Security Boulevard

Authors/Presenters:Kai Yue, Richeng Jin, Chau-Wai Wong, Dror Baron, Huaiyu Dai

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – Gradient Obfuscation Gives a False Sense of Security in Federated Learning appeared first on Security Boulevard.

In the title of this post, keep in mind the keyword is may; as a forewarning, this is not a post that definitively says you must use a VPN regardless of the circumstances… because that is simply not true.

From a privacy lens, VPNs are niche tools - once some criteria are met, they can prove useful in some circumstances.

TABLE OF CONTENTS

• Preface
• Keep internet traffic private from ISP and other third parties
• Keep IP address private from visited sites and during P2P activities
• Encrypt traffic data when on unfamiliar networks***
• Circumventing censorship
• • Unblocking geo-restricted content
• Final thoughts

Preface

While a VPN can be a useful tool in improving your privacy - and security - it is important to realize that a VPN is far from a one-size fits all privacy tool. In most situations, a VPN should not be thought of as a security tool - except in the case where they are being used for their original purpose, which is to bridge two networks together.

You should determine whether a VPN is “for you” by carefully weighing whether your goals/wants/needs align with what a VPN can truly provide. Users should also keep in mind the limitations of a VPN may affect their privacy.

A VPN cannot make you anonymous, despite what many marketing gimmicks and claims insist. A VPN is not at all a viable substitute for using tools/services that respect user privacy (including using "basic" privacy practices) or basic personal cybersecurity hygiene.

Keep internet traffic private from ISP and other third parties

VPNs effectively remove the ability of third parties - such as your internet service provider (ISP) to sniff (see) your internet traffic. In most simple cases, your ISP would only see that you are 1) online and 2) connected to a VPN service.

If a user's main concern is keeping their internet traffic private from their ISP, then using a (trustworthy) VPN is a good choice. By connecting to the VPN provider’s servers, you are effectively routing your internet traffic through the VPN provider in place of your ISP. In essence, your internet traffic is kept between you and your VPN provider; assuming your VPN provider has an honored and verified "no logs" policy, this can prove a marked improvement for your privacy.

Additionally, assuming you are not connected to a "hostile" network, VPNs can be effective in preventing third parties from snooping on your traffic.

Though, it's worth nothing that a VPN is not a silver bullet against some entities - such as well-funded and well-resourced public and private organizations. Some "adversaries" may be capable of employing advanced techniques both online and offline to expose your internet activities and possibly connect your activities to your real world identity. This can range from your “adversary” taking advantage of VPN tunnel leaks or exploiting other operational weaknesses surrounding your VPN.

Of course, using a VPN isn't a replacement for basics such as forcing HTTPS within the browser; a VPN can't encrypt the connection from your device to a website and without the encryption provided by HTTPS, data transmitted between your device and that web server is unencrypted. This unencrypted traffic can be easily captured by any third parties listening in on the connection - which is trivial since the data is transmitted in plaintext.

Keep IP address private from visited sites and during P2P activities

When configured and working properly - without leaks - a VPN effectively masks your IP address from the sites you visit and during peer-to-peer (P2P) activities. P2P activities frequently include torrenting and participating in video/audio calls in the browser (usually facilitated by WebRTC). In place of your IP address, the VPN provider’s server IP address is shared during P2P activities.

While this doesn’t provide anonymity, hiding your IP address can provide some privacy benefits, removing a piece of identifying information about your approximate location, ISP, and devices. This can be especially important during P2P activities, where these data points combined with other data about your activities can reveal more than you may have intended (or be aware of).

To ensure your IP isn’t accidentally revealed during P2P activities, you should make sure the VPN provider resists IPv6 leaks. You should also address the potential for WebRTC leaking your IP address, even while connected to the VPN server, from within your own browser.

Be aware that your VPN provider will have your IP address(es) since you are connecting to their servers.

Encrypt traffic data when on unfamiliar networks***

This "benefit" comes with a huge caveat. In May 2024, researchers disclosed the TunnelVision vulnerability (which has existed since 2002), which can force VPN apps to send/receive some or all traffic outside of the encrypted tunnel.

Source: Leviathan Security

In summary, attackers can manipulate the DHCP server and enable option 121 to route VPN traffic through the DHCP server itself instead of the VPN tunnel, essentially exposing the sent/received traffic. In most cases, while this attack is carried out, the VPN app will report that the connection is "good." This attack is most effective if performed by someone with administrative control over a network - such as a network administrator... which could be any network outside of your direct control.

Therefore, using a VPN on an unfamiliar network can be prove useless on a truly "hostile" network. Additionally, researchers believe this attack has been 1) known to attackers prior to disclosure and 2) used in the wild. This attack is not effective on Linux or Android devices.

With that said, assuming the network is not hostile or exploiting something like TunnelVision (there is little a user can do to confirm this) this is a benefit primarily for those who frequently find themselves using Wi-Fi networks outside of their home. While security hasn’t been a modern-day concern on public or otherwise unfamiliar Wi-Fi networks, privacy does remain a concern.

Depending on the ISP for the unfamiliar network, your browsing data could be collected, analyzed, and then sold/shared with third parties. Users may want to abstain from conducting sensitive activities when on an unfamiliar network, regardless of using a VPN or not.

A good and “trustworthy” VPN can effectively eliminate common privacy risks that can arise from using unfamiliar and/or public Wi-Fi networks. Again, a VPN creates an encrypted tunnel between your device and the VPN servers; third parties on a public Wi-Fi network such as the network administrator and the ISP for the network would only be able to see your active connection to the VPN provider, assuming other advanced methods of monitoring traffic/undermining VPN connections...

