Bruce Schneier:
Fast16 Malware
Researchers have reverse-engineered a piece of malware named Fast16. It’s almost certainly state-sponsored, probably US in origin, and was deployed against Iran years before Stuxnet:“…the Fast16 malware was designed to carry out the most subtle form of sabotage ever seen in an in-the-wild malware tool: By automatically spreading across networks and then silently manipulating computation processes in certain software applications that perform high-precision mathematical calculations and simulate physical phenomena, Fast16 can alter the results of those programs to cause failures that range from faulty research results to catastrophic damage to real-world equipment.”Another news article.Lots of interesting details at the links.
via Schneier on Security https://ift.tt/MOI5Y2C
Fast16 Malware
Researchers have reverse-engineered a piece of malware named Fast16. It’s almost certainly state-sponsored, probably US in origin, and was deployed against Iran years before Stuxnet:“…the Fast16 malware was designed to carry out the most subtle form of sabotage ever seen in an in-the-wild malware tool: By automatically spreading across networks and then silently manipulating computation processes in certain software applications that perform high-precision mathematical calculations and simulate physical phenomena, Fast16 can alter the results of those programs to cause failures that range from faulty research results to catastrophic damage to real-world equipment.”Another news article.Lots of interesting details at the links.
via Schneier on Security https://ift.tt/MOI5Y2C
WIRED
Newly Deciphered Sabotage Malware May Have Targeted Iran’s Nuclear Program—and Predates Stuxnet
Researchers have finally cracked Fast16, mysterious code capable of silently tampering with calculation and simulation software. It was created in 2005—and likely deployed by the US or an ally.
Bruce Schneier:
A Ransomware Negotiator Was Working for a Ransomware Gang
Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.
via Schneier on Security https://ift.tt/fBXqwld
A Ransomware Negotiator Was Working for a Ransomware Gang
Someone pleaded guilty to secretly working for a ransomware gang as he negotiated ransomware payments for clients.
via Schneier on Security https://ift.tt/fBXqwld
Gizmodo
A Ransomware Negotiator Pleads Guilty to Being a Double Agent
The Florida man helped BlackCat/ALPHV operators maximize their payouts.
Bruce Schneier:
Hacking Polymarket
Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside (for one, it facilitates assassination), one of the issues with making this work is the verification of these real-world events. Polymarket gamblers have threatened a journalist because his story was being used to verify an event. And now, gamblers are taking hair dryers to weather sensors to rig weather bets.There’s also insider trading: a lot of it.
via Schneier on Security https://ift.tt/5PhwSu7
Hacking Polymarket
Polymarket is a platform where people can bet on real-world events, political and otherwise. Leaving the ethical considerations of this aside (for one, it facilitates assassination), one of the issues with making this work is the verification of these real-world events. Polymarket gamblers have threatened a journalist because his story was being used to verify an event. And now, gamblers are taking hair dryers to weather sensors to rig weather bets.There’s also insider trading: a lot of it.
via Schneier on Security https://ift.tt/5PhwSu7
Wikipedia
Assassination market
type of market that incentivizes assassination
Bruce Schneier:
DarkSword Malware
DarkSword is a sophisticated piece of malware—probably government designed—that targets iOS.Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.DarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads. GTIG has identified three distinct malware families deployed following a successful DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The proliferation of this single exploit chain across disparate threat actors mirrors the previously discovered Coruna iOS exploit kit. Notably, UNC6353, a suspected Russian espionage group previously observed using Coruna, has recently incorporated DarkSword into their watering hole campaigns.A week after it was identified, a version of it leaked onto the internet, where it is being used more broadly.This news is a month old. Your devices are safe, assuming you patch regularly.
via Schneier on Security https://ift.tt/Wwdgkeo
DarkSword Malware
DarkSword is a sophisticated piece of malware—probably government designed—that targets iOS.Google Threat Intelligence Group (GTIG) has identified a new iOS full-chain exploit that leveraged multiple zero-day vulnerabilities to fully compromise devices. Based on toolmarks in recovered payloads, we believe the exploit chain to be called DarkSword. Since at least November 2025, GTIG has observed multiple commercial surveillance vendors and suspected state-sponsored actors utilizing DarkSword in distinct campaigns. These threat actors have deployed the exploit chain against targets in Saudi Arabia, Turkey, Malaysia, and Ukraine.DarkSword supports iOS versions 18.4 through 18.7 and utilizes six different vulnerabilities to deploy final-stage payloads. GTIG has identified three distinct malware families deployed following a successful DarkSword compromise: GHOSTBLADE, GHOSTKNIFE, and GHOSTSABER. The proliferation of this single exploit chain across disparate threat actors mirrors the previously discovered Coruna iOS exploit kit. Notably, UNC6353, a suspected Russian espionage group previously observed using Coruna, has recently incorporated DarkSword into their watering hole campaigns.A week after it was identified, a version of it leaked onto the internet, where it is being used more broadly.This news is a month old. Your devices are safe, assuming you patch regularly.
