For my next Computer Security class. (and my Ethical Hackers)

https://www.welivesecurity.com/2020/09/22/new-tool-helps-companies-assess-why-employees-click-phishing-emails/?&web_view=true

New tool helps companies assess why employees click on phishing emails

Researchers at the US National Institute of Standards and Technology (NIST) have devised a new method that could be used to accurately assess why employees click on certain phishing emails. The tool, dubbed Phish Scale, uses real data to evaluate the complexity and quality of phishing attacks to help organizations comprehend where their (human) vulnerabilities lie.

… “The Phish Scale is intended to help provide a deeper understanding of whether a particular phishing email is harder or easier for a particular target audience to detect,” said NIST researcher Michelle Steves in the press release announcing the new tool.

Phish Scale looks at two main elements when assessing how difficult it is to detect a potential phishing email. The first variable the tool evaluates is ‘phishing email cues’ – observable signs, such as spelling mistakes, using personal email addresses rather than work emails, or using time-pressuring techniques.

Meanwhile, the second ‘alignment of the email’s context to the user’ leverages a rating system to evaluate if the context is relevant to the target – the more relevant it is, the harder it becomes to identify it as a phishing email. Based on a combination of these factors, Phishing Scale categorizes the difficulty of spotting the phish into three categories: least, moderate, and very difficult.

Could be a useful tool. Well worth reading the article!

https://themarkup.org/blacklight/2020/09/22/blacklight-tracking-advertisers-digital-privacy-sensitive-websites

The High Privacy Cost of a “Free” Website

… She said she only allowed three trackers on spartapride.org: cookies from Twitter and Facebook that accompany their “like” buttons on the site, and one from Disqus, a commenting platform she got through a prepackaged website theme she bought off the internet for $59 to build the site.

But when The Markup scanned spartapride.org using our new instant privacy inspector, Blacklight, we found 21 different ad-tech companies tracked visitors to the site, sending possible signals about people’s gender identities to advertisers—without the users’ knowledge or consent.

… The trackers loaded because Disqus sells ads on the free version of its commenting portal, and that ad space comes with third-party tracking. Disqus discloses those trackers on its own website, but the company wouldn’t comment about tracking SPART*A’s users.

… To investigate the pervasiveness of online tracking, The Markup spent 18 months building a one-of-a-kind free public tool that can be used to inspect websites for potential privacy violations in real time. Blacklight reveals the trackers loading on any site—including methods created to thwart privacy-protection tools or watch your every scroll and click.

… Try out Blacklight here. Enter a website, and Blacklight will scan it for user-tracking technologies — and who’s getting your data.

Could be worth watching to see what they come up with…

https://www.cyberscoop.com/secret-service-ciab-cyber-command/

Secret Service looks to outsiders to boost financial cybercrime probes

The U.S. Secret Service is pulling in outside expertise from the private sector and U.S. Cyber Command as it weighs changes to its investigative methods in an attempt to keep pace with international hackers.

… To formalize its interest in tapping into the private sector’s understanding of scammers’ latest tactics, the agency earlier this year established an advisory group composed of cybersecurity practitioners from the private sector, academia, and U.S. government, as CyberScoop first reported.

Known as the Cyber Investigations Advisory Board (CIAB), the group met last week for the first time and is expected to provide insights on how the Secret Service must adapt to a rapidly changing criminal underground.

(Related) The flip side of Hacker prosecution?

https://www.cyberscoop.com/story/arkady-bukh-man-in-the-middle/

Arkady Bukh Man in the Middle

How Arkady Bukh, a New York-based immigrant from the former Soviet bloc, emerged as the go-to defense lawyer for the cybercrime underworld.

How the EU sees AI.

https://fuck-videos.xxx/en/xxx/?u=~aHR0cHMlM0ElMkYlMkZ3d3cuZ290cG9ybi5jb20lMkYxOXlvLWFtYXRldXItYmFiZS1yb3VnaGZ1Y2tlZC1pbi1tYW55LXBvc2VzJTJGdmlkZW8tNjM2MjQyNQ==~&serv=21061298039585111424575239526

Artificial intelligence: threats and opportunities

Europe's growth and wealth are closely connected to how it will make use of data and connected technologies. AI can make a big difference to our lives – for better or worse - and the European Parliament has established a committee to examine the impact of the technology. Below are some key opportunities and threats connected to future applications of AI.

