An anonymous reader quotes a report from Ars Technica: Intel on Tuesday pushed microcode updates to fix a high-severity CPU bug that has the potential to be maliciously exploited against cloud-based hosts. The flaw, affecting virtually all modern Intel CPUs, causes them to “enter a glitch state where the normal rules don’t apply,” Tavis Ormandy, one of several security researchers inside Google who discovered the bug, reported. Once triggered, the glitch state results in unexpected and potentially serious behavior, most notably system crashes that occur even when untrusted code is executed within a guest account of a virtual machine, which, under most cloud security models, is assumed to be safe from such faults. Escalation of privileges is also a possibility.

The bug, tracked under the common name Reptar and the designation CVE-2023-23583, is related to how affected CPUs manage prefixes, which change the behavior of instructions sent by running software. Intel x64 decoding generally allows redundant prefixes — meaning those that don’t make sense in a given context — to be ignored without consequence. During testing in August, Ormandy noticed that the REX prefix was generating “unexpected results” when running on Intel CPUs that support a newer feature known as fast short repeat move, which was introduced in the Ice Lake architecture to fix microcoding bottlenecks. The unexpected behavior occurred when adding the redundant rex.r prefixes to the FSRM-optimized rep mov operation. […]

Intel’s official bulletin lists two classes of affected products: those that were already fixed and those that are fixed using microcode updates released Tuesday. An exhaustive list of affected CPUs is available here. As usual, the microcode updates will be available from device or motherboard manufacturers. While individuals aren’t likely to face any immediate threat from this vulnerability, they should check with the manufacturer for a fix. People with expertise in x86 instruction and decoding should read Ormandy’s post in its entirety. For everyone else, the most important takeaway is this: “However, we simply don’t know if we can control the corruption precisely enough to achieve privilege escalation.” That means it’s not possible for people outside of Intel to know the true extent of the vulnerability severity. That said, anytime code running inside a virtual machine can crash the hypervisor the VM runs on, cloud providers like Google, Microsoft, Amazon, and others are going to immediately take notice.

Read more of this story at Slashdot.

Source: Slashdot – Intel Fixes High-Severity CPU Bug That Causes ‘Very Strange Behavior’

A bloc of 48 nations have developed the Crypto-Asset Reporting Framework (CARF), aimed at standardizing reporting requirements for crypto assets to address concerns related to money laundering and tax evasion. It’s set to be implemented by 2027. The Register reports: Developed by the Organisation for Economic Co-operation and Development (OECD), the CARF was developed under the 168-member Global Forum on Transparency and Exchange of Information for Tax Purposes, with the G20 and the Organisation for Economic Co-operation and Development looking on approvingly and lending a hand. As the name implies, that Forum is all about sharing data so that each nation’s tax authorities have the information they need to understand money movements and make sure they can see what they’re allowed to tax. The Forum and the legislative instruments it has fostered include reporting requirements that ensure relevant information is collected by those who facilitate transactions and will be shared.

CARF brings similar reporting requirements to crypto assets. Note the term “crypto assets.” That’s important, because cryptocurrency is not the only blockchain-based instrument that worries authorities. Some, like non-fungible tokens, rely on the same “greater fool” theory that pumped up cryptocurrency prices, and can attract – ahem – interesting investors. But others are far less contentious or speculative, and instead aim to speed transaction processing. Stablecoins, for example, are often suggested as a means for faster and cheaper cross-border transactions than is possible with dominant transaction processing services. Tokenized assets can also be more easily integrated into applications to ease automated money movements.

That speed and flexibility is increasingly appreciated. But unless transactions made with those instruments can be observed, the potential for their use to evade tax authorities is high. CARF’s use of the term “crypto assets” therefore signals an effort to cover the weird world of cryptocurrencies and the emerging classes of classier tokenized assets. The Framework was signed off in March 2023, and in the time since OECD members and other interested nations have been dotting the Is and crossing the Ts to prepare for its implementation. The Framework can be found here.

Read more of this story at Slashdot.

Source: Slashdot – 48-Nation Bloc To Crack Down On Using Crypto Assets To Avoid Tax

Sarah Perez reports via TechCrunch: YouTube today announced how it will approach handling AI-created content on its platform with a range of new policies surrounding responsible disclosure as well as new tools for requesting the removal of deepfakes, among other things. The company says that, although it already has policies that prohibit manipulated media, AI necessitated the creation of new policies because of its potential to mislead viewers if they don’t know the video has been “altered or synthetically created.” One of the changes that will roll out involves the creation of new disclosure requirements for YouTube creators. Now, they’ll have to disclose when they’ve created altered or synthetic content that appears realistic, including videos made with AI tools. For instance, this disclosure would be used if a creator uploads a video that appears to depict a real-world event that never happened, or shows someone saying something they never said or doing something they never did.

