Rioks

rioks

Top 100 Places to Learn to Code for Free Online in 2019.

This will be my last entry on the topic for a while. For context, I introduced the idea that folks don’t care about security; they care about outcomes in this post, and then I began exploring ways we, as IT practitioners, can shift the focus to the results and, therefore, contextualize the actions needed as something other than “security for the sake of security.” In this post, I’m continuing with that line of discussion. What can we DO to make our environments more secure, and how can we get our colleagues to understand and want to do it? Focus on Actual Risks and Realistic Outcomes (or: Don’t let “perfect” be the enemy of “good”) When doing your homework to build those aforementioned risk profiles, you need to be open to the possibility that whatever you’re trying to fix doesn’t represent a material risk or isn’t as big of a deal as you initially thought. On the other hand, sometimes the risk really *IS* that bad, yet the company seems unwilling to discuss it. There are two things to keep in mind: Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands:
Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. I won’t lie; this is where the politics and interpersonal element can be its most frustrating – it’s incredibly difficult to go back and reiterate everything you’ve already said, to go through the act of what feels like smoothing ruffled feathers and soothing fragile egos. But like ANY relationship, communication (and its lack) always sits at the point between moving forward and getting caught endlessly in the past. That doesn’t mean you have to be everyone’s punching bag. But just as I suggested at the beginning of this section, you need to be open to the reality that an issue you perceive to be a risk might not be that big of a deal; so to do you need to be open to the possibility that your first attempt to communicate didn’t work that well, and you need to admit that to everyone and try again. “We’re from the government, and we’re here to help.” As I hinted at earlier, NIST is aware of this issue and is attempting to bridge the gap between organizational/leadership goals and objectives and the value that infosec can provide. One of the primary outputs of this effort is the “Integrating Cybersecurity and Enterprise Risk Management” document. One of the authors, Bob Gardner, calls it “making the connection from the adversary to the wiring closet to the board room.” This document (along with other content in the 8286 series) underscores NIST’s understanding that what businesses want from cybersecurity is a contribution to risk management in terms of mitigation, avoidance, transfer, etc. The NIST series extends (and aligns with) an earlier plan, OMB Circular A-123, which directs Federal agencies to develop a formal “risk profile” (sound familiar?) and use it to combat cybersecurity threats. But the assistance and insight doesn’t end there. Sometimes, the answer to “what are we supposed to do about this” is hidden within the very security policies and frameworks companies are bound to comply with. Whether you’re talking about HIPAA, PCI-DSS, SOX, GDPR, or any one of the many other acts, provisions, or guidelines; there are usually goals and achievable objectives described. In this regard, Samuel Svarc points out: “These schemes don’t mandate specific technical steps (e.g., Advanced AV, password manager, etc.) but rather broad categories of requirements (“company will create reasonable password policies,” “company will take reasonable measures to secure computers from common threats,” etc.) that are open to interpretation… ” and yet provide a reasonably clear path forward. Furthermore, Svarc says, “…if a company can show that they conducted a real risk assessment which was then substantially followed, they will be treated differently than a company that didn’t. A company that has a current firewall, Advanced AV on workstations, ZTNA for remote workers, Bitlocker on all laptops, password managers, and FIDO keys with 2FA, normal logging monitored by competent SOC, is in a totally different place security-wise than a company that has laptops running around unencrypted, or without 2FA turned on (to mention two low hanging security steps).” Security by any other name A long-running discussion I’ve had with Kymberlee Price revolves around the definition of security and why we are (or should be) concerned about it at an organizational level. Security continues to be presented as a technology in its own right when, in fact, it’s truly about improving quality. “Quality code,” Price states with the authority of someone who’s spent over 25 years working in the security space, “is reliable. Quality code is secure.” She’s championed for a while, and it’s gaining traction in the industry at large. Tell a developer their code has a security issue, and you will not likely get more than a passing glance. After all, “shift left” was recognized as corporate double-speak for “one programmer does the work of two people for the same pay,” shortly after Larry Smith coined the term in 2001. Using it to mean developers should test their own code for security only increases the resistance. However, tell a developer their code has a quality issue, and you’ll have their full attention. “Security is actually quality by a different name” is more than a marketing spin; it’s a message meant for more than the coding crowd. If a business’ processes, policies, or products have overlooked or under-emphasized security, it’s highly likely that other aspects got short shrift as well. And that speaks to low quality. Conversely, if security has been fully considered, it’s far more likely the other aspects have also been reviewed and confirmed – if for no other reason than the fact that the job of security teams is to ensure those elements have been reviewed in the first place. What I’m getting at is that security is one of the fundamental aspects of any business, tightly bound to everything from design to delivery. Pretending otherwise and treating security as some completely separate discipline that’s divorced from poor outcomes in success, velocity, and even profitability is how we ended up in the current situation in the first place. Summary It’s difficult, if not impossible, to argue that backups aren’t important for the simple reason that the value they provide (i.e., the ability to restore data) is intuitively obvious to every level of the business, from executives on down. Security has failed to enjoy organizational support simply because the methods of creating a secure environment are much more complex, the types of threats are much more varied, and the surety of the outcomes is much less assured. In my opinion, this is due to the fact that the focus of so much of the infosec narrative has been on the technology and its delivery. This is equivalent to the backup operators making their case by describing the differences in DAT tapes vs. optical vs cloud or the benefits of full backups vs. incremental vs differential. Again, nobody cares about that stuff. Instead, infosec practitioners should shift their narrative to emphasize the business benefits of quality, resilience, and increased value. Put succinctly: Nobody cares about security, but they sure as hell care about increasing revenue, reducing cost, and removing risk. Your job is to champion the truth that, in order to have those things (revenue, etc), the business needs to invest in security across the organization. This will be my last entry on the topic for a while. For context, I introduced the idea that folks don’t care about security; they care about outcomes in this post , and then I began exploring ways we, as IT practitioners, can shift the focus to the results and, therefore, contextualize the actions needed as something other than “security for the sake of security.” In this post, I’m continuing with that line of discussion. What can we DO to make our environments more