint: bypassing smartphone fingerprint protection: usa.kaspersky[dot]com/blog/fingerprint-brute-force-android/28428/ 3️⃣ BRUTEPRINT: Expose Smartphone Fingerprint Authentication to Brute-force Attack: arxiv[dot]org/pdf/2305.10791.pdf --- #biometrics #authentication #generativeai OpenAI #databreach #identitytheft