Blog | News - Part 6919

Event

Intelligent Security Summit On-Demand

Learn the critical role of AI & ML in cybersecurity and industry specific case studies. Watch on-demand sessions today.

Our fourth and fifth top stories of the week are about new technologies unveiled at this week’s CES show. Everyone could use a lighter pair of AR glasses, but a self-driving baby stroller? That’s going to be a harder sell.

Here are the top five stories for the week of January 2nd.

1. Two years after DALL-E debut, its inventor is ‘surprised’ by impact

Before DALL-E 2, Stable Diffusion and Midjourney, there was just a research paper called “Zero -Shot Text-to-Image Generation.”

With that paper and a controlled website demo, on January 5, 2021 — two years ago today — OpenAI introduced DALL -E, a neural network that “creates images from text captions for a wide range of concepts expressible in natural language.” (Also today: OpenAI just happens to reportedly be in talks for a “tender offer that would value it at $29 billion.”)

2. ChatGPT and the unbundling of online search

Since the release of ChatGPT in November, there has been a lot of speculation about OpenAI’s latest large language model (LLM) spelling doom for Google Search. The sentiment has only intensified with the recent report of Microsoft preparing to integrate ChatGPT into its Bing search engine.

There are several reasons to believe that a ChatGPT-powered Bing (or any other search engine) will not seriously threaten Google’s search near-monopoly. LLMs have several critical problems to solve before they can make a dent in the online search industry. Meanwhile, Google’s share of the search market, its technical ability and its financial resources will help it remain competitive (and possibly dominant) as conversational LLMs start to make their mark in online search.

Meanwhile, the real (and less discussed) potential of LLMs such as ChatGPT is the “unbundling” of online search, which is where real opportunities for Microsoft and other companies lie. By integrating ChatGPT into successful products, companies can reduce the use cases of Google Search.

3. Top AI conference bans ChatGPT in paper submissions (and why it matters)

A machine learning conference debating the use of machine learning? While that might seem so meta, in its call for paper submissions on Monday, the International Conference on Machine Learning did, indeed, note that “papers that include text generated from a large-scale language model (LLM) such as ChatGPT are prohibited unless the produced text is presented as a part of the paper’s experimental analysis.”

It didn’t take long for a brisk social media debate to brew, in what may be a perfect example of what businesses, organizations and institutions of all shapes and sizes, across verticals, will have to grapple with going forward: How will humans deal with the rise of large language models that can help communicate — or borrow, or expand on, or plagiarize, depending on your point of view — ideas?

4. Lumus readies new waveguide designs for smaller and lighter AR glasses

Israel’s Lumus, the developer of reflective waveguide technology for augmented reality (AR) eyewear, has introduced its second-generation technology to enable the development of smaller and lighter AR glasses.

The Lumus Z-Lens 2D waveguide architecture builds upon 2D Maximus to enable the development of smaller, lighter AR eyeglasses with high-resolution image quality, outdoor-compatible brightness and seamless prescription eye integration. The AR modules can be as much as 50% smaller.

The new technology will be demoed publicly for the first time at CES 2023, the big tech trade show in Las Vegas this week. Lumus hopes the tech will be the AR bridge to the exciting possibilities of the metaverse.

5. Glüxkind unveils smart stroller Ella which uses AI for safer movement

Glüxkind Technologies showed off its AI-based smart stroller Ella at the CES 2023 tech trade show in Las Vegas.

Vancouver, Canada-based Glüxkind Technologies created Ella to support new parents on their daily adventures, be more inclusive and enable families to spend quality time together. It’s another example of tech — and AI in particular — infiltrating everyday products that normally don’t have much tech. I have to say I never expected to see a baby stroller with AI.

Ella, Glüxkind’s AI stroller is designed and optimized for daily life, not the showroom. With Ella’s adaptive push and brake assistance, parents and caregivers alike can enjoy effortless walks regardless of terrain; uphill, downhill, and even when fully loaded with groceries and toys. All that stuff will be a walk in the park, the company said.

VentureBeat’s mission is to be a digital town square for technical decision-makers to gain knowledge about transformative enterprise technology and transact. Discover our Briefings.

Why AI-optimized workflows aren’t always best for business

AI-optimized
Technology
workflows

newsycanuse

January 8, 2023

Why AI-optimized workflows aren’t always best for business

January 7, 2023 10:10 AM

financial stock market graph on technology abstract background

Image Credit: monsitj/Getty

Check out all the on-demand sessions from the Intelligent Security Summit here.

