RISKS Forum mailing list archives
(no subject)
From: RISKS List Owner <risko () csl sri com>
Date: Sat, 3 Jan 2026 15:13:35 PST
Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit precedence: bulk Subject: Risks Digest 34.82 RISKS-LIST: Risks-Forum Digest Saturday 3 January 2026 Volume 34 : Issue 82 ACM FORUM ON RISKS TO THE PUBLIC IN COMPUTERS AND RELATED SYSTEMS (comp.risks) Peter G. Neumann, founder and still modera!> ***** See last item for further information, disclaimers, caveats, etc. ***** This issue is archived at <http://www.risks.org> as <http://catless.ncl.ac.uk/Risks/34.82> The current issue can also be found at <http://www.csl.sri.com/users/risko/risks.txt> Contents: [After a month off, I am BACK. Best wishes for 2026, PGN] Eurostar Trains Face Day of Delays After Power Failure (Jenny Gross) Autonomous cars are the wet dream of fascist billionaires: What if a child had been trapped under that car, not a cat? (Lauren Weinstein) Waymo's Self-Driving Cars Behaving Like NY Cabbies (Katherine Bindley) Woman Discovers Man Inside The Trunk Of Her LA Waymo Ride (Patch) Massive San Francisco power failure caused Waymo robotaxis to freeze in intersections, potentially blocking emergency vehicles, due to lack of traffic lights (Lauren Weinstein) Waymo temporarily suspends service in SF amid power outage (SFGate) A small plane crashed when a 3D-printed part bought at an air show melted (BBC) A Significant Number of Airbus Planes Require Software Fix Before They Can Fly (WSJ) Airbus: Flights resume as normal after software update warning (BBC) Chinese-Linked Hackers Use Back Door for Potential 'Sabotage,' U.S. and Canada Say (A.J. Vicens) Chinese-Made Buses in Norway Can be Halted Remotely (AP) AI Hackers Are Coming Dangerously Close to Beating Humans (WSJ) OpenAI says AI browsers may always be vulnerable to prompt injection attacks (TechCrunch) Cond-Nast gets hacked and get played (DataBreaches) These Scam Centers Were Blown Up. Was It All for Show? (NYTimes) ShakeAlert sends false alarm about magnitude 5.9 earthquake in California, Nevada (LA Times) Got an earthquake alert (Dan Jacobson) YouTube's algorithm is on an AI slop and brainrot-only diet (knowtechie) AI Slop on YouTube (Lauren Weinstein) Co-Creator of Go Language is Rightly Furious Over This Appreciation Email (Itsfoss) When AI Took My Job, I Bought a Chain Saw (NYTimes via Matthew Kruk) Coffee shops, retail stores, even hotels are ditching humans to serve you better (NationalPost) Monster of 2025 -- Endless Subscriptions (Mother Jones) Social media taught Hamas how to disable Israeli tanks (Ed Ravin) Modern cars as a source of surveillance data (Ed Ravin) Abridged info on RISKS (comp.risks) ---------------------------------------------------------------------- Date: Wed, 31 Dec 2025 13:13:18 PST From: Peter Neumann <neumann () csl sri com> Subject: Eurostar Trains Face Day of Delays After Power Failure (Jenny Gross) Jenny Gross, *The New York Times*, 31 Dec 2025 A major power failure shut down the Chunnel between England and France yesterday, delaying thousands of would-be travelers. [PGN-ed] ------------------------------ Date: Fri, 5 Dec 2025 07:36:47 -0800 From: Lauren Weinstein <lauren () vortex com> Subject: Autonomous cars are the wet dream of fascist billionaires] What if a child had been trapped under that car, not a cat? New video shows Google's Waymo Murder Car driving off even as people actively tried to coax cat out from underneath. There's no way to contact Google from OUTSIDE the car without using a damned app on a phone! People were scared to stand in front and behind the car, though that was probably a safe approach to immobilize it. I can't emphasize enough what a horrific trap autonomous vehicles are. They do not have common sense. They can be controlled under orders of fascist governments and police officials -- both to NOT go somewhere and to go somewhere the rider didn't choose. They could be used to deliver hazardous materials to a location. They are the mobile manifestation of AI slop and fascist-supporting billionaires. We already know that Google's CEO is in bed with Trump and would ultimately do anything he was told to do by this fascist government. USE YOUR HEADS PEOPLE! IT'S A DIFFERENT WORLD NOW. BIG TECH CANNOT BE TRUSTED WITH A FASCIST GOVERNMENT IN CONTROL! https://www.nytimes.com/2025/12/05/us/waymo-kit-kat-san-francisco.html ------------------------------ Date: Wed, 3 Dec 2025 11:10:50 -0500 (EST) From: ACM TechNews <technews-editor () acm org> Subject: Waymo's Self-Driving Cars Behaving Like NY Cabbies (Katherine Bindley) Katherine Bindley. The Wall Street Journal (12/02/25) Waymo's self-driving cars in San Francisco are driving more aggressively, surprising residents who long viewed them as overly cautious. Witnesses report the vehicles making risky maneuvers--zigzag lane changes, rolling stops, tight passes, and even an illegal U-turn that led police to pull one over. The shift stems from software updates designed to make Waymos "confidently assertive" so they can navigate dense city traffic without disrupting flow. ------------------------------ Date: Thu, 11 Dec 2025 18:56:28 -0800 From: Steve Bacher <sebmb1 () verizon net> Subject: Woman Discovers Man Inside The Trunk Of Her LA Waymo Ride (Patch) The incident was startling but not a crime, according to police. https://patch.com/california/los-angeles/viral-video-shows-man-being-discovered-waymo-trunk<https://patch.com/california/los-angeles/viral-video-shows-man-being-discovered-waymo-trunk> ------------------------------ Date: Sun, 21 Dec 2025 13:28:42 PST From: Lauren Weinstein <lauren () vortex com> Subject: Massive San Francisco power failure caused Waymo robotaxis to freeze in intersections, potentially blocking emergency vehicles, due to lack of traffic lights [... and over a week later, this item: PG&E (Dahlia Michaels, The San Francisco Chronicle, 30 Dec 2025) After one week, various areas of the city remained dark. PGN-ed article, Not a happy one for those affected. PGN ------------------------------ Date: Sun, 21 Dec 2025 15:20:21 -0700 From: geoff goodfellow <geoff () iconia com> Subject: Waymo temporarily suspends service in SF amid power outage (SFGate) *A Waymo driverless car is not able to detect traffic lights after a major power outage in San Francisco, California, United States on December 20, 2025.* Waymo halted service in San Francisco as of Saturday at 8 p.m., following a power outage that left approximately 30% of the city without power. The autonomous cars have been causing traffic jams throughout the city, as the vehicles seem unable to function without traffic signals. ``We have temporarily suspended our ride-hailing services given the broad power outage in San Francisco,=E2=80=9D Suzanne Philion, a Waymo spokesperson told SFGATE via email Saturday night. =E2=80=9CWe are focused on keeping our riders safe and ensuring emergency personnel have the clear access they need to do their work.'' Pedestrians posted videos on X Saturday of Waymo cars stuck at intersections with their lights flashing. [...] https://www.sfgate.com/bayarea/article/waymo-temporarily-suspends-service-sf-amid-power-21254917.php https://sfstandard.com/2025/12/20/what-we-know-about-saturdays-sf-power-outage/ ------------------------------ Date: Fri, 5 Dec 2025 14:36:06 +0000 From: "Wendy M. Grossman" <wendyg () pelicancrossing net> Subject: A small plane crashed when a 3D-printed part bought at an air show melted (BBC) https://www.bbc.co.uk/news/articles/c1w932vqye0o ------------------------------ Date: Fri, 28 Nov 2025 19:50:29 -0700 From: geoff goodfellow <geoff () iconia com> Subject: A Significant Number of Airbus Planes Require Software Fix Before They Can Fly *Some planes could be temporarily grounded after the airplane maker said solar radiation may corrupt data critical to flight controls* Air travel around the world is facing potential disruptions this weekend after Airbus said a significant number of the European plane maker's jets require fixes before they are able to carry passengers again. European regulators on Friday mandated the fixes after a solar-radiation event disrupted cockpit systems on an Airbus jet operated by JetBlue Airways in October. Under regulators' emergency order, jets could be temporarily grounded if airlines don't make certain software or hardware updates by late Saturday. The European Union Aviation Safety Agency's order Friday came after Airbus said that its A320 family of planes needed to be inspected and have software and hardware fixes completed. The U.S. Federal Aviation Administration is expected to issue a related emergency order, according to government and industry officials. Airbus said about 6,000 of the planes in its A320 