RISKS-LIST: Risks-Forum Digest Saturday 20 January 2024 Volume 34 : Issue 04

ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks)
Peter G. Neumann, founder and still moderator

***** See last item for further information, disclaimers, caveats, etc. *****
This issue is archived at <http://www.risks.org> as
<http://catless.ncl.ac.uk/Risks/34.04>
The current issue can also be found at
<http://www.csl.sri.com/users/risko/risks.txt>

Contents:
Your pacemaker and open-source software (The Register)
ChatGPT can answer yes or no at the same time (Paul Robinson)
>From corny jokes to job applications, ChatGPT's new store is selling
specialized AI software (CBC)
AI’s big test: Making sense of $4 trillion in medical expenses (Politico)
AI-powered disinformation is spreading; is Canada ready for the political
impact? (CBC)
Your washing machine could be sending 3.7 GB of data a day day
(Tomshardware)
Even after a recall, Tesla's Autopilot does dumb dangerous things (WashPost)
Tesla Drivers in Chicago Confront a Harsh Foe: Cold Weather (The New York
(NYTimes)
Imaging privacy threats from an ambient light sensor (Science)
Microsoft says its corporate network hacked by a Russian
state-sponsored group on Jan 12 (Lauren Weinstein)
EFI IPv6/PXE Security Flaw (ArsTechnica)
AT&T is trying to kill all landlines in California, which would
have devastating effects (Lauren Weinstein)
Washington takes aim at facial recognition (Politico)
Your Medical Data Is Code Blue (WiReD)
Google layoffs continue with 'hundreds' from sales team (The Verge)
About my criticisms of Google ... (Lauren Weinstein)
Re: Hackers can infect network-connected wrenches to install ransomware
(Jonathan Levine)
Re: UK Post Office Accounting Systems Errors Lead to Convictions and Worse
(Bob Gezelter)
Re: Alaska cockpit recording overwritten; limited to 2hrs
(Lars-Henrik Eriksson)
Re: Linux devices are under attack by a never-before-seen worm
(Steve Bacher)
Re: CLEAR wants to scan your face at airports. Privacy
experts are worried. (John Levine)
Abridged info on RISKS (comp.risks)

----------------------------------------------------------------------

Date: Tue, 16 Jan 2024 06:55:03 -0500
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Your pacemaker and open-source software (The Register)

Using embedded medical technology, such as a pacemaker, defibrillator, or
insulin pump? What's running inside is a complete mystery

She was forced to make a life-or-death decision that would have been much
easier were it not for proprietary software being the only option for heart
devices. Sandler ended up going, and all went well. It easily could have
gone terribly wrong.

You see, Sandler has a heart condition, Hypertrophic Cardiomyopathy
(HCM). It's a condition that generally has no discernible symptoms unless it
kills you. A serious thing.

This time, however, she had a symptom, an irregular heartbeat, that was
getting worse. Clearly, the first thing to do was pull the data from the
device so that her cardiologist would have more data for the treatment.

One of the reasons why people get these devices is so they and their doctor
can track their condition. So it was easy right? Wrong.

Remember, this runs proprietary software. It turned out that no one but a
company representative could pull data from it. And, no one - and I mean no
one -- was available who could get the information.

https://www.theregister.com/2024/01/12/column/

------------------------------

Date: Sun, 14 Jan 2024 10:28:54 +0000 (UTC)
From: Paul Robinson <rfc1394@yahoo.com>
Subject: ChatGPT can answer yes or no at the same time.

It is very important for people to be aware that ChatGPT is, in effect, a
power tool. And as one would not start up a rotary saw and allow it to cut
through the floor, the drywall, and the floor of the apartment next door,
one must be very careful to take caution when using it. In a question I
asked, it said, in two sentences back-to-back, that a fictional character
both did not and did do something. The following is verbatim from the log,
the first line being my question and the following paragraph is ChatGPT's
response: What song did the HAL 9000 sing in the movie "2001 a space
odyssey?"

HAL 9000 did not sing a song in the movie "2001: A Space Odyssey." However,
HAL 9000 is known for singing the song "Daisy Bell (Bicycle Built for Two)"
in the movie "2001: A Space Odyssey." The singing occurs during a dramatic
scene where HAL is being deactivated by astronaut Dave Bowman.