secure, and how can we get our colleagues to understand and want to do it? in this post then I began exploring ways Focus on Actual Risks and Realistic Outcomes (or: Don’t let “perfect” be the enemy of “good”) (or: Don’t let “perfect” be the enemy of “good”) When doing your homework to build those aforementioned risk profiles, you need to be open to the possibility that whatever you’re trying to fix doesn’t represent a material risk or isn’t as big of a deal as you initially thought. On the other hand, sometimes the risk really *IS* that bad, yet the company seems unwilling to discuss it. There are two things to keep in mind: Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands: Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. Remember that “accept” is one of the options for risk management. The trick is getting someone to sign off on that acceptance formally. Implicit acceptance is the worst kind of risk acceptance and is usually a sign of a communication breakdown. If the best you can get is a verbal “It’ll be fine; you worry too much!” then you might have a much more considerable risk on your hands: Second, consider that the organization didn’t really hear (or internalize) what you’ve been saying. They’re refusing to listen now because they haven’t been part of the journey up to this point. Your next step isn’t to throw your hands up but rather to retrace your steps and discover where the disconnect happened. I won’t lie; this is where the politics and interpersonal element can be its most frustrating – it’s incredibly difficult to go back and reiterate everything you’ve already said, to go through the act of what feels like smoothing ruffled feathers and soothing fragile egos. But like ANY relationship, communication (and its lack) always sits at the point between moving forward and getting caught endlessly in the past. That doesn’t mean you have to be everyone’s punching bag. But just as I suggested at the beginning of this section, you need to be open to the reality that an issue you perceive to be a risk might not be that big of a deal; so to do you need to be open to the possibility that your first attempt to communicate didn’t work that well, and you need to admit that to everyone and try again. “We’re from the government, and we’re here to help.” As I hinted at earlier, NIST is aware of this issue and is attempting to bridge the gap between organizational/leadership goals and objectives and the value that infosec can provide. One of the primary outputs of this effort is the “ Integrating Cybersecurity and Enterprise Risk Management ” document. Integrating Cybersecurity and Enterprise Risk Management One of the authors, Bob Gardner, calls it “making the connection from the adversary to the wiring closet to the board room.” This document (along with other content in the 8286 series ) underscores NIST’s understanding that what businesses want from cybersecurity is a contribution to risk management in terms of mitigation, avoidance, transfer, etc. other content in the 8286 series The NIST series extends (and aligns with) an earlier plan, OMB Circular A-123 , which directs Federal agencies to develop a formal “risk profile” (sound familiar?) and use it to combat cybersecurity threats. OMB Circular A-123 But the assistance and insight doesn’t end there. Sometimes, the answer to “what are we supposed to do about this” is hidden within the very security policies and frameworks companies are bound to comply with. Whether you’re talking about HIPAA , PCI-DSS , SOX , GDPR , or any one of the many other acts, provisions, or guidelines; there are usually goals and achievable objectives described. security policies and frameworks HIPAA PCI-DSS SOX GDPR In this regard, Samuel Svarc points out: “These schemes don’t mandate specific technical steps (e.g., Advanced AV, password manager, etc.) but rather broad categories of requirements (“company will create reasonable password policies,” “company will take reasonable measures to secure computers from common threats,” etc.) that are open to interpretation… ” and yet provide a reasonably clear path forward. Furthermore, Svarc says, “…if a company can show that they conducted a real risk assessment which was then substantially followed, they will be treated differently than a company that didn’t. A company that has a current firewall, Advanced AV on workstations, ZTNA for remote workers, Bitlocker on all laptops, password managers, and FIDO keys with 2FA, normal logging monitored by competent SOC, is in a totally different place security-wise than a company that has laptops running around unencrypted, or without 2FA turned on (to mention two low hanging security steps).” Security by any other name A long-running discussion I’ve had with Kymberlee Price revolves around the definition of security and why we are (or should be) concerned about it at an organizational level. Security continues to be presented as a technology in its own right when, in fact, it’s truly about improving quality. “Quality code,” Price states with the authority of someone who’s spent over 25 years working in the security space, “is reliable. Quality code is secure.” She’s championed for a while, and it’s gaining traction in the industry at large. Kymberlee Price gaining traction Tell a developer their code has a security issue, and you will not likely get more than a passing glance. After all, “shift left” was recognized as corporate double-speak for “one programmer does the work of two people for the same pay,” shortly after Larry Smith coined the term in 2001. Using it to mean developers should test their own code for security only increases the resistance. Larry Smith coined the term However, tell a developer their code has a quality issue, and you’ll have their full attention. “Security is actually quality by a different name” is more than a marketing spin; it’s a message meant for more than the coding crowd. If a business’ processes, policies, or products have overlooked or under-emphasized security, it’s highly likely that other aspects got short shrift as well. And that speaks to low quality. Conversely, if security has been fully considered, it’s far more likely the other aspects have also been reviewed and confirmed – if for no other reason than the fact that the job of security teams is to ensure those elements have been reviewed in the first place. What I’m getting at is that security is one of the fundamental aspects of any business, tightly bound to everything from design to delivery. Pretending otherwise and treating security as some completely separate discipline that’s divorced from poor outcomes in success, velocity, and even profitability is how we ended up in the current situation in the first place. Summary It’s difficult, if not impossible, to argue that backups aren’t important for the simple reason that the value they provide (i.e., the ability to restore data) is intuitively obvious to every level of the business, from executives on down. Security has failed to enjoy organizational support simply because the methods of creating a secure environment are much more complex, the types of threats are much more varied, and the surety of the outcomes is much less assured. In my opinion, this is due to the fact that the focus of so much of the infosec narrative has been on the technology and its delivery. This is equivalent to the backup operators making their case by describing the differences in DAT tapes vs. optical vs cloud or the benefits of full backups vs. incremental vs differential. Again, nobody cares about that stuff. Instead, infosec practitioners should shift their narrative to emphasize the business benefits of quality, resilience, and increased value. Put succinctly: Nobody cares about security, but they sure as hell care about increasing revenue, reducing cost, and removing risk. Your job is to champion the truth that, in order to have those things (revenue, etc), the business needs to invest in security across the organization.

