Schneier on Security

In this issue:

1. Improving C++
2. Drones and the US Air Force
3. AI and the Evolution of Social Media
4. Cheating Automatic Toll Booths by Obscuring License Plates
5. Public AI as an Alternative to Corporate AI
6. Google Pays $10M in Bug Bounties in 2023
7. Licensing AI Engineers
8. On Secure Voting Systems
9. Security Vulnerability in Saflok’s RFID-Based Keycard Locks
10. Hardware Vulnerability in Apple’s M-Series Chips
11. Lessons from a Ransomware Attack against the British Library
12. Ross Anderson
13. Magic Security Dust
14. Declassified NSA Newsletters
15. XZ Utils Backdoor
16. Class-Action Lawsuit against Google’s Incognito Mode
17. Surveillance by the New Microsoft Outlook App
18. Maybe the Phone System Surveillance Vulnerabilities Will Be Fixed
19. Security Vulnerability of HTML Emails
20. US Cyber Safety Review Board on the 2023 Microsoft Exchange Hack
21. In Memoriam: Ross Anderson, 1956-2024
22. Backdoor in XZ Utils That Almost Happened
23. Smuggling Gold by Disguising it as Machine Parts
24. Upcoming Speaking Engagements

In this issue:

1. On the Insecurity of Software Bloat
2. European Court of Human Rights Rejects Encryption Backdoors
3. Microsoft Is Spying on Users of Its AI Tools
4. Details of a Phone Scam
5. New Image/Video Prompt Injection Attacks
6. AIs Hacking Websites
7. Apple Announces Post-Quantum Encryption Algorithms for iMessage
8. China Surveillance Company Hacked
9. A Cyber Insurance Backstop
10. How the “Frontier” Became the Slogan of Uncontrolled AI
11. NIST Cybersecurity Framework 2.0
12. LLM Prompt Injection Worm
13. The Insecurity of Video Doorbells
14. Surveillance through Push Notifications
15. How Public AI Can Strengthen Democracy
16. A Taxonomy of Prompt Injection Attacks
17. Essays from the Second IWORD
18. Using LLMs to Unredact Text
19. Jailbreaking LLMs with ASCII Art
20. Burglars Using Wi-Fi Jammers to Disable Security Cameras
21. Automakers Are Sharing Driver Data with Insurers without Consent

In this issue:

1. Voice Cloning with Very Short Samples
2. The Story of the Mirai Botnet
3. Code Written with AI Assistants Is Less Secure
4. Canadian Citizen Gets Phone Back from Police
5. Speaking to the CIA’s Creative Writing Group
6. Zelle Is Using My Name and Voice without My Consent
7. AI Bots on X (Twitter)
8. Side Channels Are Common
9. Poisoning AI Models
10. Quantum Computing Skeptics
11. Chatbots and Human Conversation
12. Microsoft Executives Hacked
13. NSA Buying Bulk Surveillance Data on Americans without a Warrant
14. New Images of Colossus Released
15. CFPB’s Proposed Data Rules
16. Facebook’s Extensive Surveillance Network
17. A Self-Enforcing Protocol to Solve Gerrymandering
18. David Kahn
19. Deepfake Fraud
20. Documents about the NSA’s Banning of Furby Toys in the 1990s
21. Teaching LLMs to Be Deceptive
22. On Software Liabilities
23. No, Toothbrushes Were Not Used in a Massive DDoS Attack
24. On Passkey Usability
25. Molly White Reviews Blockchain Book
26. A Hacker’s Mind is Out in Paperback
27. Improving the Cryptanalysis of Lattice-Based Public-Key Algorithms
28. Upcoming Speaking Engagements

In this issue:

1. A Robot the Size of the World
2. Police Get Medical Records without a Warrant
3. OpenAI Is Not Training on Your Dropbox Documents — Today
4. GCHQ Christmas Codebreaking Challenge
5. Cyberattack on Ukraine’s Kyivstar Seems to Be Russian Hacktivists
6. Data Exfiltration Using Indirect Prompt Injection
7. Ben Rothke’s Review of A Hacker’s Mind
8. Google Stops Collecting Location Data from Maps
9. New iPhone Security Features to Protect Stolen Devices
10. AI and Lossy Bottlenecks
11. AI Is Scarily Good at Guessing the Location of Random Photos
12. TikTok Editorial Analysis
13. Facial Recognition Systems in the US
14. New iPhone Exploit Uses Four Zero-Days
15. Improving Shor’s Algorithm
16. Second Interdisciplinary Workshop on Reimagining Democracy
17. PIN-Stealing Android Malware
18. Facial Scanning by Burger King in Brazil
19. Pharmacies Giving Patient Records to Police without Warrants
20. On IoT Devices and Software Liability
21. Upcoming Speaking Engagements

In this issue:

