Coinbase empies bank accounts without consent

Digital currency exchange Coinbase said it inadvertently charged punters for transactions they never made, effectively draining money from their bank accounts. It has promised to refund the money taken.

For the last few days, netizens have been complaining that funds had vanished from bank accounts linked to Coinbase without reason. Some people report multiple charges being made that drained their accounts and left them with heavy overcharge fees and the inability to pay bills and rent.

“We can confirm that the unexpected charges are originating from our payment processing network, and are related to charges from previous purchases,” a company rep called Olga said on Reddit.

“To the best of our knowledge, these unexpected charges are not permanent and are in the process of being refunded. We apologize for the poor experience.”

Rather bizarrely the post also asks those people affected by the errors to post up details of the transactions, including their location, the bank used, the number of bogus charges and the case number from the bank. From a security situation that’s very poor practice indeed.

Source: Oh sh-itcoin! Crypto-dosh swap-shop Coinbase empties punters’ bank accounts • The Register

Electronics-recycling innovator faces prison for trying to extend computers’ lives

Eric Lundgren is obsessed with recycling electronics.

He built an electric car out of recycled parts that far outdistanced a Tesla in a test. He launched what he thinks is the first “electronic hybrid recycling” facility in the United States, which turns discarded cellphones and other electronics into functional devices, slowing the stream of harmful chemicals and metals into landfills and the environment. His Chatsworth company processes more than 41 million pounds of e-waste each year and counts IBM, Motorola and Sprint among its clients.

But an idea Lundgren had to prolong the life of personal computers could land him in prison.

Prosecutors said the 33-year-old ripped off Microsoft Corp. by manufacturing 28,000 counterfeit discs with the company’s Windows operating system on them. He was convicted of conspiracy and copyright infringement, which brought a 15-month prison sentence and a $50,000 fine.

In a rare move though, a federal appeals court has granted an emergency stay of the sentence, giving Lundgren another chance to make his argument that the whole thing was a misunderstanding. Lundgren does not deny that he made the discs or that he hoped to sell them. But he says this was no profit-making scheme. By his account, he just wanted to make it easier to extend the usefulness of secondhand computers — keeping more of them out of the trash.

The case centers on “restore discs,” which can be used only on computers that already have the licensed Windows software and can be downloaded free from the computer’s manufacturer, in this case Dell. The discs are routinely provided to buyers of new computers to enable them to reinstall their operating systems if the computers’ hardware fails or must be wiped clean. But they often are lost by the time used computers find their way to a refurbisher.

Lundgren said he thought electronics companies wanted the reuse of computers to be difficult so that people would buy new ones. “I started learning what planned obsolescence was,” he said, “and I realized companies make laptops that only lasted as long as the insurance would last. It infuriated me. That’s not what a healthy society should have.”

He thought that producing and selling restore discs to computer refurbishers — saving them the hassle of downloading the software and burning new discs — would encourage more secondhand sales. In his view, the new owners were entitled to the software, and this just made it easier.

The government, and Microsoft, did not see it that way. Federal prosecutors in Florida obtained a 21-count indictment against Lundgren and his business partner, and Microsoft filed a letter seeking $420,000 in restitution for lost sales. Lundgren claims that the assistant U.S. attorney on the case told him, “Microsoft wants your head on a platter and I’m going to give it to them.”
[…]
In 2013, federal authorities intercepted shipments of 28,000 restore discs that Lundgren had manufactured in China and sent to his sales partner in Florida. The discs had labels nearly identical to the discs provided by Dell for its computers and had the Windows and Dell logos. “If I had just written ‘Eric’s Restore Disc’ on there, it would have been fine,” Lundgren said.

As a result of violating the copyright of Windows and Dell, Lundgren pleaded guilty to two of the 21 counts against him. But he believed that because the discs had no retail value and were seized before they were sold, he would not receive any prison time. His sentence was based on the financial loss involved.