The volume of data produced in the world is expected to grow from 33 zettabytes in 2018 to 175 zettabytes in 2025 (one zettabyte is a thousand billion gigabytes)

Perspective. Was the topic ethical? Vegetarian (lousy hunter) ethics?

https://phys.org/news/2020-09-ethics-classes-students-moral-behavior.html

Can ethics classes actually influence students' moral behavior?

… The study found that after exposure to a philosophy article, a 50-minute discussion section, and an optional online video concerning the ethics of eating factory-farmed meat, students decreased their rates of meat purchasing from 52% to 45%. That compared to a constant rate of 52% among students in a control group exposed to similar materials on the ethics of charitable giving.

… He added the goal of the study was not specifically to convince students to eat less meat, but to find out whether philosophical ethical instruction is even capable of influencing real-world choices.

Hard to tell an ‘audition’ from a retaliation.

https://thehackernews.com/2020/09/russian-ransomware-hack.html?&web_view=true

A New Hacking Group Hitting Russian Companies With Ransomware

… The ransomware gang, codenamed "OldGremlin" and believed to be a Russian-speaking threat actor, has been linked to a series of campaigns at least since March, including a successful attack against a clinical diagnostics laboratory that occurred last month on August 11.

"The group has targeted only Russian companies so far, which was typical for many Russian-speaking adversaries, such as Silence and Cobalt, at the beginning of their criminal path," Singaporean cybersecurity firm Group-IB said in a report published today and shared with The Hacker News.

Understand the law, if not the debate.

https://www.bespacific.com/cybercrime-and-the-law-computer-fraud-and-abuse-act-and-the-116th-congress/

Cybercrime and the Law: Computer Fraud and Abuse Act and the 116th Congress

CRS report via LC – Cybercrime and the Law: Computer Fraud and Abuse Act (CFAA) and the 116th Congress, September 21, 2020: “…Since the original enactment of the CFAA in 1984, technology and the human relationship to it have continued to evolve. Although Congress has amended the CFAA on numerous occasions to respond to new conditions, the rapid pace of technological advancement continues to present novel legal issues under the statute. For example, with increasing computerization has come a corresponding proliferation of Terms of Service (ToS) agreements—contractual restrictions on computer use. But federal courts disagree on whether the CFAA imposes criminal liability for ToS violations, and the United States Supreme Court is currently considering a case on this issue. Another technological development that has created tension under the CFAA is the rise of botnets, which are networks of compromised computers often used by cyber criminals. Although the CFAA prohibits creating botnets and using them to commit certain crimes, it is unclear if selling or renting a botnet violates the statute—a potential concern given that botnet access is often rented from botnet brokers. On a more basic level, another change that has prompted some reexamination of the CFAA is the seemingly-growing frequency of computer crime. Some contend that the prevalence and perniciousness of hacking requires private actors to defend themselves by hacking back—that is, initiating some level of intrusion into the computer of the initial attacker. The same provisions of the CFAA that prohibit hacking ostensibly also make it a crime to hack back, which some legislation has sought to change…

If it’s good enough for Apple…

https://www.imore.com/swift-language-tools-now-available-windows

Swift language tools now available for Windows 10

The Swift Project, the ongoing open-source efforts to develop the Swift programming language, has announced that an initial release of Swift is now available for Windows 10. What this means is that the tools, like the compiler and core libraries, are all available for developers right now.

… You can download the Swift toolchain for Windows from the Swift Project website.

Trusting third-parties and trusting hackers – not the same thing.

https://www.infosecurity-magazine.com/news/minnesota-suffers-secondlargest/

Minnesota Suffers Second-Largest Data Breach

Hundreds of thousands of Minnesotans are receiving letters warning them that their data may have been exposed in the second-largest healthcare data breach in state history.

The letters were sent to individuals who had donated to or been a patient of Allina Health hospitals and clinics or Children’s Minnesota, a two-hospital pediatric health system in the Twin Cities.

Breach notifications warned that personal data may have been exposed following a ransomware attack on third-party vendor Blackbaud in May 2020. The South Carolina company is one of the world's largest providers of education administration, fundraising, and financial management software.

