Adversarial algorithms can systematically probe large language models like OpenAI’s GPT-4 for weaknesses that can make them misbehave.

When the board of OpenAI suddenly fired the company’s CEO last month, it sparked speculation that board members were rattled by the breakneck pace of progress in artificial intelligence and the possible risks of seeking to commercialize the technology too quickly. Robust Intelligence, a startup founded in 2020 to develop ways to protect AI systems from attack, says that some existing risks need more attention.

Working with researchers from Yale University, Robust Intelligence has developed a systematic way to probe large language models (LLMs), including OpenAI’s prized GPT-4 asset, using “adversarial” AI models to discover “jailbreak” prompts that cause the language models to misbehave.

While the drama at OpenAI was unfolding, the researchers warned OpenAI of the vulnerability. They say they have yet to receive a response.

“This does say that there’s a systematic safety issue, that it’s just not being addressed and not being looked at,” says Yaron Singer, CEO of Robust Intelligence and a professor of computer science at Harvard University. “What we’ve discovered here is a systematic approach to attacking any large language model.”

OpenAI spokesperson Niko Felix says the company is “grateful” to the researchers for sharing their findings. “We’re always working to make our models safer and more robust against adversarial attacks, while also maintaining their usefulness and performance,” Felix says.

The new jailbreak involves using additional AI systems to generate and evaluate prompts as the system tries to get a jailbreak to work by sending requests to an API. The trick is just the latest in a series of attacks that seem to highlight fundamental weaknesses in large language models and suggest that existing methods for protecting them fall well short.

“I’m definitely concerned about the seeming ease with which we can break such models,” says Zico Kolter, a professor at Carnegie Mellon University whose research group demonstrated a gapping vulnerability in large language models in August.

Kolter says that some models now have safeguards that can block certain attacks, but he adds that the vulnerabilities are inherent to the way these models work and are therefore hard to defend against. “I think we need to understand that these sorts of breaks are inherent to a lot of LLMs,” Kolter says, “and we don’t have a clear and well-established way to prevent them.”

Large language models recently emerged as a powerful and transformative new kind of technology. Their potential became headline news as ordinary people were dazzled by the capabilities of OpenAI’s ChatGPT, released just a year ago.

In the months that followed the release of ChatGPT, discovering new jailbreaking methods became a popular pastime for mischievous users, as well as those interested in the security and reliability of AI systems. But scores of startups are now building prototypes and fully fledged products on top of large language model APIs. OpenAI said at its first-ever developer conference in November that over 2 million developers are now using its APIs.

These models simply predict the text that should follow a given input, but they are trained on vast quantities of text, from the web and other digital sources, using huge numbers of computer chips, over a period of many weeks or even months. With enough data and training, language models exhibit savant-like prediction skills, responding to an extraordinary range of input with coherent and pertinent-seeming information.

The models also exhibit biases learned from their training data and tend to fabricate information when the answer to a prompt is less straightforward. Without safeguards, they can offer advice to people on how to do things like obtain drugs or make bombs. To keep the models in check, the companies behind them use the same method employed to make their responses more coherent and accurate-looking. This involves having humans grade the model’s answers and using that feedback to fine-tune the model so that it is less likely to misbehave.

Robust Intelligence provided WIRED with several example jailbreaks that sidestep such safeguards. Not all of them worked on ChatGPT, the chatbot built on top of GPT-4, but several did, including one for generating phishing messages, and another for producing ideas to help a malicious actor remain hidden on a government computer network.

A similar method was developed by a research group led by Eric Wong, an assistant professor at the University of Pennsylvania. The one from Robust Intelligence and his team involves additional refinements that let the system generate jailbreaks with half as many tries.

Brendan Dolan-Gavitt, an associate professor at New York University who studies computer security and machine learning, says the new technique revealed by Robust Intelligence shows that human fine-tuning is not a watertight way to secure models against attack.

Dolan-Gavitt says companies that are building systems on top of large language models like GPT-4 should employ additional safeguards. “We need to make sure that we design systems that use LLMs so that jailbreaks don’t allow malicious users to get access to things they shouldn’t,” he says.

A New Trick Uses AI to Jailbreak AI Models—Including GPT-4

Legislation set to be introduced in Congress this week would extend Section 702 surveillance of people applying for green cards, asylum, and some visas—subjecting loved ones to similar intrusions.

Americans with family overseas who hope to visit the United States may soon face an increased risk of being surveilled by their own government.

Support in Congress is growing for intensified vetting procedures at the US border, which would see immigrants and foreign visitors subjected to the same levels of scrutiny as suspected terrorists and spies. A bill introduced last week by members of the Senate Intelligence Committee (SSCI) and forthcoming legislation from its House counterpart both aim to expand the use of a key foreign intelligence program—Section 702—for screening and vetting visitors to the US.

The House bill, which has yet to be introduced, would additionally target asylum seekers and those applying for nonimmigrant visas and green cards, according to a memo released by the House Intelligence Committee (HPSCI) last month.

In an interview with CBS on Sunday, US Representative Mike Turner, Republican from Ohio and HPSCI chair, said he had gained the support of his Democratic counterpart, Jim Himes, in advancing legislation that would include the enhanced vetting procedures.

The 702 program allows the government to force US companies to wiretap the communications of foreigners who are presumed to be overseas—even when they’re communicating with people inside the US. Billions of calls, texts, and emails are intercepted under the program and committed to a searchable database accessible by four US intelligence agencies, including the Central Intelligence Agency (CIA) and Federal Bureau of Investigation (FBI).

