Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
precedence: bulk
Subject: Risks Digest 32.68
RISKS-LIST: Risks-Forum Digest Friday 21 May 2021 Volume 32 : Issue 68
ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator
***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/32.68>
The current issue can also be found at
<http://www.csl.sri.com/users/risko/risks.txt>
Contents:
Waymo self-driving taxi fumbles in construction Zone, Blocks Traffic
(Youtube)
Tesla's Autopilot Mode Crashed a Car Right Into a Washington State Cop Car
(Gizmodo)
Tesla Autopilot system was on during fatal California crash, adding to
self-driving safety concerns (WashPost)
Your Car Is Spying on You. A CBP Contract Shows the Risks. (The Intercept)
Get Ready for In-Car Ads (The Intercept via geoff goodfellow)
CNA paid $40M for ransomware (Bloomberg)
Irish Health Service hit by ransomware (BBC)
Technobabble, Libertrarian Derp and Bitcoin (Paul Krugman)
The Full Story of the Stunning RSA Hack Can Finally Be Told (WiReD)
Flaw in Japan vaccine reservation system leaves government red-faced
(The Japan Times)
Just 12 People Are Behind Most Vaccine Hoaxes On Social Media, Research
Shows (NPR)
Prosecutors probe Pennsylvania contact-tracing data breach
(Meadville Tribune)
Millions of fake commenters asked the FCC to end net neutrality.
*Astroturfing* is a business model. (WashPost)
Police Departments Adopting Facial Recognition Tech Amid Allegations of
Wrongful Arrests (60 Minutes)
The Disinformation Dozen (NPR via Rob Slade)
Magecart Hackers Now hide PHP-Based Backdoor In Website Favicons
(The Hacker News)
Lies on Social Media Inflame Israeli-Palestinian Conflict (NYTimes)
Tech audit of Colonial Pipeline found glaring' problems (AP)
'Extreme Reaction' By Colonial Pipeline Baffles Energy Experts
(Arlington VA Patch)
DarkSide group that attacked Colonial Pipeline drops from sight online
(NYTimes)
FBI leads investigation of RPI computer attack (Albany Times Union)
Microsoft Data Shows That The FCC's Broadband Maps Are Fantasy (TechDirt)
Cheating Charges Upend Dartmouth Medical School (NYTimes)
Bias Is a Big Problem. But So Is Noise. (NYTimes)
We Found Joe Biden's Secret Venmo. Here's Why That's A Privacy Nightmare
For Everyone (Buzzfeed News)
Open Source and Cybersecurity (ZDNet via Rebecca Mercuir)
U.S. Has Almost 500,000 Job Openings in Cybersecurity (CBS News)
Californian RoboCop Had To Deal With Its First Crime, And It Did Not Go Well
(IFLScience)
The United States should make cybercrime a high priority (WashPost)
Mob Violence Against Palestinians in Israel Is Fueled by Groups on WhatsApp
(NYTimes)
Coinbase is down for some users as Bitcoin sees massive sell-off (CNBC)
Dutch civil servants used social media to spy on citizens, says study
(EuroNews)
How to Solve Captchas -- and Why They've So Hard to Solve (WiReD)
Cracking the Code of Letterlocking (Atlas Obscura)
Re: Marvin hacked (Tom Van Vleck)
Re: RISKS and Zero Day (Kim Zetter)
Re: I have been pwned! -- but not really (Merlyn)
Re: A mom panicked when her 4-year-old bought $2,600 in SpongeBob, Popsicles
(Bernie Cosell)
MIT STAMP/STPA Virtual Workshop 2021 (Nancy Leveson)
Abridged info on RISKS (comp.risks)
----------------------------------------------------------------------
Date: Sun, 16 May 2021 19:06:41 +0300
From: Amos Shapir <amos083@gmail.com>
Subject: Waymo self-driving taxi fumbles in construction Zone, Blocks
Traffic (Youtube)
This clip posted by JJRicks, shows a ride on a Waymo autonomous taxi, which
got confused about the meaning of traffic cones:
https://www.youtube.com/watch?v=zdKCQKBvH-A
[Lauren Weinstein noted this:
Waymo robocar gets stuck, blocks traffic, then attempts to escape its
human overseers
https://youtu.be/zdKCQKBvH-A?t=757
PGN]
------------------------------
Date: Tue, 18 May 2021 10:45:53 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Tesla's Autopilot Mode Crashed a Car Right Into a Washington State
Cop Car (Gizmodo)
https://gizmodo.com/teslas-autopilot-mode-crashed-a-car-right-into-a-washin-1846916808
------------------------------
Date: Fri, 14 May 2021 19:23:24 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Tesla Autopilot system was on during fatal California crash, adding
to self-driving safety concerns (WashPost)
Tesla Autopilot system was on during fatal California crash, adding to
self-driving safety concerns
https://www.washingtonpost.com/technology/2021/05/14/tesla-california-autopilot-crash/?utm_campaign=wp_main&utm_source=twitter&utm_medium=social
------------------------------
Date: Mon, 17 May 2021 00:14:27 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Your Car Is Spying on You. A CBP Contract Shows the Risks.
