Marcel Brown: “I have always said if there ever came a day when I could no longer meet my duties and expectations as Apple’s CEO, I would be the first to let you know. Unfortunately, that day has come.” Steve Jobs, August 24th, 2011.

Edwin Kwan: Researchers from universities in Italy and the UK have released a paper disclosing four vulnerabilities in a popular smart bulb . The vulnerabilities allow hackers to control other smart home devices and gain access to the wifi network.

Mark Miller: From the research paper, ” Universal and Transferable Adversarial Attacks on Aligned Language Models”, the research team at CMU describe how they created adversarial prompts for the public interfaces to ChatGPT, Bard, and Claude, as well as open source LLMs, such as LLaMA-2-Chat, Pythia, Falcon, and others.

Katy Craig: On a recent Wednesday evening, a university professor in western Germany prepared paintings for auction at Christie’s . Using his iPhone, he snapped pictures of these artworks intending to upload them to Christie’s website. As the images were uploaded, their GPS coordinates were unknowingly revealed to anyone who viewed them online.

 

The Stories Behind the Cybersecurity Headlines

 

Edwin Kwan
Smart Bulb Vulnerabilities Allow Homes to Be Hacked

Researchers from universities in Italy and the UK have released a paper disclosing four vulnerabilities in a popular smart bulb. The researchers found two high severity and two medium severity vulnerabilities. The vulnerabilities allow hackers to control other smart home devices and gain access to the wifi network.

This is Edwin Kwan from Sydney, Australia.

The smart bulb is the Tapo L530E made by TP-Link . The vulnerabilities are due to authentication. Not being securely implemented and having weak cryptographic measures. Those weaknesses allow attackers to retrieve the Tapo user account details and passwords, which can be used to manipulate other Tapo devices.

Once the attacker has gained access to the Tapo account, they can extract the victim’s wifi, SSID, and password to gain access to their home network. The researchers had disclosed the vulnerabilities to TP Link, and the company is working to address the vulnerabilities.

Fixed versions have already been released for some of their products. It is strongly recommended when using IoT devices to keep them isolated on a separate network.

Resources
– https://arxiv.org/pdf/2308.09019.pdf
– https://www.tp-link.com/en/support/faq/3722/
– https://www.bleepingcomputer.com/news/security/tp-link-smart-bulbs-can-let-hackers-steal-your-wifi-password/

 

Mark Miller
There’s no way to stop LLM adversaries. None.

“There’s no way that we know of to patch this. We just don’t know how to make them secure,” This comes from Zico Kolter, an associate professor at CMU. Kolter and his research team have discovered that adding what appears to be an arbitrary short string of characters to a chat prompt can pretty much jailbreak several advanced LLM ChatBots. Kolter confirms that they have created literally thousands of these strings during their testing.

This is Mark Miller in New York City.

For context, publicly available chatbots such as ChatGPT have built in rules that, in theory, stop the bot from responding to queries that might return harmful results, queries such as “How do I build a bomb?” or “Help me plan a bank robbery.” There was even a contest at Defcon a couple weeks ago to see who could get the chat engines to return forbidden results.

From the research paper, “Universal and Transferable Adversarial Attacks on Aligned Language Models”, Zolter and the research team at CMU describe how they created adversarial prompts for the public interfaces to ChatGPT, Bard, and Claude, as well as open source LLMs such as LLaMA-2-Chat, Pythia, Falcon, and others. Instead of relying on manual engineering, “our approach automatically produces these adversarial suffixes by a combination of greedy and gradient-based search techniques.”

This is a scalable, automated approach to creating adversarial prompts. That’s why Zolter’s conclusion is so disturbing.

He did turn over the results of the research to OpenAI, Google, and Anthropic, but still, if his team can generate thousands of these types of strings to completely jailbreak the blocking mechanism, that means adversaries are already doing the same thing.

Breaking large language models is no longer a “fun game” with no consequences.

You can find a link for the code for the large language model attacks on GitHub. You’ll find source links to the research of Kolter’s team, including their GitHub project, the LLM Attacks website, and much more in the resources section of this episode at 505updates.com.

Resources
– Research paper: https://arxiv.org/pdf/2307.15043.pdf
– Website: https://llm-attacks.org/
– GitHub Project: https://github.com/llm-attacks/llm-attacks

 

Katy Craig
Security Lapse Reveals Locations of Artworks

On a recent Wednesday evening, a university professor in western Germany prepared paintings for auction at Christie’s, the renowned British auction house. Using his iPhone, he snapped pictures of these artworks, intending to upload them to Christie’s website. However, this seemingly routine action led to a shocking revelation.

This is Katy Craig in San Diego, California.

As the images were uploaded, their GPS coordinates were unknowingly revealed to anyone who viewed them online. This vulnerability allowed not only Christie’s but potentially hackers to pinpoint the exact location of these paintings, sometimes down to a few feet inside a building. Around 10% of images uploaded carried such precise GPS coordinates.

The incident sheds light on the broader issue of cybersecurity vulnerabilities affecting not just tech giants, but everyone transacting online. Even personal photos can inadvertently expose sensitive information. The professor’s case highlights that even trusted institutions like Christie’s are not immune to such pitfalls.

In a similar vein, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) recently issued a warning about vulnerabilities compromising personal, financial, and health information. Though not explicitly pointing at Christie’s, the agency’s alert mirrors the concerns raised by German cybersecurity researchers.

The incident underscores the importance of comprehensive cybersecurity measures, particularly in an increasingly digital world. The vulnerability has now been reportedly addressed, but it’s a stark reminder that in the realm of data, even small oversights can have significant consequences.

This is Katy Craig. Stay safe out there.

Resources
– https://www.washingtonpost.com/technology/2023/08/21/christies-security-breach-location/
– https://news.artnet.com/art-world/christies-data-breach-gps-2352936
– https://www.artnews.com/art-news/news/christies-published-location-data-consigned-artworks-1234677405/

 

Marcel Brown
This Day, August 24, 25, and 26 in Tech History

This is Marcel Brown serving you up some technology history for August 24th through the 26th.

August 24th, 1995. Kicking off one of the largest product launches in technology history, Microsoft releases the highly anticipated Windows 95. More than 1 million copies will be sold in the first four days of its release.

August 24th, 2011. ” I have always said if there ever came a day when I could no longer meet my duties and expectations as Apple’s CEO, I would be the first to let you know. Unfortunately, that day has come.” Steve Jobs Apple CEO Steve Jobs resigns amid rumors of failing health. Jobs passed away 43 days later on October 5th, 2011.

August 25th, 1991. Linus Torvalds posts a message to the Internet newsgroup comp.os.minix with the subject line, ” what would you like to see most in minix?” This is the first announcement that he’s working on an operating system that will one day become Linux.

August 26th, 1938. Radio station WQXR in New York City broadcast the program using a tape recorder for the first time. The tape recorder used was the Phillips-Miller Recording System, also known as “Miller Tape,” invented by James Arthur Miller.

That’s your technology history for today. For more, tune in next week and visit my website thisdayintechhistory.com.

Resources
– http://thisdayintechhistory.com/08/24
– http://thisdayintechhistory.com/08/25
– http://thisdayintechhistory.com/08/26