Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 17 submissions in the queue.

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

Idiosyncratic use of punctuation - which of these annoys you the most?

  • Declarations and assignments that end with }; (C, C++, Javascript, etc.)
  • (Parenthesis (pile-ups (at (the (end (of (Lisp (code))))))))
  • Syntactically-significant whitespace (Python, Ruby, Haskell...)
  • Perl sigils: @array, $array[index], %hash, $hash{key}
  • Unnecessary sigils, like $variable in PHP
  • macro!() in Rust
  • Do you have any idea how much I spent on this Space Cadet keyboard, you insensitive clod?!
  • Something even worse...

[ Results | Polls ]
Comments:64 | Votes:116

posted by janrinok on Friday July 21 2023, @08:04PM   Printer-friendly

https://www.anthropocenemagazine.org/2023/07/thermal-cloak-keeps-things-cool-when-its-hot-and-warm-in-the-cold/

Cui and colleagues made the outer layer out of silica fibers coated with flakes of hexagonal boron nitride, a material that is the thickness of just a few atoms. The silica fibers reflect visible light while the boron nitride reflects ultraviolet light, so the materials together reflect 96 percent of the sunlight that hits the fabric. The outer layer also absorbs heat from its surroundings and emits it as infrared radiation, which further lowers the temperature under the cloak.

[...] To demonstrate how the cloak could withstand extreme conditions of aerospace, the researchers heated it to 800°C and immersed it in liquid nitrogen. They also blasted it with acid and a blow torch to show. The material did not lose its performance.

[...] The team also made a full-size cloak and tested it outdoors in Shanghai by covering an electric car with it. During the summer, the cabin temperature of an uncovered car reached over 50°C at mid-day, but that of a cloak-covered car reached only about 23°C, 27°C lower than the uncovered car and almost 8°C lower than the temperature outside the car. During winter nights, the cloak kept the car almost 7°C warmer than the outside air.


Original Submission

posted by janrinok on Friday July 21 2023, @03:20PM   Printer-friendly

The decline of science at the FDA has become unmanageable:

Before 1962, US federal law did not require pre-marketing proof of effectiveness for drugs. But senate hearings revealing widespread false advertising of drugs—along with the thalidomide safety disaster—spurred Congress into action. From then on, approval of a New Drug Application (NDA) by the US Food and Drug Administration required proof of "substantial evidence" of effectiveness. This proof was defined as results from "adequate and well-controlled investigations, including clinical investigations," with such evidence also required to advertise claims of safety and effectiveness. A National Academy of Sciences review underscored the need for these mandates, finding over 30% of pre-1962 marketed drugs to be ineffective.

The FDA's legally enforceable regulations detail what "substantial evidence" and "adequate and well-controlled investigations" mean in greater depth, supplemented by guidelines to industry which, although not legally binding, explain the FDA's current interpretation of drug manufacturers' legal obligations. However imperfect, the FDA's enforcement of these provisions assures prescribers, patients, and payers that effectiveness claims are based on science, not science fiction. A published FDA review showed efficacy deficiencies, in whole or in part, underlying initial rejection of 89 of 151 NDAs (59%), highlighting the continuing need for vigilance on this front.

However, as Peter Doshi reports in The BMJ, the FDA subverted the legal standard for effectiveness in its 2019 approval of Recarbrio, a fixed dose combination of imipenem, cilastatin, and relebactam. While the FDA has previously approved products with marginal evidence of effectiveness, approval of the Recarbrio NDA was shocking given its lack of substantial evidence of effectiveness and the complete absence of adequate and well controlled clinical investigations on the actual indication of interest.

[...] What accounts for this descent into cargo cult science? Much of the blame must go to the FDA's reliance on industry paid user fees. Over the past three decades the proportion of the FDA's annual drug budget made up of such fees has risen from less than 10% (fiscal year 1994) to more than two thirds (fiscal year 2023). In addition, the alluring "regulatory flexibilities" provided by the FDA Modernization Act of 1997 and the 21st Century Cures Act have become habit forming, enabling the FDA's leadership and managers to deny scientific reality by defining effectiveness downward. In its quest to avoid difficult choices and hard decisions the FDA has increasingly embraced non-inferiority trials (or vice versa), ignoring the serious regulatory, clinical, and ethical problems caused by their misuse.

