Newsletter

open source and cybersecurity news

August 14, 2023

- CYBERSECURITY HEADLINES TODAY -

LF Open Source Maintainers Report
Microsoft Discloses OT Vulnerabilities
4 Step Guidance for Using ChatGPT
This Day in Tech History

In this Episode:

Marcel Brown: August 13th, 1993. The Super NES version brought Street Fighter II into the home and uh, college dorm rooms where certain people spent many hours smacking down their dorm mates. I still have this game, so if anyone is feeling saucy, the smack downs can resume at any time.

Edwin Kwan: Linux Foundation research found that our technology infrastructure relies heavily on a few hundred open source projects. The maintainers of those projects bear a tremendous burden, as their projects are responsible for much of the global economy and disruptions to their project can cause massive problems and outages.

Katy Craig: Germany-based industrial automation software provider, Codesys, faces a security crisis. Microsoft researchers have uncovered over a dozen vulnerabilities in its products that could lead to remote takeover or denial of service for millions of industrial control systems.

Hillary Coover: According to a recent Reuters poll, 28% of American workers claim to use ChatGPT regularly for work. Chatbot input data is similar to browser history data in that both are discoverable and, with the right datasets correlated, can be deanonymized.

The rest of the story…

 

Edwin Kwan: The LF Open Source Maintainers Report

The Linux Foundation released a report on open source maintainers. They interviewed some of the communities’ most influential maintainers to understand more about how maintainers become maintainers and to capture their experiences, observations, and success stories.

This is Edwin Kwan from Sydney, Australia.

The research found that our technology infrastructure relies heavily on a few hundred open source projects, which represents a disproportionate percentage of software dependencies. The maintainers of those projects bear a tremendous burden, as their projects are responsible for much of the global economy and disruptions to their project can cause massive problems and outages.

Some of them work alone with little or no organizational support for their projects. The report covers areas such as how projects are growing their contributor base, governance and control, documentation, funding, diversity, and preventing burnout.

Resources
https://www.linuxfoundation.org/research/open-source-maintainers

 

Katy Craig: Microsoft Discloses OT Vulnerabilities

Germany-based industrial automation software provider, Codesys, faces a security crisis. Microsoft researchers have uncovered over a dozen vulnerabilities in its products that could lead to remote takeover or denial of service for millions of industrial control systems.

This is Katy Craig in San Diego, California.

Codesys produces software used in engineering control systems with its reach extending to approximately 1,000 different types of products manufactured by over 500 companies comprising millions of devices globally.

The risks posed by these vulnerabilities encompass Denial of Service attacks and remote code execution. These exploits could potentially target programmable logic controllers and other ICS devices employing Codesys software. Although exploiting these vulnerabilities necessitates authentication, Microsoft researchers proved how previous Codesys flaws, such as CVE-2019-9013, could be used for unauthorized access.

It’s important to note that while these vulnerabilities demand a strong understanding of Codesys V3’s proprietary protocol and user authentication, the potential damage from a successful attack is considerable. Microsoft’s findings serve as a stark reminder of the critical need to prioritize the security of ICS and the software that underpins them.

This is Katy Craig. Stay safe out there.

Resources
https://www.microsoft.com/en-us/security/blog/2023/08/10/multiple-high-severity-vulnerabilities-in-codesys-v3-sdk-could-lead-to-rce-or-dos/

 

Hillary Coover: 4 Step Guidance for Using ChatGPT

According to a recent Reuters poll, 28% of American workers claim to use ChatGPT regularly for work, while only 22% say their employers allow it. It’s a good opportunity to share some basic guidance and governance for employers who likely cannot control the adoption of chatbots.

Hi, this is Hillary Coover reporting from Washington, DC.

One of the most fundamental guidelines I like to share with people engaging with chatbots is to never input anything that you would not want published and attributed to you. While this is an unlikely occurrence, I assume that chatbot input data is similar to browser history data in that both are discoverable and, with the right datasets correlated, can be deanonymized. In essence, never input anything that you wouldn’t input into an insecure browser.

Second, automatically permit the usage and improvement of anything that is already present on your website and social media by your employees in chatbots.

Third, never upload personally identifiable information from employees or potential employees for human resource management purposes- this can potentially come back to haunt you.

Last, implement AI tools with oversight and enjoyment. Incorporate a weekly AI tool challenge that rewards employees for creativity and transparency. .

Resources

https://www.reuters.com/technology/chatgpt-fever-spreads-us-workplace-sounding-alarm-some-2023-08-11/

 

Marcel Brown: This Day, August 13th and 14th, in Tech History

This is Marcel Brown bringing you some technology history for August 13th and 14th.

August 13th, 1993.

Capcom releases Street Fighter II Turbo: Hyper Fighting for SNES in the US. The Street Fighter Two arcade game started the fighting game boom of the 1990s, which spawned off many other fighting game franchises such as Mortal Kombat and Virtua Fighter.

The Super NES version brought Street Fighter II into the home and uh, college dorm rooms where certain people spent many hours smacking down their dorm mates. I still have this game, so if anyone is feeling saucy, the smack downs can resume at any time.

August 14th, 2006.

Dell and Sony admit that flaws in Sony manufactured batteries used in certain Dell laptops could result in the batteries, overheating, catching fire, or exploding.
This came after several widely publicized reports in the proceeding months where Dell laptops did catch fire. They issue a recall of 4.1 million batteries, the largest safety recall in the history of the consumer electronics industry, still to this day. Even Samsung’s famous Galaxy Note Seven recall in 2016 only affected 2.5 million units.

Dell’s reputation suffered for many years and to some, has never fully recovered from the incident.

That’s your technology history for today. For more, tune in tomorrow and visit my website ThisDayInTechHistory.com.

Resources
http://thisdayintechhistory.com/08/13
http://thisdayintechhistory.com/08/14

 

Contributors:

Comments:

Newsletter