Month: July 2023

IDORs are becoming a major problem and CISA is sounding the alarm.

Sensitive information belonging to millions of people is being stolen from various websites and web apps all across the Internet every day, experts have warned. 

The common denominator in all these incidents appears to be the existence of insecure direct object references (IDOR). These are flaws that allow people to request sensitive information from a website or web app, without the site checking if the user is allowed to access such information in the first place.

Now, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has sounded the alarm on IDORs, in a joint security bulletin published with the Australian Cyber Security Centre.

Common flaws

In its announcement, CISA notes that hackers are “frequently” taking advantage of IDOR flaws “because they are common, hard to prevent outside the development process, and can be abused at scale.”

“Typically, these vulnerabilities exist because an object identifier is exposed, passed externally, or easily guessed—allowing any user to use or modify the identifier,” CISA said.

The consequences of these attacks can be quite painful, as they allow threat actors to steal sensitive data such as financial information, health data, or personal files.

This includes incidents such as the 2019 First American Financial security breach (800 million personal files stolen), the Microsoft Teams IDOR flaw discovered in late June 2023, and the two IDOR bugs in Nexx smart home devices found in April 2023. 

Web developers should step up, CISA then states, and implement secure-by-design principles at each step of the development process. That includes incorporating automated code analysis tools that can spot flaws in the code before the apps ever reach the production stage. 

The two organizations also said developers should set up applications “to deny access by default” to make sure the apps perform authentication checks every time someone asks to access or modify any type of sensitive data.

Check out the best firewalls today

Via: The Register

Read More 

Professors are now creating courses with ChatGPT to help you learn ChatGPT – and it’s not a bad idea

ChatGPT has created quite a buzz since its launch last fall, and has quickly settled as a staple in everyday life. Despite concerns surrounding the use of AI within academic fields, some university professors are now introducing classes and courses focused solely on educating students on the topics of prompt engineering and AI comprehension.

The rapid rise in popularity prompted Andrew Maynard, a professor at Arizona State University’s School for the Future of Innovation in Society, to offer a course tailored to help students get a head start with these emergent AI tools.

“We’ve got to the point where it was very clear to me [that] there was a lot of panic, a lot of intrigue and things were moving fast”, Maynard told Inside Higher Ed.

In April this year, Maynard offered a course now known as Basic Prompt Engineering with ChatGPT, which teaches students how to effectively create prompts for the chatbot that consistently generates desirable output.

Adapt to Survive?

While there has been significant pushback in the education sector against ChatGPT, citing obvious concerns like plagiarism and cheating, the faculty behind courses like Maynard’s see this as an opportunity to prepare students for the drastically changing digital landscape created by OpenAI’s ChatGPT and other AI tools like it.

This will affect every domain, every discipline, and it’s really important we teach it.

Jules White

Jules White, director of the Future of Learning and Generative AI at Vanderbilt University, argues that “People are saying, ‘Generative AI is taking your job’ – if that’s the case, we better do something about it and make sure students are innovating and succeeding”.

It may seem like a counterproductive approach to the concerns about how AI will affect future employment landscapes, but the move to get young members of the workforce up to speed and ‘useful’ in a world of increasing AI prevalence could actually mitigate any projected damage to the job market.

Amusingly enough, Maynard went straight to ChatGPT to help design his online course, though he did also have faculty and graduate students help test and evaluate the content. The chatbot did have a major role in the initial phases of creating the course; while it makes sense for ChatGPT to explain how to use its own software, could this be the start of AI-generated curriculums?

Read More 

Elon Musk took an outlandish risk with the rebrand to X, and it’s causing all sorts of problems.

Microsoft’s Edge browser is worrying users by displaying a security warning about the rebranded Twitter, now known as X – complete with an icon change from the famous blue bird to, well, an X.

The problem was highlighted by Florian on Twitter, who received a warning message from Edge that questioned whether the PWA (Progressive Web App) for X running in the browser was trying to trick them, and if they wanted to uninstall it as a result.

We need to rewind a bit here to get to the root of why this is happening. The first thing to know is that as Bleeping Computer, which flagged this, points out, Edge (and other Chromium-based browsers) have a built-in feature called ‘Progressive Web App Icon change’ which watches for app name or icon changes, and warns about them.

The idea is that you might be using a PWA (which essentially is a lightweight spin on an app that works just like a web page, running in the browser) that isn’t what you think it is, and might be a scam – if the name has been changed slightly, or the icon is different.

So, the browser’s telling you to be careful, and note that something is different here, so you can check everything’s okay – and uninstall the PWA if something seems fishy.

In this case, the warning has seemingly been triggered by Elon Musk’s swift rebrand to X, which involved changing the favicon (the little icon that appears on the browser tab next to the site name).

Because this happened so fast, Edge is picking it up as the wrong icon – not the Twitter bird – and alerting users to this.

Analysis: Land of confusion

Presumably, Microsoft will be tinkering with Edge pretty swiftly to update the browser so this false detection and unnecessary warning won’t happen anymore. There aren’t any reports of this appearing on Chrome (or other Chromium browsers), so Google appears to have side-stepped the issue or already remedied it.

All this talk of PWAs might seem a bit confusing, but the takeaway is if you’re using Edge and you see the warning about X (Twitter) that’s shown in the above tweet, you can safely ignore it, and there’s no need to fret.