(The Intercept)
A vehicle forensics kit can reveal where you've driven, what doors you
opened, and who your friends are.
U.S. Customs and Border Protection purchased technology that vacuums up
reams of personal information stored inside cars, according to a federal
contract reviewed by The Intercept, illustrating the serious risks in
connecting your vehicle and your smartphone.
The contract, shared with The Intercept by Latinx advocacy organization
Mijente, shows that CBP paid Swedish data extraction firm MSAB $456,073 for
a bundle of hardware including five vehicle forensics kits manufactured by
Berla, an American company. A related document indicates that CBP believed
the kit would be ``critical in CBP investigations as it can provide evidence
[not only] regarding the vehicle's use, but also information obtained
through mobile devices paired with the infotainment system.'' The document
went on to say that iVe was the only tool available for purchase that could
tap into such systems.
https://theintercept.com/2021/05/03/car-surveillance-berla-msab-cbp/
------------------------------
Date: Sun, 16 May 2021 17:48:26 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: Get Ready for In-Car Ads (The Intercept)
Because being bombarded with roadside signage while taking a leisurely
Sunday drive isn't enough, Ford has patented a new system that uses a
vehicle's cameras to detect billboards and then pull them up on a car's
infotainment display as inescapable in-vehicle advertisements.
<https://pdfaiw.uspto.gov/.aiw?docid=20210133810&SectionNum=1&IDKey=1E5A14DC9924&HomeUrl/>
<https://thenextweb.com/news/ford-new-patent-ruin-driving-forever-hell>
Billboards are an effective way to subliminally make a driver hungry for an
approaching fast food restaurant, or convince them they need to pull off the
road and visit a nearby outlet mall for some discount Reeboks. What
billboards aren't great at is providing detailed information like a phone
number, an address, or a website, as even large signage often isn't visible
long enough for a driver or passenger to memorize important details. That's
the problem Ford is trying to solve with this new system it's patenting --
although the larger potential here is concerning.
Many vehicles now come standard with built-in cameras that are either used
for autonomous driving features, security, or for providing a driver with a
view outside the vehicle to make parking easier. What Ford wants to do is
leverage those cameras to also keep an eye out for passing billboards, and
then use image recognition to put a copy of the advertisement on a vehicle's
infotainment screens so it's visible to the driver and passengers for
longer. The system would also intelligently analyze the content of the
billboard and generate hyperlinks, either for easily dialing a posted phone
number, or for bringing up a company's website to see additional information.
https://gizmodo.com/get-ready-for-in-car-ads-1846888390
[More distractions for the surrogate-driver in a driverless vehicle (who
is still supposed to be paying attention), or for the actual driver in a
conventional vehicle with already distracting electronic displays. This
is a really terrible idea. Perhaps it would inspire a renewed attempt at
"Smell-o-Vision", although the 1960 movie-theater attempt ran into
lingering scents that would not go away, and the concept was quickly
abandoned. That's my two-scents' worth. PGN]
------------------------------
Date: Fri, 21 May 2021 9:38:35 PDT
From: Peter Neumann <neumann@csl.sri.com>
Subject: CNA paid $40M for ransomware (Bloomberg)
[Re: Colonial paid $5m ransom which I noted in RISKS-32.67,
here's another case. PGN]
Insurance carrier CNA paid a $40 million dollar ransom after an attack in
March 2021,
https://www.bloomberg.com/news/articles/2021-05-20/cna-financial-paid-40-million-in-ransom-after-march-cyberattack
------------------------------
Date: Fri, 14 May 2021 10:56:46 PDT
From: Peter G Neumann <neumann@csl.sri.com>
Subject: Irish Health Service hit by ransomware (BBC)
https://www.bbc.com/news/world-europe-57111615
------------------------------
Date: Fri, 21 May 2021 9:55:56 PDT
From: Peter Neumann <neumann@csl.sri.com>
Subject: Technobabble, Libertrarian Derp and Bitcoin (Paul Krugman)
Paul Krugman, *The New York Times*, 21 May 2021
Rising asset prices don't mean that silly ideas necesarily make sense.