ACTING (like we care about) Securityms: Focusing on Risks, Outcomes, and Business Value

Storing passwords in your browser might seem convenient, but it comes with significant security risks. While browsers offer built-in password management features, they are not foolproof and can expose your sensitive information to various threats. Cybercriminals can exploit browser vulnerabilities, malware, or unauthorized access to your device, potentially leading to identity theft, financial loss, and privacy breaches. Understanding these risks is crucial for making informed decisions about how you manage and protect your passwords. Risks of Storing Passwords in Browsers When a browser saves your password, the data is typically left unencrypted. This would expose your passwords in plain text to anyone who has access to them by way of gaining physical or software-based (browser) keylogging capabilities. This presents a significant security risk, especially in the ever-evolving landscape of cybersecurity in 2024. Nowadays, malware is one of the most common threats that can take advantage of stored passwords. Ransomware incidents jumped over 73% between 2022 and the previous year to an all-time high of more than 4,611 reported cases. In 2023, the recovery costs jumped from $1.82M to $2.73M in 2024 (not taking into account any ransom payments). For instance, keyloggers can record your keystrokes, or malicious browser extensions can siphon off your saved passwords without your knowledge. Browsers themselves can have security flaws. These exploitable vulnerabilities can be used by hackers to obtain your saved passwords. Common security issues include outdated software and unpatched security holes. The impact of these vulnerabilities can be severe, compromising your password security and leading to unauthorized access to your accounts. Potential Consequences It makes life easier to store your passwords in the browser but also comes with risks. Of those disciplines, consider how much more your identity can be compromised the financial losses you could face and of course the loss of privacy. Identity Theft & Fraud: Stolen passwords are an immediate gateway to identity theft. This allows hackers to use your credentials to log into your accounts, impersonate you, and even steal your personal information. This may lead to illegal activities such as borrowing loans on your own and creating another account that you did not allow. Having password security is important because if your password gets stolen, you are probably going to lose everything. When unauthorized individuals break into your accounts, the financial loss can be both sudden and deep. Hackers could easily steal from your bank accounts or credit cards and transfer money to themselves without you knowing. Keeping your financial data secure is vital, and storing passwords in your browser for online transactions will increase the possibility of being wrongly stored or hacked. Privacy Loss: The loss of privacy is a big deal beyond just the financial repercussions. Stolen passwords can grant attackers access to your personal accounts, such as emails, social media, and cloud storage. We all know that if they get access to your private messages and photos and spy on you in real life, the effects are extensive, as the breach of one's privacy can leave them more affected emotionally and socially. Alternatives to Storing Passwords in Browsers Password managers are dedicated tools designed to securely store and manage your passwords. These tools use strong encryption to protect your data, ensuring that even if someone gains access to your device, they can’t easily retrieve your stored credentials. Using a password manager also means you don’t have to remember every single password, which reduces the temptation to reuse weak passwords across multiple accounts—a major password security risk. On top of the hefty encryption they give, the best password managers also randomly create passwords that are complicated and all different. This provides an additional security barrier (remember… layers) so that if one account is breached, the rest are not as easy to access. Among the popular password managers are LastPass, 1Password, Bitwarden, etc. These provide an easy way to safely store and simply recall your passwords — access them protected from prying eyes. For example, 2FA (Two Factor Authentication) makes your password more secure while increasing the process of logging in by enabling one extra verification before you log in. Rather than authenticating you solely via a password, 2FA asks for a second proof of identity (like a code sent to your phone/app-based notification). This additional step helps to ensure that if someone gets your password, it will not grant them access without the second factor under their possession. Best Practices for Password Security One of the best steps you can take to keep your password secure is using strong, unique passwords for all online accounts. You should avoid using everyday words or information someone could easily find out about you, like your name or birthdate. Alternatively, use at least a mix of everything: upper and lower case letters, numbers, and special characters. Try to make sure your passwords are at least 12 characters long for it harder to crack. If you struggle to remember multiple complex passwords, consider using one of the best password managers available. With tools like these, you can store strong, unique passwords for every single one of your accounts securely. While good passwords are helpful, make sure to change them once in a while, too. The likelihood of breaches can be reduced by changing your password every 3-6 months, as security experts suggest. Even if a would-be adversary has obtained one of your passwords without you knowing about it, by the time they are able to use that password against other sites. Lastly, monitoring your account activity is essential for catching any suspicious behavior early. Most websites and apps will have tools that let you view your recent logins or flag suspicious activity via notifications so long as they are used regularly. If you monitor your accounts, unauthorized access can be detected and handled immediately. Encouraging Safer Alternatives for Password Management Storing passwords in your browser may seem convenient, but it exposes you to significant security risks. By opting for safer alternatives like password managers and implementing strong security practices, you can better protect your sensitive information and keep your accounts secure. Prioritizing password security is crucial to safeguarding your online presence. Storing passwords in your browser might seem convenient, but it comes with significant security risks. While browsers offer built-in password management features, they are not foolproof and can expose your sensitive information to various threats. Cybercriminals can exploit browser vulnerabilities, malware, or unauthorized access to your device, potentially leading to identity theft, financial loss, and privacy breaches. Understanding these risks is crucial for making informed decisions about how you manage and protect your passwords. Risks of Storing Passwords in Browsers When a browser saves your password, the data is typically left unencrypted. This would expose your passwords in plain text to anyone who has access to them by way of gaining physical or software-based (browser) keylogging capabilities. This presents a significant security risk, especially in the ever-evolving landscape of cybersecurity in 2024. cybersecurity in 2024. cybersecurity in 2024. Nowadays, malware is one of the most common threats that can take advantage of stored passwords. Ransomware incidents jumped over 73% between 2022 and the previous year to an all-time high of more than 4,611 reported cases. 73% between 2022 73% between 2022 In 2023, the recovery costs jumped from $1.82M to $2.73M in 2024 (not taking into account any ransom payments). For instance, keyloggers can record your keystrokes, or malicious browser extensions can siphon off your saved passwords without your knowledge. $1.82M to $2.73M in 2024 $1.82M to $2.73M in 2024 keyloggers can record your keystrokes, or malicious browser extensions keyloggers can record your keystrokes, or malicious browser extensions Browsers themselves can have security flaws. These exploitable vulnerabilities can be used by hackers to obtain your saved passwords. Common security issues include outdated software and unpatched security holes. The impact of these vulnerabilities can be severe, compromising your password security and leading to unauthorized access to your accounts. Potential Consequences It makes life easier to store your passwords in the browser but also comes with risks. Of those disciplines, consider how much more your identity can be compromised the financial losses you could face and of course the loss of privacy. Identity Theft & Fraud: Stolen passwords are an immediate gateway to identity theft. This allows hackers to use your credentials to log into your accounts, impersonate you, and even steal your personal information. This may lead to illegal activities such as borrowing loans on your own and creating another account that you did not allow. Having password security is important because if your password gets stolen, you are probably going to lose everything. When unauthorized individuals break into your accounts, the financial loss can be both sudden and deep. Hackers could easily steal from your bank accounts or credit cards and transfer money to themselves without you knowing. Keeping your financial data secure is vital, and storing passwords in your browser for online transactions will increase the possibility of being wrongly stored or hacked. Privacy Loss: The loss of privacy is a big deal beyond just the financial repercussions. Stolen passwords can grant attackers access to your personal accounts, such as emails, social media, and cloud storage. We all know that if they get access to your private messages and photos and spy on you in real life, the effects are extensive, as the breach of one's privacy can leave them more affected emotionally and socially. Alternatives to Storing Passwords in Browsers Password managers are dedicated tools designed to securely store and manage your passwords. These tools use strong encryption to protect your data, ensuring that even if someone gains access to your device, they can’t easily retrieve your stored credentials. Using a password manager also means you don’t have to remember every single password, which reduces the temptation to reuse weak passwords across multiple accounts—a major password security risk. On top of the hefty encryption they give, the best password managers also randomly create passwords that are complicated and all different. This provides an additional security barrier (remember… layers) so that if one account is breached, the rest are not as easy to access. Among the popular password managers are LastPass, 1Password, Bitwarden, etc. These provide an easy way to safely store and simply recall your passwords — access them protected from prying eyes. best password managers best password managers For example, 2FA (Two Factor Authentication) makes your password more secure while increasing the process of logging in by enabling one extra verification before you log in. Rather than authenticating you solely via a password, 2FA asks for a second proof of identity (like a code sent to your phone/app-based notification). This additional step helps to ensure that if someone gets your password, it will not grant them access without the second factor under their possession. Best Practices for Password Security One of the best steps you can take to keep your password secure is using strong, unique passwords for all online accounts. You should avoid using everyday words or information someone could easily find out about you, like your name or birthdate. Alternatively, use at least a mix of everything: upper and lower case letters, numbers, and special characters. Try to make sure your passwords are at least 12 characters long for it harder to crack. If you struggle to remember multiple complex passwords, consider using one of the best password managers available. With tools like these, you can store strong, unique passwords for every single one of your accounts securely. While good passwords are helpful, make sure to change them once in a while, too. The likelihood of breaches can be reduced by changing your password every 3-6 months, as security experts suggest. Even if a would-be adversary has obtained one of your passwords without you knowing about it, by the time they are able to use that password against other sites. Lastly, monitoring your account activity is essential for catching any suspicious behavior early. Most websites and apps will have tools that let you view your recent logins or flag suspicious activity via notifications so long as they are used regularly. If you monitor your accounts, unauthorized access can be detected and handled immediately. Encouraging Safer Alternatives for Password Management Storing passwords in your browser may seem convenient, but it exposes you to significant security risks. By opting for safer alternatives like password managers and implementing strong security practices, you can better protect your sensitive information and keep your accounts secure. Prioritizing password security is crucial to safeguarding your online presence.