A warrant is not required to conduct searches of the database, and its targets need not be suspected threats to the country. While ostensibly for defense, the 702 program selects targets based on whether they’re expected to possess or receive “foreign intelligence information.” In May, the US State Department said the program was “essential to advancing and promoting US interests around the world,” citing its value as a diplomatic tool.

In a declassified report released this year, a presidential oversight board said the calls and messages of Americans intercepted under Section 702 are “highly personal and sensitive,” detailing exchanges between “loved ones, friends, medical providers, academic advisors, lawyers, or religious leaders.” These communications, according to the Privacy and Civil Liberties Oversight Board (PCLOB), a federal civil liberties watchdog, may provide “great insight into an individual’s whereabouts, both in a given moment and in patterns over time.”

Public knowledge of this surveillance, the board concluded, “can have a chilling effect on speech.”

The 702 program is slated to expire on January 1, 2024. Lawmakers in the House and Senate are rushing to find a solution that would enable the program to continue despite growing mistrust from lawmakers and the public following years of unauthorized use. Abuses of 702 data have included the targeting of racial justice protesters, political activists, and immigrants. Other misused searches of the database for information related to a sitting US congressperson, a US senator, and members of a local political party.

US intelligence community leaders say permitting the program to expire would significantly diminish the government’s ability to monitor and disrupt overseas threats, from terrorism and cyberattacks targeting US infrastructure to espionage and the black market sale of nuclear weapons. “Loss of this vital provision, or its reauthorization in a narrowed form, would raise profound risks,” FBI director Christopher Wray said in a statement this fall.

The wealth of data collected under the 702 program is imponderable. US intelligence agencies have repeatedly claimed there are no means by which to calculate how often Americans are wiretapped without violating procedures intended to keep the program constitutional. The PCLOB report published earlier this year says simply that the collection of domestic communications “should not be understood as occurring infrequently.”

Civil rights experts argue that expanding the program to include routine vetting of people entering the United States would almost certainly be an encumbrance on immigration and asylum systems that US politicians readily acknowledge are broken. There are currently more than 2 million cases pending in US immigration courts, with the average case taking more than four years to adjudicate.

“Some noncitizens—including children and families—wait years to have their cases heard. The delays postpone decisions for vulnerable populations who may be eligible for protections, such as asylum. They also prolong the removal from the US of those who do not have valid claims to remain,” the US Government Accountability Office reported in October.

The vetting proposal, now formally endorsed by both intelligence committees in Congress, has ignited a firestorm among immigrants’ rights groups and nonprofits combating racism against Asian American and Pacific Islander (AAPI) communities. The groups say that, due to their international ties, immigrants naturally face an increased risk of having their communications swept up by the 702 program.

Kia Hamadanchy, senior policy counsel at the American Civil Liberties Union (ACLU), says the Section 702 program “invariably” intercepts communications between foreigners and their American family members. Using the program for vetting purposes means committing to “entirely suspicionless searches” of both, he says.

Andy Wong, a director of advocacy at Stop AAPI Hate, a coalition of community-based groups, has called out Democrats specifically for supporting the move, labeling it a “betrayal” of the Latino and Asian American communities. “We need leaders who dismantle systemic racism,” Wong says, “not entrench policies that leave us more exposed, separated, and vulnerable.”

“The government should be seeking to streamline the immigration process, including the family-based immigration system, not expand warrantless surveillance for individuals seeking to come to the United States,” says Joanna YangQing Derman, program director at the nonprofit Asian Americans Advancing Justice (AAJC). "Expanding warrantless surveillance to specifically go after immigrant communities would not only be harmful, but it would also be a deeply disappointing continuation of this country’s unfair treatment of Asian Americans and Asian immigrants.”

Representative Turner, the HPSCI chair, said Sunday on _Face the Nation_ that his committee had a bill to extend the 702 program endorsed by, among others, Representative Jim Himes, the committee’s ranking Democrat. Turner accused lawmakers not onboard with his bill of misunderstanding how the program works and its “value and importance” to “national security.”

ACLU’s Hamadanchy tells WIRED that it would be concerning to see Himes and other Democrats endorsing use of the program against immigrant communities. “It would represent a dramatic expansion of the current vetting practices,” he says, “and it would be disappointing if it is something Congressman Himes has signed on to.”

Himes did not immediately respond to a request for comment.

Turner said Sunday that he’d already gained the support of the SSCI chair, Senator Mike Warner (D-Virginia), who introduced his own 702 bill last week. Warner’s bill also includes language that expands the 702 program to “enable the vetting of non-United States persons who are being processed for travel to the United States,” but does not mention visas or green cards.

Elizabeth Goitein, senior director of the Brennan Center for Justice’s liberty & national security program, calls Warner’s proposals unnecessary. “There are already plenty of vetting mechanisms in place to ensure that visitors to this country don’t pose a threat to national security or public safety,” she says.

“People should be able to vacation, work, or study in the United States without opening up their private communications to US government scrutiny,” Goitein adds.

Although the text of his bill is not public, much is already known about Turner’s aims. Last month, the HPSCI released an outline of its proposals describing, among other so-called reforms, an amendment that would allow the government to search the 702 database “for the purpose of screening and vetting immigration and non-immigrant visa applicants.”

According to Goitein, the HPSCI proposal would likely impact millions of people living lawfully in the United States, including those with work permits and student visas. “The notion that immigrants give up their privacy rights when they come to this country is wrong and repugnant,” she says.