Workflow and process inefficiencies can cost up to 40% of a company’s annual revenue. In many instances, companies seek to resolve this issue by implementing Artificial Intelligence (AI) scheduling algorithms. This is seen as a beneficial tool for business models that depend on speed and efficiency, such as delivery services and the logistics sector.

While AI has certainly helped with some of the time-consuming and often unpredictable tasks associated with scheduling workers across departments, the model is not yet perfect. Sometimes, it makes the problems worse and not better.

AI lacks the human ability to look beyond simply optimizing for business efficiency. That means it has no capacity for “human” variables like workers’ preferences. The limitations of AI scheduling can often lead to unbalanced shifts or unhappy workers, culminating in situations where the AI “help” given to HR actually gets in the way of smooth workflows.

When optimization goes wrong: AI can’t see humans behind the data points

Auto-scheduling AI has gained a lot of popularity in recent years. Between 2022 and 2027, the global AI scheduling system market is expected to see a CAGR of 13.5%, and 77% of companies are either already using AI or seeking to add AI tools to optimize workflows and improve business processes.

Event

Intelligent Security Summit On-Demand

Learn the critical role of AI & ML in cybersecurity and industry specific case studies. Watch on-demand sessions today.

Watch Here

However, it’s important to note that AI cannot yet make schedules without human oversight. HR professionals still need to review and adjust automatically generated schedules because there is still a huge, glaring flaw in the AI algorithms: A lack of “human parameters.”

AI is excellent at sorting through data and finding ways to maximize efficiency in business processes. Workflow optimization via algorithms that use historical data is ideal for projecting things like order volume and the required number of workers, based on information such as marketing promotions, weather patterns, time of day, hourly order estimates and average customer wait times.

The problem stems from AI’s inability to account for “human parameters,” which it perceives as drops in efficiency rather than better business practices.

For example, if a company has observant Muslim employees, they need small breaks in their workdays to observe prayer times. If a business employs new mothers, they may also need built-in times to pump breastmilk. These are things that are currently beyond AI’s capabilities to properly account for, because it cannot use empathy and human reasoning to see that these “inefficient schedules” are much more efficient from a long-term employee happiness perspective.

Efficiency isn’t always the best policy; is there a solution?

Currently, auto-scheduling tools can only pull data points from limited sources, like timesheets and workflow histories, to evenly distribute work hours in what it deems is the optimal way. AI scheduling tools need help understanding why it’s bad to have the same employee work the closing shift one day and then return for the opening shift the next day. They also can’t yet account for individual worker preferences or varied availabilities.

One possible solution to this problem is to keep adding parameters to the algorithms, but that presents its own problems. First, every time you introduce a new parameter, it decreases the likelihood that the algorithm will perform well. Second, algorithms only work as well as the data they are given. If AI tools are provided with incomplete, incorrect or imprecise data, the scheduling can hinder workflow efficiency and create more work for managers or HR employees. Adding more filters or limitations to the algorithm won’t help it work better.

So what is the solution? Unfortunately, until we discover ways to infuse AI with empathetic reasoning capabilities, there will likely always be a need for humans to have a hand in scheduling workers.

Nonetheless, companies can work toward creating a more positive, synergistic relationship between AI scheduling tools and the humans who use them.

For instance, delivery companies can feed historical data into AI tools to increase the effectiveness of their initial schedule outputs. This reduces some of the burden for HR and scheduling managers. In turn, the human scheduler now has an optimized base schedule to work from, so they can spend less time fitting workers into the needed time slots.

AI might be perfectly efficient, but it still needs human help to make employees happy

Humanity is still working hard on developing AI that exhibits “general intelligence,” which is a term applied to the intelligence seen in humans and animals. It combines problem-solving with emotion and common sense, two things yet to be replicated in AI.

When you need to automate repetitive tasks or analyze massive amounts of data to find inefficiencies and better work methods, AI outshines humans nearly every time. However, as soon as you add nuance, emotion or general intelligence, as with scheduling tasks, humans will still need to have the final say to balance optimized workflows with employee satisfaction and long-term company growth.

Vitaly Alexandrov is a serial entrepreneur and founder and CEO of Food Rocket, a US-based rapid grocery delivery service.

DataDecisionMakers

Welcome to the VentureBeat community!

DataDecisionMakers is where experts, including the technical people doing data work, can share data-related insights and innovation.

If you want to read about cutting-edge ideas and up-to-date information, best practices, and the future of data and data tech, join us at DataDecisionMakers.

You might even consider contributing an article of your own!

How to leverage data and technology in an increasingly automated world

Leverage
Technology

newsycanuse

January 8, 2023

How to leverage data and technology in an increasingly automated world

January 7, 2023 9:10 AM

Document management system or DMS. Automation software to archiving and efficiently manage and information files. Knowledge and documentation corporate. Internet Technology Concept

Image Credit: Galeanu Mihai/Getty

Check out all the on-demand sessions from the Intelligent Security Summit here.