Source: Electronics-recycling innovator faces prison for trying to extend computers’ lives

Russians behind bars in US after nicking $300m+ in credit-card hacks

Two Russian criminals have been sent down in America after pleading guilty to helping run the largest credit-card hacking scam in US history.Muscovites Vladimir Drinkman, 37, and Dmitriy Smilianets, 34, ran a massive criminal ring that spent months hacking companies to get hold of credit and debit card information. They then sold it online to the highest bidders, who then recouped their investment by ripping off companies and citizens around the world.”Drinkman and Smilianets not only stole over 160 million credit card numbers from credit card processors, banks, retailers, and other corporate victims, they also used their bounty to fuel a robust underground market for hacked information,” said acting assistant attorney general John Cronan on Thursday.
[…]
Rytikov, prosecutors allege, acted as the group’s ISP, supplying internet access that the gang knew would be unlogged and unrecorded. Smilianets handled the sales side, working dark web forums to find buyers for the cards at a cost of $50 per EU card, $10 for American accounts, and $15 for Canadian credit cards.

NASDAQ, 7-Eleven, Carrefour, JCP, Hannaford, Heartland, Wet Seal, Commidea, Dexia, JetBlue, Dow Jones, Euronet, Visa Jordan, Global Payment, Diners Singapore and Ingenicard were among the victims of the gang, the Feds claim. The final cost is difficult to estimate but just three of the companies targeted reported losses of over $300m thanks to the gang.

Source: Russians behind bars in US after nicking $300m+ in credit-card hacks • The Register

Cleaning products as large a source of urban air pollution as cars

Household cleaners, paints and perfumes have become substantial sources of urban air pollution as strict controls on vehicles have reduced road traffic emissions, scientists say.

Researchers in the US looked at levels of synthetic “volatile organic compounds”, or VOCs, in roadside air in Los Angeles and found that as much came from industrial and household products refined from petroleum as from vehicle exhaust pipes.

The compounds are an important contributor to air pollution because when they waft into the atmosphere, they react with other chemicals to produce harmful ozone or fine particulate matter known as PM2.5. Ground level ozone can trigger breathing problems by making the airways constrict, while fine airborne particles drive heart and lung disease.
Ammonia emissions rise in UK, as other air pollutant levels fall
Read more

In Britain and the rest of Europe, air pollution is more affected by emissions from diesel vehicles than in the US, but independent scientists said the latest work still highlighted an important and poorly understood source of pollution that is currently unregulated.

“This is about all those bottles and containers in your kitchen cabinet below the sink and in the bathroom. It’s things like cleaners, personal products, paints and glues,” said Joost de Gouw, an author on the study at the University of Colorado in Boulder.

Source: Cleaning products a big source of urban air pollution, say scientists | Environment | The Guardian

Koinz Trading Bitcoin mining pyramid game enters receivership

At least 60 people fall for Koinz Trading, that claimed to buy and run a BTC miner for you for the price of EUR 6100 + EUR 23 per month. Payments stopped in September. Rumor has it that the founder Barry van Mourik was selling the computers to pay for his debts.

Zeker zestig gedupeerden van Koinz Trading, het Nederlandse bedrijf dat klanten zogenoemde Miners S9-machines had beloofd, zijn hun geld zo goed als zeker kwijt. Het bedrijf is woensdag door de rechtbank in Amsterdam failliet verklaard. Bij de politie zijn tientallen aangiften binnengekomen.

Source: Bitcoinfabriek Koinz Trading failliet – Emerce

IBM Watson to generate sales solutions

“We’ve trained Watson on our standard solutions and offerings, plus all the prior solutions IBM has designed for large enterprises,” the corporate files state. “This means we can review a client’s RFP [request for proposal] and come up with a new proposed architecture and technical solution design for a state of the art system that can run enterprise businesses at scale.” Proposed solutions will be delivered “in minutes,” it is claimed.
[…]
IBM is not leaving all the work to Watson: a document we’ve seen also details “strong governance processes to ensure high quality solutions are delivered globally.”

Big Blue’s explanation for cognitive, er, solutioning’s role is that it will be “greatly aiding the work of the Technical Solutions Managers” rather than replacing them.