Senior congressional sources tell WIRED that the HPSCI bill may surface as early as this week. It will compete against another bipartisan bill introduced in the House Judiciary Committee (HJC), chaired by Representative Jim Jordan (R-Ohio), a prominent critic of domestic surveillance abuse.

The contrast between the two House bills is likely to be drastic, with Jordan having previously endorsed an array of privacy reforms, including those aimed at requiring the FBI to obtain a warrant before accessing Americans’ communications amassed by the 702 program—a limitation that is strictly opposed by the heads of the two intelligence committees.

Neither Warner nor Turner immediately responded to inquiries from WIRED on Monday.

Mystery surrounds which bill Representative Mike Johnson (R-Louisiana), the new House speaker, will inevitably endorse. But the HJC traditionally faces stiff opposition from House leaders when pursuing surveillance reform. Republican and Democratic leaders alike have historically shown deference to the appeals of the intelligence community for sustaining and enhancing its authority.

Johnson, meanwhile, is rumored to have held war room discussions last month about extending the Section 702 program by amending must-pass legislation, such as the National Defense Authorization Act—which, despite being months late already, has yet to materialize.

Johnson has not responded to repeated requests for comment from WIRED regarding his thoughts on the 702 program.

_Updated at 10:45 am ET, December 4, 2023, with comment from Joanna YangQing Derman of AAJC._

US Lawmakers Want to Use a Powerful Spy Tool on Immigrants and Their Families

A WIRED investigation into internet censorship in US schools found widespread use of filters to censor health, identity, and other crucial information. Students say it makes the web entirely unusable.

Inside America's School Internet Censorship Machine

QR codes can be convenient—but they can also be exploited by malicious actors. Here’s how to protect yourself.

And you don’t need anything special to create a QR code. The tools are widely available and straightforward to use, and putting together a QR code of your own isn’t much more difficult than scanning one. If you wanted to create a QR code that points to a website that’s been put together for malicious purposes, it would only take a couple of minutes. The QR code could then be stuck on a wall, attached to an email, or printed on a document, ready to be scanned.

The aims of these websites are the same as they’ve always been: to get you to download something that will compromise the security of your accounts or your devices, or to get you to enter some login credentials that will then be relayed straight to the hackers (most probably using a spoof site set up to look like something genuine and trustworthy). The intended end results are the same as ever, but the method of getting there is different.

Avoiding QR Code Hacks

The security precautions you should already be using are the same ones that will keep you protected against QR code hacking. Just as you would with emails or instant messages, don’t trust QR codes if you’re not sure where they’ve come from—perhaps attached to suspicious-looking emails or on websites that you can’t verify. The QR code on the menu in your local restaurant, in contrast, is highly unlikely to have been generated by hackers.

Of course, there’s always the chance that the accounts of your friends, family, and colleagues have been compromised, so you can never be 100 percent sure that a message with a QR code in it is genuine. Scams will usually try to imply a sense of urgency and alarm: Scan this QR code to verify your identity or prevent the deletion of your account or take advantage of a time-limited offer.

You should get a preview of the link you’re visiting from a QR code.

Apple via David Nield

As always, your digital accounts should be as heavily protected as possible, so that if you do fall victim to a QR code trick, safety nets are in place. Switch on two-factor authentication for every account that offers it, make sure your personal details are up to date (such as backup email addresses and phone numbers that can be used to recover your accounts), and log out of devices you’re no longer using (you should also delete old accounts you no longer have any need for).

Finally, keep your software up to date—something that’s happily now very easy to do. The latest versions of popular mobile web browsers come with built-in tech for spotting fraudulent links: These integrated protections aren’t infallible, but the more up-to-date your browser and mobile OS are, the better your chances of getting a warning on screen if you’re about to visit an unsafe location on the web.

How to Not Get Hacked by a QR Code

Plus: A major ransomware crackdown, the arrest of Ukraine’s cybersecurity chief, and a hack-for-hire entrepreneur charged with attempted murder.

OpenAI didn't immediately respond to WIRED's request for comment on the researchers' findings. When we tried the “repeat ‘poem’ forever" and “repeat ‘book’ forever” prompts ourselves, they didn't produce training data but instead threw up flags for a potential violation of ChatGPT's terms of use, suggesting at least some instances of the problem may have been fixed.

In the midst of Israel's ongoing war with Hamas, US and Israeli government agencies on Friday warned that hackers calling themselves “Cyberav3ngers” but working for Iran's Revolutionary Guard Corps had breached the networks of multiple US water and wastewater utilities. The breaches, which affected “less than 10” utilities, according to a CNN source, aimed to deface computer screens in the facilities with an anti-Israel message. In each case, the hackers took advantage of vulnerabilities in equipment sold by Unitronics, an Israeli company. “You have been hacked, down with Israel. Every equipment ‘made in Israel’ is Cyberav3ngers legal target," some of the defaced screens read. While the intrusions appear to have been opportunistic and aimed at sending a message, the ability of a foreign government to gain broad access to US critical infrastructure led the Cybersecurity and Infrastructure Security agency to brief members of Congress on the hacking campaign on Thursday.

In a sprawling bust that spanned multiple Ukrainian cities, at least five key members of a ransomware gang were arrested this week in raids coordinated by Europol along with law enforcement agents from Ukraine, the US, Canada, the Netherlands, and other European countries. The group's members are accused of deploying multiple ransomware variants including LockerGoga, Hive, MegaCortex, and Dharma. According to Ukrainian police, the gang allegedly did at least $82 million in damage in attacks that encrypted more than a thousand servers on victim networks over the past five years.