To date, over 3 million people in the United States have been impacted by the attack on Blackbaud, which has also impacted a number of universities, charities, and organizations in the United Kingdom.

… A statement on Allina's website seeks to reassure customers by rather optimistically telling them: "Blackbaud did pay the cybercriminal’s demand with confirmation that the copy of the data that they removed had been destroyed."

(Related)

https://www.zdnet.com/article/ransomware-is-evolving-but-the-key-to-preventing-attacks-remains-the-same/?&web_view=true

Ransomware is evolving, but the key to preventing attacks remains the same

… Europol's No More Ransom project is attempting to take the fight to cyber criminals by offering free decryption tools for hundreds of different families of ransomware, something which is estimated to have stopped over four million victims from giving into ransom demands.

… But the best way to protect against the potential damage of a ransomware attack is to make sure organisations, businesses and individuals have the necessary cybersecurity measures in place to avoid falling victim to ransomware in the first place.

"Prevention is the key," said Ruiz. "The main advice is keep backups of your data and keep them offline. Also it's essential that all the operating systems and anti-virus are properly updated; implement any available patch as soon as possible in order to mitigate any vulnerabilities”. It's also important that organisations teach employees how to spot a potential cyberattack.

Makes me wonder what else the “Texas government” could order. (Call out the National Guard?)

https://www.infosecurity-magazine.com/news/texas-government-spoofed/?&web_view=true

Cyber-Criminals Spoof Texas Government

Cyber-criminals have tried to receive free goods by posing as the Texas government and emailing out Requests for Quotes (RFQs).

The multi-layered email attack, in which threat actors pretended to be from the Texas Department of State Health Services, was discovered by researchers at Abnormal Security.

"If unsuspecting salespersons were to respond to this initial request, attackers could establish a line of communication and eventually follow-through with the requested goods," noted researchers.

Using what appears to be a genuine government purchase order, the attackers attempted to obtain products worth hundreds of thousands of dollars without handing over a penny.

… Careful attention had been paid by the attackers to the fine details. The deceptive email included the genuine logo of Texas Health and Human Services, and the request appeared to be sent by John William Hellerstedt, MD, the genuine commissioner of Texas Health.

Researchers noted: "The phone number provided is not associated with the 'bill to' address, although the area code is in Texas and does match the area code for the department of state health services phone number. This is a social engineering tactic aimed to engage recipients into requesting the ship to address, either by email or phone.”

What do you call it when lawyers don’t look at the law? I don’t think “misinterpretation” is the word I’d choose.

https://www.databreaches.net/legal-misinterpretation-to-blame-for-delay-in-reporting-kentucky-unemployment-breach/

Legal misinterpretation to blame for delay in reporting Kentucky unemployment breach

Matthew Glowicki reports:

An inspector general report has found there were “unacceptable” delays in reporting an April security breach of Kentucky’s unemployment system but that residents’ personal information doesn’t appear to have been misused.

The report primarily blames the monthlong delay in reporting the breach on current legal staff who relied on a holdover procedure from the previous administration that misinterpreted state law governing when breaches need to be reported.

Read more on Louisville Courier Journal.

Law and sausage.

https://www.wired.com/story/california-prop-24-fight-over-privacy-future/

The Fight Over the Fight Over California’s Privacy Future

WHEN STATE SENATOR Bob Hertzberg learned that an ambitious privacy initiative had gotten enough signatures to qualify for the ballot in California, he knew he had to act quickly.

“My objective,” he says, “was to get the damn thing off the ballot.”

… Much better, he thought, to address the problem of data privacy through the legislative process. So Hertzberg approached Mactaggart with a deal: work with him to craft a bill, and once it passes, withdraw the ballot initiative. Mactaggart agreed.

… So, about a year after the CCPA was passed—but before it had gone into effect—Hertzberg, who by then was majority leader of the California State Senate, pitched a new idea to Mactaggart. In a total reversal from his earlier stance, Hertzberg urged Mactaggart to bypass the legislative process. Instead, he should fund and draft a new ballot initiative to improve upon the CCPA. And this one wouldn’t be a bargaining chip. It would go all the way to a vote by the people of California. Thus was born the California Privacy Rights Act, which will appear on Californians’ ballots this fall as Proposition 24.

