Monthly Archives: September 2019

Study shows how consumers rely on price and locality to determine quality of products

Posted on by

The study suggests that marketers can use this understanding of local identity versus global identity to shape consumers’ price perceptions and behavior. UTA and three other universities contributed to the study.

“Consumers tend to use price to judge a product’s quality when their local identity is most important to them,” Janakiraman said. “When promoting high-priced or branded products, marketers can situationally activate consumers’ local identity. To accomplish this objective, businesses can encourage consumers to think locally or employ local cultural symbols in advertising and other promotional material.”

Findings also suggest that discount stores, such as dollar stores, should discourage consumers from using the price of a product to infer its quality.

“Discount stores, therefore, would be better served by temporarily making consumers’ global identity more prominent,” Janakiraman said. “Cues in advertisements that focus on a product’s global appeal would help achieve that goal.”

Source: Study shows how consumers rely on price to determine quality of products

Privatised RAF pilot training takes 7 years to produce combat-ready aviators, has a shortfall of 86% with RAF needs

Posted on by

The UK Armed Forces’ privatised pilot training system is taking nearly seven years to turn new recruits into frontline-ready aviators, according to the National Audit Office (NAO).

The NAO investigation into the UK Military Flying Training System (UKMFTS) contract, which is let to a consortium backed in part by US arms multinational Lockheed Martin, thundered that the RAF was short of 330 pilots, while almost half of students entering the UKMFTS system last year failed to complete their intermediate training.

“In its worst year (2018-19), 49 students completed Phase 2, an 86 per cent shortfall against the [Ministry of Defence’s] current aircrew requirements. In its best year (2015-16), 182 students completed Phase 2, a 21 per cent shortfall,” said the NAO in its latest report.

Damningly, RAF fast jet pilots, the two-winged master race* who fly the service’s Typhoon and F-35 fighters, were taking more than seven years to get from joining the Air Force to being declared ready for frontline duties.

Part of the underlying cause of the problems identified by the NAO is the contractor’s failure to provide enough aeroplanes and instructors. Originally the post-Cold War era RAF had more than 100 Hawk advanced training jets, 130 Short Tucano intermediate trainers and 89 Grob Tutor basic training aeroplanes. Ascent, the Lockheed Martin-backed consortium, is replacing these with 23 Grob Prefect training aeroplanes, 10 Texan II fast jet trainers and five Embraer Phenom 100s. The MoD itself continues providing modernised Hawks.

Source: Auditors bemoan time it takes for privatised RAF pilot training to produce combat-ready aviators • The Register

Cheap GPS kiddie trackers have default password 123456 and send all information unencrypted

Posted on by

GPS trackers are designed to bring you greater peace of mind by helping you to locate your kids, your pets, and even your car. They can help keep the elderly or disabled safe by providing them with a simple SOS button to call for immediate help. Many devices are marketed for these purposes on common sites like Amazon and eBay and can be purchased for $25-$50 USD, making them more financially attractive than using a smartphone for some of the same capabilities.

[…]

As the instructions state, there is a web portal and a mobile application that you can use to manage the tracker. We took the path of least resistance and first opened a web application which is reachable at http://en.i365gps.com.

[…]

As you can see the first red flag is that the login form is served over HTTP protocol, not over the more secure HTTPS. Moreover, you have two options to connect to the cloud: by using an account with username and password or using ID and password. Which one to pick? We turned to the leaflet for answers. It says:

Figure 5: Default password

This applies both for Android application as well as for web application. What is also an alarming fact is that last sentence: “…user needs to contact reseller to register a username if need to login by username.” Since you have to call the reseller to request a username, it’s fairly clear you are intended to use the ID, the password for which is “123456.” Not a good start.

[…]

Ok so let’s get back to the IMEI/ID that in combination with default password serves as the credentials for your account. Remember how easy it was to scan through that 1M of possible IMEI numbers as they have the same prefix? So we scanned an arbitrary 4M sequential serial numbers ourselves just to get an idea of the scale of the devices out there and we learned that at least six hundred thousand devices are live in the wild with default passwords. We executed a deeper scan of a subset of one million of these devices to determine make, model, and location; of the one million, we scanned, over 167,000 were locatable.

