Speaker 1: Welcome to tech Stuff, a production from I Heart Radio.
Speaker 1: Hey there, and welcome to tech Stuff. I'm your host,
Speaker 1: Jonathan Strickland. I'm an executive producer with iHeart Radio and
Speaker 1: I love all things tech and it is time for
Speaker 1: the tech news for Thursday, March eleventh, twenty one. Let's
Speaker 1: get to it. Last week I told you about how
Speaker 1: the social network site gab, known for the right wing
Speaker 1: political philosophy of most of its users, was the victim
Speaker 1: of a data breach as a hacker accessed gab systems
Speaker 1: and stole around seventy gigabytes worth of data, including three
Speaker 1: million private posts. Well earlier this week, gab has been
Speaker 1: hacked again and even went offline temporarily as the administrators
Speaker 1: of the site conducted and investigate into the security vulnerability
Speaker 1: that made this possible. Now, during the downtime, users who
Speaker 1: are trying to go to gab got an error message,
Speaker 1: but the site is back up as of this recording.
Speaker 1: A hacker using the handle captain Jack Sparrow that's j
Speaker 1: A x p A r Oh claims responsibility for both hacks,
Speaker 1: though who knows if that handle represents just one person
Speaker 1: or it's being used by a group. Working together. The
Speaker 1: hacker used authentication tokens that they gathered during the first hack,
Speaker 1: and they used those to carry out the second one.
Speaker 1: They were able to access the systems because those authentication
Speaker 1: tokens were still good, and that showed the GAB failed
Speaker 1: to reset those security tokens. The hacker also left a
Speaker 1: message that claims that this hacker gave GAB CEO Andrew
Speaker 1: Torba and ultimatum cough up eight bitcoins, which is worth
Speaker 1: about four fifty thousand dollars, and the hacker would return
Speaker 1: at least some of that stolen data. Torva apparently refused, which,
Speaker 1: for the record, is what security experts say is the
Speaker 1: right call. Capitulating to hacker demands typically just reinforces that
Speaker 1: hackers decisions, and it also encourages other hackers to follow suit,
Speaker 1: because if you pay the ransom, people know that there's
Speaker 1: money to be made, and it just makes things worse. Plus,
Speaker 1: there's never actually a guarantee that you'll ever get anything
Speaker 1: back anyway, or that there won't be copies of the
Speaker 1: stuff you get back floating around now. I have to
Speaker 1: say GAB definitely comes out looking like a terrible steward
Speaker 1: of user security and data like absolutely awful. The company
Speaker 1: has completely failed to protect user assets. And just to
Speaker 1: be clear, while I am about as far away in
Speaker 1: political ideology as you can get from the typical GAB user,
Speaker 1: I also don't really care for hackers who promise sites
Speaker 1: and then issue ransom notices. I don't think that's a
Speaker 1: valid approach either. I don't think anyone comes out of
Speaker 1: this situation looking like a good guy, and that's gonna
Speaker 1: be a kind of common message in today's news items.
Speaker 1: I think my guess is that the leaders at gab
Speaker 1: are kind of in over their heads. They got the
Speaker 1: boot from various other platforms due to the actions of
Speaker 1: their users and different violations of terms of service, so
Speaker 1: they're kind of forced to take whatever they can get,
Speaker 1: which is something we've also seen with Parlor. Moving on
Speaker 1: to a different hacking story, I've covered the Solar Winds
Speaker 1: hack numerous times already about how it looks as though
Speaker 1: Russian backed hackers. I mean, it's all but confirmed that
Speaker 1: they are Russian backed hackers who compromise Solar Winds software
Speaker 1: build system and that let the hackers push out software
Speaker 1: updates as if they were legitimate updates. But those updates
Speaker 1: really carried malware two Solar Winds customers, and that gave
Speaker 1: the hackers the ability to infiltrate thousands of computer systems
Speaker 1: and they could then follow up on that attack. This
Speaker 1: was the supply chain attack, where targeted systems accepted the
Speaker 1: malware because it was coming from a previously trusted source,
Speaker 1: that being Solar Winds. Well, now cybersecurity researchers have published
Speaker 1: a report that shows hackers backed by China we're targeting
Speaker 1: Solar Winds at the same time in a separate operation,
Speaker 1: one that I have previously conflated with the Russian hackers.
Speaker 1: So it's time to set the record straight. Based on
Speaker 1: what these researchers found. While the Russian hack used the
Speaker 1: method I just described a moment ago, it appears that
Speaker 1: it was the Chinese hackers who were specifically targeting a
Speaker 1: software project called Ryan and these hackers, according to the researchers,
Speaker 1: were really going after a specific Solar Winds customer and
Speaker 1: they install a malware shell now called Supernova around that
Speaker 1: Orion software. So this sounds like it was a much
Speaker 1: more targeted attack. The Russian approach was different. It let
Speaker 1: hackers blast out malware two thousands of potential targets, and
Speaker 1: then the hackers could follow up with the specific hits
Speaker 1: that they wanted to. They could look at who they
Speaker 1: were able to capture with that first blast and follow
Speaker 1: up for further infiltration. Whereas the Chinese approach was different.
