2960 matches found
Bounty to Recover NIST’s Elliptic Curve Seeds
This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late 90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry...
Cisco Can’t Stop Using Hard-Coded Passwords
Theres a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an...
Model Extraction Attack on Neural Networks
Adi Shamir et al. have a new model extraction attack on neural networks: Polynomial Time Cryptanalytic Extraction of Neural Network Models Abstract: Billions of dollars and countless GPU hours are currently spent on training Deep Neural Networks DNNs for a variety of tasks. Thus, it is essential ...
AI Risks
There is no shortage of researchers and industry titans willing to warn us about the potential destructive power of artificial intelligence. Reading the headlines, one would hope that the rapid gains in AI technology have also brought forth a unifying realization of the risks--and the steps we ne...
Deepfake Election Interference in Slovakia
Well designed and well timed deepfake or two Slovakian politicians discussing how to rig the election: Šimečka and Denník N immediately denounced the audio as fake. The fact-checking department of news agency AFP said the audio showed signs of being manipulated using AI. But the recording was...
Political Disinformation and AI
Elections around the world are facing an evolving threat from foreign actors, one that involves artificial intelligence. Countries trying to influence each others elections entered a new era in 2016, when the Russians launched a series of social media disinformation campaigns targeting the US...
Malicious Ads in Bing Chat
Malicious ads are creeping into chatbots...
Hacking Gas Pumps via Bluetooth
Turns out pumps at gas stations are controlled via Bluetooth, and that the connections are insecure. No details in the article, but it seems that its easy to take control of the pump and have it dispense gas without requiring payment. Its a complicated crime to monetize, though. You need to sell...
NSA AI Security Center
The NSA is starting a new artificial intelligence security center: The AI security centers establishment follows an NSA study that identified securing AI models from theft and sabotage as a major national security challenge, especially as generative AI technologies emerge with immense...
Friday Squid Blogging: Protecting Cephalopods in Medical Research
From Nature: Cephalopods such as octopuses and squid could soon receive the same legal protection as mice and monkeys do when they are used in research. On 7 September, the US National Institutes of Health NIH asked for feedback on proposed guidelines that, for the first time in the United States...
Critical Vulnerability in libwebp Library
Both Apple and Google have recently reported critical vulnerabilities in their systems--iOS and Chrome, respectively--that are ultimately the result of the same vulnerability in the libwebp library: On Thursday, researchers from security firm Rezillion published evidence that they said made it...
Signal Will Leave the UK Rather Than Add a Backdoor
Totally expected, but still good to hear: Onstage at TechCrunch Disrupt 2023, Meredith Whittaker, the president of the Signal Foundation, which maintains the nonprofit Signal messaging app, reaffirmed that Signal would leave the U.K. if the countrys recently passed Online Safety Bill forced Signa...
Friday Squid Blogging: New Squid Species
An ancient squid: New research on fossils has revealed that a vampire-like ancient squid haunted Earths oceans 165 million years ago. The study, published in June edition of the journal Papers in Palaeontology, says the creature had a bullet-shaped body with luminous organs, eight arms and sucker...
New Revelations from the Snowden Documents
Jake Appelbaums PhD thesis contains several new revelations from the classified NSA documents provided to journalists by Edward Snowden. Nothing major, but a few more tidbits. Kind of amazing that that all happened ten years ago. At this point, those documents are more historical than anything...
On the Cybersecurity Jobs Shortage
In April, Cybersecurity Ventures reported on extreme cybersecurity job shortage: Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, according to Cybersecurity Ventures. The number of unfilled jobs leveled off in 2022, and remains at 3...
Detecting AI-Generated Text
There are no reliable ways to distinguish text written by a human from text written by an large language model. OpenAI writes: Do AI detectors work? In short, no. While some including OpenAI have released tools that purport to detect AI-generated content, none of these have proven to reliably...
Using Hacked LastPass Keys to Steal Cryptocurrency
Remember last November, when hackers broke into the network for LastPass--a password database--and stole password vaults with both encrypted and plaintext data for over 25 million users? Well, theyre now using that data break into crypto wallets and drain them: $35 million and counting, all going...
