Software developer at a big library, cyclist, photographer, hiker, reader. Email: chris@improbable.org
24360 stories
·
217 followers

Add a shared credentials relationship from twitter.com to x.com (#759) · apple/password-manager-resources@34c37ad · GitHub

1 Share

You can’t perform that action at this time.


Page 2

Read the whole story
Share this story
Delete

OpenAI departures: Why can’t former employees talk, but the new ChatGPT release can? - Vox

2 Shares

On Monday, OpenAI announced exciting new product news: ChatGPT can now talk like a human.

It has a cheery, slightly ingratiating feminine voice that sounds impressively non-robotic, and a bit familiar if you’ve seen a certain 2013 Spike Jonze film. “Her,” tweeted OpenAI CEO Sam Altman, referencing the movie in which a man falls in love with an AI assistant voiced by Scarlett Johansson.

But the product release of ChatGPT 4o was quickly overshadowed by much bigger news out of OpenAI: the resignation of the company’s co-founder and chief scientist, Ilya Sutskever, who also led its superalignment team, as well as that of his co-team leader Jan Leike (who we put on the Future Perfect 50 list last year).

The resignations didn’t come as a total surprise. Sutskever had been involved in the boardroom revolt that led to Altman’s temporary firing last year, before the CEO quickly returned to his perch. Sutskever publicly regretted his actions and backed Altman’s return, but he’s been mostly absent from the company since, even as other members of OpenAI’s policy, alignment, and safety teams have departed.

But what has really stirred speculation was the radio silence from former employees. Sutskever posted a pretty typical resignation message, saying “I’m confident that OpenAI will build AGI that is both safe and beneficial…I am excited for what comes next.”

Leike ... didn’t. His resignation message was simply: “I resigned.” After several days of fervent speculation, he expanded on this on Friday morning, explaining that he was worried OpenAI had shifted away from a safety-focused culture.

Questions arose immediately: Were they forced out? Is this delayed fallout of Altman’s brief firing last fall? Are they resigning in protest of some secret and dangerous new OpenAI project? Speculation filled the void because no one who had once worked at OpenAI was talking.

It turns out there’s a very clear reason for that. I have seen the extremely restrictive off-boarding agreement that contains nondisclosure and non-disparagement provisions former OpenAI employees are subject to. It forbids them, for the rest of their lives, from criticizing their former employer. Even acknowledging that the NDA exists is a violation of it.

If a departing employee declines to sign the document, or if they violate it, they can lose all vested equity they earned during their time at the company, which is likely worth millions of dollars. One former employee, Daniel Kokotajlo, who posted that he quit OpenAI “due to losing confidence that it would behave responsibly around the time of AGI,” has confirmed publicly that he had to surrender what would have likely turned out to be a huge sum of money in order to quit without signing the document.

While nondisclosure agreements aren’t unusual in highly competitive Silicon Valley, putting an employee’s already-vested equity at risk for declining or violating one is. For workers at startups like OpenAI, equity is a vital form of compensation, one that can dwarf the salary they make. Threatening that potentially life-changing money is a very effective way to keep former employees quiet. (OpenAI did not respond to a request for comment.)

All of this is highly ironic for a company that initially advertised itself as OpenAI — that is, as committed in its mission statements to building powerful systems in a transparent and accountable manner.

OpenAI long ago abandoned the idea of open-sourcing its models, citing safety concerns. But now it has shed the most senior and respected members of its safety team, which should inspire some skepticism about whether safety is really the reason why OpenAI has become so closed.

The tech company to end all tech companies

OpenAI has spent a long time occupying an unusual position in tech and policy circles. Their releases, from DALL-E to ChatGPT, are often very cool, but by themselves they would hardly attract the near-religious fervor with which the company is often discussed.

What sets OpenAI apart is the ambition of its mission: “to ensure that artificial general intelligence — AI systems that are generally smarter than humans — benefits all of humanity.” Many of its employees believe that this aim is within reach; that with perhaps one more decade (or even less) — and a few trillion dollars — the company will succeed at developing AI systems that make most human labor obsolete.

Which, as the company itself has long said, is as risky as it is exciting.