family are affected, or roughly half the fleet. [...] https://www.wsj.com/business/airlines/airbus-grounds-significant-number-of-a320-planes-8d3d4d09?st=7xEZZc [Gabe Goldberg noted an item The NY Times: https://www.nytimes.com/2025/11/28/business/airbus-software-a320-jets.html?smid=nytcore-ios-share PGN] ------------------------------ Date: Sat, 29 Nov 2025 06:43:30 -0800 From: Steve Bacher <sebmb1 () verizon net> Subject: Airbus: Flights resume as normal after software update warning Thousands of Airbus planes are being returned to normal service after being grounded for hours due to a warning that solar radiation could interfere with onboard flight control computers. The aerospace giant -- based in France -- said around 6,000 of its A320 planes had been affected with most requiring a quick software update. Some 900 older planes need a replacement computer. [...] The firm identified a problem with the aircraft's computing software which calculates a plane's elevation, and found that at high altitudes, data could be corrupted by intense radiation released periodically by the Sun. As well as the A320, the company's best-selling aircraft, the A318, A319 and the A321 models were also impacted. While approximately 5,100 of the planes could see their issues resolved with the simple software update, for around 900 older planes, a replacement computer would be needed. [...] https://www.bbc.com/news/articles/c4gp9d28p74o ------------------------------ Date: Mon, 8 Dec 2025 15:36:47 PST From: ACM TechNews <technews-editor () acm org>: ACM TechNews, 8 Dec 2025 Subject: Chinese-Linked Hackers Use Back Door for Potential 'Sabotage,' U.S. and Canada Say (A.J. Vicens) A.J. Vicens, Reuters (12/04/25) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the Canadian Centre for Cyber Security issued an advisory and a detailed malware analysis report on Dec. 4 indicating that hackers with ties to the Chinese government have targeted unnamed government and IT entities using the sophisticated "Brickstorm" malware. The malware enables hackers to penetrate an organization's network, steal login credentials and other sensitive data, and even take full control of targeted devices. ------------------------------ Date: Fri, 7 Nov 2025 11:20:15 -0500 (EST) From: ACM TechNews <technews-editor () acm org> Subject: Chinese-Made Buses in Norway Can be Halted Remotely (AP) Associated Press (11/05/25), via ACM TechNews Norwegian transport operator Ruter is tightening security after tests showed Chinese-made Yutong electric buses can be remotely accessed for software updates and diagnostics, theoretically allowing them to be stopped. Ruter said manufacturers can access battery and power controls via mobile networks. The company plans stricter procurement rules, local firewalls, and cybersecurity measures to monitor updates before they reach buses. Yutong said its data, stored in Germany, is encrypted and used only for maintenance and optimization purposes. ------------------------------ MICRO Microsoft Quietly Shuts Down Windows Shortcut Flaw After Years of Espionage Abuse (Carly Page) Carly Page, The Register (12/04/25) Microsoft recently patched a critical Windows shortcut file flaw that Trend Micro researchers said has been exploited by 11 state-sponsored hacking groups, including those from North Korea, Iran, Russia, and China, since 2017. The vulnerability enabled malicious .lnk shortcut files to conceal nefarious payloads by padding harmful command-line arguments with whitespace or other non-printing characters. With the fix, the full command is now displayed in Windows' "Properties" dialog. ------------------------------ Date: Sun, 28 Dec 2025 13:12:54 -0700 From: geoff goodfellow <geoff () iconia com> Subject: AI Hackers Are Coming Dangerously Close to Beating Humans (WSJ) A recent Stanford experiment shows what happens when an artificial-intelligence hacking bot is unleashed on a network. - Stanford University's AI bot, Artemis, outperformed nine out of ten human penetration testers in finding network vulnerabilities. - Artemis operated at a cost of under $60 per hour, significantly cheaper than human testers who charge between $2,000 and $2,500 per day. - Despite its effectiveness, Artemis produced approximately 18% false positive bug reports and missed an obvious bug spotted by human