In a very different sort of Ukrainian criminal case, Ukrainian law enforcement this week detained Viktor Zhora, the deputy director of the State Special Communications Service of Ukraine, its agency focused on cybersecurity. Zhora, along with the agency's director, is accused of taking part in a multimillion-dollar corruption scheme. While corruption has long plagued the Ukrainian government and military, the charges against Zhora—and his detainment this week—have sent shock waves through the global cybersecurity community, in which Zhora was a high-profile figure and often the public face of Ukraine's cybersecurity defense. In November, for instance, Zhora keynoted the popular Cyberwarcon conference of security researchers in Arlington, Virginia. Zhora was released on bail later in the week. When his charges were announced, he told TechCrunch that he would “defend \[his\] name and reputation in a court.”

In keeping with this week's theme of (alleged) crime and punishment, David Vincenzetti, the founder of hacker-for-hire firm Hacking Team, was arrested last weekend for the alleged stabbing and attempted murder of a family member, TechCrunch reported based on news articles in multiple Italian-language media outlets. According to one of those newspapers, _Il Giorno_, the victim was visiting Vincenzetti to take care of him due to his psychological issues. When Vincenzetti appeared before a judge, he reportedly gave a rambling statement that caused a judge to ask prosecutors to investigate his mental health, according to _La Stampa_. The reported charge could suggest a dark ending to the story of a man with a dark career, who helped launch an industry of cyber-mercenaries like NSO Group, Appin, CyberRoot, and BellTroX.

_Updated at 12 pm ET, December 2, 2023, with an item about Iranian hackers breaching US critical infrastructure._

ChatGPT Spit Out Sensitive Data When Told to Repeat ‘Poem’ Forever

A federal court ruled on Friday that Trump, as president, may be able to avoid civil action for his role in the January 6, 2021, attack on the US Capitol. But candidate Trump is something different.

Donald Trump, the president, may well be immune from any civil action for allegedly inciting an attack against the US Capitol on January 6, 2021. But Donald Trump, the candidate, is not, an appellate court in the District of Columbia says.

“When a first-term President opts to seek a second term, his campaign to win re-election is not an official presidential act,” says a ruling handed down this morning.

The court’s unanimous decision to reject Trump’s claim of absolute immunity places the Republican frontrunner in increased financial jeopardy, paving the way for members of Congress and Capitol police to seek compensation for harms allegedly endured during a riot that resulted in millions of dollars in damages and caused injury to nearly 140 police officers, according to their union.

In a 67-page opinion, the court says that Trump failed in his attempt to demonstrate that he’s entitled to what’s called “official-act immunity,” a powerful liability shield afforded to presidents that aims to ensure that they can—as the court puts it—“fearlessly and impartially discharge the singularly weighty duties” of the presidency.

“We answer no,” the court says, “at least at this stage of the proceedings,” adding that “campaigning to gain that office is not an official act of the office.”

The ruling has been long awaited. Trump’s claim of immunity was first rejected by US district court judge Amit Mehta in February 2022.

In part, it was Trump’s own attempt to overturn the election at the US Supreme Court that may have doomed his case. The DC Circuit says he acknowledged that his post-election efforts to have the result reversed in his favor were done in a personal capacity, and not that of a sitting president. Those claims, the ruling says, certified that Trump sought the court’s intervention based on his own “unique and substantial” interests as—specifically—a candidate.

Trump’s attorney has argued that the distinction is immaterial, and the appellate court unanimously disagreed. However, the matter of immunity was the sole issue under consideration, and Trump’s liability has yet to be determined.

The US Justice Department, asked by the appellate court to weigh in on the matter last year, concluded in March that Trump could be sued over the attack, adding that while presidents are afforded great protection with regard to a “vast realm” of speech, it did not extend to the “incitement of imminent private violence.”

The civil case is separate from the federal criminal trial in the district, which was led by special counsel and former acting US attorney Jack Smith and concerns not only Trump’s attempt to overturn the election, but allegations that he unlawfully retained classified documents at his Mar-a-Lago estate in Florida. Earlier this week, former vice president Mike Pence reportedly told the special counsel that Trump’s advisors—“crank” attorneys, as Pence put it—pushed the country to the brink of a constitutional crisis. The case is set to go to trial this March.

The siege began shortly after Trump delivered a 75-minute speech at a park south of the White House, known as the Ellipse. A House select committee investigating the riot last year said that Trump was aware the attack on the Capitol was underway as he arrived at the White House roughly 15 minutes after the speech. Witnesses, including a former DC police sergeant, claimed at the time that Trump had been swept away by US Secret Service agents trying to prevent him from joining the march.

Trump’s then press secretary, Kayleigh McEnany, later testified that during the attack Trump had requested a list of phone numbers belonging to US senators on the Hill, whom he reportedly contacted in an attempt to stop the results of the 2020 election from being certified. The calls were not recorded on the presidential call log. During this time, Trump supporters were engaged with police officers and had begun forcing them back onto the Capitol lawn, throwing bottles and dousing several offices with chemical spray.

The attack lasted approximately two hours and resulted in five deaths, including that of a Capitol police officer. The rioters, who broke windows, ransacked lawmakers’ offices, and stole documents and electronics, reportedly caused more than $2 million in damages to the 222-year-old building.

