• Risks Digest 33.95 (2/2)

    From RISKS List Owner@21:1/5 to All on Sat Dec 2 23:33:11 2023
    [continued from previous message]

    in cars every year, this is becoming an increasingly grave problem.
    In the same podcast, we also explored the booming revenue stream that
    car manufacturers are tapping into by not only collecting people's
    data, but also packaging it together for targeted advertising.
    According to the Mozilla research, popular global brands including
    BMW, Ford, Toyota, Tesla, Kia, and Subaru:

    "Can collect deeply personal data such as sexual activity,
    immigration status, race, facial expressions, weight, health and
    genetic information, and where you drive. Researchers found data is
    being gathered by sensors, microphones, cameras, and the phones and
    devices drivers connect to their cars, as well as by car apps,
    company websites, dealerships, and vehicle telematics."

    In fact, the seasoned Mozilla team said "cars are the worst product
    category we have ever reviewed for privacy" after finding that all 25
    car brands they researched earned the "Privacy Not Included" warning
    label.

    Since that doesn't give us much of a choice to go for a brand that
    respects our privacy, I suggest we turn off our phones before we start
    the car. It's both safer and better for your privacy.

    ------------------------------

    Date: Mon, 27 Nov 2023 11:51:33 -0500 (EST)
    From: ACM TechNews <technews-editor@acm.org>
    Subject: Protecting Critical Infrastructure from Cyber Attacks
    (RMIT)

    RMIT University, 22 Nov 23, via ACM TechNews

    A mathematical breakthrough by researchers at the Royal Melbourne Institute
    of Technology and tech startup Tide Foundation in Australia allows system access authority to be spread invisibly and securely across a
    network. Dubbed "ineffable cryptograph," the technology has been
    incorporated into a prototype access-control system specifically for
    critical infrastructure management, known as KeyleSSH, and successfully
    tested with multiple companies. It works by generating and operating keys across a decentralized network of servers, each operated by independent organizations. Each server in the network can only hold part of a key--no
    one can see the full keys, all the processes they are partially actioning,
    or the assets they are unlocking.

    ------------------------------

    Date: Mon, 20 Nov 2023 18:58:47 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: Crypto Crashed and Everyone's In Jail. Investors Think It's
    Coming Back Anyway. (Vice)

    https://www.vice.com/en/article/7kxmpg/crypto-crashed-and-everyones-in-jail-investors-think-its-coming-back-anyway

    ------------------------------

    Date: Wed, 29 Nov 2023 20:49:51 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: Feds seize Sinbad crypto mixer allegedly used by North Korean
    hackers (TechCrunch)

    https://techcrunch.com/2023/11/29/feds-seize-sinbad-crypto-mixer-allegedly-used-by-north-korean-hackers/

    ------------------------------

    Date: Thu, 30 Nov 2023 18:37:21 -0500
    From: Gabe Goldberg <gabe@gabegold.com>
    Subject: A lost bitcoin wallet passcode helped uncover a major security flaw
    (The Washington Post)

    If you created a bitcoin wallet before 2016, your money may be at risk -- A company that helps recover cryptocurrency discovered a software flaw putting
    as much as $1 billion at risk from hackers. Now it’s going public in hopes people will move their money before they get robbed.

    https://www.washingtonpost.com/technology/2023/11/14/bitcoin-wallet-passcode-flaw/

    ------------------------------

    Date: Thu, 30 Nov 2023 09:35:52 -0700
    From: Matthew Kruk <mkrukg@gmail.com>
    Subject: Ontario's Crypto King still jet-setting to UK,
    Miami, and soon Australia despite bankruptcy (CBC)

    https://www.cbc.ca/news/canada/toronto/ontario-crypto-king-jetsetting-abroad-while-bankrupt-1.7042719

    ------------------------------

    Date: Thu, 30 Nov 2023 08:35:24 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: British Library confirms customer data was stolen by hackers,
    with outage expected to last months (TechCrunch)

    https://techcrunch.com/2023/11/29/british-library-customer-data-stolen-ransomware/

    ------------------------------

    Date: Thu, 30 Nov 2023 08:39:33 -0500
    From: Monty Solomon <monty@roscom.com>
    Subject: PSA: Update Chrome browser now to avoid an exploit
    already in the wild (The Verge)

    https://www.theverge.com/2023/11/30/23982296/google-chrome-browser-update-sandbox-escape-exploit-security-vulnerability

    ------------------------------

    Date: Sun, 19 Nov 2023 08:39:46 -0700
    From: Matthew Kruk <mkrukg@gmail.com>
    Subject: WeWork has failed. Like a lot of other tech
    startups, it left damage in its wake (CBC)

    https://www.cbc.ca/news/business/armstrong-start-ups-wework-uber-1.7032264

    The worksharing giant WeWork was supposed to fundamentally alter the future
    of the office. It raised billions of dollars, signed leases in office
    towers across North America but filed for bankruptcy protection last week.

    Analysts say it collapsed, at least in part, because it never had a viable business model.

    "It didn't really have a clear path to profitability. It never made any
    money," said Susannah Streeter, head of money and markets at the financial services firm Hargreaves Lansdown.

