Editor’s Pick

Enlarge (credit: OpenAI)

ChatGPT developer OpenAI recently acknowledged the necessity of using copyrighted material in the development of AI tools like ChatGPT, The Telegraph reports, saying they would be “impossible” without it. The statement came as part of a submission to the UK’s House of Lords communications and digital select committee inquiry into large language models.

AI models like ChatGPT and the image generator DALL-E gain their abilities from training sessions fed, in part, by large quantities of content scraped from the public Internet without the permission of rights holders (In the case of OpenAI, some of the training content is licensed, however). This sort of free-for-all scraping is part of a longstanding tradition in academic machine learning research, but because deep learning AI models went commercial recently, the practice has come under intense scrutiny.

“Because copyright today covers virtually every sort of human expression—including blogposts, photographs, forum posts, scraps of software code, and government documents—it would be impossible to train today’s leading AI models without using copyrighted materials,” wrote OpenAI in the House of Lords submission.

Enlarge / The Rexroth Nutrunner, a line of torque wrench sold by Bosch Rexroth. (credit: Bosch Rexroth)

Researchers have unearthed nearly two dozen vulnerabilities that could allow hackers to sabotage or disable a popular line of network-connected wrenches that factories around the world use to assemble sensitive instruments and devices.

The vulnerabilities, reported Tuesday by researchers from security firm Nozomi, reside in the Bosch Rexroth Handheld Nutrunner NXA015S-36V-B. The cordless device, which wirelessly connects to the local network of organizations that use it, allows engineers to tighten bolts and other mechanical fastenings to precise torque levels that are critical for safety and reliability. When fastenings are too loose, they risk causing the device to overheat and start fires. When too tight, threads can fail and result in torques that are too loose. The Nutrunner provides a torque-level indicator display that’s backed by a certification from the Association of German Engineers and adopted by the automotive industry in 1999. The NEXO-OS, the firmware running on devices, can be controlled using a browser-based management interface.

Nozomi researchers said the device is riddled with 23 vulnerabilities that, in certain cases, can be exploited to install malware. The malware could then be used to disable entire fleets of the devices or to cause them to tighten fastenings too loosely or tightly while the display continues to indicate the critical settings are still properly in place. B

Enlarge / The tilt of the numerical right-most block may not accurately reflect the degree to which we, collectively, are upgraded to Wi-Fi 7 at this stage. (credit: Getty Images)

Wi-Fi 7 devices can now be certified by the Wi-Fi Alliance. The new standard can provide higher throughput, linked wireless bands for better stability, and reduced latency. It also can make people who skipped over Wi-Fi 6E feel like they made the smart move.

Wi-Fi 7 has already existed as a thing that expensive, new routers claimed to offer, but now it’s a certification they can claim. Wi-Fi 7 devices can use 320 MHz of channel bandwidth, compared to the typical 160 MHz used by Wi-Fi 5, 6, and 6E gear. The new standard is the first to offer Multi-Link Operation, which can bond a connection across 2.4, 5, and 6 GHz connections, offering greater speed and more reliable connections when moving in and out of range of various bands.

As Intel puts it in its explainer, earlier Wi-Fi channels were like moving vans that could “only take one highway at a time and choose alternate routes if they run into traffic. However, Wi-Fi 7 semi-trucks will simultaneously operate across two highways to get more boxes to the destination more quickly.”

Enlarge

Software maker Ivanti is urging users of its end-point security product to patch a critical vulnerability that makes it possible for unauthenticated attackers to execute malicious code inside affected networks.

The vulnerability, in a class known as a SQL injection, resides in all supported versions of the Ivanti Endpoint Manager. Also known as the Ivanti EPM, the software runs on a variety of platforms, including Windows, macOS, Linux, Chrome OS, and Internet of Things devices such as routers. SQL injection vulnerabilities stem from faulty code that interprets user input as database commands or, in more technical terms, from concatenating data with SQL code without quoting the data in accordance with the SQL syntax. CVE-2023-39336, as the Ivanti vulnerability is tracked, carries a severity rating of 9.6 out of a possible 10.

“If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication,” Ivanti officials wrote Friday in a post announcing the patch availability. “This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server.”

Enlarge / An AI-generated image of a “Beautiful queen of the universe looking at the camera in sci-fi armor, snow and particles flowing, fire in the background” created using alpha Midjourney v6. (credit: Midjourney)

In December, just before Christmas, Midjourney launched an alpha version of its latest image synthesis model, Midjourney v6. Over winter break, Midjourney fans put the new AI model through its paces, with the results shared on social media. So far, fans have noted much more detail than v5.2 (the current default) and a different approach to prompting. Version 6 can also handle generating text in a rudimentary way, but it’s far from perfect.

“It’s definitely a crazy update, both in good and less good ways,” artist Julie Wieland, who frequently shares her Midjourney creations online, told Ars. “The details and scenery are INSANE, the downside (for now) are that the generations are very high contrast and overly saturated (imo). Plus you need to kind of re-adapt and rethink your prompts, working with new structures and now less is kind of more in terms of prompting.”

At the same time, critics of the service still bristle about Midjourney training its models using human-made artwork scraped from the web and obtained without permission—a controversial practice common among AI model trainers we have covered in detail in the past. We’ve also covered the challenges artists might face in the future from these technologies elsewhere.

Enlarge (credit: Getty Images)

Orange España, Spain’s second-biggest mobile operator, suffered a major outage on Wednesday after an unknown party obtained a “ridiculously weak” password and used it to access an account for managing the global routing table that controls which networks deliver the company’s Internet traffic, researchers said.