Could this set a precedent for the rest of us? IF they get Fourth Amendment protection, shouldn’t I? Will Google et al file briefs?

Seventh Circuit Examines Lifetime GPS Tracking of Sex Offenders

Joe Kelly reports:

The Seventh Circuit on Friday weighed the intrusiveness of a Wisconsin statute that institutes lifetime GPS monitoring of certain convicted sex offenders against the necessity of preventing further offenses from that particular class of criminals.

The underlying suit was first filed as a federal class action by eight registered sex offenders in March 2019. They argued that a 2017 statutory interpretation by former Wisconsin Attorney General Brad Schimel that broadened the class of sex offenders subjected to lifetime GPS monitoring after the completion of their sentences constitutes an unreasonable search under the Fourth Amendment, calling the tracking “an intrusive search that provides the government detailed, real-time data about a person’s every move.”

Read more on Courthouse News.

You mean it was Okay to hack elections before? (But will Trump veto it?)

https://thehill.com/policy/cybersecurity/517462-house-approves-legislation-making-hacking-voting-systems-a-federal-crime?&web_view=true

House approves legislation making hacking voting systems a federal crime

Not sure this is a good idea, but it should be an attractive one. Do they already have licensing agreements with Google, Facebook and others?

https://www.technologyreview.com/2020/09/21/1008654/cias-new-tech-recruiting-pitch-more-patents-more-profits/

CIA’s new tech recruiting pitch: More patents, more profits

The newest federal lab gives the CIA and its officers the unprecedented ability to make money off inventions that come from within the agency.

Even I can see this is a bluff.

https://www.vice.com/en_us/article/889pk3/facebook-threatens-to-pull-out-of-europe-if-it-doesnt-get-its-way

Facebook Says it Will Stop Operating in Europe If Regulators Don’t Back Down

… In a court filing in Dublin, Facebook said that a decision by Ireland’s Data Protection Commission (DPC) would force the company to pull up stakes and leave the 410 million people who use Facebook and photo-sharing service Instagram in the lurch.

For my Ethical Hackers. A billboard that screams, “Please shut the barn door before someone steals all the horses,” may not be the best way to alert your security teams.

https://www.zdnet.com/article/us-govt-orders-federal-agencies-to-patch-dangerous-zerologon-bug-by-monday/?&web_view=true

US govt orders federal agencies to patch dangerous Zerologon bug by Monday

The Department of Homeland Security's cybersecurity division has ordered federal civilian agencies to install a security patch for Windows Servers, citing "unacceptable risk" posed by the vulnerability to federal networks.

The DHS order was issued via an emergency directive, a rarely-used legal mechanism through which US government officials can force federal agencies into taking various actions.

The target of the DHS's latest emergency directive is CVE-2020-1472, a vulnerability also known as Zerologon.

The vulnerability is considered extremely dangerous, as it allows threat actors that have a foothold on an internal network to hijack Windows Servers running as domain controllers and effectively take over the entire network

Some scare stories...

https://www.forbes.com/sites/cindygordon/2020/09/21/why-cybersecurity-and-ai-are-top-governance-risks-for-board-directors-and-ceos/#22e0e5f66fd4

Why CyberSecurity And AI Are Top Governance Risks For Board Directors And CEOs?

Ask most board directors and CEO’s to define cybersecurity and artificial intelligence in a board meeting and have them share their answers and you may well find that their depth of knowledge is too shallow in their duty of care responsibilities.

Perspective.

https://techcrunch.com/2020/09/20/gangster-capitalism-and-the-american-theft-of-chinese-innovation/

Gangster capitalism and the American theft of Chinese innovation

… So much as China protected its industry from overseas competitors like Google and Amazon through market-entry barriers, America is now protecting its entrenched incumbents from overseas competitors like TikTok. We’re demanding joint ventures and local cloud data sovereignty just as the Communist Party has demanded for years.

Hell, we’re apparently demanding a $5 billion tax payment from ByteDance, which the president says will fund patriotic education for youth.