Source: If you don’t like what IBM is pitching, blame Watson: It’s generating sales ‘solutions’ now • The Register

Apple Is Rushing to Fix the Telugu Bug as Assholes Use It to ‘Bomb’ People’s iPhones and Macs

While many bugs are relatively benign, often getting patched before the user knows anything is wrong, the latest plague to hit Apple devices is already wreaking havoc on internet.

The issue, which has become known as the Telugu bug, gives people the ability to crash a wide range of iPhone, Mac, and iPad apps just by sending a single character from the third most spoken language in India.

To help address the situation, Apple says its already working on a patch that will fix the bug, which should arrive in the form of an intermediary update before iOS 11.3 (which is currently in beta) gets officially released.

However, in the meantime, some more mean-spirited users have taken to using the Telugu symbol to “bomb” other peoples devices. Motherboard has reported that by adding the symbol to a user’s Twitter name, you can crash the iOS Twitter app simply by liking someone’s tweet. And while it’s possible to address the issue by uninstalling and reinstalling the Twitter app, there’s not much stopping the same person from liking another tweet and causing the app to go haywire again.

Others have gotten even more devious, such as a security researcher who added the symbol to his Uber handle, which would crash the app anytime a driver with an iPhone tried to pick them up. And then there’s Darren Martyn, who posted a video on Twitter where he crashes people’s Mac networking app after he added the Telugu symbol to the name of a Wi-Fi network.

Source: Apple Is Rushing to Fix the Telugu Bug as Assholes Use It to ‘Bomb’ People’s iPhones and Macs

A Hacker Has Wiped a Spyware Company’s Servers—Again

Last year, a vigilante hacker broke into the servers of a company that sells spyware to everyday consumers and wiped their servers, deleting photos captured from monitored devices. A year later, the hacker has done it again.

Thursday, the hacker said he started wiping some cloud servers that belong to Retina-X Studios, a Florida-based company that sells spyware products targeted at parents and employers, but that are also used by people to spy on their partners without their consent.

Retina-X was one of two companies that were breached last year in a series of hacks that exposed the fact that many otherwise ordinary people surreptitiously install spyware on their partners’ and children’s phones in order to spy on them. This software has been called “stalkerware” by some. This spyware allows people to have practically full access to the smartphone or computer of their targets. Whoever controls the software can see the photos the target snaps with their phone, read their text messages, or see what websites they go to, and track their location.

Source: A Hacker Has Wiped a Spyware Company’s Servers—Againp – Motherboard

Yay to the hackers!

macOS may lose data on APFS-formatted disk images

This week we reported to Apple a serious flaw in macOS that can lead to data loss when using an APFS-formatted disk image. Until Apple issues a macOS update that resolves this problem, we’re dropping support for APFS-formatted disk images.

Note: What I describe below applies to APFS sparse disk images only — ordinary APFS volumes (e.g. your SSD startup disk) are not affected by this problem. While the underlying problem here is very serious, this is not likely to be a widespread problem, and will be most applicable to a small subset of backups. Disk images are not used for most backup task activity, they are generally only applicable when making backups to network volumes. If you make backups to network volumes, read on to learn more.
[…]
Earlier this week I noticed that an APFS-formatted sparsebundle disk image volume showed ample free space, despite that the underlying disk was completely full. Curious, I copied a video file to the disk image volume to see what would happen. The whole file copied without error! I opened the file, verified that the video played back start to finish, checksummed the file – as far as I could tell, the file was intact and whole on the disk image. When I unmounted and remounted the disk image, however, the video was corrupted.

