GhostStripe, Sec Clearance bill, JR EAST, Vulnrichment, and Solar Storm
This week Koichi is back as editor for another round-up of the news. This time I chose these security news: GhostStripe, Security Clearance bill, and RISS, Suspected attack on Japan Railway (JR) East, Vulnrichment; and Solar Storm.
GhostStripe, a new attack method against Self-Driving Car (SDC)
A group of researchers from a university in Singapore announced that they have proved a new attack method against SDC. They called it GhostStripe. This is one of the Adversarial Attack against AI which is used for Self-Driving systems.
SDC takes pictures and those AI recognizes their surroundings from those images. Intentional manipulation of the image to cause the SDC's AI to misrecognize, that is Adversarial example Attack which I discussed before. For example, ShapeShifter is an attack method in which intentional manipulation of the image of a traffic sign ordering a stop makes SDC recognize the wrong instruction and not stop. GhostStripe uses LEDs to project colored lines that the human eye cannot distinguish but that the CMOS rolling digital shutter reacts to. AI security was discussed in a previous article, and we expect to see more research on such attacks in the future.
Source: GhostStripe attack haunts self-driving cars by making them ignore road signs
Security Clearance bill and RISS
On May 9, the Japanese House of Councilors' Cabinet Committee voted unanimously in favor of a bill to create a "Security Clearance" system. This would limit access to information critical to economic security to those whose credibility has been verified by the government, including employees of private companies. Conversely, until now, access to such security assets did not require any particular background checks and there wasn't a penalty for information leakage. By this system, access to such information will be granted only to people recognized as having no risk of causing leaks.
By the way, Japan has a national cybersecurity certification, the Registered Information Security Specialist (RISS), which certify the ability to protect systems against cyber attacks (However, it is debatable whether the qualification really proves actual skills). I do not know what is required to pass the clearance, but such a certification may be one of them.
Source: Japan's parliament enacts new economic security clearance bill
Suspected attack on Japan Railway (JR) East
SUICA is the most popular prepaid rechargeable contactless smart card and electronic money system in Japan and mostly used as a fare card on train lines (JR East). On 5/10, JR East announced SUICA, especially "Mobile SUICA" smart phone IC ticket application had stopped running because of "system failure". From around 5:30pm on the same day, it had been difficult to connect to services that require network interaction, such as logging into the application and recharging money, and it took 5 hours to "became almost stable," according to a company spokesperson. JR believes that the cause of the system failure is that they suffered a cyber attack and is consulting with the Metropolitan Police Department. If this is a cyber attack incident, it
Source: JR East hit by system disruption, cyberattack suspected
Vulnrichment
The US Cybersecurity and Infrastructure Agency (CISA) has announced the creation of “Vulnrichment,” a project to provide additional information on CVSS/CVE to fill in the gaps in the NVD’s recent slowdown. The current vulnerability assessment score is CVSS, but it does not take into account the vulnerability response policy or the environment within the system where the vulnerability exists. This is where the Stakeholder-Specific Vulnerability Categorization (SSVC) evaluation criteria is introduced to assess the urgency of responding to the vulnerability. According to the article, CISA has enriched 1,300 CVEs so far. They have a public repository of the project.
Source: CISA starts CVE “vulnrichment” program
Solar Storm
On May 11–12, one of the largest flares ever generated on the sun caused a Solar Storm (magnetic storm) on Earth. As a result, Northern lights/Auroras were observed around the world. In the end, no large-scale communication problems were confirmed, but NICT urged people to be vigilant until around the 16th, as using GPS (satellite-based positioning systems) and some wireless communications may be affected.
And NOAA detects another solar flare on the 16th but this time there are no magnetic storm
Source: https://nict.go.jp/publicity/topics/2024/05/10-1.html
