Security

“Top 10 Security Disasters in ML: How Laurel and Yanny Replaced Alice and Bob”: 2019 RSAC SF Presentation

Leave a comment

I’ll be presenting again (10th year in a row) at the RSA Conference in SF, discussing how the focus for our information security industry should have shifted fundamentally after 2014 from ongoing confidentiality to growing integrity concerns.

SESSION ID: MASH-F02

TITLE: Top 10 Security Disasters in ML: How Laurel and Yanny Replaced Alice and Bob

SCHEDULED SESSION DAY AND TIME: Friday, Mar 08, 9:50 AM

ROOM: Moscone West 2007

LENGTH: 50 minutes

ABSTRACT: A seismic shift is upon us. Integrity flaws stand looming and untamed despite the security industry making great progress in availability and confidentiality awareness and control. Now a crisis of trust is developing as developers rush into “machine learning” with integrity a paramount risk. This talk will expose keys of past breaches of integrity to help attendees prepare to control ones just ahead.

QUICK ABSTRACT: If you thought confidentiality breaches were a crisis, are you ready to detect and prevent integrity failures at machine speed?

LINK: https://www.rsaconference.com/industry-topics/presentation/top-10-security-disasters-in-ml-how-laurel-and-yanny-replaced-alice-and-bob (including PDF)

RECORDING:

Security

Apple Alert: SSD Data Loss in 13-inch Macbook Pro

Leave a comment

In an awkwardly worded statement, the laptop manufacturer has alerted owners of its 13-inch Macbook Pro that SSD firmware flaws are causing serious data corruption and even complete failure.

Apple has determined that a limited number of 128GB and 256GB solid-state drives (SSD) used in 13-inch MacBook Pro (non Touch Bar) units have an issue that may result in data loss and failure of the drive. 13-inch MacBook Pro units with affected drives were sold between June 2017 and June 2018.

Apple or an Apple Authorized Service Provider (AASP) will service affected drives, free of charge. Apple recommends having your drive serviced as soon as possible.

A few things stand out here:

  1. The firmware update means an Apple “technician will run a utility”
  2. The repair process is to backup your data, update the SSD firmware in a destructive manner, and then restore all your data from backup. And this begs the question why someone can’t do the update themselves if it means restoring a backup to a fresh OS install. Apple ought not be worried about data loss or failure in the process as that’s a guaranteed outcome. Are they concerned the firmware update would brick the laptop, or that the utility would grant too much authority to the end user?
  3. Data already destroyed by the faulty SSD can not be recovered
  4. Anyone who already paid for this service can get a refund. Although at the same time, it only “covers affected MacBook Pro models for 3 years after the first retail sale of the unit”. The repair will not be free if your SSD has faults beyond 3 years…
History, Security

2018 Ebola Crisis Worsens as US Regime Denies Aid

Leave a comment

Here’s a pithy comment by Peter Salama, head of the new Health Emergencies Program at the World Health Organization, about factors leading to Ebola crisis unfolding this year in DRC:

These viruses manage to exploit social vulnerabilities and fault lines. That’s what we’re seeing in this Ebola outbreak starkly.

And even more to the point:

In the last two years since I have been here, 80 percent of our major outbreaks have been in conflict-affected areas. This is the issue of the future.

The issue of urban outbreaks of high-threat pathogens is really an issue of our generation. I don’t think we’ve fully grappled with that. Now with yellow fever, plague, with Ebola, we are starting to see these patterns. All bets are off [in terms of] thinking we know about the transmission of diseases because of what happened in rural outbreaks in the past. It’s completely different now.

Ok, so you have this data showing conflict-affected areas are where the major outbreaks occur, and that is “the issue of the future”. Consider this in terms of infected drones easily deployed over/under/around barriers into urban areas, and then rapid lateral transmission.

I’m not trying to think out of the box here. This is an ancient security worry, for those familiar with the history of siege weaponry.

Who (pun not intended) can guess the current US regime’s response to the outbreak of a high-threat pathogen in the place most expected? Perhaps the title of this post gave away the answer.

Vox reporter Julia Belluz asks Salama the following:

The US pulled its Centers of Disease Control and Prevention workers out of Beni, the outbreak epicenter. They decided it was too dangerous for America’s best Ebola experts to be there — and it sounds like they are not coming back anytime soon. […] But I understand Canada, the UK, even nonprofits with US personnel, are sending people, and you have hundreds of WHO officials deployed. Is the US government an outlier?

This makes the American leadership appear weak and feckless; and Salama replies very diplomatically:

The US government is the main country that has had constraints.

Security

Insecurity of US Regime Impacts Trade

Leave a comment

China has downgraded the rating of US ability to partner or deliver goods, and is distancing itself from the instability of a white nationalist White House.

…the economic relationship between the U.S. and China has been permanently altered.

[…]

The president’s abrupt return to brinkmanship…underscored U.S. unpredictability.

[…]

…imposition of tariffs on more than $250 billion in Chinese goods already has prompted China to [buy] soybeans from Brazil rather than Indiana or Iowa.

[…]

Xi has personally directed a campaign to promote “self-reliance,” with public tours of China’s modern industries in the south and its traditional Rust Belt region in the northeast.

“The turn away from reliance on the U.S. for agricultural and industrial inputs will accelerate,” Charles W. Freeman Jr., a former U.S. diplomat said in an email.

This really isn’t about China or America, though. Anyone familiar with the erratic performance and quick failure of a certain steakhouse, casino, airline…probably wouldn’t want to hitch their wagon to a horse unwilling to pull its own weight let alone help anyone else.