“Superintelligence will be the most impactful technology humanity has ever invented, and could help us solve many of the world’s most important problems,” a recruitment page for Leike and Sutskever’s team at OpenAI states. “But the vast power of superintelligence could also be very dangerous, and could lead to the disempowerment of humanity or even human extinction. While superintelligence seems far off now, we believe it could arrive this decade.”

Naturally, if artificial superintelligence in our lifetimes is possible (and experts are divided), it would have enormous implications for humanity. OpenAI has historically positioned itself as a responsible actor trying to transcend mere commercial incentives and bring AGI about for the benefit of all. And they’ve said they are willing to do that even if that requires slowing down development, missing out on profit opportunities, or allowing external oversight.

“We don’t think that AGI should be just a Silicon Valley thing,” OpenAI co-founder Greg Brockman told me in 2019, in the much calmer pre-ChatGPT days. “We’re talking about world-altering technology. And so how do you get the right representation and governance in there? This is actually a really important focus for us and something we really want broad input on.”

OpenAI’s unique corporate structure — a capped-profit company ultimately controlled by a nonprofit — was supposed to increase accountability. “No one person should be trusted here. I don’t have super-voting shares. I don’t want them,” Altman assured Bloomberg’s Emily Chang in 2023. “The board can fire me. I think that’s important.” (As the board found out last November, it could fire Altman, but it couldn’t make the move stick. After his firing, Altman made a deal to effectively take the company to Microsoft, before being ultimately reinstated with most of the board resigning.)

But there was no stronger sign of OpenAI’s commitment to its mission than the prominent roles of people like Sutskever and Leike, technologists with a long history of commitment to safety and an apparently genuine willingness to ask OpenAI to change course if needed. When I said to Brockman in that 2019 interview, “You guys are saying, ‘We’re going to build a general artificial intelligence,’” Sutskever cut in. “We’re going to do everything that can be done in that direction while also making sure that we do it in a way that’s safe,” he told me.

Their departure doesn’t herald a change in OpenAI’s mission of building artificial general intelligence — that remains the goal. But it almost certainly heralds a change in OpenAI’s interest in safety work; the company hasn’t announced who, if anyone, will lead the superalignment team.

And it makes it clear that OpenAI’s concern with external oversight and transparency couldn’t have run all that deep. If you want external oversight and opportunities for the rest of the world to play a role in what you’re doing, making former employees sign extremely restrictive NDAs doesn’t exactly follow.

Changing the world behind closed doors

This contradiction is at the heart of what makes OpenAI profoundly frustrating for those of us who care deeply about ensuring that AI really does go well and benefits humanity. Is OpenAI a buzzy, if midsize tech company that makes a chatty personal assistant, or a trillion-dollar effort to create an AI god?

The company’s leadership says they want to transform the world, that they want to be accountable when they do so, and that they welcome the world’s input into how to do it justly and wisely.

But when there’s real money at stake — and there are astounding sums of real money at stake in the race to dominate AI — it becomes clear that they probably never intended for the world to get all that much input. Their process ensures former employees — those who know the most about what’s happening inside OpenAI — can’t tell the rest of the world what’s going on.

The website may have high-minded ideals, but their termination agreements are full of hard-nosed legalese. It’s hard to exercise accountability over a company whose former employees are restricted to saying “I resigned.”

ChatGPT’s new cute voice may be charming, but I’m not feeling especially enamored.

A version of this story originally appeared in the Future Perfect newsletter. Sign up here!

Read the whole story
Share this story
Delete

Lawsuit Exposes Inner Workings Of Stew Peters’ Extremist Media Empire

1 Share

A dispute raging inside the “Stew Peters Network” ended up in a federal court in Florida last month. The ongoing case has exposed drama between a group of far right media personalities, complete with alleged text messages and emails that show the inner workings of a company that has peddled conspiracy theories, anti-gay hate speech, racism, and antisemitism, while still maintaining connections with more mainstream Republicans. 

In many ways, the trouble began — as so many things have in the modern far right — with the coronavirus pandemic. 