via Schneier on Security https://ift.tt/Wwdgkeo
Google Cloud Blog
The Proliferation of DarkSword: iOS Exploit Chain Adopted by Multiple Threat Actors | Google Cloud Blog
DarkSword is a new iOS exploit chain that leverages multiple zero-day vulnerabilities to fully compromise iOS devices.
Bruce Schneier:
Rowhammer Attack Against NVIDIA Chips
A new rowhammer attack gives complete control of NVIDIA CPUs.On Thursday, two research teams, working independently of each other, demonstrated attacks against two cards from Nvidia’s Ampere generation that take GPU rowhammering into new—and potentially much more consequential—territory: GDDR bitflips that give adversaries full control of CPU memory, resulting in full system compromise of the host machine. For the attack to work, IOMMU memory management must be disabled, as is the default in BIOS settings.“Our work shows that Rowhammer, which is well-studied on CPUs, is a serious threat on GPUs as well,” said Andrew Kwong, co-author of one of the papers. “GDDRHammer: Greatly Disturbing DRAM RowsCross-Component Rowhammer Attacks from Modern GPUs.” “With our work, we… show how an attacker can induce bit flips on the GPU to gain arbitrary read/write access to all of the CPU’s memory, resulting in complete compromise of the machine.”Update Friday, April 3: On Friday, researchers unveiled a third Rowhammer attack that also demonstrates Rowhammer attacks on the RTX A6000 that achieves privilege escalation to a root shell. Unlike the previous two, the researchers said, it works even when IOMMU is enabled.The second paper is GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit:…does largely the same thing, except that instead of exploiting the last-level page table, as GDDRHammer does, it manipulates the last-level page directory. It was able to induce 1,171 bitflips against the RTX 3060 and 202 bitflips against the RTX 6000.GeForge, too, uses novel hammering patterns and memory massaging to corrupt GPU page table mappings in GDDR6 memory to acquire read and write access to the GPU memory space. From there, it acquires the same privileges over host CPU memory. The GeForge proof-of-concept exploit against the RTX 3060 concludes by opening a root shell window that allows the attacker to issue commands that run unfettered privileges on the host machine. The researchers said that both GDDRHammer and GeForge could do the same thing against the RTC 6000.
via Schneier on Security https://ift.tt/XJqeK4w
Rowhammer Attack Against NVIDIA Chips
A new rowhammer attack gives complete control of NVIDIA CPUs.On Thursday, two research teams, working independently of each other, demonstrated attacks against two cards from Nvidia’s Ampere generation that take GPU rowhammering into new—and potentially much more consequential—territory: GDDR bitflips that give adversaries full control of CPU memory, resulting in full system compromise of the host machine. For the attack to work, IOMMU memory management must be disabled, as is the default in BIOS settings.“Our work shows that Rowhammer, which is well-studied on CPUs, is a serious threat on GPUs as well,” said Andrew Kwong, co-author of one of the papers. “GDDRHammer: Greatly Disturbing DRAM RowsCross-Component Rowhammer Attacks from Modern GPUs.” “With our work, we… show how an attacker can induce bit flips on the GPU to gain arbitrary read/write access to all of the CPU’s memory, resulting in complete compromise of the machine.”Update Friday, April 3: On Friday, researchers unveiled a third Rowhammer attack that also demonstrates Rowhammer attacks on the RTX A6000 that achieves privilege escalation to a root shell. Unlike the previous two, the researchers said, it works even when IOMMU is enabled.The second paper is GeForge: Hammering GDDR Memory to Forge GPU Page Tables for Fun and Profit:…does largely the same thing, except that instead of exploiting the last-level page table, as GDDRHammer does, it manipulates the last-level page directory. It was able to induce 1,171 bitflips against the RTX 3060 and 202 bitflips against the RTX 6000.GeForge, too, uses novel hammering patterns and memory massaging to corrupt GPU page table mappings in GDDR6 memory to acquire read and write access to the GPU memory space. From there, it acquires the same privileges over host CPU memory. The GeForge proof-of-concept exploit against the RTX 3060 concludes by opening a root shell window that allows the attacker to issue commands that run unfettered privileges on the host machine. The researchers said that both GDDRHammer and GeForge could do the same thing against the RTC 6000.
