Monthly Archives: January 2018

Japanese cryptocurrency exchange loses more than $500 million to hackers

Posted on by

Coincheck said that around 523 million of the exchange’s NEM coins were sent to another account around 3 a.m. local time (1 p.m. ET Thursday), according to a Google translation of a Japanese transcript of the Friday press conference from Logmi. The exchange has about 6 percent of yen-bitcoin trading, ranking fourth by market share on CryptoCompare.

The stolen NEM coins were worth about 58 billion yen at the time of detection, or roughly $534.8 million, according to the exchange. Coincheck subsequently restricted withdrawals of all currencies, including yen, and trading of cryptocurrencies other than bitcoin.

Bloomberg first reported the hack. A CNBC email sent to Coincheck’s listed address bounced back.

Cryptocurrency NEM, which intends to help businesses handle data digitally, briefly fell more than 20 percent Friday before recovering to trade about 10 percent lower near 85 cents, according to CoinMarketCap. Most other major digital currencies, including bitcoin, traded little changed on the day.

Source: Japanese cryptocurrency exchange loses more than $500 million to hackers

Lenovo Fingerprint Manager Pro for Windows has a hardcoded password

Posted on by

A vulnerability has been identified in Lenovo Fingerprint Manager Pro. Sensitive data stored by Lenovo Fingerprint Manager Pro, including users’ Windows logon credentials, is encrypted using a weak algorithm, contains a hard-coded password, and is accessible to all users with local non-administrative access to the system it is installed in.

Source: Lenovo Fingerprint Manager Pro for Windows 7, 8, and 8.1 only (not 10) Insecure Credential Storage

Heat Map Released by Fitness Tracker Reveals Location of Secret Military Bases

Posted on by

Strava which markets itself as a “social-networking app for athletes” publicly made available the global heat map, showing the location of all the rides, runs, swims, and downhills taken by its users, as collected by their smartphones and wearable devices like Fitbit.

Since Strava has been designed to track users’ routes and locations, IUCA analyst Nathan Ruser revealed that the app might have unintentionally mapped out the location of some of the military forces around the world, especially some secret ones from the United States.

With a total of one billion activities logged on the Strava’s activity map, it is a whole lot of useful data from all over the world.

Although Strava’s publicly available activity map was live as of November 2017, Ruser recently noticed that the map includes the fitness routes of army soldiers and agents in secret base locations, including U.S. military bases in Afghanistan and Syria, a suspected CIA base in Somalia and even Area 51.

Source: Heat Map Released by Fitness Tracker Reveals Location of Secret Military Bases

NASA’s Long Dead (since 2007) ‘IMAGE’ Satellite is Alive! – how satellite hunters go to work.

Posted on by

Over the past week the station has been dedicated to an S-band scan looking for new targets and refreshing the frequency list, triggered by the recent launch of the mysterious ZUMA mission. This tends to be a semi-annual activity as it can eat up a lot of observing resources even with much of the data gathering automated the data reviewing is tedious.

Upon reviewing the data from January 20, 2018, I noticed a curve consistent with an satellite in High Earth Orbit (HEO) on 2275.905MHz, darn not ZUMA… This is not uncommon during these searches. So I set to work to identify the source.

A quick identity scan using ‘strf’ (sat tools rf) revealed the signal to come from 2000-017A, 26113, called IMAGE.
[…]
So what was IMAGE? I did a little Googling and discovered that it had been ‘Lost in Space’ since December 18, 2005 after just dropping off the grid suddenly. The mission was designed to image the magnetosphere, more details about that can be found in the press kit.

NASA considered the spacecraft a total loss due to a design flaw that manifested while the spacecraft was in its extended mission. The NASA failure review did however conclude that it was possible for the spacecraft to be revived by permitting a ‘Transponder SSPC reset’ after it passed through eclipse in 2007. One must assume that didn’t occur in 2007 and they gave up.
[…]
Periodically the spacecraft will enter an eclipse and NASA surmised that this may trigger it to restart and apply power back to the communications system. That appears to have happened! As you will note from the plots below the Sun angles are presently good for IMAGE and it may just stay operational for some time to come.

Source: NASA’s Long Dead ‘IMAGE’ Satellite is Alive! – Riddles in the Sky

Dutch agencies provide crucial intel about Russia’s interference in US-elections, US burns the Dutch source

Posted on by

The Cozy Bear hackers are in a space in a university building near the Red Square. The group’s composition varies, usually about ten people are active. The entrance is in a curved hallway. A security camera records who enters and who exits the room. The AIVD hackers manage to gain access to that camera. Not only can the intelligence service now see what the Russians are doing, they can also see who’s doing it. Pictures are taken of every visitor. In Zoetermeer, these pictures are analyzed and compared to known Russian spies.

