The RISKS Digest
Volume 34 Issue 21

Saturday, 27th April 2024

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

AI deepfakes threaten to upend global elections. No one can stop them.
WashPost
Tesla's Autopilot and Full Self-Driving linked to hundreds of crashes, dozens of deaths
The Verge
Cisco Says Hackers Subverted Its Security Devices to Spy on Governments
Reuters
Hackers Use Developing Countries as Testing Ground for New Ransomware Attacks
Ellesheva Kissin
9 Disturbing Stories From People Who Say They Found Cameras in Their Airbnb
Gizmodo
Millions of IPs remain infected by USB worm years after its creators left it for dead
ArsTechnica
Chinese Firm Is America's Favorite Drone Maker, Except in Washington
NYTimes
Stop Using Your Face or Thumb to Unlock Your Phone
Gizmodo
How Google's SGE Could Destroy the Internet
Lauren Weinstein
FTC questions Amazon's use of disappearing messages on Signal
WashPost
FTC says Amazon executives destroyed potential evidence by using apps like Signal
The Verge
Tech brands are forcing AI into your gadgets, whether you asked for it or not
ArsTechnica
Health insurance giant Kaiser will notify millions of a data breach after sharing patients’ data with advertisers
TechCrunch
Chaturbate Owes Texas $675,000 for Not Verifying the Age of Users
Gizmodo
Android TV has access to your entire account, but Google is changing that
ArsTechnica
Health insurance giant Kaiser will notify millions of a data breach after sharing patients’ data with advertisers
TechCrunch
We're always fighting the last war
Henry Baker
Prescient Fiction: 'Forbidden Planet' & 21st C. AI
Henry Baker
Info on RISKS (comp.risks)

AI deepfakes threaten to upend global elections. No one can stop them. (WashPost)

Peter Neumann <neumann@csl.sri.com>
Sat, 27 Apr 2024 8:37:31 PDT
Pranshu Verma and Cat Zakrzewski,  *The Washington Post*

Elections from India to Europe have been assailed by AI deepfakes that
spread quickly and are no longer easy to debunk—leaving voters
vulnerable.

https://www.washingtonpost.com/technology/2024/04/23/ai-deepfake-election-2024-us-india/


Tesla's Autopilot and Full Self-Driving linked to hundreds of crashes, dozens of deaths (The Verge)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:31:09 -0400
https://www.theverge.com/2024/4/26/24141361/tesla-autopilot-fsd-nhtsa-investigation-report-crash-death

In March 2023, a North Carolina student was stepping off a school bus when
he was struck by a Tesla Model Y traveling at “highway speeds,” according to
a federal investigation that published today. The Tesla driver was using
Autopilot, the automaker’s advanced driver-assist feature that Elon Musk
insists will eventually lead to fully autonomous cars.

The 17-year-old student who was struck was transported to a hospital by
helicopter with life-threatening injuries. But what the investigation found
after examining hundreds of similar crashes was a pattern of driver
inattention, combined with the shortcomings of Tesla’s technology, resulting
in hundreds of injuries and dozens of deaths.

Drivers using Autopilot or the system’s more advanced sibling, Full
Self-Driving, “were not sufficiently engaged in the driving task,” and
Tesla’s technology “did not adequately ensure that drivers maintained their
attention on the driving task,” NHTSA concluded.


Cisco Says Hackers Subverted Its Security Devices to Spy on Governments (Reuters)

ACM TechNews <technews-editor@acm.org>
Fri, 26 Apr 2024 11:40:26 -0400 (EDT)
Raphael Satter, *Reuters*, 24 Apr 2024, via ACN TechNews

Cisco Systems on Wednesday said that hackers have subverted some of its
digital security devices to break into government networks globally. In a
blog post, Cisco said its Adaptive Security Appliances had previously
unknown vulnerabilities that had been exploited by a group of hackers they
dubbed "UAT4356." The company described the group as a "sophisticated
state-sponsored actor." Cisco said the vulnerabilities have been patched.


