Critical NVIDIA flaw affects AI applications. Governor Newsom vetoes controversial AI safety bill.

Summary

By the CyberWire staff

At a glance.

Critical NVIDIA flaw affects AI applications.
Governor Newsom vetoes controversial AI safety bill.
British man accused of hacking five US companies.

Critical NVIDIA flaw affects AI applications.

Researchers at Wiz have disclosed a critical vulnerability (CVE-2024-0132) affecting NVIDIA Container Toolkit and GPU Operator. The flaw affects any AI application that uses the toolkit to enable GPU support. NVIDIA issued a patch on September 26th.

Wiz stated, "The vulnerability enables attackers who control a container image executed by the vulnerable toolkit to escape from that container and gain full access to the underlying host system, posing a serious risk to sensitive data and infrastructure." The researchers add, "The urgency with which you should fix the vulnerability depends on the architecture of your environment and the level of trust you place in running images. Any environment that allows the use of third party container images or AI models – either internally or as-a-service – is at higher risk given that this vulnerability can be exploited via a malicious image."

Now available: The SpyCloud 2024 Malware and Ransomware Defense Report

SpyCloud’s annual Malware & Ransomware Defense Report is packed with valuable insights from over 500+ security leaders and practitioners from across the US and UK. The findings include details about how infostealer malware is fueling ransomware, the most common entry points used by cybercriminals in ransomware attacks, industry-specific risks, and actionable takeaways on how to protect your organization from the criminal underground. Read the report now.

Governor Newsom vetoes controversial AI safety bill.

California Governor Gavin Newsom has vetoed a contentious AI safety bill, stating that it "falls short of providing a flexible, comprehensive solution to curbing the potential catastrophic risks," the AP reports. The bill's author, Democratic Senator Scott Wiener, called the veto a "setback for everyone who believes in oversight of massive corporations that are making critical decisions that affect the safety and welfare of the public and the future of the planet." Critics said the bill would stifle innovation and had a disproportionate focus on extreme scenarios.

Newsom stated, "While well-intentioned, SB 1047 does not take into account whether an AI system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data. Instead, the bill applies stringent standards to even the most basic functions — so long as a large system deploys it. I do not believe this is the best approach to protecting the public from real threats posed by the technology."

Are You Confident in the Security of Your Remote and Hybrid Employees?

A remote or hybrid workforce expands your company's surface area of attack beyond corporate firewall boundaries. Employees’ personal computers introduce shadow IT, and home networks with default settings are easy targets, compounded by public Wi-Fi vulnerabilities. You need to develop a strategy to stay secure while remote employees work across untrusted networks. To learn how you can secure your company's workforce, get a free copy of the latest ThreatLocker® whitepaper on how to secure remote workforces.

British man accused of hacking five US companies.

Police in the UK have arrested a British man, Robert Westbrook, who will be extradited to the US on hacking charges. The US Justice Department alleges, "From January 2019 through May 2020, Westbrook executed a hack-to-trade scheme through which he generated millions of dollars in profits. On at least five occasions, Westbrook gained unauthorized access to Office365 email accounts belonging to corporate executives employed by certain U.S.-based companies to obtain non-public information, including information about impending earnings announcements. Westbrook then used that information to purchase securities that he sold in short order for substantial profits after the material information became public. On several occasions, Westbrook implemented auto-forwarding rules designed to automatically forward content from the corporate executives’ compromised email accounts to email accounts controlled by Westbrook. Westbrook generated profits exceeding $3 million dollars through this scheme."

[On Demand Podcast] Cloud Security in the Age of Generative AI

Listen to the recent discussion between N2K CyberWire’s Dave Bittner and Sysdig’s Loris Degioanni on how generative AI (GenAI) and Large Language Models (LLMs) are changing the cloud security landscape. We explored how to secure your AI deployments to safeguard sensitive information and went into the state-of-the-art for employing AI to boost the effectiveness of your cloud security teams in the face of evolving threats. Watch or listen to the discussion now.

Notes.

Today's issue includes events affecting , and the United Kingdom the United States.

Attacks, Threats, and Vulnerabilities

Accounting Firm WMDDH Discloses Data Breach Impacting 127,000 (SecurityWeek) The personal information of over 127,000 individuals was stolen in a July 2023 data breach at Wright, Moore, DeHart, Dupuis & Hutchinson (WMDDH).