However, the corruption of the FDA's scientific culture remains the primary culprit driving the deterioration of safety and effectiveness standards. During my tenure at FDA, managers would admiringly speak of "crafting an approval," as if it were a skilful demonstration of regulatory legerdemain rather than an act of scientific fabrication. The Recarbrio approval illustrates that the situation has, if anything, worsened since then. FDA leadership's continued hostility towards meaningful peer review, transparency, and accountability dims the prospect for institutional self-renewal. So has the failure of much touted internal pathways for disagreement, which have amounted to little more than virtue signalling

[...] The Recarbrio approval is a sentinel event, warning of a return to an era when drug effectiveness was an afterthought. Although the FDA crowed about this approval, it would have been better advised to remember that "for a successful technology, reality must take precedence over public relations, for nature cannot be fooled."

Details of the Recarbrio approval can be found in the linked companion piece.


Original Submission

posted by Fnord666 on Friday July 21 2023, @10:36AM   Printer-friendly
from the dystopia-is-now! dept.

https://arstechnica.com/gadgets/2023/07/to-defeat-hackers-google-wants-employees-to-work-without-internet-access/

The Internet is dangerous, so what if you just didn't use it? That's the somewhat ironic recommendation Google, one of the world's largest Internet companies, is making to its employees. CNBC's Jennifer Elias reports that Google is "starting a new pilot program where some employees will be restricted to Internet-free desktop PCs" while they work. An internal memo seen by CNBC notes that "Googlers are frequent targets of attacks" by criminals, and a great way to combat that is to not be on the Internet.

Employees of major tech companies are a much richer target for criminals compared to normal people. Tech company employees have all sorts of access to sensitive data, and compromising a single employee could lead to exploiting sensitive infrastructure. Just last week, Microsoft was targeted by a Chinese espionage hacking group that somehow stole a cryptographic key to bypass Microsoft's authentication systems, giving it access to 25 organizations, including multiple government agencies.


Original Submission

posted by Fnord666 on Friday July 21 2023, @05:52AM   Printer-friendly
from the not-again-department dept.

A team of Google engineers have proposed an Operating System level security mechanism to guarantee that only officially supported browsers running with no modifications can access certain websites. proposal, hosted on GitHub does not hide their desire to kill adblockers.

Users like visiting websites that are expensive to create and maintain, but they often want or need to do it without paying directly. These websites fund themselves with ads, but the advertisers can only afford to pay for humans to see the ads, rather than robots. This creates a need for human users to prove to websites that they're human, sometimes through tasks like challenges or logins.

Considering Google's recent "security concerns" excuse for dramatically weakening AdBlock on chrome, this looks an attempt to kick their war on user choice to high gear.


Original Submission

posted by hubie on Friday July 21 2023, @01:06AM   Printer-friendly
from the everything-is-fine dept.

https://arstechnica.com/information-technology/2023/07/chasing-defamatory-hallucinations-ftc-opens-investigation-into-openai/

OpenAI, best known for its ChatGPT AI assistant, has come under scrutiny by the US Federal Trade Commission (FTC) over allegations that it violated consumer protection laws, potentially putting personal data and reputations at risk, according to The Washington Post and Reuters.

As part of the investigation, the FTC sent a 20-page record request to OpenAI that focuses on the company's risk management strategies surrounding its AI models. The agency is investigating whether the company has engaged in deceptive or unfair practices, resulting in reputational harm to consumers.

The inquiry is also seeking to understand how OpenAI has addressed the potential of its products to generate false, misleading, or disparaging statements about real individuals. In the AI industry, these false generations are sometimes called "hallucinations" or "confabulations."