Last para:
The good news is that none of this matters very much. Because Bitcoin and
its relatives haven't managed to achieve any meaningful economic role,
what happens to their value is basically irrelevant to those of us not
playing the crypto game.
------------------------------
Date: Fri, 21 May 2021 00:43:38 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: The Full Story of the Stunning RSA Hack Can Finally Be Told (WiReD)
In 2011, Chinese spies stole the crown jewels of cybersecurity -- stripping
protections from firms and government agencies worldwide. Here's how it
happened.
https://www.wired.com/story/the-full-story-of-the-stunning-rsa-hack-can-finally-be-told/
------------------------------
Date: Tue, 18 May 2021 20:43:55 +0900
From: Dave Farber <farber@gmail.com>
Subject: Flaw in Japan vaccine reservation system leaves government
red-faced (The Japan Times)
A quote that should apply to all software systems:
``It would have been better if we had fixed it from the start,'' the
minister said, adding that the ministry does not plan to conduct a large
system overhaul.
Flaw in Japan vaccine reservation system leaves government red-faced
Japan Times, 18 May 2021
<https://www.japantimes.co.jp/news/2021/05/18/national/japan-vaccine-reservation-flaw/>
<https://cdn-japantimes.com/wp-content/uploads/2021/05/np_file_87756-1.jpeg>
The Defense Ministry says it will fix a fault in the booking system for the
large vaccination centers it operates. | KYODO
The government said Tuesday it will fix a COVID-19 vaccine booking system
fault that allowed reservations to be made using nonexistent application
numbers.
The announcement came a day after the government started accepting online
bookings for older people to receive shots at large Self-Defense
Forces-staffed vaccination centers in Tokyo and Osaka as it attempts to ramp
up its inoculation rollout amid a fourth wave of infections.
The state-run booking system for the vaccination center in Tokyo was found
to accept municipality code numbers and vaccination ticket numbers that were
not issued by respective authorities.
"We plan on fixing (the system) so we can confirm the inputted data are
genuine information," Defense Minister Nobuo Kishi said at a news
conference.
"It would have been better if we had fixed it from the start," the minister
said, adding that the ministry does not plan to conduct a large system
overhaul.
The problem was reported Monday by major news organizations Asahi Shimbun
Publications Inc. and the Mainichi Shimbun, which signed up to test the
system using fictitious information. Both said in their reporting that they
had canceled reservations they created.
Kishi said he takes the actions of the companies "very seriously," calling
them "malicious and very regrettable" despite the significant flaws they
brought to light.
He asked the public not to make appointments using false information to
ensure slots are available to those who are eligible and so vaccines are not
wasted.
The problem with vaccination ticket numbers, issued to eligible individuals
by their municipality, was put down to a failure to cross-reference data in
the system with that from local municipalities, according to the Defense
Ministry.
"We did not think it appropriate for the Defense Ministry to retain private
information of every individual in the country subject to vaccination,"
Kishi said.
At a separate news conference, Chief Cabinet Secretary Katsunobu Kato warned
the government may consider taking legal action against people or groups
deemed to have taken advantage of the system failure in a malicious manner,
such as making many reservations using fictitious data.
Currently, residents of Tokyo's 23 wards and the city of Osaka age 65 or
older are able to make appointments via the Defense Ministry's website and
the Line messaging app but spots are filling up quickly with the launch of
online bookings.
The government moved to set up mass vaccination centers operated mostly by
Self-Defense Forces doctors and nurses to accelerate its vaccine rollout,
given only around 3% of its population of 126 million has received at least
one shot of a vaccine, the slowest vaccination rate among major economies.
Some municipalities that run local inoculation venues have experienced
problems processing appointments as phone lines and computer systems have
been overloaded.
According to the Defense Ministry, around 44,000 slots for the Tokyo center were booked by 7 a.m. Tuesday out of the 50,000 that had been made available between May 24 and May 30.