The company’s namesake, Stew Peters, is an internet personality whose eponymous show and associated social media posts have, in just the past two days alone, suggested immigrants are “retarded cannibals,” declared “Jewish Zionist infiltration in our government” is “our enemy,” and attacked “queer perverts” who he said needed to be “brought to heel” for creating “Weimar conditions” that “must be met with Weimar solutions.” Peters, who has amassed six figure followings on the social networks Gab and Telegram along with an audience of over eighty thousand on former President Trump’s “Truth Social” platform, has shared his stage with neo-Nazi leader Nick Fuentes. Yet Peters’ evident extremism, which has included airing blatantly antisemitic cartoon caricatures in the introduction to his broadcasts, has also not stopped him from drawing established Republicans as guests on his show, including Trump’s former White House chief of staff, Mark Meadows, Rep. Paul Gosar (R-AZ), who has been credited with appearances in six episodes, and multiple current GOP congressional candidates.  

While a blend of right wing politics and hate speech is a core part of Peters’ brand, COVID conspiracy theories are what provided him some of his strongest social media momentum. Specifically, Peters gained prominence with the 2022 documentary “Died Suddenly,” which focused on what the Canadian Broadcasting Corporation described as “the evidence-free claim that COVID vaccines are causing sudden deaths in people around the world.” Peters was among the producers of the approximately hour long movie. It mixed jump cuts and archival footage — including images of 9/11, the moon landing, and bigfoot — along with interviews and easily contradicted claims to argue the vaccines are part of a population control plot engineered by the “global elite.” “Died Suddenly” concludes with onscreen text urging viewers to “let us never forget what they have done.”

“If you are quiet, or apathetic, or complacent you have to stand before God and you have to answer for that,” Peters warned the audience. 

According to the Associated Press, Peters’ conspiratorial call to action amassed over 20 million views on various online platforms. It also helped inspire a viral hashtag. Those posts fueled harassment of people who experienced medical emergencies and deaths of loved ones due to COVID, as well as unrelated incidents. And, last month, disagreements over promotion and fundraising related to the movie led Peters’ company to file a lawsuit against his fellow producers, some of whom have their own connections to extremism and Republican politics.  

Documents filed as part of that suit, which are being reported here for the first time, reveal allegations of “wrongful, deceptive, fraudulent, and infringing actions” that Peters has leveled against the other producers of “Died Suddenly.” Through an attorney, all of the defendants have disputed the allegations. They are currently seeking to have the suit dismissed. The documents also depict Peters and his associates squabbling over cash generated by the film. The court docket contains internal correspondence between Peters and the other producers, including alleged text messages that Peters’ former business partners claim show him trying to hide money from his ex-wife by routing payments through a friend. 

“I’m going through a nasty divorce and I don’t really feel like giving her half of everything that they sent me,” Peters said in the alleged text exchange.

Travis DeCosta, the attorney representing Peters’ company in the case, declined to comment on the alleged text about the divorce. 

“Right now I’m not at liberty to talk about it,” DeCosta said in a phone conversation with TPM on Thursday evening.  

The lawsuit was first reported on last month by Angry White Men, a site dedicated to “tracking white supremacy.” However, the internal correspondence from Peters’ company and other case documents are being reported here at TPM for the first time. Along with feuds and alleged malfeasance in Peters’ inner circle, the documents — including some which were unsealed due to TPM reporting — shed light on the financial model that fringe far right broadcasters use to build their business. The suit paints a picture of an extremist media empire driven by clicks, commercials from a company selling gold bars to people paranoid about the “next crisis,” and audience donations. It also reveals how heavily Peters relied on outsiders to create much of the content that aired under his brand name. 

Fame has long been a goal for Peters. A profile published by Mother Jones last year detailed how Peters spent the early 2000’s and 2010’s pursuing a rap career with the moniker “Fokiss.” 

Peters’ musical efforts did not result in industry success, an experience Peters detailed in a 2012 song. A video for that track begins with what seems to be a fictionalized version of his mother telling a baby Peters, “You’re going to make it Stewart … my special boy” before detailing how “that dream” was a “failure.” 

Starting in 2014, Peters went on to work as a bounty hunter in Minnesota where he experienced some initial social media success posting videos of apprehensions and taped rants. However, this venture was not without its own issues. By 2020, Peters began posting a political radio show on the Facebook page where he shared bounty hunting exploits. The following year, according to the Daily Beast, Peters was arrested after a scene at his home. The incident reportedly led Peters to express fears about the future of his law enforcement-adjacent career, and his bounty hunting videos ultimately tapered off. As Peters increasingly focused on political content, it was the “Died Suddenly” documentary that helped Peters, as Mother Jones put it, “hit his stride.”

