News

• The FDA has approved the Libre Duo 10 Day CGM wearable
• It can continuously measure both ketones and blood sugar levels
• It’s worn by diabetics as a continuous glucose monitor (CGM)

The US Food and Drug Administration (FDA) has approved the first wearable device capable of simultaneously monitoring both ketone and bloody sugar levels, which the organization says is “a breakthrough for the safety of children and adults living with diabetes".

The device in question is the Libre Duo 10 Day monitor. Worn on your arm as a continuous glucose monitor (CGM), it provides minute-by-minute glucose updates that are sent to your smartphone. It also monitors ketone levels and sends you an alert if they rise above a certain threshold.

In terms of who can use it, the Libre Duo 10 Day wearable has been approved for use by people aged two or over who are living with diabetes. It takes the form of a small wearable sensor that measures glucose and ketone levels held within the fluids under your skin.

Made by Abbott Diabetes Care, there are few other specific details about the device for the time being, but the potential is huge.

In approving the Libre Duo 10 Day, the FDA’s intention is to help prevent diabetic ketoacidosis (DKA). This condition occurs when your body starts using fat instead of glucose for energy, which in turn leads to it producing too much ketone. DKA can become a life-threatening medical emergency if left untreated.

One of the benefits of the Libre Duo 10 Day is that it can track ketone levels in real time. Rather than using a standalone test kit that only provides a snapshot of your situation in that exact moment, the Libre wearable can display trends over time, notifying you if your ketone levels are rising or falling — which could help keep you better informed of whether your risk of DKA is changing.

The fact that it combines ketone monitoring with blood sugar analysis also means you don’t need two separate devices in order to stay on top of your diabetes. Having a single wearable helps keep things straightforward.

We don’t know when the Libre Duo 10 Day will become available, and its manufacturer’s website simply says it is “coming soon.” When it does arrive, it might help simplify the process of ketone and blood sugar monitoring for the 2.1 million Americans with type 1 diabetes for whom DKA is a real threat.

• Researcher registers Linux machine as a trusted device on Apple's Find My network and pulled live people-tracking data that Apple normally reserves for its own hardware
• The work is not a mass-surveillance exploit: it is limited in scope and only reads a location share that a friend had already agreed to, and it cannot silently locate arbitrary Apple users
• The approach took less than a week of protocol reverse engineering, and Apple has maintained silence on queries about the technique employed

Apple keeps the full Find My experience locked to its own devices, but a recent attempt by security researchers suggests that wall may be a relatively weak barrier to entry.

A 22-year-old security researcher who goes by "Zerotistic" documented how they registered an ordinary Linux machine as a trusted node on Apple's network and used its new status to receive live people-location data that Apple otherwise shares only with its own devices, such as iPhones and iPads.

Find My, Apple's catch-all tool for locating hardware such as AirTags, iPhones, and iPads, also lets people share their whereabouts with family and friends, and while Apple has historically guarded this particular feature very closely, it is also the same one the security researcher targeted to introduce a device that Apple does not otherwise have complete control over as part of its ecosystem.

The task is not an easy one to begin with: convincing Apple's back end that a Linux process was a legitimate Apple device that was part of its ecosystem and therefore could be trusted with information shared via the Find My platform required a lot of trial and error to get going.

It is important to clarify here that Apple's system is not exactly compromised here; the approach still requires a friend to share data that the Linux client that the security researcher built can then read.

Apple currently sends people-location data over its private Push Notification service only after it trusts that the receiving machine belongs to the account and can handle the data. This means the Linux machine would have to speak Apple's private language to query its servers and process the information it received.

It involved obtaining an Apple Identity Services (IDS) certificate, a specialized device and messaging credential Apple's internal framework uses to link an Apple Account to specific hardware, end-to-end encryption keys, and push notification tokens. This meant crafting a certificate signing request and sending it to a legacy Apple enrollment endpoint.

Once done, a Linux box with a signed certificate could sign its own requests and register as a Find My device, but it still had to subscribe to six different subservices to function. The registration request also had to be signed using an IDS certificate and an APNs certificate obtained during initial network setup.