via Schneier on Security https://ift.tt/XJqeK4w
Wikipedia
Row hammer
Computer security exploit
Bruce Schneier:
Smart Glasses for the Authorities
ICE is developing its own version of smart glasses, with facial recognition tied to various databases.
via Schneier on Security https://ift.tt/qkyij68
Smart Glasses for the Authorities
ICE is developing its own version of smart glasses, with facial recognition tied to various databases.
via Schneier on Security https://ift.tt/qkyij68
Kenklippenstein
Exclusive: ICE Glasses
Homeland Security is making “smart glasses” to collect intelligence on Americans
Bruce Schneier:
Insider Betting on Polymarket
Insider trading is rife on Polymarket:Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—defined as wagers of $2,500 or more at odds of 35 percent or less—on the platform had an average win rate of around 52 percent in markets on military and defense actions.That compares with a win rate of 25 percent across all politics-focused markets and just 14 percent for all markets on the platform as a whole.It is absolutely insane that this is legal. We already know how insider betting warps sports. Insider betting warping politics—and military actions—is orders of magnitude worse.
via Schneier on Security https://ift.tt/jALMEr4
Insider Betting on Polymarket
Insider trading is rife on Polymarket:Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—defined as wagers of $2,500 or more at odds of 35 percent or less—on the platform had an average win rate of around 52 percent in markets on military and defense actions.That compares with a win rate of 25 percent across all politics-focused markets and just 14 percent for all markets on the platform as a whole.It is absolutely insane that this is legal. We already know how insider betting warps sports. Insider betting warping politics—and military actions—is orders of magnitude worse.
via Schneier on Security https://ift.tt/jALMEr4
Schneier on Security
Insider Betting on Polymarket - Schneier on Security
Insider trading is rife on Polymarket: Analysis by the Anti-Corruption Data Collective, a non-profit research and advocacy group, found that long-shot bets—defined as wagers of $2,500 or more at odds of 35 percent or less—on the platform had an average…
Bruce Schneier:
Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia
Evidence of them has been found by analyzing DNA in the seawater.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/uDy54Gs
Friday Squid Blogging: Giant Squid Live in the Waters of Western Australia
Evidence of them has been found by analyzing DNA in the seawater.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/uDy54Gs
nautil.us
Giant Squid Discovered Lurking off the Australian Coast
Giant Squid Discovered Lurking off the Australian Coast: The massive sea creature left behind some DNA
Bruce Schneier:
LLMs and Text-in-Text Steganography
Turns out that LLMs are really good at hiding text messages in other text messages.
via Schneier on Security https://ift.tt/eymZPdJ
LLMs and Text-in-Text Steganography
Turns out that LLMs are really good at hiding text messages in other text messages.
via Schneier on Security https://ift.tt/eymZPdJ
arXiv.org
LLMs can hide text in other text of the same length
A meaningful text can be hidden inside another, completely different yet still coherent and plausible, text of the same length. For example, a tweet containing a harsh political critique could be...
Bruce Schneier:
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years.TL;DRcopy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC.It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own.The exploit works unmodified across Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Fedora and most others. No race condition, no per-distro offsets.The file on disk is never modified. AIDE, Tripwire and checksum-based monitoring see nothing.Kubernetes Pod Security Standards (Restricted) and the default RuntimeDefault seccomp profile do not block the syscall used. A custom seccomp profile is needed.The mainline fix landed on 1 April. Distros are rolling kernels out now. Patch.“Local privilege escalation” sounds dry, so let me unpack it. It means: an attacker who already has some way to run code on the machine, even as the most boring unprivileged user, can promote themselves to root. From there they can read every file, install backdoors, watch every process, and pivot to other systems.Why does that matter on shared infrastructure? Because “local” covers a lot of ground in 2026: every container on a shared Kubernetes node, every tenant on a shared hosting box, every CI/CD job that runs untrusted pull-request code, every WSL2 instance on a Windows laptop, every containerised AI agent given shell access. They all share one Linux kernel with their neighbours. A kernel LPE collapses that boundary.News article.