The post How Using a VPN May Benefit Your Privacy appeared first on Security Boulevard.

via the comic & dry wit of Randall Munroe, creator of XKCD

Permalink

The post Randall Munroe’s XKCD ‘Exam Numbers’ appeared first on Security Boulevard.

For You Plague: U.S. Justice Dept. and Federal Trade Commission file lawsuit, alleging TikTok broke the COPPA law, plus a previous injunction.

The post TikTok Abuses Kids, say DoJ and FTC appeared first on Security Boulevard.

LAS VEGAS — Humans, unsurprisingly, remain the weak link in cybersecurity.

Related: Digital identity best practices

We’re gullible – and we can’t get away from relying on usernames and passwords.

Steady advances in software and hardware mechanisms to secure identities … (more…)

The post Black Hat Fireside Chat: Token’s wearable MFA solution combines PKI, biometrics — in a ring first appeared on The Last Watchdog.

The post Black Hat Fireside Chat: Token’s wearable MFA solution combines PKI, biometrics — in a ring appeared first on Security Boulevard.

National Public Data, a background check company that collects sensitive personal information, is facing a class-action legal complaint for allowing the data from 2.9 billion people to be stolen in a breach and later sold on the dark web for millions of dollars.

The post National Public Data Sued for Hack that Exposed Data of 2.9 Billion People appeared first on Security Boulevard.

Sonar’s R&D team discovered a Cross-Site Scripting vulnerability in Roundcube. Similar vulnerabilities in Roundcube have been used by APTs to steal government emails.

The post Government Emails at Risk: Critical Cross-Site Scripting Vulnerability in Roundcube Webmail appeared first on Security Boulevard.

Authors/Presenters:Viktor Valadi, AI Sweden; Xinchi Qiu, Pedro Porto Buarque de Gusmão, Nicholas D. Lane, Mina Alibeigi

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – FedVal: Different Good Or Different Bad In Federated Learning appeared first on Security Boulevard.

Authors/Presenters:Viktor Valadi, AI Sweden; Xinchi Qiu, Pedro Porto Buarque de Gusmão, Nicholas D. Lane, Mina Alibeigi

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – FedVal: Different Good Or Different Bad In Federated Learning appeared first on Security Boulevard.

Learn why AI policy is vital for ethical development and how regulations like the EU AI Act shape the future.

The post AI Policy and Governance: Shaping the Future of Artificial Intelligence appeared first on Scytale.

The post AI Policy and Governance: Shaping the Future of Artificial Intelligence appeared first on Security Boulevard.

A novel Linux kernel exploit technique called SLUBStick has proven to be 99% successful running the kind of attacks that in the past had a success rate of about 40% and allows bad actors to take total control of a system.

The post Novel SLUBStick Linux Exploit Gives Attackers Full System Control appeared first on Security Boulevard.

Articles related to cyber risk quantification, cyber risk management, and cyber resilience.

The post Leveraging CRQ to Comply With DORA Regulations | Kovrr appeared first on Security Boulevard.

As AI adoption grows, so does organizations’ appetite for the vast data from disparate sources needed to train AI models. Because of this, companies are grappling with how to safeguard a surging amount of fragmented data wherever it lives.

The post DSPM: A Cybersecurity Approach Tailor-Made for This AI Era appeared first on Security Boulevard.

LLMs are different from other tools and different approaches are required to mitigate their risks involving new security technologies.

The post Strategies for Mitigating LLM Risks in Cybersecurity appeared first on Security Boulevard.

The Payment Card Industry Data Security Standard (PCI DSS) aims to improve credit, debit and cash card transaction security and protect cardholders from breaches of their personal information.

The post Effective Third-Party Risk Management Under PCI DSS 4.0 appeared first on Security Boulevard.

The cloud has revolutionized how businesses operate, offering unprecedented agility and scalability. However, this rapid adoption has also introduced a new wave of security challenges. A recent Checkpoint cloud security...

The post How Strobes Uncover Hidden Cloud Risks Within Your Organization? appeared first on Strobes Security.

The post How Strobes Uncover Hidden Cloud Risks Within Your Organization? appeared first on Security Boulevard.

In episode 341, we cover the unprecedented global IT outage caused by a CrowdStrike update crash, affecting 8.5 million Windows machines. We discuss whether it’s the largest outage in history and discuss the intricacies of internet accessibility and responses from key stakeholders like Microsoft. Also, in our Aware Much segment, we explore Japan’s AI system, […]

The post The Great CrowdStrike Crash, AI’s Role in Employee Smiles appeared first on Shared Security Podcast.

The post The Great CrowdStrike Crash, AI’s Role in Employee Smiles appeared first on Security Boulevard.

Authors/Presenters:Qi Liu, Jieming Yin, Wujie Wen, Chengmo Yang, Shi Shay

Many thanks to USENIX for publishing their outstanding USENIX Security ’23 Presenter’s content, and the organizations strong commitment to Open Access. Originating from the conference’s events situated at the Anaheim Marriott; and via the organizations YouTube channel.

Permalink

The post USENIX Security ’23 – NeuroPots: Realtime Proactive Defense against Bit-Flip Attacks in Neural Networks appeared first on Security Boulevard.

Proofpoint Email Fraud Defense is a familiar name ...

The post Top 10 Proofpoint Alternatives and Competitors in 2024 appeared first on EasyDMARC.

The post Top 10 Proofpoint Alternatives and Competitors in 2024 appeared first on Security Boulevard.

PowerDMARC is a well-known DMARC solution, but it ...

The post Top 10 PowerDMARC Alternatives and Competitors in 2024 appeared first on EasyDMARC.

The post Top 10 PowerDMARC Alternatives and Competitors in 2024 appeared first on Security Boulevard.