Friday Squid Blogging: Cleaning Squid
Two links on how to properly clean squid. I learned a few years ago, in Spain, and got pretty good at it. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
LLM Summary of My Book Beyond Fear
Claude Anthropics LLM was given this prompt: Please summarize the themes and arguments of Bruce Schneiers book Beyond Fear. Im particularly interested in a taxonomy of his ethical arguments--please expand on that. Then lay out the most salient criticisms of the book. Claudes reply: Heres a brief...
On Technologies for Automatic Facial Recognition
Interesting article on technologies that will automatically identify people: With technology like that on Mr. Leyvands head, Facebook could prevent users from ever forgetting a colleagues name, give a reminder at a cocktail party that an acquaintance had kids to ask about or help find someone at ...
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak: Im speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page...
Fake Signal and Telegram Apps in the Google Play Store
Google removed fake Signal and Telegram apps from its Play store. An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also...
Zero-Click Exploit in iPhones
Make sure you update your iPhones: Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain dubbed BLASTPASS to deploy NSO Groups Pegasus commercial spyware onto fully patched iPhones. The two bugs, tracked as...
Cars Have Terrible Data Privacy
A new Mozilla Foundation report concludes that cars, all of them, have terrible data privacy. All 25 car brands we researched earned our Privacy Not Included warning label--making cars the official worst category of products for privacy that we have ever reviewed. Theres a lot of details in the...
On Robots Killing People
The robot revolution began long ago, and so did the killing. One day in 1979, a robot at a Ford Motor Company casting plant malfunctioned--human workers determined that it was not going fast enough. And so twenty-five-year-old Robert Williams was asked to climb into a storage rack to help move...
Friday Squid Blogging: Glass Squid Video
Heres a fantastic video of Taonius Borealis, a glass squid, from NOAA. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...
LLMs and Tool Use
Last March, just two weeks after GPT-4 was released, researchers at Microsoft quietly announced a plan to compile millions of APIs--tools that can do everything from ordering a pizza to solving physics equations to controlling the TV in your living room--into a compendium that would be made...
The Hacker Tool to Get Personal Data from Credit Bureaus
The new site 404 Media has a good article on how hackers are cheaply getting personal information from credit bureaus: This is the result of a secret weapon criminals are selling access to online that appears to tap into an especially powerful set of data: the targets credit header. This is...
Cryptocurrency Startup Loses Encryption Key for Electronic Wallet
The cryptocurrency fintech startup Prime Trust lost the encryption key to its hardware wallet--and the recovery key--and therefore $38.9 million. It is now in bankruptcy. I cant understand why anyone thinks these technologies are a good idea...
Inconsistencies in the Common Vulnerability Scoring System (CVSS)
Interesting research: Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities Abstract: The Common Vulnerability Scoring System CVSS is a popular method for evaluating the severity of vulnerabilities in vulnerability management. In th...
Friday Squid Blogging: We’re Genetically Engineering Squid Now
Is this a good idea? The transparent squid is a genetically altered version of the hummingbird bobtail squid, a species usually found in the tropical waters from Indonesia to China and Japan. Its typically smaller than a thumb and shaped like a dumpling. And like other cephalopods, it has a...
Spyware Vendor Hacked
A Brazilian spyware app vendor was hacked by activists: In an undated note seen by TechCrunch, the unnamed hackers described how they found and exploited several security vulnerabilities that allowed them to compromise WebDetetive’s servers and access its user databases. By exploiting other flaws...
Own Your Own Government Surveillance Van
A used government surveillance van is for sale in Chicago: So how was this van turned into a mobile spying center? Well, lets start with how it has more LCD monitors than a Counterstrike LAN party. They can be used to monitor any of six different video inputs including a videoscope camera. A...
When Apps Go Rogue
Interesting story of an Apple Macintosh app that went rogue. Basically, it was a good app until one particular update…when it went bad. With more official macOS features added in 2021 that enabled the "Night Shift" dark mode, the NightOwl app was left forlorn and forgotten on many older Macs. Few...
Identity Theft from 1965 Uncovered through Face Recognition
Interesting story: Napoleon Gonzalez, of Etna, assumed the identity of his brother in 1965, a quarter century after his siblings death as an infant, and used the stolen identity to obtain Social Security benefits under both identities, multiple passports and state identification cards, law...
