Jonathan Greig writes via The Record: Genetic testing giant 23andMe confirmed that a data scraping incident resulted in hackers gaining access to sensitive user information and selling it on the dark web. The information of nearly 7 million 23andMe users was offered for sale on a cybercriminal forum this week. The information included origin estimation, phenotype, health information, photos, identification data and more. 23andMe processes saliva samples submitted by customers to determine their ancestry.

When asked about the post, the company initially denied that the information was legitimate, calling it a “misleading claim” in a statement to Recorded Future News. The company later said it was aware that certain 23andMe customer profile information was compiled through unauthorized access to individual accounts that were signed up for the DNA Relative feature — which allows users to opt in for the company to show them potential matches for relatives. […] When pressed on how compromising a handful of user accounts would give someone access to millions of users, the spokesperson said the company does not believe the threat actor had access to all of the accounts but rather gained unauthorized entry to a much smaller number of 23andMe accounts and scraped data from their DNA Relative matches.

A researcher approached Recorded Future News after examining the leaked database and found that much of it looked real. […] The researcher downloaded two files from the BreachForums post and found that one had information on 1 million 23andMe users of Ashkenazi heritage. The other file included data on more than 300,000 users of Chinese heritage. The data included profile and account ID numbers, names, gender, birth year, maternal and paternal genetic markers, ancestral heritage results, and data on whether or not each user has opted into 23andme’s health data. The researcher added that he discovered another issue where someone could enter a 23andme profile ID, like the ones included in the leaked data set, into their URL and see someone’s profile. The data available through this only includes profile photos, names, birth years and location but does not include test results.

Read more of this story at Slashdot.

Source: Slashdot – 23andMe Scraping Incident Leaked Data On 1.3 Million Users

An anonymous reader quotes a report from Motherboard: A man who admitted attempting to assassinate Queen Elizabeth II with a crossbow after discussing his plan with an AI-powered chatbot has been sentenced to 9 years in prison for treason. It’s the UK’s first treason conviction in more than 40 years. Jaswant Singh Chail, who was 19 at the time of his arrest on Christmas Day, 2021, scaled the walls of Windsor Castle’s grounds with a mask and a loaded high-power crossbow. He said his intent was, as a British Sikh, to assassinate the Queen in a Star Wars-inspired plan to avenge the 1919 Jallianwalla Bagh massacre, a colonial-era atrocity during British rule in India. Prosecutors said that Chail was encouraged to undertake this plot after discussing it at length with an AI-powered chatbot that egged him on and bolstered his resolve. […] Chail is currently being held at Broadmoor high-security hospital and will remain there until he is psychologically well enough to serve his sentence.

Read more of this story at Slashdot.

Source: Slashdot – Man Jailed In UK’s First Treason Conviction In 40 Years Was Encouraged By AI Chatbot

Kylie Robison writes via Fortune: Beginning on Monday, Slack employees will be expected to set aside their regular work duties and to instead plug away at various modules on Salesforce’s Trailhead online learning platform, Fortune has learned. The goal is for Slack’s employees to reach Trailhead’s Ranger level, a feat that requires roughly 40 hours on the learning platform, whose modules include topics like “Learn about the Fourth Industrial Revolution” and “Healthy Eating.” A large percent of Slack’s roughly 3,000 staff have neglected to hit the target, according to sources inside the company. And since Salesforce provides Trailhead to other businesses as a way to “upskill” employees, some speculate that the slackers at Slack make for bad optics.

In a message to employees in mid-September, Slack CEO Lidiane Jones wrote that the one week shutdown, dubbed “Ranger Week,” is intended to give everyone “dedicated time to make a lot of progress towards the goal.” Jones wrote in her message that the product development engineering (PDE), customer experience (CE), Biz Ops, and communication departments are expected to participate in Ranger Week. “It’s important that we all reach Ranger status this year, and I want to ensure that everyone has focus time to upskill on Trailhead,” Jones wrote in the message to staff. “I know this will disrupt and slow V2MOM progress for many of us — we are making this a priority now so we can quickly get back to work on our roadmaps,” she said, referring to the company’s annual forward-looking strategy planning document which stands for vision, values, methods, obstacles, and measures. […]

“We really are canceling all meetings next week to facilitate this heads-down time, even 1:1s,” Slack’s chief of staff to the CTO wrote to employees on Wednesday. “We don’t know yet what will happen to people who haven’t hit Ranger by Jan. 31. At a minimum, it will make Slack look bad compared to the other clouds. Please do use the time next week to make as much progress as you can!” […] Still, the work stoppage is somewhat porous. Slack’s CTO noted that “deploys, on-call rotations, and interviews” will still happen as normal, and while no executive has used the word “mandatory,” it’s considered strongly encouraged. According to Insider, some workers at Slack are “gaming” the platform to speed through the sessions.

Read more of this story at Slashdot.

