Recently, Cybernews confirmed a post on a popular hacker forum, likely made by the alleged perpetrators, claiming 353 gigabytes of data were stolen during a breach of Doctor Alliance’s network. For now, the data has not been leaked, with the user going by the alias “GOD” threatening to either post or sell the information on November 21, 2025, in case a ransom of USD 200,000 is not paid.

Alias “GOD,” who likely represents a group of individuals, released a small 200 MB sample to prove they have the files. As per Cybernews, the revealed files include “various medical records, riddled with sensitive personal data,” specifically details on patient prescriptions, treatment plans, names, health insurance numbers, phone numbers, home addresses, hospital orders and more.

In the United States, such data access would constitute a reportable breach under the terms of the Health Insurance Portability and Privacy Act (HIPAA). Cybersecurity researchers now believe the trove, if determined to be legitimate, poses a serious risk to patients and employees, as it could all be used for identity theft, blackmail or other nefarious purposes. This includes not only medical identity theft but also insurance fraud.

“This data leak poses a huge risk of identity theft and medical fraud for the patients involved, such as obtaining medical services or prescription drugs in the victim’s name. Both doctors and patients can fall victim to social engineering attacks,” remarked the researchers.

While promising that the data would be deleted if the ransom is paid, the alleged cybercriminals in a post refused to divulge details like when the attack took place and what vector was used. No known hacker outfit has claimed credit for the attack.

The post Cyberattack on healthcare firm Doctor Alliance: All you need to know appeared first on International Finance.

Its outcome, the EU AI Act, is the first major piece of legislation controlling AI, including ‘generative AI’ chatbots, which have become the Internet’s new craze since ChatGPT’s inception in late 2022.

Two days later, French startup Mistral AI unveiled Mixtral 8x7B, a new large language model (LLM) for generative AI. Its unique setup of eight expert models makes it better than proprietary alternatives despite being smaller. Worse, the Act’s harsher regulations do not apply to its open-source code, presenting regulators with new issues.

Mixtral’s disruptive potential exemplifies policymakers’ struggles to rein in AI. Tech companies believe self-regulation is the answer. Given their inclination to prematurely enforce restrictive laws, former Google CEO Eric Schmidt believes governments should leave AI regulation to tech corporations.

How to control something that changes so fast is a question for most policymakers.

Setting EU law

The first attempt to answer that question is the AI Act, which will take effect in May 2025. Given the bloc’s regulatory powerhouse status, it intends to develop a European and possibly worldwide regulatory framework by encompassing practically all AI applications.

RPC partner Helen Armstrong said, “Large, multi-jurisdictional businesses may find it more efficient to comply with EU standards across their global operations on the assumption that they will probably substantially meet other countries’ standards.”

It is also the first attempt to handle foundation models, or General Purpose AI models (GPAI), which power AI systems.

All models must be horizontally compliant, including detecting AI-generated content, or face fines of up to 7% of the miscreant’s global revenue. How do you control rapid change? The Act tiers risk and responsibility for activities and AI models.

GPAIs with systemic risk must undergo rigorous reviews, incident reporting, and advanced cybersecurity procedures, including ‘red teaming,’ a simulated hacker attack. It’s called “systemic risk” because of two main factors: the amount of computation used to train the model (more than 10^25 “floating point operations”), which shows how big the industry is; and the model having more than 10,000 business users in the EU.

It appears only ChatGPT-4 and probably Google’s Gemini fit these criteria. Not everyone finds these criteria effective. Nigel Cannings, the founder of Intelligent Voice, stated that some high-capacity models may be relatively benign, while others may use lower-capacity models in high-risk contexts. The computing criterion may encourage developers to find workarounds that technically meet the threshold without reducing risks.

Cutting data requirements to achieve favourable outcomes is the goal of current AI research. Patrick Bangert, a data and AI expert at Searce, a technology consulting firm, said, “Classifying models by the amount of compute they require is only a short-term solution. These efforts are likely to break the compute barrier in the medium term, thus making this regulation void.”

The Act’s final draft was fiercely negotiated. France, Germany, and Italy initially resisted binding foundation model legislation, fearing it would hurt their startups. The Commission proposed horizontal regulations for all models and codes of practice for the most powerful as a compromise.

“There was a feeling that a lower threshold could hinder foundation model development by European companies, which were training smaller models at the time,” said Philipp Hacker, an AI regulation expert at the European New School of Digital Studies.

Hacker argued that this was entirely incorrect, as the rules only codify the bare minimum of industry practices—even falling short by some measures. Domino Data Lab AI expert Kjell Carlsson said, “We chose the threshold after extensive lobbying, resulting in an imperfect outcome. Others think the Act is too broad. It’s far more effective to regulate use cases instead of the general technologies that underpin them.”

Many European startups and SMEs say the limitations could hurt them compared to competitors.

The Future Society, an AI governance think tank, discovered that foundation model suppliers that invest much in training data—1% of their development costs—find compliance easier. Sceptics argue that this solution serves as an additional barrier to the EU’s regulatory framework, hindering innovation in an area where Europe desperately needs success stories.