Have we gone beyond ‘talking’ about AI?

https://www.cio.com/article/3575542/ai-first-or-nothing.html

AI-first or nothing

5 steps to AI transformation and survival

… Data gathered from 100+ global CIOs at the Metis Strategy Digital Symposium in July 2020 personifies the trend toward AI-first operating models: 66% of CIOs stated that they have teams focused on identifying AI use cases, conducting pilots and scaling those cases that improve outcomes. Of the CIOs who do not currently have resources focused on this, roughly 60% indicated it is on their roadmap.

In our work with Fortune 500 companies, we have identified common characteristics among organizations that successfully navigate the shift to AI-first. Below are a series of smart first steps digital leaders can take to initiate, accelerate, or course correct their AI transformation.

Well, it’s a start. Other free courses & ebooks available here too.

https://www.analyticsvidhya.com/blog/2020/09/3-free-certificate-courses-data-science-machine-learning-analytics-vidhya/

Big Announcement: 3 Free Certificate Courses in Data Science and Machine Learning by Analytics Vidhya!

… The 3 Free Certified Courses Are:

• Introduction to Python

• Getting Started with Decision Trees

• Getting Started with Neural Networks

Interesting that this comes from Russia.

http://journals.rudn.ru/law/article/view/24569

COMPUTER TECHNOLOGIES FOR COMMITTING SABOTAGE AND TERRORISM

The article discusses the problems that arise in connection with the crimes against state and public security committed by use of computer and network technologies. This topic is becoming relevant because some states have already experienced the effects of “combat” computer viruses, which can be regarded as waging war using cyber weapons. The most famous example is the attack by the Stuxnet computer virus on an Iranian uranium enrichment plant. The virus was created specifically to disable industrial control systems. The use of unmanned ground and air vehicles to carry out terrorist acts is of particular danger.

… The destructive potential of cyberterrorism is determined by the widespread computerization of state and public life, the implementation of projects to create smart cities, including smart transportation, as well as the intensive development of the Internet of things. The purpose of the article is to analyze new criminal threats to state and public security, as well as to study high-tech ways of committing crimes such as sabotage, terrorist acts, and other crimes of a terrorist nature.

… The article describes some of the techniques already used to commit crimes of sabotage and terrorism.

...and you will think it’s a human writing it.

https://www.theatlantic.com/ideas/archive/2020/09/future-propaganda-will-be-computer-generated/616400/

In the Future, Propaganda Will Be Computer-Generated

Disinformation campaigns used to require a lot of human effort, but artificial intelligence will take them to a whole new level.

Don’t wait for an AI professor…

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7487209/

Emerging challenges in AI and the need for AI ethics education

Artificial Intelligence (AI) is reshaping the world in profound ways; some of its impacts are certainly beneficial but widespread and lasting harms can result from the technology as well. The integration of AI into various aspects of human life is underway, and the complex ethical concerns emerging from the design, deployment, and use of the technology serves as a reminder that it is time to revisit what future developers and designers, along with professionals, are learning when it comes to AI. It is of paramount importance to train future members of the AI community, and other stakeholders as well, to reflect on the ways in which AI might impact people’s lives and to embrace their responsibilities to enhance its benefits while mitigating its potential harms. This could occur in part through the fuller and more systematic inclusion of AI ethics into the curriculum. In this paper, we briefly describe different approaches to AI ethics and offer a set of recommendations related to AI ethics pedagogy.

(Related) If that last article was too complex…

https://dspace.mit.edu/handle/1721.1/127488

Can my algorithm be my opinion? : an AI + ethics curriculum for middle school students

Children of today can be considered "AI natives." In the same way that children of the 90s were considered to be digital natives, children of the early 2000s and 2010s have grown up in a world where much of their access to information is mediated by artificial intelligence systems. Furthermore, we expect their futures to be increasingly affected by AI, as consumers and designers. For this reason, there is a movement to teach AI concepts to K-12 students. Drawing on a tradition of scholarship in Science and Technology Studies and a surge in recent research on the ethical issues associated with the construction of AI systems, it is clear that students not only need a technical education of AI, but an education that will allow them to become conscientious consumers and ethical designers of it. This thesis presents a set of standards which describe what every child should know about the ethics of artificial intelligence: that it is not an objective or morally neutral source of information and, given that, how to design AI systems with stakeholders in mind. It then describes a series of open-source, largely unplugged activities which address these standards by blending together ethical and technical content. Finally, it presents results from a pilot where students engaged with these activities. Findings about students' initial understanding of AI and the ethical dilemmas associated with it are presented, as are students' understanding after engaging with the curriculum. After participating, students moved from seeing AI as an objective tool to a tool that can be both objective and subjective. By the end of the curriculum, students were able to identify more stakeholders of technical systems and design their own systems according to the values of those stakeholders. This work shows that students can transform into conscientious consumers and ethical designers of AI.

