serisec

Category: bruce schneier

  • Friday Squid Blogging: Squid Sticker

    Friday Squid Blogging: Squid Sticker A sticker for your water bottle. Blog moderation policy. Bruce Schneier Go to bruce schneier

  • Mailbox Insecurity

    Mailbox Insecurity It turns out that all cluster mailboxes in the Denver area have the same master key. So if someone robs a postal carrier, they can open any mailbox. I get that a single master key makes the whole system easier, but it’s very fragile security. Bruce Schneier Go to bruce schneier

  • New Advances in the Understanding of Prime Numbers

    New Advances in the Understanding of Prime Numbers Really interesting research into the structure of prime numbers. Not immediately related to the cryptanalysis of prime-number-based public-key algorithms, but every little bit matters. Bruce Schneier Go to bruce schneier

  • Hacking Digital License Plates

    Hacking Digital License Plates Not everything needs to be digital and “smart.” License plates, for example: Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By removing a sticker on…

  • Short-Lived Certificates Coming to Let’s Encrypt

    Short-Lived Certificates Coming to Let’s Encrypt Starting next year: Our longstanding offering won’t fundamentally change next year, but we are going to introduce a new offering that’s a big shift from anything we’ve done before—short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS…

  • Upcoming Speaking Events

    Upcoming Speaking Events This is a current list of where and when I am scheduled to speak: I’m speaking at a joint meeting of the Boston Chapter of the IEEE Computer Society and GBC/ACM, in Boston, Massachusetts, USA, at 7:00 PM ET on Thursday, January 9, 2025. The event will take place at the Massachusetts…

  • Ultralytics Supply-Chain Attack

    Ultralytics Supply-Chain Attack Last week, we saw a supply-chain attack against the Ultralytics AI library on GitHub. A quick summary: On December 4, a malicious version 8.3.41 of the popular AI library ultralytics ­—which has almost 60 million downloads—was published to the Python Package Index (PyPI) package repository. The package contained downloader code that was…

  • Friday Squid Blogging: Biology and Ecology of the Colossal Squid

    Friday Squid Blogging: Biology and Ecology of the Colossal Squid Good survey paper. Blog moderation policy. Bruce Schneier Go to bruce schneier

  • Jailbreaking LLM-Controlled Robots

    Jailbreaking LLM-Controlled Robots Surprising no one, it’s easy to trick an LLM-controlled robot into ignoring its safety instructions. Bruce Schneier Go to bruce schneier

  • Full-Face Masks to Frustrate Identification

    Full-Face Masks to Frustrate Identification This is going to be interesting. It’s a video of someone trying on a variety of printed full-face masks. They won’t fool anyone for long, but will survive casual scrutiny. And they’re cheap and easy to swap. Bruce Schneier Go to bruce schneier

  • Trust Issues in AI

    Trust Issues in AI For a technology that seems startling in its modernity, AI sure has a long history. Google Translate, OpenAI chatbots, and Meta AI image generators are built on decades of advancements in linguistics, signal processing, statistics, and other fields going back to the early days of computing—and, often, on seed funding from…

  • Detecting Pegasus Infections

    Detecting Pegasus Infections This tool seems to do a pretty good job. The company’s Mobile Threat Hunting feature uses a combination of malware signature-based detection, heuristics, and machine learning to look for anomalies in iOS and Android device activity or telltale signs of spyware infection. For paying iVerify customers, the tool regularly checks devices for…

  • Friday Squid Blogging: Safe Quick Undercarriage Immobilization Device

    Friday Squid Blogging: Safe Quick Undercarriage Immobilization Device Fifteen years ago I blogged about a different SQUID. Here’s an update: Fleeing drivers are a common problem for law enforcement. They just won’t stop unless persuaded­—persuaded by bullets, barriers, spikes, or snares. Each option is risky business. Shooting up a fugitive’s car is one possibility. But…

  • AI and the 2024 Elections

    AI and the 2024 Elections It’s been the biggest year for elections in human history: 2024 is a “super-cycle” year in which 3.7 billion eligible voters in 72 countries had the chance to go the polls. These are also the first AI elections, where many feared that deepfakes and artificial intelligence-generated misinformation would overwhelm the…

  • Algorithms Are Coming for Democracy—but It’s Not All Bad

    Algorithms Are Coming for Democracy—but It’s Not All Bad In 2025, AI is poised to change every aspect of democratic politics—but it won’t necessarily be for the worse. India’s prime minister, Narendra Modi, has used AI to translate his speeches for his multilingual electorate in real time, demonstrating how AI can help diverse democracies to…

  • Details about the iOS Inactivity Reboot Feature

    Details about the iOS Inactivity Reboot Feature I recently wrote about the new iOS feature that forces an iPhone to reboot after it’s been inactive for a longish period of time. Here are the technical details, discovered through reverse engineering. The feature triggers after seventy-two hours of inactivity, even it is remains connected to Wi-Fi.…

  • Race Condition Attacks against LLMs

    Race Condition Attacks against LLMs These are two attacks against the system components surrounding LLMs: We propose that LLM Flowbreaking, following jailbreaking and prompt injection, joins as the third on the growing list of LLM attack types. Flowbreaking is less about whether prompt or response guardrails can be bypassed, and more about whether user inputs…

  • Friday Squid Blogging: Squid-Inspired Needle Technology

    Friday Squid Blogging: Squid-Inspired Needle Technology Interesting research: Using jet propulsion inspired by squid, researchers demonstrate a microjet system that delivers medications directly into tissues, matching the effectiveness of traditional needles. Blog moderation policy. Bruce Schneier Go to bruce schneier

  • NSO Group Spies on People on Behalf of Governments

    NSO Group Spies on People on Behalf of Governments The Israeli company NSO Group sells Pegasus spyware to countries around the world (including countries like Saudi Arabia, UAE, India, Mexico, Morocco and Rwanda). We assumed that those countries use the spyware themselves. Now we’ve learned that that’s not true: that NSO Group employees operate the…

  • Security Analysis of the MERGE Voting Protocol

    Security Analysis of the MERGE Voting Protocol Interesting analysis: An Internet Voting System Fatally Flawed in Creative New Ways. Abstract: The recently published “MERGE” protocol is designed to be used in the prototype CAC-vote system. The voting kiosk and protocol transmit votes over the internet and then transmit voter-verifiable paper ballots through the mail. In…

  • What Graykey Can and Can’t Unlock

    What Graykey Can and Can’t Unlock This is from 404 Media: The Graykey, a phone unlocking and forensics tool that is used by law enforcement around the world, is only able to retrieve partial data from all modern iPhones that run iOS 18 or iOS 18.0.1, which are two recently released versions of Apple’s mobile…

  • Secret Service Tracking People’s Locations without Warrant

    Secret Service Tracking People’s Locations without Warrant This feels important: The Secret Service has used a technology called Locate X which uses location data harvested from ordinary apps installed on phones. Because users agreed to an opaque terms of service page, the Secret Service believes it doesn’t need a warrant. Bruce Schneier Go to bruce…

  • The Scale of Geoblocking by Nation

    The Scale of Geoblocking by Nation Interesting analysis: We introduce and explore a little-known threat to digital equality and freedom­websites geoblocking users in response to political risks from sanctions. U.S. policy prioritizes internet freedom and access to information in repressive regimes. Clarifying distinctions between free and paid websites, allowing trunk cables to repressive states, enforcing…

  • Friday Squid Blogging: Transcriptome Analysis of the Indian Squid

    Friday Squid Blogging: Transcriptome Analysis of the Indian Squid Lots of details that are beyond me. Blog moderation policy. Bruce Schneier Go to bruce schneier