Compared to the United States and China, the EU has created few AI unicorns and lagged in research. Nicolai Tangen, head of Norway’s $1.6 trillion sovereign wealth fund, which uses AI in its investment decision-making, has publicly criticised the EU’s approach: “He said, “I am not saying it is good, but in America, you have a lot of AI and no regulation; in Europe, you have no AI and a lot of regulation.”

European firms face a fragmented market, stricter data protection regulations, and difficulty retaining AI professionals. Hacker says the Act’s unjustified “bad reputation” may make things worse.

“It is not particularly stringent, but there has been a lot of negative coverage, and many investors, especially from the international venture capital (VC) scene, treat the Act as an additional risk. This will hinder European unicorns’ fundraising,” he said.

Some disagree with this assessment. The Act’s rules require VCs to add a new criterion to their scorecard: Is the company building a model or product that is and will remain EU compliant?

Dan Shellard, partner at Paris-based venture finance firm Breega, said regulation might offer regtech opportunities. Some believe it will boost innovation.

Chris Pedder, Chief Data Scientist at AI-powered edtech firm Obrizum, said forcing corporations to be more open and responsible will certainly spur innovation.

The special installation of fans’ recreations of Johannes Vermeer’s ‘Girl with a Pearl Earring’ includes Julian van Dieken’s AI-powered piece. Another issue is that technology is evolving faster than legislation. The Act doesn’t regulate open-source models like Mixtral 8x7B unless they pose a systemic risk. Making them public aims to increase transparency and accessibility, but it also poses significant safety risks.

Open-source models offer a broader range of computational capabilities, allowing many users to utilise local computing resources instead of expensive cloud-based ones.

Iain Swaine of BioCatch, a digital fraud detection startup, noted that in a decentralised system, it becomes easier to create malware, phishing sites, and deepfakes.

America is divided

The United States is behind in regulation despite its commercial AI dominance. Multiple federal agencies regulate AI, creating a fragmented regulatory framework. An executive order requires federal agencies to investigate AI usage, require AI system developers to assure ‘safe, secure, and trustworthy’ systems and share safety test results with the US government.

Donald Trump has vowed to reverse it, but it may fail without Republican support in Congress. Congress’ bipartisan AI task force has yielded little. Due to partisanship, any compromise before the November elections is improbable. Since American governments value innovation and economic progress, we project US regulation to be less severe than European regulation. Europe has no AI and lots of regulation, while America has lots of AI and little regulation.

Morgan, Lewis & Bockius partner David Plotinsky said, “AI will be an area in which both Congress and the executive branch take a very incremental approach to regulating AI—including by first applying existing regulatory frameworks to AI rather than developing entirely new frameworks.”

States could potentially fill this void. He said the risk is a “patchwork of regulations that may overlap in some areas and also conflict in others.” Apocalyptic predictions that an omnipotent AI may threaten humanity inform the debate. Some, like Elon Musk, want AI development stopped. However, mundane matters seem more urgent. The advent of monopolies, especially in generative AI, is a serious concern, but multiple ChatGPT competitors have allayed concerns that OpenAI, the business behind ChatGPT, will monopolise.

‘Our Planet Powered by AI’ author Mark Minevich said, “The industry’s high barriers to entry, such as the need for enormous data and computational power, mean that only a few huge incumbents, such as top big tech companies, could dominate.”

As AI becomes a flashpoint in the United States-China relationship, policymakers are also concerned about how legislation affects US competitiveness. In another executive order, US President Joe Biden ordered the Treasury to prohibit outbound AI investment in countries of concern and to review AI technologies for security vulnerabilities.

Plotinsky, acting chief of the US Department of Justice’s Foreign Investment Review Section, predicted that Washington would need to adopt a risk-based approach to foundation models. He also said that any risk-based approach would have to consider whether the foundation model was created in the United States or another trusted country, as well as what controls and other safety measures might be needed to keep China’s potentially powerful goals from causing concerns. National AI leadership is the government’s goal for 2030, with substantial funding.

China produces most AI research

Its Global AI Governance Initiative, which includes creating a new international AI governance organisation, shows its desire to influence global regulation. The initiative also urges “opposing drawing ideological lines or forming exclusive groups to obstruct other countries from developing AI,” a reference to US legislation restricting US investment in China’s AI business.

According to Wendy Chang, a technology analyst at the Mercator Institute for China Studies, China aspires to participate in international forums and influence the global development of AI regulation.

Domestically, Beijing’s tightly managed censorship regime needs to be maintained, often openly, by requiring generated text content to ‘reflect communist basic values.’ The EU launched a global AI standards race. Although the government encourages Chinese enterprises to build Gen AI tools to compete internationally, these beliefs may hinder China’s AI leadership. Baidu and Alibaba unveiled their AI-powered chatbots last year.

The country’s early generative AI standards required developers to verify the ‘truth, correctness, objectivity, and diversity’ of training data, a high standard for models trained on online content. Recent regulatory changes allow Chinese enterprises to ‘elevate the quality’ and ‘strengthen truthfulness’ instead of ensuring training data honesty, but hurdles remain.