The researcher then issued a SubscribeAndFetch request that provided an encrypted location key from his friend's Apple device to the Linux box, masquerading as one.

What might concern Apple is how fast things moved: the whole pipeline came together in a week. It also didn't require a jailbreak, a leaked key, or even a Mac to do the job. Instead, open-source clients and decompiled daemons were the norm, with a trial-and-error approach that eventually paid off.

The technique has its limitations: attacks can not target a stranger, and consent is required to track even one's friends. It shows that Apple's boundary around Find My stems from an obscure protocol it enforces rather than a cryptographic lock; once a device acts like it is from Apple, the ecosystem treats it as a family member rather than an untrusted node.

Apple has yet to respond to media queries about whether it plans to address the demonstrated trick or patch the loop in the near future.

• OpenAI says it has disrupted a social media influence campaign that is believed to be of Russian origin
• What makes this campaign stand out is the underlying architecture, which features a "think tank" with highly questionable credibility
• The objective of the campaign was to influence Western audiences into believing Russia was superior, and that Western countries were sacrificing their sovereignty

AI tools have once again been used for bad, rather than for good, and this time it has been as part of a campaign attributed to Russia that tried to discredit Western countries supportive of Ukraine.

The threat actors used ChatGPT accounts to promote the work of an “expert community” of academics known as the International Burke Institute (IBI). The site used stolen academic works attributed to the wrong authors in an attempt to appear legitimate while also hiding the true source of its academic ‘contributions’.

The IBI was registered to an address in Israel - with some evidence suggesting real individuals in Israel represented and promoted the page - but the main purpose of the misinformation campaign was to paint Russia in a favourable light compared to its Western adversaries.

In its report on the campaign OpenAI points out that those behind the ChatGPT accounts used to promote the page took careful steps to hide their Russian origins. Many of the prompts included instructions to hide any linguistic clues that the operators used Russian language prompting.

One inclusion on the IBI website referred to Germany’s traffic light coalition as the “Svetofor coalition”. Svetofor is the word for ‘traffic light’ in numerous Slavic languages, including Russian, indicating that drafts were written in Slavic languages before being translated.

Some of the accounts were used to promote the IBI across X, LinkedIn, Facebook, Substack and Telegram with AI generated imagery and captions, with other accounts being used to automatically engage with comments by real users on Substack. The operators of the ChatGPT accounts regularly requested performance summaries of these pages in Russian, and used ChatGPT to generate matching profile pictures for some accounts.

One of the features of the IBI website is to advertise the ‘Burke Sovereignty Index’ - designed to measure how well a country performs compared to others across political, economic, technological, informational, cultural, cognitive and military factors.

The Index’s purpose is to make Western countries appear worse than Russia, OpenAI says. Having taken a look at the Index myself it's clear there is no consistency in measurement or comparison. For example, The Vatican City - which is less than half a square kilometer in size - sits above Spain in its average of scores. The Index also gave Russia the highest military score.

The website also includes a list of experts, whose affiliation to the IBI is not referenced. Some among them are pioneers in their fields of study, such as Francis Fukuyama and Noam Chomsky.

Others are former high-ranking members of the US government, such as Mike Pompeo and Joseph Nye. There are even listings for experts who passed away before the IBI was founded, such as Shlomo Avineri and Jiang Ping.

Much of the academic work cited on the IBI website is legitimate, but more often than not has been stolen from its actual author and misattributed to a different author to hide the work’s actual source, OpenAI said. This has been done to give the IBI website credibility and to make it appear authentic.

The overall impact of the IBI and its promotion using social media and ChatGPT is fairly limited, OpenAI noted. Some of the Telegram channels garnered followings between ten to twenty thousand showing a limited breakout to authentic audiences.

But the main thing to take away from this is the level of dedication placed behind the underlying infrastructure of the IBI. The site is designed to look authentic, uses authentic research (even if it is wrongly attributed), and presents itself as a collection of experts. To the layman, a cursory glance at the IBI website would give any of their social media presence a level of authenticity not seen in other social influence campaigns.