TechRisk Notes#23: Systemic risk in the Cloud + OWASP Top 10 LLM risk
Also, DeFi continued to face adversaries, Vitalik on Ethereum's future, Mandiant shared its playbook using Generative AI.
EmergingTech Spotlight
Storm in the cloud? - A report from the Treasury’s little-known Financial and Banking Information Infrastructure Committee declared earlier this year, regulators are getting nervous about the systemic financial risks emanating from the cloud. Indeed, the Bank for International Settlements suggested last year — echoing work by European central banks — that “big tech interdependencies” have become “a key policy blind spot”. [more]
OWASP released a draft top 10 list most critical vulnerabilities often seen in Large Language Models (LLM) applications, highlighting their potential impact, ease of exploitation, and prevalence in real-world applications.[more]
Security firm Mandiant shared how they are leveraging generative AI in bottom-up use cases to help identify threats faster, eliminate toil, and better scale talent and expertise. These include, building out SIEM queries, generating codes to help increase the speed of malware analysis, writing YARA rules. [more]
Why Do LLMs Hallucinate? There are two reasons: i) lack of information, and ii) a surface level, statistical model of language, rather than a modicum of true semantic understanding. [more]
The Department for Education has begun a consultation on the use of generative AI. The department aims to explore the opportunities such technology presents for education, as well as understand the concerns of educators and experts in education. The call for evidence is asking schools, colleges and other academic institutes, along with local authorities, about their experiences with ChatGPT and other generative AI systems. [more]
Experts warned the task of distinguishing what's real from what's not will impose a significant mental and cognitive burden on people in the AI era.
This is because misinformation has already fueled significant social problems, ranging from polarization to vaccine skepticism. AI-generated content risks intensifying those issues and making it more difficult for people to make sense of the world around them. [more]
Web3 Cryptospace Spotlight
11 Jun - DeFi protocol Sturdy Finance has been exploited for more than $750K due to suspected price manipulation. Sturdy Finance team has promised that no further action will be taken against the attacker and $100K bounty if these crypto assets are returned. [more]
11 Jun - Floating Point Group (FPG), an institutional trading desk specializing in crypto assets trading, suffered a cyber attack and suffered a loss of more than $15M in crypto assets. Notably, FPG engaged outside auditors in December of last year for a series of cybersecurity audits and penetration testing, as well as had successfully earned a SOC 2 certification. [more][more-2][more-FPG_SOC]
11 Jun - DeFi protocol Atlantis Loans, an abandoned lending platform on Binance’s BNB Chain, suffered a governance attack and approximately $1M worth of crypto assets being drained. [more]
14 Jun - Hashflow, a cryptocurrency trading platform, has assured its impacted consumers that they will be “made whole” following an exploit that resulted in the loss of at least $600K in crypto assets from the exchange. Security firm, Peckshield, suggested that it could be the work of a white hacker draining the crypto assets after identifying its smart contract’s flaw. [more][more-securityanalysis]
Ethereum co-founder Vitalik Buterin believes the success of Ethereum will come down to three major technical “transitions” that need to happen almost simultaneously — layer-2 scaling, wallet security and privacy-preserving features. [more]