With the advent of process automation and machine learning (ML) technologies, companies are increasingly confronted with new data and information, as well as the mounting pressure to adopt new tools they may not know how to take full advantage of.

In fact, in Deloitte’s State of AI in the Enterprise survey, 39% of respondents identified data issues as one of the top three greatest challenges they face with AI initiatives. It’s like finding a needle in a haystack with a metal detector that is too complicated to use — a waste of time and resources and a false sense of competitiveness.

But just how are industry innovators, such as field service organizations (FSOs) that typically dispatch technicians to remote locations to install, repair, or maintain equipment, rising to meet the challenges of an increasingly automated world? The answer lies in organizational changes to replace legacy technologies, break down data silos and fully leverage artificial intelligence (AI) to its full potential.

Replace legacy technologies

FSOs have traditionally focused on optimizing service efficiency and quality through process improvements and management software updates. Yet, traditional methods are no longer enough to show business value to their customers.

Event

Intelligent Security Summit On-Demand

Learn the critical role of AI & ML in cybersecurity and industry specific case studies. Watch on-demand sessions today.

Watch Here

As companies start focusing on offering outcome-based service models, they need to prepare to launch services like predictive maintenance, so they don’t risk reverting back to the break/fix model where they are constantly upgrading legacy systems. However, the evolution to an outcome-based model involves a level of digital transformation that poses several challenges. It can create an IT environment that is overly complex and includes numerous applications and systems with different update and release cadences or security features, which often leads to high IT maintenance costs and possible business disruptions.

Additionally, replacing a legacy system with one that cannot utilize data optimally while simultaneously promising compatibility with AI can lead to project delays and additional costs.

Address data and AI-enabled technology deficiencies

Optimizing the productivity of a company’s workforce and providing excellent customer experience is challenging in today’s on-demand world. To offer greater business value to customers, FSOs need to utilize data and intelligence to both meet and anticipate customer needs. However, this type of innovation requires breaking down data silos and coordinating processes across the organization to provide employees with customer insights.

Additionally, with AI-embedded software, organizations have the ability to automate repetitive tasks, process complex data sets, and more. However, while 80% of companies are already using some form of automation technology or plan to do so over the next year, it can be difficult for them to start the process of delivering the value AI promises without a third party walking them through the best AI and data solutions.

Maximize data and AI investments

Using a combination of data and AI has a lot of benefits, especially for organizations like FSOs that work to provide the best service to customers, by ensuring optimized scheduling of employees are able to respond to predicted service tasks.

In cases like these, data and AI work hand in hand; for example, data gathered from IoT sensors can help AI predict asset performance and schedule optimization by using data such as maintenance history. Typically, experiential data also helps FSOs actively respond to potential service issues by predicting when a customer’s product needs maintenance and thus makes sure parts and technicians are available at a given time.

AI also helps internal staff by automating customer interactions through the enhancement of chatbot and customer relationship management (CRM) tools.

As we move toward a more modern, automated future, organizations will need to get a grasp of their data silos to experience AI’s full potential. When data is used effectively with AI, organizations can solve a variety of problems end to end, paving the way for organizations to leverage predictive scheduling while meeting customer needs.

Kevin Miller is CTO of IFS.

DataDecisionMakers

Welcome to the VentureBeat community!

DataDecisionMakers is where experts, including the technical people doing data work, can share data-related insights and innovation.

If you want to read about cutting-edge ideas and up-to-date information, best practices, and the future of data and data tech, join us at DataDecisionMakers.

You might even consider contributing an article of your own!

We need to build better bias in AI

Build
Technology

newsycanuse

January 8, 2023

January 7, 2023 8:20 AM

Robot wearing dunce hat sits with head in hand in futuristic circuit backdrop

Image Credit: Donald Iain Smith/Getty

Check out all the on-demand sessions from the Intelligent Security Summit here.

At their best, AI systems extend and augment the work we do, helping us to realize our goals. At their worst, they undermine them. We’ve all heard of high-profile instances of AI bias, like Amazon’s machine learning (ML) recruitment engine that discriminated against women or the racist results from Google Vision. These cases don’t just harm individuals; they work against their creators’ original intentions. Quite rightly, these examples attracted public outcry and, as a result, shaped perceptions of AI bias into something that is categorically bad and that we need to eliminate.