Why You Shouldn't Store Passwords in Your Browser: Password Security Risks

While securing a non-fungible token (NFT) might sound like a good idea, doing so comes with cybersecurity risks for buyers. Anyone getting into this alternative investment type should understand the cyberthreats they’re up against. 1. Reentrancy Attack A reentrancy attack exploits a vulnerability to force smart contracts into infinite loops. Since these self-executing agreements execute imperatively — meaning each line of code must finish executing before moving on to the next one — they effectively unquestioningly hand over control when making external calls. If the called contract is malicious, it can make recursive callbacks. Since the caller must pause its code execution until its call returns, it’s forced to execute the original line of code repeatedly without updating its balance. Bad actors can exploit this function to steal NFTs within moments, potentially allowing their attack to go unnoticed initially. 2. Technical Support Scam Since NFTs are unregulated and decentralized, owners must rely on others in the community for help. Many who experience technical issues they can’t figure out go to Discord, Reddit, or Telegram for assistance. Unfortunately, some individuals on those platforms are there for the wrong reasons. They take advantage of people’s trust and lack of knowledge to steal their assets. 3. Marketplace Hack Centralized platforms can be hacked like any other third-party marketplace, making them significant cybersecurity risks for NFT buyers. Although up to 95% of today’s NFTs are worthless, the ones that have retained their value are worth a lot — meaning those looking to buy one will inevitably become targets for bad actors. Marketplace hacks have happened before and will likely happen again. For instance, a hacker stole thousands of dollars in NFTs from Nifty Gateway in 2021. Even popular sites like OpenSea have admitted to experiencing security breaches. People interested in owning NFTs must understand the risks of operating on such platforms. 4. Denial of Service A denial of service attack is among the most significant cybersecurity risks for NFT buyers. It involves an attacker using recursive callbacks to block smart contracts from returning to the state they were in before the transaction began to execute. This results in unlimited resource usage and permanently blocks the function. 5. Rug-Pull Scam In a rug-pull scam, a bad actor convinces others they’ll get a great return on investment if they buy into a certain stock, cryptocurrency, or NFT project. Once they get enough people to fund their idea, they disappear. This type of con has happened multiple times in this community because it’s unregulated. In 2022, Ethan Nguyen and Andre Llacuna created Frosties, an ice-cream-themed NFT collection. Reportedly, they made roughly $1.1 million after their 8,888 items sold within one hour of their public launch. Shortly afterward, they transferred their funds into various digital wallets and disappeared. Although the two men were later arrested for fraud and money laundering, the people who had bought into Frosties were still out their hard-earned money — and their NFTs were virtually worthless. Rug-pull scams are common, even if most aren’t as lucrative. If an investment sounds too good to be true, it probably is. 6. Oracle Manipulation When smart contracts access or receive data from an outside source via an oracle — a third-party service that connects the blockchain to external systems — they become vulnerable to hacks. An attacker can forcibly trigger transactions to steal an NFT before the owner realizes something is wrong. 7. Counterfeit NFTs Scammers can easily plagiarize or steal artwork. Their item’s URL and wallet address won’t align with the original, but it may still be convincing enough. People who think they’ll never fall for such a thing are mistaken — even the most widely used platforms are full of fakes. In 2022, OpenSea announced over 80% of the NFTs created with its free toolset were counterfeits. 8. Phishing Attack In a two-part phishing attack, an attacker takes over a social media account by tricking a well-known figure in the industry to click on a malicious link or attachment. When they gain control, they post about a limited-time deal or a live drop alongside a second malicious link. A large percentage of followers will likely believe it’s legitimate. As soon as they click on the link, the attacker can view their credit card information as they type it in, take over their social media account, or empty every NFT from their digital wallet. In the worst-case scenario, all three possibilities occur — meaning no one can comment on the post warning others that it’s a phishing attack. 9. Fraudulent Marketplace Fraudulent marketplaces are either fake and made to look real or are convincing copies of legitimate platforms. Since there are zero regulations for NFT buyers or sellers, anyone with enough technical knowledge can set one up. They’re usually designed to inject malware into unsuspecting devices or trick visitors into giving up their credentials. 10. Pump-and-Dump Scam A pump-and-dump scam is one of the biggest cybersecurity risks for NFT buyers. It involves a bad actor artificially inflating their collection’s value. They make it look like a great investment, prompting real people to buy into it. From there, the value increases exponentially — but only temporarily. Once it peaks, they suddenly sell everything, rendering the rest valueless. 11. Digital Wallet Vulnerabilities Since NFT digital wallets are supposed to store assets, any vulnerabilities can put an owner’s entire collection at risk. Unfortunately, they’re not as secure as many people think. For instance, web-based versions connected to the internet are vulnerable to man-in-the-middle attacks. Those on mobile devices can also be hacked. Whether a digital wallet stores tokens or holds a private key that gives the owner access to their items on the blockchain, it serves as their last line of defense. Unless they keep their app updated, stay off public Wi-Fi, and keep their device in their possession, hackers can exploit vulnerabilities and steal their collection. NFT Buyers Must Remain Vigilant for Cyberthreats There are tons of cybersecurity risks for NFT buyers — especially those who are new to the community and don’t know the common cyberthreats. They must remain vigilant and wary of anything they’ve never encountered to protect their digital wallet and personal data. While securing a non-fungible token (NFT) might sound like a good idea, doing so comes with cybersecurity risks for buyers. Anyone getting into this alternative investment type should understand the cyberthreats they’re up against. While securing a non-fungible token (NFT) might sound like a good idea, doing so comes with cybersecurity risks for buyers. Anyone getting into this alternative investment type should understand the cyberthreats they’re up against. 1. Reentrancy Attack 1. Reentrancy Attack A reentrancy attack exploits a vulnerability to force smart contracts into infinite loops. Since these self-executing agreements execute imperatively — meaning each line of code must finish executing before moving on to the next one — they effectively unquestioningly hand over control when making external calls. each line of code must finish executing each line of code must finish executing If the called contract is malicious, it can make recursive callbacks. Since the caller must pause its code execution until its call returns, it’s forced to execute the original line of code repeatedly without updating its balance. Bad actors can exploit this function to steal NFTs within moments, potentially allowing their attack to go unnoticed initially. 2. Technical Support Scam Since NFTs are unregulated and decentralized, owners must rely on others in the community for help. Many who experience technical issues they can’t figure out go to Discord, Reddit, or Telegram for assistance. Unfortunately, some individuals on those platforms are there for the wrong reasons. They take advantage of people’s trust and lack of knowledge to steal their assets. 3. Marketplace Hack Centralized platforms can be hacked like any other third-party marketplace, making them significant cybersecurity risks for NFT buyers. Although up to 95% of today’s NFTs are worthless, the ones that have retained their value are worth a lot — meaning those looking to buy one will inevitably become targets for bad actors. up to 95% of today’s NFTs up to 95% of today’s NFTs Marketplace hacks have happened before and will likely happen again. For instance, a hacker stole thousands of dollars in NFTs from Nifty Gateway in 2021. Even popular sites like OpenSea have admitted to experiencing security breaches. People interested in owning NFTs must understand the risks of operating on such platforms. stole thousands of dollars in NFTs stole thousands of dollars in NFTs 4. Denial of Service A denial of service attack is among the most significant cybersecurity risks for NFT buyers. It involves an attacker using recursive callbacks to block smart contracts from returning to the state they were in before the transaction began to execute. This results in unlimited resource usage and permanently blocks the function. 5. Rug-Pull Scam In a rug-pull scam, a bad actor convinces others they’ll get a great return on investment if they buy into a certain stock, cryptocurrency, or NFT project. Once they get enough people to fund their idea, they disappear. This type of con has happened multiple times in this community because it’s unregulated. In 2022, Ethan Nguyen and Andre Llacuna created Frosties, an ice-cream-themed NFT collection. Reportedly, they made roughly $1.1 million after their 8,888 items sold within one hour of their public launch. Shortly afterward, they transferred their funds into various digital wallets and disappeared. made roughly $1.1 million made roughly $1.1 million Although the two men were later arrested for fraud and money laundering, the people who had bought into Frosties were still out their hard-earned money — and their NFTs were virtually worthless. Rug-pull scams are common, even if most aren’t as lucrative. If an investment sounds too good to be true, it probably is. 6. Oracle Manipulation When smart contracts access or receive data from an outside source via an oracle — a third-party service that connects the blockchain to external systems — they become vulnerable to hacks. An attacker can forcibly trigger transactions to steal an NFT before the owner realizes something is wrong. 7. Counterfeit NFTs Scammers can easily plagiarize or steal artwork. Their item’s URL and wallet address won’t align with the original, but it may still be convincing enough. People who think they’ll never fall for such a thing are mistaken — even the most widely used platforms are full of fakes. In 2022, OpenSea announced over 80% of the NFTs created with its free toolset were counterfeits. over 80% of the NFTs over 80% of the NFTs 8. Phishing Attack In a two-part phishing attack, an attacker takes over a social media account by tricking a well-known figure in the industry to click on a malicious link or attachment. When they gain control, they post about a limited-time deal or a live drop alongside a second malicious link. A large percentage of followers will likely believe it’s legitimate. As soon as they click on the link, the attacker can view their credit card information as they type it in, take over their social media account, or empty every NFT from their digital wallet. In the worst-case scenario, all three possibilities occur — meaning no one can comment on the post warning others that it’s a phishing attack. 9. Fraudulent Marketplace Fraudulent marketplaces are either fake and made to look real or are convincing copies of legitimate platforms. Since there are zero regulations for NFT buyers or sellers, anyone with enough technical knowledge can set one up. They’re usually designed to inject malware into unsuspecting devices or trick visitors into giving up their credentials. there are zero regulations there are zero regulations 10. Pump-and-Dump Scam A pump-and-dump scam is one of the biggest cybersecurity risks for NFT buyers. It involves a bad actor artificially inflating their collection’s value. They make it look like a great investment, prompting real people to buy into it. From there, the value increases exponentially — but only temporarily. Once it peaks, they suddenly sell everything, rendering the rest valueless. 11. Digital Wallet Vulnerabilities Since NFT digital wallets are supposed to store assets, any vulnerabilities can put an owner’s entire collection at risk. Unfortunately, they’re not as secure as many people think. For instance, web-based versions connected to the internet are vulnerable to man-in-the-middle attacks. Those on mobile devices can also be hacked. Whether a digital wallet stores tokens or holds a private key that gives the owner access to their items on the blockchain, it serves as their last line of defense. Unless they keep their app updated, stay off public Wi-Fi, and keep their device in their possession, hackers can exploit vulnerabilities and steal their collection. NFT Buyers Must Remain Vigilant for Cyberthreats There are tons of cybersecurity risks for NFT buyers — especially those who are new to the community and don’t know the common cyberthreats. They must remain vigilant and wary of anything they’ve never encountered to protect their digital wallet and personal data.

11 Cybersecurity Risks for NFT Buyers

AI and the Future of Cybersecurity: Can We Keep Up with the Risks?