The Dutch access to the Russian hackers’ network soon pays off. In November, the Russians prepare for an attack on one of their prime targets: the American State Department. By now, they’ve obtained e-mail addresses and the login credentials of several civil servants. They manage to enter the non-classified part of the computer network.

The AIVD and her military counterpart MIVD inform the NSA-liaison at the American embassy in The Hague. He immediately alerts the different American intelligence services.

What follows is a rare battle between the attackers, who are attempting to further infiltrate the State Department, and its defenders, FBI and NSA teams – with clues and intelligence provided by the Dutch. This battle lasts 24 hours, according to American media.

The Russians are extremely aggressive but do not know they’re being spied on. Thanks to the Dutch spies, the NSA and FBI are able to counter the enemy with enormous speed. The Dutch intel is so crucial that the NSA opens a direct line with Zoetermeer, to get the information to the United States as soon as possible.
[…]
President elect Donald Trump categorically refuses to explicitly acknowledge the Russian interference. It would tarnish the gleam of his electoral victory. He has also frequently praised Russia, and president Putin in particular. This is one of the reasons the American intelligence services eagerly leak information: to prove that the Russians did in fact interfere with the elections. And that is why intelligence services have told American media about the amazing access of a ‘western ally’.

This has led to anger in Zoetermeer and The Hague. Some Dutchmen even feel betrayed. It’s absolutely not done to reveal the methods of a friendly intelligence service, especially if you’re benefiting from their intelligence. But no matter how vehemently the heads of the AIVD and MIVD express their displeasure, they don’t feel understood by the Americans. It’s made the AIVD and MIVD a lot more cautious when it comes to sharing intelligence. They’ve become increasingly suspicious since Trump was elected president.

The AIVD hackers are no longer in Cozy Bear’s computer network. The Dutch espionage lasted between 1 and 2,5 years. Hacker groups frequently change their methods and even a different firewall can cut off access.

Source: Dutch agencies provide crucial intel about Russia’s interference in US-elections – Tech – Voor nieuws, achtergronden en columns

Hackers Hijacking CPUs to Mine Cryptocurrency Have Now Invaded YouTube Ads

Posted on by

As Ars Technica first reported on Friday, users on social media started complaining earlier this week that YouTube ads were triggering their anti-virus software. Specifically, the software was recognizing a script from a service called CoinHive. The script was originally released as a sort of altruistic idea that would allow sites to make a little extra income by putting a visitor’s CPU processing power to use by mining a cryptocurrency called Monero. This could be used ethically as long as a site notifies its visitors of what’s happening and doesn’t get so greedy with the CPU usage that it crashes a visitor’s computer. In the case of YouTube’s ads running the script, they were reportedly using up to 80 percent of the CPU and neither YouTube nor the user were told what was happening.

Source: Hackers Hijacking CPUs to Mine Cryptocurrency Have Now Invaded YouTube Ads

Thanks to “consent” buried deep in sales agreements, car manufacturers are tracking tens of millions of US and EU cars

Posted on by

Millions of new cars sold in the US and Europe are “connected,” having some mechanism for exchanging data with their manufacturers after the cars are sold; these cars stream or batch-upload location data and other telemetry to their manufacturers, who argue that they are allowed to do virtually anything they want with this data, thanks to the “explicit consent” of the car owners — who signed a lengthy contract at purchase time that contained a vague and misleading clause deep in its fine-print.

Car manufacturers are mostly warehousing this data (leaving it vulnerable to leaks and breaches, search-warrants, government hacking and unethical employee snooping), and can’t articulate why they’re saving it or how they use it.

Much of this data ends up in “marketplaces” where data-sets from multiple auto-makers are merged, made uniform, and given identifiers that allow them to be cross-referenced with the massive corporate data-sets that already exist, and then offered on the open market to any bidder.

Source: Thanks to “consent” buried deep in sales agreements, car manufacturers are tracking tens of millions of US cars / Boing Boing

Researchers find a way to link TOR / Silk Road BTC expenditure to people using two datasets

Posted on by

To do so, the Qatari researchers first collected dozens of bitcoin addresses used for donations and dealmaking by websites protected by the anonymity software Tor, run by everyone from WikiLeaks to the now-defunct Silk Road. Then they scraped thousands of more widely visible bitcoin addresses from the public accounts of users on Twitter and the popular bitcoin forum Bitcoin Talk.