The hijacking began around 9:28 Coordinated Universal Time (about 2:28 Pacific time) when the party logged into Orange’s RIPE NCC account using the password “ripeadmin” (minus the quotation marks). The RIPE Network Coordination Center is one of five Regional Internet Registries, which are responsible for managing and allocating IP addresses to Internet service providers, telecommunication organizations, and companies that manage their own network infrastructure. RIPE serves 75 countries in Europe, the Middle East, and Central Asia.

“Things got ugly”

The password came to light after the party, using the moniker Snow, posted an image to social media that showed the orange.es email address associated with the RIPE account. RIPE said it’s working on ways to beef up account security.

Enlarge

Google-owned security firm Mandiant spent several hours trying to regain control of its account on X (formerly known as Twitter) on Wednesday after an unknown scammer hijacked it and used it to spread a link that attempted to steal cryptocurrency from people who clicked on it.

“We are aware of the incident impacting the Mandiant X account and are working to resolve the issue,” company officials wrote in a statement. “We’ve since regained control over the account and are currently working on restoring it.” The statement didn’t answer questions asking if the company had determined how the account was compromised.

The hacked Mandiant account was initially used to masquerade as one belonging to Phantom, a company that offers a wallet for storing cryptocurrency. Posts on X encouraged people to visit a malicious website to see if their wallet was one of 250,000 that were eligible for an award of tokens. Over several hours, X employees played tug-of-war with the unknown scammer, with scam posts being removed only to reappear, according to people who followed the events.

Enlarge (credit: Getty Images)

Roughly 11 million Internet-exposed servers remain susceptible to a recently discovered vulnerability that allows attackers with a foothold inside affected networks. Once they’re in, attackers compromise the integrity of SSH sessions that form the lynchpin for admins to securely connect to computers inside the cloud and other sensitive environments.

Terrapin, as the vulnerability has been named, came to light two weeks ago in a research paper published by academic researchers. Tracked as CVE-2023-48795, the attack the researchers devised works when attackers have an adversary-in-the-middle attack (also abbreviated as AitM and known as man-in-the-middle or MitM), such as when they’re positioned on the same local network and can secretly intercept communications and assume the identity of both the recipient and the sender.

In those instances, Terrapin allows attackers to alter or corrupt information transmitted in the SSH data stream during the handshake—the earliest connection stage, when the two parties negotiate the encryption parameters they will use to establish a secure connection. As such, Terrapin represents the first practical cryptographic attack targeting the integrity of the SSH protocol itself. It works by targeting BPP (Binary Packet Protocol), which is designed to ensure AitMs can’t add or drop messages exchanged during the handshake. This prefix truncation attack works when implementations support either the “ChaCha20-Poly1305” or “CBC with Encrypt-then-MAC,” cipher modes, which, at the time the paper was published, was found in 77 percent of SSH servers.

Enlarge / AI-generated results of a gangster Mickey Mouse, Eldritch Horror Mickey Mouse, and Basketball Mickey Mouse created by a model trained on 1928 public domain Mickey Mouse cartoons. (credit: Schroedingercat, Kevin Elliott, David Binkowski)

On January 1, three early Mickey Mouse cartoons entered the public domain in the US, and AI experimenters have wasted no time taking advantage of it. On Monday, a digital humanities researcher named Pierre-Carl Langlais uploaded an AI model to Hugging Face that has been trained on those public domain cartoons, and anyone can use it to create new still images based on a written prompt.  While the results are rough and sometimes garbled, they show notable early experimentation with integrating public domain Mickey into the AI space.

The new model can create images of Mickey Mouse, Minnie Mouse, and Peg Leg Pete. “The generated images aims adhere [sic] to the 1928 design in order to have Mickey, Minnie and Pete and in the public domain,” writes Langlais on the model card. “This is still a work in progress: while the model is in development, generated images should be checked to ensure they really are in the public domain design.”

To create the model, Langlais fine-tuned a version of Stable Diffusion XL with 34 cartoon image stills from Steamboat Willie, 22 stills from Plane Crazy, and 40 stills from The Gallopin’ Gaucho—all released in 1928 and now in the public domain. More stills would have equated to more cost and training time, so he likely kept the number of images low for practical purposes, although that created lower-quality results. And Langlais writes in the model card that the training stills aren’t as high quality as possible, but that might change over time: “Hopefully with the cartoons now being part of the public domain, higher definition versions should be available.”

Enlarge (credit: Tero Vesalainen)

Researchers on Wednesday presented intriguing new findings surrounding an attack that over four years backdoored dozens if not thousands of iPhones, many of which belonged to employees of Moscow-based security firm Kaspersky. Chief among the discoveries: the unknown attackers were able to achieve an unprecedented level of access by exploiting a vulnerability in an undocumented hardware feature that few if anyone outside of Apple and chip suppliers such as ARM Holdings knew of.

“The exploit’s sophistication and the feature’s obscurity suggest the attackers had advanced technical capabilities,” Kaspersky researcher Boris Larin wrote in an email. “Our analysis hasn’t revealed how they became aware of this feature, but we’re exploring all possibilities, including accidental disclosure in past firmware or source code releases. They may also have stumbled upon it through hardware reverse engineering.”

Four zero-days exploited for years

Other questions remain unanswered, wrote Larin, even after about 12 months of intensive investigation. Besides how the attackers learned of the hardware feature, the researchers still don’t know what, precisely, its purpose is. Also unknown is if the feature is a native part of the iPhone or enabled by a third-party hardware component such as ARM’s CoreSight