Source: macOS may lose data on APFS-formatted disk images | Carbon Copy Cloner | Bombich Software

Missing data hinder replication of artificial intelligence studies

Last year, computer scientists at the University of Montreal (U of M) in Canada were eager to show off a new speech recognition algorithm, and they wanted to compare it to a benchmark, an algorithm from a well-known scientist. The only problem: The benchmark’s source code wasn’t published. The researchers had to recreate it from the published description. But they couldn’t get their version to match the benchmark’s claimed performance, says Nan Rosemary Ke, a Ph.D. student in the U of M lab. “We tried for 2 months and we couldn’t get anywhere close.”
[…]
The most basic problem is that researchers often don’t share their source code. At the AAAI meeting, Odd Erik Gundersen, a computer scientist at the Norwegian University of Science and Technology in Trondheim, reported the results of a survey of 400 algorithms presented in papers at two top AI conferences in the past few years. He found that only 6% of the presenters shared the algorithm’s code. Only a third shared the data they tested their algorithms on, and just half shared “pseudocode”—a limited summary of an algorithm. (In many cases, code is also absent from AI papers published in journals, including Science and Nature.)
[…]
Assuming you can get and run the original code, it still might not do what you expect. In the area of AI called machine learning, in which computers derive expertise from experience, the training data for an algorithm can influence its performance. Ke suspects that not knowing the training for the speech-recognition benchmark was what tripped up her group. “There’s randomness from one run to another,” she says. You can get “really, really lucky and have one run with a really good number,” she adds. “That’s usually what people report.”
[…]
Henderson’s experiment was conducted in a test bed for reinforcement learning algorithms called Gym, created by OpenAI, a nonprofit based in San Francisco, California. John Schulman, a computer scientist at OpenAI who helped create Gym, says that it helps standardize experiments. “Before Gym, a lot of people were working on reinforcement learning, but everyone kind of cooked up their own environments for their experiments, and that made it hard to compare results across papers,” he says.

IBM Research presented another tool at the AAAI meeting to aid replication: a system for recreating unpublished source code automatically, saving researchers days or weeks of effort. It’s a neural network—a machine learning algorithm made of layers of small computational units, analogous to neurons—that is designed to recreate other neural networks. It scans an AI research paper looking for a chart or diagram describing a neural net, parses those data into layers and connections, and generates the network in new code. The tool has now reproduced hundreds of published neural networks, and IBM is planning to make them available in an open, online repository.

Source: Missing data hinder replication of artificial intelligence studies | Science | AAAS

A phishing attack scored credentials for more than 50,000 Snapchat users

In late July, Snap’s director of engineering emailed the company’s team in response to an unfolding privacy threat. A government official from Dorset in the United Kingdom had provided Snap with information about a recent attack on the company’s users: a publicly available list, embedded in a phishing website named klkviral.org, that listed 55,851 Snapchat accounts, along with their usernames and passwords.

The attack appeared to be connected to a previous incident that the company believed to have been coordinated from the Dominican Republic, according to emails obtained by The Verge. Not all of the account credentials were valid, and Snap had reset the majority of the accounts following the initial attack. But for some period of time, thousands of Snapchat account credentials were available on a public website.
[…]
Snap says it uses machine-learning techniques to look for suspicious links being sent within the app, and proactively blocks thousands of suspicious URLs per year. Users who were affected by the July attack were notified that their passwords had been reset via an email from the company.

In the July case, the company noticed that a single device had been logging into a large number of accounts and began flagging it as suspicious. But thousands of accounts had already been compromised.
[…]
It is unclear how long the attack went on, or when the attack Dominican Republic attack had begun. But by the morning of July 24th, Google had blocked klkviral.org from appearing in search results and flagged it as a malicious site for people trying to visit it. (Snap works with Google and other tech companies to maintain a list of known malicious sites.)

The accounts compromised in July represent a tiny fraction of Snap’s 187 million active users. But the incident illustrates how sites set up to mimic login screens can do an outsized amount of damage — and how companies must increasingly rely on machine-learning techniques to identify them in real time.

Source: A phishing attack scored credentials for more than 50,000 Snapchat users – The Verge

Pirates Crack Microsoft’s UWP Protection, Five Layers of DRM Defeated

Video games pirates have reason to celebrate today after scene cracking group CODEX defeated Microsoft’s Universal Windows Platform system on Zoo Tycoon Ultimate Animal Collection. While the game it was protecting isn’t exactly a fan favorite, it was reportedly protected by five layers of DRM within the UWP package, including the Denuvo-like Arxan anti-tamper technology
[…]
After being released on October 31, 2017, the somewhat underwhelming Zoo Tycoon Ultimate Animal Collection became the first victim at the hands of popular scene group, CODEX.
[…]
CODEX did reveal that various layers of protection had to be bypassed to make the game work. They’re listed by the group as MSStore, UWP, EAppX, XBLive, and Arxan, the latter being an anti-tamper system.