By merely searching for direct links between those two sets of addresses in the blockchain, they found more than 125 transactions made to those dark web sites’ accounts—very likely with the intention of preserving the senders’ anonymity—that they could easily link to public accounts. Among those, 46 were donations to WikiLeaks. More disturbingly, 22 were payments to the Silk Road. Though they don’t reveal many personal details of those 22 individuals, the researchers say that some had publicly revealed their locations, ages, genders, email addresses, or even full names. (One user who fully identified himself was only a teenager at the time of the transactions.) And the 18 people whose Silk Road transactions were linked to Bitcoin Talk may be particularly vulnerable, since that forum has previously responded to subpoeanas demanding that it unmask a user’s registration details or private messages. “You have irrefutable evidence mapping this profile to this hidden service,” says Yazan Boshmaf, another of the study’s authors.

Source: Your Sloppy Bitcoin Drug Deals Will Haunt You for Years

1.7-Billion-Year-Old Chunk of North America Found Sticking to Australia

Posted on by

Geologists matching rocks from opposite sides of the globe have found that part of Australia was once attached to North America 1.7 billion years ago.

Researchers from Curtin University in Australia examinedrocks from the Georgetown region of northern Queensland. The rocks — sandstone sedimentary rocks that formed in a shallow sea — had signatures that were unknownin Australia but strongly resembled rocks that can be seen in present-day Canada.

The researchers, who described their findings online Jan. 17 in the journal Geology, concluded that the Georgetown area broke away from North America 1.7 billion years ago. Then, 100 million years later, this landmass collided with what is now northern Australia, at the Mount Isa region. […]
Previous research suggested that northeast Australia was near North America, Siberia or North China when the continents came together to form Nuna, Nordsvan and colleagues noted, but scientists had yet to find solid evidence of this relationship.

Source: 1.7-Billion-Year-Old Chunk of North America Found Sticking to Australia

Scientists Found a Way to Make Inexpensive, Solid-Looking 3D Holograms / volumetric displays

Posted on by

Researchers at Brigham Young University in Utah made something they’re calling an Optical Trap Display (OTD). The device traps a tiny opaque particle in mid-air using an invisible laser beam, then moves the beam around a preset path in free space. At the same time, it illuminates the particle with red, green, or blue lights. When the particle moves fast enough, it creates a solid holographic image in the air. Move it even faster, and you can create the illusion of movement.
[…]
“We can think about this image like a 3D-printed object,” lead author Daniel Smalley, an assistant professor in electroholography at Brigham Young University, explained in a Nature video. “A single point was dragged sequentially through all these image points, and as it did, it scattered light. And the accumulated effect of all that scattering and moving was to create this 3D image in space that is visible from all angles.”

Scientifically, what Smalley and his team are creating are known as volumetric images, which differentiates them from 2D-hologram technologies. Other companies and scientists have made devices that create volumetric images, but the researchers say theirs is the first to generate free-floating images that can occupy the same space as other objects, as opposed to volumetric images that need to be contained inside a specially designed field. Other devices often require a much more elaborate set-up as well, while the OTD is relatively cheap, made with commercially available parts and low-cost lasers.
[…]
That said, the device does have its limitations. Namely, that the images produced right now are quite tiny: smaller than a fingernail. Making the images bigger will require the researchers learn how to manipulate more than one particle at a time. And it’s unlikely the device will be usable outdoors for the foreseeable future, since fast moving air particles can muck up the process. Video cameras also have a problem capturing the images the way our eyes or still cameras do—a video’s frame rate makes the image look like it’s flickering, while our eyes only see a solid image.

Source: Scientists Found a Way to Make Inexpensive, Solid-Looking 3D Holograms

Microsoft whips out tool so you can measure Windows 10’s data-slurping creepiness

Posted on by

The software giant has produced a tool that’s claimed to show users how much personal information its Windows 10 operating system collects and sends back to Redmond for diagnostics.The application is dubbed Diagnostic Data Viewer, and is free from the Windows Store. It reveals that stuff like the computer’s device name, OS version, and serial number, as well as more detailed records such as installed apps, preference settings, and details on each application’s usage, are beamed back to Microsoft.
[…]
Microsoft says the Diagnostic Data Viewer will run separately from the Windows Privacy Dashboard that is bundled with Windows 10. That app will also be upgraded to provide users with more information on data collection, including activity history for the user’s Microsoft account.