While most people agree on the need to build high-trust, fair AI systems, taking all bias out of AI is unrealistic. In fact, as the new wave of ML models go beyond the deterministic, they’re actively being designed with some level of subjectivity built in. Today’s most sophisticated systems are synthesizing inputs, contextualizing content and interpreting results. Rather than trying to eliminate bias entirely, organizations should seek to understand and measure subjectivity better.

In support of subjectivity

As ML systems get more sophisticated — and our goals for them become more ambitious — organizations overtly require them to be subjective, albeit in a manner that aligns with the project’s intent and overall objectives.

We see this clearly in the field of conversational AI, for instance. Speech-to-text systems capable of transcribing a video or call are now mainstream. By comparison, the emerging wave of solutions not only report speech, but also interpret and summarize it. So, rather than a straightforward transcript, these systems work alongside humans to extend how they already work, for example, by summarizing a meeting, then creating a list of actions arising from it.

Event

Intelligent Security Summit On-Demand

Learn the critical role of AI & ML in cybersecurity and industry specific case studies. Watch on-demand sessions today.

Watch Here

In these examples, as in many more AI use cases, the system is required to understand context and interpret what is important and what can be ignored. In other words, we’re building AI systems to act like humans, and subjectivity is an integral part of the package.

The business of bias

Even the technological leap that has taken us from speech-to-text to conversational intelligence in just a few years is small compared to the future potential for this branch of AI.

Consider this: Meaning in conversation is, for the most part, conveyed through non-verbal cues and tone, according to Professor Albert Mehrabian in his seminal work, Silent Messages. Less than ten percent is down to the words themselves. Yet, the vast majority of conversation intelligence solutions rely heavily on interpreting text, largely ignoring (for now) the contextual cues.

As these intelligence systems begin to interpret what we might call the metadata of human conversation. That is, tone, pauses, context, facial expressions and so on, bias — or intentional, guided subjectivity — is not only a requirement, it is the value proposition.

Conversation intelligence is just one of many such machine learning fields. Some of the most interesting and potentially profitable applications of AI center not around faithfully reproducing what already exists, but rather interpreting it.

With the first wave of AI systems some 30 years ago, bias was understandably seen as bad because they were deterministic models intended to be fast, accurate — and neutral. However, we are at a point with AI where we require subjectivity because the systems can match and indeed mimic what humans do. In short, we need to update our expectations of AI in line with how it has changed over the course of one generation.

Rooting out bad bias

As AI adoption increases and these models influence decision-making and processes in everyday life, the issue of accountability becomes key.

When an ML flaw becomes apparent, it is easy to blame the algorithm or the dataset. Even a casual glance at the output from the ML research community highlights how dependent projects are on easily accessible ‘plug and play’ upstream libraries, protocols and datasets.

However, problematic data sources are not the only potential vulnerability. Undesirable bias can just as easily creep into the way we test and measure models. ML models are, after all, built by humans. We choose the data we feed them, how we validate the initial findings and how we go on to use the results. Skewed results that reflect unwanted and unintentional biases can be mitigated to some extent by having diverse teams and a collaborative work culture in which team members freely share their ideas and inputs.

Accountability in AI

Building better bias starts with building more diverse AI/ML teams. Research consistently demonstrates that more diverse teams lead to increased performance and profitability, yet change has been maddeningly slow. This is particularly true in AI.

While we should continue to push for culture change, this is just one aspect of the bias debate. Regulations governing the AI system bias are another important route to creating trustworthy models.

Companies should expect much closer scrutiny of their AI algorithms. In the U.S., the Algorithmic Fairness Act was introduced in 2020 with the aim of protecting the interests of citizens from harm that unfair AI systems can cause. Similarly, the EU’s proposed AI regulation will ban the use of AI in certain circumstances and heavily regulate its use in “high risk” situations. And beginning in New York City in January 2023, companies will be required to perform AI audits that evaluate race and gender biases.

Building AI systems we can trust

When organizations look at re-evaluating an AI system, rooting out undesirable biases or building a new model, they, of course, need to think carefully about the algorithm itself and the data sets it is being fed. But they must go further to ensure that unintended consequences do not creep in at later stages, such as test and measurement, results interpretation, or, just as importantly, at the point where employees are trained in using it.

As the field of AI gets increasingly regulated, companies need to be far more transparent in how they apply algorithms to their business operations. On the one hand, they will need a robust framework that acknowledges, understands and governs both implicit and explicit biases.

However, they are unlikely to achieve their bias-related objectives without culture change. Not only do AI teams urgently need to become more diverse, at the same time the conversation around bias needs to expand to keep up with the emerging generation of AI systems. As AI machines are increasingly built to augment what we are capable of by contextualizing content and inferring meaning, governments, organizations and citizens alike will need to be able to measure all the biases to which our systems are subject.

