MGM says FTC can’t possibly probe its ransomware downfall

MGM Resorts wants the FTC to halt a probe into last year’s ransomware infection at the mega casino chain – because the watchdog’s boss Lina Khan was a guest at one of its hotels during the cyberattack, apparently. The biz on Monday sued [PDF] the US regulator and its chair, noting the computer network intrusion in September 2023 “cost MGM dearly.” That legal complaint, filed in a Washington DC federal district court, demands among other things an end to the regulator’s investigation into the malware infection unless Khan is recused from the probe, and a declaration that the watchdog acted unconstitutionally. MGM earlier said it expected losses totaling at least $100 million from the attack. It presumably would rather the FTC not add to that pain with fines or some other punishment stemming from scrutiny of the corporation’s IT practices.

This site claims to have harvested 4B+ Discord chats, today all yours for a price

Internet-scraping outfit Spy.pet claims to have harvested more than four billion public messages made by nearly 620 million users on more than 14,000 Discord chat servers – and is selling access to this trove. The service (for a lack of a better word) has been active since November 2023, vacuuming up user and server activity without any sign of an opt-out. Yes, all the info is already public in a way – Discord is kinda like IRC on steroids – and it’s a reminder that it’s not impossible to gather up all this chatter using bots for various purposes (if not surveillance then training AI models.)

OpenAI’s GPT-4 can exploit real vulnerabilities by reading security advisories

AI agents, which combine large language models with automation software, can successfully exploit real world security vulnerabilities by reading security advisories, academics have claimed. In a newly released paper, four University of Illinois Urbana-Champaign (UIUC) computer scientists – Richard Fang, Rohan Bindu, Akul Gupta, and Daniel Kang – report that OpenAI’s GPT-4 large language model (LLM) can autonomously exploit vulnerabilities in real-world systems if given a CVE advisory describing the flaw. “To show this, we collected a dataset of 15 one-day vulnerabilities that include ones categorized as critical severity in the CVE description,” the US-based authors explain in their paper.

EU privacy body takes on Meta for ‘consent-or-pay’ model

The EDPB said that offering only a paid alternative to services which involve processing personal data for targeted ads ‘should not be the default way forward’. The European Data Protection Board (EDPB) has giving the opinion that Meta needs to give EU consumers “a real choice” when it comes to its new subscription model, which currently sees users either pay for an ad-free version of its apps or consent to targeted advertising. Dubbed ‘consent or pay’, the model released last year is seen by some as a smokescreen that aims to justify a massive collection of data, a practice that many EU consumer groups have said is illegal under the GDPR.

T-Mobile, Verizon workers get texts offering $300 for SIM swaps

Criminals are now texting T-Mobile and Verizon employees on their personal and work phones, trying to tempt them with cash to perform SIM swaps. The targeted employees have shared screenshots of messages offering $300 to those willing to aid the senders in their criminal endeavors. According to many reports, this is part of a campaign targeted at current and former mobile carrier workers who could have access to the systems required to perform a SIM swap. “Myself and a group of former employees all got the same message, all from different numbers and with different verbiage,” one of the targeted people said.