via Schneier on Security https://ift.tt/uXVPmqk
Copy.Fail Linux Vulnerability
This is the worst Linux vulnerability in years.TL;DRcopy.fail is a Linux kernel local privilege escalation, not a browser or clipboard attack. Disclosed by Theori on 29 April 2026 with a working PoC.It abuses the kernel crypto API (AF_ALG sockets) plus splice() to write four bytes at a time straight into the page cache of a file the attacker does not own.The exploit works unmodified across Ubuntu, RHEL, Debian, SUSE, Amazon Linux, Fedora and most others. No race condition, no per-distro offsets.The file on disk is never modified. AIDE, Tripwire and checksum-based monitoring see nothing.Kubernetes Pod Security Standards (Restricted) and the default RuntimeDefault seccomp profile do not block the syscall used. A custom seccomp profile is needed.The mainline fix landed on 1 April. Distros are rolling kernels out now. Patch.“Local privilege escalation” sounds dry, so let me unpack it. It means: an attacker who already has some way to run code on the machine, even as the most boring unprivileged user, can promote themselves to root. From there they can read every file, install backdoors, watch every process, and pivot to other systems.Why does that matter on shared infrastructure? Because “local” covers a lot of ground in 2026: every container on a shared Kubernetes node, every tenant on a shared hosting box, every CI/CD job that runs untrusted pull-request code, every WSL2 instance on a Windows laptop, every containerised AI agent given shell access. They all share one Linux kernel with their neighbours. A kernel LPE collapses that boundary.News article.
via Schneier on Security https://ift.tt/uXVPmqk
Jorijn
copy.fail (CVE-2026-31431): a small Linux kernel bug with an unusually big blast radius | Jorijn Schrijvershof
copy.fail (CVE-2026-31431) explained: how a Linux kernel page-cache write turns any user into root, why it bypasses container isolation, and how to patch.
Bruce Schneier:
OpenAI’s GPT-5.5 is as Good as Mythos at Finding Security Vulnerabilities
The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available.Here is the Institute’s evaluation of Mythos.And here is an analysis of a smaller, cheaper model. It requires more scaffolding from the prompter, but it is also just as good.
via Schneier on Security https://ift.tt/qeYuUxl
OpenAI’s GPT-5.5 is as Good as Mythos at Finding Security Vulnerabilities
The UK’s AI Security Institute evaluated GPT-5.5’s ability to find security vulnerabilities, and found that it is comparable to Claude Mythos. Note that the OpenAI model is generally available.Here is the Institute’s evaluation of Mythos.And here is an analysis of a smaller, cheaper model. It requires more scaffolding from the prompter, but it is also just as good.
via Schneier on Security https://ift.tt/qeYuUxl
AI Security Institute
Our evaluation of OpenAI's GPT-5.5 cyber capabilities | AISI Work
AISI conducted cyber evaluations on OpenAI's GPT-5.5. GPT-5.5 is one of the strongest models we have tested on our cyber tasks and is the second model to solve one of our multi-step cyber-attack simulations end-to-end.
Bruce Schneier:
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak:I’m giving a virtual talk on “The Security of Trust in the Age of AI,” hosted by the Financial Women’s Association of New York, at 6:00 PM ET on May 21, 2026.I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24–25, 2026, and my talk will be the evening of June 24.I’m speaking at the Digital Humanism Conference in Vienna, Austria, on Tuesday, June 26, 2026.I’m speaking at the Nuremberg Digital Festival in Nuremburg, Germany, on Wednesday, July 1, 2026.The list is maintained on this page.
via Schneier on Security https://ift.tt/DhNpZ0b
Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak:I’m giving a virtual talk on “The Security of Trust in the Age of AI,” hosted by the Financial Women’s Association of New York, at 6:00 PM ET on May 21, 2026.I’m speaking at the Potsdam Conference on National Cybersecurity at the Hasso Plattner Institut in Potsdam, Germany. The event runs June 24–25, 2026, and my talk will be the evening of June 24.I’m speaking at the Digital Humanism Conference in Vienna, Austria, on Tuesday, June 26, 2026.I’m speaking at the Nuremberg Digital Festival in Nuremburg, Germany, on Wednesday, July 1, 2026.The list is maintained on this page.
