Daily Archives: December 19, 2018

EU Diplomatic Comms Network, Which the NSA Reportedly Warned Could Be Easily Hacked, Was Hacked. But contents were boring.

Posted on by

The European Union’s network used for diplomatic communications, COREU, was infiltrated “for years” by hackers, the New York Times reported on Tuesday, with the unknown rogues behind the attack reportedly reposting the stolen communiqués to an “open internet site.”

The network in question connects EU leadership with other EU organizations, as well as the foreign ministries of member states. According to the Times, the attack was first discovered by security firm Area 1, which provided a bit more than 1,100 of the cables to the paper for examination. Some of the documents show unease over Donald Trump’s presidency and his relationship with the Russian government, while others contain tidbits such as Chinese President Xi Jinping’s feelings about the U.S.’s brimming trade war with his country and rumors about nuclear weapons deployment on the Crimean peninsula:

In one cable, European diplomats described a meeting between President Trump and President Vladimir V. Putin of Russia in Helsinki, Finland, as “successful (at least for Putin).”

Another cable, written after a July 16 meeting, relayed a detailed report and analysis of a discussion between European officials and President Xi Jinping of China, who was quoted comparing Mr. Trump’s “bullying” of Beijing to a “no-rules freestyle boxing match” … The cables include extensive reports by European diplomats of Russia’s moves to undermine Ukraine, including a warning on Feb. 8 that Crimea, which Moscow annexed four years ago, had been turned into a “hot zone where nuclear warheads might have already been deployed.”

Hackers were able to breach COREU after a phishing campaign aimed at officials in Cyprus gave them access to passwords that compromised the whole network, Area 1 chief executive Oren Falkowitz told the Times. An anonymous official at the U.S.’s National Security Agency added that the agency had warned the EU had received numerous warnings that the aging system could easily be infiltrated by malicious parties.

[…]

Fortunately for the EU, the Times wrote, the stolen information is primarily “low-level classified documents that were labeled limited and restricted,” while more sensitive communiqués were sent via a separate system (EC3IS) that European officials said is being upgraded and replaced. Additionally, although the documents were uploaded to an “open internet site,” the hackers apparently made no effort to publicize them, the paper added.

Source: EU Diplomatic Comms Network, Which the NSA Reportedly Warned Could Be Easily Hacked, Was Hacked

This AI Just Mapped Every Solar Panel in the United States

Posted on by

n some states, solar energy accounts for upwards of 10 percent of total electricity generation. It’s definitely a source of power that’s on the rise, whether it be to lessen our dependence on fossil fuels, nuclear power, or the energy grid, or simply to take advantage of the low costs. This form of energy, however, is highly decentralized, so it’s tough to know how much solar energy is being extracted, where, and by whom.

[…]

The system developed by Rajagopal, along with his colleagues Jiafan Yu and Zhecheng Wang, is called DeepSolar, and it’s an automated process whereby hi-res satellite photos are analyzed by an algorithm driven by machine learning. DeepSolar can identify solar panels, register their locations, and calculate their size. The system identified 1.47 million individual solar installations across the United States, whether they be small rooftop configurations, solar farms, or utility-scale systems. This exceeds the previous estimate of 1.02 million installations. The researchers have made this data available at an open-source website.

By using this new approach, the researchers were able to accurately scan billions of tiles of high-resolution satellite imagery covering the continental U.S., allowing them to classify and measure the size of solar systems in a few weeks rather than years, as per previous methods. Importantly, DeepSolar requires minimal human supervision.

DeepSolar map of solar panel usage across the United States.
Image: Deep Solar/Stanford University

“The algorithm breaks satellite images into tiles. Each tile is processed by a deep neural net to produce a classification for each pixel in a tile. These classifications are combined together to detect if a system—or part of—is present in the tile,” Rajagopal told Gizmodo.

