AI: You Can't Live With It, You Can't Live Without It 

AI can do terrific things for us and we've seen recent stories of how AI can identify vulnerabilities in software that it would take days, weeks or months for us mere humans to find. Of course, AI can be used just as easily to exploit those vulnerabilities. AI is training on the data in our websites, but now there's a way to poison that too. This edition focuses on three stories related to the benefits and challenges of AI: AI finding a security flaw in Zoom, terabytes of credentials leaked via an open source tool that streamlines AI-driven software development and how a font can be used to poison the training data for AI.

ZOOMing Into Trouble

Researchers on Tuesday disclosed vulnerabilities in the video conferencing platform Zoom that could have been exploited to take over targets’ devices. Anyone on a call that involved screen sharing, whether participants or the host, would have been vulnerable to a silent attack that could be carried out with no indication and no interaction from the victim. The bug was discovered in early June using publicly available AI models, and that it took fewer than 20 prompts to uncover the vulnerabilities and create a working attack. Zoom is already rolling out fixes for all operating systems that Zoom supports. Lily Hay Newman discusses it in ArsTechnica here: Researchers found a way to hijack devices through Zoom screen sharing

A Large Supply of Credentials

Remember when a supply-chain was a good thing? Terabytes worth of credentials, many belonging to the world’s biggest and most sensitive organizations, have been exposed in a supply-chain attack on LiteLLM, an open source tool that streamlines AI-driven software development. It only took a 40-minute window in March to extract the credentials. The list of companies where credentials were exposed reads like a "who's who" of organizations: Microsoft, Amazon, Cisco, Samsung, and Salesforce, just to name a few. 2,186 organizations affected in all! Yikes! Dan Goodin discusses it in ArsTechnica here: Terabytes of credentials leaked in massive supply-chain attack  

Scrape This, AI!

A pair of designers are hoping to stymie AI scrapers with a new font designed to offer people a perfectly readable webpage while serving scrapers a subtly edited, nonsensical version in the underlying HTML. That's right, a font. ShieldFont was made to offer web publishers “a practical opt-out from unauthorized AI training and [to] disrupt what is collected when that choice is ignored.” The font is based around "ligatures", a long-standing feature of many fonts that is usually used to replace certain letter pairs with a more readable version when they’re smushed up next to each other. Here, they're using it to replace entire words with nonsensical alternatives, e.g., swapping “horse” with “potato”. AI models will have cowboys riding potatoes before we know it. Kyle Orland discusses it in ArsTechnica here: The web’s newest weapon against AI scrapers is a font

Images created by Bing. Get well ASAP, Jeff!

-Doug Austin

---

Jeffrey Brandt, Editor

Connect with me on LinkedIn Jeffrey Brandt
Follow all the PinHawk highlights @PinHawkHappens
Website:PinHawk.com | Blog: PinHawkBlog.com