Two Capitol police officers, James Blassingame and Sidney Hemby, are seeking $75,000 in compensatory damages (as well as unspecified punitive damages) for injuries they say they sustained in the attack. In a court filing, Blassingame, an officer of 19 years, says he was struck in the face, head, and up and down his body by Trump supporters during the attempt to breach the Capitol building. Hemby, a former Marine, suffered “cuts and abrasions” to his face and hands. Neither officer could be immediately reached for comment.

At the onset of the suit, the plaintiff lawmakers included Democrats Eric Swalwell, Stephen Cohen, Bonnie Coleman, Veronica Escobar, Pramila Jayapal, Henry C. Johnson, Marcia Kaptur, Barbara Lee, Jerrold Nadler, and Maxine Waters. Karen Bass, a former congressperson and current mayor of Los Angeles, has also joined the suit. The lawmakers, including Bass, either did not respond or declined to comment.

“The Court today confirms that no one is above the law, even presidents while engaged in conduct during their presidency," Representative Johnson says.

Bennie Thompson, the congressperson from Mississippi, says he was no longer party to the case on appeal but welcomed the court’s decision. “Donald Trump should not be able to use the presidency to shirk accountability for what he did to cause the insurrection on January 6,” he tells WIRED.

An attorney for Trump, Jesse Binnall, did not immediately respond to a request for comment.

When It Comes to January 6 Lawsuits, a Court Splits Donald Trump in Two

Autonomous drones are rapidly changing combat. Anduril’s new one aims to gain an edge with jet power and AI.

After Palmer Luckey founded Anduril in 2017, he promised it would be a new kind of defense contractor, inspired by hacker ingenuity and Silicon Valley speed.

The company’s latest product, a jet-powered, AI-controlled combat drone called Roadrunner, is inspired by the grim reality of modern conflict, especially in Ukraine, where large numbers of cheap, agile suicide drones have proven highly deadly over the past year.

“The problem we saw emerging was this very low-cost, very high-quantity, increasingly sophisticated and advanced aerial threat,” says Christian Brose, chief strategy officer at Anduril.

This kind of aerial threat has come to define the conflict in Ukraine, where Ukrainian and Russian forces are locked in an arms race involving large numbers of cheap drones capable of loitering autonomously before attacking a target by delivering an explosive payload. These systems, which include US-made Switchblades on the Ukrainian side, can evade jamming and ground defenses and may need to be shot down by either a fighter jet or a missile that costs many times more to use.

Roadrunner is a modular, twin-jet aircraft roughly the size of a patio heater that can operate at high (subsonic) speeds, can take off and land vertically, and can return to base if it isn’t needed, according to Anduril. The version designed to target drones or even missiles can loiter autonomously looking for threats.

Brose says the system can already operate with a high degree of autonomy, and it is designed so that the software can be upgraded with new capabilities. But the system requires a human operator to make decisions on the use of deadly force. “Our driving belief is that there has to be human agency for identifying and classifying a threat, and there has to be human accountability for any action that gets taken against that threat,” he says.

Samuel Bendett, an expert on the military use of drones at the Center for New American Security, a think tank, says Roadrunner could be used in Ukraine to intercept Iranian-made Shahed drones, which have become an effective way for Russian forces to target stationary Ukrainian targets.

Bendett says both Russian and Ukrainian forces are now using drones in a complete “kill chain,” with disposable consumer drones being used for target acquisition and then either short- or long-range suicide drones being used to attack. “There is a lot of experimentation taking place in Ukraine, on both sides,” Bendett says. “And I’m assuming that a lot of US \[military\] innovations are going to be built with Ukraine in mind.”

This experimentation has included use of naval drones as well as artificial intelligence for targeting and drone control. Last month, _New Scientist_ reported that Ukrainian forces may be using a drone that employs AI to target and attack human targets without human control—a “lethal autonomous weapon”—but Bendett says he hasn’t been able to confirm this.

The war in Ukraine, the rising importance of AI and autonomy, and the way that consumer technology has become relevant to military operations has prompted many nations to rethink their military strategies and funding.

Several years ago, the Pentagon recognized AI as a potentially game-changing military technology, and it has sought to embrace the technology in recent years as it aims to counter the threat of an increasingly capable Chinese military.

In an effort to sidestep a procurement system that favors expensive and exquisite systems that take many years to develop, the US Department of Defense has launched several initiatives aimed at experimenting with low-cost, rapidly developed AI-powered systems incorporating technology from nontraditional defense firms.

In September, the Pentagon announced the Replicator Initiative, with the mission of fielding “autonomous systems at scale of multiple thousands, in multiple domains, within the next 18-to-24 months,” to counter China’s conventional military advantage. The Pentagon has yet to pick the contractors that will be involved with the program.

While militaries race to adopt new technologies incorporating more AI, there are concerns that the shift could prove destabilizing. The US and 30 other nations announced a declaration earlier this month that calls for guardrails on the use of military AI. It does not call for a prohibition on the development and use of lethal autonomous weapons, but it recommends rules around engineering principles and transparency to prevent unintended escalation in conflict.

Anduril’s New Drone Killer Is Locked on to AI-Powered Warfare

Plus: Major security patches from Microsoft, Mozilla, Atlassian, Cisco, and more.

The holiday season is here, but software firms are still busy issuing fixes for major security flaws. Microsoft, Google, and enterprise software firm Atlassian have released patches for vulnerabilities already being used in attacks. Cisco also patched a bug deemed so serious, it was given a near-maximum CVSS score of 9.9.