“Died Suddenly” was produced by Peters, filmmakers Matt Skow and Nicholas Stumphauzer, who directed the movie, Edward Szall, and Lauren Witzke. It was presented by the “Stew Peters Network,” which is essentially a subscription-based website and series of social media pages that host Peters’ show and affiliated broadcasts. Szall and Witzke are partners in the production company TLM Global, which is short for “Truth & Light Media.” 

Like Peters, Szall and Witzke, who was previously an executive producer for Peters’ network, have their own connections to both GOP politics and the more extreme far right. Witzke, who could not be reached for comment on this story, was the GOP nominee for  U.S. Senate in Delaware in 2020. After winning the Republican primary in that race, Witzke cheerfully accepted tweeted congratulations from Fuentes, the prominent neo Nazi activist and broadcaster. Before losing in the general election, Witzke conducted an interview with the website VDare, which has consistently hosted white nationalist and antisemitic content. In that conversation, Witzke indicated she was more concerned about immigration than being branded a racist.

“Died Suddenly” wasn’t the only product of the partnership between Peters, Witzke, and Szall that, according to court documents, began in October 2021. Since then, the pair also worked with Peters on the documentary “These Little Ones,” which focused on a narrative about “elite pedophilia” with echoes of the pro-Trump QAnon conspiracy theory. They also produced two movies under the “Watch The Water” banner that were credited with originating a conspiracy theory that COVID was caused by snake venom in drinking water. Two other videos made through the partnership suggest world leaders and scientists are involved in a Satanic plot and that Americans are being enslaved by taxes, narratives that are more extreme versions of the concerns about globalists and elites that hint at antisemitic tropes and have increasingly become part of the Republican playbook. Along with producing these documentaries, Witzke and Szall also hosted their own biweekly broadcast, “Crosstalk News” on Peters’ network.

However, earlier this year, the partnership between Peters, Witzke, and Szall apparently turned sour. On April 3, Fokiss Inc. a Minnesota company led by Peters that bears his old rap name, filed a federal suit against Witzke, Szall, TLM Global, LLC, a related company, and the directors of “Died Suddenly,” Skow, and Stumphauzer. The suit was filed in the Southern District of Florida. All of the defendants are being represented by attorneys Matthew Nelles and Joshua Martin, who did not respond to requests for comment from TPM. Skow and Stumphauzer also did not respond to requests for comment.  

The initial complaint, which notes that Fokiss is doing business as the Stew Peters Network, accuses the TLM team of making “unauthorized donation solicitations” on a website associated with “Died Suddenly.” Fokiss’ complaint also alleged all of the defendants made “improper” applications for trademarks associated with the “Died Suddenly” brand. The court filing also includes a copy of a termination letter that Peters apparently sent to Szall on January 27, 2024 in an attempt to end their business relationship. That letter describes the “ownership confusion of the ‘DIED SUDDENLY’ name, twitter page, and documentary” along with “unapproved postings, fundraisers, and even subscription sign ups” that Peters called “unacceptable” and even “criminal.” 

Despite these concerns Peters indicated in the letter a willingness to continue to work with Szall, Witzke, and TLM. Peters specified that Crosstalk “may continue to air on the SPN.” He also discussed the terms for this, which he indicated were part of a separate “contract.” The deal outlined by Peters in the letter indicated that “Crosstalk” was fully produced by TLM and then delivered to his company on the afternoon it was aired. He wrote that TLM needed to pay $1,600 monthly to air on the network. The exchange indicates that, at least in this case, Peters charged other hosts to make content for his network, which offered them the benefit of exposure to his following. Peters also wrote that TLM had an “ongoing obligation to complete and deliver … the remaining two documentaries” for which he said they were already “paid in full for by the Stew Peters Network.”

The complaint details the amount TLM was paid to make documentaries for Peters. It also identified Goldco, a relatively mainstream company that helps clients invest in gold and other precious metals as the primary funder of the Stew Peters Network and its documentaries. 

According to the complaint, Goldco had two sponsorship agreements with Peters’ company that ran from April 2022 to the end of last month. He has continued to identify the company as a sponsor in more recent broadcasts as well. The complaint described Goldco as providing “the majority of the Network’s annual budgets and production requirements.” Goldco and its CEO, Trevor Gerszt, did not respond to questions from TPM about its role financing Peters’ network, and its extremist content. 