“It’s the equivalent of Denuvo (without the DRM License part),” cracker Voksi previously explained. “It’s still bloats the executable with useless virtual machines that only slow down your game.”

Source: Pirates Crack Microsoft’s UWP Protection, Five Layers of DRM Defeated – TorrentFreak

When will people learn that DRM will always be defeated by annoyed users?

New scanning technique reveals secrets behind great paintings

Researchers in the US have used a new scanning technique to discover a painting underneath one of Pablo Picasso’s great works of art, the Crouching Woman (La Misereuse Accroupie).

Underneath the oil painting is a landscape of Barcelona which, it turns out, Picasso used as the basis of his masterpiece.

The new x-ray fluorescence system is cheaper than alternative art scanning systems – and it is portable, making it available to any gallery that wants it.
[…]
Until now scanning was only for the greatest of great works of art – and for the wealthiest galleries.

This new system can be used by anyone to find the story behind any painting they are interested in.

Source: New scanning technique reveals secrets behind great paintings – BBC News

Posted in Art

Facebook admits SMS notifications sent using two-factor number was caused by bug

The issue, which may have persisted for months or perhaps even longer, was flagged by Bay Area software engineer Gabriel Lewi, who tweeted about it earlier this week. Prominent technology critic and sociologist Zeynep Tufekci then used the situation as a springboard to criticize Facebook’s alleged unethical behavior, thinking the 2FA notifications may have been an intentional method for Facebook to boost user engagement.

“I am sorry for any inconvenience these messages might have caused. We are working to ensure that people who sign up for two-factor authentication won’t receive non-security-related notifications from us unless they specifically choose to receive them, and the same will be true for those who signed up in the past,” Stamos writes in the blog post. “We expect to have the fixes in place in the coming days. To reiterate, this was not an intentional decision; this was a bug.”

Source: Facebook admits SMS notifications sent using two-factor number was caused by bug – The Verge

A bit worrying when your two factor security system starts acting up on its own and sending messages randomly.

New AI model fills in blank spots in photos

The technology was developed by a team led by Hiroshi Ishikawa, a professor at Japan’s Waseda University. It uses convolutional neural networks, a type of deep learning, to predict missing parts of images. The technology could be used in photo-editing apps. It can also be used to generate 3-D images from real 2-D images.

The team at first prepared some 8 million images of real landscapes, human faces and other subjects. Using special software, the team generated numerous versions for each image, randomly adding artificial blanks of various shapes, sizes and positions. With all the data, the model took three months to learn how to predict the blanks so that it could fill them in and make the resultant images look identical to the originals.

The model’s learning algorithm first predicts and fills in blanks. It then evaluates how consistent the added part is with its surroundings.

Source: New AI model fills in blank spots in photos- Nikkei Asian Review

0 A.D. | A free, open-source game of ancient warfare

0 A.D. (pronounced “zero-ey-dee”) is a free, open-source, historical Real Time Strategy (RTS) game currently under development by Wildfire Games, a global group of volunteer game developers. As the leader of an ancient civilization, you must gather the resources you need to raise a military force and dominate your enemies.
[…]
We intend to portray some of the major civilizations over the millennium of 500 B.C. to 500 A.D. (Hence the midpoint, zero.) That is an ambitious prospect, so in the first edition of 0 A.D. we focus on the last five centuries B.C. Perhaps in future expansion packs, more civilizations will be added, along with additional gameplay features.

We put a strong emphasis on historical accuracy while developing 0 A.D. We plan all our units and all our buildings based on reconstructions of how the units and the buildings might have looked like in the ancient world. We even name them in the original languages, such as Greek and Latin. But it’s worth remembering that any game should be fun to play, so, in many cases, we preferred playability over historical accuracy.

Source: 0 A.D. | A free, open-source game of ancient warfare