testers. [...] https://www.wsj.com/tech/ai/ai-hackers-are-coming-dangerously-close-to-beating-humans-4afc3ad6 ------------------------------ Date: Mon, 22 Dec 2025 17:56:38 -0800 From: Lauren Weinstein <lauren () vortex com> Subject: OpenAI says AI browsers may always be vulnerable to prompt injection attacks (TechCrunch) https://techcrunch.com/2025/12/22/openai-says-ai-browsers-may-always-be-vulnerable-to-prompt-injection-attacks/ ------------------------------ Date: Sun, 28 Dec 2025 01:45:25 -0500 From: Gabe Goldberg <gabe () gabegold com> Subject: Cond-Nast gets hacked and get played (DataBreaches) https://databreaches.net/2025/12/25/conde-nast-gets-hacked-and-databreaches-gets-played-christmas-lump-of-coal-edition/ ------------------------------ Date: Fri, 28 Nov 2025 18:22:37 -0500 From: Monty Solomon <monty () roscom com> Subject: These Scam Centers Were Blown Up. Was It All for Show? Myanmarâs junta made a grand display of demolishing buildings that hosted the centers, even broadcasting the explosions. But the scammers have found new homes. https://www.nytimes.com/2025/11/28/world/asia/myanmar-scam-centers-junta.html ------------------------------ Date: Thu, 4 Dec 2025 09:53:58 -0800 From: Steve Bacher <sebmb1 () verizon net> Subject: ShakeAlert sends false alarm about magnitude 5.9 earthquake in California, Nevada (Los Angeles Times) The ShakeAlert computer system that warns about the imminent arrival of shaking from earthquakes sent out a false alarm Thursday morning for a magnitude 5.9 temblor in Carson City, Nev., that did not actually happen. The ShakeAlert blared on both the MyShake app and the Wireless Emergency Alert system â similar to an Amber Alert â on phones across the region, including in the San Francisco Bay Area, the Sacramento area, and in eastern California, just after 8 a.m. It wasn't immediately clear why the ShakeAlert system was activated, or how many phones got the incorrect alerts. The earthquake report was later deleted from the MyShake app â which carries earthquake early warnings from the U.S. Geological Surveyâs ShakeAlert system â and from the USGS earthquake website. âWe did not detect any earthquakes,â said Paul Caruso, a USGS geophysicist, Thursday morning. The ShakeAlert system has previously proved effective in giving seconds of warning ahead of significant earthquakes, including from a magnitude 5.2 earthquake in San Diego County in April; earthquakes in El Sereno and the Malibu area last year; and a temblor east of San José in 2022. âWeâre in the process of figuring out what happened,â said Robert de Groot, an operations team leader for the U.S. Geological Surveyâs ShakeAlert system. There have been other times when earthquake early warnings have misfired. In 2023, a scheduled drill of the MyShake app at 10:19 a.m. rang instead at 3:19 a.m., which occurred because the warning was inadvertently scheduled for 10:19 a.m. Greenwich Mean Time, instead of Pacific time. And in 2021, phone users across Northern California got a warning of a magnitude 6 earthquake in Truckee, near Lake Tahoe; but the quake that actually occurred was a far more modest magnitude 4.7. Scientists said the significant overestimation of the quakeâs magnitude was in part caused by it being on the edge of the ShakeAlert seismic network sensors, and that researchers worked on reprogramming the computer system to avoid a similar issue in the future. https://www.latimes.com/california/story/2025-12-04/no-earthquake-felt-after-shakealert-issues-alert-for-magnitude ------------------------------ Date: Wed, 24 Dec 2025 17:52:05 +0800 From: Dan Jacobson <jidanni () jidanni org> Subject: Got an earthquake alert I got one of those government earthquake alerts. The phone was beeping so loud I had to push the okay button, upon which the message disappeared, so I wasn't able to read whatever it said. ------------------------------ Date: Tue, 30 Dec 2025 10:42:40 -0700 From: Matthew Kruk <mkrukg () gmail com> Subject: YouTube's algorithm is on an AI slop and brainrot-only diet (knowtechie) https://knowtechie.com/ai-slop-youtube-algorithm/ AI videos are cheap, fast, endlessly scalable, and perfectly tuned to trigger curiosity. For new users, the algorithm has no history to guide it, so it defaults to whatever keeps eyeballs glued to the screen. That's a problem, especially when researchers at Amazon Web Services estimate that 57% of the Internet may already be AI