One working group suggested a proportion of model-rejectable answers. Given chatbots’ potential to spread falsehoods, such regulations may require Chinese corporations to develop their models with restricted firewalled data. Chinese companies and citizens cannot use ChatGPT. After an AI tool criticised Mao Zedong, iFlytek’s founder apologised publicly. Chang said Beijing’s domestic information regulation is a major issue for AI developers.

Compliance would be difficult for tech companies, especially smaller ones, and may deter many from entering the field. We already see tech companies focusing on corporate solutions rather than public products, which the government desires.

A full AI law is due from the Chinese government, which has published specific AI regulations. The 2021 recommendation algorithm regulation was driven by concerns over their role in information dissemination, a perceived threat to political stability, and China’s concept of ‘cyber sovereignty.’ Importantly, the rule created a list of algorithms with “public opinion properties,” which means developers had to explain how their algorithms were trained and how they were used. It now covers AI models and training data, with the first LLMs passing these reviews released in August.

China’s internet authority recently issued guidelines for AI-produced deepfakes, and its deep synthesis regulation, finalised five days before ChatGPT’s debut, requires synthetically generated content to be labelled. Who owns this photo? Another rising battleground is foundation model data IP ownership.

Generative AI has stunned creative workers, prompting legal action and strikes in industries like Hollywood that were previously impervious to technological innovation. Many artists have sued generative AI platforms for creating unlicensed derivative works.

Stock image seller Getty Images sued image generation platform Stable Diffusion for copyright and trademark infringement. Financial authorities face new AI problems. Risk modelling, claims management, anti-money laundering, and fraud detection in finance increasingly use AI, posing serious hazards.

Trouble in the EU

In 2022, the Bank of England and FCA reported that 79% of UK financial services organisations used machine learning, with 14% deeming it essential. The “black box” problem, which involves algorithmic decision-making without transparency or accountability, is a major issue.

According to regulators, AI may increase systemic risks, including flash crashes, market manipulation by deepfakes, and convergent models causing digital cooperation. The industry has promised improved ‘explainability’ in how AI is used for decision-making, but this remains elusive, and regulators may fall victim to automation bias when overusing AI systems.

Scott Dawson from DECTA, a payment solutions provider, suggests that while transparency appears advantageous in theory, financial institutions often hide certain elements of their processes for legitimate reasons.

He cited fraud prevention as an example where more transparency about how financial services firms use AI systems could be counterproductive: “Telling the world what they are looking for would only make them less effective, leading to fraud.”

Another issue is algorithmic prejudice. AI in credit risk management can make loans harder to get or worsen their terms for marginalised groups. The EU’s planned Financial Data Access law, which allows financial institutions to exchange consumer data with third parties, may hurt vulnerable borrowers.

The EU AI Act classifies banks’ AI-based creditworthiness operations and life and health insurance pricing and risk assessments as high-risk activities, requiring them to comply with stricter regulations.

“New ethical challenges are triggering unintended biases, forcing the industry to reflect on the ethics of new models and think about evolving towards a new, common code of conduct for all financial institutions,” said Dun & Bradstreet head of banking and financial services, Sara de la Torre.

The platform’s proprietors responded by allowing artists to opt out and protect their IP.

Such legal action has raised the question of who owns AI-generated material—AI platforms, downstream providers, content creators, or users. Solutions include paying content creators, sharing revenue, and using open-source data.

EIP counsel Ellen Keenan-O’Malley said, “In the short term, I expect organisations to place greater reliance on contractual provisions, such as a broad intellectual property indemnity against third-party claims for infringement.”

Only the European Union has adopted a clear position; the AI Act requires model providers to take ‘adequate measures’ to safeguard copyright, including releasing full training data summaries and copyright rules. Synopsys data specialist Curtis Wilson said banning copyrighted photos for AI training will prevent AIs from mass-producing custom art.

However, the expert commented, “But it would also ban image classification AI that detects cancerous tumours.”

Europe and China want a piece of America’s tech superiority, making AI deployment geopolitical. Because AI models are growing so quickly and different approaches are used in different major economies, only bilateral agreements can work. For this reason, the tech industry thinks that global regulatory frameworks are too optimistic.

A recent Biden-Xi conference agreed to begin talks without specifics. Following a similar US-UK agreement to reduce regulatory divergence, the EU and US have agreed to strengthen AI-based technology cooperation, focusing on safety and governance.

Delivered during the first global AI summit in November at the United Kingdom’s Bletchley Park, the Bletchley Declaration called for international cooperation to mitigate AI concerns. Action has not yet followed. As politicians and tech businesses face the same headwinds that are fragmenting the global economy in an era of increasing deglobalization, unified AI regulation seems unlikely.

The EU has set the global AI standards with horizontal, and some say overly strict, rules for AI systems; the US, hampered by pre-election polarisation and the success of its AI firms, has taken a ‘wait-and-see’ approach that gives the tech industry a free hand; and China, as usual, censors domestically while trying to influence the global regulatory framework.

