The RISKS Digest
Volume 33 Issue 54

Sunday, 27th November 2022

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

Why artificial intelligence is now a primary concern for Henry Kissinger
David Ignatius
Alphabet installed software on user devices without their knowledge, permission, or even data enabled.
Mark E Jeftovic via Peter Houppermans
Major tax-filing websites secretly share income data with Meta
Ars Technica
Thinking about taking your computer to the repair shop? Be very afraid
Ars Technica
The airport of the future is the airport of today—and that's not good.
PapersPlease
What Riding in a Self-Driving Tesla Tells Us About the Future of Autonomy
NYTimes
ID.me made baseless pandemic fraud claims to win contracts, Congress says
Ars Technica
Redacted Documents Are Not as Secure as You Think
WiReD
The World Generates So Much Data, New Unit Measurements Were Created to Keep Up
NPR
Massive Twitter data breach was far worse than reported, reveal security researchers
9to5mac
Twitter, Mastodon Handle, and App
Paul Roberts
Idle Crypto Is the Devil's Workshop
The New York Times
What Happens When Crypto Meets Ted Lasso
NYTimes
U.S. authorities seize iSpoof, a call spoofing site that stole millions
Tech Crunch
How Amazon shopping ads are disguised as real results
WashPost
RansomExx joins the ranks of ransomware gangs switching to Rust
Cybernews
How a Jewish Group's Online Surveillance Uncovered a Synagogue Plot
NYTimes
Sundry twitter items
Lauren Weinstein PGN-culled
Elon's phone confusion
Lauren Weinstein
They Weren't Rich But They Wanted to invest. Then They Lost Everything on FTX
Mother Jones
Re: NordStream
Nicolas Flamant Yotti
Info on RISKS (comp.risks)

hy artificial intelligence is now a primary concern for Henry Kissinger (David Ignatius)

Monty Solomon <monty@roscom.com>
Sat, 26 Nov 2022 16:06:27 -0500

David Ignatius, The Washington Pst, 24 Nov 2022 If leading powers don't find ways to limit AI's reach, Henry Kissinger warns, “it is simply a mad race for some catastrophe.”

https://www.washingtonpost.com/opinions/2022/11/24/artificial-intelligence-risk-kissinger-warning-weapons/


Alphabet installed software on user devices without their knowledge, permission, or even data enabled.

Peter Houppermans <peter@houppermans.net>
Wed, 23 Nov 2022 07:04:27 +0100

I picked this up via Mark E Jeftovic's Axis of Easy, and it's worth paying attention to:

https://www.zerohedge.com/political/lawsuit-claims-massachusetts-installed-covid-19-spyware-1-million-devices

I merely summarize:

  1. Software was installed by Google, sorry, Alphabet on behalf of a government without the user's involvement or knowledge;
  2. This installation was explicitly hidden from the user;
  3. Alphabet appears to have means to enable data downloads explicitly against the wishes of the user.

Major tax-filing websites secretly share income data with Meta (Ars Technica)

Monty Solomon <monty@roscom.com>
Tue, 22 Nov 2022 16:29:53 -0500

Financial data was sent to Meta by TaxAct, H&R Block, and TaxSlayer.

https://arstechnica.com/tech-policy/2022/11/major-tax-filing-websites-secretly-share-income-data-with-meta/


Thinking about taking your computer to the repair shop? Be very afraid (Ars Technica)

Monty Solomon <monty@roscom.com>
Tue, 22 Nov 2022 16:31:38 -0500

Not surprisingly, female customers bear the brunt of the privacy violations.

https://arstechnica.com/information-technology/2022/11/half-of-computer-repairs-result-in-snooping-of-sensitive-data-study-finds/


The airport of the future is the airport of today—and that's not good. (PapersPlease)

“Edward Hasbrouck” <edward@hasbrouck.org>
November 24, 2022 11:39:33 JST

A case study and post-pandemic holday travel horror story: https://papersplease.org/wp/2022/11/23/the-airport-of-the-future-is-the-airport-of-today-and-thats-not-good/

Today, the day before Thanksgiving, will probably be the busiest day for air travel in the USA since the outbreak of the COVID-19 pandemic in early 2020. If you are flying this week for the first time in three years, what will you see that has changed? Unfortunately, many of the most significant changes made during the pandemic are deliberately invisible—which is part of that makes them so evil.

