Speaker 1: Welcome to tech Stuff, a production from iHeartRadio. Hey there,
Speaker 1: and welcome to tech Stuff. I'm your host Jonathan Strickland.
Speaker 1: I'm an executive producer with iHeart Podcasts. And how the
Speaker 1: tech are you? It's time for the tech news for
Speaker 1: the week ending July fifth, twenty twenty four. And y'all.
Speaker 1: One of the tricky things about designing a website is
Speaker 1: that you can't know which browsers your users are going
Speaker 1: to be relying upon when they visit it. So you
Speaker 1: might build a site that works great in certain current browsers,
Speaker 1: but if you go back a generation or three, maybe
Speaker 1: things aren't quite so seamless. But you still have people
Speaker 1: out there who are relying on those browsers. So what
Speaker 1: do you do. Do you try and design for the
Speaker 1: lowest common denominator. Well, for many web designers, one work
Speaker 1: around for this problem resided on an online code library
Speaker 1: called polyfilm. The project is an open source one that
Speaker 1: would put JavaScript code up on a polyfil account and
Speaker 1: that would allow websites to include just a particular URL
Speaker 1: link in the website design, and the library would work
Speaker 1: with older browsers and allow them to display web pages
Speaker 1: properly so that you know, you would still see the
Speaker 1: way the web page was supposed to be laid out,
Speaker 1: So it offloaded a lot of work for web designers.
Speaker 1: You could just include this link and it would do
Speaker 1: the work for you. But then earlier this year, a
Speaker 1: Chinese company called finuln Ul or Funnel maybe it's funnel
Speaker 1: funnel makes more sense anyway, they purchased both the GitHub
Speaker 1: account that hosted this library, as well as the domain
Speaker 1: name for the polyfil site, and last week a cybersecurity
Speaker 1: company called Sansec alerted the world that what you to
Speaker 1: be that JavaScript code is now code that redirects visits
Speaker 1: to other websites, mainly ones related to porn or gambling.
Speaker 1: That's not great. The security firm also said that the
Speaker 1: code was designed so that it wasn't redirecting all the time,
Speaker 1: and this was probably an effort to hide the fact
Speaker 1: it was doing it at all, right, Like if it
Speaker 1: was only doing it in certain hours, then it was
Speaker 1: going to avoid detection longer. But it wasn't long before
Speaker 1: various web companies began to block the domain entirely, and
Speaker 1: the guy who first built polypill posted a message urging
Speaker 1: website administrators to remove links to the Online Code Library.
Speaker 1: Ours Technica's Dan Goodin reports that nearly four hundred thousand
Speaker 1: sites are still linked to the library despite these warnings,
Speaker 1: including sites that are connected to the US federal government,
Speaker 1: which is a big old wompwomp. So these aren't just
Speaker 1: little independent websites out there that are falling victim to this.
Speaker 1: Some of those websites are connected to assive companies and
Speaker 1: other organizations, you know, groups that should absolutely prioritize removing
Speaker 1: malicious links and code from their web pages. But I
Speaker 1: can't bust the USA's chops too much on this because,
Speaker 1: as good In reveals in his article, more than half
Speaker 1: of all the websites that are still linking to Polythyl
Speaker 1: are actually in Germany, which is a big old achluliba.
Speaker 1: In the end, this story shows that supply chain attacks
Speaker 1: can really be effective. So that's when hackers aren't targeting
Speaker 1: end companies, organizations, or individuals. Instead they target the tools
Speaker 1: and services that those end targets are relying upon. So
Speaker 1: you poison the supply chain and you hit a lot
Speaker 1: of targets. It's also a black mark against Chinese companies
Speaker 1: continuing to cause chaos online. Speaking of supply chain attacks.
Speaker 1: What happens when the company that you count on for
Speaker 1: added security is the target of hackers. That's a question
Speaker 1: folks are asking after authe au Thhy, a two factor
Speaker 1: authentication app, got hit by hackers. More specifically, the company
Speaker 1: that makes Authee, a company called Twilio, revealed that hackers
Speaker 1: had managed to access a limited amount of customer information,
Speaker 1: apparently limited to just around thirty three million cell phone numbers. Now.