Hackers Use Developing Countries as Testing Ground for New Ransomware Attacks (Ellesheva Kissin)

ACM TechNews <technews-editor@acm.org>
Fri, 26 Apr 2024 11:40:26 -0400 (EDT)
Ellesheva Kissin, *Financial Times*, 24 Apr 2024, via ACN TechNews

Cybersecurity firm Performanta reported that businesses in Africa, Asia, and
South America increasingly are being used by hackers as testing grounds for
their latest ransomware before they turn to higher-value targets in North
America and Europe. Recent dry runs in developing countries focused on a
Senegalese bank, a Chilean financial services company, a Colombian tax firm,
and a government economic agency in Argentina.


9 Disturbing Stories From People Who Say They Found Cameras in Their Airbnb (Gizmodo)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:47:27 -0400
https://gizmodo.com/airbnb-hidden-cameras-shocking-stories-bedroom-night-1851433108

Airbnb announced in March that all indoor security cameras would be banned
at its properties worldwide starting April 30. And if you read through
online complaints about cameras that were discovered during Airbnb stays
over the years, it’s easy to understand why it’s been such a controversial
issue.

Gizmodo filed a Freedom of Information Act request with the FTC for any
consumer complaints filed about Airbnb that involved cameras. Some of the
complaints are fairly mundane, and simply mention how cameras may have been
used to prove things that break the rules at Airbnb properties. But others
are pretty horrifying and involve hidden cameras in places where people
expect privacy.


Millions of IPs remain infected by USB worm years after its creators left it for dead (ArsTechnica)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:57:18 -0400
https://arstechnica.com/?p=2020055


Chinese Firm Is America's Favorite Drone Maker, Except in Washington (NYTimes)

ACM TechNews <technews-editor@acm.org>
Fri, 26 Apr 2024 11:40:26 -0400 (EDT)
Kate Kelly and Julian E. Barnes. *The New York Times*, 25 Apr 2024,
via ACN TechNews

The Countering CCP Drones Act, under consideration by the U.S. Congress,
would threaten the commercial business of DJI, a Chinese drone manufacturer
that dominates sales among U.S. law enforcement agencies and hobbyists. The
legislation would put the company on a Federal Communications Commission
roster that would prevent it from running on U.S. communications
infrastructure.  Researchers found vulnerabilities in an app that controls
DJI's drones could be used to access personal data (a U.S. official said all
known vulnerabilities currently have been patched).


Stop Using Your Face or Thumb to Unlock Your Phone (Gizmodo)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:47:58 -0400
Last week, the 9th Circuit Court of Appeals in California released a ruling
that concluded state highway police were acting lawfully when they forcibly
unlocked a suspect's phone using their fingerprint. You probably didn’t hear
about it. The case didn’t get a lot of coverage, especially because the
courts weren’t giving a blanket green light for every cop to shove your
thumb to your screen during an arrest. But it’s another toll of the warning
bell that reminds you to not trust biometrics to keep your phone’s sensitive
info private. In many cases, especially if you think you might interact with
the police (at a protest, for example), you should seriously consider
turning off biometrics on your phone entirely.
https://gizmodo.com/stop-using-your-face-or-thumb-to-unlock-your-phone-1851438205


How Google's SGE Could Destroy the Internet (Lauren Weinstein)

Lauren Weinstein <lauren@vortex.com>
Sat, 27 Apr 2024 09:26:18 -0700
Google's LLM AI SGE ("Search Generative Experience") could effectively
destroy the Internet for all but the largest sites—the same
Internet that #Google so effectively helped to build.

This is becoming clear as SGE rolls out to most users, with SGE
"answers" now appearing on a vast number of Google queries. Leaving
aside the serious questions around the accuracy of such responses and
everything associated with that, the mere presence of the responses
could be devastating to most sites.

These SGE answers are frequently verbose and can take up much of the
entire first screen—or more—of the results pages. This means you
may have to scroll down to even FIND the first organic "blue link"
results. Devastating.

To be clear, many of the SGE responses are themselves showing links to
the answers' source materials (e.g., in colored boxes)—but the
obvious question is, why the hell would most users bother to click on
those links once they already have the answers that Google's LLM has
provided, based on the information that Google sucked without
compensation into their LLM from those sites? It's impossible to
imagine that click through rates to those sites won't be crushed.