Explaining “explaining.”

https://www.sciencedirect.com/science/article/abs/pii/S0004370220301375

Explanation in AI and law: Past, present and future

Explanation has been a central feature of AI systems for legal reasoning since their inception. Recently, the topic of explanation of decisions has taken on a new urgency, throughout AI in general, with the increasing deployment of AI tools and the need for lay users to be able to place trust in the decisions that the support tools are recommending. This paper provides a comprehensive review of the variety of techniques for explanation that have been developed in AI and Law. We summarise the early contributions and how these have since developed. We describe a number of notable current methods for automated explanation of legal reasoning and we also highlight gaps that must be addressed by future systems to ensure that accurate, trustworthy, unbiased decision support can be provided to legal professionals. We believe that insights from AI and Law, where explanation has long been a concern, may provide useful pointers for future development of explainable AI.

Another reason to grant AI personhood?

https://qz.com/1905712/when-ai-in-healthcare-goes-wrong-who-is-responsible-2/

When AI in healthcare goes wrong, who is responsible?

Artificial intelligence can be used to diagnose cancer, predict suicide, and assist in surgery. In all these cases, studies suggest AI outperforms human doctors in set tasks. But when something does go wrong, who is responsible?

There’s no easy answer, says Patrick Lin, director of Ethics and Emerging Sciences Group at California Polytechnic State University. At any point in the process of implementing AI in healthcare, from design to data and delivery, errors are possible. “This is a big mess,” says Lin. “It’s not clear who would be responsible because the details of why an error or accident happens matters. That event could happen anywhere along the value chain.”

I wonder if the President has other software as a target for his ‘blessing?’

https://www.npr.org/2020/09/20/914032065/tiktok-ban-averted-trump-gives-oracle-walmart-deal-his-blessing

TikTok Ban Averted: Trump Gives Oracle-Walmart Deal His 'Blessing'

President Trump has given tentative approval to a deal that will keep TikTok alive in the U.S., resolving a months-long confrontation between a hit app popularized by lip-syncing teens and White House officials who viewed the service as a national security risk.

… As part of the deal rescuing TikTok, U.S. tech company Oracle is joining hands with Walmart to form a new entity called TikTok Global, which will be headquartered in the U.S.

That arrangement appears to satisfy the White House's concerns over the security of American user data, even though ByteDance is expected to hold its majority ownership position.

(Related) Just a “cost of doing business in the US?”

https://www.reuters.com/article/us-usa-china-tiktok-bytedance-idUSKCN26B039

ByteDance says not aware of $5 billion education fund in TikTok deal

TikTok owner Bytedance said in a social media post on Sunday that it was the first time it had heard in the news it was setting up a $5 billion education fund in the United States.

U.S. President Donald Trump said he had approved a deal, which included a $5 billion education fund, to allow TikTok to continue to operate in the United States.

Perspective. An impressive Infographic returns!

https://www.visualcapitalist.com/every-minute-internet-2020/

Here’s What Happens Every Minute on the Internet in 2020

[Grab it from:

https://web-assets.domo.com/blog/wp-content/uploads/2020/08/20-data-never-sleeps-8-final-01-Resize.jpg

Perhaps the greatest invention of the Pandemic Era!

https://dilbert.com/strip/2020-09-20

Something fishy here. Clearly a major hack if they needed to restore every computer but yet they can prevent it in future with a simple purchase?

https://www.kristv.com/news/local-news/school-district-reaches-out-to-fbi-following-cyberattack

School district reaches out to FBI following cyberattack

… School administrators said they were victims of a cyberattack Tuesday afternoon. "(We have) given the FBI everything they need to investigate the incident," school officials said.

Administrators said they have to go through all Windows devices in the school system, including student’s devices. They have to be scanned, reimaged, wiped, and reinstalled. The process is very time and labor-intensive.