Surbhi Rathore is the CEO and cofounder of Symbl.ai

DataDecisionMakers

Welcome to the VentureBeat community!

DataDecisionMakers is where experts, including the technical people doing data work, can share data-related insights and innovation.

If you want to read about cutting-edge ideas and up-to-date information, best practices, and the future of data and data tech, join us at DataDecisionMakers.

You might even consider contributing an article of your own!

Roland’s 50th Anniversary Concept Piano has flying speakers for some reason

anniversary
Roland's
Technology

newsycanuse

January 8, 2023

Roland’s 50th Anniversary Concept Piano has flying speakers for some reason

2022 marked the 50th anniversary of storied instrument maker Roland. But, even though we’ve switched over to our 2023 calendars, the company took the opportunity at CES to take one more victory lap by showing off its 50th Anniversary Concept Piano. It’s an audacious electronic piano built in collaboration with Japanese furniture maker Karimoku. The outside is one piece molded from Japanese Nara oak that hides a 360-degree, 14 speaker system.

If the elegant curves stuffed to the brim with speakers aren’t exciting enough for you, well I’ve got good news: Roland has also built speakers into drones that hover above the piano and can be controlled by the player. Unfortunately, those couldn’t be flown on the show floor at CES, so Roland dangled a pair of them from wires. Those are combined with a proprietary low-latency audio connection and the company’s PureAcoustic Ambience tech to create flexible natural sounding reverb that more accurately mimics what you’d hear in, say, a concert hall. And I can confirm that even in the cavernous Las Vegas Convention Center, fighting against the constant din of people and other exhibitors, the concept piano sounded amazing.

Above the keyboard itself there’s a large touchscreen that can be used to stream tutorials, video conference with a piano teacher, or even run Zenbeats from Roland Cloud, turning the instrument into a studio hub. There’s even USB MIDI and Bluetooth connectivity for interacting with other instruments.

Of course, the Roland 50th Anniversary Concept Piano is not for sale. And never will be. This is a creation in the tradition of over-the-top concept cars. Maybe some of its features will eventually make their way to future instruments, but for now it’s truly a one of a kind.

All products recommended by Engadget are selected by our editorial team, independent of our parent company. Some of our stories include affiliate links. If you buy something through one of these links, we may earn an affiliate commission. All prices are correct at the time of publishing.

A dead NASA satellite is returning to Earth after 38 years in space

returning
Satellite
Technology

newsycanuse

January 8, 2023

A dead NASA satellite is returning to Earth after 38 years in space

After nearly four decades in space, NASA’s retried Earth Radiation Budget Satellite (ERBS) is about to fall from the sky. On Friday, the agency said the likelihood of wreckage from ERBS harming anyone on Earth is “very low.” NASA expects most of the 5,400-pound satellite will burn up upon re-entry. Earlier this week, the Defense Department predicted ERBS would re-enter the Earth’s atmosphere on Sunday at approximately 6:40PM ET, give or take 17 hours.

While it may be a household name, the Earth Radiation Budget Satellite had anything but a dull history. Per Phys.org, the Space Shuttle Challenger carried the satellite to space in 1984, a little more than a year before Challenger’s heartbreaking demise in early 1986. Astronaut Sally Ride, the first American woman to fly to space, released ERBS from Challenger’s cargo hold using the spacecraft’s robotic arm. During that same mission, Ride’s crewmate, Kathryn Sullivan, became the first American woman to perform a space walk. It was also the first mission to see two female astronauts fly to space together. As for ERBS, it went on to collect ozone and atmospheric measurements until 2005. Scientists used that data to study how Earth absorbs and radiates solar energy. ERBS’s contribution to science is even more impressive when you consider NASA initially expected it would only stay functional for two years.

The tech pioneer behind Sound Blaster has passed away

'Pioneer'
Sound
Technology

newsycanuse

January 8, 2023

The tech pioneer behind Sound Blaster has passed away

Singaporean inventor and tech pioneer Sim Wong Hoo passed away on January 4th at the age of 67. Sim may not be a household name these days, but he founded Creative Technology (or Creative Labs in the US), the company behind the Sound Blaster brand of sound cards, back in 1981. Sound Blasters were some of the first sound cards available to consumers, and there was a time when you had to make sure your system worked with them if you wanted to listen to music and play games.

Sim established his business in the US and started selling Sound Blasters a few years later, after which Creative became the first Singaporean company to be listed on the Nasdaq exchange. The integration of sound boards into the motherboard ended Sound Blaster’s popularity, but Bloomberg says the cards provided audio for more than 400 million PCs.