Speaker 1: They were looking at a specific target and went right
Speaker 1: for them, as opposed to doing that blast attack. And
Speaker 1: we are not done with the hacking stories just yet.
Speaker 1: Vercada or Verkada is a Silicon Valley startup that sells
Speaker 1: security cameras with cloud based services, and they were hacked
Speaker 1: earlier this week. Now I say hacked, but when I
Speaker 1: tell you how it actually happened you, I think that
Speaker 1: hack might be a bit of a generous term for
Speaker 1: this particular thing. For Kado practices terrible security, and for
Speaker 1: a company that's in the security business, that's not great.
Speaker 1: So the hackers responsible belonged to a group called APT
Speaker 1: six nine four to zero arson cats. Okay, but APT,
Speaker 1: by the way, stands for Advanced Persistent Threat. It's a
Speaker 1: common term in the cybersecurity world. Anyway, these hackers discovered
Speaker 1: that Verkada had an Internet portal for the company's internal
Speaker 1: development system away to log in to make changes to
Speaker 1: code and various Arcadia products. You know, it's the way
Speaker 1: that the developers can access stuff. Now, that makes sense,
Speaker 1: particularly in a world where presumably a lot of the
Speaker 1: people working for Vercada are doing so remotely. But what
Speaker 1: does not make sense is that the hackers say that
Speaker 1: this was essentially a publicly accessible portal. There were no
Speaker 1: log in credentials required to get to that portal system,
Speaker 1: so you get there without having to first verify that
Speaker 1: you work for the company, and on that landing page
Speaker 1: or that landing site, they found the login credentials to
Speaker 1: get what they called super admin level access to Arcada's systems.
Speaker 1: So as a result, they were able to access more
Speaker 1: than one hundred thousand cameras the number I frequently see
Speaker 1: a one hundred fifty thousand camera feeds belonging to various
Speaker 1: Arcaded customers. They also got a list that was around
Speaker 1: twenty four thousand entries long that that names those customers,
Speaker 1: and they include businesses, churches, health care facilities, jails, and
Speaker 1: the p g A of all things. Tesla is one
Speaker 1: of their customers. Though Tesla says that the hack really
Speaker 1: just gave the hackers of you into one of Tesla's
Speaker 1: suppliers sites, but not the main manufacturing facility in Shanghai.
Speaker 1: A software developer named Tilly Kottman gave details about the hack,
Speaker 1: presumably having played some part in carrying it out. Now,
Speaker 1: what we call this a hack? I would argue that
Speaker 1: finding log in credentials on a publicly accessible landing page
Speaker 1: is pretty much like walking up to someone's password protected
Speaker 1: computer and seeing that they put the log in and
Speaker 1: password on a sticky note and stuck it to the monitor.
Speaker 1: It's not exactly safe. I mean, there's no point in
Speaker 1: having a locked door if you're hanging a key off
Speaker 1: the door. Knob Kottman says that part of the reason
Speaker 1: that the hacker group published the information and shared video
Speaker 1: from various locations you know Varcada customers, is that they
Speaker 1: wanted to point out how widely distributed Varcada's systems actually
Speaker 1: are and how inherently unsafe they are. Now, it's hard
Speaker 1: for me to disagree with those points. I would argue
Speaker 1: you this kind of puts the hackers into a sort
Speaker 1: of gray hat area when it comes to the spectrum
Speaker 1: of hackers, so we typically describe them by hats. So
Speaker 1: you've got white hat hackers. These are hackers who probit systems.
Speaker 1: They look for vulnerabilities, but the intent is to tell
Speaker 1: the respective system administrators about those vulnerabilities, hopefully before someone
Speaker 1: else can exploit them. So the whole goal is to
Speaker 1: find weaknesses and systems and then say, hey, you need
Speaker 1: to fix this. But then you've got your black hat hackers.
Speaker 1: These are the people who are trying to profit from
Speaker 1: being able to access systems and exploit them in some way.
Speaker 1: Gray hats are somewhere in the middle. The hackers didn't
Speaker 1: just go to Rakeda to alert the company of the mistake.