Morgan Wright, Chief Security Advisor at SentinelOne, an AI-powered cybersecurity platform, said, “The challenge going forward is not allowing China to dictate what standards are or promote policies regulating AI that favour them over everyone else.”

However, keeping up with technology is harder. If talkative chatbots surprised the world in 2022, the next waves of AI-powered innovation have left experts dumbfounded by their disruptive potential.

“The field is moving so fast, I am not sure that even venture capital firms not deeply immersed in the field for the last decade fully understand AI and its implications,” said Fluent Ventures founder Alexandre Lazarow.

According to Plotinsky from Morgan, Lewis & Bockius, regulators may be at a disadvantage.

He said, “The technology has evolved too rapidly for lawmakers and their staff to fully comprehend both the underlying technology and the related policy issues.”

The rapid growth of AI technology has created a complex challenge for regulators worldwide, with varying approaches emerging in the EU, US, and China. While the EU has implemented the AI Act to set global standards, its broad and stringent regulations have raised concerns among startups and investors. In contrast, the US takes a more cautious, innovation-driven stance, creating regulatory uncertainty. China, balancing innovation with tight censorship, seeks to influence global AI governance.

As AI technology advances quickly, international cooperation and adaptable regulatory frameworks are crucial. The future of AI regulation will likely hinge on finding a balance between fostering innovation and addressing the emerging risks of AI, with each region contributing its own approach to the global conversation.

The post EU AI Act: A struggle to keep up with tech appeared first on International Finance.

Sometimes a bit too inhumane. It turns out that cheaters who splice together video footage to fabricate proof or employ software that violates rules to obtain unfair advantages are the ones who create bogus records in speedrunning. Allan Cecil, a speedrunner and hacker, has made it his duty to find them.

Bans in the past

After admitting to cheating during the 2022 marathon, Done Quick has banned a speedrunner from participating in any future competitions. Additionally, it appears that the Russian player Mekarazium set a world record by completing the Metal Gear Rising: Revengeance expansion.

Mekarazium, on the other hand, presented a pre-recorded film that was assembled utilising segments of different runs rather than live gameplay. To promote the hoax, they responded to the video in real time.

While Summer Games Done Quick returned to an in-person setting for the first time since 2019, some speedrunners took part virtually. According to PCGamesN, Mekazarium was one of them that let them cheat. After reaching a charitable donation target, the player tackled the Blade Wolf DLC after first dominating MGR: Revengeance’s main campaign in a legal run.

On the other hand, spectators observed differences in the Blade Wolf gameplay. Some pointed out that while Mekarazium was playing the primary game, there were hardly any audible moments when he pressed keys on the keyboard. Mekarazium raises their right hand briefly while their persona is surveying their surroundings, despite their assertion that they were manipulating the mouse with their left hand.

Mekarazium later played down the fact that their run broke records as well. One would assume that a speedrunner who beat their own world record by 25 seconds would be ecstatic.

Mekarazium sent a message to the GDQ enforcement team that PCGamesN was able to receive.

“The Blade Wolf DLC run reward people paid for is a pre-recorded, segmented run. After switching the saves, I’ve decided to change my decision at the last minute from a real-time run,” he said.

Mekarazium stated that they wished to showcase the Blade Wolf run’s potential. They did, however, apologise and admit that they had done “an real awful thing.” They also feared what would happen to other fast runners. They went on, “I didn’t spend more time thinking about others and I acted selfishly.”

“GDQ informed Engadget in a statement that they learned yesterday that Mekazarium performed a segmented video for his DLC run at Summer Games Done Quick 2022,” he added.

Since then, Mekazarium has acknowledged this to GDQ employees as well as to certain community members. He got in touch with us and provided a paper that showed he had been planning this for more than a month, proving it was deliberate and planned.

“This is a blatant attempt to compromise the integrity of the speedrunning community, which we adore and encourage. It’s unclear from the document what precise outcome they were hoping for, but it’s obvious that they thought we wouldn’t be ready to call them out on their actions. Nonetheless, we think it is essential for the community to understand why GDQ withdrew this run. Mekazarium will not be able to run in the future, and we have removed his runs from our YouTube collection,” GDQ continued.

Unfortunately, the incident tarnished another GDQ event that was otherwise quite successful. For Doctors Without Borders, spectators and speedrunners raised just over $3 million. Still, there were a few more difficulties. The organisers had to remove a few games from the schedule because certain runs took longer than anticipated. On the last day, though, they managed to squeeze in one more Pokémon game in an attempt to maximise donations.

The diable hack of 1996

During a speech at the recent Defcon hacker conference in Las Vegas, Cecil intended to provide what he claims is proof that a speedrunning record for the 1996 Personal Computer game Diablo, which has been in the Guinness Book of World Records for over 15 years, was, in fact, the product of rule-breaking methods that ought to disqualify it.