Figure 29: a result of a detailed scan of 1M serial numbers for tracker devices
Figure 30: last GPS position of trackers

Now it’s obvious that the same infrastructure is used for all or at least most of the trackers from this vendor as we identified 29 different models of trackers during this scan of 1M IMEIs. All the models are sold by wholesaler Shenzen i365, and we were able to determine that some models in this scan are being sold under different product names, which leads us to the conclusion that infrastructure and devices are being white labelled and sold under different brand names. In many instances, however, we were only able to determine a generic model number.

Number of trackers Tracker model
60601 T58
36658 A9
26654 T8S
20778 T28
20640 TQ
11480 A16
10263 A6
9121 3G
7452 A18
5092 A21
4083 T28A
3626 A12
2921 A19
2839 A20
2638 A20S
2610 S1
1664 P1
749 FA23
607 A107
280 RomboGPS
79 PM01
55 A21P
26 PM02
16 A16X
15 PM03
4 WA3
4 P1-S
3 S6
1 S9

Figure 31: trackers models and their counts in 1M detailed sample scan

Figure 32: affected models

You are probably already feeling like there is a lot more to this story than meets the eye as we found devices that are not produced by this particular company during this scan. It turns out that this problem is much bigger than it looks. How big? We’ll show you in the follow-up to this which goes deeper into the relationships between different products and companies and into many surprising facts about cloud infrastructure. We found more alarming vulnerabilities and much more instances of this cloud and trackers.

But so far we think we are speaking of approximately 50 different applications sharing the same platform (and probably also the same vulnerabilities) as seen in this picture:

Figure 33: the research continues, see you in part 2 where we uncover more about platform/cloud

Source: The secret life of GPS trackers (1/2) – Avast Threat Labs

Tesla Malfunction Locks Out Owners Who Depended on App for Entry, Forces Them to Scramble for ‘Keys’

Posted on by

Some Tesla users who rely on the app to gain entry to their Model 3 were temporarily unable to get into their electric cars on Labor Day.

The Next Web reported that a number of people tweeted out their frustrations on Monday when they were “locked out” of their car due to phone app issues. Downdetector, a tracker for users to report technical difficulties with web-based services, also showed that many users were having trouble with Tesla’s app.

A Tesla spokesperson confirmed to Gizmodo that Tesla’s app was temporarily unavailable on Monday but full functionality was soon restored. Tweets suggest the app was down for around three hours at least.

Source: Tesla Malfunction Locks Out Owners Who Depended on App for Entry, Forces Them to Scramble for ‘Keys’

Well done, Elon Musk!

Google has secret webpages that feed your personal data to advertisers, report to EU says

Posted on by

New evidence submitted for an investigation into Google’s collection of personal data in the European Union reportedly accuses the search giant of stealthy sending your personal user data to advertisers. The company allegedly relays this information to advertisers using hidden webpages, allowing it to circumvent EU privacy regulations.

The evidence was submitted to Ireland’s Data Protection Commission, the main watchdog over the company in the European Union, by Johnny Ryan, chief policy officer for privacy-focused browser maker Brave, according to a Financial Times report Wednesday. Ryan reportedly said he discovered that Google used a tracker containing web browsing information, location and other data and sent it to ad companies via webpages that “showed no content,” according to FT. This could allow companies buying ads to match a user’s Google profile and web activity to profiles from other companies, which is against Google’s own ad buying rules, according to the FT.

In response, Google said Wednesday it doesn’t serve “personalized ads or send bid requests to bidders without user consent.”

The process laid out by Ryan could potentially be “cookie matching” or “cookie syncing,” an ad industry practice of matching ads across multiple sites based on a user’s browsing history. A Google developer page on cookie matching explains the process and the privacy principles the search engine follows, such as not allowing the info to be harvested by multiple companies.