This simple example of saying both a wrong answer and the contradictory
right answer in two sentences is an obvious reason why Artificial
Intelligence systems can be useful, they can produce wrong answers.

Remember, Artificial Intelligence can only augment real intelligence,not
replace it.

------------------------------

Date: Sun, 14 Jan 2024 14:24:40 -0700
From: Matthew Kruk <mkrukg@gmail.com>
Subject: From corny jokes to job applications, ChatGPT's new store is
selling specialized AI software (CBC)

https://www.cbc.ca/news/business/chatgpt-app-store-launches-1.7083183

Prominent artificial intelligence company OpenAI has launched a new way for
developers to sell and distribute their own custom versions of AI software
through an online store, with industry participants and watchdogs saying it
could change how businesses and consumers use the technology.

The GPT Store will include personalized artificial intelligence
applications, and will let users discover and build versions tailored to
specific topics or needs.

The store will offer custom versions of ChatGPT, created by developers who
pay a subscription fee to OpenAI.

------------------------------

Date: Sun, 31 Dec 2023 07:58:00 -0800
From: Steve Bacher <sebmb1@verizon.net>
Subject: AI’s big test: Making sense of $4 trillion in
medical expenses (Politico)

Hospitals and insurers are racing to find new artificial intelligence tools
to give them an edge in billing and processing their part of the $4 trillion
in medical expenses Americans accrue each year.

As one of the largest parts of the U.S. economy undergoes perhaps its
biggest transition in decades, billions of dollars are at stake — not only
for health care providers and insurers, but also for the government, which
handles millions of Medicare and Medicaid claims every year.

For providers, the dream is an AI tool that can quickly and aggressively
code procedures and file claims. Insurers — and the government agencies that
pay for health care — want comparable technology to scrub those bills.
[...]

But Congress has barely begun to grapple with how AI could affect these
issues. And the administration is just beginning to work out its approach to
regulating the technology — even as the ground is shifting for hospitals,
doctors and insurers vying for a tech edge. [...]

https://www.politico.com/news/2023/12/31/ai-medical-expenses-00132557

------------------------------

Date: Thu, 18 Jan 2024 06:39:34 -0700
From: Matthew Kruk <mkrukg@gmail.com>
Subject: AI-powered disinformation is spreading; is Canada ready for the
political impact?

https://www.cbc.ca/news/politics/ai-deepfake-election-canada-1.7084398

------------------------------

Date: Sun, 14 Jan 2024 06:06:36 -0800
From: Tom Van Vleck <thvv@multicians.org>
Subject: Your washing machine could be sending 3.7 GB of data a day
(Tomshardware)

https://www.tomshardware.com/networking/your-washing-machine-could-be-sending-37-gb-of-data-a-day

[Steve Bacher noted:

An LG washing machine owner and self-confessed fintech geek has asked the
Twitterverse why his smart home appliance ate an average of 3.66GB of data
daily. Concerned about the washer's Internet addiction, Johnie forced the
device to go cold turkey and blocked it using his router UI. Had the LG
washer been hacked, hijacked, or otherwise tampered with over the net --
or is this the average data consumption for a modern smart appliance?

[... instead of breaching your breeches?
Oddly, we have had relatively few items lately in RISKS relating to the
risks of the Internet of things (and certainly not underthings). PGN]

------------------------------

Date: Mon, 15 Jan 2024 19:47:07 -0500
From: Gabe Goldberg <gabe@gabegold.com>
Subject: Even after a recall, Tesla's Autopilot does dumb dangerous things
(The Washington Post)

On the streets of San Francisco, the updated version of Tesla’s
driver-assistance software still took the wheel in places it wasn't designed
to handle, including blowing through stop signs.

Author: Last weekend, my Tesla Model Y received an over-the-air update to
make its driver-assistance software safer. In my first test drive of the
updated Tesla, it blew through two stop signs without even slowing down.
[...]

The process of simply getting the recall was itself a red flag for a lack of
urgency about this fix. Unlike on a phone, where you can go to settings to
look for updates, my car had no button to look for or prompt a download.
Tesla’s user manual advised updates would download automatically if I had
strong WiFi, so I moved my router outdoors near my parked car. When the
recall finally arrived — a week and a half later — it contained a number of
other unrelated features as well as a patch on top of its original release.
[...]