Microsoft is also planning an update to the app to allow users to export dashboard reports, view media consumption information, and delete reported data (for some reason this isn’t already allowed).

The Dashboard and Data Viewer apps arrive after Microsoft was taken to task by governments for what many saw as overly intrusive data collection by Windows 10.

Source: Microsoft whips out tool so you can measure Windows 10’s data-slurping creepiness • The Register

Engineers design artificial synapse for “brain-on-a-chip” hardware

Posted on by

engineers at MIT have designed an artificial synapse in such a way that they can precisely control the strength of an electric current flowing across it, similar to the way ions flow between neurons. The team has built a small chip with artificial synapses, made from silicon germanium. In simulations, the researchers found that the chip and its synapses could be used to recognize samples of handwriting, with 95 percent accuracy.
[…]
Most neuromorphic chip designs attempt to emulate the synaptic connection between neurons using two conductive layers separated by a “switching medium,” or synapse-like space. When a voltage is applied, ions should move in the switching medium to create conductive filaments, similarly to how the “weight” of a synapse changes.

But it’s been difficult to control the flow of ions in existing designs. Kim says that’s because most switching mediums, made of amorphous materials, have unlimited possible paths through which ions can travel — a bit like Pachinko, a mechanical arcade game that funnels small steel balls down through a series of pins and levers, which act to either divert or direct the balls out of the machine.

Like Pachinko, existing switching mediums contain multiple paths that make it difficult to predict where ions will make it through. Kim says that can create unwanted nonuniformity in a synapse’s performance.

“Once you apply some voltage to represent some data with your artificial neuron, you have to erase and be able to write it again in the exact same way,” Kim says. “But in an amorphous solid, when you write again, the ions go in different directions because there are lots of defects. This stream is changing, and it’s hard to control. That’s the biggest problem — nonuniformity of the artificial synapse.”

A perfect mismatch

Instead of using amorphous materials as an artificial synapse, Kim and his colleagues looked to single-crystalline silicon, a defect-free conducting material made from atoms arranged in a continuously ordered alignment. The team sought to create a precise, one-dimensional line defect, or dislocation, through the silicon, through which ions could predictably flow.

To do so, the researchers started with a wafer of silicon, resembling, at microscopic resolution, a chicken-wire pattern. They then grew a similar pattern of silicon germanium — a material also used commonly in transistors — on top of the silicon wafer. Silicon germanium’s lattice is slightly larger than that of silicon, and Kim found that together, the two perfectly mismatched materials can form a funnel-like dislocation, creating a single path through which ions can flow.

The researchers fabricated a neuromorphic chip consisting of artificial synapses made from silicon germanium, each synapse measuring about 25 nanometers across. They applied voltage to each synapse and found that all synapses exhibited more or less the same current, or flow of ions, with about a 4 percent variation between synapses — a much more uniform performance compared with synapses made from amorphous material.

They also tested a single synapse over multiple trials, applying the same voltage over 700 cycles, and found the synapse exhibited the same current, with just 1 percent variation from cycle to cycle.

Source: Engineers design artificial synapse for “brain-on-a-chip” hardware | MIT News

Easy to watch over your shoulder at your Tindering

Posted on by

Checkmarx researchers disclosed two flaws (CVE-2018-6017, CVE-2018-6018) and a proof of concept (see video below) for an app that could sit on the wireless network of, say, an airport or hotel and observe actions including profile views, swipes, and likes.

The first issue, CVE-2018-6017, results from the Tinder’s app’s use of insecure HTTP connections to access profile pictures. By observing traffic on a public Wi-Fi network (or some other snooping position on a network), a miscreant could see what profiles are being viewed and match them with the victim’s device. If a scumbag has compromised the network when the victim turns on the Tinder app, the victim’s profile information could also be intercepted and viewed.

The second flaw, CVE-2018-6018, is what allows the attacker to see specific actions like swipes and likes. Though the Tinder API uses HTTPS connections for traffic it handles, the specific actions each move their encrypted packets with a set length.

By checking packets for specific byte sizes (278 bytes for a left swipe to reject, 374 bytes for a right swipe to approve, and 581 bytes for a like), the attacker could combine the actions with the unsecured HTTP profile and photo traffic to work out who is swiping who.

The recommendation for users is simple enough: avoid public Wi-Fi networks wherever possible. Developers, meanwhile, should take steps to make sure all app traffic is secured.