Speaker 1: Authee is an app that generates codes meant to authenticate
Speaker 1: users as they log into various services. I actually have
Speaker 1: an Authee account so that I can log into Twitch,
Speaker 1: for example. So I think there's a certain assumption among
Speaker 1: users that the service is also secure because it exists
Speaker 1: solely to aid in the security of other services. You
Speaker 1: think if it's a company that's in the security business,
Speaker 1: it should be pretty safe. And yet Twillio has confirmed
Speaker 1: that hackers access to and quote unquote unauthenticated endpoint to
Speaker 1: steal the list of customer phone numbers. While that information
Speaker 1: has limited value, it does mean that the hackers might
Speaker 1: rely on the data to conduct phishing attacks, or more
Speaker 1: likely sell the data for cheap on a black market
Speaker 1: where other people can use it for phishing attacks and such.
Speaker 1: We're not done with hacking news yet. A group called
Speaker 1: Shiny Hunters says its attack on Ticketmaster landed the group
Speaker 1: some really valuable information. I'm talking seriously valuable, like more
Speaker 1: than twenty two billion dollars valuable. And as such, the
Speaker 1: group has increased its initial ransom demand, which was originally
Speaker 1: one million dollars, up to eight million dollars. It has,
Speaker 1: in the mortal words of Darth Vader, altered the deal.
Speaker 1: Pray they do not alter it further. So what's going
Speaker 1: on here? All right? So the hackers breached Ticketmasters systems
Speaker 1: back in May, I'm pretty sure I talked about on
Speaker 1: our previous news episode, and in the process, the hackers
Speaker 1: were able to access a ton of information, and that
Speaker 1: includes around four hundred and forty thousand tickets to Taylor
Speaker 1: Swift shows. You know, she's like the hottest ticket in town,
Speaker 1: no matter what town it is. And the hackers have
Speaker 1: all the information they need to do stuff like produce
Speaker 1: fraudulent but working tickets. They could do that because they
Speaker 1: have all the data. So imagine that you show up
Speaker 1: to a Swift concert and then you find out that
Speaker 1: your legitimate ticket that you purchased months ago no longer
Speaker 1: works because you know someone else has beaten you to it,
Speaker 1: and this is a ticket you purchased for some ungodly
Speaker 1: amount of money, because, let's face it, Ticketmaster is a
Speaker 1: real beast of a company, and it also has beastly
Speaker 1: convenience and processing fees to boot. But because hackers were
Speaker 1: able to steal your ticket information, they produced a copy.
Speaker 1: Maybe they produced a whole bunch of different copies. Maybe
Speaker 1: they scalped all those tickets to unsuspecting buyers. There could
Speaker 1: be one hundred other people who bought your ticket information
Speaker 1: and they're also stuck waiting outside because whomever got there
Speaker 1: first is currently sitting in your seat and they're waiting
Speaker 1: for blank Space to start playing. That's actually the only
Speaker 1: Taylor Swift song I know off the top of my head. Anyway,
Speaker 1: the hackers also have information about all the people who
Speaker 1: have bought tickets. They have personal identifiable information, and that
Speaker 1: could mean that they could reach out to the customers
Speaker 1: and pose as ticket Master. They could say, hey, we
Speaker 1: have recovered your tickets. They were part of this breach,
Speaker 1: but we have it. We need to secure x amount
Speaker 1: of money in order to send you the updated information
Speaker 1: and they're just exploiting you. That's a possibility. Maybe they
Speaker 1: sell your information online and other hackers use your information
Speaker 1: to conduct spear phishing campaigns against you. I mean, if
Speaker 1: you're the sort of person who has spent hundreds or
Speaker 1: one thousands of dollars on a concert ticket, then you
Speaker 1: could end up being a very attractive target for exploitation
Speaker 1: down the line. According to hack Read, the stolen information
Speaker 1: includes nearly a billion sales orders and half a billion
Speaker 1: unique email addresses, plus four hundred million encrypted credit cards
Speaker 1: records with partial details unencrypted. Now, the encrypted credit card
Speaker 1: information at the very least means the hackers don't have
Speaker 1: immediate access to that information. Encryption is a tough thing
Speaker 1: to break us, particularly if you're using really good encryption,
Speaker 1: so they might not be able to ever get that
Speaker 1: credit card information. But this is a really ugly hack
Speaker 1: that has affected millions of Ticketmaster customers. So what's the
Speaker 1: company going to do? Well? I do not know, but
Speaker 1: I bet this is not going to look good in
Speaker 1: the antitrust lawsuit that the US government has brought against
Speaker 1: Live Nation, which is Ticketmaster's parent company. Now, do you
Speaker 1: think we're done with hacker stories this week, don't bank
Speaker 1: on it literally. Ransomware hackers targeted the Patelco credit Union
Speaker 1: in California. According to John Broadkin of Ours Technica, we're
Speaker 1: going to have a lot of Ours Technica stories for
Speaker 1: the second half of this episode. But apparently the hackers
Speaker 1: used a phishing email to trick someone within the organization
Speaker 1: to activate malware that quickly began encrypting data in Patelco's systems,
Speaker 1: and it locked that information away from the credit union.