Cecil will have assisted in disproving three high-profile speedruns in 2023 alone if he and the group of investigators he has been working with are successful in shattering the ostensibly unbreakable standard.

Cecil, better known in the gaming community as dwangoAC, started an equally obscure pastime that led him into this peculiar role as a speedrun debunker: Using emulator software to run a game in a controlled environment and discover the limits of that game’s speedrun, he is renowned for being an adept practitioner of so-called “tool-assisted speedruns”—a subset of speedrunning that some purists formerly thought to be a form of cheating.

Cecil contends that speed runs using tools, where competitors painstakingly rewind, replay, refine, and polish their runs frame by frame, can be their legitimate kind of competition or even art.

DwangoAC claims that part of the reason he became obsessed with apprehending cheaters was his desire to safeguard the little-known sport of speedrunning from people who would use the same tools covertly and misleadingly, thereby transforming tool-assisted speedruns into a form of speedrun doping rather than a legitimate pastime.

Cecil has established himself as a mainstay in the speedrunning community. He works as a staff member at the tool-assisted speedrun website TASvideos.org and has organised numerous epic speedrunning feats, including one that rewrote the game’s conclusion in Ocarina of Time using coding errors.

In addition, he is the inventor of TASBot, a robot that attaches to video game console controller ports to mimic controller inputs. This allows players to watch and validate recorded speed runs on actual gaming hardware. The robot is such a hit that, according to Cecil’s count, live streams of it have generated $1.5 million in donations for charitable organisations.

But the gamer has recently pushed his fixation with tool-assisted speedrunning in a new direction, using it to track down cheaters who jeopardise the credibility of his hobby. As he has done in all three of the records he has tried to disprove, if he can demonstrate that even a well-honed tool-assisted speedrun in a particular game isn’t faster than a supposed human record, then demonstration can act as a precursor to a suggestion that a record was probably fabricated. Additionally, he has discovered that the process of designing that tool-assisted run frequently yields fresh insights into the bounds of what is feasible or impractical for an unaided human endeavour.

Cecil may have embarked on his most contentious project yet with his latest record-breaking endeavour. He plans to showcase proof at Defcon that he believes should nullify the record of Maciej “groobo” Maselewski, a Polish speedrunner who currently owns the Guinness record for the fastest role-playing game speedrun of all time in addition to the fastest Diablo speedrun. Since 2009, Maselewski’s 3-minute and 12-second Diablo run has defeated all opponents.

Cecil claims that when he and another speedrunner, Matthew “funkmastermp” Petroff, attempted to complete a tool-assisted speed run for Diablo in January 2024, he became suspicious that Maselewski had broken the norms of speedrunning. They soon realised that no matter how good they became at running or how fortunate they were with the randomly generated dungeon layouts in the game, they would never be able to beat Maselewski’s time of 3 minutes and 12 seconds.

This prompted them to put together a team of investigators who eventually discovered what they believed to be a lengthy list of discrepancies in the items and software versions, missing frames, and other indications of possible tampering in the video of Maselewski’s run. They have compiled all of this information into a comprehensive document that has been uploaded to Cecil’s website.

When Maselewski was contacted for comment, he promptly refuted any such foul conduct. He mentioned in an email that his run was always regarded as “segmented,” edited together level by level, which is a widely recognized classification for speedrunning.

It was never mistaken for anything else, according to Maselewski.

It’s amazing to learn that a group of researchers has been working on this. Cecil shared a later text discussion between Maselewski and his associates, in which Maselewski called the effort to disprove his record a “witch hunt.”

Cecil counters that Maselewski’s straightforward explanation, that the speedrun was divided, is insufficient. He alleges that a piece of performance-enhancing software known as a “trainer” must have been used and that some dungeon layouts in Maselewski’s run could not have been generated even in a single segment of a run without changing the game’s data.

In a farewell email to WIRED the evening before Cecil’s Defcon talk, Maselewski stated that he thought individuals who were accusing him of cheating were employing inaccurate instruments and a partial understanding of Diablo’s intricacies. Dwango wants to share a narrative. Have I cheated? No, writes Maselewski.

“But the wonder of discovery has already overstayed its welcome for a select few, and the script has already been written, so it doesn’t matter what is true or not at this point,” he noted.

Cecil’s proof seems to have more of an impact on an administrator of Speed Demos Archive, or SDA, another speedrun record-keeping website where Maselewski owns a comparable Diablo record. The administrator, who goes under the pseudonym “ktwo,” claims that SDA hasn’t formally taken a decision and is still awaiting Maselewski’s explanation.

Ktwo states, “To be clear, we have reached a preliminary conclusion, based on the information provided.”

The staff is in agreement that the analysis presents issues regarding the legitimacy of the run, which must be resolved to prevent SDA from publishing the run. The runners and the administrative staff are currently debating these issues.

Speedrunner Eric “Omnigamer” Koziel started re-examining a record set by Todd Rogers for the Atari 2600 racing game Dragster in 2017 while doing research for a book about speedrunning. This is how Cecil got involved in the investigation of gaming records. Rogers has maintained his record time of 5.51 seconds for an astounding 35 years.