In this digital day and age, streaming is the go-to method for consuming entertainment. Devices like Amazon Fire TV Sticks have revolutionized how we watch TV shows, movies, and live sports. However, with this convenience comes a dark side: the proliferation of "loaded" or "fully loaded" Fire TV Sticks. The modified FireSticks promise access to premium content without the associated costs, enticing many to take a shortcut. But is it worth it? This article explores the legal and ethical implications of using loaded Fire TV Sticks, the risks involved, and why sticking to legitimate streaming options is the smarter choice. Understanding Loaded Fire TV Sticks A "loaded" or "fully loaded" Fire TV Stick is a device that has been modified, usually by jailbreaking it and installing third-party apps or Kodi add-ons, to stream content without authorization. These devices promise access to premium content for free or at a reduced cost. Legal Implications Jailbreaking vs. Illegal Streaming Jailbreaking: Modifying a Fire TV Stick to remove software restrictions is not illegal in itself. It allows users to install third-party applications that are not available in the Amazon App Store.
Illegal Streaming: Using a jailbroken device to stream copyrighted content without permission is illegal. This constitutes a violation of copyright laws and can lead to severe penalties. Consequences Fines and Imprisonment: In the UK, illegal streaming can result in unlimited fines and up to five years in prison. In the US, penalties for copyright infringement can reach up to $250,000 in fines and five years in prison​​.
Law Enforcement Actions: Authorities have conducted raids and legal actions against individuals and groups involved in the sale and distribution of these devices. In some cases, users themselves have faced legal repercussions. Ethical Considerations Impact on Content Creators Revenue Loss: Using loaded Fire TV Sticks undermines the revenue streams of content creators and the entertainment industry, affecting the production of new content.
Supporting Crime: Proceeds from the sale of these devices often fund organized crime, contributing to further illegal activities​. Risks and Consequences Cybersecurity Threats Malware and Data Theft: Loaded Fire Stick devices can expose users to malware, data theft, and other cybersecurity threats. Unsuspecting users may compromise their personal information and suffer financial losses​.
Lack of Parental Controls: Loaded Fire TV Sticks also lack parental controls, potentially exposing children to inappropriate and explicit content​​. Device Performance Bricking the Device: Improper jailbreaking can lead to technical issues, such as software crashes or system instability. The device might also become more susceptible to security threats.
Loss of Legitimate Services: Users risk losing access to legitimate streaming services due to software updates and technical issues​. How to Identify Illicit Streaming Devices or Loaded Fire TV Sticks These devices are marketed as "fully loaded," "jailbroken," or "plug and play." The mentioned terms indicate the devices have been modified to access unauthorized content, which is illegal.
Another sign of an illicit device is the presence of pre-installed apps or add-ons not available in official app stores. These modifications typically allow access to premium content without a subscription.
If you find an Amazon Fire TV Stick offering free access to paid services like Netflix or Sky Sports, it's likely illegal. Has Anyone Gotten in Trouble Using and Selling Jailbroken Fire Sticks? July 2024 - UK A recent UK crackdown on illegal streaming led to the arrest of three individuals for distributing jailbroken Amazon Fire Sticks, enabling free access to premium content like Sky. Penalties for using these devices include fines of up to £50,000 or 12 months in prison. Authorities identified and investigated 40 illegal IPTV operators, issuing warnings and cease-and-desist notices. June 2024 - UK A man in the UK made over £130,000 selling illegally modified TV Firesticks on Facebook, providing cheap access to channels like Sky Sports and Premier League football. His alias Kevo James attracted 3,600+ members. After the devices were seized from his home, the accused pleaded guilty to copyright and fraud charges, receiving a two-year suspended sentence, 25 days of rehabilitation, and 150 hours of unpaid work. December 2020 - US Upon receiving complaints about jailbroken Amazon Fire TV Sticks, Auburndale, Florida’s detectives investigated and arrested four individuals for selling modified Fire Sticks. The accused individuals sold illegal Fire Sticks to undercover detectives. They were charged with promoting the sale of intercept devices and released on $1,000 bond each. How to Stay Safe Avoiding Illicit Devices Identify Legal Devices: Consumers should be cautious and ensure they purchase devices from reputable sources. Avoid descriptions like “Fully Loaded” or “Jailbroken,” which indicate the device is intended for illegal streaming​.
Reporting Sellers: Report sellers of illegal devices to organizations like Crimestoppers or FACT in the UK. These reports help authorities crack down on illegal streaming operations. Conclusion While the allure of loaded Fire Sticks may seem tempting with their promise of free access to premium streaming platforms, the risks far outweigh the benefits. The legal repercussions, ranging from hefty fines to imprisonment, alongside the ethical implications of depriving content creators of the earnings they deserve, should deter users from opting for these illicit devices. Furthermore, the significant cybersecurity threats and potential device performance issues pose additional concerns. Sticking to legitimate streaming options ensures a safer and more reliable streaming experience and supports the industry that produces the content we love. By making informed and ethical choices, we can enjoy the vast array of entertainment available without compromising our security, legality, or moral responsibility. Always prioritize legal and official sources for streaming to contribute positively to the ecosystem and avoid unnecessary risks. In this digital day and age, streaming is the go-to method for consuming entertainment. Devices like Amazon Fire TV Sticks have revolutionized how we watch TV shows, movies, and live sports. However, with this convenience comes a dark side: the proliferation of "loaded" or "fully loaded" Fire TV Sticks. The modified FireSticks promise access to premium content without the associated costs, enticing many to take a shortcut. But is it worth it? This article explores the legal and ethical implications of using loaded Fire TV Sticks, the risks involved, and why sticking to legitimate streaming options is the smarter choice. Understanding Loaded Fire TV Sticks A "loaded" or "fully loaded" Fire TV Stick is a device that has been modified, usually by jailbreaking it and installing third-party apps or Kodi add-ons, to stream content without authorization. These devices promise access to premium content for free or at a reduced cost. Legal Implications Legal Implications Jailbreaking vs. Illegal Streaming Jailbreaking vs. Illegal Streaming Jailbreaking: Modifying a Fire TV Stick to remove software restrictions is not illegal in itself. It allows users to install third-party applications that are not available in the Amazon App Store. Illegal Streaming: Using a jailbroken device to stream copyrighted content without permission is illegal. This constitutes a violation of copyright laws and can lead to severe penalties. Jailbreaking: Modifying a Fire TV Stick to remove software restrictions is not illegal in itself. It allows users to install third-party applications that are not available in the