Google executives appear to be thrilled with how well this is going --
FOR THEM. For the sites providing the data that is now powering
Google's SGE encroaching, destructive storm, it's likely going to be a
disaster, unless Google and other AI firms make major changes in their
deployment models—whether voluntarily or under the force of new
regulatory models. -L


FTC questions Amazon's use of disappearing messages on Signal (WashPost)

Peter Neumann <neumann@csl.sri.com>
Fri, 26 Apr 2024 14:44:21 PDT
*The Washington Post*, 26 Apr 2026
https://www.washingtonpost.com/technology/2024/04/26/amazon-ftc-messages-de=ted-bezos/

The Federal Trade Commission is accusing Amazon founder Jeff Bezos and
other top company executives of using disappearing messaging apps such
as Signal to conceal potential evidence in the agency's ongoing
antitrust case against the e-commerce behemoth.

  “For years, Amazon's top executives, including founder and former CEO
  Jeff Bezos, discuss[ed] sensitive business matters, including antitrust,
  over the Signal encrypted-messaging app instead of email,'' the FTC
  alleged in a document filed Thursday evening.  “These executives turned
  on Signal's *disappearing message* feature, which irrevocably destroys
  messages, even after Amazon was on notice that Plaintiffs were
  investigating its conduct.''

  The agency, which first accused Amazon of intentionally deleting messages
  in its original antitrust complaint last fall, is now asking a U.S.
  District Court judge to order the company to turn over documents related
  to its handling of data. It's the latest salvo in a landmark case in which
  the FTC is arguing that Amazon abused its dominance of e-commerce to
  squeeze merchants and bury rivals, leading to higher prices for   Bezos owns The Washington Post.

  “The FTC's contentions are baseless,'' Amazon spokesman Tim Doyle said in
  a statement, responding to the filing alleging destruction of evidence.
  “Amazon voluntarily disclosed employees' limited Signal use to the FTC
  years ago, thoroughly collected Signal conversations from its employees'
  phones, and allowed agency staff to inspect those conversations even when
  they had nothing to do with the FTC's investigation. The FTC has a
  complete picture of Amazon's decision-making in this case, including 1.7
  million documents from sources like email, internal messaging
  applications, and laptops (among other sources), and over 100 terabytes of
  data.''  [..]


FTC says Amazon executives destroyed potential evidence by using apps like Signal (The Verge)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:32:39 -0400
https://www.theverge.com/2024/4/26/24141801/ftc-amazon-antitrust-signal-ephemeral-messaging-evidence


Tech brands are forcing AI into your gadgets, whether you asked for it or not (ArsTechnica)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:54:32 -0400
https://arstechnica.com/gadgets/2024/04/ai-marketing-hype-is-coming-for-your-favorite-gadgets


Health insurance giant Kaiser will notify millions of a data breach after sharing patients’ data with advertisers (TechCrunch)

"Monty Solomon" <monty@roscom.com>
Fri, 26 Apr 2024 19:43:32 -0400
https://techcrunch.com/2024/04/25/kaiser-permanente-health-plan-million
s-data-breach/


Chaturbate Owes Texas $675,000 for Not Verifying the Age of Users (Gizmodo)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:45:49 -0400
https://gizmodo.com/chaturbate-porn-age-verification-law-ken-paxton-pornhub-1851439770


Android TV has access to your entire account, but Google is changing that (ArsTechnica)

Monty Solomon <monty@roscom.com>
Fri, 26 Apr 2024 19:51:57 -0400
https://arstechnica.com/?p=2020252


Health insurance giant Kaiser will notify millions of a data breach after sharing patients’ data with advertisers

"Monty Solomon" <monty@roscom.com>
Fri, 26 Apr 2024 19:43:32 -0400
https://techcrunch.com/2024/04/25/kaiser-permanente-health-plan-million
s-data-breach/


We're always fighting the last war

"Henry Baker" <hbaker1@pipeline.com>
Sat, 27 Apr 2024 03:34:57 +0000
The first few minutes of the Pearl Harbor attack which caused the U.S. entry
into WWII sadly proved Billy Mitchell 100% correct.  The good news re
Dec. 7th—if there was any—was that no U.S. aircraft carriers were in
Pearl Harbor that day.

Ditto with the 'Millennium Challenge 2002' wargames, in which essentially
the entire U.S. Mediterranean fleet was 'virtually' sunk within days using
'asymmetric warfare'.

Ditto with 'cheap drones' in the current Ukraine war; they have rebalanced the battle between
infantry—now equipped with cheap drones for surveillance and attack—and tanks—a balance
which has existed for a century since the battle tank appeared near the end of WWI.