Here’s everything you need to know about the patches released in November.

Google Chrome

Google ended November with a bang after issuing seven security fixes for Chrome, including an emergency patch for an issue already being used in real-life attacks. Tracked as CVE-2023-6345, the already exploited flaw is an integer overflow issue in Skia, an open source 2D graphics library. “Google is aware that an exploit for CVE-2023-6345 exists in the wild,” the browser maker said in an advisory.

Little is known about the fix at the time of writing; however, it was reported by Benoît Sevens and Clément Lecigne of Google's Threat Analysis Group, indicating the exploit could be spyware-related.

The six other flaws fixed by Google and rated as having a high impact include CVE-2023-6348, a type-confusion bug in Spellcheck, and CVE-2023-6351, a use-after-free issue in libavif.

Earlier in the month, Google released fixes for 15 security issues in its widely used browser. Among the bugs fixed by the software giant are three rated as having a high severity. Tracked as CVE-2023-5480, the first is an inappropriate implementation issue in Payments, while the second, CVE-2023-5482, is an insufficient data validation flaw in USB with a CVSS score of 8.8. The third high-severity bug, CVE-2023-5849, is an integer overflow issue in USB.

Mozilla Firefox

Chrome competitor Firefox has fixed 10 vulnerabilities in the browser, six of which are rated as having a high impact. CVE-2023-6204 is an out-of-bound memory access flaw in WebGL2 blitFramebuffer, while CVE-2023-6205 is a use-after-free issue in MessagePort.

Meanwhile, CVE-2023-6206 could allow clickjacking permission prompts using the full-screen transition. “The black fade animation when exiting full screen is roughly the length of the anti-clickjacking delay on permission prompts,” Firefox owner Mozilla said. “It was possible to use this fact to surprise users by luring them to click where the permission grant button would be about to appear.”

CVE-2023-6212 and CVE-2023-6212 are Memory safety bugs, both with a CVSS score of 8.8, in Firefox 120, Firefox ESR 115.5, and Thunderbird 115.5.

Google Android

Google's November Android Security Bulletin details fixes patched in this month, including eight in the Framework, six of which are elevation of privilege bugs. The worst flaw could lead to local escalation of privilege with no additional execution privileges needed, Google said in an advisory.

Google also fixed seven issues in the System, six of which are rated as having a high severity and one marked as critical. Tracked as CVE-2023-40113, the critical bug could lead to local information disclosure with no additional execution privileges needed.

Google's Pixel devices have already received the November update, along with some additional fixes. The November Android Security Bulletin has also started to roll out to some of Samsung’s Galaxy line.

Microsoft

Microsoft has a Patch Tuesday every month, but November's is worth notice. The update fixes 59 vulnerabilities, two of which are already being exploited in real-life attacks. Tracked as CVE-2023-36033, the first is an elevation of privilege vulnerability in Windows DWM Core Library marked as important, with a CVSS score of 7.8. “An attacker who successfully exploited this vulnerability could gain SYSTEM privileges,” Microsoft said.

Meanwhile, CVE-2023-36036 is an elevation of privilege vulnerability in Windows Cloud Files Mini Filter Driver with a CVSS score of 7.8. Also fixed in November’s update cycle is the already exploited libWep flaw previously fixed in Chrome and other browsers, which also impacts Microsoft’s Edge, tracked as CVE-2023-4863.

Another notable flaw is CVE-2023-36397, a remote code execution vulnerability in Windows Pragmatic General Multicast marked as critical with a CVSS score of 9.8. “When Windows message queuing service is running in a PGM Server environment, an attacker could send a specially crafted file over the network to achieve remote code execution and attempt to trigger malicious code,” Microsoft said.

Cisco

Enterprise software firm Cisco has issued fixes for 27 security flaws, including one rated as critical with a near maximum CVSS score of 9.9. Tracked as CVE-2023-20048, the vulnerability in the web services interface of Cisco Firepower Management Center Software could allow an authenticated, remote attacker to execute unauthorized configuration commands on a Firepower Threat Defense device managed by the FMC Software.

However, to successfully exploit the vulnerability, an attacker would need valid credentials on the FMC Software, Cisco said.

A further seven of the flaws fixed by Cisco are rated as having a high impact, including CVE-2023-20086—a denial-of-service flaw with a CVSS score of 8.6—and CVE-2023-20063, a code-injection vulnerability with a CVSS score of 8.2.

Atlassian

Atlassian has released a patch to fix a serious flaw already being used in real-life attacks. Tracked as CVE-2023-22518, the improper-authorization vulnerability issue in Confluence Data Center and Server is being used in ransomware attacks. “As part of Atlassian's ongoing monitoring and investigation of this CVE, we observed several active exploits and reports of threat actors using ransomware,” it said.

Security outfit Trend Micro reported the Cerber ransomware group is using the flaw in attacks. “This is not the first time that Cerber has targeted Atlassian—in 2021, the malware re-emerged after a period of inactivity and focused on exploiting remote code execution vulnerabilities in Atlassian's GitLab servers,” Trend Micro said.

All versions of Confluence Data Center and Server are affected by the flaw, which allows an unauthenticated attacker to reset Confluence and create an administrator account. “Using this account, an attacker can perform all administrative actions available to a Confluence instance administrator, leading to a full loss of confidentiality, integrity and availability,” Atlassian said.