Amazon App Store. Illegal Streaming: Using a jailbroken device to stream copyrighted content without permission is illegal. This constitutes a violation of copyright laws and can lead to severe penalties. Consequences Consequences Fines and Imprisonment: In the UK, illegal streaming can result in unlimited fines and up to five years in prison. In the US, penalties for copyright infringement can reach up to $250,000 in fines and five years in prison​​. Law Enforcement Actions: Authorities have conducted raids and legal actions against individuals and groups involved in the sale and distribution of these devices. In some cases, users themselves have faced legal repercussions. Fines and Imprisonment: In the UK, illegal streaming can result in unlimited fines and up to five years in prison. In the US, penalties for copyright infringement can reach up to $250,000 in fines and five years in prison​​. penalties for copyright infringement penalties for copyright infringement Law Enforcement Actions: Authorities have conducted raids and legal actions against individuals and groups involved in the sale and distribution of these devices. In some cases, users themselves have faced legal repercussions. Ethical Considerations Impact on Content Creators Impact on Content Creators Revenue Loss: Using loaded Fire TV Sticks undermines the revenue streams of content creators and the entertainment industry, affecting the production of new content. Supporting Crime: Proceeds from the sale of these devices often fund organized crime, contributing to further illegal activities​. Revenue Loss: Using loaded Fire TV Sticks undermines the revenue streams of content creators and the entertainment industry, affecting the production of new content. Supporting Crime: Proceeds from the sale of these devices often fund organized crime , contributing to further illegal activities​. fund organized crime fund organized crime Risks and Consequences Risks and Consequences Cybersecurity Threats Cybersecurity Threats Malware and Data Theft: Loaded Fire Stick devices can expose users to malware, data theft, and other cybersecurity threats. Unsuspecting users may compromise their personal information and suffer financial losses​. Lack of Parental Controls: Loaded Fire TV Sticks also lack parental controls, potentially exposing children to inappropriate and explicit content​​. Malware and Data Theft: Loaded Fire Stick devices can expose users to malware, data theft, and other cybersecurity threats. Unsuspecting users may compromise their personal information and suffer financial losses​. Lack of Parental Controls: Loaded Fire TV Sticks also lack parental controls, potentially exposing children to inappropriate and explicit content​​. Device Performance Bricking the Device: Improper jailbreaking can lead to technical issues, such as software crashes or system instability. The device might also become more susceptible to security threats. Loss of Legitimate Services: Users risk losing access to legitimate streaming services due to software updates and technical issues​. Bricking the Device: Improper jailbreaking can lead to technical issues, such as software crashes or system instability. The device might also become more susceptible to security threats. Loss of Legitimate Services: Users risk losing access to legitimate streaming services due to software updates and technical issues​. How to Identify Illicit Streaming Devices or Loaded Fire TV Sticks These devices are marketed as "fully loaded," "jailbroken," or "plug and play." The mentioned terms indicate the devices have been modified to access unauthorized content, which is illegal. Another sign of an illicit device is the presence of pre-installed apps or add-ons not available in official app stores. These modifications typically allow access to premium content without a subscription. If you find an Amazon Fire TV Stick offering free access to paid services like Netflix or Sky Sports, it's likely illegal. These devices are marketed as "fully loaded," "jailbroken," or "plug and play." The mentioned terms indicate the devices have been modified to access unauthorized content, which is illegal. Another sign of an illicit device is the presence of pre-installed apps or add-ons not available in official app stores. These modifications typically allow access to premium content without a subscription. If you find an Amazon Fire TV Stick offering free access to paid services like Netflix or Sky Sports, it's likely illegal. Has Anyone Gotten in Trouble Using and Selling Jailbroken Fire Sticks? July 2024 - UK July 2024 - UK A recent UK crackdown on illegal streaming led to the arrest of three individuals for distributing jailbroken Amazon Fire Sticks, enabling free access to premium content like Sky. Penalties for using these devices include fines of up to £50,000 or 12 months in prison. recent UK crackdown recent UK crackdown Authorities identified and investigated 40 illegal IPTV operators, issuing warnings and cease-and-desist notices. June 2024 - UK June 2024 - UK A man in the UK made over £130,000 selling illegally modified TV Firesticks on Facebook, providing cheap access to channels like Sky Sports and Premier League football. His alias Kevo James attracted 3,600+ members. selling illegally modified TV Firesticks selling illegally modified TV Firesticks After the devices were seized from his home, the accused pleaded guilty to copyright and fraud charges, receiving a two-year suspended sentence, 25 days of rehabilitation, and 150 hours of unpaid work. December 2020 - US December 2020 - US Upon receiving complaints about jailbroken Amazon Fire TV Sticks, Auburndale, Florida’s detectives investigated and arrested four individuals for selling modified Fire Sticks. The accused individuals sold illegal Fire Sticks to undercover detectives. arrested four individuals arrested four individuals They were charged with promoting the sale of intercept devices and released on $1,000 bond each. How to Stay Safe Avoiding Illicit Devices Identify Legal Devices: Consumers should be cautious and ensure they purchase devices from reputable sources. Avoid descriptions like “Fully Loaded” or “Jailbroken,” which indicate the device is intended for illegal streaming​. Reporting Sellers: Report sellers of illegal devices to organizations like Crimestoppers or FACT in the UK. These reports help authorities crack down on illegal streaming operations. Identify Legal Devices: Consumers should be cautious and ensure they purchase devices from reputable sources. Avoid descriptions like “Fully Loaded” or “Jailbroken,” which indicate the device is intended for illegal streaming​. Reporting Sellers: Report sellers of illegal devices to organizations like Crimestoppers or FACT in the UK. These reports help authorities crack down on illegal streaming operations. Conclusion While the allure of loaded Fire Sticks may seem tempting with their promise of free access to premium streaming platforms, the risks far outweigh the benefits. The legal repercussions, ranging from hefty fines to imprisonment, alongside the ethical implications of depriving content creators of the earnings they deserve, should deter users from opting for these illicit devices. Furthermore, the significant cybersecurity threats and potential device performance issues pose additional concerns. Sticking to legitimate streaming options ensures a safer and more reliable streaming experience and supports the industry that produces the content we love. By making informed and ethical choices, we can enjoy the vast array of entertainment available without compromising our security, legality, or moral responsibility. Always prioritize legal and official sources for streaming to contribute positively to the ecosystem and avoid unnecessary risks.