However, upon deconstructing Dragster’s code to attempt to decipher Rogers’s time-stamp, Koziel discovered that the strategies Rogers claimed to have employed, like shifting into second gear at the beginning of the game, wouldn’t have yielded the desired benefit.

Knowing Koziel from the speedrunning community, Cecil offered to aid in creating a tool-assisted speedrun that they could replay on a real Atari 2600 via TASBot, demonstrating that Rogers’ record was unattainable even on that original hardware. They discovered that TASBot performed theoretically flawlessly in 5.57 seconds, which was less than Rogers’ claimed time. Despite Rogers’ protests, his three-and-a-half-decade-old record was removed from Twin Galaxies’ records, along with all of his other records on the website, and Guinness removed his title for the “longest-standing video game record” worldwide.

A group of players set out to defeat every level of Super Mario Maker, and Cecil became involved in the investigation of another renowned speedrun early 2024, after taking a seven-year break to work on TASBot projects. When that Wii U game was published in 2015, players could post their levels for other players to play, that is, assuming they could upload a video of themselves beating the level. However, “Trimming the Herbs,” one of these levels, seemed unachievable. Only its inventor had been able to finish it for years.

Cecil offered to create a tool-assisted speedrun for the level in an attempt to assist this group of Super Mario Maker devotees. He discovered that, partly because of differences in the Bluetooth communications between the Wii U and its controllers, it was almost hard to clear it consistently.

In that instance, the level’s developer came forward during the investigation to admit he’d defeated the level by tampering with the internal components of his Wii U gamepad, a move he had always meant to be amusing but had never before disclosed to the public.

Cecil is not anticipating a confession or any kind of cordial agreement on the facts in his latest attempt to refute Maselewski’s Diablo record. However, he is sure that he and the researchers he has collaborated with will be able to overthrow Maselewski’s record and allow speedrunners to resume their approach to the game.

He was shocked to learn that, thanks to new Diablo strategies they discovered during their investigation, they could beat Maselewski’s record with a tool-assisted speedrun, finishing the game in 2 minutes and 45 seconds without using any of his purported rule-breaking modifications.

Cecil reports that Diablo speedrunner “xavier_sb” has finished a run of the game in less than four minutes and 40 seconds, setting a new record should Maselewski’s be wiped out.

He claims that this already demonstrates how the alleged unachievable record’s “chilling effect” is wearing off. Cecil claims that people had just given up since there was no point. The Diablo speedrunning competition has resumed.

Cecil hopes that by holding speedrunners accountable, he will contribute to the growth of both conventional speedrunning and the tool-assisted sort of speedrunning that he has helped pioneer.

According to him, the secret is to distinguish between people who utilise software tools to play games with superhuman accuracy as an honest kind of art and others who use them for dishonest purposes.

Preserving the art of speedrunning

As Cecil continues to fight for honesty in the speedrunning community, his efforts highlight a larger issue in competitive gaming: the fine line between legitimate optimisation and outright cheating. While tool-assisted speedruns push the limits of what is possible in games, they should not be confused with human achievement. Cecil believes that speedrunning, whether tool-assisted or not, should remain a space for creativity, innovation, and fairness.

The distinction between art and fraud in speedrunning comes down to transparency. Tool-assisted runs are a legitimate form of competition as long as they are presented as such. But when players use similar tools covertly to gain an unfair advantage, it threatens the credibility of the entire sport.

Cecil hopes to ensure that speedrunning continues to evolve as a thriving, legitimate sport, one that celebrates skill, creativity, and integrity.

The post Tool-assisted Speedruns stir debate in esports appeared first on International Finance.

SentinelOne’s cybersecurity researchers have detected a fresh piece of malware called LuaDream on telecom infrastructure in the Middle East, Western Europe, and South Asia.

This malware is distinct because it makes use of the LuaJIT just-in-time (JIT) compiler for the Lua programming language. The Hacker News, a news website, notes that Lua is not exactly a popular choice among hackers, with malware written in this language having only been discovered three times in the previous ten years. That includes Project Sauron, Animal Farm (also known as SNOWGLOBE), and Flame.

The researchers added that LuaDream is a modular, multi-protocol backdoor with 13 core and 21 support components. Its primary objectives are to steal user and system data and to launch new plugins, including command execution.

The researchers hypothesize that the work is a “well-executed, maintained, and actively developed project of a considerable scale” in light of the victim organizations, the endpoints on which the malware had been discovered, the unusual choice of programming language, and the type of data LuaDream looks to exfiltrate. The attackers, who were unknown at the time, reportedly went to great measures to remain undetected.

The source code specifies a date in June 2022, but the malware was discovered in August 2023, giving the researchers the impression that it had been developed for more than a year.

Despite being inconclusive, some evidence regarding the assailants’ identities pointed to Chinese actors. The “strategic” Chinese intrusions into Africa, some of which targeted telecom companies, are covered in a different SentinelOne study. These were a component of the Backdoor Diplomacy, Earth Estries, and Operation Tainted Love activity clusters. Operation Tainted Love, the latter, is said to use the same threat actor as LuaDream activities.