According to the complaint, Peters’ company provided TLM a “documentary budget” of $379,000 through two separate payments last year that were “generally tied to the Plaintiff’s obligations to the GoldCo Sponsorship Agreement.” 

The complaint included a Feb. 5 response from Ryan DiGiovanni, an attorney for TLM Global LLC, answering Peters’ termination letter from the prior month. DiGiovanni objected to what he described as Peters’ attempt to “piecemeal together the provisions for which you expect continued performance while at the same time repudiating your responsibility for continued payment.” He also said TLM “unequivocally disagree[s] that the two documentaries have been ‘paid in full.’” 

While TLM’s attorney said they considered Peters’ letter a “material breach” of his agreement with the company, he attempted to end his response on a relatively positive note. DiGiovanni said TLM would provide Peters’ “work completed to date” on an unfinished documentary and that the company was “open to further discussion … regarding the possibility of future contract(s).”

Peters’ attorney, DeCosta, fired back with another letter that quoted a “request” that purportedly came from Witzke in October 2003 where she indicated the remaining documentary budget was $189,000. That alleged request, which was a bulleted list, also included other money Witzke, who was still working for both the Stew Peters Network and SPN at the time, wanted from Peters. According to Peters’ attorney, Witzke had line items asking for “$25k Lauren Mid Year Bonus (You Promised)” and  “Lauren Car – $13,500 (You Promised).” Peters’ attorney also included a November 17, 2023 email that he said was sent from Szall to bolster the argument the documentary budget had been fully provided to TLM. In that alleged email, Szall wrote to Peters that, despite some disagreement, he needed no further payment for the remaining documentaries required by their contract. 

However, the alleged email from Szall to Peters indicated there were still outstanding issues about money Witzke believed she was due.

“Regarding what you mentioned in the itemization about Lauren’s bonus and car allowance, TLM cannot receive money on behalf of Lauren as she was your employee,” Szall wrote in the alleged email, adding, “Bro, listen, she still considers the $25k bonus and the $13.5k car allowance as outstanding, and she may pursue that money on her own. Just wanted to let you know, I tried to get her to let it go, she’s not.” 

Szall further suggested that Witzke would “pursue” those funds. Nelles, Witzke’s attorney in the suit, did not respond to specific questions about the bonus and car payment dispute. DeCosta, the attorney for Peters’ company, told TPM Witzke’s requests for funds were a “moot issue” that “has nothing to do with the intellectual property claim that this lawsuit’s about.”  

“We dispute that she’s entitled to any money,” DeCosta said of Witzke in a phone conversation on Thursday evening. 

In the over six weeks since Peters’ company filed suit against Szall, Witzke, the TLM companies, and the “Died Suddenly” directors, the lawyers for both sides have engaged in a back and forth argument in court. Two days after filing the suit, Peters and his attorney argued for a temporary restraining order that, among other things, restricted the defendants’ assets and barred them from using web and social media associated with “Died Suddenly.”  The temporary restraining order was put in place on April 9. 

On April 17, lawyers for Szall, Witzke, and the other defendants filed a motion to dissolve the temporary restraining order. Along with objecting to technicalities related to an alleged lack of certified notice given by the lawyer for Peters’ company and problems with the time stamp on the order, the motion featured the text purportedly from Peters about his “divorce.” The motion said that text was an instruction from Peters to Witzke on May 4, 2023, and that the money he was hoping to conceal from his ex-wife was his “Goldco sponsorship.” In light of this, TLM’s lawyers argued it was “ironic” Peters’ company was concerned about anyone else “hiding assets.” 

TPM reached out to Szall via text message on Thursday with several questions about the case. Via email, he pointed to the motion seeking to dissolve the restraining order and specifically the page featuring the alleged “nasty divorce” text. Szall suggested he and the other defendants felt that page contained “the answers you are looking for.”  

The motion seeking to dissolve the restraining order against TLM and the other defendants also included an alleged text from Peters to Witzke on February 25, 2023. In that alleged exchange Peters apparently expressed frustration that Szall and his colleagues were soliciting donations in the name of “Died Suddenly,” which he described as a “serious problem.” 