Still, for the less tech-savvy, this will be a worrying warning message to see, one that could even make folks think that they could have fallen victim to malware. Rest assured that isn’t the case, and your security software (hopefully you’re running one of the best antivirus apps) hasn’t let you down.

On a broader level, this is just another fragment of collateral damage from Musk’s X rebrand, which really hasn’t gone down well at all in many (well, most) quarters, and seems like a crazy risk to take. What throws further confusion into the mix is that there are actually scams floating around trying to leverage the Twitter rebrand to exploit unwary people, as we’ve seen.

Could this rebrand thing get any messier? It’s very likely, sadly…

Via Engadget

Read More 

Nikon Zf rumors suggest the retro full-frame camera might launch within the next few days.

The Nikon Zf is one of the year’s most anticipated mirrorless cameras – and some fresh rumors suggest it could be launched within the next few days.

A Nikon Rumors post states that the full-frame mirrorless camera could land “on or around August 2nd”. And while the rumor site adds that it isn’t sure completely sure about that launch date, it does say that the Nikon Zf will “most likely” land in the first week of August.

If you’re a fan of retro-themed cameras with modern mirrorless specs – think the Fujifilm X-T5 or Leica Q3 – then Nikon’s imminent launch is definitely one to watch. That’s because the Nikon Zf is expected to be a full-frame version of the Nikon Z fc, which we still rate as one of the best travel cameras around.

The latest Nikon Zf rumors do suggest, though, that it’ll be a much more capable, and expensive, camera than the Z fc. Earlier leaks have suggested that the Zf will have the same 45MP full-frame sensor as the Nikon Z7 II, which is still one of the best around for dynamic range and overall image quality.

The good news for wildlife and street shooters is that, according to Nikon Rumors, the Nikon Zf will also have “improved autofocus compared to Z6II/Z7II”, plus a small LCD screen on the top for you to quickly check settings.

But the Nikon Zf’s design is really its most interesting feature. Like the Nikon Z fc, it’s expected to pay homage to the Nikon FM2 (a 30-year-old film camera). But unlike the Z fc, the Zf is expected to have better build quality and a small grip that should make it better balanced with longer lenses. 

Analysis: What made the Nikon FM2 special?

The enduring popularity of film cameras and modern incarnations like the sold-out Fujifilm X100V show that photography fans still pine for retro tools – and the Nikon FM2 (above), which launched in 1982 definitely qualifies as a design classic.

The fully-mechanical FM2 ran without batteries and was known for being virtually indestructible. That isn’t a feature that Nikon managed to bring into the modern day with the more flimsy Z fc, so we’re keen to see how far it’s improved the rumored Nikon Zf’s build quality.

The FM2 actually lacked a grip to help differentiate it from the pro SLRs of the day, but it seems Nikon has made the practical choice of adding one to the Zf (according to rumors, at least). That makes sense given the chunky, modern-day lenses photographers would likely want to pair with the Zf.

When we spoke to Nikon about the design of the Nikon Z fc back in August 2021, it told us that it didn’t want to make an exact replica of the FM2, and that will likely be the case again with the Zf. 

Nikon designer Shu Suzuki (ID Group, Design Center) told us in 2021: “While the design of the Z fc takes its inspiration from the FM2, the goal was never to reproduce the silhouette exactly, but rather create a new framework which preserves the overall essence of the earlier model.”

If Nikon can do that with the Zf while sprinkling it with some of the latest mirrorless tech, we could be looking at one of the best cameras of the year.

Read More 

Like any new tech, Micro LED TVs can be pretty expensive. But prices are plummeting and the sweet spot isn’t far away.

We love Micro LED TVs here at TechRadar, but their price tags, not so much. The new 89-inch Micro LED from Samsung costs as much as a small house, and rival TVs aren’t much cheaper. The good news is that more affordable Micro LED TVs are coming. All you need to do is channel your inner Rip Van Winkle or Sleeping Beauty and go to bed for, ooh, about four years.

That’s not quite how industry analysts Omdia put it, as reported by Business Korea. They merely say that based on current trends, the cost of Micro LED panels will plummet to around one-quarter of their current prices by 2027. But it’s clear that we’ll need to wait a little longer before Micro LED becomes an affordable option for most of us.

With Micro LED TVs, the price isn’t right

As with any new tech, early adopters pay more – and with display technology that’s particularly true, because it takes quite a while for manufacturing to deliver consistent quality, acceptable yields and the economies of scale that start putting prices down.

According to a report from Omdia, as seen by Business Korea, the price for mid-sized Micro LED panels – that’s 10.1- to 14.6 inches – is currently between $5,800 and $10,000 per panel. That’s expected to drop to around $1,200 for the smallest sizes by 2027.

That’s the good news. However, the larger panels required for really big TVs are likely to stay expensive. For instance, 14.6-inches is fine for a PC or a tablet and 10.1-inches is a good fit for a Tesla, but it’s hardly on the same scale as the ultra-premium 76-, 101- and 114-inch TVs Samsung is promising for later this year. 

And even at a quarter of the price, those TVs are still going to be frighteningly expensive. Samsung’s 110-inch Micro LED TV, previously called The Wall, had a sticker price of $140,000. If you want a big Micro LED TV, you’d better start saving.

Read More