sludge. ------------------------------ Date: Fri, 5 Dec 2025 22:12:07 -0800 From: Lauren Weinstein <lauren () vortex com> Subject: AI Slop on YouTube Just stumbled into an example of #YouTube AI Slop generation in progress. Happened onto a recent (posted within the last week) video purporting to tell of a notorious "deleted scene" from the classic film "Forbidden Planet" (1956). It was obviously AI generated with the typical AI still image manipulations and voice, and never actually showed the scene. However, over the next hour YouTube offered me what seems like dozens of variations of this same video, shorts and non-shorts, all with nearly identical narration, none actually showing the scene, and with posting dates as recent as an hour ago -- many without any views. These still seem to be churning out as I type this -- all on ostensibly different channels containing similar content. Multiply this by all the possible ways this sort of AI Slop could be generated in relation to the vast array of possible content sources, and you see how #YouTube is rapidly become a deep pit of garbage. There is still lots of wonderful stuff on there -- it's still my favorite streaming service by far -- but AI Slop is making finding the worthwhile content ever more difficult. AND GOOGLE DOESN'T CARE OF COURSE -- 'cause an ad is an ad and a click is a click. -L ------------------------------ Date: Sun, 28 Dec 2025 16:34:54 -0500 From: Gabe Goldberg <gabe () gabegold com> Subject: Co-Creator of Go Language is Rightly Furious Over This Appreciation Email (Itsfoss) Imagine someone sends a thank-you email and the recipient gets so outraged that he starts using expletives. That would be inappropriate and utterly rude, right? Yeah..but not always. On the contrary, it may feel satisfying to a level, especially when it is AI-slop. https://itsfoss.com/news/rob-pike-furious/ [Lauren Weinstein commented on this item: Rob Pike goes ballistic over AI-generated email thanking him for his work -- and he's absolutely correct! [Kudos to Rob! Well done. PGN] ------------------------------ Date: Sun, 28 Dec 2025 21:57:50 -0700 From: Matthew Kruk <mkrukg () gmail com> Subject: When AI Took My Job, I Bought a Chain Saw (The New York Times) https://www.nytimes.com/2025/12/28/opinion/artificial-intelligence-jobs.html Some of the best career advice I've received didn't come from a mentor -- or even a human. I told a chatbot that AI was swallowing more and more of my work as a copywriter and that I needed a way to survive. The bot paused, processing my situation, and then suggested I buy a chain saw. This advice would have seemed absurd back when I lived in Washington, D.C., in a dense neighborhood of rowhouses. But for the past 25 years, I've lived in Lawrenceburg, Ind., a small working-class town where my grandparents once ran a bakery. [Don't forget that really old stale bread might be sliced with a chain saw -- although it is not recommended. But AI software may not easy to demolish. It does not want to go away. PGN] ------------------------------ Date: Fri, 2 Jan 2026 15:51:57 -0700 From: Matthew Kruk <mkrukg () gmail com> Subject: Coffee shops, retail stores, even hotels are ditching humans to serve you better (NationalPost) https://nationalpost.com/news/canada/robots-service-coffee-shops-retail-hotels Vandhana Mohanraj and her partner Faisal Fakhani had just finished their regular grocery run when the couple decided to stop for coffee. At the storefront for the fledgling Caffeo shop in downtown Toronto, Mohanraj punched in her choice -- a vanilla latte -- and tapped her card on the payment pad. Then the cafe barista went to work. Behind the plate-glass window, an all-arms robot filled the metal filter basket with fresh grounds, inserted it into an espresso machine, then topped the resulting coffee with steamed milk. Mohanraj sipped her first android-prepared brew and smiled. Fakhani took a swig and agreed with Mohanraj's assessment -- surprisingly good. ------------------------------ Date: Thu, 25 Dec 2025 22:29:07 -0500 From: Gabe Goldberg <gabe () gabegold com> Subject: Monster of 2025 -- Endless Subscriptions (Mother Jones) Weâre being $5.99 per month-ed to death. The Hatch Restore alarm clock, which retails for $169, can light up your bedroom in every hue, soothe you to sleep with audio meditation sessions, and keep you in a REM cycle with a full