Speaker 1: Just as the credit card information being encrypted means that
Speaker 1: hackers can't easily get to the credit cards. Well, if
Speaker 1: hackers in encrypt all of an organization's data on their
Speaker 1: systems and their servers, then the organization has no access
Speaker 1: to their legitimate information. So among the many services that
Speaker 1: have been disrupted by this massive attack are online banking,
Speaker 1: which is a big one. The actual attack happened on
Speaker 1: June twenty ninth, and the credit union chose to shut
Speaker 1: down several of its services sort of as a protective
Speaker 1: measure to prevent the hack from spreading throughout the entire system. So,
Speaker 1: according to the credit Union, that includes stuff like quote transactions, transfers, payments,
Speaker 1: and deposits end quote, you know, the basic functionality of
Speaker 1: a bank, So direct deposits were also affected, but according
Speaker 1: to the bank, cash and check deposits are still working,
Speaker 1: So that sounds like for the time being, Patelco customers
Speaker 1: will have to go to a physical location in order
Speaker 1: to make deposits or withdrawals. They may also have had
Speaker 1: their personal information compromises part of this attack. In fact,
Speaker 1: patel coasys you should assume that's the case. They have
Speaker 1: also said that the credit union will work with law
Speaker 1: enforcement to provide protection to those customers. Now, if I
Speaker 1: were to guess, I would say that would be things
Speaker 1: like credit protection and maybe some id theft protection that
Speaker 1: will last for like a year. That's a pretty common
Speaker 1: thing that companies will offer in the wake of a
Speaker 1: breach like this, but this is a particularly bad one.
Speaker 1: It does really illustrate the fact that companies need to
Speaker 1: really drill home the proper security measures that employees need
Speaker 1: to follow in order to avoid these kinds of attacks.
Speaker 1: Hackers will take any advantage they can to do this
Speaker 1: sort of thing, and they will target organizations that are
Speaker 1: particularly vulnerable like banking. Medical organizations are another big one,
Speaker 1: because there's a huge incentive for the company to pay
Speaker 1: off the ransom and get regain access to all that information.
Speaker 1: But as I've always said, keep in mind, paying the
Speaker 1: ransom is typically a bad idea. One, there's no guarantee
Speaker 1: you're going to get everything back, or that the hackers
Speaker 1: aren't going to keep copies of all the information and
Speaker 1: then sell it on the black market. Two. Paying the
Speaker 1: ransom sends the message, hey, these attacks work, they make money,
Speaker 1: and then hackers will just step it up. So paying
Speaker 1: ransoms is typically pretty bad. But at the same time,
Speaker 1: if it's a mission critical kind of thing, I get
Speaker 1: how it's hard to just shrug your shoulders and say, well,
Speaker 1: we're just going to take a loss on this one. Okay,
Speaker 1: we're going to take a quick break. When we come back,
Speaker 1: we've got some more tech news stories to cover. Okay,
Speaker 1: we're back, and we've got some more Ours Technica stories,
Speaker 1: because there were a ton of good ones this week.
Speaker 1: So Ashley Bellinger of Ours Technica, she's actually got a
Speaker 1: couple of stories in this week's episode, has a disturbing
Speaker 1: piece about AI and it's titled AI trains on kids
Speaker 1: photos even when parents use strict privacy settings. So this
Speaker 1: piece is all about how AI companies with image generators
Speaker 1: have been using posted photos across the web to train
Speaker 1: those models, even in cases where the platforms that are
Speaker 1: hosting these photos have specific rules against data scraping, or
Speaker 1: platforms where parents have settings where they can opt into
Speaker 1: denying permission for the use of their children's pictures so
Speaker 1: they can explicitly say I do not want these photos
Speaker 1: used for anything else. And yet it appears that these
Speaker 1: image generator models have still been using those kinds of
Speaker 1: images to train up and that's awful. It is an
Speaker 1: enormous violation of privacy. And researchers with the Human Rights
Speaker 1: Watch have discovered that these companies have hundreds of photos
Speaker 1: of children from vulnerable populations. That makes us even more horrifying.
