Dark mode: ON

Infosec Decoded Season 5 #11: Cancer Vaccine

With Doug Spindler and sambowne@infosec.exchange

Recorded Fri, Feb 7, 2025

Politics

Elon Musk’s DOGE is feeding sensitive federal data into AI to target cuts

DOGE fed sensitive data from across the Education Department into Azure AI to probe the agency’s programs and spending. The DOGE team plans to replicate this process across many departments and agencies, accessing the back-end software at different parts of the government and then using AI technology to extract and sift through information about spending on employees and programs, including DEI initiatives.

Musk says he 'deleted' IRS easy filing team that let Americans file taxes for free online

A right-wing MAGA influencer called the "direct file" tax program a "far left government wide computer office" that was "built by Elizabeth Warren." He claimed, "Direct file puts the government in charge of preparing people's tax returns for them." Musk responded by saying, "That group has been deleted."

It’s Official: the Cybertruck is More Explosive than the Ford Pinto

The CyberTruck is 17 times more likely to have a fire fatality than a Ford Pinto.

Between 1970 and 1980, 3,173,491 Ford Pintos were produced. Its famously flawed gas tank behind the rear bumper caused 27 fiery deaths with its knowingly negligent design.

My best estimate is that 34,438 CyberTrucks have been delivered to customers as of Jan 1, 2025. In 2 crashes and 1 incident in their first full year on American roads, the Cybertrucks burned 5 occupants who died.

I look forward to the Cybertruck being governmentally crash-tested by the NHTSA, which it has not been thus far. Until then, I can’t recommend sitting in one.

Educated but easily fooled? Who falls for misinformation and why

Individuals with higher levels of education are just as likely to fall for misinformation as those with a lower level of education. Older adults are actually better than younger adults at distinguishing between true and false headlines. Republicans are more likely to fall for misinformation than those who identify as Democrats.

The strongest effect in the meta-analysis was the influence of familiarity. When participants reported having already seen a news headline, they were more likely to believe it was true. This finding underscores the danger of repeated exposure to misinformation, particularly on social media.

Infosec

Google: How to make any AMD Zen CPU always generate 4 as a random number

Googlers have not only figured out how to break AMD's security – allowing them to load unofficial microcode into its processors to modify the silicon's behavior as they wish – but also demonstrated this by producing a microcode patch that makes the chips always output 4 when asked for a random number. Google was able to produce microcode updates that appear to be digitally signed by AMD, by exploiting a weak hash algorithm in the chip.



DeepSeek is “TikTok on steroids,” senator warns amid push for government-wide ban

Lawmakers are now pushing to immediately ban the Chinese chatbot DeepSeek on government devices, citing national security concerns that the Chinese Communist Party (CCP) may have built a backdoor into DeepSeek to access Americans' sensitive private data. If passed, DeepSeek could be banned within 60 days.

DeepSeek coding has the capability to transfer users' data directly to the Chinese government

Tsarynny says he used AI software to decrypt portions of DeepSeek's code and found what appeared to be intentionally hidden programming that has the capability to send user data to one website: CMPassport.com, the online registry for China Mobile, a telecommunications company owned and operated by the Chinese government.

China Mobile was banned from operating in the U.S. by the FCC in 2019 due to concerns that "unauthorized access to customer…data could create irreparable damage to U.S. national security." It was delisted from the New York Stock Exchange in 2021 and added to the FCC's list of national security threats in 2022.

DeepSeek iOS app sends data unencrypted to ByteDance-controlled servers

Mobile security company NowSecure reported that the app sends sensitive data over unencrypted channels, making the data readable to anyone who can monitor the traffic. More sophisticated attackers could also tamper with the data while it's in transit. Apple strongly encourages iPhone and iPad developers to enforce encryption of data sent over the wire using ATS (App Transport Security). For unknown reasons, that protection is globally disabled in the app, NowSecure said.

HTTPS and OpenVPN face new attack that can decrypt secret cookies (from 2016)

Researchers are calling on developers to stop using legacy 64-bit block-ciphers, which include 3DES and Blowfish.



Microsoft says attackers use exposed ASP.NET keys to deploy malware

Microsoft warns that attackers are deploying malware in ViewState code injection attacks using static ASP. NET machine keys found online. Some developers use ASP.NET validationKey and decryptionKey keys (designed to protect ViewState from tampering and information disclosure) found on code documentation and repository platforms in their own software.

”Torrenting from a corporate laptop doesn’t feel right”: Meta emails unsealed

A copyright case raised by book authors alleges that Meta illegally trained its AI models on pirated books. Meta torrented and seeded "at least 81.7 terabytes of data," and tried to conceal the seeding by not using Facebook servers.

Apple missed screenshot-snooping malware in code that made it into the App Store, Kaspersky claims

Researchers found the malware in an iOS app called ComeCome, which is also available from Google’s Play store, and claims to offer food delivery services. The application also delivers the keys to victims’ crypto holdings to crooks, gathering them by using OCR on screenshots.

Three Years After Experimental Vaccine, These Patients Are Still Cancer-Free

An experimental vaccine for kidney cancer is off to a promising start. In data from a Phase I trial released this week, the vaccine candidate appeared to be safe and produced a clear immune response in all nine patients at high risk for recurrences of their cancer.

The researchers personalized the vaccines given to their patients. They isolated neoantigens within each person’s individual cancers that seemed to have the best chance of inducing immunity, manufactured more of them, and then included them in the vaccine. So far, the results are highly encouraging.

Opinion: There’s a vaccine for poultry. The reason the U.S. isn’t using it is insane.

Other countries are using a bird flu vaccine successfully in poultry and that if we vaccinate the poulets (the young birds) today, separated from the flock, we can have virus-free poultry and cheaper eggs sooner than later. So why are we not doing this?

Our government is worried that if we vaccinate broiler hens, which make up a hefty billions in exports, there are some countries that will cease to buy them for their own export rules and regulations. Which means that global trade, not public health or the health of our local farmers, is actually driving the daily killing of poultry and hence, the price of our eggs.