During the pandemic, largely unnoticed, the dystopian surveillance-by design airport of the future that we've been worried and warning about for many years has become, in many places, the airport of today.

While travelers were sheltering in place during the COVID-19 pandemic, airports have taken advantage of the opportunity to move ahead with expansion and renovation projects. While passenger traffic was reduced, and terminals and other airport facilities were operating well below capacity, disruptions due to construction could be minimized.

A characteristic feature of almost all new or newly-renovated major airports in the U.S. and around the world is that they are designed and built on the assumption that all passengers' movements within the airport will be tracked at all times, and that all phases of passenger processing will be carried out automatically using facial recognition.

In the airport of the future, or in a growing number of present-day airports, there's no need for a government agency or airline that wants to use facial recognition to install cameras or data links for that purpose. As in the new International Arrivals Facility at Sea-Tac Airport, which opened this year, the cameras and connectivity are built into the facility as common-use public-private infrastructure shared by airlines, government agencies, and the operator of the airport—whether that's a public agency (as with almost all U.S. airports) or a private company (as with many foreign airports).

This integrated and as-invisible-as-possible surveillance infrastructure exemplifies the malign convergence of interests between government agencies that want to identify and track travelers for pre-crime predictive profiling and control, and airlines and airports (motivated by business efficiency even when they are operated by instrumentalities of state and local governments) that want to use the same hardware, and data from government ID databases, for business process automation and revenue maximization.

That malign convergence of interests extends to an interest in making surveillance tech inconspicuous and, if it is visible at all, making it appear normal and unavoidable. Neither government agencies nor travel companies nor airports want travelers to notice or question what is happening, or want to take responsibility for it. If travelers ask questions, airlines want to be able to answer, “the Federal government made us do it”, even if that isn't true (as it unquestionably isn't for U.S. citizens or any domestic flyers within the U.S.).

The integration of facial recognition into the airport structure makes these surveillance systems and practices much less visible—by design—than retrofitted or standalone surveillance cameras. Their positioning along the flow of passengers from airport entrance to aircraft door makes it almost impossible to pass through the airport and board a plane without being photographed, identified, and tracked.

Opting out is, in these new airports and terminals, a purely theoretical option for travelers who already know their rights (without being given notice of them), figure out how to assert them (again without notice) and who are willing to put up with additional questioning, search, and/or delay.

More: https://papersplease.org/wp/2022/11/23/the-airport-of-the-future-is-the-airport-of-today-and-thats-not-good/


What Riding in a Self-Driving Tesla Tells Us About the Future of Autonomy (NYTimes)

Monty Solomon <monty@roscom.com>
Sun, 27 Nov 2022 13:51:14 -0500

https://www.nytimes.com/interactive/2022/11/14/technology/tesla-self-driving-flaws.html


ID.me made baseless pandemic fraud claims to win contracts, Congress says (Ars Technica)

Monty Solomon <monty@roscom.com>
Tue, 22 Nov 2022 16:40:38 -0500

https://arstechnica.com/tech-policy/2022/11/id-me-made-baseless-pandemic-fraud-claims-to-win-contracts-congress-says/


Redacted Documents Are Not as Secure as You Think (WiReD)

Monty Solomon <monty@roscom.com>
Fri, 25 Nov 2022 21:52:50 -0500

https://www.wired.com/story/redact-pdf-online-privacy/


The World Generates So Much Data, New Unit Measurements Were Created to Keep Up (NPR)

ACM TechNews <technews-editor@acm.org>
Wed, 23 Nov 2022 12:01:56 -0500 (EST)

Ashley Ahn, NPR, 19 Nov 2022

Four new prefixes to the International System of Units were announced by the 27th General Conference on Weights and Measures on 18 Nov 2022, marking the first expansion of the metric system since 1991. The new prefixes are ronna (27 zeroes after the first digit) and quetta (30 zeroes) at the top of the measurement range, and ronto (27 zeroes after the decimal point) and quecto (30 zeroes) at the bottom. Said the UK's National Physical Laboratory (NPL), “The change was largely driven by the growing requirements of data science and digital storage, which is already using prefixes at the top of the existing range (yottabytes and zettabytes, for expressing huge quantities of digital information).” NPL indicated ronto and quecto will be useful in quantum science and particle physics.