It’s worth pointing out that this disclosure is limited to content that “appears realistic,” and is not a blanket disclosure requirement on all synthetic video made via AI. “We want viewers to have context when they’re viewing realistic content, including when AI tools or other synthetic alterations have been used to generate it,” YouTube spokesperson Jack Malon told TechCrunch. “This is especially important when content discusses sensitive topics, like elections or ongoing conflicts,” he noted. […] The company also warns that creators who don’t properly disclose their use of AI consistently will be subject to “content removal, suspension from the YouTube Partner Program, or other penalties.” YouTube says it will work with creators to make sure they understand the requirements before they go live. But it notes that some AI content, even if labeled, may be removed if it’s used to show “realistic violence” if the goal is to shock or disgust viewers. […]

Other changes include the ability for any YouTube user to request the removal of AI-generated or other synthetic or altered content that simulates an identifiable individual — aka a deepfake — including their face or voice. But, the company clarifies that not all flagged content will be removed, making room for parody or satire. It also says that it will consider whether or not the person requesting the removal can be uniquely identified or whether the video features a public official or other well-known individual, in which case “there may be a higher bar,” YouTube says. Alongside the deepfake request removal tool, the company is introducing a new ability that will allow music partners to request the removal of AI-generated music that mimics an artist’s singing or rapping voice.

Read more of this story at Slashdot.

Source: Slashdot – YouTube Adapts Its Policies For the Coming Surge of AI Videos

An anonymous reader quotes a report from Electrek: On Monday, Rivian released an incremental software update 2023.42, which bricked the infotainment system in R1Ses and R1Ts. The company is frantically working on a fix, but it might not be an OTA. […] The vehicles are drivable, but software and displays go black. It appears that the 2023.42 software update hangs at 90% on the vehicle screen or 50% on the app screen, and then the vehicle screens black out. All systems appear to still work except for the displays. At the moment, it appears that Amazon vans are not impacted. Update: The company has acknowledged the issue with affected customers but has yet to issue a fix or plan to fix. Rivian’s vice president of software engineering, Wassim Bensaid, took to Reddit to update users on the situation, writing: “Hi All, We made an error with the 2023.42 OTA update — a fat finger where the wrong build with the wrong security certificates was sent out. We cancelled the campaign and we will restart it with the proper software that went through the different campaigns of beta testing. Service will be contacting impacted customers and will go through the resolution options. That may require physical repair in some cases. This is on us — we messed up. Thanks for your support and your patience as we go through this.

*Update 1 (11/13, 10:45 PM PT): The issue impacts the infotainment system. In most cases, the rest of the vehicle systems are still operational. A vehicle reset or sleep cycle will not solve the issue. We are validating the best options to address the issue for the impacted vehicles. Our customer support team is prioritizing support for our customers related to this issue. Thank you.”

Read more of this story at Slashdot.

Source: Slashdot – Rivian Software Update Bricks Infotainment System, Fix Not Obvious

India’s capital, New Delhi, is preparing a new weapon in the fight against deadly air pollution: cloud seeding. From a report: The experiment, which could take place as early as next week, would introduce chemicals like silver iodide into a cloudy sky to create rain and, it’s hoped, wash away the fine particulate matter hovering over one of the world’s largest cities. The need is desperate. Delhi has already tried traffic restriction measures, multimillion-dollar air filtration towers, and the use of fleets of water-spraying trucks to dissolve the particulate matter in the air — but to no avail.

The use of cloud seeding, if it goes ahead, would be controversial. “It’s not at all a good use of resources because it’s not a solution, it’s like a temporary relief,” says Avikal Somvanshi, a researcher at the Center for Science and Environment in New Delhi. Environmentalists and scientists worry that most of the government’s response is focused on mitigating the pollution rather than trying to cut off its source. “There is just no political intent to solve this, that is one of the biggest problems,” says Bhavreen Kandhari, an activist and cofounder of Warrior Moms, a network of mothers demanding clean air.

[…] Now, Delhi officials are seeking permission from federal agencies in India to try cloud seeding. The technique involves flying an aircraft to spray clouds with salts like silver or potassium iodide or solid carbon dioxide, also known as dry ice, to induce precipitation. The chemical molecules attach to moisture already in the clouds to form bigger droplets that then fall as rain. China has used artificial rain to tackle air pollution in the past — but for cloud seeding to work properly, you need significant cloud cover with reasonable moisture content, which Delhi generally lacks during the winter. If weather conditions are favorable, scientists leading the project at the Indian Institute of Technology in Kanpur plan to carry out cloud seeding around November 20.

Read more of this story at Slashdot.

Source: Slashdot – Delhi Plans To Unleash Cloud Seeding in Its Battle Against Deadly Smog