“He’s turning Died Suddenly into HIS grift,” Peters wrote in the alleged text exchange, later adding, “I have NEVER asked for a donation.”

The lawyers for Szall, Witzke, TLM, and the directors suggested in court filings? this showed Peters was aware of the donations well before seeking the temporary restraining order. They also claimed “just $4,134.60” was raised through fundraising between January and April of last year. A judge ultimately recommended to dissolve the restraining order on April 23. DeCosta, the attorney for Peters’ company, did not object to the recommendation.

Since then, there has been a flurry of activity related to the fact the initial complaint filed on behalf of Peters’ company exceeded a required page limit. DeCosta is currently working on an amended complaint. On Monday, the attorneys for Szall, Witzke, TLM, and the “Died Suddenly” directors filed a motion to dismiss the lawsuit for failure to state a claim. A response from the attorney for Peters’ company is due June 3. As of this writing, the case remains ongoing. 

As the court fight rages on, Peters’ extremism has become an issue. In the motion seeking to withdraw the restraining order, TLM’s attorneys cited the fact that Peters is “a divisive individual.” As evidence, the motion pointed to posts Peters made criticizing Martin Luther King Jr. and the gay community. Of course, Szall, Witzke, and TLM are no strangers to divisive rhetoric of their own. 

Old episodes of “Crosstalk” are still available on the Stew Peters Network website. The most recent episode hosted on the page is a “Christmas Special” from December last year that begins with graphics of Szall and Witzke as angels before moving to a Dr. Seuss parody titled “How The Rabbi Robbed Christmas by, Dr. Suss.” The story, complete with antisemitic caricatures, was the tale of a rabbi who doesn’t like Christmas, in part because it hurt “his wallet.”

“Even the Jews down in Jewville liked Christmas a lot, but the rabbi who lived just north of Jewville did not,” a narrator said.

Since then, TLM has moved on to other projects including working with Trump associate Laura Loomer. Fundraising pages for that project initially indicated Fuentes, the neo Nazi streamer, was involved. However, when asked by TPM, both Szall and Loomer claimed that was an error

Szall has taken the Crosstalk brand to Cozy TV, a video platform that is heavily associated with Fuentes. The site is home to Fuentes’ broadcasts and the company that owns and operates Cozy is also headquartered at the same PO Box address as Fuentes’ America First Foundation. 

TPM emailed Szall to ask if he had any regrets about his own statements in light of his attorneys’ trying to make an issue of Peters’ “divisive” commentary. TPM also pressed him on how he could have concerns about that if he was apparently willing to work with Fuentes. Szall stood by his own remarks, though he suggested Witzke has not been involved in the Cozy broadcasts.

“You will never find us casting blame onto others for our own statements and behaviors,” Szall wrote. “I run a Bible study on Cozy, and Lauren doesn’t make content anymore, as she is 7 months pregnant and her attention is focused entirely on her new and growing family.”

Szall also suggested Peters’ comments were included in the motion to show that the host had damaged his own brand separate from any harm he alleged was done by TLM.

“Any damages caused to Stew Peters’ reputation are entirely self inflicted- and no fault of Lauren’s or my own,” Szall wrote.   

Read the whole story
Share this story
Delete

Project Hephaistos – II. Dyson sphere candidates from Gaia DR3, 2MASS, and WISE | Monthly Notices of the Royal Astronomical Society | Oxford Academic

1 Share

Read the whole story
Share this story
Delete

Two Santa Cruz students uncover security bug that could let millions do their laundry for free | TechCrunch

1 Comment

A pair of university students say they found and reported earlier this year a security flaw allowing anyone to avoid paying for laundry provided by over a million internet-connected laundry machines in residences and college campuses around the world.

Months later, the vulnerability remains open after CSC ServiceWorks repeatedly ignored requests to fix the flaw.

UC Santa Cruz students Alexander Sherbrooke and Iakov Taranenko told TechCrunch that the vulnerability they discovered allows anyone to remotely send commands to laundry machines run by CSC and operate laundry cycles for free.

Sherbrooke said he was sitting on the floor of his basement laundry room in the early hours one January morning with his laptop in hand and “suddenly having an ‘oh s—’ moment.” From his laptop, Sherbrooke ran a script of code with instructions telling the machine in front of him to start a cycle despite having $0 in his laundry account. The machine immediately woke up with a loud beep and flashed “PUSH START” on its display, indicating the machine was ready to wash a free load of laundry. 