Using Loaded Fire TV Sticks: What are the Risks, Ethics & Legalities

The timely “No, Hashing Still Doesn’t Make Your Data Anonymous” post from the FTC is a great reminder that, especially with the rise of large language models (LLMs) and generative AI, how those models are trained and fine-tuned creates opportunities for massive data leakage. Synthetic data is often considered the convenient solution to the data privacy challenges associated with LLM training and fine-tuning. However, synthetic data is not equivalent to anonymous or de-identified data. The Appeal and Enthusiasm for Synthetic Data Synthetic data fills gaps where real data is hard to obtain. It’s great for simulating rare events or generating large datasets for many machine-learning models. Advances in AI-generated tools have enhanced synthetic data’s capabilities, making it more versatile and powerful. Synthetic data accelerates innovation by enabling rapid development and testing of new algorithms and technologies. It provides a sandbox for experimentation without the constraints of real-world data limitations. As TDS Editors mention, “Using synthetic data isn’t exactly a new practice: it’s been a productive approach for several years now.” Generative AI and Privacy Risks Despite the enthusiasm, it’s critical to recognize that synthetic data is not inherently anonymous. Generative AI and LLMs have unique privacy risks. Synthetic data can still reflect patterns from real data, leading to potential re-identification risks. From a data loss prevention and data privacy point of view, there are several additional risks unique to LLMs: Membership and Property Leakage from Pre-Training Data: LLMs can inadvertently memorize sensitive information during their training on vast datasets. Model Features Leakage from Trained LLM: Features learned during training can leak sensitive information when the model is queried. Privacy Leakage from Conversations (History) with LLMs: Data from user interactions can be stored and potentially exposed. Compliance with Privacy Intent of Users: Ensuring that the data used and generated by LLMs complies with user consent and privacy expectations. Enterprise data leakage becomes more relevant when leveraging LLMs in settings such as Retrieval-Augmented Generation (RAG) or fine-tuning LLMs with enterprise data to create domain-specific models. To prevent leaks, the privacy of enterprise (training) data must be safeguarded. Synthetic Data: Appealing Yet Not Automatically Anonymous Synthetic data addresses many issues related to privacy and enterprise data leakage. However, as previously stated, synthetic data is not automatically anonymous. Evaluating the quality of synthetic data and avoiding the pitfalls highlighted in studies such as “On the Inadequacy of Similarity-based Privacy Metrics: Reconstruction Attacks against ‘Truly Anonymous Synthetic Data’” is crucial. It’s much better to rely on a mathematical definition of privacy guarantees like differential privacy. Differential privacy provides robust guarantees by ensuring that the inclusion or exclusion of a single data point does not significantly affect the outcome, thereby protecting individual privacy. Evaluating Synthetic Data Quality To ensure synthetic data is effective and safe, evaluate its quality rigorously. Fidelity: Measures how well synthetic data reflects the statistical properties of real data. High fidelity means the synthetic data maintains the patterns and distributions of the original dataset. “If our model can produce synthetic data that can be considered to be a random sample from the same parent distribution, then we’ve hit the jackpot.” Utility: Determines whether synthetic data can be used effectively for its intended purpose. High-utility synthetic data should yield similar results to real data in machine learning models or statistical analyses. “The synthetic data should be just as useful when put to tasks such as regression or classification.” Privacy: Ensures that synthetic data does not allow for re-identification of individuals. The Maximum Similarity Test compares the similarities within and between datasets to detect privacy breaches. Skabar highlights that “the biggest danger with synthetic data points being too close to observed points is privacy; i.e., being able to identify points in the observed set from points in the synthetic set.” Practical Techniques Maximum Similarity Test: This test involves calculating the similarity between instances in synthetic and real datasets and comparing these similarities. Similar distributions indicate high fidelity and utility without compromising privacy. Train on Synthetic, Test on Real (TSTR): Train a machine learning model on synthetic data and test it on real data. High performance in this test shows that the synthetic data maintains utility and accurately represents real data. Gower Similarity: For mixed-type datasets, Gower Similarity measures the distance between data points, providing a comprehensive similarity measure that accommodates various data types. The FTC article about the ineffectiveness of hashing as privacy protection is a good reminder that robust privacy-preserving techniques and thorough quality evaluations are key to ensuring synthetic datasets are safe and functional. The timely “No, Hashing Still Doesn’t Make Your Data Anonymous” post from the FTC is a great reminder that, especially with the rise of large language models (LLMs) and generative AI, how those models are trained and fine-tuned creates opportunities for massive data leakage. “No, Hashing Still Doesn’t Make Your Data Anonymous” “No, Hashing Still Doesn’t Make Your Data Anonymous” Synthetic data is often considered the convenient solution to the data privacy challenges associated with LLM training and fine-tuning. However, synthetic data is not equivalent to anonymous or de-identified data. The Appeal and Enthusiasm for Synthetic Data Synthetic data fills gaps where real data is hard to obtain. It’s great for simulating rare events or generating large datasets for many machine-learning models. Advances in AI-generated tools have enhanced synthetic data’s capabilities, making it more versatile and powerful. Synthetic data accelerates innovation by enabling rapid development and testing of new algorithms and technologies. It provides a sandbox for experimentation without the constraints of real-world data limitations. As TDS Editors mention , “Using synthetic data isn’t exactly a new practice: it’s been a productive approach for several years now.” TDS Editors mention TDS Editors mention Generative AI and Privacy Risks Despite the enthusiasm, it’s critical to recognize that synthetic data is not inherently anonymous. Generative AI and LLMs have unique privacy risks. Synthetic data can still reflect patterns from real data, leading to potential re-identification risks. From a data loss prevention and data privacy point of view, there are several additional risks unique to LLMs : there are several additional risks unique to LLMs there are several additional risks unique to LLMs Membership and Property Leakage from Pre-Training Data: LLMs can inadvertently memorize sensitive information during their training on vast datasets. Membership and Property Leakage from Pre-Training Data: LLMs can inadvertently memorize sensitive information during their training on vast datasets. Membership and Property Leakage from Pre-Training Data: Model Features Leakage from Trained LLM: Features learned during training can leak sensitive information when the model is queried. Model Features Leakage from Trained LLM: Features learned during training can leak sensitive information when the model is queried. Model Features Leakage from Trained LLM: Privacy Leakage from Conversations (History) with LLMs: Data from user interactions can be stored and potentially exposed. Privacy Leakage from Conversations (History) with LLMs: Data from user interactions can be stored and potentially exposed. Privacy Leakage from Conversations (History) with LLMs: Compliance with Privacy Intent of Users: Ensuring that the data used and generated by LLMs complies with user consent and privacy expectations. Compliance with Privacy Intent of Users: Ensuring that the data used and generated by LLMs complies with user consent and privacy expectations. Compliance with Privacy Intent of Users: Enterprise data leakage becomes more relevant when leveraging LLMs in settings such as Retrieval-Augmented Generation (RAG) or fine-tuning LLMs with enterprise data to create domain-specific models. To prevent leaks, the privacy of enterprise (training) data must be safeguarded. Synthetic Data: Appealing Yet Not Automatically Anonymous Synthetic data addresses many issues related to privacy and enterprise data leakage. However, as previously stated, synthetic data is not automatically anonymous. Evaluating the quality of synthetic data and avoiding the pitfalls highlighted in studies such as “On the Inadequacy of Similarity-based Privacy Metrics: Reconstruction Attacks against ‘Truly Anonymous Synthetic Data’” is crucial. “On the Inadequacy of Similarity-based Privacy Metrics: Reconstruction Attacks against ‘Truly Anonymous Synthetic Data’” “On the Inadequacy of Similarity-based Privacy Metrics: Reconstruction Attacks against ‘Truly Anonymous Synthetic Data’” It’s much better to rely on a mathematical definition of privacy guarantees like differential privacy. Differential privacy provides robust guarantees by ensuring that the inclusion or exclusion of a single data point does not significantly affect the outcome, thereby protecting individual privacy. Evaluating Synthetic Data Quality To ensure synthetic data is effective and safe, evaluate its quality rigorously . evaluate its quality rigorously evaluate its quality rigorously Fidelity: Measures how well synthetic data reflects the statistical properties of real data. High fidelity means the synthetic data maintains the patterns and distributions of the original dataset. “If our model can produce synthetic data that can be considered to be a random sample from the same parent distribution, then we’ve hit the jackpot.” Fidelity: Measures how well synthetic data reflects the statistical properties of real data. High fidelity means the synthetic data maintains the patterns and distributions of the original dataset. “If our model can produce synthetic data that can be considered to be a random sample from the same parent distribution, then we’ve hit the jackpot.” Fidelity: Utility: Determines whether synthetic data can be used effectively for its intended purpose. High-utility synthetic data should yield similar results to real data in machine learning models or statistical analyses. “The synthetic data should be just as useful when put to tasks such as regression or classification.” Utility: Determines whether synthetic data can be used effectively for its intended purpose. High-utility synthetic data should yield similar results to real data in machine learning models or statistical analyses. “The synthetic data should be just as useful when put to tasks such as regression or classification.” Utility: Privacy: Ensures that synthetic data does not allow for re-identification of individuals. The Maximum Similarity Test compares the similarities within and between datasets to detect privacy breaches. Skabar highlights that “the biggest danger with synthetic data points being too close to observed points is privacy; i.e., being able to identify points in the observed set from points in the synthetic set.” Privacy: Ensures that synthetic data does not allow for re-identification of individuals. The Maximum Similarity Test compares the similarities within and between datasets to detect privacy breaches. Skabar highlights that “the biggest danger with synthetic data points being too close to observed points is privacy; i.e., being able to identify points in the observed set from points in the synthetic set.” Privacy: Practical Techniques Maximum Similarity Test: This test involves calculating the similarity between instances in synthetic and real datasets and comparing these similarities. Similar distributions indicate high fidelity and utility without compromising privacy. Maximum Similarity Test: This test involves calculating the similarity between instances in synthetic and real datasets and comparing these similarities. Similar distributions indicate high fidelity and utility without compromising privacy. Maximum Similarity Test: Train on Synthetic, Test on Real (TSTR): Train a machine learning model on synthetic data and test it on real data. High performance in this test shows that the synthetic data maintains utility and accurately represents real data. Train on Synthetic, Test on Real (TSTR): Train a machine learning model on synthetic data and test it on real data. High performance in this test shows that the synthetic data maintains utility and accurately represents real data. Train on Synthetic, Test on Real (TSTR): Gower Similarity: For mixed-type datasets, Gower Similarity measures the distance between data points, providing a comprehensive similarity measure that accommodates various data types. Gower Similarity: For mixed-type datasets, Gower Similarity measures the distance between data points, providing a comprehensive similarity measure that accommodates various data types. Gower Similarity: The FTC article about the ineffectiveness of hashing as privacy protection is a good reminder that robust privacy-preserving techniques and thorough quality evaluations are key to ensuring synthetic datasets are safe and functional.

Synthetic Data, Hashing, Enterprise Data Leakage, and the Reality of Privacy Risks: What to Know