Massive Twitter data breach was far worse than reported, reveal security researchers (9to5mac)

Monty Solomon <monty@roscom.com>
Fri, 25 Nov 2022 22:19:11 -0500

https://9to5mac.com/2022/11/25/massive-twitter-data-breach/


Twitter, Mastodon Handle, and App

Paul Roberts <paulroberts@gmail.com>
Wed, 23 Nov 2022 17:14:43 -0500

I think we're seeing an Elon Musk blindspot. Essentially: he's purchased a social network, but seems to think that the secret to making it work is the same as the solution for Tesla and SpaceX—namely: excellent engineering. Undoubtedly, there are ways to improve the Twitter platform, as Mudge has pointed out. But what has kept users coming to Twitter and giving it high-quality content is the social network bit, not the platform, per se. It is having people you respect there, alongside you, sharing ideas and engaging in conversations. Musk—who is clearly not gifted in person-to-person interactions—just misses that. That's also why he doesn't see why the TwitChan platform he's unleashed, in which trolls hurl racial, misogynistic and antisemitic epithets, conspiracy theories, and unbridled hate speech without consequence will drive people away from the commons rather than draw them to it.

You can have an amazing social media platform, but without creatives to provide it with content, Twitter is doomed. Looking at Twitter purely from the engineering/coding perspective misses this bigger, deeper truth for Twitter. Alas, Musk has missed the window to get this right, hold on to the critical 10% of creatives and thinkers who provide 90% of the content and promote Twitter as a “pro social” platform with—perhaps—a slightly more coarse filter (literally).

Next stop: bankruptcy.


Idle Crypto Is the Devil's Workshop (The New YorkTimes)

Gabe Goldberg <gabe@gabegold.com>
Sun, 27 Nov 2022 22:40:03 -0500

The newest monetary system in the world may be undone by the oldest problem there is.

A few weeks ago, Sam Bankman-Fried's FTX cryptocurrency exchange collapsed in a classic run. Investors were spooked by evidence that the exchange had mismanaged their money and couldn't pay them back, so they panicked. And they were right. They couldn't get their money back.

The blockchain technology behind cryptocurrency was supposed to make events like this a thing of the past. But FTX's business was to serve as a gateway into (and out of) cryptocurrency. That business still depends on humans to serve as honest gatekeepers. And we've seen over and over that humans can't resist the main temptation that comes with this role: to use their customers' money for their own purposes.

https://www.nytimes.com/2022/11/27/opinion/ftx-sam-bankman-fried-fullenkamp.html


What Happens When Crypto Meets Ted Lasso (NYTimes)

Monty Solomon <monty@roscom.com>
Sun, 27 Nov 2022 13:43:42 -0500

What Happens When Crypto Meets Ted Lasso

A group of American cryptocurrency investors is trying to turn an obscure English soccer club into the Internet's team with a global following of crypto[currency] enthusiasts.

https://www.nytimes.com/2022/11/06/business/crypto-soccer-crawley.html


U.S. authorities seize iSpoof, a call spoofing site that stole millions (Tech Crunch)

Monty Solomon <monty@roscom.com>
Thu, 24 Nov 2022 15:57:13 -0500

https://techcrunch.com/2022/11/24/ispoof-seized/


How Amazon shopping ads are disguised as real results (WashPost)

Monty Solomon <monty@roscom.com>
Fri, 25 Nov 2022 01:23:46 -0500

https://www.washingtonpost.com/technology/interactive/2022/amazon-shopping-ads/


RansomExx joins the ranks of ransomware gangs switching to Rust (Cybernews)