The neural net can then determine which tile is a solar panel, and which is not. The network architecture is such that after training, the layers of the network produce an activation map, also known as a heat map, that outlines the panels. This can be used to obtain the size of each solar panel system.

Source: This AI Just Mapped Every Solar Panel in the United States

Turning Off Facebook Location Services Doesn’t Stop Tracking – you have to hide your IP address

Posted on by

Aleksandra Korolova has turned off Facebook’s access to her location in every way that she can. She has turned off location history in the Facebook app and told her iPhone that she “Never” wants the app to get her location. She doesn’t “check-in” to places and doesn’t list her current city on her profile.

Despite all this, she constantly sees location-based ads on Facebook. She sees ads targeted at “people who live near Santa Monica” (where she lives) and at “people who live or were recently near Los Angeles” (where she works as an assistant professor at the University of Southern California). When she traveled to Glacier National Park, she saw an ad for activities in Montana, and when she went on a work trip to Cambridge, Massachusetts, she saw an ad for a ceramics school there.

Facebook was continuing to track Korolova’s location for ads despite her signaling in all the ways that she could that she didn’t want Facebook doing that.

This was especially perturbing for Korolova, as she recounts on Medium, because she has studied the privacy harms that come from Facebook advertising, including how it could be previously used to gather data about an individual’s likes, estimated income and interests (for which she and her co-author Irfan Faizullabhoy got a $2,000 bug bounty from Facebook), and how it can currently be used to target ads at a single house or building, if, say, an anti-choice group wanted to target women at a Planned Parenthood with an ad for baby clothes.

Korolova thought Facebook must be getting her location information from the IP addresses she used to log in from, which Facebook says it collects for security purposes. (It wouldn’t be the first time Facebook used information gathered for security purposes for advertising ones; advertisers can target Facebook users with the phone number they provided for two-factor protection of their account.) As the New York Times recently reported, lots of apps are tracking users’ movements with surprising granularity. The Times suggested turning off location services in your phone’s privacy settings to stop the tracking, but even then the apps can still get location information, by looking at the wifi network you use or your IP address.

When asked about this, Facebook said that’s exactly what it’s doing and that it considers this a completely normal thing to do and that users should know this will happen if they closely read various Facebook websites.

“Facebook does not use WiFi data to determine your location for ads if you have Location Services turned off,” said a Facebook spokesperson by email. “We do use IP and other information such as check-ins and current city from your profile. We explain this to people, including in our Privacy Basics site and on the About Facebook Ads site.”

On Privacy Basics, Facebook gives advice for “how to manage your privacy” with regards to location but says that regardless of what you do, Facebook can still “understand your location using things like… information about your Internet connection.” This is reiterated on the “About Facebook Ads” site that says that ads might be based on your location which is garnered from “where you connect to the Internet” among other things.

Strangely, back in 2014, Facebook told businesses in a blog post that “people have control over the recent location information they share with Facebook and will only see ads based on their recent location if location services are enabled on their phone.” Apparently, that policy has changed. (Facebook said it would update this old post.)

Hey, maybe this is to be expected. You need an IP address to use the internet and, by the nature of how the internet works, you reveal it to an app or a website when you use them (though you can hide your IP address by using one provided by the Tor browser or a VPN). There are various companies that specialize in mapping the locations of IP addresses, and while it can sometimes be wildly inaccurate, an IP address will give you a rough approximation of your whereabouts, such as the state, city or zip code you are currently in. Many websites use IP address-derived location to personalize their offerings, and many advertisers use it to show targeted online ads. It means showing you ads for restaurants in San Francisco if you live there instead of ads for restaurants in New York. In that context, Facebook using this information to do the same thing is not terribly unusual.

“There is no way for people to opt out of using location for ads entirely,” said a Facebook spokesperson by email. “We use city and zip level location which we collect from IP addresses and other information such as check-ins and current city from your profile to ensure we are providing people with a good service—from ensuring they see Facebook in the right language, to making sure that they are shown nearby events and ads for businesses that are local to them.”

