The RISKS Digest
Volume 34 Issue 16

Wednesday, 10th April 2024

Forum on Risks to the Public in Computers and Related Systems

ACM Committee on Computers and Public Policy, Peter G. Neumann, moderator

Please try the URL privacy information feature enabled by clicking the flashlight icon above. This will reveal two icons after each link the body of the digest. The shield takes you to a breakdown of Terms of Service for the site - however only a small number of sites are covered at the moment. The flashlight take you to an analysis of the various trackers etc. that the linked site delivers. Please let the website maintainer know if you find this useful or not. As a RISKS reader, you will probably not be surprised by what is revealed…

Contents

The total eclipse shows us how important solar energy is to the U.S.
The Verge
Chinese Hack of Microsoft Exchange Online Was Preventable, Reviwe Board Finds
Kim S. Nash
Dana-Farber Cancer Institute has retracted 7 studies amid controversy over errors
NBC News
A once-ignored community of science sleuths now has the research community on its heels
NBC News
Can AI help fill the therapist shortage? Mental health apps show promise and pitfalls
CBS News
Hackers stole 340,000 Social Security numbers from government consulting firm
TechCrunch
Critical takeover vulnerabilities in 92,000 D-Link devices under active exploitation
ArsTechnica
Targus says cyberattack is causing operational outage
TechCrunch
After pushing cloud storage, TV provider to auto-delete 61-day-old DVR recordings
ArsTechnica
Texas Will Use Computers to Grade STAAR Tests
Keaton Peters
Cheshire Cat GPS Jamming/Spoofing in Ukraine, Israel, ...
Henry Baker
Scammers exploiting people who change their status to #OpenToWork
Ben Rothke
Mr Bates vs The Post Office now available on PBS in the U.S.
PBS via Jeremy Epstein
Why Open Source Can't Innovate
Dana F. Blankenhorn
Elon Musk Didn't Want His Latest Deposition Released. Here It Is.
HuffPost Latest News
Russian trolls target U.S. support for Ukraine, Kremlin documents show
WashPost
California judge dismisses one of ‘Are We Dating the Same Guy?’ lawsuits
NBC News
YouTube is the most consequential technology in America
WashPost
Yet another 419 variant
Rob Slade
Tesla is settling with the family of the Apple engineer who died in an Autopilot crash
The Verge
Re: AI that targets civilians ...
Dylan Northrup
Info on RISKS (comp.risks)

The total eclipse shows us how important solar energy is to the U.S. (The Verge)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 20:53:45 -0400
https://www.theverge.com/2024/4/8/24124189/solar-eclipse-renewable-energy-panels-electricity-grid

  [And incidentally, Monty noted Internet Traffic Dipped as Viewers Took in
  the Eclipse Internet—it dropped by 40 percent or more during the
  eclipse in states in the path of totality, including Maine, New Hampshire
  and Ohio, Cloudflare found.
https://www.nytimes.com/2024/04/09/business/internet-traffic-eclipse-cloudflare.html
  PGN]


Chinese Hack of Microsoft Exchange Online Was Preventable, Review Board Finds (Kim S. Nash)

Peter Neumann <neumann@csl.sri.com>
Wed, 10 Apr 2024 11:34:12 PDT
Kim S. Nash. *The Wall Street Journal*
https://cybersecurity.cmail20.com/t/d-l-eydzx-tjludishy-i/

Security missteps at Microsoft might pave the way for a cyber-overhaul of
the cloud sector.

"A cascade of security failures at Microsoft" allowed Chinese hackers to
penetrate the company's Exchange Online cloud-based email system last year,
according to the U.S. Cyber Safety Review Board.

The board spent seven months investigating the espionage incident, in which
the email accounts of 22 organizations and more than 500 individuals around
the world were compromised.

These included Commerce Secretary Gina Raimondo and U.S. Ambassador to
China, Nicholas Burns. Microsoft cooperated fully with the probe, the board
said in its report issued Tuesday.