Monty Solomon <monty@roscom.com>
Sun, 27 Nov 2022 10:09:34 -0500

https://cybernews.com/news/ransomexx-switching-to-rust/


How a Jewish Group's Online Surveillance Uncovered a Synagogue Plot (NYTimes)

Monty Solomon <monty@roscom.com>
Sun, 27 Nov 2022 13:04:11 -0500

The Community Security Initiative of the UJA-Federation of New York sounded the alarm that set off the manhunt that ended in two arrests.

https://www.nytimes.com/2022/11/22/nyregion/nyc-synagogue-threats-twitter.html


Sundry twitter items (PGN-culled)

Lauren Weinstein <lauren@vortex.com>
Tue, 22 Nov 2022 21:15:32 -0800

Sam Bankman-Fried, Elon Musk, and a secret text https://www.semafor.com/article/11/22/2022/sam-bankman-fried-elon-and-a-secret-text

Elon Musk Tweets Defense of Cop Who Killed Unarmed Black Man in Ferguson Missouri

https://gizmodo.com/elon-musk-tweets-cop-killed-unarmed-black-man-ferguson-1849815713

Musk running another phony poll to bring back most suspended users:

“Should Twitter offer a general amnesty to suspended accounts, provided that they have not broken the law or engaged in egregious spam?”

Now you know why people are referring to Elon's Twitter as $8chan. It's headed toward being the most toxic place on the Net for however long it lasts—which isn't likely to be long under these conditions. -L

High-profile Apple executive overseeing App Store deleted his Twitter account, which had over 200,000 followers https://finance.yahoo.com/news/high-profile-apple-executive-overseeing-142618165.html

Elon Musk Inherited Twitter's Child Abuse Nightmare—Experts Say He's Making It Worse

https://www.forbes.com/sites/alexandralevine/2022/11/18/elon-musk-twitter-csam-lawsuit/


Elon's phone confusion

Lauren Weinstein <lauren@vortex.com>
Sat, 26 Nov 2022 08:28:27 -0800

It was amusing yesterday hearing Musk talking about “building his own phone” if #Twitter is tossed from the #Apple and #Google app stores for violations of their Terms of Service. Notably, his comment gives us instant insight into his lack of knowledge in this area. Let's review:

  1. There was already supposed to be a Tesla Pi phone to be available by perhaps the end of this year. Maybe it will arrive in a fully self-driving Tesla without a human driver.
  2. He doesn't actually need to build his own phone. If he wants an Elon phone, he could just rebrand one of the many Chinese Android clone phones (though notably, most of these will not have Play Store access, see below).
  3. The phone isn't the problem for a toxic Twitter. The ecosystems are the issue. The Apple and Google smartphones ecosystems are built to provide end-to-end security for apps, best effort protection against malware (e.g., Google's Play Store “Play Protect” that scans apps for malware), and so on. If an app is not in the app stores, you can't easily run that app. Sure, Elon could sell a clone phone with his pay-to-play Twitter app already installed, but that phone would not be expected to have access to the Google Play Store for other apps unless they were preloaded also. Now you also need an update mechanism for the apps. Essentially, you have to build an entire new ecosystem.
  4. Apple currently locks down their iOS devices tightly against non-app store apps. This will be changing with new EU rules coming into force. On the other hand, Google has always permitted sideloading of (non-Play Store) Android apps by knowledgeable users. Technically, Elon could promote users sideloading a Twitter app on Android (and presumably eventually iOS) to bypass app store restrictions. However, there is definitely significantly increased friction and potential for user confusion in this model.
  5. We've heard Elon complain about the cut that the Apple and Google app stores take from app revenues. This of course only is an issue if your app isn't free and/or is charging users for something. This tends to validate the observation that Elon wants to turn all Twitter users into an ongoing profit center—thus his talk about crypto, banking, etc. via Twitter, and his “anything app” fixation. While he may be able to convince significant numbers of users to pay him continuously for now worthless blue checks, the extent to which large numbers of Internet users will want to participate in a “your entire life belongs to Elon” app/banking ecosystem remains to be seen. -L

They Weren't Rich But They Wanted to invest. Then They Lost Everything on FTX (Mother Jones)