Source: Turning Off Facebook Location Services Doesn’t Stop Tracking

NASA fears internal server hacked, staff personal info swiped by miscreants

Posted on by

A server containing personal information, including social security numbers, of current and former NASA workers may have been hacked, and its data stolen, it emerged today.

According to an internal memo circulated among staff on Tuesday, in mid-October the US space agency investigated whether or not two of its machines holding employee records had been compromised, and discovered one of them may have been infiltrated by miscreants.

It was further feared that this sensitive personal data had been siphoned from the hijacked server. The agency’s top brass stressed no space missions were affected, and identity theft protection will be offered to all affected workers, past and present. The boffinry nerve-center’s IT staff have since secured the servers, and are combing through other systems to ensure they are fully defended, we’re told.

Anyone who joined, left, or transferred within the agency from July 2006 to October 2018 may have had their personal records swiped, according to NASA bosses. Right now, the agency employs roughly 17,300 people.

Source: Houston, we’ve had a problem: NASA fears internal server hacked, staff personal info swiped by miscreants • The Register

Facebook Allowed Netflix, Spotify and A Bank To Read And Delete Users’ Private Messages. And around 150 other companies got to see other private information without user consent.

Posted on by

Facebook gave more than 150 companies, including Microsoft, Netflix, Spotify, Amazon, and Yahoo, unprecedented access to users’ personal data, according to a New York Times report published Tuesday.

The Times obtained hundreds of pages of Facebook documents, generated in 2017, that show that the social network considered these companies business partners and effectively exempted them from its privacy rules.

Facebook allowed Microsoft’s search engine Bing to see the names of nearly all users’ friends without their consent, and allowed Spotify, Netflix, and the Royal Bank of Canada to read, write, and delete users’ private messages, and see participants on a thread.

It also allowed Amazon to get users’ names and contact information through their friends, let Apple access users’ Facebook contacts and calendars even if users had disabled data sharing, and let Yahoo view streams of friends’ posts “as recently as this summer,” despite publicly claiming it had stopped sharing such information a year ago, the report said. Collectively, applications made by these technology companies sought the data of hundreds of millions of people a month.

On Tuesday night, a Facebook spokesperson explained to BuzzFeed News that the social media giant solidified different types of partnerships with major tech and media companies for specific reasons. Apple, Amazon, Yahoo, and Microsoft, for example, were known as “integration partners,” and Facebook helped them build versions of the app “for their own devices and operating systems,” the spokesperson said.

Facebook solidified its first partnerships around 2009–2010, when the company was still a fledgling social network. Many of them were still active in 2017, the spokesperson said. The Times reported that some of them were still in effect this year.

Around 2010, Facebook linked up with Spotify, the Bank of Canada, and Netflix. Once a user logged in and connected their Facebook profile with these accounts, these companies had access to that person’s private messages. The spokesperson confirmed that there are probably other companies that also had this capability, but stressed that these partners were removed in 2015 and, “right now there is no evidence of any misuse of data.”

Other companies, such as Bing and Pandora, were able to see users’ public information, like their friend lists and what types of songs and movies they liked.

Source: Facebook Allowed Netflix, Spotify, And A Bank To Read And Delete Users’ Private Messages

The finger here is being justly pointed at Facebook – but what they are missing is the other companies also knew they were acting unethically by asking for and using this information. It also shows that privacy is something that none of these companies respect and the only way of safeguarding it is by having legal frameworks that respect it.

Amazon and Facebook Reportedly Had a Secret Data-Sharing Agreement, and It Explains So Much

Posted on by

Back in 2015, a woman named Imy Santiago wrote an Amazon review of a novel that she had read and liked. Amazon immediately took the review down and told Santiago she had “violated its policies.” Santiago re-read her review, didn’t see anything objectionable about it, so she tried to post it again. “You’re not eligible to review this product,” an Amazon prompt informed her.

