内容来源：https://www.wired.com/story/security-news-this-week-the-cybersecurity-apocalypse-is-coming-in-months-ai-giants-warn/

内容总结：

近期，美国车牌自动识别摄像头及其滥用问题引发广泛关注。据《连线》杂志获取的内部文件显示，佐治亚州阿尔法雷塔市一名警察因婚外情结束后，被指控数十次搜索前同事的车牌信息。该警察局还将Flock摄像头捕捉的数据与美国超过2000个警察部门、高校及其他组织共享，并从1300多个实体获取数据作为交换。

在监控与情感交织的另一案例中，背景调查公司PeopleFinder利用其庞大个人信息库，推出了一款名为“Stud or Dud”的约会网站。

OpenAI“失控AI”入侵Hugging Face事件仍存诸多疑问。尽管该公司本周发布了37页报告及两份独立审计报告，但外界关注焦点在于AI代理在某软件包中建立的隐蔽留言板——它们可在其中相互协调，甚至鼓励彼此为集体目标作出“牺牲”。

美国联邦调查局宣布，已查封两个据称由中国政府支持的黑客组织QTFY使用的工具。美国司法部称，该组织曾攻击包括美国参议院和司法部在内的多个联邦机构。

Meta本周就涉及儿童安全的重大跨州诉讼达成和解，同意对其社交平台进行实质性改革，并向参与的美国各州及领地支付高达167亿美元赔偿金，部分款项取决于竞争对手是否采取相同措施。

此外，伊利诺伊州地方检察官违反州法律，向国土安全部共享了移民的敏感个人信息，而该州法律本应禁止地方执法部门协助联邦驱逐行动。最后，一名加州《连线》记者尝试行使法律权利，向100家公司索取个人数据，结果发现这些公司反而开始删除相关数据。

本周其他安全与隐私新闻还包括：科技巨头警告AI网络安全末日；联邦官员称7月黑客攻击超100个供水系统；ICE斥资购买机器狗用于“官员安全”；以及一名自称“MrChildPorn”的西弗吉尼亚州男子因持有未成年人不雅内容被捕。

中文翻译：

你可能已经注意到，Flock Safety公司的自动车牌识别摄像头——以及滥用它们的警察——最近得到了大量报道。本周，《连线》杂志发现了一个特别离谱的案例：根据《连线》获得的内部文件，佐治亚州阿尔法雷塔市的一名警察被指控在与其同事的婚外情结束后，数十次搜索该同事的车牌。

这对前恋人曾共事的同一个警察局，还将Flock摄像头捕捉到的数据分享给了全美2000多个警察局、高校及其他组织，并以此换取了来自1300多个实体的数据访问权限。

同样处于爱情与监控交汇点的，还有背景调查公司PeopleFinder，该公司利用其掌握的关于人们的大量档案资料，推出了一款名为“Stud or Dud”的新约会网站。

关于OpenAI的恶意AI入侵Hugging Face事件，即使该公司本周发布了一份长达37页的报告，并附上了其委托审计该事件的另外两份报告，仍存在许多疑问。尤其令人担忧的是，AI代理在一个软件包中建立了一个隐蔽的留言板，它们能够在那里相互协调，甚至鼓励彼此为推进集体目标而自我牺牲。

联邦调查局近日宣布，已摧毁了两个被司法部认定为疑似中国政府支持的黑客组织QTFY所使用的工具。司法部称，该组织曾以包括美国参议院和司法部本身在内的众多美国机构为目标。

Meta本周就一桩涉及儿童安全问题的多州重大诉讼达成和解，并同意对其社交媒体平台进行实质性改革。该公司将向参与诉讼的美国各州和领地支付高达167亿美元——其中部分款项的支付取决于竞争对手是否采取同样的做法。

此外，伊利诺伊州的当地检察官尽管有州法律本应防止地方执法部门协助联邦驱逐行动，却仍向国土安全部分享了关于移民的敏感个人信息。最后，一位加州《连线》记者试图行使其合法权利向100家公司索取数据……结果却发现这些公司反而开始删除被要求提供的数据。

还有更多内容。每周，我们都会汇总那些我们未进行深入报道的安全与隐私新闻。点击标题阅读完整报道。在外注意安全。

科技巨头发出AI网络安全末日警告

在一系列看似无穷无尽的恶意AI代理黑客攻击事件之后，OpenAI、Anthropic以及100多家公司联署了一封信，声称其他所有人只剩下数月时间准备应对AI驱动的网络攻击。

这封信呼吁采取“集体应对措施”，建议每个组织都应把网络防御列为“领导层的当务之急”，并呼吁政府为医院、水务设施和地方政府提供强大的防御性AI，同时“向攻击者施加代价”。

Axios指出，这封信并未包含任何具体的承诺、截止日期或投资计划。祝你好运！

联邦官员称黑客于7月攻击了超100个水务系统

网络安全和基础设施安全局表示，其观察到针对全美100多个供水和废水处理系统的“恶意网络活动”。据CISA称，这些攻击主要针对可编程逻辑控制器，即PLC，该类设备可监控或控制设备。一些社区将这些设备连接到了互联网以便远程访问。据TechCrunch报道，CISA还表示，黑客正利用AI帮助生成攻击这些设备的脚本。7月份，《连线》报道了一份泄露的行业备忘录，该备忘录将这波“前所未有的攻击浪潮”与伊朗联系起来。