Facial DNA provider leaks biometric data via WordPress folder (Hackread) Follow us on Twitter (X) @Hackread - Facebook @ /Hackread

Marketplace

PwC Urges Boards to Give CISOs a Seat at the Table (Infosecurity Magazine) PwC claims fewer than 50% of businesses involve their CISOs in strategic planning on cyber

Legislation, Policy, and Regulation

Pentagon asks lawmakers to kill third-party look at an independent cyber force - Breaking Defense (Breaking Defense) A Defense Department official previously warned those proposing a separate cyber force to "be careful what you wish for."

Litigation, Investigation, and Law Enforcement

U.K. National Charged with Multimillion-Dollar Hack-to-Trade Fraud Scheme (US Justice Department) westbrook.indictment.pdf NEWARK, N.J. – A United Kingdom national has been charged for his execution of a hack-to-trade scheme, through which he generated millions of dollars in profits.

Industry Events

For a complete running list of events, please visit the Event Tracker.

Newly Noted Events

Pacific Hackers Conference (Mountain View, California, USA, Nov 2, 2024) Pacific Hacker Conference is an information security and hacking conference that gathers the brightest minds in cybersecurity and hacking from Silicon Valley and beyond. Focusing on cutting-edge techniques, research, and developments, we aim to create an environment where knowledge is shared and connections are made. Our audience ranges from security professionals, researchers, and ethical hackers to industry decision-makers. We keep the conference small, allowing us to provide what other Cons leave out.

CYBERWARCON (Arlington + Virtual, Virginia, USA, Nov 22, 2024) CYBERWARCON is a one-day conference in Arlington, VA focused on the specter of destruction, disruption, and malicious influence on our society through cyber capabilities. CYBERWARCON is not a hacker conference, or an ICS conference, or an international policy conference. The central purpose of this conference is to identify and explore threats. Participants and attendees come from a spectrum of backgrounds including the military and government, academia, the media, and the private sector.

Events

Uniting Women in Cyber 2024 (Arlington, Virginia, USA, Oct 1, 2024) The premier networking event to advance diversity in cybersecurity! Join renowned cyber leaders and experts from all walks of life. Uniting Women in Cyber (UWIC) event convenes a powerful and diverse network of cyber leaders and experts to discuss emerging global trends, technological advancements, and workforce development. UWIC is the premier event for professionals, aspiring practitioners and all who are interested in cybersecurity, to meet and network with national leaders in the field. Come and be a part of a vibrant, diverse community to learn, share ideas, and expand your professional network!

HITRUST® Collaborate 2024 (Frisco, Texas, USA, Oct 1 - 3, 2024) HITRUST Collaborate is the most comprehensive information protection and risk management conference for privacy, security, and compliance. The 2.5-day conference includes keynotes, panel discussions, and educational sessions for industry professionals.

Insider Risk Management Program Evaluation & Optimization Training Course (Laurel, Maryland, USA, Oct 2 - 3, 2024) This highly sought after and very comprehensive training course, will ensure that the Insider RIsk Program Manager / Insider Threat Program (ITP) Manager and other key stakeholders that support the program, have the Core / Advanced Knowledge, Blueprint, Resources needed for developing, managing or optimizing a program. Students will be provided with an ITP Management Toolkit that provides an abundance of educational resources, templates and checklists for ITP development, management and optimization. Our student satisfaction levels are in the exceptional range. The Insider Threat Defense Group is so confident about our training courses that they come with a money back training guarantee.

SecureWorld Dallas (Plano, Texas, USA, Oct 3, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

SecureWorld Denver (Denver, Colorado, USA, Oct 10, 2024) Join your regional cybersecurity community for high-quality, affordable training and collaboration. Earn 6-12 CPE credits through 15+ educational sessions learning from local and nationally recognized industry leaders. Attend featured keynotes, panel discussions, breakout sessions, and solution vendor displays—all while networking with peers in InfoSec.

Sponsor & Support

Grow your brand, generate leads, and fill your funnel.

With the industry’s largest B2B podcast network, popular newsletters, and influential readers and listeners all over the world, companies trust the CyberWire to get the message out. Learn more.

Daily Briefing for 09.30.24