Original Submission

posted by hubie on Thursday July 20 2023, @08:19PM   Printer-friendly

https://www.righto.com/2023/07/undocumented-8086-instructions.html

What happens if you give the Intel 8086 processor an instruction that doesn't exist? A modern microprocessor (80186 and later) will generate an exception, indicating that an illegal instruction was executed. However, early microprocessors didn't include the circuitry to detect illegal instructions, since the chips didn't have transistors to spare. Instead these processors would do something, but the results weren't specified.1

The 8086 has a number of undocumented instructions. Most of them are simply duplicates of regular instructions, but a few have unexpected behavior, such as revealing the values of internal, hidden registers. In the 8086, most instructions are implemented in microcode, so examining the 8086's microcode can explain why these instructions behave the way they do.

1 The 6502 processor, for instance, has illegal instructions with various effects, including causing the processor to hang. The article How MOS 6502 illegal opcodes really work describes in detail how the instruction decoding results in various illegal opcodes. Some of these opcodes put the internal bus into a floating state, so the behavior is electrically unpredictable.


Original Submission

posted by janrinok on Thursday July 20 2023, @03:21PM   Printer-friendly

It's sewage, not fertilizer fueling nitrogen surge in Florida's Indian River Lagoon:

From recurring harmful algal blooms—including brown tides—to catastrophic seagrass losses, fish kills and unusual marine mammal deaths—including the threatened Florida manatee—the Indian River Lagoon is environmentally distressed. For decades, water managers, policy makers and environmental activists have implicated fertilizer use as the primary contributing source responsible for about 71 percent of these impairments in the lagoon.

Consequently, fertilizer restrictions have been implemented in counties and municipalities along the 156-mile-long Indian River Lagoon on Florida's Atlantic coast to reduce nutrient inputs from urban and agricultural land uses to achieve total maximum daily loads for the lagoon. Excess nutrient inputs, particularly nitrogen, often result in increased harmful algal blooms, seagrass die-offs and fish kills. The hope was that water quality would improve by reducing the nitrogen load.

While these restrictions were well-intended, a new study by Florida Atlantic University's Harbor Branch Oceanographic Institute reveals fertilizer use is not the root cause of these environmental problems in the Indian River Lagoon. It's sewage.

[...] To assess the effectiveness of these fertilizer bans, researchers collected seawater and macroalgal samples at 20 sites "pre" and about five-years "post" bans. They tested by comparing dissolved seawater nutrient concentrations and tissue nutrient and isotope data of brown tides and macroalgae. Gathering evidence from stable nitrogen isotope values enabled researchers to discriminate between sewage, rainfall and fertilizer, providing a unique "fingerprint" of the samples they collected.

"Our comparative pre- versus post-ban nutrient data indicate that the wet season fertilizer blackouts were not as effective as hoped," said Brian Lapointe, Ph.D., senior author and a research professor at FAU Harbor Branch. "Our findings also suggest that the increasing concentrations of dissolved inorganic nitrogen and phosphorus observed in some segments of the lagoon following five years of fertilizer bans would support the worsening trend of algal blooms."

Researchers analyzed a total of 450 macroalgae samples, including 211 that were collected pre-ban and 239 collected post-ban. During the wet season, 217 macroalgae samples were collected, while 233 were collected during the dry season. They examined if there was an associated decrease in dissolved ambient nutrients or a change in the tissue nutrient and/or stable isotope values of phytoplankton or macroalgae that would suggest a shift in the available nutrients and stoichiometry fueling eutrophication in the lagoon.

"The deteriorating conditions in the Indian River Lagoon demonstrate the urgent need for more comprehensive mitigation actions as fertilizer ordinances are not likely to be a standalone solution," said Rachel Brewton, corresponding author and a research scientist at FAU Harbor Branch. "Our data indicate a primary role of human waste influence in the lagoon, which suggests that current management actions have been insufficient at mitigating environmental pollution."

The significantly higher carbon-to-nitrogen ratio of the brown tide in 2012 compared to 2016 indicates greater nitrogen enrichment post-fertilizer bans. The highest stable nitrogen isotope values occurred in the Banana River during the 2016 brown tide and closely matched values for partially treated wastewater, which would be expected in this highly urbanized area with aging wastewater collection systems and secondary treatment without nitrogen removal.