Additionally, all of the 25,000 slots for the Osaka center were filled
within 25 minutes on Monday afternoon, the ministry said.
Japan began inoculation of its older population of about 36 million in
mid-April after its vaccination effort for health care workers started in
February.
[Does anyone believe that the huge influx of counterfeit
proof-of-vaccination cards is going to increase herd immunity? I have not
heard the herd crying out for salvation. PGN]
------------------------------
Date: Fri, 14 May 2021 09:19:05 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Just 12 People Are Behind Most Vaccine Hoaxes On Social Media,
Research Shows ()
https://www.npr.org/2021/05/13/996570855/disinformation-dozen-test-facebooks-twitters-ability-to-curb-vaccine-hoaxes?utm_campaign=storyshare&utm_source=twitter.com&utm_medium=social
------------------------------
Date: Thu, 13 May 2021 14:51:12 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Prosecutors probe Pennsylvania contact-tracing data breach
(Meadville Tribune)
This impacted 72K people relative to COVID-19.
https://www.meadvilletribune.com/coronavirus/prosecutors-probe-pennsylvania-contact-tracing-data-breach/article_c97c5eb9-d364-52bd-a8d4-d85f8d3a129e.html
------------------------------
Date: Fri, 14 May 2021 21:53:30 -0400
From: Monty Solomon <monty@roscom.com>
Subject: Millions of fake commenters asked the FCC to end net neutrality.
*Astroturfing'* is a business model. (WashPost)
The technology used this time may be new, but the business model has been
around for decades.
https://www.washingtonpost.com/politics/2021/05/14/millions-fake-commenters-asked-fcc-end-net-neutrality-astroturfing-is-business-model/
------------------------------
Date: Mon, 17 May 2021 12:34:06 -0400 (EDT)
From: ACM TechNews <technews-editor@acm.org>
Subject: Police Departments Adopting Facial Recognition Tech Amid
Allegations of Wrongful Arrests (60 Minutes)
Anderson Cooper, 60 Minutes 16 May 2021 via ACM TechNews, 17 May 2021
U.S. police departments are adopting facial recognition technology, despite
complaints of wrongful arrests resulting from its use. Clare Garvie at
Georgetown University Law's Center on Privacy and Technology thinks facial
recognition has been involved in hundreds of thousands of such cases, in
which users incorrectly assume the technology is faultless, given the
mathematical basis of its matches. The U.S. National Institute of Standards
and Technology's Patrick Grother evaluates prototype facial recognition
algorithms, and his team published a landmark study which determined that
many facial recognition algorithms found it difficult to distinguish between
Black, Asian, and female faces. Grother said false negatives arising from
such errors could lead to wrongful arrests. Since last summer, three Black
men have sued for wrongful arrest involving facial recognition; said Garvie,
"The fact that we only know of three misidentifications is more a product of
how little we know about the technology than how accurate it is."
https://orange.hosting.lsoft.com/trk/click?ref=znwrbbrs9_6-2b09ax22b48bx069479&
------------------------------
Date: Fri, 14 May 2021 12:05:48 -0700
From: Rob Slade <rslade@gmail.com>
Subject: The Disinformation Dozen (NPR)
An intriguing piece of research has found that the majority of antivax
disinformation is being distributed by only twelve people.
https://www.npr.org/2021/05/13/996570855/disinformation-dozen-test-facebooks-twitters-ability-to-curb-vaccine-hoaxes
On the downside, these few people are having a massively disproportionate
effect on public discourse and behaviour. Although only a dozen people are
the instigators, they use multiple accounts, get reposted by many others,
and use various ruses to try and avoid being banned by social media
platforms.
On the plus side, if this research holds true for other forms of
disinformation, it does indicate that a concerted effort could seriously
reduce the disinformation problem overall ...
------------------------------
Date: Fri, 14 May 2021 10:03:48 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: Magecart Hackers Now hide PHP-Based Backdoor In Website Favicons
(The Hacker News)
Cybercrime groups are distributing malicious PHP web shells disguised as a
favicon to maintain remote access to the compromised servers and inject
JavaScript skimmers into online shopping platforms with an aim to steal
financial information from their users.