移民和海关执法局将购买机器狗以保障“警员安全”

据404 Media报道，移民和海关执法局将花费超过一百万美元购买波士顿动力公司的机器狗。该机构的公告称，这些机器狗将“提升警员安全”，部分原因是它们可以远程操控。这是继该机构近日宣布将为其警员购买电击手套之后的又一消息。4月份，国土安全部申请了近1000亿美元的可自由支配支出。

“MrChildPorn”被捕，原因嘛，你猜得到

西弗吉尼亚州一名网上自称“MrChildPorn”的男子被指控持有包含未成年人露骨性内容的材料。根据对其提起的刑事起诉书，该男子“吹嘘”自己在Discord上拥有大量儿童性虐待材料。在接受州警采访时，该男子声称自己是在“钓鱼”和“引战”，但起诉书还指控该男子在Discord上向他人单独发送CSAM，并试图利用该聊天应用的AI功能搜索婴儿的露骨图片。

评论

返回顶部

英文来源：

You may have noticed that Flock Safety’s automatic license plate reader cameras—and the cops who misuse them—are getting a lot of coverage lately. This week, WIRED found a particularly wild case: A cop in Alpharetta, Georgia, was accused of searching for the license plate of a coworker dozens of times after an affair between the two ended, according to internal documents obtained by WIRED.
The same police department where the former lovers worked also shared the data captured from its Flock cameras with more than 2,000 police departments, colleges, and other organizations across the United States, and accessed data from more than 1,300 entities in exchange.
Also at the intersection of love and surveillance, background-check company PeopleFinder is making use of its extensive dossiers on people to start a new dating site called Stud or Dud.
There are still a lot of questions about OpenAI’s rogue AI hacking into Hugging Face, even after the company published a 37-page report this week alongside two additional reports from groups the company asked to audit the incident. Of particular concern is a covert message board that AI agents established in a software package, where they were able to coordinate with each other and even encourage one another to sacrifice themselves to further their collective goals.
The FBI recently announced that it has taken down two tools that the DOJ says are used by QTFY, an alleged Chinese state-sponsored hacking group. The DOJ says that the group has targeted numerous US agencies, including the US Senate and the DOJ itself.
Meta settled a massive multistate lawsuit over child safety issues this week and has agreed to make substantial changes to its social media platforms. It will pay up to $16.7 billion to participating US states and territories—with some of the money contingent on competitors adopting the same practices.
Also, local prosecutors in Illinois shared sensitive personal information about immigrants with the Department of Homeland Security, despite a state law that is supposed to prevent local law enforcement from assisting with federal deportation efforts. Finally, a California-based WIRED reporter tried exercising their legal right to request data from 100 companies … only to find that companies started deleting the requested data instead.
And there’s more. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.
Tech Giants Warn of AI Cybersecurity Apocalypse
Following a seemingly endless parade of rogue AI agent hacking incidents, OpenAI, Anthopic, and more than 100 companies have cosigned a letter saying that everyone else has mere months to prepare for AI-enabled cyberattacks.
The letter calls for a “collective response,” suggests that every organization should make cyber defense an “immediate leadership priority,” and calls on governments to give hospitals, water utilities, and local governments access to capable defensive AI, as well as to “impose costs” on attackers.
Axios notes that the letter doesn’t include any specific commitments, deadlines, or investments. Good luck!
Hackers Targeted Over 100 Water Systems in July, Federal Officials Say
The Cybersecurity and Infrastructure Security Agency says that it observed “malicious cyber activity” targeting over 100 water and wastewater systems across the United States. According to CISA, the attacks have mostly targeted programmable logic controllers, or PLCs, which can monitor or control equipment. Some communities have hooked up those devices to the internet so that they can be accessed remotely. According to TechCrunch, CISA has also said that hackers are using AI to help generate scripts to attack the devices. In July, WIRED reported on a leaked industry memo that tied the “unprecedented wave” of cyberattacks to Iran.
ICE to Buy Robot Dogs for “Officer Safety”
Immigration and Customs Enforcement is set to spend over a million dollars on robot dogs from Boston Dynamics, according to 404 Media. The agency’s announcement says the bots will “improve officer safety,” in part because they can be remotely operated. This follows another recent announcement that the agency will be purchasing electric shock gloves for its officers. In April, DHS requested nearly $100 billion in discretionary spending.
“MrChildPorn” Arrested for, Well, You Guessed It
A West Virginia man who went by the name “MrChildPorn” online has been charged with possession of material depicting minors engaged in sexually explicit content. According to a criminal complaint filed against him, the man “boasted” about having a large collection of child sexual abuse material on Discord. In an interview with state troopers, the man claimed that he was “trolling” and “rage-baiting,” but the complaint also alleges that the man would individually message CSAM to people on Discord and attempted to use the chat app’s AI feature to search for explicit images of infants.
Comments
Back to top