Source: Slashdot – All Slack Employees Forced To Spend a Week Getting Salesforce Certifications

The National Security Agency (NSA), in partnership with the Cybersecurity and Infrastructure Security Agency (CISA), have highlighted the ten most common cybersecurity misconfigurations in large organizations. In their join cybersecurity advisory (CSA), they also detail the tactics, techniques, and procedures (TTPs) actors use to exploit these misconfigurations. From the report: Through NSA and CISA Red and Blue team assessments, as well as through the activities of NSA and CISA Hunt and Incident Response teams, the agencies identified the following 10 most common network misconfigurations:
1. Default configurations of software and applications
2. Improper separation of user/administrator privilege
3. Insufficient internal network monitoring
4. Lack of network segmentation
5. Poor patch management
6. Bypass of system access controls
7. Weak or misconfigured multifactor authentication (MFA) methods
8. Insufficient access control lists (ACLs) on network shares and services
9. Poor credential hygiene
10. Unrestricted code execution

NSA and CISA encourage network defenders to implement the recommendations found within the Mitigations section of this advisory — including the following — to reduce the risk of malicious actors exploiting the identified misconfigurations: Remove default credentials and harden configurations; Disable unused services and implement access controls; Update regularly and automate patching, prioritizing patching of known exploited vulnerabilities; and Reduce, restrict, audit, and monitor administrative accounts and privileges.

NSA and CISA urge software manufacturers to take ownership of improving security outcomes of their customers by embracing secure-by-design and-default tactics, including: Embedding security controls into product architecture from the start of development and throughout the entire software development lifecycle (SDLC); Eliminating default passwords; Providing high-quality audit logs to customers at no extra charge; and Mandating MFA, ideally phishing-resistant, for privileged users and making MFA a default rather than opt-in feature. A PDF version of the report can be downloaded here (PDF).

Read more of this story at Slashdot.

Source: Slashdot – NSA Shares Top Ten Cybersecurity Misconfigurations

An anonymous reader quotes a report from Ars Technica: Getty Images CEO Craig Peters told the Verge that he has found a solution to one of AI’s biggest copyright problems: creators suing because AI models were trained on their original works without consent or compensation. To prove it’s possible for AI makers to respect artists’ copyrights, Getty built an AI tool using only licensed data that’s designed to reward creators more and more as the tool becomes more popular over time. “I think a world that doesn’t reward investment in intellectual property is a pretty sad world,” Peters told The Verge. The conversation happened at Vox Media’s Code Conference 2023, with Peters explaining why Getty Images — which manages “the world’s largest privately held visual archive” — has a unique perspective on this divisive issue.

In February, Getty Images sued Stability AI over copyright concerns regarding the AI company’s image generator, Stable Diffusion. Getty alleged that Stable Diffusion was trained on 12 million Getty images and even imitated Getty’s watermark — controversially seeming to add a layer of Getty’s authenticity to fake AI images. Now, Getty has rolled out its own AI image generator that has been trained in ways that are unlike most of the popular image generators out there. Peters told The Verge that because of Getty’s ongoing mission to capture the world’s most iconic images, “Generative AI by Getty Images” was intentionally designed to avoid major copyright concerns swirling around AI images — and compensate Getty creators fairly.

Rather than crawling the web for data to feed its AI model, Getty’s tool is trained exclusively on images that Getty owns the rights to, Peters said. The tool was created out of rising demand from Getty Images customers who want access to AI generators that don’t carry copyright risks. […] With that as the goal, Peters told Code Conference attendees that the tool is “entirely commercially safe” and “cannot produce third-party intellectual property” or deepfakes because the AI model would have no references from which to produce such risky content. Getty’s AI tool “doesn’t know what the Pope is,” Peters told The Verge. “It doesn’t know what [Balenciaga] is, and it can’t produce a merging of the two.” Peters also said that if there are any lawsuits over AI images generated by Getty, then Getty will cover any legal costs for customers. “We actually put our indemnification around that so that if there are any issues, which we’re confident there won’t be, we’ll stand behind that,” Peters said. When asked how Getty creators will be paid for AI training data, Peters said that there currently isn’t a tool for Getty to assess which artist deserves credit every time an AI image is generated. “Instead, Getty will rely on a fixed model that Peters said determines ‘what proportion of the training set does your content represent? And then, how has that content performed in our licensing world over time? It’s kind of a proxy for quality and quantity. So, it’s kind of a blend of the two,'” reports Ars.

“Importantly, Peters suggested that Getty isn’t married to using this rewards system and would adapt its methods for rewarding creators by continually monitoring how customers are using the AI tool.”

Read more of this story at Slashdot.

Source: Slashdot – Getty Images Built a ‘Socially Responsible’ AI Tool That Rewards Artists

Atari just announced preorders for a physical cartridge for the company’s once-ubiquitous 2600 console. From a report: A gaming console that counts 1982 as its most successful year is releasing another new cartridge in the year 2023. The game-in-question is called Save Mary and was actually developed during the console’s golden years, before being shelved when the 2600 went the way of the dodo. Save Mary was in development for two whole years, which is a lifetime in the generation of gaming that preceded the NES. The normal timeframe to produce a game back then was six to nine months, with some notorious titles taking just five or six weeks. Save Mary was originally developed by veteran Atari staffer Tod Frye, the guy behind the 2600 version of Pac-Man and the Swordquest series.

Read more of this story at Slashdot.

Source: Slashdot – Atari Releasing New Cartridge For Its 46-Year-Old 2600 Console