“Targeted intrusions by the BackdoorDiplomacy APT and the threat group orchestrating Operation Tainted Love indicate a level intention directed at supporting [China in its efforts to] shape policies and narratives aligned with its geostrategic ambitions, establishing itself as a pivotal and defining force in Africa’s digital evolution,” security researcher Tom Hegel said, TechRadar reported.

The post Malware LuaDream targeting telecom across three continents appeared first on International Finance.

An attacker connected to the same network as the victim, such as a public or corporate wifi, was able to carry out a MiTM attack, allowing them to see users’ sensitive data, like usernames and passwords or PIN codes.

This discovery will certainly be cause for alarm for many banks whose customers rely on these apps for safe and secure banking on the go.

Banks have a number of responsibilities to ensure that their customers are secure when using the bank’s mobile app:

Regular updates and testing
The bank has to ensure that its app security stack is up to date and aligned with the latest industry standards, typically by ensuring that it complies with the guidelines provided by industry best practice frameworks such as OWASP; and regularly update and test its security stack against this. Another approach is to disallow older applications from connecting to their systems.

Security testing
Banks should always aim to use external penetration testing (White-hat hackers) to externally validate applications have the correct security posture. Internal development teams are often under a lot of pressure to deliver before adequate quality assurance has been done, and they do not always have the latest skills or knowledge of new hacker exploits. Not only should the mobile be secured but also the API that it uses.

Communications to customers about updates
Banks should regularly release app updates to users via the relevant app stores and use their websites and other channels to educate users on the importance of always using the latest version of the app.

Strategic partnerships to prioritise security
In addition, banks can partner with vendors whose core business it is to look at security trends and work with them to ensure that the business unit responsible for security remains up-to-date with trends and has access to the latest digital fraud mitigation technologies.

From a user’s perspective, the top ways to minimise vulnerabilities include:

*   Always make sure to use the latest version of banking apps available.

*   Always aim to update mobile phones to the latest versions of the mobile operating system.

*   Avoid banking on public networks; this is usually a bad idea. If banking must be done in a public place, use the mobile data rather than public wifi network.

*   Be aware that several usernames and passwords have probably already been stolen in one or more mass data breaches. Aside from changing login credentials, press service providers to offer decent two-factor authentication (strong authentication) and use it as a second line of defence.

Certificate pinning

The University of Birmingham researchers pointed out that in the current case, certificate pinning – technology that would normally improve security – allowed standard security tests to fail in detecting a serious flaw that could let attackers decrypt, view and modify network traffic and take control of a victim’s online or mobile banking.

Certificate pinning is a technique used to ensure the identity of the website you are talking to by comparing the digital certificate presented against a set list of trusted certificates. Most browsers indicate that users are connecting to a legitimate website by showing a lock icon. This identification is provided by third-party authorities using digital certificates.

While the approach is generally sound, there have been cases where attackers were able to issue fake certificates and thus set up counterfeit bank websites that still register as legitimate in the browser.

Certificate pinning addresses this problem by disallowing the acceptance of any certificate that isn’t specifically listed by the bank as theirs.

Apps using certificate pinning do not allow a connection to be made to the ‘bank’ if it isn’t validated by a set list of trusted certificates. One could, of course, go further and create a certificate on the mobile side too, meaning that the bank will not connect to the app if it cannot recognise the certificate it presents. Connection between the client and the server is now mutually validated, meaning that both parties know exactly who they are talking to.

If a connection is validated and legitimated in this way, and it has been ensured that the integrity of the app is sound, the attack described by the researchers would not be feasible.

Gerhard Oosthuizen is CIO at Entersekt

The post ‘10 million banking app users at risk’ appeared first on International Finance.

Many firms believe hackers only want personal or financial data, but there is a credible risk to industrial robots.

The risk is growing as robots, like other devices, are increasingly connected to wider networks and the internet. That gives hackers more ways in, and the consequences are potentially disastrous.

In one example, attackers locked up a robotic assembly plant in Mexico and demanded a ransom from the operators.

There is also the safety risk for human factory operatives if a robot were to be hacked.

Lack of awareness and preparedness for a cyber-attack extends to robot makers. In one experiment, researchers hacked a robotic arm and forced it to mis-perform, compelling its manufacturer to plug the security hole.

Nightmare scenarios
The threat might come from disgruntled employees, criminals, recreational hackers or nation states.
One kind of attack would inject faults or defects in the production process, or lock it down completely as in the Mexican incident, leading to loss of production and revenue. If defective products make it to the market, they can cause reputational damage, a potential advantage that could motivate an attack by unscrupulous competitors.

By manipulating safety protocols, hackers could cause the robot to injure human operators, or to damage itself or the factory environment. Alternatively, attackers might attempt to steal sensitive data from the machines themselves or the wider company network through remote access.