Gabe Goldberg <gabe@gabegold.com>
Fri, 25 Nov 2022 01:34:22 -0500

The amateur investors who trusted the crypto platform have lost a shot at financial stability. He Lost $17,000 in Crypto. https://www.motherjones.com/politics/2022/11/ftx-ftt-users-losses-alameda-sam-bankman-fried/

Here's How to Avoid His Mistake: He's not the first person to suffer this fate, but hopefully he can be the last. https://www.wired.com/story/i-lost-17000-dollars-crypto-how-to-avoid/


Re: NordStream (RISKS-33.50 and RISKS-33.52)

“Nicolas Flamant Yotti” <nicolas.flamant@papernest.com>
Tue, 22 Nov 2022 13:19:13 +0000

My colleague Kendall sent you some information about the aftermath of the nordstream pipe bursting which was uploaded here right away: https://seclists .org/risks/2022/q4/3 Here is a follow-up.

Carbon offsetting

<https://t.sidekickopen84.com/s3t/c/5/f18dQhb0S7kF8bWDTTW1C5FXw59hl3kW7_k2841CX6NGN36PYCpvfv7lW7vZ0Py3jpv0Sf197v5Y04?te=W3R5hFj4cm2zwW4mKLS-4cRxF8W3F7sbd3ZSz4qW3FbmCt3XvbfRW3K3psD3K76ZWW3P8KrX3zgCBpW41p0wR3M7MSgf4fJfX_V3&si=8000000023715636&pi=b900d744-9de6-431f-eb58-041670f2b14f>

Projects estimate the emissions they have prevented by predicting how much deforestation and land clearing would have occurred without them. The reductions are then sold on as credits. We found their predictions were often inconsistent with previous levels of deforestation in the area and in some cases, the threat to the trees may have been overstated.

There is a reason that Indigenous Environmental Network and Indigenous Climate Action held a protest against offsetting at COP26, the UN's annual climate conference: Offsetting incentivises the commodification of nature and allows powerful corporations to take over the lands of vulnerable communities, risking human rights abuses. Offset schemes often exclude local and Indigenous Peoples from land management practises that allow them to grow food and preserve biodiversity. <https://t.sidekickopen84.com/s3t/c/5/f18dQhb0S7kF8bWDTTW1C5FXw59hl3kW7_k2841CX6NGN36PYCpvfv7lW7vZ0Py3jpv0Sf197v5Y04?te=W3R5hFj4cm2zwW4mKLS-3T1jVGW45Nq0H3K78fMW3FbmCt3Xv9WMW3T0W843JF3YjW3zdZ6p1LBDN_W4cgyYh45n4V3W3F9cm73zhrNGW4cQK1L3T3KWNW41QW513K77SmW4cfM1M3M7MSgW4fJfX_1GysvpW1YZrlM24RsJK39x12&si=8000000023715636&pi=b900d744-9de6-431f-eb58-041670f2b14f> <https://t.sidekickopen84.com/s3t/c/5/f18dQhb0S7kF8bWDTTW1C5FXw59hl3kW7_k2841CX6NGN36PYCpvfv7lW7vZ0Py3jpv0Sf197v5Y04?te=W3R5hFj4cm2zwW4mKLS-3P5VTyW41WVrw3F6bT3W49LdrL41YyllW41PGFk43TBFHW1Lw2bX45LLHwW41pRqm45n4V50&si=8000000023715636&pi=b900d744-9de6-431f-eb58-041670f2b14f>,

A research on programs in the Brazilian Amazon headed by scientist and former project inspector Thales West discovered that initiatives consistently misrepresented their carbon reductions. The procedures, he claimed, “are not robust enough, leaving room for projects to obtain credits that have no influence at all on the environment.”

Source: https://www.switch-plan.co.uk/green-energy/carbon-offsetting/

 In charge of digital partnerships for papernest UK
 *+44 789 9829 913*
 *nicolas.flamant@papernest.com* <nicolas.flamant@papernest.com>
 www.papernest.co.uk

Please report problems with the web pages to the maintainer

x
Top