In another case, the students added an ostensible balance of several million dollars into one of their laundry accounts, which reflected in their CSC Go mobile app as though it were an entirely normal amount of money for a student to spend on laundry.

CSC ServiceWorks is a large laundry service company, touting a network of over a million laundry machines installed in hotels, university campuses, and residences across the United States, Canada and Europe.

Since CSC ServiceWorks does not have a dedicated security page for reporting security vulnerabilities, Sherbrooke and Taranenko sent the company several messages through its online contact form in January but heard nothing back from the company. A phone call to the company landed them nowhere either, they said. 

The students also sent their findings to the CERT Coordination Center at Carnegie Mellon University, which helps security researchers disclose flaws to affected vendors and provide fixes and guidance to the public.

The students are now revealing more about their findings after waiting longer than the customary three months that security researchers typically grant vendors to fix flaws before going public. The pair first disclosed their research in a presentation at their university cybersecurity club earlier in May.

It’s unclear who, if anyone, is responsible for cybersecurity at CSC, and representatives for CSC did not respond to TechCrunch’s requests for comment.

The student researchers said the vulnerability is in the API used by CSC’s mobile app, CSC Go. An API allows apps and devices to communicate with each other over the internet. In this case, the customer opens the CSC Go app to top up their account with funds, pay, and begin a laundry load on a nearby machine.

Sherbrooke and Taranenko discovered that CSC’s servers can be tricked into accepting commands that modify their account balances because any security checks are done by the app on the user’s device and are automatically trusted by CSC’s servers. This allows them to pay for laundry without actually putting real funds in their accounts. 

By analyzing the network traffic while logged in and using the CSC Go app, Sherbrooke and Taranenko found they could circumvent the app’s security checks and send commands directly to CSC’s servers, which are not available through the app itself. 

Technology vendors like CSC are ultimately responsible for making sure their servers are performing the proper security checks; otherwise it’s akin to having a bank vault protected by a guard who doesn’t bother to check who is allowed in.

The researchers said potentially anyone can create a CSC Go user account and send commands using the API because the servers are also not checking if new users owned their email addresses. The researchers tested this by creating a new CSC account with a made-up email address.

With direct access to the API and referencing CSC’s own published list of commands for communicating with its servers, the researchers said it is possible to remotely locate and interact with “every laundry machine on the CSC ServiceWorks connected network.” 

Practically speaking, free laundry has an obvious upside. But the researchers stressed the potential dangers of having heavy-duty appliances connected to the internet and vulnerable to attacks. Sherbrooke and Taranenko said they were unaware if sending commands through the API can bypass the safety restrictions that modern laundry machines come with to prevent overheating and fires. The researchers said someone would have to physically push the laundry machine’s start button to begin a cycle; until then, the settings on the front of the laundry machine cannot be changed unless someone resets the machine.

CSC quietly wiped out the researchers’ account balance of several million dollars after they reported their findings, but the researchers said the bug remains unfixed and it’s still possible for users to “freely” give themselves any amount of money.

Taranenko said he was disappointed that CSC did not acknowledge their vulnerability. 

“I just don’t get how a company that large makes those types of mistakes, then has no way of contacting them,” he said. “Worst-case scenario, people can easily load up their wallets and the company loses a ton of money. Why not spend a bare minimum of having a single monitored security email inbox for this type of situation?”

But the researchers are undeterred by the lack of response from CSC. 

“Since we’re doing this in good faith, I don’t mind spending a few hours waiting on hold to call their help desk if it would help a company with its security issues,” said Taranenko, adding that it was “fun to get to do this type of security research in the real world and not just in simulated competitions.”

Read the whole story
Share this story
Delete
1 public comment
acdha
12 hours ago
reply
“Since CSC ServiceWorks does not have a dedicated security page for reporting security vulnerabilities, Sherbrooke and Taranenko sent the company several messages through its online contact form in January but heard nothing back from the company. A phone call to the company landed them nowhere either, they said.”
Washington, DC

‘Turning point in energy history’ as solar, wind start pushing fossil fuels off the grid » Yale Climate Connections

1 Share
Read the whole story
Share this story
Delete
Next Page of Stories