Source: Swipe fright: Tinder hackers may know how desperate you really are • The Register

It’s 2018 and your Macs, iPhones can be pwned by playing evil music: lots of patches

Posted on by

Apple has released security patches for iOS and macOS that include, among other things, Meltdown and Spectre fixes. The new versions should be installed as soon as possible.
[…]
Less-hyped, but still serious, are vulnerabilities in the macOS kernel that include an exploitable race condition (CVE-2018-4092), a validation issue (CVE-2018-4093), and memory initialization bug (CVE-2018-4090) that could also allow restricted memory to be read.
[…]
Two other kernel flaws, CVE-2018-4097 and CVE-2018-4082, allow an app to run code as the kernel, thus hijacking the whole machine. The first is “a logic issue [..] addressed with improved validation,” discovered by Resecurity Inc, and the second “a memory corruption issue […] addressed through improved input validation” found and reported by Russ Cox of Google.

Other noteworthy bugs include CVE-2018-4094, a bug in both Sierra and High Sierra discovered by five researchers at Yonsei University in Seoul, South Korea. The memory corruption bug allows remote code execution attacks simply by processing a maliciously crafted audio file.

The WebKit browser engine received three fixes for remote code execution flaws (CVE-2018-4088, CVE-2018-4089,CVE-2018-4096) that are also patched in Safari with version 11.0.3.

The QuartzCore component contained a remote code execution flaw (CVE-2018-4085) that can be exploited via web content, while Wi-Fi had a restricted memory access flaw (CVE-2018-4084), and a bug in the operating system’s process sandbox (CVE-2018-4091) could allow programs to get around access restrictions.
Meanwhile, on mobile…

For iOS devices, Apple has served up the 11.2.5 update. It includes a fix for the CVE-2018-4094 audio-file remote-code execution flaw as well as the three kernel memory leak bugs (CVE-2018-4090, CVE-2018-4092, CVE-2018-4093), and the QuartzCore, and WebKit flaws included in the macOS update.

Researcher Abraham “cheesecakeufo” Masri gets credit for CVE-2018-4100, a patched flaw in iOS that allows text messages to crash the iPhone, while Zimperium zLabs’ Rani Idan was credited for CVE-2018-4095 and CVE-2018-4087, a pair of arbitrary code execution flaws in Core Bluetooth.

Masri’s text-message bug, CVE-2018-4100, is also fixed in macOS’s LinkPresentation code to prevent weird text in webpages and messages from stalling desktop apps.

Many of the same iOS flaws are addressed for the Apple Watch in watchOS 4.2.2, and in the AppleTV with tvOS 11.2.5.

Source: It’s 2018 and your Macs, iPhones can be pwned by playing evil music • The Register

Bizzarely these are only now being patched?

YouTube’s Support for Musicians Comes With a non-disparagement contract. Wait, what? It’s legal to agree to this before you know what they will do to you?!

Posted on by

YouTube has asked musicians to agree not to disparage the streaming-video service in exchange for promotional support, according to people familiar with the matter, a way to quell persistent criticism by artists.

In recent months, YouTube has given a handful of musicians a couple hundred thousand dollars to produce videos and promoted their work on billboards, part of a larger campaign to improve the site’s relationship with the music industry.

Yet such support comes with a catch, with some musicians required to promise the won’t say negative things about YouTube, said the people, who asked not to be identified discussing private business transactions. Non-disparagement agreements are common in business, but YouTube’s biggest direct competitors in music don’t require them, the people said.

YouTube’s non-disparagement agreements go beyond a requirement not to criticize the video site, one of the people said, without going into detail. YouTube requires many partners to agree to such conditions, including creators who make original series for its paid service, the person said.

YouTube has taken extra precautions in recent deals due to an incident with director Morgan Spurlock. Spurlock caught YouTube off-guard when he admitted in December to sexual misconduct just three months after the company acquired the rights to release his latest film, a sequel to the Oscar-nominated documentary “Super Size Me.”

YouTube has more reason to worry about artists’ public comments than most companies. Songwriters and artists have assailed the site for what they view as meager revenue-sharing and poor protections against piracy. Dozens of musicians signed a petition in 2016 rebuking free music services and pushing for Congress to make YouTube more responsible for policing copyright violations.

Source: YouTube’s Support for Musicians Comes With a Catch – Bloomberg

Surely non-disparagement contracts can’t be considederd at all legal?