Under his leadership, Creative also launched a range of MP3 players, and Sim once tried to take on Apple by spending $100 million on advertising and marketing in its bid to dethrone the iPod. In 2006, Creative sued Apple for violating its patent for portable media system menus. The companies filed more lawsuits against each other after that before Apple settled with Creative and paid the company $100 million for the technology outlined in its patent.

Creative confirmed Sim’s passing on its website, calling him “a visionary, inventor, and entrepreneur who gave the PC a voice.” In a press release published by the company, interim CEO Song Siow Hui said in a statement:

“I have known and worked with Mr. Sim for over 30 years. This is a sad and sudden development and we feel a great loss especially since Mr. Sim and I recently had extensive discussions on the future direction of the Company. During those discussions, Mr. Sim was full of fresh vision. Even on the night before, he had a long discussion with the Engineering team and was scheduled to meet with the Online Sales team the next day. The best thing to do now is to ensure the continued smooth running of the Company, and also to execute and realise the vision and strategy that Mr. Sim had for the Company.”

Proposed digital fraud refund rules risk excluding many victims

digital
proposed
Technology

newsycanuse

January 8, 2023

Proposed digital fraud refund rules risk excluding many victims

weerapat1003 – stock.adobe.com

Proposals to establish a fraud refund mechanism in the UK risk excluding many victims of digitally enabled fraud, a major bank has warned

Alex Scroxton

Alex Scroxton,
Security Editor

Published: 07 Jan 2023 0:01

Proposals by the Payment Systems Regulator (PSR) to establish a new fraud refund mechanism risks excluding many victims of authorised push payment (APP) fraud and other forms of digitally enabled fraud by setting a minimum level of reimbursement, retail bank TSB has warned.

Under the proposals, which TSB does in general support, the regulator plans to allow the banking sector to adopt a £100 threshold for repayment, meaning that if the victim lost less than £100, the bank would not be obliged to help.

TSB said this could see thousands of victims denied reimbursement under the new protections, which it has long campaigned for. It pointed out that while cases of APP fraud in which less than £100 was lost account for only about 1% of total monetary losses to fraud in the UK (representing £5m of losses per annum altogether), they also amounted to about a quarter of all fraud cases.

Of those, 44% relate to purchase fraud and 11% to advanced fee fraud, which by its nature has a tendency to victimise the financially vulnerable.

TSB added that younger people would also be disproportionately affected by the plans, with 20- to 40-year-olds accounting for over half of sub-£100 fraud cases.

It claimed the proposals would also exclude a significant number of people who have fallen victim to fraud on social media platforms – Meta’s Facebook and Instagram account for 80% of all purchase fraud cases seen by TSB, while, according to UK Finance, about 70% of all push payment fraud starts online.

“We welcome these moves by government and regulators to increase customer protection from fraud,” said TSB director of fraud prevention Paul Davis. “However, many people simply cannot afford losing £100 to fraud – especially in the current economic climate – and deserve to be protected from increasingly complex scams that often take place on social media sites. TSB’s Fraud Refund Guarantee has been protecting our customers for nearly four years and currently pays out to 98% of fraud victims, including those with losses under £100.”

TSB is calling on the PSR to reconsider these plans, as well as to abandon a proposal to charge victims a £35 excess fee per claim, something it said would disproportionately impact financially vulnerable people amid the cost-of-living crisis.

The PSR first proposed mandating APP fraud reimbursement in 2021, at the same time calling on both banks and tech firms to be more transparent about fraud levels and increase prevention efforts.

Losses to APP fraud in the UK are expected to double over the five-year period from 2021 to 2026, climbing from approximately £666m to £1.32bn in that timeframe, according to figures produced last year by payments software firm ACI Worldwide and analytics firm GlobalData.

“APP fraud is on the rise, and despite many banks stepping up their fraud prevention efforts, this is an issue they can no longer solve on their own,” Cleber Martins, head of payments intelligence and risk solutions at ACI Worldwide, said at the time.

“APP fraud does not happen in silos,” he added. “To contain and stop this kind of fraud, a detailed and holistic view of all payment activity is needed. Financial institutions, social media giants and telco companies need to work together to stop fraudsters in their tracks before the fraudulent transactions take place.”

Cyber gang abused free trials to exploit public cloud CPU resources

abused
Cyber
Technology

newsycanuse

January 8, 2023

Cyber gang abused free trials to exploit public cloud CPU resources

Parilov – stock.adobe.com

A South Africa-based cyber crime gang exploited free trials and introductory offers to run cryptominers via public cloud services, then did a runner without paying

Alex Scroxton

Alex Scroxton,
Security Editor

Published: 05 Jan 2023 14:05

A South Africa-based threat actor known as Automated Libra has been observed adopting increasingly sophisticated techniques to conduct a widespread freejacking campaign against various public cloud services.