"These web shells known as Smilodon or Megalodon are used to dynamically
load JavaScript skimming code via server-side requests into online stores,"
Malwarebytes J=C3=A9r=C3=B4me Segura said
<https://blog.malwarebytes.com/cybercrime/2021/05/newly-observed-php-based-skimmer-shows-ongoing-magecart-group-12-activity/>
in a Thursday write-up. "This technique is interesting as most client-side
security tools will not be able to detect or block the skimmer."
Injecting web skimmers on e-commerce websites to steal credit card details
is a tried-and-tested modus operandi of Magecart, a consortium of different
hacker groups who target online shopping cart systems. Also known as
formjacking attacks, the skimmers take the form of JavaScript code that the
operators stealthily insert into an e-commerce website, often on payment
pages, with an intent to capture customers' card details in real-time and
transmit them to a remote server.
While injecting skimmers typically work by making a client-side request to
an external JavaScript resource hosted on an attacker-controlled domain when
a customer visits the online store in question, the latest attack is a
little different in that the skimmer code is introduced into the merchant
site dynamically at the server-side. [...]
https://thehackernews.com/2021/05/magecart-hackers-now-hide-php-based.html
------------------------------
Date: Fri, 14 May 2021 12:20:52 -0700
From: Lauren Weinstein <lauren@vortex.com>
Subject: Lies on Social Media Inflame Israeli-Palestinian Conflict (NYTimes)
https://www.nytimes.com/2021/05/14/technology/israel-palestine-misinformation-lies-social-media.html
------------------------------
Date: Sat, 15 May 2021 09:43:34 -1000
From: geoff goodfellow <geoff@iconia.com>
Subject: Tech audit of Colonial Pipeline found glaring' problems (AP)
An outside audit three years ago of the major East Coast pipeline company
hit by a cyberattack found *atrocious* information management practices and
``A Patchwork of poorly connected and secured systems,'' its author told The
Associated Press.
``We found glaring deficiencies and big problems,'' said Robert
F. Smallwood, whose consulting firm delivered an 89-page report in January
2018 after a six-month audit. ``I mean an eighth-grader could have hacked
into that system.''
How far the company, Colonial Pipeline, went to address the vulnerabilities
isn't clear. Colonial said Wednesday that since 2017, it has hired four
independent firms for cybersecurity risk assessments and increased its
overall IT spending by more than 50%. While it did not specify an amount, it
said it has spent tens of millions of dollars.
``We are constantly assessing and improving our security practices -- both
physical and digital,'' the privately held Georgia company said in response
to questions from the AP about the audit's findings. It did not name the
firms who did cybersecurity work but one firm, Rausch Advisory Services,
located in Atlanta near Colonial's headquarters, acknowledged being among
them. Colonial's chief information officer sits on Rausch's advisory board.
[...]
https://apnews.com/article/va-state-wire-technology-business-1f06c091c492c1630471d29a9cf6529d
------------------------------
Date: Sat, 15 May 2021 16:51:19 -0400
From: Gabe Goldberg <gabe@gabegold.com>
Subject: 'Extreme Reaction' By Colonial Pipeline Baffles Energy Experts
(Arlington VA Patch)
VIRGINIA -- The major East Coast pipeline behind the gasoline shortages in
the Southeast and mid-Atlantic is coming under scrutiny for its information
technology and cybersecurity practices.
Colonial Pipeline revealed Friday that it had been the target of a
cyberattack on its information technology system. The company said the
hackers stole nearly 100 gigabytes of data and encrypted at least a portion
of the company's information technology network.
The hackers, however, did not obtain access to the operational technology
side of the pipeline company's system. But Colonial Pipeline still decided
to shut down the entire pipeline system, which provides nearly 50 percent of
the gasoline and jet fuel to East Coast markets.
The decision to shut down the pipeline system has caused major shortages of
gasoline. In Virginia, 55 percent of gas stations had run dry of supplies as
of Thursday morning, according to GasBuddy, which tracks supply. In the
District of Columbia, about 51 percent of stations were out of gas. [...]
The cyberattack targeted the portion of Colonial Pipeline's technology
network that most of its employees use to check their email, review
contracts and write and distribute invoices, Bloomberg reported Wednesday.
Colonial Pipeline had no evidence that its operational technology systems,
which are not connected to its information technology system, had been
compromised in the attack, the company said. [...]
Pipeline system operations became more digital in the 1990s and 2000s.
According to an Associated Press report, though, an outside audit conducted