via Schneier on Security https://ift.tt/DhNpZ0b
www.fwa.org
The Security of Trust in the Age of AI
The rules of finance are being rewritten by machines. As AI evolves from a tool into an autonomous "agent," the financial sector faces a crisis of systemic integrity. Join Harvard Kennedy School security technologist Bruce Schneier for a strategic briefing…
Bruce Schneier:
Bypassing On-Camera Age-Verification Checks
Some AI-based video age-verification checks can be fooled with a fake mustache.
via Schneier on Security https://ift.tt/MgonBjJ
Bypassing On-Camera Age-Verification Checks
Some AI-based video age-verification checks can be fooled with a fake mustache.
via Schneier on Security https://ift.tt/MgonBjJ
TechCrunch
Some kids are bypassing age-verification checks with a fake mustache | TechCrunch
A new survey found that kids find it easy to bypass age checks, despite a rise in age-verification laws around the world.
Bruce Schneier:
Friday Squid Blogging: Bigfin Squid
Article about the bigfin squid.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/wUK52xD
Friday Squid Blogging: Bigfin Squid
Article about the bigfin squid.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/wUK52xD
BBC Science Focus Magazine
This is our clearest look yet at one of the deep ocean’s rarest animals | BBC Science Focus Magazine
Meet the bigfin squid, a quid with 'elbows', enormous rippling fins and tentacles like long, rippling strands of spaghetti
Bruce Schneier:
Zero-Day Exploit Against Windows BitLocker
It’s nasty, but it requires physical access to the computer:The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments.Slashdot thread. And here’s Nightmare-Eclipse’s GitHub account.
via Schneier on Security https://ift.tt/f2qvT9B
Zero-Day Exploit Against Windows BitLocker
It’s nasty, but it requires physical access to the computer:The exploit, named YellowKey, was published earlier this week by a researcher who goes by the alias Nightmare-Eclipse. It reliably bypasses default Windows 11 deployments of BitLocker, the full-volume encryption protection Microsoft provides to make disk contents off-limits to anyone without the decryption key, which is stored in a secured piece of hardware known as a trusted platform module (TPM). BitLocker is a mandatory protection for many organizations, including those that contract with governments.Slashdot thread. And here’s Nightmare-Eclipse’s GitHub account.
via Schneier on Security https://ift.tt/f2qvT9B
Ars Technica
Zero-day exploit completely defeats default Windows 11 BitLocker protections
It's not entirely clear how the exploit works. Microsoft says it's investigating.
Bruce Schneier:
Laurie Anderson Is Quoting Me
Not by name, but Laurie Anderson quotes me in one of the tracks of her new album:My favorite quote is from a cryptologist who said “If you think technology will solve your problems, you don’t understand technology and you don’t understand your problems.”Also in interviews:“Of course, it’s ridiculous, outrageous, blah, blah, blah,” Anderson says about the ad. ‘But, I mean, my favorite quote on this is from a cryptologist who said, ‘If you think technology will solve your problems, you don’t understand technology  and you don’t understand your problems.’ And I think I’m completely on board with that.”People are telling me that she has been reciting this quote in performances for years. (I lost track of her since college and her 1981 hit “”https://www.youtube.com/watch?v=Vkfpi2H8tOE”>O Superman.”)The origins of the quote is from Roger Needham:If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.I modified the quote in the preface to my 2000 book Secrets and Lies:A few years ago I heard a quotation, and I am going to modify it here: If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.I can’t tell you why me in 2000 didn’t credit Needham by name. I should have.I have used the quote pretty consistently since then. Somewhere along the line I dropped “security” from the phrase, and now say it more like Anderson quotes me:If you think technology will solve your problem, you don’t understand your problem and you don’t understand technology.I sometimes use singular and sometimes use plural. Sometimes I say “the problem” and “the technology.” But I think the quote flows better ending with just the word “technology.”