Tactical and strategic decisions at Microsoft reflect "a corporate culture
that deprioritized enterprise security investments and rigorous risk
management, at odds with the company's centrality in the technology
ecosystem and the level of trust customers place in the company to protect
their data and operations," the board said.

Not only does the report include security recommendations for the tech giant,
but some for cloud providers generally as well. U.S. officials also plan to
convene major cloud players to hammer out baseline cyber practices and a
process for the companies to regularly attest they are complying.


Dana-Farber Cancer Institute has retracted 7 studies amid controversy over errors (NBC News)

Monty Solomon <monty@roscom.com>
Tue, 9 Apr 2024 21:47:28 -0400
The episode has imperiled the reputation of the Harvard-affiliated
Dana-Farber Cancer Institute and raised questions about the work of one
high-profile researcher.

https://www.nbcnews.com/science/science-news/cancer-institute-dana-farber-retracts-studies-errors-rcna143922


A once-ignored community of science sleuths now has the research community on its heels (NBC News)

Monty Solomon <monty@roscom.com>
Tue, 9 Apr 2024 21:49:03 -0400
Artificial intelligence tools are only making it easier to spot
problems. Some scientists say it’s time for universities and academic
publishers to reform how they address flawed research.

https://www.nbcnews.com/science/science-news/-ignored-community-science-sleuths-now-research-community-heels-rcna136946


Can AI help fill the therapist shortage? Mental health apps show promise and pitfalls (CBS News)

Gabe Goldberg <gabe@gabegold.com>
Wed, 10 Apr 2024 14:57:49 -0400
Providers of mental health services are turning to AI-powered chatbots
designed to help fill the gaps amid a shortage of therapists and growing
demand from patients.

But not all chatbots are equal: some can offer helpful advice while others
can be ineffective, or even potentially harmful. Woebot Health uses AI to
power its mental health chatbot, called Woebot. The challenge is to protect
people from harmful advice while safely harnessing the power of artificial
intelligence.  [...]

The National Eating Disorders Association's AI-powered chatbot, Tessa, was
taken down after it provided potentially harmful advice to people seeking
help.

https://www.cbsnews.com/news/ai-chatbots-mental-health-therapy-pitfalls-60-minutes/

  They're so proud—rules-based bot gives deterministic response. Same
  input, same output. Guidelines/guardrails protect against anything bad --
  except when they're modified and don't. GPT bot improvises.

  What could go wrong?

     [Well, they might need a Woebot Wabbit?  PGN]


Hackers stole 340,000 Social Security numbers from government consulting firm (TechCrunch)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 21:09:17 -0400
https://techcrunch.com/2024/04/08/hackers-stole-340000-social-security-numbers-from-government-consulting-firm/


Critical takeover vulnerabilities in 92,000 D-Link devices under active exploitation (ArsTechnica)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 21:16:32 -0400
https://arstechnica.com/?p=2015480


Targus says cyberattack is causing operational outage (TechCrunch)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 21:09:45 -0400
https://techcrunch.com/2024/04/08/targus-says-cyberattack-causing-operational-outage/


After pushing cloud storage, TV provider to auto-delete 61-day-old DVR recordings (ArsTechnica)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 21:17:40 -0400
https://arstechnica.com/?p=2015412


Texas Will Use Computers to Grade STAAR Tests (Keaton Peters)

ACM TechNews <technews-editor@acm.org>
Wed, 10 Apr 2024 11:50:04 -0400 (EDT)
Keaton Peters, *The Texas Tribune*, 9 Apr 2024

The Texas Education Agency (TEA) this year will use an "automated scoring
engine" that uses natural language processing technology to assess and grade
open-ended questions on the State of Texas Assessment of Academic Readiness
(STAAR) for reading, writing, science, and social studies. TEA gathered
3,000 responses that went through two rounds of human scoring, and used them
to teach the automated scoring engine the characteristics of responses. It
is programmed to assign the same scores a human would have given.