Remotely Stopping Polish Trains
Turns out that its easy to broadcast radio commands that force Polish trains to stop: …the saboteurs appear to have sent simple so-called "radio-stop" commands via radio frequency to the trains they targeted. Because the trains use a radio system that lacks encryption or authentication for those...
Friday Squid Blogging: China’s Squid Fishing Ban Ineffective
China imposed a "pilot program banning fishing in parts of the south-west Atlantic Ocean from July to October, and parts of the eastern Pacific Ocean from September to December." However, the conservation group Oceana analyzed the data and figured out that the Chinese werent fishing in those area...
Hacking Food Labeling Laws
This article talks about new Mexican laws about food labeling, and the lengths to which food manufacturers are going to ensure that they are not effective. There are the typical high-pressure lobbying tactics and lawsuits. But theres also examples of companies hacking the laws: Companies like...
Parmesan Anti-Forgery Protection
The Guardian is reporting about microchips in wheels of Parmesan cheese as an anti-forgery measure...
December’s Reimagining Democracy Workshop
Imagine that weve all--all of us, all of society--landed on some alien planet, and we have to form a government: clean slate. We dont have any legacy systems from the US or any other country. We dont have any special or unique interests to perturb our thinking. How would we govern ourselves? Its...
Applying AI to License Plate Surveillance
License plate scanners arent new. Neither is using them for bulk surveillance. Whats new is that AI is being used on the data, identifying "suspicious" vehicle behavior: Typically, Automatic License Plate Recognition ALPR technology is used to search for plates linked to specific crimes. But in...
White House Announces AI Cybersecurity Challenge
At Black Hat last week, the White House announced an AI Cyber Challenge. Gizmodo reports: The new AI cyber challenge which is being abbreviated "AIxCC" will have a number of different phases. Interested would-be competitors can now submit their proposals to the Small Business Innovation Research...
Friday Squid Blogging: Squid Brand Fish Sauce
Squid Brand is a Thai company that makes fish sauce: It is part of Squid Brands range of "personalized healthy fish sauces" that cater to different consumer groups, which include the Mild Fish Sauce for Kids and Mild Fish Sauce for Silver Ages. It also has a Vegan Fish Sauce. As usual, you can al...
Bots Are Better than Humans at Solving CAPTCHAs
Interesting research: "An Empirical Study & Evaluation of Modern CAPTCHAs": Abstract: For nearly two decades, CAPTCHAS have been widely used as a means of protection against bots. Throughout the years, as their use grew, techniques to defeat or bypass CAPTCHAS have continued to improve. Meanwhile...
Detecting “Violations of Social Norms” in Text with AI
Researchers are trying to use AI to detect "social norms violations." Feels a little sketchy right now, but this is the sort of thing that AIs will get better at. Like all of these systems, anything but a very low false positive rate makes the detection useless in practice. News article...
UK Electoral Commission Hacked
The UK Electoral Commission discovered last year that it was hacked the year before. Thats fourteen months between the hack and the discovery. It doesnt know who was behind the hack. We worked with external security experts and the National Cyber Security Centre to investigate and secure our...
Zoom Can Spy on Your Calls and Use the Conversation to Train AI, But Says That It Won’t
This is why we need regulation: Zoom updated its Terms of Service in March, spelling out that the company reserves the right to train AI on user data with no mention of a way to opt out. On Monday, the company said in a blog post that theres no need to worry about that. Zoom execs swear the compa...
China Hacked Japan’s Military Networks
The NSA discovered the intrusion in 2020--we dont know how--and alerted the Japanese. The Washington Post has the story: The hackers had deep, persistent access and appeared to be after anything they could get their hands on--plans, capabilities, assessments of military shortcomings, according to...
Friday Squid Blogging: NIWA Annual Squid Survey
Results from the National Institute of Water and Atmospheric Research Limited annual squid survey: This year, the team unearthed spectacular large hooked squids, weighing about 15kg and sitting at 2m long, a Taningia--which has the largest known light organs in the animal kingdom--and a few...
The Inability to Simultaneously Verify Sentience, Location, and Identity
Really interesting "systematization of knowledge" paper: "SoK: The Ghost Trilemma" Abstract: Trolls, bots, and sybils distort online discourse and compromise the security of networked platforms. User identity is central to the vectors of attack and manipulation employed in these contexts. However...