When she wrote to Amazon about it, the company told her that her “account activity indicates you know the author personally.” Santiago did not know the author, so she wrote an angry email to Amazon and blogged about Amazon’s “big brother” surveillance.

I reached out to both Santiago and Amazon at the time to try to figure out what the hell happened here. Santiago, who is an indie book writer herself, told me that she’d been in the same ballroom with the author in New York a few months before at a book signing event, but had not talked to her, and that she had followed the author on Twitter and Facebook after reading her books. Santiago had never connected her Facebook account to Amazon, she said.

Amazon wouldn’t tell me much back in 2015. Spokesperson Julie Law told me by email at the time that the company “didn’t comment on individual accounts” but said, “when we detect that elements of a reviewer’s Amazon account match elements of an author’s Amazon account, we conclude that there is too much risk of review bias. This can erode customer trust, and thus we remove the review. I can assure you that we investigate each case.”

“We have built mechanisms, both manual and automated over the years that detect, remove or prevent reviews which violate guidelines,” Law added.

A new report in the New York Times about Facebook’s surprising level of data-sharing with other technology companies may shed light on those mechanisms:

Facebook allowed Microsoft’s Bing search engine to see the names of virtually all Facebook users’ friends without consent, the records show, and gave Netflix and Spotify the ability to read Facebook users’ private messages.

The social network permitted Amazon to obtain users’ names and contact information through their friends, and it let Yahoo view streams of friends’ posts as recently as this summer, despite public statements that it had stopped that type of sharing years earlier.

If Amazon was sucking up data from Facebook about who knew whom, it may explain why Santiago’s review was blocked. Because Santiago had followed the author on Facebook, Amazon or its algorithms would see her name and contact information as being connected to the author there, according to the Times. Facebook reportedly didn’t let users know this data-sharing was happening nor get their consent, so Santiago, as well as the author presumably, wouldn’t have known this had happened.

Amazon declined to tell the New York Times about its data-sharing deal with Facebook but “said it used the information appropriately.” I asked Amazon how it was using the data obtained from Facebook, and whether it used it to make connections like the one described by Santiago. The answer was underwhelming.

“Amazon uses APIs provided by Facebook in order to enable Facebook experiences for our products,” said an Amazon spokesperson in a statement that didn’t quite answer the question. “For example, giving customers the option to sync Facebook contacts on an Amazon Tablet. We use information only in accordance with our privacy policy.”

Amazon declined our request to comment further.

Why was Facebook giving out this data about its users to other tech giants? The Times report is frustratingly vague, but it says Facebook “got more users” by partnering with the companies (though it’s unclear how), but also that it got data in return, specifically data that helped power its People You May Know recommendations. Via the Times:

The Times reviewed more than 270 pages of reports generated by the system — records that reflect just a portion of Facebook’s wide-ranging deals. Among the revelations was that Facebook obtained data from multiple partners for a controversial friend-suggestion tool called “People You May Know.”

The feature, introduced in 2008, continues even though some Facebook users have objected to it, unsettled by its knowledge of their real-world relationships. Gizmodo and other news outlets have reported cases of the tool’s recommending friend connections between patients of the same psychiatrist, estranged family members, and a harasser and his victim.

Facebook, in turn, used contact lists from the partners, including Amazon, Yahoo and the Chinese company Huawei — which has been flagged as a security threat by American intelligence officials — to gain deeper insight into people’s relationships and suggest more connections, the records show.

‘You scratch my algorithm’s back. I’ll scratch your algorithm’s back,’ or so the arrangement apparently went.

Back in 2017, I asked Facebook whether it was getting information from “third parties such as data brokers” to help power its creepily accurate friend recommendations. A spokesperson told me by email, “Facebook does not use information from data brokers for People You May Know,” in what now seems to be a purposefully evasive answer.