  [Texas is leaning to STAARBOARD for a change?  But this loo ks more like
  any PORT in a storm.  What was the quality of the 3,000 human scorings?
  The system could have been trained on sloppy grading, and assigning the
  same scores may be really wrong-headed.  Once again, we desperately need
  sound evidence-based results.  PGN]


Henry Baker <hbaker1@pipeline.com>
Tue, 09 Apr 2024 18:02:23 +0000
"If you don't know where you're going, any road will take you there."
-- Cheshire Cat in Alice's Wonderland

Isn't this jamming/spoofing a fraud on the location-based advertisers ?

How soon before we have GPS 'swatting' on Carmen Sandiego ?

https://en.wikipedia.org/wiki/Swatting

https://www.newscientist.com/article/2415318-ukraine-will-spoof-gps-across-the-country-to-stop-russian-drones/

Ukraine will spoof GPS across the country to stop Russian drones


Scammers exploiting people who change their status to #OpenToWork

Ben Rothke <brothke@gmail.com>
Mon, 8 Apr 2024 18:25:46 -0400
Many job seekers often change their LinkedIn status to #OpenToWork.

Scammers look for people who do that and launch scams against them.

Most often around resume building, executive coaching, and job
introductions.

https://brothke.medium.com/when-opentowork-is-really-opentoscam-598ef27dd628?sk=b65fb880100304aa67a53a0590c7b162


Mr Bates vs The Post Office now available on PBS in the U.S.

Jeremy Epstein <jeremy.j.epstein@gmail.com>
Mon, 8 Apr 2024 22:16:30 -0400
The Horizon post office scandal in the UK has been discussed periodically
in RISKS over the years. The docudrama that caused the UK parliament to
finally take action is now available in the US on PBS.
https://www.pbs.org/wgbh/masterpiece/shows/mr-bates-vs-the-post-office/

I'm curious to see whether viewers will see the parallel to trusting AI
systems, and the risks those bring.


Why Open Source Can't Innovate (Dana F. Blankenhorn)

Gabe Goldberg <gabe@gabegold.com>
Tue, 9 Apr 2024 14:06:39 -0400
How The Commons Was Closed for the Benefit of the Few

https://danafblankenhorn.substack.com/p/why-open-source-cant-innovate


Elon Musk Didn't Want His Latest Deposition Released. Here It Is. (HuffPost Latest News)

Gabe Goldberg <gabe@gabegold.com>
Tue, 9 Apr 2024 17:05:16 -0400
Musk is being sued for falsely suggesting a 22-year-old Jewish man was part
of a neo-Nazi brawl.

The lawsuit against the billionaire, filed in October, alleges that Musk
used his colossal social media platform to amplify a false far-right
conspiracy theory linking 22-year-old Ben Brody to a brawl in Oregon between
the neo-Nazi group Rose City Nationalists and the Proud Boys, a neo-fascist
fight club. The brawl occurred during Oregon City’s first Pride Night Fest,
when both groups came to disrupt the event and spew anti-LGBTQ+ rhetoric.

Brody wasn't even in the same state when the June 24 brawl occurred. But his
world was turned upside down when far-right X accounts, magnified by Musk,
falsely identified him as a member of Rose City Nationalists (and an
undercover federal agent) and posted his personal information online.

Musk amplified the conspiracy theory repeatedly to his more than 180 million
followers, suggesting Brody was a fresh-faced federal agent pretending to be
a neo-Nazi in a “false flag situation,” a phrase used to suggest a harmful
event was deliberately set up to misrepresent a group or person. [...]

Brody said he and his family were forced to flee their home amid the fallout
from Musk’s posts. He’s seeking more than $1 million in damages.  The next
court hearing is scheduled for April 22.  [...]