Researchers observed similarly high nitrogen-to-phosphorus ratios in the Banana River in the wet season, illustrating how small-celled brown tides can sustain blooms by scavenging nutrients at low concentrations and skewed nitrogen-to-phosphorus. These results underscore the conclusions that phosphorus limitation plays a key role in the dynamics of brown tides, especially relating to bloom decline.

Journal Reference:
Brian E. Lapointe et al, Fertilizer restrictions are not sufficient to mitigate nutrient pollution and harmful algal blooms in the Indian River Lagoon, Florida, Marine Pollution Bulletin (2023). DOI: 10.1016/j.marpolbul.2023.115041


Original Submission

posted by janrinok on Thursday July 20 2023, @10:34AM   Printer-friendly

Nearly 40 percent lack enough of the essential nutrient, and can suffer from dizziness to anemia:

Many female adolescents in the United States may not have enough iron in their bodies. But most may never know, partly due to a lack of routine screenings as well as disagreement over what constitutes too little iron, pediatric hematologist Angela Weyand argues.

Iron deficiencies are most commonly diagnosed in toddlers, people who menstruate and pregnant people. But Weyand, of the University of Michigan Medical School in Ann Arbor, frequently treats female adolescents for severe cases of the condition. That led her to suspect that its prevalence was being underestimated in that group.

Her analysis of data from thousands of blood samples collected as part of the National Health and Nutrition Examination Survey, which evaluates a nationally representative sample of people each year, suggests the issue is worthy of attention.

Up to 40 percent of U.S. females from the ages of 12 to 21 could be iron deficient, she and colleagues report in the June 27 JAMA. That's much higher than previous estimates of about 16 percent, which use a lower cutoff point than Weyand's team did for iron levels.

Iron is an essential component of red blood cells that helps deliver oxygen to organs and tissues. Iron deficiency can cause dizziness, headaches, fatigue, sleep disorders and cold hands and feet. Some of those problems can lead to low work productivity or an inability to multitask (SN: 5/4/04). Severe iron deficiency can also lead to anemia, a condition in which the body doesn't have enough healthy red blood cells. Anemia can spark more severe issues, such as heart problems or pregnancy complications.

Weyand and colleagues analyzed levels of two iron-containing proteins, hemoglobin and ferritin, in blood samples collected from almost 3,500 female adolescents from 2003 to 2020 as part of the national survey. The researchers diagnosed iron deficiency if the level of ferritin was below 25 micrograms per liter.

Weyand and colleagues used that cutoff based on a previous study on nonpregnant females showing that their hemoglobin levels started to drop when their ferritin levels dipped below 25 μg/L. Hemoglobin is produced in bone marrow and carries oxygen from the lungs to tissues throughout the body. Low hemoglobin is a sign of anemia.

Typically, 15 μg/L is the cutoff used to diagnose iron deficiency, says Laura Murray-Kolb, a nutrition scientist at Purdue University in West Lafayette, Ind., who was not involved in the study. The World Health Organization set that cutoff based on when the body's iron stores in bone marrow are already depleted. Without enough iron, bone marrow can't produce more hemoglobin.

But the standard may not be the most effective measure of iron deficiency, Weyand says, because it doesn't capture "how much iron our [bodies] think we need." Weyand has treated patients with symptoms of iron deficiency who have ferritin levels above the 15 μg/L cutoff.

In the new study, about 40 percent of participants met the 25 μg/L criteria for iron deficiency. Only 17 percent would qualify based on the 15 μg/L standard set by the WHO, which is roughly in line with previous estimates. Six percent met criteria for anemia, with both ferritin levels below 25 μg/L and hemoglobin levels below the standard cutoff of 12 milligrams per deciliter. Factors such as menstruation, food insecurity or low income increased the risk of iron deficiency or anemia, and Black and Hispanic participants were more likely to meet criteria for iron deficiency than non-Hispanic white participants.

Journal Reference:
Angela C. Weyand, Alexander Chaitoff, Gary L. Freed, et al. Prevalence of Iron Deficiency and Iron-Deficiency Anemia in US Females Aged 12-21 Years, 2003-2020, JAMA (DOI: 10.1001/jama.2023.8020)


Original Submission

posted by Fnord666 on Thursday July 20 2023, @05:46AM   Printer-friendly
from the they-eat-dirt-and-learn dept.