How easy is it to hack a robot?
Ease of access to the software varies, making an inside job more likely in some scenarios. Firmware may be freely available online or retrievable from used robot CPUs, and some manufacturers allow programmers to access code in a simulation environment, creating a potential practice ground for would-be robot hackers.
Hackers have other ways to infiltrate, other than via the internet. They may attack from within the factory, for example connecting to the robot directly through a USB port, or physically accessing its computer controller directly or via remote service.

Once they have penetrated the system, they can potentially alter the controller’s parameters, tamper with calibration programmes or production logic and alter the robot’s perceived state, for example to show it is idle when it is not, or its actual state causing loss of control.

How big is the risk?
The scale of the threat could be enormous. It’s estimated there will be 1.3 million robots in factories worldwide by next year (2018) and that 12% of jobs will have been taken over by automated systems within a decade and a half. Robots are operating across almost all industrial sectors from car manufacturing to aviation and food processing.

The UK’s National Cyber Security Centre has highlighted hacking of robotic, unmanned and autonomous systems as a subject for attention, both by itself and by the intelligence organisation GCHQ.

A survey of robotic engineers by Italian academics found three quarters had never properly checked cybersecurity in their infrastructure, a third of robots were internet accessible and half of respondents didn’t see a realistic cyber security threat. To make matters worse, industrial robots often have weak authentication protocols and outdated software running on vulnerable operating systems Operators need to take the necessary precautions.

Operators of industrial robots must conduct a professional review of cybersecurity risks, have an incident response plan in place in case of a security breach and ensure that software is regularly updated, especially with security patches. The security review should look at what data robots hold and how they are potentially connected to sensitive data elsewhere on the network.

Considering the risk to production, people and facilities, it must be taken seriously from board level to operational level. An internet-connected robot should be treated with the same security precautions as any computer on the network, including setting long, complex passwords rather than relying on manufacturers’ default. There is a temptation to neglect updates because they may cause production downtime, but it needs to be given a higher priority.

Operators must make security a key factor when sourcing new industrial robots, selecting a manufacturer that shows commitment to the issue and provides frequent software updates with security patches.

Limiting who has access to robots and segmenting machines from networks where possible can also reduce risk.

Ultimately, one of the most effective precautions is also one of the most prosaic, and may comfort those who fear their jobs will be stolen by robots. It’s hard to imagine a time when we dare leave robots to get on with it, so until and unless that day comes, we need humans to keep watch on robots at work.

Ross Thomson is Principal Consultant at Amethyst Risk Management

The post Industry is not ready for robot hack threat appeared first on International Finance.

Equifax announced on September 7, 2017 that unauthorized users accessed the names, Social Security numbers, birth dates, addresses and, in some instances, driver’s license numbers of consumers from mid-may through July 2017. Equifax also admitted that credit card numbers for approximately 209,000 US consumers were accessed.

Lead plaintiffs Jamie McGonnigal and Brian Spector accuse Equifax of failing to properly secure and safeguard consumers’ personally identifiable information which resulted in criminals obtaining their personal and financial information.

The complaint alleges that not only could Equifax have prevented this data breach—especially considering the warnings raised by the recent data breach of their competitor Experian—but that once discovered, they failed to notify consumers in a timely manner. Equifax acknowledged they discovered a breach had occurred on July 29, 2017, but they failed to announce it to the public until more than a month later.

As a result of the company’s negligence and failure to properly safeguard consumers’ records, Mr. McGonnigal and Mr. Spector allege their personal and financial information was stolen and they incurred out-of-pocket costs for identity theft protection and unauthorized use of their financial accounts. In addition, they allege the likelihood of impending injuries in the future since criminals have access to their personal and financial information.

Leading Data Breach Attorney Says Equifax Breach is “Shocking”

Class action members are represented by one of the leading data breach attorneys in the country: John Yanchunis. He currently serves as lead counsel in the Yahoo data breach case, one of the largest class actions in history. Previously, he represented consumers in the Home Depot Inc. and Target Corp. data breach cases which settled for $13 million and $10 million respectively.

He has litigated some of the largest data breaches in history, yet when asked about the Equifax breach, John Yanchunis described it as “shocking.”

“Equifax contains one of the largest databases of consumer information and they should have been better prepared for any attempt to penetrate its systems,” he said.

Three Equifax Managers Sold Stock Prior to Data Breach Announcement

Coinciding with news of the data breach is information that three managers sold their stock in Equifax just prior to the announcement. After learning of these events, Attorney John Yanchunis said the data breach may justify punitive damages.

“Equifax has acknowledged that it discovered the breach on July 29th. What it hasn’t explained is why it waited so long to make an announcement that the breach had occurred,” he stated.

“The profiteering before the company’s announcement is astounding.”

Plaintiffs seek statutory damages under the Fair Credit Reporting Act (“FCRA”) and state consumer protection statutes, reimbursement of out-of-pocket losses and other compensatory damages, credit monitoring services beyond Equifax’s current two-year offer, and an order requiring Equifax to improve their data security measures.

The post Morgan & Morgan files lawsuit on behalf of millions of Equifax data breach victims appeared first on International Finance.