Skype, Signal, Slack, other apps inherit Electron vuln

Posted on by

Electron is a node.js and Chromium framework that lets developers use Web technologies (JavaScript, HTML and CSS) to build desktop apps. It’s widely-used: Skype, Slack, Signal, a Basecamp implementation and a desktop WordPress app all count themselves as adopters.

Slack users should update to version 3.0.3 or better, and the latest version of Skype for Windows is protected, Microsoft told Cyberscoop.

Electron has only published limited details of CVE-2018-1000006, but it affects Windows applications that use custom protocol handlers in the framework.

Here’s what the advisory has to say:

“Electron apps designed to run on Windows that register themselves as the default handler for a protocol, like myapp://, are vulnerable.

“Such apps can be affected regardless of how the protocol is registered, e.g. using native code, the Windows registry, or Electron’s app.setAsDefaultProtocolClient API.

A ray of sunshine to close: “macOS and Linux are not vulnerable to this issue”, Electron’s developers said.

Source: Skype, Signal, Slack, other apps inherit Electron vuln

Intel patches for Spectre cause reboots, Intel tells people to stop installing them and also please help test for them

Posted on by

As we start the week, I want to provide an update on the reboot issues we reported Jan. 11. We have now identified the root cause for Broadwell and Haswell platforms, and made good progress in developing a solution to address it. Over the weekend, we began rolling out an early version of the updated solution to industry partners for testing, and we will make a final release available once that testing has been completed.

Based on this, we are updating our guidance for customers and partners:

We recommend that OEMs, cloud service providers, system manufacturers, software vendors and end users stop deployment of current versions, as they may introduce higher than expected reboots and other unpredictable system behavior. For the full list of platforms, see the Intel.com Security Center site.
We ask that our industry partners focus efforts on testing early versions of the updated solution so we can accelerate its release. We expect to share more details on timing later this week.
We continue to urge all customers to vigilantly maintain security best practice and for consumers to keep systems up-to-date.

Source: Root Cause of Reboot Issue Identified; Updated Guidance for Customers and Partners

Amazon.com: Dr.meter Wifi Endoscope, 2.0 Megapixels HD Digital Inspection Camera with 5 Meters(16.4ft) Cable and 8 LEDs in the Camera Handheld Borescope Supports Windows iOS and Android System: Camera & Photo

Posted on by

Amazon.com: Dr.meter Wifi Endoscope, 2.0 Megapixels HD Digital Inspection Camera with 5 Meters(16.4ft) Cable and 8 LEDs in the Camera Handheld Borescope Supports Windows iOS and Android System: Camera & Photo

Source: Amazon.com: Dr.meter Wifi Endoscope, 2.0 Megapixels HD Digital Inspection Camera with 5 Meters(16.4ft) Cable and 8 LEDs in the Camera Handheld Borescope Supports Windows iOS and Android System: Camera & Photo

Revealing True Emotions Through Micro-Expressions: A Machine Learning Approach

Posted on by

Micro-expressions–involuntary, fleeting facial movements that reveal true emotions–hold valuable information for scenarios ranging from security interviews and interrogations to media analysis. They occur on various regions of the face, last only a fraction of a second, and are universal across cultures. In contrast to macro-expressions like big smiles and frowns, micro-expressions are extremely subtle and nearly impossible to suppress or fake. Because micro-expressions can reveal emotions people may be trying to hide, recognizing micro-expressions can aid DoD forensics and intelligence mission capabilities by providing clues to predict and intercept dangerous situations. This blog post, the latest highlighting research from the SEI Emerging Technology Center in machine emotional intelligence, describes our work on developing a prototype software tool to recognize micro-expressions in near real-time.

Source: Revealing True Emotions Through Micro-Expressions: A Machine Learning Approach

Facebook open sources Detectron, object detection framework in caffe2

Posted on by

Today, Facebook AI Research (FAIR) open sourced Detectron — our state-of-the-art platform for object detection research.

The Detectron project was started in July 2016 with the goal of creating a fast and flexible object detection system built on Caffe2, which was then in early alpha development. Over the last year and a half, the codebase has matured and supported a large number of our projects, including Mask R-CNN and Focal Loss for Dense Object Detection, which won the Marr Prize and Best Student Paper awards, respectively, at ICCV 2017. These algorithms, powered by Detectron, provide intuitive models for important computer vision tasks, such as instance segmentation, and have played a key role in the unprecedented advancement of visual perception systems that our community has achieved in recent years.