catalogue of white noise options. To utilize these features, though, you need to pay an additional $4.99 per month, in perpetuity. Welcome to the age of subscription captivity, where an increasing share of the things you pay for actually own you. https://www.motherjones.com/politics/2025/12/monster-of-2025-endless-subscriptions/ ------------------------------ Date: Thu, 4 Dec 2025 09:26:51 -0500 From: Ed Ravin <eravin () panix com> Subject: Social media taught Hamas how to disable Israeli tanks Israel's Army Radio reports that Hamas spent years collecting intelligence on Israel's military operations and equipment by monitoring Israeli soldiers' social media activity: [...] According to the report, Hamas learned about a hidden kill switch on the tank that disables the vehicle and renders it useless, which they utilized during their attacks on IDF bases along the Gaza border on October 7 [...] Hamas also had "maps, intelligence reports, virtual reality simulations and full-scale models of military equipment." Full story at: https://www.timesofisrael.com/hamas-spent-years-mining-idf-troops-social-media-for-intel-on-bases-tanks-report/ Social media posts by soldiers have been a problem for years in the Israeli military. Simply ordering soldiers to stay off social media does not seem to be in the playbook, so instead they are turning to AI, which as we know, solves all problems: https://www.timesofisrael.com/liveblog_entry/idf-to-employ-ai-tool-to-clamp-down-on-soldiers-social-media-posts/ ------------------------------ Date: Thu, 4 Dec 2025 09:39:55 -0500 From: Ed Ravin <eravin () panix com> Subject: Modern cars as a source of surveillance data Someone in the Israeli military apparently just realized how dangerous it is to use computer-based cars chock-full of sensors with live online Internet connections for all the top brass: [...] For China, data-rich technologies are strategic assets, not just commercial goods. âThe legislation in China, by various laws, instructs and obliges Chinese companies to share with the state whatever data is available to them,â Orion said. Thatâs why, he argued, Israel should consider recalling âevery electrical vehicle, which is actually a multi-sensor computerized platform, that links back [to China].â Full story at: https://www.timesofisrael.com/idf-swerves-away-from-chinese-cars-driven-by-worries-of-spies-lurking-in-everyday-tech/ ------------------------------ Date: Sat, 28 Oct 2023 11:11:11 -0800 From: RISKS-request () csl sri com Subject: Abridged info on RISKS (comp.risks) The ACM RISKS Forum is a MODERATED digest. Its Usenet manifestation is comp.risks, the feed for which is donated by panix.com as of June 2011. => SUBSCRIPTIONS: The mailman Web interface can be used directly to subscribe and unsubscribe: http://mls.csl.sri.com/mailman/listinfo/risks => SUBMISSIONS: to risks () CSL sri com with meaningful SUBJECT: line that includes the string `notsp'. Otherwise your message may not be read. *** This attention-string has never changed, but might if spammers use it. => SPAM challenge-responses will not be honored. Instead, use an alternative address from which you never send mail where the address becomes public! => The complete INFO file (submissions, default disclaimers, archive sites, copyright policy, etc.) has moved to the ftp.sri.com site: <risksinfo.html>. *** Contributors are assumed to have read the full info file for guidelines! => OFFICIAL ARCHIVES: http://www.risks.org takes you to Lindsay Marshall's delightfully searchable html archive at newcastle: http://catless.ncl.ac.uk/Risks/VL.IS --> VoLume, ISsue. Also, ftp://ftp.sri.com/risks for the current volume/previous directories or ftp://ftp.sri.com/VL/risks-VL.IS for previous VoLume If none of those work for you, the most recent issue is always at http://www.csl.sri.com/users/risko/risks.txt, and index at /risks-34.00 ALTERNATIVE ARCHIVES: http://seclists.org/risks/ (only since mid-2001) *** NOTE: If a cited URL fails, we do not try to update them. Try browsing on the keywords in the subject line or cited article leads. Apologies for what Office365 and SafeLinks may have done to URLs. ==> Special Offer to Join ACM for readers of the ACM RISKS Forum: <http://www.acm.org/joinacm1> ------------------------------ End of RISKS-FORUM Digest 34.82 ************************
Current thread:
- (no subject) RISKS List Owner (Jan 03)