Speaker 1: They didn't go to say, hey, you've got this massive
Speaker 1: security vulnerability, you need to fix it right now. They
Speaker 1: went public with this revelation, which definitely makes the company
Speaker 1: look bad, And honestly, I think you can make a
Speaker 1: good argument that there's some merit in that, considering that
Speaker 1: the whole value proposition for a security company is that
Speaker 1: it's safe. This is also a good reminder that security
Speaker 1: systems that include ways to access a camera feed remotely
Speaker 1: represents a potential security vulnerability. It's always a good idea
Speaker 1: to do your research before you choose a security solution
Speaker 1: on a related note, Jason Cobler and Joseph Cox over
Speaker 1: at Vice dot Com pointed out that another really big
Speaker 1: issue with this hack is that Verkada offers facial recognition
Speaker 1: solutions in their security camera technologies, and that means that
Speaker 1: hackers weren't just able to look at video feeds, they
Speaker 1: could potentially identify the people who showed up in those
Speaker 1: video feeds, And as they pointed out, quote, the breach
Speaker 1: shows the astonishing reach of facial recognition enabled cameras in
Speaker 1: ordinary workplaces, bars, parking lots, schools, stores, and more. End quote.
Speaker 1: I think that that's putting it lightly because honestly, while
Speaker 1: this is all about security cameras and a company that
Speaker 1: has this kind of proprietary approach to facial recognition, we
Speaker 1: have to remember that just about everybody carries a camera
Speaker 1: with them, and depending upon the apps being used, a
Speaker 1: lot of these companies are able to take advantage of
Speaker 1: massive amounts of data and do facial recognition on their own.
Speaker 1: So yeah, this is a very acute UH case that
Speaker 1: we can point to, but it's by no means an outlier.
Speaker 1: It is easy to imagine a scenario in which malicious
Speaker 1: hackers would not only breach a system like Verkada, but
Speaker 1: also keep it quiet, right, They might never come forward
Speaker 1: letting people know that they got access, and then in
Speaker 1: the meantime they could use these surveillance cameras for their
Speaker 1: own purposes and perhaps even spy and potentially blackmail specific people.
Speaker 1: The facial recognition genie is out of the bottle, and
Speaker 1: the fact that there are numerous big companies are making
Speaker 1: use of the technology in a widely distributed way means
Speaker 1: that whenever you're on camera, you are potentially identifiable in
Speaker 1: real time, and you're pretty much always just moments away
Speaker 1: from being on camera if you're out and about. So
Speaker 1: fun times. So hey, let's stay on this topic for
Speaker 1: a little bit. The United States Army Research Laboratory has
Speaker 1: been working on image recognition AI applications that will be
Speaker 1: able to identify faces even if those images were taken
Speaker 1: in darkness. So this research team took half a million
Speaker 1: pictures of three people, which is a pretty small sample size,
Speaker 1: believe it or not. Now, some of those photos were
Speaker 1: taken in normal conditions, normal lighting conditions using a standard camera.
Speaker 1: Others were taken in low light conditions, and some with
Speaker 1: thermal cameras. I think it's pretty obvious to see where
Speaker 1: the benefits are from a military perspective of having technology
Speaker 1: that can identify a person even in low lighting conditions,
Speaker 1: But there is no denying the idea is more or
Speaker 1: than a little creepy. That being said, half a million photos,
Speaker 1: like I said, is a very small sample size, and
Speaker 1: the team says they're making progress, but they are nowhere
Speaker 1: near a level where anything is sophisticated enough for deployment.
Speaker 1: The system is still struggling to identify images and low
Speaker 1: lighting conditions. Thermal cameras produce very different kinds of photos
Speaker 1: than our normal cameras do, and the computer systems haven't
Speaker 1: quite figured out how to reliably map those thermal images
Speaker 1: to specific people. Also, they said that just a small
Speaker 1: change in the camera's viewing angle, like the angle between
Speaker 1: the person's face and the camera, can make it a
Speaker 1: lot harder for a computer to suss out who they
Speaker 1: are looking at. I've often talked about image recognition by
Speaker 1: using coffee mugs as kind of an example. If you
Speaker 1: were to feed millions of images of red coffee mugs
Speaker 1: to a computer, but every single one of those images
Speaker 1: showed the red coffee mug having it's handled pointing off
Speaker 1: to the right side in some way, then the computer
Speaker 1: might balk at seeing that same red coffee mug. But
Speaker 1: what they handle pointed to the left side that could
Speaker 1: be enough to throw the computer off. Computers are remarkable,
Speaker 1: but they can still be pretty dumb in some ways. Still,
Speaker 1: this area of research is a bit scary, particularly since
Speaker 1: we already live in a world where lots of entities
Speaker 1: like law enforcement agencies, rely on facial recognition technologies. And
Speaker 1: that's without even getting into the existing problems we already