Freejacking is the act of using free or time-limited access to public cloud resources – such as introductory trial offers – to perform illicit cryptomining.

The campaign was initially dubbed PurpleUrchin by researchers at cloud and container security specialist Sysdig, which uncovered it last year while analysing some publicly shared containers and suspicious activity emanating from a Docker hub account.

At the time, Sysdig told Computer Weekly’s sister site SearchSecurity that its research team had not been able to establish how long the campaign had been running. However, Palo Alto Networks’ Unit 42 team has since analysed over 250GB of data, including container data and system access logs, and hundreds of indicators of compromise, and is now able to shed more light on the campaign and those behind it.

Unit 42 said PurpleUrchin – which reached a peak of activity in November 2022 – was set up as long ago as 2019 and had previously been highly active during the second half of 2021.

In the campaign, the Automated Libra gang stole compute resource from several service platforms using “play-and-run” tactics – akin to a so-called “dine-and-dash” in a restaurant – where they exploited the on-offer resources until they ran out, and then did not pay their bills, which in some cases were close to $200 per account.

Unit 42 found that Automated Libra was able to create and use more than 130,000 fake accounts on limited use platforms such as GitHub, Heroku and Togglebox using stolen or fake credit cards, and deployed an architecture that used standard DevOps continuous integration and delivery (CI/CD) techniques to automate the business of standing up these accounts and running them to perform cryptomining activities on a massive scale.

Among other things, they became able to bypass or resolve CAPTCHAs designed to weed out fake accounts, increase the number of accounts created – three to five per minute on GitHub at one point – and use as much CPU time as possible before the unwitting victims noticed.

“Automated Libra designs their infrastructure to make the most use out of CD/CI tools. This is getting easier to achieve over time, as the traditional VSPs [virtual service providers] are diversifying their service portfolios to include cloud-related services,” said Unit 42 researchers William Gamanzo and Nathaniel Quist.

“The availability of these cloud-related services makes it easier for threat actors because they don’t have to maintain infrastructure to deploy their applications. In the majority of cases, all they need to do is to deploy a container.”

Indeed, using CI/CD techniques may have been something of a masterstroke for the freejackers, as by creating highly modular operational environments they could allow components of their operation to fail, be updated, or be terminated and replaced, without affecting their larger environment.

Gamanzo and Quist said they identified over 40 individual cryptowallets and seven cryptocurrencies or tokens used in the operation. Additionally, the containerised components were used to automate the process of trading the freshly mined cryptocurrency across multiple trading platforms.

According to the Sysdig research, the gang may have stayed under the radar for some time because they weren’t really affecting any legitimate users or compromising any genuine accounts.

However, their actions could ultimately rebound on genuine users if service providers tighten the rules on free or trial service tiers, or increase their subscription fees. Sysdig reckons that every free GitHub account costs GitHub $15 per month, so the cost to the cloud providers would likely be significant given Automated Libra has been able to scale its operation so well.

Warning over ransomware attacks spreading via Fortinet kit

Ransomware
Technology
warning

newsycanuse

January 8, 2023

Warning over ransomware attacks spreading via Fortinet kit

Following the disclosure of a critical vulnerability in October 2022, Fortinet VPN devices were exploited in two known ransomware attacks, with access likely sold on the dark web

Alex Scroxton

Alex Scroxton,
Security Editor

Published: 05 Jan 2023 14:00

Ransomware operators are exploiting Fortinet network devices that remain vulnerable to a critical authentication bypass vulnerability, according to research publicly released today by eSentire’s Threat Research Unit (TRU).

Fortinet first disclosed the vulnerability in question – tracked as CVE-2022-40684 – on 10 October 2022. It affects FortiOS, FortiProxy and FortiSwitchManager, which, if successfully exploited, would enable an unauthenticated actor to perform operations on the admin interface by sending specially crafted HTTP or HTTPS requests.

Fortinet said at the time of the disclosure that it was aware of an instance of the vulnerability having been exploited. However, according to eSentire, a functional proof-of-concept (PoC) exploit was circulating just three days later, after which a “slew” of threat actors began scanning the internet for vulnerable devices.

The TRU team said it had detected and shut down two attacks on its customers – one, a further education institution in Canada, and the other, a global investment firm. Both were hit by an undisclosed ransomware operator, and in both cases, the investigation led back to vulnerable Fortinet secure socket layer virtual private network (SSL VPN) devices that were being managed and monitored by third-party managed service providers (MSPs).