Source: Facebook open sources Detectron – Facebook Research

Active learning machine learns to create new quantum experiments

Posted on by

We present an autonomous learning model which learns to design such complex experiments, without relying on previous knowledge or often flawed intuition. Our system not only learns how to design desired experiments more efficiently than the best previous approaches, but in the process also discovers nontrivial experimental techniques. Our work demonstrates that learning machines can offer dramatic advances in how experiments are generated.
[…]
The artificial intelligence system learns to create a variety of entangled states and improves the efficiency of their realization. In the process, the system autonomously (re)discovers experimental techniques which are only now becoming standard in modern quantum optical experiments—a trait which was not explicitly demanded from the system but emerged through the process of learning. Such features highlight the possibility that machines could have a significantly more creative role in future research.

Source: Active learning machine learns to create new quantum experiments

The artificial agent develops new experiments by virtually placing mirrors, prisms or beam splitters on a virtual lab table. If its actions lead to a meaningful result, the agent has a higher chance of finding a similar sequence of actions in the future. This is known as a reinforcement learning strategy.

Read more at: https://phys.org/news/2018-01-artificial-agent-quantum.html#jCp

Breakthrough study shows how plants sense the world

Posted on by

Plants lack eyes and ears, but they can still see, hear, smell and respond to environmental cues and dangers—especially to virulent pathogens. They do this with the aid of hundreds of membrane proteins that can sense microbes or other stresses.

Only a small portion of these sensing proteins have been studied through classical genetics, and knowledge on how these sensors function by forming complexes with one another is scarce. Now, an international team of researchers from four nations—including Shahid Mukhtar, Ph.D., and graduate student Timothy “TC” Howton at the University of Alabama at Birmingham—has created the first network map for 200 of these proteins. The map shows how a few key proteins act as master nodes critical for network integrity, and the map also reveals unknown interactions.
[…]
The model plant Arabidopsis thaliana contains more than 600 different receptor kinases—50 times more than humans—that are critical for plant growth, development, immunity and stress response. Until now, only a handful had known functions, and little was known about how the receptors might interact with each to coordinate responses to often-conflicting signals.

For the Nature study, the Belkhadir lab tested interactions between extracellular domains of the receptors in a pairwise manner, working with more than 400 extracellular domains of the LRR-receptor kinases and performing 40,000 interaction tests.

Positive interactions were used to produce an interaction map displaying how those receptor kinases interact with one another, in a total of 567 high-confidence interactions.
[…]
At UAB, Mukhtar and Howton tested 372 intracellular domains of the LRR-receptor kinases whose extracellular domains had shown high-confidence interactions, to see if the intracellular domains also showed strong interactions. More than half did, suggesting that the formation of these receptor complexes is required for signal perception and downstream signal transduction. This also indicates a validation of the biological significance of the extracellular domain interaction
[…]
The Nature study included two major surprises, says Adam Mott, Ph.D., University of Toronto. LRR-receptor kinases that have small extracellular domains interacted with other LRR-receptor kinases more often than those that have large domains. This suggests that the small receptor kinases evolved to coordinate actions of the other receptors. Second, researchers identified several unknown LRR-receptor kinases that appear critical for network integrity.

Source: Breakthrough study shows how plants sense the world

So yes, vegetarians, plants do live and feel and see and detect, you murderers!

American Reich restarts dodgy spying program – just as classified surveillance abuse memo emerges

Posted on by

The US Senate reauthorized a controversial NSA spying program on Thursday – and then, because it’s 2018 and nothing matters any more, embarked on a partisan battle over a confidential memo that outlines Uncle Sam’s alleged abuse of surveillance powers.

Despite numerous appeals, press conferences, competing legislation and speeches outlining abuse of the program, on Thursday a majority of senators ignored pleas for a proper warrant requirement to be added to the program – that would require the Feds to always go to a judge before searching the communications of a US citizen – and voted to continue the surveillance for a further six years.
[…]

However, the agents won’t need a warrant if they are looking into…

Death, kidnapping, serious bodily injury, offense against a minor, destruction of critical infrastructure, cybersecurity, transnational crime, and human trafficking

…which are basically the crimes the FBI investigates. Ergo, it’s unlikely the Feds will seek warrants to search the NSA’s section 702 data stores for stuff on American citizens.

Just hours after the section 702 program was given the final green light before the president can sign on the dotted line, the Senate’s intelligence committee approved the release of a confidential four-page memo alleging previous abuse of the FISA spying program to the rest of Congress. The public is unable to see it.