Cheap drones put into serious question most—if not almost all—of the
'prevailing wisdom' re strategy/tactics/weapons of modern warfare.  These
put big '?' marks next to *every* 'big ticket' asset in modern warfare --
from $billion ships/aircraft carriers, to $100m fighters, to $10m battle
tanks, to $billion spy satellites.  In chess terminology, coordinated pawns
beat rare expensive bishops, rooks, and queens.

https://nationalinterest.org/blog/reboot/exact-day-navy-battleships-became-obsolete-clear-209558

"In 1921, General Billy Mitchell, a vocal advocate of airpower, staged a
controversial exercise sinking obsolete battleship with bombers. This
foreshadowed the dominance of aircraft carriers in World War II despite
Mitchell's goal of a separate air force. The Navy initially dismissed his
claims, but the sinking of the 'unsinkable' German battleship Ostfriesland
proved the vulnerability of battleships."

"Mitchell believed that aviation—which could respond to both air and
naval threats—much better suited to protecting the country's coastline
than battleships. Mitchell was fond of stating that a thousand bombers could
be purchased for the cost of a single battleship, and told a House
subcommittee that properly equipped, an Air Service could sink any
battleship in existence."

https://www.msn.com/en-us/news/world/ar-AA1nIxGp

"Cheap Russian drones overwhelm US-made Abrams tanks, taken out of action"

"Ukrainian forces are withdrawing US-provided Abrams M1A1 main battle tanks
from the front lines after at least five have been destroyed by cheap
Russian drones, according to the AP."

"The failure of the Abrams to make a difference is a costly miscalculation.
The export cost of an Abrams tank can be around $10mn, while Col. Markus
Reisner, an Austrian military trainer who follows the weapons being used in
Ukraine, told the Euromaidan Press that the Russian suicide drones being
used to destroy them can be as cheap as $500 each (a ratio of 20,000:1)."

https://en.wikipedia.org/wiki/Millennium_Challenge_2002

"In a preemptive strike, Red launched a massive salvo of cruise missiles
that overwhelmed the Blue forces' electronic sensors and destroyed sixteen
warships: one aircraft carrier, ten cruisers and five of Blue's six
amphibious ships. An equivalent success in a real conflict would have
resulted in the deaths of over 20,000 service personnel. Soon after the
cruise missile offensive, another significant portion of Blue's navy was
"sunk" by an armada of small Red boats, which carried out both conventional
and suicide attacks that capitalized on Blue's inability to detect them as
well as expected."

https://www.theguardian.com/world/2002/sep/06/usa.iraq

"In the first few days of the [Millennium Challenge] exercise, using
surprise and unorthodox tactics, the wily 64-year-old Vietnam veteran sank
most of the US expeditionary fleet in the Persian Gulf, bringing the US
assault to a halt."


Prescient Fiction: 'Forbidden Planet' & 21st C. AI

Henry Baker <hbaker1@pipeline.com>
Fri, 26 Apr 2024 00:44:55 +0000
All of the recent discussions of the risks of AI bring to mind the
incredibly prescient movie (& radio play) 'Forbidden Planet':

https://en.wikipedia.org/wiki/Forbidden_Planet

In addition to being a pretty decent takeoff on Shakespeare's 'The Tempest',
the movie version of 'Forbidden Planet' introduces us to talking robots (now
almost passe !), and incredibly power- hungry planet-sized data centers
capable of turning human thoughts into reality.

Amazingly, this 1956 movie still holds up for modern viewers, thanks to the
supplanting of typical cheesy 1950's scifi effects in favor of laserlike
animations and electronic music.

The risks of AI, according to this movie: be very careful what you wish for,
because an AI with access to planet-sized energy capabilities can fulfill
even your worst nightmare.

Your choice: watch it again (safely) in movie form, or watch it play out in
real life.

BTW, I listened as a young boy to a radio serial version of Forbidden Planet
during the summer of either 1955 or 1956; but after extensive Google
searching, I have been unable to find a reference to this radio play
version. I know exactly where I was while listening to it on my
grandmother's huge radio with quite decent fidelity; perhaps someone else
here also heard it at the same time?

Please report problems with the web pages to the maintainer

x
Top