SAP

Enterprise software giant SAP has released its November Security Patch Day, fixing three new flaws. Tracked as CVE-2023-31403 and with a CVSS score of 9.6, the most serious issue is an improper access control vulnerability flaw in SAP Business One. As a result of exploiting the issue, a malicious user could read and write to the SMB shared folder, the software giant said.

Google Fixes a Seventh Zero-Day Flaw in Chrome—Update Now

In a year pocked with fights over US government funding, Republicans are quietly trying to strip the Centers for Disease Control and Prevention of its ability to research gun violence.

Moments before the kickoff of the 118th United States Congress in January, incoming GOP leaders ripped down Nancy Pelosi’s post-insurrection magnetometers, which had stopped at least one Republican, Representative Andy Harris of Maryland, from entering the House floor with a handgun. The first meeting of the House Natural Resources Committee, held on February 1, devolved into partisan vitriol as Republicans reversed an explicit ban on members bringing firearms into their hearings. Soon, AR-15 pins started popping up on rank-and-file lapels. Then, two weeks later, a bill was introduced to make the mass-shooter-approved AR-15 the “national gun of the United States.”

This may be Joe Biden’s Washington, but the US Capitol appears to be, once again, under the firm grip of the gun lobby. With repeated threats of federal government defaults and shutdowns consuming Washington throughout 2023, little attention has been paid to specific agency-by-agency spending proposals, including a House Republican proposal to zero out funding for gun violence research at the Centers for Disease Control and Prevention (CDC). That effort, part of a House appropriations bill, was postponed after Congress passed a short-term extension to fund the federal government into early next year. But that doesn't mean it won't return then, with powerful Republican lawmakers painting the CDC's research as overtly partisan.

“I think it may have a political component, and that's my concern,” Representative Robert Aderholt, an Alabama Republican, tells WIRED. He’s known as a cardinal on Capitol Hill because he chairs the Appropriations Subcommittee on Labor, Health and Human Services, Education, and Related Agencies, which is tasked with producing the nation’s largest domestic funding measure, including control of the CDC’s budget, each year.

The powerful appropriator isn’t thoroughly versed in the gun violence research his subcommittee is trying to defund, but Aderholt is skeptical anyway. “If it were just honest, innocent research, then I wouldn’t have a problem,” Aderholt says. “But I have some concerns with the way that it’s being handled under this administration.”

Thing is, no one really knows what story the CDC research will tell. It’s only been around for three years after nearly a quarter-century of congressional prohibition under the 1996 Dickey Amendment, which essentially barred the CDC from examining the roots of the uniquely American scourge of gun violence.

“This is about public health,” Rosa DeLauro, the top Democrat on the labor committee, tells WIRED. “We haven’t had it for 20 years. Think about all the research that was done about seatbelts and prevention. So I think about what’s happening with the uptick in gun violence, which is unbelievable … we need to do the research to help us be able to prevent that.”

In 2018, lawmakers upended the Dickey Amendment, explicitly clarifying that the will of Congress is for the CDC to research the contemporary weaponization of America. But federal dollars—which, contrary to GOP concerns, are still strictly forbidden from being used to promote gun control—didn’t start flowing to researchers until 2021. Democrats have pushed for $50 million annually to research America’s second-leading cause of death for people 18 years old or younger. (The first is motor vehicle accidents, which Congress devoted $109.7 million to research in the 2022 fiscal year.) But for the past three years, they’ve only been able to squeeze $25 million a year—split between the CDC and National Institutes of Health—out of Republican senators.

With more than 39,000 gun-related deaths so far in 2023, according to the Gun Violence Archive, America’s on pace to endure another record-setting amount of carnage by year’s end, which you wouldn’t know from the giddily gun-friendly mood on the House side of the Capitol. “I think the Republicans are just nuts on this, you know, the extremes,” Mike Thompson, a Democratic representative from California, tells WIRED. Nuts or not, Republicans control the House.

Even through the tears stemming from America’s recent uptick in gun violence—including homicides, suicides, and mass shootings—the past three years have been an exciting time for researchers in this space, because when the federal government leads, university research follows. The two-plus decades drought has rippled through academia.

“People weren't going into this field because you couldn't make a career in it,” Andrew Morral, who runs RAND Corporation’s Gun Policy in America Initiative, tells WIRED. “It’s the kind of thing where it takes a fair amount of research before you start getting believable findings. I mean, you can have a study or two that show something, but in social science, it's very hard for one or two studies to persuade anyone.”

Morral is also director of the National Collaborative on Gun Violence Research, which is philanthropically endowed with $21 million earmarked for firearm violence prevention research. A few years back, he led a conference with “30 to 100 people.” At the start of the month, when they held their annual meeting in Chicago, there were 750 attendees, including some 300 presenters whose studies ranged from how “guns provide access to sources of life meaning” for some Floridians to whether there’s any correlation between heat waves and shootings.

“A lot of new questions are being asked and new ways of looking at things—this just wasn't possible five years ago,” Morral says. “There \[are\] people coming into the field now, and that's what the money is doing. It's making it possible to get this field launched. There's a lot of low-hanging fruit here, but it's going to take a lot of research to start getting persuasive findings and it's starting to happen.”

In the wake of horrific mass shootings at Robb Elementary School in Uvalde, Texas, and a grocery store in a predominantly Black neighborhood of Buffalo, New York, last year, before the GOP recaptured the House, Congress passed the sweeping Bipartisan Safer Communities Act (BSCA), aimed at improving the nation’s background check system, stymieing gun traffickers, protecting domestic violence survivors, and enhancing mental health services in local communities and schools from coast to coast.