Table of Links Abstract and I. Introduction II. Expectations of Blockchain Accessibility III. Approach I: Maintain a Ledger Locally - Run a Full Node IV. Approach II: Query a Third-Party Ledger-Node-As-A-Service (NAAS) V. Approach III: Light Node - External Query & Local Verification VI. Concluding Remark and References IV. APPROACH II: QUERY A THIRD-PARTY LEDGER - NODE-AS-A-SERVICE (NAAS) If a user cannot afford to run a full node themselves, they must outsource the synchronization of blockchains to some third party. While typical users may be tempted to entrust their crypto coins and assets to an all-in-one cryptocurrency exchange, such as Crypto.com [16] and Binance [6], for exchange of easy accessibility, we consider the approach fundamentally flawed. Because the user has no access to the asset without the consent of the exchange, they cannot claim that they effectively own the asset: the recent collapse of FTX [31] reveals the risk of the exchange being insolvent and the user’s asset being lost. Therefore, if the user wants to keep his private key and still maintain reasonable access to the blockchain, one approach is to purchase a third-party service that answers RPC queries, colloquially known as Node-as-a-service (NAAS) or an RPC node. The clients can interact with the third-party service just as they would with a full node (see Fig. 3). Many active NAAS providers exist in the field, including Alchemy, Ankr, BlockDaemon, etc. Table II provides a list of providers, as advertised by the Ethereum Foundation [25]. While we recognize that different providers offer services with different features and have different pricing plans, which makes an accurate comparison challenging, we pick four uniform measurements to understand the provider: the number of protocols supported, whether there is a free tier, the minimum amount the user needs to pay for a paid tier (per month), and whether or not the provider developed an exclusive API (such as one that handles the NFT) for the service in addition to traditional RPC calls. A. Pros and Cons The main benefit of using a NAAS service is that it is more affordable than running one’s own full node because the service provider can build an infrastructure that handles a high workload efficiently. Many providers also have a free tier that allows a limited number of queries. It is also noteworthy that most providers allow users to access more than one blockchain, which would traditionally require running one full node for each blockchain. Some providers offer exclusive pre-made APIs to handle common use cases, such as NFT. While using such API may reduce the program’s portability, it increases the development efficiency. The drawback of the approach is also significant: the security assumption of the model now depends on the service provider as a trusted party. Consider the case of Bitcoin’s RPC call getbalance. The client has no way to verify the numerical result because RPC is not designed to ensure data integrity: every user is expected to run a node themselves. There is also no privacy guarantee when the service provider is untrusted: the service provider can see all parameters of an RPC call, thus increasing the risk associated, such as frontrunning [17]. Besides, any attack and incident of the service provider can impact users’ access to blockchain information, thus affecting availability. Ankr was hit by a DNS attack in July 2022, which disrupted its users’ access to two blockchains and placed their funds at risk [36]. Similarly, Infura was forced to censor Venezuelan users due to a US sanction in March 2022 [39]. These cases illustrate that a centralized service provider can become a single point of failure, and additional considerations are needed to ensure the accessibility of blockchains. B. Open Questions Node-as-a-service providers form a competitive market: there are 19 providers advertised on the Ethereum Foundation website. However, there is little study on the market: who are the main users? Which service has a better cost-performance ratio for a specific type of user? How profitable can the providers be? An empirical study on this growing market is a challenging topic. The design of the RPC protocol in this scenario can be particularly challenging since the current RPC protocol assumes the complete trust of the server. However, with the recent advancement of verification methods, such as Flyclient [10], a verifiable RPC protocol may be possible from a minimal-sized root of trust, solving the issue of integrity in the face of an untrusted service provider. We also observe that it is standard industry practice to employ several services so that at least one is available at any time. Since many providers exist in the field, a unified structure that features a collaboration between providers may provide an improved availability guarantee and some degree of privacy and anonymity to users. For instance, Lava [13] is an ongoing proposal to design a decentralized RPC network blockchain that allows a group of NAAS providers to join together to provide services to users. The users will be charged in LAVA, a new type of coin specific to the network. Both NAAS providers and blockchain validators will stake LAVA to use the system. Unfortunately, Lava’s whitepaper lacks a formal description of security, instead claiming that slashing the funds from bad actors can stop them from providing compromised information. Authors:
(1) Zhongtang Luo, Purdue University (luo401@purdue.edu);
(2) Rohan Murukutla, Supra (r.murukutla@supraoracles.com);
(3) Aniket Kate, Purdue University / Supra (aniket@purdue.edu). This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. Table of Links Abstract and I. Introduction Abstract and I. Introduction II. Expectations of Blockchain Accessibility II. Expectations of Blockchain Accessibility III. Approach I: Maintain a Ledger Locally - Run a Full Node III. Approach I: Maintain a Ledger Locally - Run a Full Node IV. Approach II: Query a Third-Party Ledger-Node-As-A-Service (NAAS) IV. Approach II: Query a Third-Party Ledger-Node-As-A-Service (NAAS) V. Approach III: Light Node - External Query & Local Verification V. Approach III: Light Node - External Query & Local Verification VI. Concluding Remark and References VI. Concluding Remark and References IV. APPROACH II: QUERY A THIRD-PARTY LEDGER - NODE-AS-A-SERVICE (NAAS) If a user cannot afford to run a full node themselves, they must outsource the synchronization of blockchains to some third party. While typical users may be tempted to entrust their crypto coins and assets to an all-in-one cryptocurrency exchange, such as Crypto.com [16] and Binance [6], for exchange of easy accessibility, we consider the approach fundamentally flawed. Because the user has no access to the asset without the consent of the exchange, they cannot claim that they effectively own the asset: the recent collapse of FTX [31] reveals the risk of the exchange being insolvent and the user’s asset being lost. Therefore, if the user wants to keep his private key and still maintain reasonable access to the blockchain, one approach is to purchase a third-party service that answers RPC queries, colloquially known as Node-as-a-service (NAAS) or an RPC node. The clients can interact with the third-party service just as they would with a full node (see Fig. 3). Many active NAAS providers exist in the field, including Alchemy, Ankr, BlockDaemon, etc. Table II provides a list of providers, as advertised by the Ethereum Foundation [25]. While we recognize that different providers offer services with different features and have different pricing plans, which makes an accurate comparison challenging, we pick four uniform measurements to understand the provider: the number of protocols supported, whether there is a free tier, the minimum amount the user needs to pay for a paid tier (per month), and whether or not the provider developed an exclusive API (such as one that handles the NFT) for the service in addition to traditional RPC calls. A. Pros and Cons A. Pros and Cons The main benefit of using a NAAS service is that it is more affordable than running one’s own full node because the service provider can build an infrastructure that handles a high workload efficiently. Many providers also have a free tier that allows a limited number of queries. It is also noteworthy that most providers allow users to access more than one blockchain, which would traditionally require running one full node for each blockchain. Some providers offer exclusive pre-made APIs to handle common use cases, such as NFT. While using such API may reduce the program’s portability, it increases the development efficiency. The drawback of the approach is also significant: the security assumption of the model now depends on the service provider as a trusted party. Consider the case of Bitcoin’s RPC call getbalance. The client has no way to verify the numerical result because RPC is not designed to ensure data integrity: every user is expected to run a node themselves. There is also no privacy guarantee when the service provider is untrusted: the service provider can see all parameters of an RPC call, thus increasing the risk associated, such as frontrunning [17]. Besides, any attack and incident of the service provider can impact users’ access to blockchain information, thus affecting availability. Ankr was hit by a DNS attack in July 2022, which disrupted its users’ access to two blockchains and placed their funds at risk [36]. Similarly, Infura was forced to censor Venezuelan users due to a US sanction in March 2022 [39]. These cases illustrate that a centralized service provider can become a single point of failure, and additional considerations are needed to ensure the accessibility of blockchains. B. Open Questions B. Open Questions Node-as-a-service providers form a competitive market: there are 19 providers advertised on the Ethereum Foundation website. However, there is little study on the market: who are the main users? Which service has a better cost-performance ratio for a specific type of user? How profitable can the providers be? An empirical study on this growing market is a challenging topic. The design of the RPC protocol in this scenario can be particularly challenging since the current RPC protocol assumes the complete trust of the server. However, with the recent advancement of verification methods, such as Flyclient [10], a verifiable RPC protocol may be possible from a minimal-sized root of trust, solving the issue of integrity in the face of an untrusted service provider. We also observe that it is standard industry practice to employ several services so that at least one is available at any time. Since many providers exist in the field, a unified structure that features a collaboration between providers may provide an improved availability guarantee and some degree of privacy and anonymity to users. For instance, Lava [13] is an ongoing proposal to design a decentralized RPC network blockchain that allows a group of NAAS providers to join together to provide services to users. The users will be charged in LAVA, a new type of coin specific to the network. Both NAAS providers and blockchain validators will stake LAVA to use the system. Unfortunately, Lava’s whitepaper lacks a formal description of security, instead claiming that slashing the funds from bad actors can stop them from providing compromised information. Authors: (1) Zhongtang Luo, Purdue University (luo401@purdue.edu); (2) Rohan Murukutla, Supra (r.murukutla@supraoracles.com); (3) Aniket Kate, Purdue University / Supra (aniket@purdue.edu). Authors: Authors: (1) Zhongtang Luo, Purdue University (luo401@purdue.edu); (2) Rohan Murukutla, Supra (r.murukutla@supraoracles.com); (3) Aniket Kate, Purdue University / Supra (aniket@purdue.edu). This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. This paper is available on arxiv under CC BY-NC-ND 4.0 DEED license. available on arxiv

Navigating the Node-as-a-Service Market: Benefits, Risks, and Open Questions

A Hitchhiker's Guide to Restaking and Its Risks

রিস্ট্যাকিং এবং এর ঝুঁকির জন্য হিচহাইকারস গাইড

Per Anhalter durch die Neuverpfändung und ihre Risiken

Una guía para autoestopistas sobre retomar y sus riesgos

Guide de l'auto-stoppeur sur le reprise et ses risques

एक सहयात्री की रीस्टेकिंग और उसके जोखिमों के बारे में मार्गदर्शिका

再ステーキングとそのリスクに関するヒッチハイカーガイド

재예약과 그 위험에 대한 히치하이커를 위한 가이드

Um guia do mochileiro para reestabelecer e seus riscos

Путешественник автостопом по пересдаче и ее рискам

Bir Otostopçunun Yeniden Seks Yapma Rehberi ve Riskleri

Hướng dẫn cho người quá giang về việc đặt lại và rủi ro của nó

搭便车者指南：重新抵押及其风险

Nanotargeting Risks: The Urgent Need for Better Privacy Protections

Stories, News & Mentions about RIOKS

Rioks’s Stories on HackerNoon