Holiday Extravaganza – Supply Chain, Hardware Hacking, Vulnerabilities, News – PSW #809

As long as we still need to advise this: "Ensure the Unitronics PLC default password “1111” is not in use." - We will be vulnerable, and attackers will be wildly successful.

Its gets a bad rap, for a whole host of reasons. This article leaves out A LOT. For example, there is not one mention of GPIO in the entire article. For me, this is the most powerful feature as it allows for add-ons and a ton of possibilities.

But no CVE was issued...

I think we need to re-define what "new" means: "This malware family is written using the .NET framework and leverages the domain name service (DNS) protocol to create a covert channel and provide different backdoor functionalities. Threat actors have used this along with the other two tools in multiple attacks targeting organizations across the U.S., Middle East and Africa. Its C2 infrastructure dates back to 2020."

I covered an article a while back that talked about instant boot PCs and issues with BIOS logos. This is a problem and one that I believe has existed for some time.

A long, detailed explanation of how the near-collapse and revival of OpenAI happened. My main takeaway is that Microsoft’s chief executive, Satya Nadella, is very good at his job. Microsoft faced a severe crisis, with their new Copilot suite of products based on OpenAI technology, and that company suddenly and inexplicably firing its CEO. Microsoft skillfully and calmly guided the parties to a solution that restored Sam Altman to lead OpenAI, removed the troublemakers from the board, and gave Microsoft a board seat at OpenAI.

Large Language. Models make a lot of mistakes responding to normal prompts -- from 3 to 27%. But when asked to look up data in SQL databases, they are much worse. They return accurate responses to most basic business queries just 22% of the time. And for intermediate and expert-level queries, accuracy plummeted to 0%.

TikTokers are sharing strangers’ conversations, hoping to expose gossipers to the very people they’re talking about. Is the humiliation worth it? This is a new form of privacy invasion.

An excellent recommendation from CISA, explaining how products should be designed so ordinary users will be reasonably secure, when using the default setup.

Artificial intelligence programs still struggle with basic problem-solving skills that people excel at. In fact, their complete lack of understanding of the physical world and lack of planning abilities puts them way below cat-level intelligence, never mind human-level.

Model Evaluation on Bedrock has two components: automated evaluation and human evaluation.. The automated tests assess the model’s performance on metrics like robustness, accuracy, or toxicity for tasks like summarization, text classification, question and answering, and text generation. The human tests can be customized, including tests for toxicity, empathy and friendliness.

A new covert channel exploits Spectre on modern CPUs with Spectre mitigations enabled. It works on many modern processors, and attacks a common code pattern that appears tens of thousands of times in the Linux kernel. In a demo , they leak the root password hash within half a minute on a last-generation Ubuntu system. The mitigation is to disable Linear Address Masking or LAM.

Star Trek fans have been using AI in an attempt to make a version of the acclaimed series Deep Space 9 that looks decent on modern TVs.. It’s actually quite good.