Facebook doesn’t want to tell us how its systems work. Amazon doesn’t want to tell us how its systems work. These companies are data mining us, sometimes in concert, to make uncomfortably accurate connections but also erroneous assumptions. They don’t want to tell us how they do it, suggesting they know it’s become too invasive to reveal. Thank god for leakers and lawsuits.

Source: Amazon and Facebook Reportedly Had a Secret Data-Sharing Agreement, and It Explains So Much

Ancient Hidden City Discovered Under Lake Titicaca

Posted on by

Five minutes away from the town of Tiquina, on the shores of Lake Titicaca, archaeologists found the remains of an ancient civilization under the waters of the lake.

The find was made 10 years ago, by Christophe Delaere, an archaeologist from the Free University of Belgium, by following information provided by the locals. 24 submerged archaeological sites have been identified under the lake, according to the BBC.

The most significant of these sites is at Santiago de Ojjelaya, and the Bolivian government has recently agreed to build a museum there to preserve both the underwater structures and those which are on land.

Lake Titicaca. Photo by Alex Proimos CC BY SA 2.0

The project is supposed to be finished in 2020 and will cost an estimated $10 million. The Bolivian government is funding the project with help from UNESCO and is backed by the Belgian development cooperation agency.

The proposed building will have two parts and cover an area of about 2.3 acres (9,360 square meters). One part of the museum will be on the shore, and it will display artifacts that have been raised from the lake bottom. The second part will be partially submerged, with enormous glass walls that will look out under the lake, allowing visitors to see the “hidden city” below.

Old pottery from Tiwanaku at the Ethnologisches Museum, Berlin-Dahlem.

According to the Bolivia Travel Channel, the museum will facilitate the beginning of an archaeological tourism enterprise, which “will be a resort and archaeology research center, geology and biology, characteristics that typified it unique in the world [sic],” according to Wilma Alanoca Mamani, holder of the portfolio of the Plurinational State. Christophe Delaere said that the building’s design incorporates elements of architecture used by the Andean cultures who inhabited the area.

Jose Luis Paz, who is the director of heritage for Bolivia’s Ministry of Culture, says that two types of underwater ruins will be visible when the building is complete: religious/spiritual offering sites, primarily underwater, and places where people lived and worked, which were primarily on the shoreline. He went on to say that the spiritual sites were likely flooded much later than the settlements.

Chullpas from Tiwanaku epoch. Photo by Diego Delso CC BY-SA 4.0

A team of archaeological divers and Bolivian and Belgian experts have located thousands of items in the underwater sites. Some of these pieces will be brought up, but the majority will remain underwater as they are quite well-preserved.

Wilma Mamani said that more than 10,000 items have been found including gold and ceramic pieces and various kinds of bowls and other vessels. The items are of pre-Inca Tiwanaku civilizations. Some of the artifacts have been estimated to be 2,000 years old, and others have been dated back to when the Tiwanaku empire was one of the primary Andean civilizations.

Gateway of the Sun, Tiwanaku, drawn by Ephraim Squier in 1877.

Tiwanaku was a major civilization in Bolivia, with the main city built around 13,000 feet above sea level, near Lake Titicaca, which made it one of the highest urban centers ever built.

The city reached its zenith between 500 AD and 1000 AD, and, at its height, was home to about 10,000 people. It’s unclear exactly when the civilization took hold, but it is known that people started settling around Lake Titicaca about 2,000 BC.

The Gateway of the Sun from the Tiwanaku civilization in Bolivia.

According to Live Science, the city’s ancient name is unknown, since they never developed a written language, but archaeological evidence suggests that Tiwanaku cultural influence reached across the southern Andes, into Argentina, Peru, and Chile, as well as Bolivia.

Tiwanaku began to decline around 1,000 AD, and the city was eventually abandoned. Even when it fell out of use, it stayed an important place in the mythology of the Andean people, who viewed it as a religious site.

Source: Ancient Hidden City Discovered Under Lake Titicaca