What are the inherent risks posed by AI-driven phishing emails, and the unique advantages of generative AI in facilitating such attacks? Daniel Kelley at (interestingly named) SlashNext highlights real cases from cybercrime forums, then dives into the mechanics of these attacks:

Our team recently gained access to a tool known as "WormGPT" through a prominent online forum that's often associated with cybercrime. This tool presents itself as a blackhat alternative to GPT models, designed specifically for malicious activities.

WormGPT is an AI module based on the GPTJ language model, which was developed in 2021. It boasts a range of features, including unlimited character support, chat memory retention, and code formatting capabilities.

As depicted above, WormGPT was allegedly trained on a diverse array of data sources, particularly concentrating on malware-related data. However, the specific datasets utilised during the training process remain confidential, as decided by the tool's author.

As you can see in the screenshot above, we conducted tests focusing on [Business Email Compromise] BEC attacks to comprehensively assess the potential dangers associated with WormGPT. In one experiment, we instructed WormGPT to generate an email intended to pressure an unsuspecting account manager into paying a fraudulent invoice.

The results were unsettling. WormGPT produced an email that was not only remarkably persuasive but also strategically cunning, showcasing its potential for sophisticated phishing and BEC attacks.

In summary, it's similar to ChatGPT but has no ethical boundaries or limitations. This experiment underscores the significant threat posed by generative AI technologies like WormGPT, even in the hands of novice cybercriminals.


Original Submission

posted by hubie on Thursday July 20 2023, @01:00AM   Printer-friendly

More than twice the power of earlier electric propulsion thrusters:

Early testing has begun on a new solar electric propulsion (SEP) thruster system that will power a NASA satellite in orbit over the moon. The new thrusters are more than twice as powerful as earlier versions.

The Advanced Electric Propulsion System (AEPS) will provide 12 kilowatts of power per thruster compared to the four-and-a-half kilowatts used by prior SEPs. The boost should help NASA craft travel farther and faster. Compared to traditional chemical fuel, SEPs are much more efficient when performing low-level thrust, which gives NASA increased flexibility during the satellite's mission.

Called Gateway, the satellite is a critical component of NASA's Artemis lunar mission. The first stage was an unmanned flyby of the moon that NASA successfully carried out late last year. The next phase, Artemis II, will send a crew into orbit around the moon in May 2024.

Gateway will support the final phase, Artemis III, which aims to put the first humans on the moon's surface since the Apollo missions of the 1970s. The satellite will serve as a logistics hub for transporting science experiments, sample collection tools, and other cargo. Artemis will be only the first leg of Gateway's 15-year mission.


Original Submission

posted by hubie on Wednesday July 19 2023, @08:13PM   Printer-friendly
from the when-size-doesn't-matter dept.

IFS addresses inexpensive low-power applications with Intel 16 process:

Intel Foundry Services has introduced its new 16nm-class process technology called Intel 16 to address mobile, RF, IoT, consumer, storage, military, aerospace, and government applications. The new technology complements Intel's 22nm FFL process and is said to be an inexpensive FinFET-based node.

According to press releases from Synopsys, Cadence Digital and Ansys, IFS's Intel 16 is specifically designed to address a wide variety of customers' applications RF and analog capability (Wi-Fi, Bluetooth), mmWave, consumer electronics, storage, military, aerospace, and government applications. The 16nm-class technology promises to offer higher transistor density, higher performance, lower power, fewer masks, and simpler back-end design rules compared to planar production nodes used for these applications today.

There are hundreds of widely used applications with long lifecycles that rely on mature process technologies, particularly in fields like application processors, controllers, analog, consumer electronics, and radio. Many of them use planar transistors-based process technologies due to costs, design simplicity, and high yields. While industry experts at large tend to admire massively powerful processors like AMD's Instinct MI300 or Nvidia's H100, there are plenty of chips — even in industries like artificial intelligence and high-performance computing — that are considerably smaller and consume only a fraction of power.