1. Coin Flips Are Biased
2. Security Vulnerability of Switzerland’s E-Voting System
3. Analysis of Intellexa’s Predator Spyware
4. Former Uber CISO Appealing His Conviction
5. AI and US Election Rules
6. Child Exploitation and the Crypto Wars
7. EPA Won’t Force Water Utilities to Audit Their Cybersecurity
8. Microsoft is Soft-Launching Security Copilot
9. New NSA Information from (and about) Snowden
10. Messaging Service Wiretap Discovered through Expired TLS Cert
11. Hacking Scandinavian Alcohol Tax
12. The Future of Drone Warfare
13. Spyware in India
14. New York Increases Cybersecurity Rules for Financial Companies
15. Crashing iPhones with a Flipper Zero
16. Spaf on the Morris Worm
17. Decoupling for Security
18. Online Retail Hack
19. The Privacy Disaster of Modern Smart Cars
20. Ten Ways AI Will Change Democracy
21. How .tk Became a TLD for Scammers
22. Upcoming Speaking Engagements

In this issue:

1. On Technologies for Automatic Facial Recognition
2. LLM Summary of My Book Beyond Fear
3. Using Hacked LastPass Keys to Steal Cryptocurrency
4. Detecting AI-Generated Text
5. On the Cybersecurity Jobs Shortage
6. New Revelations from the Snowden Documents
7. Signal Will Leave the UK Rather Than Add a Backdoor
8. Critical Vulnerability in libwebp Library
9. NSA AI Security Center
10. Hacking Gas Pumps via Bluetooth
11. Malicious Ads in Bing Chat
12. Political Disinformation and AI
13. Deepfake Election Interference in Slovakia
14. AI Risks
15. Model Extraction Attack on Neural Networks
16. Cisco Can’t Stop Using Hard-Coded Passwords
17. Bounty to Recover NIST’s Elliptic Curve Seeds
18. Hacking the High School Grading System

In this issue:

1. Zoom Can Spy on Your Calls and Use the Conversation to Train AI, But Says That It Won’t
2. UK Electoral Commission Hacked
3. Detecting “Violations of Social Norms” in Text with AI
4. Bots Are Better than Humans at Solving CAPTCHAs
5. White House Announces AI Cybersecurity Challenge
6. Applying AI to License Plate Surveillance
7. December’s Reimagining Democracy Workshop
8. Parmesan Anti-Forgery Protection
9. Hacking Food Labeling Laws
10. Remotely Stopping Polish Trains
11. Identity Theft from 1965 Uncovered through Face Recognition
12. When Apps Go Rogue
13. Own Your Own Government Surveillance Van
14. Spyware Vendor Hacked
15. Inconsistencies in the Common Vulnerability Scoring System (CVSS)
16. Cryptocurrency Startup Loses Encryption Key for Electronic Wallet
17. The Hacker Tool to Get Personal Data from Credit Bureaus
18. LLMs and Tool Use
19. On Robots Killing People
20. Cars Have Terrible Data Privacy
21. Zero-Click Exploit in iPhones
22. Fake Signal and Telegram Apps in the Google Play Store
23. Upcoming Speaking Engagements

In this issue:

1. Tracking Down a Suspect through Cell Phone Records
2. Disabling Self-Driving Cars with a Traffic Cone
3. Practice Your Security Prompting Skills
4. Commentary on the Implementation Plan for the 2023 US National Cybersecurity Strategy
5. Kevin Mitnick Died
6. AI and Microdirectives
7. Google Reportedly Disconnecting Employees from the Internet
8. New York Using AI to Detect Subway Fare Evasion
9. Backdoor in TETRA Police Radios
10. Fooling an AI Article Writer
11. Indirect Instruction Injection in Multi-Modal LLMs
12. Automatically Finding Prompt Injection Attacks
13. Hacking AI Resume Screening with Text in a White Font
14. New SEC Rules around Cybersecurity Incident Disclosures
15. The Need for Trustworthy AI
16. Political Milestones for AI
17. Microsoft Signing Key Stolen by Chinese
18. You Can’t Rush Post-Quantum-Computing Cryptography Standards
19. Using Machine Learning to Detect Keystrokes
20. Cryptographic Flaw in Libbitcoin Explorer Cryptocurrency Wallet
21. The Inability to Simultaneously Verify Sentience, Location, and Identity
22. China Hacked Japan’s Military Networks

In this issue:

1. Security and Human Behavior (SHB) 2023
2. Power LED Side-Channel Attack
3. Ethical Problems in Computer Security
4. AI as Sensemaking for Public Comments
5. UPS Data Harvested for SMS Phishing Attacks
6. Excel Data Forensics
7. Typing Incriminating Evidence in the Memo Field
8. Stalkerware Vendor Hacked
9. Redacting Documents with a Black Sharpie Doesn’t Work
10. The US Is Spying on the UN Secretary General
11. Self-Driving Cars Are Surveillance Cameras on Wheels
12. The Password Game
13. Class-Action Lawsuit for Scraping Data without Permission
14. Belgian Tax Hack
15. The AI Dividend
16. Wisconsin Governor Hacks the Veto Process
17. Privacy of Printing Services
18. Google Is Using Its Vast Data Stores to Train AI
19. French Police Will Be Able to Spy on People through Their Cell Phones
20. Buying Campaign Contributions as a Hack