Speaker 1: have with facial recognition, like racial and gender bias that
Speaker 1: can lead to inaccurate results. And gosh, I wish I
Speaker 1: had a happier story I could segue too. But I
Speaker 1: should also mention that the Los Angeles Times published an
Speaker 1: article titled clear View AI uses your online photos to
Speaker 1: instantly I du that's a problem, lawsuit says, And yeah,
Speaker 1: the headline pretty much tells the story. So you've got
Speaker 1: this company, clear View AI, and they have an an
Speaker 1: enormous image database, and they created it by scraping various
Speaker 1: websites and services, particularly social networking platforms like face Book
Speaker 1: and Twitter, but also other types of services like Google,
Speaker 1: and Venmo, and they started gathering photos that way. According
Speaker 1: to the l A Times, that means that the company
Speaker 1: has a database of more than three billion photos and
Speaker 1: has software that creates a digital faceprint of each person
Speaker 1: based on those photos, which allows for faster facial recognition
Speaker 1: identification if the system encounters a new image of someone
Speaker 1: who is already in the database somewhere. So all those
Speaker 1: photos that people share on different sites without really thinking
Speaker 1: about it, and I include myself in this group of people,
Speaker 1: you could be part of that massive database. That means
Speaker 1: this company could potentially be using those photos to make
Speaker 1: it possible for a clear view customers like once again,
Speaker 1: law enforcement agencies to use it in real time with
Speaker 1: the various solutions. Now, this prompted some civil liberties activists
Speaker 1: to file a lawsuit against the company in California. They
Speaker 1: said that the company's practices violate privacy and create a
Speaker 1: chilling effect on protected activities such as the right to assembly. Now,
Speaker 1: right now, we're in a pandemic. People shouldn't really be
Speaker 1: assembling in public and big numbers anyway. But they're specifically
Speaker 1: talking about things like the Black Lives Matter movement. So
Speaker 1: the people who have had their accounts scraped, were never
Speaker 1: given any notice that that was happening, let alone ever
Speaker 1: given the chance to give consent for it. Now, the
Speaker 1: flip side of that argument is that you could say,
Speaker 1: someone posting to Facebook or whatever is doing so in
Speaker 1: a semi public way, right if they haven't protected their
Speaker 1: account in any way, then anyone could potentially see those photos.
Speaker 1: But then you have to ask, what about people who
Speaker 1: don't have a Facebook account. Maybe their friends have taken
Speaker 1: photos of them and put those photos up on their
Speaker 1: own account. Maybe those photos even have identifiable information in them,
Speaker 1: And then you've got someone who doesn't even have a
Speaker 1: Facebook account who had their picture scraped for this kind
Speaker 1: of thing doesn't matter in that case. So the plaintiffs
Speaker 1: are focusing just on California and California's citizens for this
Speaker 1: particular lawsuit, and they are seeking an injunction that would
Speaker 1: force clear View AI to stop collecting biometric information on
Speaker 1: people in California, But they also want the company to
Speaker 1: delete all the biometric data that it has already collected.
Speaker 1: Clear View AI faces a similar lawsuit in Illinois. That
Speaker 1: one is being brought against it by the American Civil
Speaker 1: Liberties Union. I'm sure. I will be following up on
Speaker 1: this story later on in the year as it plays out.
Speaker 1: It really is indicative of how people are becoming aware
Speaker 1: that the early choices we made when we were building
Speaker 1: out stuff like social networking sites, we're rather shortsighted and
Speaker 1: have had bigger consequences than we anticipated back then. I mean, heck,
Speaker 1: Facebook started as a website for students to rate how
Speaker 1: hot each other happened to be, So that's kind of
Speaker 1: creepy all on its own. It doesn't have the same
Speaker 1: sort of weight as this is a site that some
Speaker 1: company is going to use later down the road to
Speaker 1: build out an identification engine that law enforcement agencies might
Speaker 1: be using ethically or otherwise in the future. Uh. And
Speaker 1: because of those consequences, we now have to revisit those
Speaker 1: early decisions we made and ask questions like, how can
Speaker 1: we address this? Are there any ways to fix it?
Speaker 1: Will it require us to create a ban on the
Speaker 1: private use of facial recognition technologies? Honestly, those are big
Speaker 1: questions that we don't have answers to yet, and I
Speaker 1: don't know what answers we will arrive at, but I
Speaker 1: will continue to cover the cases. That's it for today's news.
Speaker 1: I hope you guys stay safe and healthy. If you
Speaker 1: have anything you want to share with me, the best
Speaker 1: place to do it is over on Twitter the handle
Speaker 1: I use this tech stuff. H S double you and
Speaker 1: I'll talk to you again really soon. Y Text Stuff
Speaker 1: is an I Heart Radio production. For more podcasts from
Speaker 1: my Heart Radio, visit the I Heart Radio app, Apple Podcasts,
Speaker 1: or wherever you listen to your favorite shows