Exploring the intersection of security, technology, and society—and what might be coming next…
Standard Web Edition | January 9, 2023
If you’re not subscribed to the podcast version of the newsletter, please add it with your favorite client. APPLE | SPOTIFY | OTHER
SECURITY NEWS
The FBI is warning people to block online ads due to imposters poisoning search results. They advise users to 1) check ad URLs, 2) go to sites directly instead of via search, and 3) use an ad blocker. MORE
Sam Curry and friends have published a monster list of vulnerabilities across the automotive industry. Manufacturers affected include Ferrari, BMW, Rolls Royce, Porsche, and others. They were able to do things like remote unlock vehicles, precision-locate them, break into their internal infrastructure, do customer account takeovers, pull customer data, and much more. Seriously impressive work. MORE | SAM’S BLOG WRITEUP
There was a new Twitter dump making the rounds last week, but it appears to just be cleaned-up data from a previous scraping incident. It’s the same person who released both version; they were previously charging for it, and now they’re making it available for free. MORE
AWS is now encrypting new S3 buckets by default. MORE
Chick-fil-A is investigating “suspicious activity” regarding some customer accounts. MORE
Synology published patches for multiple critical vulnerabilities. MORE
Zoho is urging admins to patch ManageEngine immediately due to a critical bug that provides authenticated users access to the backend database. MORE
TECHNOLOGY NEWS
It looks like Apple will launch its long-awaited headset this year. Rumors are early, but it appears it’ll have a digital crown (think Apple Watch) that lets you adjust the amount of AR vs. reality. Sounds cool, but I’m really worried about how cool this thing will have to be to overcome the downside of a giant piece of hardware on your head. Certain things are hard deal-breakers for adoption and coolness-factor, and giant stuff on your head is one of them.That being said, it seems like the first version might be a VR headset similar to the Oculus, with the everyday glasses-type device coming later. MORE | GRUBER | MACRUMORS
Microsoft is about to take a major swipe at Google’s search dominance by integrating ChatGPT into Bing. It’ll be interesting to see how it goes because GPT isn’t super great at looking up facts right now. Its current form is somehow much better at replacing WIkipedia than Google. I’d just be happy to see anything that makes Google sweat. Their only innovation in search in the last several years seems to have been adding more ads. MORE
Tech companies laid off over 150,000 people in 2022, which is more than in 2020 or 2021. MORE
Amazon increased its layoffs from 10,000 to 18,000. Like many other companies, they’re blaming overeager hiring in previous years. MORE
Samsung’s last quarter profits fell an estimated 70% vs. last year. MORE
OpenAI may be selling some shares to a private equity fund in a deal that places its overall worth at around $29 billion. MORE
Apple has launched AI-powered book narrations. Really cool, but I’m still unable to use the Books app due to the lack of audiobook bundle pricing that exists with Amazon. MORE
Researchers tested GPT 3.5 against the Bar Exam and said GPT-4 will likely be able to pass it. MORE
Shopify has canceled all recurring meetings of more than two people and has encouraged employees to abstain from all large chats. Can’t wait to hear the results of this experiment. MORE
HUMAN NEWS
A Tesla with a man and his wife and two kids went 300 feet off the edge of the cliffs on Highway 1 in California, and everyone survived. The husband has now been arrested for attempted murder. MORE
The US is looking to ban non-compete agreements in labor contracts. The move would significantly increase mobility for employees and competition for talent. MORE
China is reopening its border with Hong Kong after three years of strict control. MORE
There’s a new mostly-automated McDonald’s in Fort Worth, Texas. It’s the first in a pilot of new automated locations that can do much of the entire process without humans. MORE
NYC schools are banning GPT on school devices and networks to avoid student cheating. Of course they’ll still be able to use it on their mobile devices, at home, etc. I think it says a whole lot that they haven’t banned Google in the same way. Doesn’t that kind of mean GPT is better for looking things up? MORE
The latest omicron subvariant is now responsible for around 40% of US cases. MORE
The US is coming after $460 million in FTX-related money at Robinhood. MORE
IDEAS & ANALYSIS
ChatGPT in Security: Who Wins in Red vs. Blue
Here’s a fun question: who is going to be better at using ChatGPT and future models for cybersecurity attack and defense? Will it be the attackers or the defenders? My money is on the attackers for no reason other than them having higher numbers, more time, and more scrappiness. Most defenders are professionals, while many attackers are either state-sanctioned or offensive security is their only viable path to a decent income. I see that difference putting most of the creative advantage on the attacker’s side, and that’s just adding to the natural asymmetry of “attackers can fail constantly and just hope to get lucky once vs. defenders needing to be right all the time.” Examples of AI-powered attacks will (and already are in some cases) include faster and better phishing campaigns, automated exploit code writing, automated reverse engineering, automated BEC and other social engineering, information warfare campaigns, etc. Other than elite researchers and state-sponsored good hackers, I expect the defenders to be overwhelmed by the volume and creativity of AI-augmented attacks from those on the attacker side. MORE
NOTES
I’ve updated my LinkedIn profile to reflect that I’m now full-time at Unsupervised Learning. What a great feeling! Incredibly stoked for the products I’m building and all the extra time I’m going to be putting into the show. It’s not even mid-month and we’ve already put out two member posts! MORE
Went to see my bestie Jason last week and it was glorious just hanging out, talking shop, and planning for 2023. Got to see him interact a ton with his kids as well, and it turns out he’s as good a father as he is a friend and hacker. It was wonderful to see. MORE
I did a bunch of AI art this weekend and published the gallery and the prompts I used to a new member post. MORE | SAMPLE
DISCOVERY
📄 Cloud Pentesting — An evolutionary timeline of getting into cloud-based pentesting. BLOG | BY SETH ART
AT&T predicted the internet in an ad in 1993. MORE
Excess management is costing the US $3 trillion a year. MORE
Accomplishments of Small Teams MORE
How LinkedIn rebuilt its threat detection and response program under the theme of a Software Defined SOC. MORE
Upcoming security conferences calendar. MORE
A calendar of security and privacy CFP deadlines. MORE
My Hacker Samurai art was particularly popular this weekend. MORE | MEMBER POST WITH TECHNIQUE AND PROMPTS
There’s big drama in the D&D space, with a new license going after competitors and attempting to control creators. MORE
Using GPT to create intelligence reports. MORE
RECOMMENDATION OF THE WEEK
Do a quick check of your backup situation. What all data is essential to you and your family? Do you have both a cloud and local backup of all that data? Run through some potential negative scenarios and make sure your current solution wouldn’t leave you without data that’s important to you. I like to do this exercise every January.
APHORISM OF THE WEEK
“The holy grail of discipline is getting your dopamine from effort rather than reward.”
Andrew Huberman (Paraphrased)