Speaker 1: It's not just kids, which is already bad enough, but
Speaker 1: kids from disadvantaged communities where they don't have access to
Speaker 1: the kinds of tools or services that others might have
Speaker 1: to fight this kind of thing. Not that fighting it
Speaker 1: is that easy in the first place, but it's even
Speaker 1: harder for these folks. So the researcher said that the
Speaker 1: metadata connected to these images sometimes also includes personal information
Speaker 1: about the children, which is obviously an even bigger privacy
Speaker 1: and security risk, and the generator also creates images based
Speaker 1: off these reference photos. Right Like image generator companies say
Speaker 1: that their AI isn't plagiarizing off of other people, just
Speaker 1: as AI text generator companies say that the text generator
Speaker 1: doesn't plagiarize. But there have been plenty of cases where
Speaker 1: people have pointed out, hey, that's not entirely true. Like
Speaker 1: you can spot elements that seem to be directly lifted
Speaker 1: from source material, and if not directly lifted, so heavily
Speaker 1: influenced by that source material as to constitute a copy.
Speaker 1: So I think it's really important to read this piece.
Speaker 1: There's a lot more that Ashley Bellinger writes about in
Speaker 1: her article. I highly recommend reading it again. That's on
Speaker 1: ours Technico if you want to check out the full
Speaker 1: story now. She also has a piece titled tool Preventing
Speaker 1: Aimmicry Cracked Artists Wonder What's next. This is kind of
Speaker 1: related because it also has to do with AI generation
Speaker 1: and specifically image generation. So as the headline indicates, a
Speaker 1: tool that some online artists use called Glaze has recently
Speaker 1: been called into question as to whether or not it
Speaker 1: is a really great defense So glaze works by inserting
Speaker 1: data into images, and that data alters the images in
Speaker 1: ways that aren't noticeable by humans. In a way, you
Speaker 1: could say it corrupts the information of the image itself.
Speaker 1: And a computer that's scanning these images doesn't know that
Speaker 1: the superfluous data isn't necessary. It thinks it's part of
Speaker 1: the image. Because computers aren't looking at pictures, they're looking
Speaker 1: at the information that makes up that picture and replicating
Speaker 1: or working off of that. So if you're poisoning the
Speaker 1: images by inserting some meaningless information that doesn't really show
Speaker 1: up in the finished picture when you're looking at as
Speaker 1: a human being, then the computer thinks, oh, well, this
Speaker 1: is a necessary component of this kind of image for
Speaker 1: this particular style. Like it's looking at the metadata and saying, oh,
Speaker 1: this is the artist who created this image. If someone
Speaker 1: asks me to create an image in the style of
Speaker 1: this artist, I will take this data in an effort
Speaker 1: to produce that kind of image. But because of the poison, right,
Speaker 1: because of the superfluous data, it might take that noise
Speaker 1: and boost the noise. So what you'll end up with
Speaker 1: is an image that does not look like the reference material,
Speaker 1: which is that's the whole point of glaze. It's to
Speaker 1: poison the reference material so that artists can retain their
Speaker 1: unique styles and not worry about computers copying it. But
Speaker 1: now there are a pair of orobloms facing artists who
Speaker 1: want to use glaze. So one is just that doing
Speaker 1: so requires going through an approvals process with Glaze, and
Speaker 1: the demand for the tool has exceeded the team's capacity
Speaker 1: for keeping up with those requests, so there's a bottleneck there.
Speaker 1: The other problem is that some researchers have come forward
Speaker 1: saying that Glaze's methods aren't really bulletproof and that AI
Speaker 1: will inevitably evolve to defeat these protections. So it's kind
Speaker 1: of like a seesaw approach, and we've actually seen that
Speaker 1: in other security measures like captures are a great example.
Speaker 1: You know, experts would design a new test that in
Speaker 1: theory is easy for humans to do but hard for machines.
Speaker 1: But then eventually the computer scientists train up machines so
Speaker 1: that they can do these tests as well as are
Speaker 1: sometimes even better than humans can, and it requires a
Speaker 1: complete redesign of the capture test, and so it goes.
Speaker 1: The same thing could be going on in image generating
Speaker 1: AI and the efforts to foil it and again. To
Speaker 1: learn more about this, read Bellinger's article on ours Tetnica.
Speaker 1: She does a phenomenal job breaking it all down again.
Speaker 1: That's titled tool Preventing AI mimicry. Cracked artists wonder what's next? Now,
Speaker 1: I'm sure all of y'all out there had the experience
Speaker 1: of setting up a new television and scrolling through all
Speaker 1: the options to find out how the heck you can
Speaker 1: turn off motion smoothing. This is that feature that removes
Speaker 1: motion blur, and that might look great if you're watching
Speaker 1: a live sports event, but for everything else, well, a
Speaker 1: lot of people really hate that effect, including me. This
Speaker 1: is what gives everything that kind of soap opera look.