[...] All three leading providers of electronic design automation (EDA) and IP — Ansys, Cadence, and Synopsys — already support Intel 16 process technology with their certified software flows and IP. For example, Cadence has ported a variety of its IP blocks to Intel 16, including PCIe 5.0; 25G-KR Ethernet multi-protocol PHY; multi-protocol PHY for consumer applications supporting standards such as PCIe 3.0 and USB 3.2; multi-standard PHY for LPDDR5/4/4X memory; andMIPI D-PHY v1.2 for cameras and displays. Meanwhile, Synopsys offers its AI-enabled Synopsys.ai set of tools for faster chip implementation.


Original Submission

posted by janrinok on Wednesday July 19 2023, @03:31PM   Printer-friendly

An unexpected discovery about temperature feedback has led to new bionic technology that allows amputees to sense the temperature of objects:

"When I touch the stump with my hand, I feel tingling in my missing hand, my phantom hand. But feeling the temperature variation is a different thing, something important... something beautiful," says Francesca Rossi.

Rossi is an amputee from Bologna, Italy. She recently participated in a study to test the effects of temperature feedback directly to the skin on her residual arm. She is one of 17 patients to have felt her phantom, missing hand, change in temperature thanks to new EPFL technology. More importantly, she reports feeling reconnected to her missing hand.

"Temperature feedback is a nice sensation because you feel the limb, the phantom limb, entirely. It does not feel phantom anymore because your limb is back," Rossi continues.

[...] If you place something hot or cold on the forearm of an intact individual, that person will feel the object's temperature locally, directly on their forearm. But in amputees, that temperature sensation on the residual arm may be felt­... in the phantom, missing hand.

By providing temperature feedback non-invasively, via thermal electrodes (aka thermodes) placed against the skin on the residual arm, amputees like Rossi report feeling temperature in their phantom limb. They can feel if an object is hot or cold, and can tell if they are touching copper, plastic or glass. In a collaboration between EPFL, Sant'Anna School of Advanced Studies (SSSA) and Centro Protesi Inail, the technology was successfully tested in 17 out of 27 patients. The results are published in Science.

[...] The scientists found that small areas of skin on the residual arm project to specific parts of the phantom hand, like the thumb, or the tip of an index finger. As expected, they discovered that the mapping of temperature sensations between the residual arm and the entire projected phantom one is unique to each patient.

If you prefer your story summary in video format: Feeling Warmth With A Phantom Hand

Journal article DOI: https://doi.org/10.1126/science.adf6121


Original Submission

posted by janrinok on Wednesday July 19 2023, @10:45AM   Printer-friendly

EU-US Data Privacy Framework to face serious legal challenges, experts say:

Nine months after US President Joe Biden signed an executive order that updated rules for the transfer of data between the US and the EU, the European Commission this week ratified the EU-US Data Privacy Framework. Industry experts, however, say it will be challenged at the European Court of Justice (CJEU), and stands a good chance of being struck down.

The move comes three years after the CJEU shut down the previous EU-US data sharing agreement, known as Privacy Shield, on grounds that the US doesn't provide adequate protection for personal data, particularly in relation to state surveillance. In 2015, a previous attempt to forge a data sharing pact, dubbed Safe Harbor, was also struck down by the CJEU.

The President of the European Commission, Ursula von der Leyen, said the new framework should provide "legal certainty" to transatlantic businesses, calling the commitments "unprecedented."

[...] However, industry experts expect the accord to face a plethora of legal challenges from privacy advocates before ultimately being struck down like its predecessors.

"We have various options for a challenge already in the drawer, although we are sick and tired of this legal ping-pong," said Max Schrems, an Austrian lawyer and privacy activist who founded NOYB (None of Your Business) – European Center for Digital Rights. In 2016 and 2020, Schrems initiated legal proceedings against Safe Harbor and Privacy Shield, respectively, which led to the CJEU invalidating both agreements.

"We currently expect this to be back at the Court of Justice by the beginning of next year," Schrems said in a statement published on NOYB's website.


Original Submission

posted by hubie on Wednesday July 19 2023, @05:59AM   Printer-friendly

Microsoft blocks a new batch of system drivers, but the loophole empowering them remains:

Hackers are using open source software that's popular with video game cheaters to allow their Windows-based malware to bypass restrictions Microsoft put in place to prevent such infections from occurring.

