Well, not just CSAM this additional and not just telemetry.

Gen. Paul Nakasone argued that FISA Sec. 702 has “saved lives” and stopped terrorist and espionage plots.

Source: NSA leader kicks off congressional debate to reauthorize FISA surveillance power

AMD has issued guidance for patching 31 new CPU vulnerabilities that impact both its consumer Ryzen and data center EPYC processors.

Source: AMD Discloses 31 New CPU Vulnerabilities, Issues Patch Guidance

With the release of ChatGPT, I’ve read many random articles about this or that threat from the technology. This paper is a good survey of the field: what the threats are, how we might detect machine-generated text, directions for future research. It’s a solid grounding amongst all of the hype. Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methods Abstract: Advances in natural language generation (NLG) have resulted in machine generated text that is increasingly difficult to distinguish from human authored text. Powerful open-source models are freely available, and user-friendly tools democratizing access to generative models are proliferating. The great potential of state-of-the-art NLG systems is tempered by the multitude of avenues for abuse. Detection of machine generated text is a key countermeasure for reducing abuse of NLG models, with significant technical challenges and numerous open problems. We provide a survey that includes both 1) an extensive analysis of threat models posed by contemporary NLG systems, and 2) the most complete review of machine generated text detection methods to date. This survey places machine generated text within its cybersecurity and social context, and provides strong guidance for future work addressing the most critical threat models, and ensuring detection systems themselves demonstrate trustworthiness through fairness, robustness, and accountability.

Source: Threats of Machine-Generated Text

Call metadata can be ferreted out

Source: Boffins break VoLTE privacy in LTE and 5G networks • The Register

The airport 5G problem – where some planes with older or faulty radio altimeters could be confused by strong 5G signals – has resulted in a further compromise. Carriers wanted airlines to have to promptly bring their equipment up-to-date, while an aviation body wanted the current restrictions to be made permanent … more… The post Airport 5G problem: Airlines now get until next year to fix it appeared first on 9to5Mac.

Source: Airport 5G problem: Airlines now get until next year to fix it

I don’t know how much of a thing this will end up being, but we are seeing ChatGPT-written malware in the wild. …within a few weeks of ChatGPT going live, participants in cybercrime forums—­some with little or no coding experience­—were using it to write software and emails that could be used for espionage, ransomware, malicious spam, and other malicious tasks. “It’s still too early to decide whether or not ChatGPT capabilities will become the new favorite tool for participants in the Dark Web,” company researchers wrote. “However, the cybercriminal community has already shown significant interest and are jumping into this latest trend to generate malicious code.” Last month, one forum participant posted what they claimed was the first script they had written and credited the AI chatbot with providing a “nice [helping] hand to finish the script with a nice scope.” The Python code combined various cryptographic functions, including code signing, encryption, and decryption. One part of the script generated a key using elliptic curve cryptography and the curve ed25519 for signing files. Another part used a hard-coded password to encrypt system files using the Blowfish and Twofish algorithms. A third used RSA keys and digital signatures, message signing, and the blake2 hash function to compare various files. Check Point Research report. ChatGPT-generated code isn’t that good, but it’s a start. And the technology will only get better. Where it matters here is that it gives less skilled hackers—script kiddies—new capabilities.

Source: ChatGPT-Written Malware

The Biden administration previously weighed in on the case between Meta and the spyware maker to recommend the court dismiss the appeal.

Source: Ground News – Supreme Court clears way for WhatsApp case against NSO Group, opening spyware firm to more lawsuits

After gaining access to a powerful administrative account, the researchers could perform all sorts of tasks inside Reviver, the sole company that sells the digital plates in California.

Source: Researchers Could Track the GPS Location of All of California’s New Digital License Plates

The two people who shut down four Washington power stations in December were arrested. This is the interesting part:

Investigators identified Greenwood and Crahan almost immediately after the attacks took place by using cell phone data that allegedly showed both men in the vicinity of all four substations, according to court documents.

Nowadays, it seems like an obvious thing to do—although the search is probably unconstitutional. But way back in 2012, the Canadian CSEC—that’s their NSA—did some top-secret work on this kind of thing. The document is part of the Snowden archive, and I wrote about it:

The second application suggested is to identify a particular person whom you know visited a particular geographical area on a series of dates/times. The example in the presentation is a kidnapper. He is based in a rural area, so he can’t risk making his ransom calls from that area. Instead, he drives to an urban area to make those calls. He either uses a burner phone or a pay phone, so he can’t be identified that way. But if you assume that he has some sort of smart phone in his pocket that identifies itself over the Internet, you might be able to find him in that dataset. That is, he might be the only ID that appears in that geographical location around the same time as the ransom calls and at no other times.

There’s a whole lot of surveillance you can do if you can follow everyone, everywhere, all the time. I don’t even think turning your cell phone off would help in this instance. How many people in the Washington area turned their phones off during exactly the times of the Washington power station attacks? Probably a small enough number to investigate them all.

Tags: cell phones, geolocation, law enforcement, tracking

Posted on January 9, 2023 at 7:14 AM • 8 Comments

Source: Identifying People Using Cell Phone Location Data – Schneier on Security