Speaker 1: You could argue that the reason why classic films and
Speaker 1: television look the way they do really becomes part of
Speaker 1: a combination of limitations on the technology as well as
Speaker 1: the costs of production. But it means that we have
Speaker 1: certain concepts that we associate with what looks like cinema
Speaker 1: or looks like TV, and motion smoothing kind of violates that. Well,
Speaker 1: back in early June, Roku turned on motion smoothing by
Speaker 1: default and there's no way to turn it off, which
Speaker 1: has prompted William Joel of The Verge to write a
Speaker 1: very entertaining piece title Dear Roku, you ruined my TV.
Speaker 1: So Joel writes about how Roku has removed the choice
Speaker 1: from users, forcing them an experience that many people do
Speaker 1: not like. Well worth the read. It's over on the Verge.
Speaker 1: Go check that out. Particularly, you should read it if
Speaker 1: you happen to be an executive at Roku and you're
Speaker 1: wondering why your customers are so agitated. It's been a
Speaker 1: year since Meta launched its competitor to x, formerly known
Speaker 1: as Twitter. Meta's platform is called Threads, which takes its
Speaker 1: name from earlier abandoned Meta projects, and this week Mark
Speaker 1: Zuckerberg announced that Threads hit one hundred and seventy five
Speaker 1: million users, which is impressive but also shows that Meta
Speaker 1: users have not been adopting Threads as quickly as they
Speaker 1: have other platforms like Instagram. Zuckerberg did not go into
Speaker 1: detail on stuff like daily users or anything like that,
Speaker 1: and if I were a betting man, I would wager
Speaker 1: that the reason Zuckerberg did not share those numbers is
Speaker 1: that they aren't very impressive, because I'm guessing on a
Speaker 1: daily basis, people just aren't going to threads that much. Yes,
Speaker 1: there's one hundred and seventy five million users total, but
Speaker 1: how many of those are going to threads regularly? So
Speaker 1: the question is will Threads gain more purchase and user
Speaker 1: mind share? And also how is X doing during all
Speaker 1: this stuff? Honestly, I have no clue. My perception is
Speaker 1: that things that X aren't going great, but that's largely
Speaker 1: down to how you know, there's these ongoing challenges the
Speaker 1: company is facing when it comes to convincing advertisers that
Speaker 1: the ads they are paying for are not going to
Speaker 1: show up next to hate speech. In November twenty twenty three,
Speaker 1: Amazon launched an ambitious product called Astro, which is a
Speaker 1: home robot, a little wheeled CTC robot that can roll
Speaker 1: around your house and keep an eye, well, you know,
Speaker 1: keep a keep cameras and sensors on how things are going.
Speaker 1: And the company also introduced an enterprise version of that
Speaker 1: bought Astro for business, so it's a device intended for
Speaker 1: corporations and such. Now, less than a year after launch,
Speaker 1: Amazon has announced is discontinuing the enterprise version. Customers that
Speaker 1: bought one will receive a full refund, which is around
Speaker 1: twenty three hundred and fifty bucks plus a few hundred
Speaker 1: dollars in credit because their security system is going to
Speaker 1: stop working. Once Amazon shuts down the servers on September
Speaker 1: twenty fifth, it will brick these little robots. The company
Speaker 1: has said it will continue to develop robotics for the home,
Speaker 1: so it sounds like the consumer version of Astro will
Speaker 1: continue to receive support at least for now, and that
Speaker 1: Amazon is apparently working on successors to that twenty twenty
Speaker 1: three model. As for Astro, for business models, they cannot
Speaker 1: be switched to work as consumer versions, so Amazon is
Speaker 1: sending customers shipping label so they can ship off these
Speaker 1: former security robots back off to Amazon so they can
Speaker 1: go to the recycling center, which seems like a pretty
Speaker 1: sad fate for the cute little fillers. Okay, that's it
Speaker 1: for the tech news for the week ending July fifth,
Speaker 1: twenty twenty four. I hope you are all well and
Speaker 1: I'll talk to you again really soon. Tech Stuff is
Speaker 1: an iHeartRadio production. For more podcasts from iHeartRadio, visit the
Speaker 1: iHeartRadio app, Apple Podcasts, or wherever you listen to your
Speaker 1: favorite shows,