Once they had gained a foothold in the target environments, the threat actor abused Microsoft’s Remote Desktop Protocol (RDP) to achieve lateral movement, as well as legitimate encryption utilities BestCrypt and BitLocker. The overall modus operandi and ransom note were indicative of a relatively new group known as KalajaTomorr.

Keegan Keplinger, research and reporting lead for the eSentire TRU, told Computer Weekly that the use of an insecure VPN to spread ransomware should not, in and of itself, come as a surprise to anybody.

“SSL VPNs are easy to misconfigure, and they are highly targeted for exploitation since they must be exposed to the internet and they provide access to credentials for the organisation,” said Keplinger.

“Additionally, the tendency for these devices to be managed by a third party often means that the organisation and their security providers have no direct visibility into activities being conducted on the device. This allows threat actors longer dwell times, as observed in the sale of these devices on the dark web, [making] SSL VPNs a prime target for initial access brokers [IABs],” he added.

To this point, Keplinger explained that the TRU had also observed multiple parties buying and selling access to compromised Fortinet devices in the weeks after the initial disclosure. These sales ranged from individual targets to bulk sales of multiple potential victims – in one case, an IAB was observed selling bulk access on a monthly subscription basis, asking between $5,000 and $7,000.

Keplinger said the TRU’s research had shown that cyber criminals are always on the ball when it comes to exploiting vulnerabilities in well-used products. Fortinet, as a popular supplier of network security solutions, could be considered particularly at risk of having its technology exploited in such a way.

“A particular blind spot, in this case, was out-of-date Fortinet devices, managed by third parties. This creates a visibility gap for the organisation and their security providers – in cases we observed, this led to the Fortinet devices being leveraged by ransomware actors. You can’t get an endpoint agent on a Fortinet device, but they do have security logging functionality, which is what allowed us to track down and intercept devices that initial access brokers were sitting on,” said Keplinger.

“To detect intrusion actions, after that access has been sold, endpoint monitoring usually does the trick, and if your endpoint monitoring solution can quarantine endpoints, you can intercept attacks before they get the ransomware deployed,” he added.

Computer Weekly reached out to Fortinet for more information, but the organisation had not responded at the time of publication.

At the same time, defenders should be alert to the possibility of exploitation of a different vulnerability in the FortiOS SSL VPN, disclosed by France-based Olympe Cyberdefense just before Christmas. The heap-based buffer overflow tracked as CVE-2022-42475 could enable remote, unauthenticated attackers to execute arbitrary code.

NewyscanuseGet some of the latest news

NewyscanuseGet some of the latest news

News You Can USe!

NewsYcanuseGet some of the latest news

News You Can USe!

NewyscanuseGet some of the latest news

Event

1. Two years after DALL-E debut, its inventor is ‘surprised’ by impact

2. ChatGPT and the unbundling of online search

3. Top AI conference bans ChatGPT in paper submissions (and why it matters)

4. Lumus readies new waveguide designs for smaller and lighter AR glasses

5. Glüxkind unveils smart stroller Ella which uses AI for safer movement

When optimization goes wrong: AI can’t see humans behind the data points

Event

Efficiency isn’t always the best policy; is there a solution?

AI might be perfectly efficient, but it still needs human help to make employees happy

DataDecisionMakers

Replace legacy technologies

Event

Address data and AI-enabled technology deficiencies

Maximize data and AI investments

DataDecisionMakers

In support of subjectivity

Event

The business of bias

Rooting out bad bias

Accountability in AI

Building AI systems we can trust

DataDecisionMakers

Proposals to establish a fraud refund mechanism in the UK risk excluding many victims of digitally enabled fraud, a major bank has warned

Read more on Hackers and cybercrime prevention

UK police arrest 120 in largest-ever cyber fraud crackdown

APP fraud volumes expected to double by 2026, says report

Bank warns of spike in online cost-of-living scams

Two-thirds of UK organisations defrauded since start of pandemic

A South Africa-based cyber crime gang exploited free trials and introductory offers to run cryptominers via public cloud services, then did a runner without paying

Read more on Cloud security

CISA: Iranian APT actors compromised federal network

Cryptomining campaign abused free GitHub account trials

Thousands wrongly given criminal convictions after computer error

Sysdig deal reflects infrastructure-as-code security buzz

Following the disclosure of a critical vulnerability in October 2022, Fortinet VPN devices were exploited in two known ransomware attacks, with access likely sold on the dark web

Read more on Network security management

Fortinet confirms VPN vulnerability exploited in the wild

Google, MS, Oracle vulnerabilities make November ’22 a big month for patching

Critical Fortinet vulnerability under active exploitation

China using top consumer routers to hack Western comms networks