Lucene search
K
SchneierRecent

2960 matches found

Schneier on Security
Schneier on Security
added 2023/10/12 11:9 a.m.26 views

Bounty to Recover NIST’s Elliptic Curve Seeds

This is a fun challenge: The NIST elliptic curves that power much of modern cryptography were generated in the late 90s by hashing seeds provided by the NSA. How were the seeds generated? Rumor has it that they are in turn hashes of English sentences, but the person who picked them, Dr. Jerry...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/11 11:4 a.m.20 views

Cisco Can’t Stop Using Hard-Coded Passwords

Theres a new Cisco vulnerability in its Emergency Responder product: This vulnerability is due to the presence of static user credentials for the root account that are typically reserved for use during development. An attacker could exploit this vulnerability by using the account to log in to an...

7.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/10 11:9 a.m.9 views

Model Extraction Attack on Neural Networks

Adi Shamir et al. have a new model extraction attack on neural networks: Polynomial Time Cryptanalytic Extraction of Neural Network Models Abstract: Billions of dollars and countless GPU hours are currently spent on training Deep Neural Networks DNNs for a variety of tasks. Thus, it is essential ...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/09 11:3 a.m.45 views

AI Risks

There is no shortage of researchers and industry titans willing to warn us about the potential destructive power of artificial intelligence. Reading the headlines, one would hope that the rapid gains in AI technology have also brought forth a unifying realization of the risks--and the steps we ne...

7.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/06 7:4 a.m.21 views

Deepfake Election Interference in Slovakia

Well designed and well timed deepfake or two Slovakian politicians discussing how to rig the election: Šimečka and Denník N immediately denounced the audio as fake. The fact-checking department of news agency AFP said the audio showed signs of being manipulated using AI. But the recording was...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/05 11:12 a.m.17 views

Political Disinformation and AI

Elections around the world are facing an evolving threat from foreign actors, one that involves artificial intelligence. Countries trying to influence each others elections entered a new era in 2016, when the Russians launched a series of social media disinformation campaigns targeting the US...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/04 11:8 a.m.22 views

Malicious Ads in Bing Chat

Malicious ads are creeping into chatbots...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/03 11:1 a.m.80 views

Hacking Gas Pumps via Bluetooth

Turns out pumps at gas stations are controlled via Bluetooth, and that the connections are insecure. No details in the article, but it seems that its easy to take control of the pump and have it dispense gas without requiring payment. Its a complicated crime to monetize, though. You need to sell...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/10/02 4:40 p.m.43 views

NSA AI Security Center

The NSA is starting a new artificial intelligence security center: The AI security centers establishment follows an NSA study that identified securing AI models from theft and sabotage as a major national security challenge, especially as generative AI technologies emerge with immense...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/29 9:7 p.m.26 views

Friday Squid Blogging: Protecting Cephalopods in Medical Research

From Nature: Cephalopods such as octopuses and squid could soon receive the same legal protection as mice and monkeys do when they are used in research. On 7 September, the US National Institutes of Health NIH asked for feedback on proposed guidelines that, for the first time in the United States...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/27 11:8 a.m.22 views

Critical Vulnerability in libwebp Library

Both Apple and Google have recently reported critical vulnerabilities in their systems--iOS and Chrome, respectively--that are ultimately the result of the same vulnerability in the libwebp library: On Thursday, researchers from security firm Rezillion published evidence that they said made it...

7.2AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/26 11:15 a.m.13 views

Signal Will Leave the UK Rather Than Add a Backdoor

Totally expected, but still good to hear: Onstage at TechCrunch Disrupt 2023, Meredith Whittaker, the president of the Signal Foundation, which maintains the nonprofit Signal messaging app, reaffirmed that Signal would leave the U.K. if the countrys recently passed Online Safety Bill forced Signa...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/22 9:9 p.m.15 views

Friday Squid Blogging: New Squid Species

An ancient squid: New research on fossils has revealed that a vampire-like ancient squid haunted Earths oceans 165 million years ago. The study, published in June edition of the journal Papers in Palaeontology, says the creature had a bullet-shaped body with luminous organs, eight arms and sucker...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/21 11:3 a.m.23 views