… Administrators said they have purchased everything needed to keep this from happening again and they hope to get back to what they do best, teaching kids, on Monday.

Slicing up the law or adding to it?

https://oag.ca.gov/news/press-releases/attorney-general-becerra-announces-landmark-settlement-against-glow-inc-%E2%80%93?&web_view=true

Attorney General Becerra Announces Landmark Settlement Against Glow, Inc. – Fertility App Risked Exposing Millions of Women’s Personal and Medical Information

California Attorney General Xavier Becerra today announced a landmark settlement against Glow, Inc. (Glow), a technology company that operates a fertility-tracking mobile app that stores personal and medical information. The settlement, which is subject to court approval, resolves the Attorney General’s investigation of Glow's app for serious privacy and basic security failures that put women’s highly-sensitive personal and medical information at risk. In addition to a $250,000 civil penalty, the settlement includes injunctive terms that require Glow to comply with state consumer protection and privacy laws, and a first-ever injunctive term that requires Glow to consider how privacy or security lapses may uniquely impact women.

For my Ethical Hackers…

https://hackaday.com/2020/09/18/listening-to-an-iphone-with-am-radio/?web_view=true

LISTENING TO AN IPHONE WITH AM RADIO

Electronic devices can be surprisingly leaky, often spraying out information for anyone close by to receive. [Docter Cube] has found another such leak, this time with the speakers in iPhones. While repairing an old AM radio and listening to a podcast on his iPhone, he discovered that the radio was receiving audio the from his iPhone when tuned to 950-970kHz.

[Docter Cube] states that he was able to receive the audio signal up to 20 feet away. A number of people responded to the tweet with video and test results from different phones. It appears that iPhones 7 to 10 are affected, and there is at least one report for a Motorola Android phone. The amplifier circuit of the speaker appears to be the most likely culprit, with some reports saying that the volume setting had a big impact. With the short range the security risk should be minor, although we would be interested to see the results of testing with higher gain antennas. It is also likely that the emission levels still fall within FCC Part 15 limits.

(Ditto)

https://www.zdnet.com/article/spammers-use-hexadecimal-ip-addresses-to-evade-detection/?&web_view=true

Spammers use hexadecimal IP addresses to evade detection

… IP addresses can also be written in three other formats:

• Octal - 0300.0250.0000.0001 (by converting each decimal number to the octal base)

• Hexadecimal - 0xc0a80001 (by convert each decimal number to hexadecimal)

• Integer/DWORD - 3232235521 (by converting the hexadecimal IP to integer)

… According to a report published yesterday by Trustwave, a spam group has adopted hexadecimal IP addresses for their campaigns since mid-July earlier this year.

Doom & gloom?

https://thenextweb.com/neural/2020/09/18/a-beginners-guide-to-the-ai-apocalypse-killer-robots/

A beginner’s guide to the AI apocalypse: Killer robots

Welcome to the fifth article in TNW’s guide to the AI apocalypse. In this series we examine some of the most popular doomsday scenarios prognosticated by modern AI experts. Previous articles in this series include: Misaligned Objectives, Artificial Stupidity, Wall-E Syndrome, and Humanity Joins the Hivemind.

We’ve danced around the subject of killer robots in the previous four editions in this series, but it’s time to look the machines in their beady red eyes and… speculate.

Still a hot topic.

https://theconversation.com/gpt-3-new-ai-can-write-like-a-human-but-dont-mistake-that-for-thinking-neuroscientist-146082

GPT-3: new AI can write like a human but don’t mistake that for thinking – neuroscientist

Since it was unveiled earlier this year, the new AI-based language generating software GPT-3 has attracted much attention for its ability to produce passages of writing that are convincingly human-like. Some have even suggested that the program, created by Elon Musk’s OpenAI, may be considered or appears to exhibit, something like artificial general intelligence (AGI), the ability to understand or perform any task a human can. This breathless coverage reveals a natural yet aberrant collusion in people’s minds between the appearance of language and the capacity to think.

Lots of introductory videos. MS Office, Computer Basics, Job Search, Social Media, etc.

https://edu.gcfglobal.org/en/topics/

GCFLearnFree.org