via Schneier on Security https://ift.tt/laDtx6F
Laurie Anderson Is Quoting Me
Not by name, but Laurie Anderson quotes me in one of the tracks of her new album:My favorite quote is from a cryptologist who said “If you think technology will solve your problems, you don’t understand technology and you don’t understand your problems.”Also in interviews:“Of course, it’s ridiculous, outrageous, blah, blah, blah,” Anderson says about the ad. ‘But, I mean, my favorite quote on this is from a cryptologist who said, ‘If you think technology will solve your problems, you don’t understand technology  and you don’t understand your problems.’ And I think I’m completely on board with that.”People are telling me that she has been reciting this quote in performances for years. (I lost track of her since college and her 1981 hit “”https://www.youtube.com/watch?v=Vkfpi2H8tOE”>O Superman.”)The origins of the quote is from Roger Needham:If you think cryptography can solve your problem, you don’t understand your problem and you don’t understand cryptography.I modified the quote in the preface to my 2000 book Secrets and Lies:A few years ago I heard a quotation, and I am going to modify it here: If you think technology can solve your security problems, then you don’t understand the problems and you don’t understand the technology.I can’t tell you why me in 2000 didn’t credit Needham by name. I should have.I have used the quote pretty consistently since then. Somewhere along the line I dropped “security” from the phrase, and now say it more like Anderson quotes me:If you think technology will solve your problem, you don’t understand your problem and you don’t understand technology.I sometimes use singular and sometimes use plural. Sometimes I say “the problem” and “the technology.” But I think the quote flows better ending with just the word “technology.”
via Schneier on Security https://ift.tt/laDtx6F
CBC
Laurie Anderson on the fantastic and catastrophic uses of AI in art | CBC Arts
In an interview with Q’s Tom Power, the groundbreaking American artist also shares her advice for the next generation of creators.
Bruce Schneier:
On AI Security
Good report:Executive Summary: Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t actually work for measuring AI capabilities (even when they are NOT emergent systemic properties like security). So let’s take a step back: how do you measure security in the first place? Good question. Over the last 30 years, security engineering for software evolved from black box penetration testing, through whitebox code analysis and architectural risk analysis to de facto process-driven standards like the Building Security In Maturity Model (BSIMM). Software had a very deep impact on business operations, and it appears that AI is going to have an even deeper impact. Will a software security-like measurement move work for AI? Probably. In the meantime we can make real progress in AI security by cleaning up our WHAT piles and managing risk by identifying and applying good assurance processes. (Spoiler alert: no matter what we do, we still don’t get a security meter for AI, so we need to be extra vigilant about security.)
via Schneier on Security https://ift.tt/jT5hOPB
On AI Security
Good report:Executive Summary: Let’s say you wanted to make sure that your AI is secure. Can you just maximize the security and privacy benchmark and call it a day? Nope, because benchmarks don’t actually work for measuring AI capabilities (even when they are NOT emergent systemic properties like security). So let’s take a step back: how do you measure security in the first place? Good question. Over the last 30 years, security engineering for software evolved from black box penetration testing, through whitebox code analysis and architectural risk analysis to de facto process-driven standards like the Building Security In Maturity Model (BSIMM). Software had a very deep impact on business operations, and it appears that AI is going to have an even deeper impact. Will a software security-like measurement move work for AI? Probably. In the meantime we can make real progress in AI security by cleaning up our WHAT piles and managing risk by identifying and applying good assurance processes. (Spoiler alert: no matter what we do, we still don’t get a security meter for AI, so we need to be extra vigilant about security.)
via Schneier on Security https://ift.tt/jT5hOPB
Bruce Schneier:
macOS Kernel Memory Corruption Exploit
A group used Anthropic’s Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple’s M5.News article.
via Schneier on Security https://ift.tt/VaiHgW7
macOS Kernel Memory Corruption Exploit
A group used Anthropic’s Mythos AI model to help find a kernel memory corruption vulnerability and exploit on Apple’s M5.News article.
via Schneier on Security https://ift.tt/VaiHgW7
blog.calif.io
First public macOS kernel memory corruption exploit on Apple M5
Apple spent five years building hardware and software to make memory corruption exploits dramatically harder. Our engineers, working together with Mythos Preview, built a working exploit in five days.
Bruce Schneier:
CISA Security Leak
Crazy story:Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.News article.
via Schneier on Security https://ift.tt/fzaDd7M
CISA Security Leak
Crazy story:Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.News article.
via Schneier on Security https://ift.tt/fzaDd7M
Krebs on Security
CISA Admin Leaked AWS GovCloud Keys on Github
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems.…
Bruce Schneier:
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/3iw7vEy
Friday Squid Blogging: Regulating Squid Fishing in the South Pacific
The South Pacific Regional Fisheries Management Organization (SPRFMO) needs to regulate squid fishing in the South Pacific.As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.Blog moderation policy.
via Schneier on Security https://ift.tt/3iw7vEy
The Good Men Project
The Squid Rush in the South Pacific Is Forcing Regulators to Act
Fishing for jumbo flying squid (Dosidicus gigas) has expanded rapidly over the past two decades.