New Revelations from the Snowden Documents

Jake Appelbaums PhD thesis contains several new revelations from the classified NSA documents provided to journalists by Edward Snowden. Nothing major, but a few more tidbits. Kind of amazing that that all happened ten years ago. At this point, those documents are more historical than anything...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/20 11:6 a.m.13 views

On the Cybersecurity Jobs Shortage

In April, Cybersecurity Ventures reported on extreme cybersecurity job shortage: Global cybersecurity job vacancies grew by 350 percent, from one million openings in 2013 to 3.5 million in 2021, according to Cybersecurity Ventures. The number of unfilled jobs leveled off in 2022, and remains at 3...

6.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/19 11:8 a.m.14 views

Detecting AI-Generated Text

There are no reliable ways to distinguish text written by a human from text written by an large language model. OpenAI writes: Do AI detectors work? In short, no. While some including OpenAI have released tools that purport to detect AI-generated content, none of these have proven to reliably...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/18 11:2 a.m.13 views

Using Hacked LastPass Keys to Steal Cryptocurrency

Remember last November, when hackers broke into the network for LastPass--a password database--and stole password vaults with both encrypted and plaintext data for over 25 million users? Well, theyre now using that data break into crypto wallets and drain them: $35 million and counting, all going...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/15 9:8 p.m.15 views

Friday Squid Blogging: Cleaning Squid

Two links on how to properly clean squid. I learned a few years ago, in Spain, and got pretty good at it. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/15 7:12 p.m.15 views

LLM Summary of My Book Beyond Fear

Claude Anthropics LLM was given this prompt: Please summarize the themes and arguments of Bruce Schneiers book Beyond Fear. Im particularly interested in a taxonomy of his ethical arguments--please expand on that. Then lay out the most salient criticisms of the book. Claudes reply: Heres a brief...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/15 11:15 a.m.18 views

On Technologies for Automatic Facial Recognition

Interesting article on technologies that will automatically identify people: With technology like that on Mr. Leyvands head, Facebook could prevent users from ever forgetting a colleagues name, give a reminder at a cocktail party that an acquaintance had kids to ask about or help find someone at ...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/14 4:1 p.m.16 views

Upcoming Speaking Engagements

This is a current list of where and when I am scheduled to speak: Im speaking at swampUP 2023 in San Jose, California, on September 13, 2023 at 11:35 AM PT. The list is maintained on this page...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/14 11:5 a.m.13 views

Fake Signal and Telegram Apps in the Google Play Store

Google removed fake Signal and Telegram apps from its Play store. An app with the name Signal Plus Messenger was available on Play for nine months and had been downloaded from Play roughly 100 times before Google took it down last April after being tipped off by security firm ESET. It was also...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/13 11:13 a.m.71 views

Zero-Click Exploit in iPhones

Make sure you update your iPhones: Citizen Lab says two zero-days fixed by Apple today in emergency security updates were actively abused as part of a zero-click exploit chain dubbed BLASTPASS to deploy NSO Groups Pegasus commercial spyware onto fully patched iPhones. The two bugs, tracked as...

4.4CVSS6.6AI score0.15263EPSS
Exploits2
Schneier on Security
Schneier on Security
added 2023/09/12 11:20 a.m.11 views

Cars Have Terrible Data Privacy

A new Mozilla Foundation report concludes that cars, all of them, have terrible data privacy. All 25 car brands we researched earned our Privacy Not Included warning label--making cars the official worst category of products for privacy that we have ever reviewed. Theres a lot of details in the...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/11 11:4 a.m.56 views

On Robots Killing People

The robot revolution began long ago, and so did the killing. One day in 1979, a robot at a Ford Motor Company casting plant malfunctioned--human workers determined that it was not going fast enough. And so twenty-five-year-old Robert Williams was asked to climb into a storage rack to help move...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/08 9:3 p.m.18 views

Friday Squid Blogging: Glass Squid Video

Heres a fantastic video of Taonius Borealis, a glass squid, from NOAA. As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered. Read my blog posting guidelines here...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/08 11:5 a.m.28 views

LLMs and Tool Use

Last March, just two weeks after GPT-4 was released, researchers at Microsoft quietly announced a plan to compile millions of APIs--tools that can do everything from ordering a pizza to solving physics equations to controlling the TV in your living room--into a compendium that would be made...