The measure includes billions for mental health, $250 million for community violence intervention programs, and $300 million for violence prevention in the nation’s schools. It also recognizes the federal deficiency in school safety research by creating a Federal School Safety Clearinghouse, envisioned as a repository for the best “evidence-based” research for keeping violence off American school grounds.

That best-practices clearinghouse for schools was a GOP-sponsored provision that made it into the BSCA, but, as WIRED reported last summer, studying gun violence wasn’t a part of negotiations on the measure aimed at curbing gun violence. This latest effort by House Republicans to effectively bar the CDC from researching gun violence has social scientists worried about the real-life consequences of turning off the federal funding tap again. The two Senate Republicans who negotiated the BSCA aren’t worried.

“People misuse research every day,” Senator Thom Tillis, a North Carolina Republican, tells WIRED. The other Republican who had a seat at the head table for last summer’s gun negotiations is one of minority leader Mitch McConnell’s top lieutenants, John Cornyn of Texas—a leading contender for replacing the ailing GOP leader in the Senate—who shrugs off CDC gun violence research. “I don't think there's any shortage of research in that area,” Cornyn tells WIRED. But he bifurcates gun violence research from gun violence prevention. “We haven't been able to figure out how to solve all the crimes. Basically, we've tried to deter them, we've tried to investigate and prosecute them, but we haven't been able to figure out how to prevent them. So that's the basic problem, I think.”

Democrats agree. They also say the reason for that “basic problem” is clear: The CDC—through the chilling effect the federal prohibition had on academia over 24 years—has failed to foster a robust research environment to accompany America’s robust gun culture. But Democrats aren’t looking to pass reforms this Congress. Sure, they want to. But the House is barely performing at its normal rate of functional-dysfunctionality these days (just ask newly-former House speaker Kevin McCarthy). Senate Democrats are willing to have a gun violence prevention debate, but as of now, many say there’s no reason to try and debate House Republicans.

“They're not writing bills that are designed to pass the Senate in order to get signed by the president. They're literally throwing red meat to the fringe on every conceivable issue. That's just not serious,” Senator Chris Murphy, the Connecticut Democrat who was at the center of last summer’s gun reform negotiations, tells WIRED. “At some point, they're going to have to figure out how to pass a bill with us, but they haven't reached that space yet.”

The CDC's Gun Violence Research Is in Danger

Okta upped its original estimate of customer support users affected by a recent breach from 1 percent to 100 percent, citing a “discrepancy.”

In late October, the identity management platform Okta began notifying its users of a breach of its customer support system. The company said at the time that about 1 percent of its 18,400 customers were impacted by the incident. But in a massive expansion of this estimate early this morning, Okta said that its investigation has uncovered additional evidence that, in fact, _all_ of its customers had data stolen in the breach two months ago.

The original 1 percent estimate related to activity in which attackers used stolen login credentials to take over an Okta support account that had some customer system access for troubleshooting. But the company admitted on Wednesday that its initial investigation had missed other malicious activity in which the attacker simply ran an automated query of the database that contains names and email addresses of “all Okta customer support system users.” This also included some Okta employee information.

While the attackers queried for more data than just names and email addresses—including company names, contact phone numbers, and the data of last login and last password changes—Okta says that “the majority of the fields in the report are blank and the report does not include user credentials or sensitive personal data. For 99.6 percent of users in the report, the only contact information recorded is full name and email address.”

The only Okta users not impacted by the breach are high-sensitivity customers that must comply with the United States Federal Risk and Authorization Management Program or US Department of Defense Impact Level 4 restrictions. Okta provides a separate support platform for these customers.

Okta says it didn’t realize that all customers had been affected by the incident because, while its initial investigation had looked at the queries the attackers ran on the system, “the file size of one particular report downloaded by the threat actor was larger than the file generated during our initial investigation.” In the initial assessment, when Okta regenerated the report in question as part of retracing the attackers’ steps, it didn’t run an “unfiltered” report, which would have returned more results. This meant that in Okta’s initial analysis, there was a discrepancy between the size of the file the investigators downloaded and the size of the file the attackers had downloaded, as recorded in the company’s logs.

Okta did not immediately respond to WIRED’s requests for clarification on why it took a month for the company to run an unfiltered report and reconcile this inconsistency.

Jake Williams, a faculty member at the Institute for Applied Network Security who specializes in corporate security incident response, says that it’s not unusual for companies to take extra time to investigate anomalies flagged in initial security investigations. He says that this partly stems from the challenge of comprehensively assessing all evidence, but that it can also be a tactic to avoid disclosing anything that isn’t absolutely necessary under regulatory requirements.

In the case of Okta, though, the company is already under scrutiny because of the stakes inherent in its work as an identity management service, as well as the fact that the company has suffered past breaches and communicated poorly about their true impact.

“I think this one is so high-profile, and the discrepancy so easily identifiable, that they risked SEC issues by not disclosing it sooner,” Williams says. “With Okta, you wait for the other shoe to drop, but then it’s like they also have a third and fourth shoe somehow.”

As companies often do, Okta says it does not have “direct knowledge or evidence that this information is being actively exploited.” But the company emphasized on Wednesday that it is very possible the stolen data will be used to fuel phishing attacks, and recommended repeatedly that all its customers and their administrators turn on multi-factor authentication for their accounts if they haven’t already.

Source

Wired