Turbines, Simens, Vulnerabilities, Power

New release by Kaspersky team leaded by SCADA StrangeLove fellow Gleb Gritsai  "On the insecure nature of turbine control systems in power generation" as presented on Chaos Communication Congress 36C3.

Power plants everywhere...

Artificial Intelligence Security Census

In this paper, we present the results of Internet-wide security scans of publicly available AIML systems. We show that many different interfaces of AIML systems are not protected and accessible from the Internet, moreover, most of them don't even have basic security mechanisms. Also, we describe found the known vulnerabilities related to outdated software and insecure configurations. 

Malign Machine Learning Models and bad DICOM

Zeronighs 2019 AISec releases: how to insert malware into TensorFlow and PyTorch models and hack NVIDIA Clara ML pipeline with DICOM image.

AISec on ZeroNights 2019

New AISec releases soon at Zeronights 2019.

Roman Palkin : "Malign Machine Learning Models"
Maria Nedyak : "Hacking Medical Imaging with DICOM"


See you there!

https://zeronights.ru/en/program-en/

Cyber Resilience of Railway Signaling Systems

Recently published information on the cybersecurity assessment of railway computer and communication-based control systems (CBCS) identified several weaknesses and vulnerabilities, which allow threat agents to not only degrade system reliability and bypass safety mechanisms, but to carry out attacks which directly affect the rail traffic safety. Despite these findings, remarkably these systems meet all relevant IT security and functional safety requirements and have the required international, national and industrial certificates.

HITB AISec slides and special release

Slides "AI for Security and Security for AI" talk by Sergey Gordeychik, as presented at HITB CyberWeek 2019, Abu Dhabi.



Machine learning technologies are turning from rocket science into daily engineering life. You no longer have to know the difference between Faster R-CNN and HMM to develop a machine vision system, and even OpenCV has bindings for JavaScript allowing to resolve quite serious tasks all the while remaining in front end. On other hand massive implementation of AI in various areas brings about problems, and security is one of the greatest concerns. In the broader context security is really all about trust.

Do we trust AI? I don’t, personally.

DICOM to passwd. On security of ML pipelines

Machine Learning and Artificial Intelligence Pipelines are very useful tools. They help to concentrate on specific task without digging into implementation details. However, from design and security perspective these things are like Frankenstein.

Here is  an example