The mysterious missive was drafted by House intelligence committee chairman Devin Nunes (R-CA), and of course it could be looney-tunes nonsense. Regardless, a number of lawmakers who only now just read the memo have said that had they been aware of the misconduct detailed in the memo, they would not having voted for the reauthorization of section 702 of the FISA Amendments Act.

Republican lawmakers in particular, having seen the report, embarked on a fiercely partisan campaign accusing the Obama administration of snooping on the Trump presidential campaign using the foreigner-targeting FISA laws.
[…]
The hypocrisy is stunning, even for Congress. One moment, Republicans insist a Big Brother program is needed to foil terrorists abroad, ignoring its ability to pry into the lives of Americans. The next moment, Republicans are upset the same set of laws were indeed used to pry into the lives of Americans – some of the folks working for Team Trump.
[…]
Congresscriters who now claim to be shocked – shocked! – about FISA’s sweeping capabilities – have been willfully ignoring determined efforts in both the House and the Senate in recent weeks to have a full debate about the extent of spying powers that the US government possesses
[…]

In one part of that speech, he even went into great detail over how the Director of National Intelligence had publicly denied that Uncle Sam was able to intercept communications between US citizens on US soil – and then, when challenged subsequently, claimed to have heard a different question.

When Wyden asked the same question again, the director refused to answer, claiming that it was classified. “How can a topic in which the director of national intelligence has already given an answer in public suddenly become classified?” asked Wyden in his speech.

But if all that wasn’t enough, we will all likely be subject to one more head-holding display of hypocrisy when President Trump signs the reauthorization bill into law – despite the fact congressfolk are railing against the same set of FISA laws being used to spy on his campaign.

Source: America restarts dodgy spying program – just as classified surveillance abuse memo emerges • The Register

Security Breaches Don’t Affect Stock Price. Or don’t they?

Posted on by

Abstract: This report assesses the impact disclosure of data breaches has on the total returns and volatility of the affected companies’ stock, with a focus on the results relative to the performance of the firms’ peer industries, as represented through selected indices rather than the market as a whole. Financial performance is considered over a range of dates from 3 days post-breach through 6 months post-breach, in order to provide a longer-term perspective on the impact of the breach announcement.

Key findings:

While the difference in stock price between the sampled breached companies and their peers was negative (1.13%) in the first 3 days following announcement of a breach, by the 14th day the return difference had rebounded to + 0.05%, and on average remained positive through the period assessed.

For the differences in the breached companies’ betas and the beta of their peer sets, the differences in the means of 8 months pre-breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.

For the differences in the breached companies’ beta correlations against the peer indices pre- and post-breach, the difference in the means of the rolling 60 day correlation 8 months pre- breach versus post-breach was not meaningful at 90, 180, and 360 day post-breach periods.

In regression analysis, use of the number of accessed records, date, data sensitivity, and malicious versus accidental leak as variables failed to yield an R2 greater than 16.15% for response variables of 3, 14, 60, and 90 day return differential, excess beta differential, and rolling beta correlation differential, indicating that the financial impact on breached companies was highly idiosyncratic.

Based on returns, the most impacted industries at the 3 day post-breach date were U.S. Financial Services, Transportation, and Global Telecom. At the 90 day post-breach date, the three most impacted industries were U.S. Financial Services, U.S. Healthcare, and Global Telecom.

The market isn’t going to fix this. If we want better security, we need to regulate the market.

Source: Security Breaches Don’t Affect Stock Price – Schneier on Security

However, the dataset:

The analysis began with a dataset of 235 recorded data breaches dating back to 2005

is very very small and misses some of the huge breaches such as Equifax.
There is a very telling table in the results that does show that if a breach is hugely public, then share prices do indeed plummet:

So it may also have something to do with how the company handles the breach and how much media attention is out there.

OnePlus say 40,000 customers credit card details breached

Posted on by
1. What happened One of our systems was attacked, and a malicious script was injected into the payment page code to sniff out credit card info while it was being entered. The malicious script operated intermittently, capturing and sending data directly from the user's browser. It has since been eliminated. We have quarantined the infected server and reinforced all relevant system structures. 2. Who's affected Some users who entered their credit card info on oneplus.net between mid-November 2017 and January 11, 2018, may be affected. Credit card info (card numbers, expiry dates and security codes) entered at oneplus.net during this period may be compromised. Users who paid via a saved credit card should NOT be affected. Users who paid via the "Credit Card via PayPal" method should NOT be affected. Users who paid via PayPal should NOT be affected. We have contacted potentially affected users via email.

Source: [Jan 19 Update] An Update on Credit Card Security – OnePlus Forums