“People are attacked all the time in the media, online media, social media,
but it is rare that that actually has a meaningful negative impact on their
life,” Musk testified.

https://www.huffpost.com/entry/elon-musk-didnt-want-his-latest-deposition-released-here-it-is_n_66133d2ce4b0d81853f9a766


Russian trolls target U.S. support for Ukraine, Kremlin documents show (WashPost)

Monty Solomon <monty@roscom.com>
Tue, 9 Apr 2024 19:54:05 -0400
In a campaign stoking anti-Ukraine sentiment in the U.S., Russia-directed
trolls have written thousands of fabricated news articles and social media
posts.

https://www.washingtonpost.com/world/2024/04/08/russia-propaganda-us-ukraine/


California judge dismisses one of ‘Are We Dating the Same Guy?’ lawsuits (NBC News)

Monty Solomon <monty@roscom.com>
Tue, 9 Apr 2024 21:52:54 -0400
Stewart Lucas Murrey is suing more than 50 women for sharing stories about
him in multiple private Facebook groups.

https://www.nbcnews.com/tech/judge-dismisses-are-we-dating-same-guy-facebook-group-lawsuit-rcna147043


YouTube is the most consequential technology in America

"Monty Solomon" <monty@roscom.com>
Tue, 9 Apr 2024 20:04:36 -0400
This is the most consequential technology in America

This is America’s most popular social app by a mile, the top way to listen
to music, the healthiest economy on the Internet and essential AI training
fuel.

(Spoiler alert: It’s YouTube.)

You think you know YouTube. It’s where billions of people learn how to
change a tire, follow a favorite yoga workout or catch footage of Monday’s
solar eclipse.

But maybe you don’t know that YouTube is also the most popular way to hear
music and one of the country’s largest cable TV providers. YouTube is the
healthiest economy on the Internet. And it has been rocket fuel for
artificial intelligence.

I’m digging into YouTube’s identity because it’s essential to understand the
influence of technologies in our lives. As popular as YouTube is, its power
over the Internet and us is somehow still underrated.

Let me try to persuade you that YouTube is the most consequential technology
in America: [...]

https://www.washingtonpost.com/technology/2024/04/09/most-important-app-youtube/


Yet another 419 variant

Rob Slade <rslade@gmail.com>
Tue, 9 Apr 2024 09:46:09 -0700
So, I got this email inviting me to a Trello workspace.  I assume Trello is
something like Slack or MS Teams.  I initially assumed that this was yet
another instance of someone assuming that "rslade@gmail.com" was *their*
email address, rather than mine.  But then I saw the included note:

  "Greetings, I am Brian Smith, a seasoned attorney at Piccadilly's
  Attorneys Firm and Personal attorney to a deceased member of your family
  who died and left behind an Estate claim. You have been designated as a
  devisee. Please contact me via email for further information.
  [attorneybriansmith96@gmail.com]"

OK, right, it's just another version of the "your rich relative died"
advance fee fraud.

But I found it interesting that they are trying yet another workaround to
get by standard spam filters ...


Tesla is settling with the family of the Apple engineer who died in an Autopilot crash (The Verge)

Monty Solomon <monty@roscom.com>
Mon, 8 Apr 2024 20:52:36 -0400
https://www.theverge.com/2024/4/8/24124744/tesla-autopilot-lawsuit-settlement-huang-death


Re: AI that targets civilians ... (RISKS-34.15)

Dylan Northrup <northrup@gmail.com>
Tue, 9 Apr 2024 09:45:10 -0400
> Actually, using face-recognition methods may be the most humane way to
> tell apart terrorists who hide among the civilian population.  Especially
> when the alternative older methods were more like "kill them all and let
> God sort them out".

Facial recognition should be forbidden from use by law enforcement unless
and until it is able to be used on white collar criminals (tax evasion,
securities fraud, insider trading, etc.). The actual losses from those
crimes dwarfs losses from all other types of crime facial recognition will
pitched as the solution for.

Please report problems with the web pages to the maintainer

x
Top