6.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/07 11:9 a.m.21 views

The Hacker Tool to Get Personal Data from Credit Bureaus

The new site 404 Media has a good article on how hackers are cheaply getting personal information from credit bureaus: This is the result of a secret weapon criminals are selling access to online that appears to tap into an especially powerful set of data: the targets credit header. This is...

6.6AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/06 11:5 a.m.16 views

Cryptocurrency Startup Loses Encryption Key for Electronic Wallet

The cryptocurrency fintech startup Prime Trust lost the encryption key to its hardware wallet--and the recovery key--and therefore $38.9 million. It is now in bankruptcy. I cant understand why anyone thinks these technologies are a good idea...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/05 11:3 a.m.18 views

Inconsistencies in the Common Vulnerability Scoring System (CVSS)

Interesting research: Shedding Light on CVSS Scoring Inconsistencies: A User-Centric Study on Evaluating Widespread Security Vulnerabilities Abstract: The Common Vulnerability Scoring System CVSS is a popular method for evaluating the severity of vulnerabilities in vulnerability management. In th...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/01 9:29 p.m.18 views

Friday Squid Blogging: We’re Genetically Engineering Squid Now

Is this a good idea? The transparent squid is a genetically altered version of the hummingbird bobtail squid, a species usually found in the tropical waters from Indonesia to China and Japan. Its typically smaller than a thumb and shaped like a dumpling. And like other cephalopods, it has a...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/09/01 11:7 a.m.14 views

Spyware Vendor Hacked

A Brazilian spyware app vendor was hacked by activists: In an undated note seen by TechCrunch, the unnamed hackers described how they found and exploited several security vulnerabilities that allowed them to compromise WebDetetive’s servers and access its user databases. By exploiting other flaws...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/31 11:6 a.m.11 views

Own Your Own Government Surveillance Van

A used government surveillance van is for sale in Chicago: So how was this van turned into a mobile spying center? Well, lets start with how it has more LCD monitors than a Counterstrike LAN party. They can be used to monitor any of six different video inputs including a videoscope camera. A...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/30 1:39 p.m.10 views

When Apps Go Rogue

Interesting story of an Apple Macintosh app that went rogue. Basically, it was a good app until one particular update…when it went bad. With more official macOS features added in 2021 that enabled the "Night Shift" dark mode, the NightOwl app was left forlorn and forgotten on many older Macs. Few...

6.7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/29 11:3 a.m.17 views

Identity Theft from 1965 Uncovered through Face Recognition

Interesting story: Napoleon Gonzalez, of Etna, assumed the identity of his brother in 1965, a quarter century after his siblings death as an infant, and used the stolen identity to obtain Social Security benefits under both identities, multiple passports and state identification cards, law...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/28 11:5 a.m.22 views

Remotely Stopping Polish Trains

Turns out that its easy to broadcast radio commands that force Polish trains to stop: …the saboteurs appear to have sent simple so-called "radio-stop" commands via radio frequency to the trains they targeted. Because the trains use a radio system that lacks encryption or authentication for those...

7.3AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/25 9:6 p.m.12 views

Friday Squid Blogging: China’s Squid Fishing Ban Ineffective

China imposed a "pilot program banning fishing in parts of the south-west Atlantic Ocean from July to October, and parts of the eastern Pacific Ocean from September to December." However, the conservation group Oceana analyzed the data and figured out that the Chinese werent fishing in those area...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/25 11:3 a.m.20 views

Hacking Food Labeling Laws

This article talks about new Mexican laws about food labeling, and the lengths to which food manufacturers are going to ensure that they are not effective. There are the typical high-pressure lobbying tactics and lawsuits. But theres also examples of companies hacking the laws: Companies like...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/24 11:24 a.m.18 views

Parmesan Anti-Forgery Protection

The Guardian is reporting about microchips in wheels of Parmesan cheese as an anti-forgery measure...

7AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/23 11:6 a.m.19 views

December’s Reimagining Democracy Workshop

Imagine that weve all--all of us, all of society--landed on some alien planet, and we have to form a government: clean slate. We dont have any legacy systems from the US or any other country. We dont have any special or unique interests to perturb our thinking. How would we govern ourselves? Its...

6.5AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/22 11:4 a.m.23 views

Applying AI to License Plate Surveillance

License plate scanners arent new. Neither is using them for bulk surveillance. Whats new is that AI is being used on the data, identifying "suspicious" vehicle behavior: Typically, Automatic License Plate Recognition ALPR technology is used to search for plates linked to specific crimes. But in...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/21 11:10 a.m.21 views

White House Announces AI Cybersecurity Challenge

At Black Hat last week, the White House announced an AI Cyber Challenge. Gizmodo reports: The new AI cyber challenge which is being abbreviated "AIxCC" will have a number of different phases. Interested would-be competitors can now submit their proposals to the Small Business Innovation Research...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/18 9:2 p.m.16 views

Friday Squid Blogging: Squid Brand Fish Sauce

Squid Brand is a Thai company that makes fish sauce: It is part of Squid Brands range of "personalized healthy fish sauces" that cater to different consumer groups, which include the Mild Fish Sauce for Kids and Mild Fish Sauce for Silver Ages. It also has a Vegan Fish Sauce. As usual, you can al...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/18 11:4 a.m.25 views

Bots Are Better than Humans at Solving CAPTCHAs

Interesting research: "An Empirical Study & Evaluation of Modern CAPTCHAs": Abstract: For nearly two decades, CAPTCHAS have been widely used as a means of protection against bots. Throughout the years, as their use grew, techniques to defeat or bypass CAPTCHAS have continued to improve. Meanwhile...

7.1AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/17 11:7 a.m.13 views

Detecting “Violations of Social Norms” in Text with AI

Researchers are trying to use AI to detect "social norms violations." Feels a little sketchy right now, but this is the sort of thing that AIs will get better at. Like all of these systems, anything but a very low false positive rate makes the detection useless in practice. News article...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/16 11:17 a.m.18 views

UK Electoral Commission Hacked

The UK Electoral Commission discovered last year that it was hacked the year before. Thats fourteen months between the hack and the discovery. It doesnt know who was behind the hack. We worked with external security experts and the National Cyber Security Centre to investigate and secure our...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/15 11:3 a.m.23 views

Zoom Can Spy on Your Calls and Use the Conversation to Train AI, But Says That It Won’t

This is why we need regulation: Zoom updated its Terms of Service in March, spelling out that the company reserves the right to train AI on user data with no mention of a way to opt out. On Monday, the company said in a blog post that theres no need to worry about that. Zoom execs swear the compa...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/14 11:2 a.m.15 views

China Hacked Japan’s Military Networks

The NSA discovered the intrusion in 2020--we dont know how--and alerted the Japanese. The Washington Post has the story: The hackers had deep, persistent access and appeared to be after anything they could get their hands on--plans, capabilities, assessments of military shortcomings, according to...

6.9AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/11 9:9 p.m.13 views

Friday Squid Blogging: NIWA Annual Squid Survey

Results from the National Institute of Water and Atmospheric Research Limited annual squid survey: This year, the team unearthed spectacular large hooked squids, weighing about 15kg and sitting at 2m long, a Taningia--­which has the largest known light organs in the animal kingdom­--and a few...

6.8AI score
Exploits0
Schneier on Security
Schneier on Security
added 2023/08/11 11:8 a.m.14 views

The Inability to Simultaneously Verify Sentience, Location, and Identity

Really interesting "systematization of knowledge" paper: "SoK: The Ghost Trilemma" Abstract: Trolls, bots, and sybils distort online discourse and compromise the security of networked platforms. User identity is central to the vectors of attack and manipulation employed in these contexts. However...

6.9AI score
Exploits0
Total number of security vulnerabilities2960