The people's AI?
· Summarized
Key takeaways
- Legal protections for digital privacy are strengthening, as evidenced by the Supreme Court’s decision that location data shared with companies like Google is subject to Fourth Amendment search requirements.
- Law enforcement practices involving geofence warrants are being scrutinized and may require more specific, probable-cause-based warrants, impacting how digital data is accessed.
- Cybercriminals continue to exploit vulnerabilities with sophisticated techniques, including autonomous AI-driven ransomware attacks and stealthy malware frameworks, highlighting the evolving threat landscape.
- Companies and consumers should remain vigilant about privacy vulnerabilities, such as issues with Apple’s 'Hide My Email' feature.
- The tech industry faces skepticism about ambitious claims, illustrated by Microsoft’s controversial quantum computing announcements—highlighting the importance of independent verification.
Summary
OpenAI's Proposed Equity Plan with the US Government
OpenAI is reportedly considering a plan to give the Trump administration a 5% stake in the company, a move that could set a precedent with other US AI companies offering similar shares to the government. The goal, as expressed by CEO Sam Altman, is to allow the public to benefit financially from AI developments as technology reshapes the economy. This is happening amidst increasing US government oversight of AI and openness to industry partnerships, and would likely require congressional approval.
Cybersecurity Threats and Exploits
Cisco has confirmed it is actively seeing exploitation of a recently patched vulnerability in its unified communications manager (Unified CM) platform, which manages IP telephony systems. The flaw, a server-side request forgery, can be exploited remotely without authentication. Meanwhile, researchers have uncovered the first documented autonomous ransomware attack, Jade Puffer, where an AI agent exploited vulnerabilities to gain access, harvest credentials, and encrypt data, indicating a potential future where AI speeds up cyber attacks. The Vect ransomware operation partnered with Team PCP to improve credential theft and malware deployment, creating a pipeline for supply chain attacks. The FortiBleed campaign, linked to ransomware groups, has stolen over 110 million credentials from Fortigate firewalls and is involved in ransomware deployment. Veil#Drop malware framework uses sophisticated, stealthy techniques to deploy credential-stealing malware. Scammers have targeted small businesses with fake law enforcement emails to deliver ransomware, exploiting fear and social engineering. Additionally, a vulnerability in Apple’s 'Hide My Email' feature was disclosed that could reveal users’ real addresses, raising privacy concerns.
Legal and International Cybercrime Developments
An individual affiliated with the cybercrime group scattered Spider has been extradited from Finland to the US, facing charges related to over 100 intrusions generating $100 million in ransom payments. This exemplifies ongoing international cooperation against cybercriminal networks.
Expert Discussion on Geofence Warrants and Privacy Law
Ben Yellen from the University of Maryland and co-host of the Caveat podcast discusses the Supreme Court ruling on geofence warrants. The case involved law enforcement obtaining location data from Google to identify a suspect. The Supreme Court ruled this involved a Fourth Amendment search, affirming the expectation of privacy even when sharing data with third parties like Google. The decision emphasizes that location data is deeply revealing and warrants constitutional protections, potentially influencing future privacy and law enforcement practices. Google's existing policy changed following this ruling, possibly deterring future broad data sharing.
Microsoft’s Quantum Computing Claims and Scientific Skepticism
Microsoft announced a new Majorana-based quantum processor claiming to be vastly more reliable. Critics, however, question the validity of the research, citing retracted papers and lack of public data, leading to skepticism about whether the breakthrough is genuine or overhyped. The debate underscores the difficulty in verifying claims in cutting-edge quantum science.
Sponsors
- Black Hat USA · The episode is supported by Black Hat USA. It features hundreds of peer-reviewed briefings, over a hundred hands-on trainings, and the largest business hall in Black Hat history. The event runs from August 1st to 6th in Vegas, with a special offer: use code CyberWire for $200 off your briefings pass at blackhat.com.
Show notes
OpenAI considers an equity plan to share AI wealth with the public. Cisco confirms active exploitation of its unified CM platform. Researchers discover autonomous ransomware. The Vect ransomware operation partners with TeamPCP. The FortiBleed credential-harvesting campaign is linked to ransomware attacks. Veil#Drop stealthily deploys the PureLog Stealer. Scammers target small businesses with fake law enforcement emails. Apple’s Hide My Email feature…doesn’t. An alleged Scattered Spider member is extradited to the United States. Our guest is Ben Yelin, Dave's Caveat cohost, on the Supreme Court’s geofence warrants ruling. Microsoft’s quantum claims leave physicists in two states at once.
Remember to leave us a 5-star rating and review in your favorite podcast app.
Miss an episode? Sign-up for our daily intelligence roundup, Daily Briefing, and you’ll never miss a beat. And be sure to follow CyberWire Daily on LinkedIn.
CyberWire Guest
Today we are joined by Ben Yelin from University of Maryland Center for Cyber Health and Hazard Strategies discussing the Supreme Court ruling on geofence warrants. If you enjoyed this conversation, you can check out Ben on Caveat.
Selected Reading
OpenAI in talks to give Trump administration a 5% stake in the company, FT reports (CNN Business)
Cisco finally confirms attackers exploiting Unified CM flaw (Bleeping Computer)
Sysdig Details JADEPUFFER, the First Documented Agentic Ransomware Operation (HackRead)
Vect and TeamPCP partner for ransomware campaigns (Sophos)
FortiBleed Campaign Linked to INC, Lynx Ransomware Attacks (SecurityWeek)
VEIL#DROP: Blogspot-Hosted PowerShell Loader (Secureonix)
Fake Interpol investigation emails target small businesses with ransomware (Bitdefender)
Apple ‘Hide My Email’ Vulnerability Reveals Peoples’ Real Email Addresses (404 Media)
Alleged Member of Criminal Cyber Hacking Group “Scattered Spider” Arrested in Finland and Extradited to the United States (U.S. Department of Justice, Office of Public Affairs)
Is there a new quantum processor or is Microsoft lying? (Mathew Ingram)
Share your feedback.
What do you think about CyberWire Daily? Please take a few minutes to share your thoughts with us by completing our brief listener survey. Thank you for helping us continue to improve our show.
Want to hear your company in the show?
N2K CyberWire helps you reach the industry’s most influential leaders and operators, while building visibility, authority, and connectivity across the cybersecurity community. Learn more at sponsor.thecyberwire.com.
The CyberWire is a production of N2K Networks, your source for strategic workforce intelligence. © N2K Networks, Inc.
Learn more about your ad choices. Visit megaphone.fm/adchoices
Follow this show on AudioBrevity and new episodes get summarized for you. Create a free account