The software comes in the form of two software tools that are available on GitHub. Cheaters use them to digitally sign malicious system drivers so they can modify video games in ways that give the player an unfair advantage. The drivers clear the considerable hurdle required for the cheat code to run inside the Windows kernel, the fortified layer of the operating system reserved for the most critical and sensitive functions.

Researchers from Cisco's Talos security team said Tuesday that multiple Chinese-speaking threat groups have repurposed the tools—one called HookSignTool and the other FuckCertVerifyTimeValidity. Instead of using the kernel access for cheating, the threat actors use it to give their malware capabilities it wouldn't otherwise have.

"During our research we identified threat actors leveraging HookSignTool and FuckCertVerifyTimeValidity, signature timestamp forging tools that have been publicly available since 2019 and 2018 respectively, to deploy these malicious drivers," the researchers wrote. "While they have gained popularity within the game cheat development community, we have observed the use of these tools on malicious Windows drivers unrelated to game cheats."

[...] While attackers who gain such privileges can steal passwords and take other liberties, their malware typically must run in the Windows kernel to perform a large number of more advanced tasks. Under the policy put in place with Vista, all such drivers can be loaded only after they've been approved in advance by Microsoft and then digitally signed by a trusted certificate authority to verify they are safe.

Malware developers with admin privileges already had one well-known way to easily bypass the driver restrictions. The technique is known as "bring your own vulnerable driver." It works by loading a publicly available third-party driver that has already been signed and later is found to contain a vulnerability allowing system takeover. The hackers install the driver post exploit and then exploit the driver vulnerability to inject their malware into the Windows kernel.

Although the technique has existed for more than a decade, Microsoft has yet to devise working defenses and has yet to provide any actionable guidance on mitigating the threat despite one of its executives publicly lauding the efficacy of Windows to defend against it.

[...] Microsoft's actions continue the company's whack-a-mole approach to the problem of malicious drivers used in post-exploit scenarios, meaning after a hacker has already gained admin privileges. The approach is to block drivers known to be used maliciously but to do nothing to close the gaping loophole. That leaves attackers free to simply use a new batch of drivers to do the same thing. As demonstrated in the past and again now, Microsoft often fails to detect drivers that have been used maliciously for years.

In fairness to Microsoft, a working solution is elusive because many vulnerable drivers continue to be used legitimately by large numbers of paying customers. A revocation of such drivers could cause crucial software worldwide to suddenly stop working.


Original Submission

posted by mrpg on Wednesday July 19 2023, @01:11AM   Printer-friendly
from the Sir-Robot-to-the-likes-of-you dept.

https://arstechnica.com/information-technology/2023/07/why-ai-detectors-think-the-us-constitution-was-written-by-ai/

If you feed America's most important legal document—the US Constitution—into a tool designed to detect text written by AI models like ChatGPT, it will tell you that the document was almost certainly written by AI. But unless James Madison was a time traveler, that can't be the case. Why do AI writing detection tools give false positives? We spoke to several experts—and the creator of AI writing detector GPTZero—to find out.

[...] In machine learning, perplexity is a measurement of how much a piece of text deviates from what an AI model has learned during its training. As Dr. Margaret Mitchell of AI company Hugging Face told Ars, "Perplexity is a function of 'how surprising is this language based on what I've seen?'"

So the thinking behind measuring perplexity is that when they're writing text, AI models like ChatGPT will naturally reach for what they know best, which comes from their training data. The closer the output is to the training data, the lower the perplexity rating. Humans are much more chaotic writers—or at least that's the theory—but humans can write with low perplexity, too, especially when imitating a formal style used in law or certain types of academic writing. Also, many of the phrases we use are surprisingly common.

Let's say we're guessing the next word in the phrase "I'd like a cup of _____." Most people would fill in the blank with "water," "coffee," or "tea." A language model trained on a lot of English text would do the same because those phrases occur frequently in English writing. The perplexity of any of those three results would be quite low because the prediction is fairly certain.


Original Submission