    ------------------------------

    Date: Mon, 20 Nov 2023 12:00:49 -0800
    From: Rob Slade <rslade@gmail.com>
    Subject: Re: The AI Pin (RISKS-33.94)

    [Ummmmm, somehow my posting got truncated, and the risky part left off:]

    On the other hand, as we have seen in various events to do with Siri and Alexa, this is "always on" surveillance. The AI Pin will always be
    listening for commands. (And, in common with Siri, Alexa, Gboard, and all the others, those verbal commands will be sent back to HQ for processing
    into text and parsing.) By accident (and possibly by design?) it will be listening to everything that goes on around you. (And, with the camera, possibly looking, too.)

    And, if it gets popular enough, who knows what you can find out with all
    that aggregated data ...

    ------------------------------

    Date: Wed, 22 Nov 2023 09:44:45 +0000
    From: "C.J.S. Hayward" <cjsh@cjshayward.com>
    Subject: Re: Social media gets teens hooked while feeding aggression and
    impulsivity, and researchers think they know why (CBC)

    https://www.cbc.ca/news/health/smartphone-brain-nov14-1.7029406

    Kids who spend hours on their phones scrolling through social media are showing more aggression, depression and anxiety, say Canadian researchers. [...

    That is part of the dehumanizing effect I studied in "How Can I Take my
    Life Back from my Phone?", https://cjshayward.com/phone/.

    Using phones the way that seems "natural" opens a Pandora's box. Once
    privilege could be marked by not owning a television. Now privilege can be marked by not owning a phone, or as in my case, learning to use it with non-obvious ways that curb its presence as an intravenous drip of noise.

    ------------------------------

    Date: Sun, 19 Nov 2023 09:47:58 -0500
    From: Steve Singer <sws@dedicatedresponse.com>
    Subject: Re: Garble in Schneier's AI post (RISKS-33.84]

    The text of this post was garbled by software (what could possibly go
    wrong?) ;-)

    The links at the beginning and end of Schneier's post are unaffected and contain the embedded references of the original, ungarbled:

    https://www.schneier.com/blog/archives/2023/11/ten-ways-ai-will-change-democracy.html

    https://ash.harvard.edu/ten-ways-ai-will-change-democracy

    [As I remarked, Bruce's mailer encodes commas, equal signs, and other
    characters, and I try to revert to just plain ASCII where possible. PGN]

    ------------------------------

    Date: Mon, 27 Nov 2023 19:05:26 +0000
    From: Sam Bull <sam@sambull.org9wqnn1@sambull.org>
    Subject: Re: Using your iPhone to start your car is about to get a
    lot easier (RISKS-33.94)

    * The CCC Digital Key uses UWB and near-field communication (NFC), along with
    low-energy Bluetooth to send and receive communications between your phone
    and your car.

    Not much different from what Tesla has been doing for years (which both supports unlocking remotely via an API and unlocking locally via Bluetooth).

    ------------------------------

    Date: Sat, 25 Nov 2023 02:29:08 +0000
    From: Sam Bull <9wqnn1@sambull.org>
    Subject: Re: Oveview of the iLeakage Attack (Jericho, RISKS-33.93)

    Sorry... *godfather* implies at least two generations, if not three.

    Wouldn't that be *grandfather*? I'm a godfather to my sister. 0 generations

    ------------------------------

    Date: Sat, 28 Oct 2023 11:11:11 -0800
    From: RISKS-request@csl.sri.com
    Subject: Abridged info on RISKS (comp.risks)

    The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is
    comp.risks, the feed for which is donated by panix.com as of June 2011.
    SUBSCRIPTIONS: The mailman Web interface can be used directly to
    subscribe and unsubscribe:
    http://mls.csl.sri.com/mailman/listinfo/risks

    SUBMISSIONS: to risks@CSL.sri.com with meaningful SUBJECT: line that
    includes the string `notsp'. Otherwise your message may not be read.
    *** This attention-string has never changed, but might if spammers use it.
    SPAM challenge-responses will not be honored. Instead, use an alternative
    address from which you never send mail where the address becomes public!
    The complete INFO file (submissions, default disclaimers, archive sites,
    copyright policy, etc.) has moved to the ftp.sri.com site:
    <risksinfo.html>.
    *** Contributors are assumed to have read the full info file for guidelines!

    OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's
    delightfully searchable html archive at newcastle:
    http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue.
    Also, ftp://ftp.sri.com/risks for the current volume/previous directories
    or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume
    If none of those work for you, the most recent issue is always at
    http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-33.00
    ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001)
    *** NOTE: If a cited URL fails, we do not try to update them. Try
    browsing on the keywords in the subject line or cited article leads.
    Apologies for what Office365 and SafeLinks may have done to URLs.
    Special Offer to Join ACM for readers of the ACM RISKS Forum:
    <http://www.acm.org/joinacm1>

    ------------------------------

    End of RISKS-FORUM Digest 33.95
    ************************

    --- SoupGate-Win32 v1.05
    * Origin: fsxNet Usenet Gateway (21:1/5)