Cybersafetyconnections June 10,2024 vol1 #172
- From konbriefing there was an unauthorized access to an AI platform, Hugging Face (HF) – New York City, New York, USA
- Hugging Face Spaces platform, specifically concerning Spaces secrets and users were impacted by the breach.
- The breach may have happened possibly due to poor cybersecurity posture.
- No cybercriminals have taken responsibility.
- Here are steps taken to mitigate loss from cyberattack.
What happened?
Hugging Face – New York City, New York, USA ,Hugging Face reported the discovery of unauthorized access to their Spaces platform, specifically concerning Spaces secrets. There was reason to believe that a subset of Spaces’ secrets may have been accessed without proper authorization.
Who was impacted?
Hugging Face Spaces platform, specifically concerning Spaces secrets and users were impacted by the breach.
Why did this happen?
From the report we have Hugging Face had to tighten up cybersecurity and so it maybe have happened due to lax cybersecurity posture.
Which cybercriminal Group was responsible?
No cybercriminal group claimed responsibility.
How Hugging Face mitigated loss from cyberattack
OWASP Threat and Safeguard Matrix
As part of Hugging Face initial response,
- There was prompt revocation of several Hugginf F tokens associated with the compromised secrets.
- Users whose tokens have been revoked have been duly notified via email. All users were strongly advised to refresh any keys or tokens and consider migrating from HF tokens to fine-grained access tokens, which became the new default.
- Huggin Face collaborated with external cyber security forensic specialists to investigate the incident in detail and to conduct a comprehensive review of their security policies and procedures.
- Furthermore, over recent days, substantial enhancements were made to the security of the Spaces infrastructure.
- This included the complete removal of org tokens to bolster traceability and audit capabilities, the introduction of a key management service (KMS) for Spaces secrets, reinforcement of our system’s ability to identify leaked tokens and proactively invalidate them, and an across-the-board improvement of our security measures.
- Additionally, “classic” read and write tokens would be phased out soon, aligning with the feature parity of fine-grained access tokens. We remain vigilant in investigating any potential related incidents.
- In addition to internal measures, law enforcement agencies and data protection authorities were promptly notified regarding this incident.
And from Co-Pilot, here is how to mitigate loss from cyberattack on an AI platform.
Mitigating the loss from unauthorized access to an AI platform involves several steps. Here are some strategies:
- Data Breach Prevention:
- Strengthen security protocols, encryption, and access controls for AI instances that process sensitive data.
- Monitor and audit data access to prevent internal breaches.
- Educate staff about privacy risks associated with using AI tools like GPT-4 or PaLM21.
- Adversarial Attack Defense:
- Implement robust input validation to prevent adversarial attacks.
- Regularly update AI models to address vulnerabilities.
- Consider model extraction attacks and evasion attacks1.
- Unauthorized AI Use:
- Permit secure AI tools that meet business needs.
- Establish rules for staff to prevent unauthorized use of AI systems2.
Conclusion
Remember, strong security measures, employee training, and effective physical security practices are essential to prevent unauthorized access3. If you need further assistance, feel free to ask! 😊