The Data Protection Commission began an investigation into Google’s practices in May after it received a complaint from Brave that Google was allegedly violating the EU’s General Data Protection Regulation.

Source: Google has secret webpages that feed your personal data to advertisers, report says – CNET

Online Depression Tests Are Collecting and Sharing Your Data

Posted on by

This week, Privacy International published a report—Your mental health for sale—which explored how mental health websites handle user data. The digital rights nonprofit looked at 136 mental health webpages across Google France, Google Germany and the UK version of Google, according to the report. They chose websites based on advertised links and featured page search results for depression-related terms in French, German, and English, and also included the most visited sites according to web analytics service SimilarWeb.

According to the report, the organization used the open-source software webxray to identify third-party HTTP requests and cookies. It then analyzed the websites on July 8th of this year. The analysis found that 97.78 percent of the webpages had a third-party element, which might include cookies, JavaScript, or an image hosted on an outside server. And Privacy International also pointed out that its research found that the main reason for these third-party elements was for advertising.

Webxray’s analysis found that 76.04 percent of the webpages had trackers for marketing purposes—80.49 percent of the pages in France, 61.36 percent of the pages in Germany, and 86.27 percent of them in the UK. Among the third-party trackers also included the likes of advertising services from Google, Facebook, and Amazon, with Google trackers being the most present, followed by Facebook and Amazon.

A deeper dive into a subset of these websites—the first three Google search results for “depression test” in the three countries—also indicated some more specific and egregious ways in which these trackers are shilling some of our most intimate data. For instance, among the findings from that additional analysis, Privacy International found that some of the depression test websites stored user’s responses and shared them along with their test results with third parties. They also found that two depression test websites use Hotjar, an online feedback tool that can record what someone types and clicks on a webpage. It’s not difficult to imagine how such data—responses to a depression test—can be exploited.

Source: Online Depression Tests Are Collecting and Sharing Your Data

Human speech may have a universal transmission rate: 39 bits per second

Posted on by

Italians are some of the fastest speakers on the planet, chattering at up to nine syllables per second. Many Germans, on the other hand, are slow enunciators, delivering five to six syllables in the same amount of time. Yet in any given minute, Italians and Germans convey roughly the same amount of information, according to a new study. Indeed, no matter how fast or slowly languages are spoken, they tend to transmit information at about the same rate: 39 bits per second, about twice the speed of Morse code.

“This is pretty solid stuff,” says Bart de Boer, an evolutionary linguist who studies speech production at the Free University of Brussels, but was not involved in the work. Language lovers have long suspected that information-heavy languages—those that pack more information about tense, gender, and speaker into smaller units, for example—move slowly to make up for their density of information, he says, whereas information-light languages such as Italian can gallop along at a much faster pace. But until now, no one had the data to prove it.

Scientists started with written texts from 17 languages, including English, Italian, Japanese, and Vietnamese. They calculated the information density of each language in bits—the same unit that describes how quickly your cellphone, laptop, or computer modem transmits information. They found that Japanese, which has only 643 syllables, had an information density of about 5 bits per syllable, whereas English, with its 6949 syllables, had a density of just over 7 bits per syllable. Vietnamese, with its complex system of six tones (each of which can further differentiate a syllable), topped the charts at 8 bits per syllable.

Next, the researchers spent 3 years recruiting and recording 10 speakers—five men and five women—from 14 of their 17 languages. (They used previous recordings for the other three languages.) Each participant read aloud 15 identical passages that had been translated into their mother tongue. After noting how long the speakers took to get through their readings, the researchers calculated an average speech rate per language, measured in syllables/second.

Some languages were clearly faster than others: no surprise there. But when the researchers took their final step—multiplying this rate by the bit rate to find out how much information moved per second—they were shocked by the consistency of their results. No matter how fast or slow, how simple or complex, each language gravitated toward an average rate of 39.15 bits per second, they report today in Science Advances. In comparison, the world’s first computer modem (which came out in 1959) had a transfer rate of 110 bits per second, and the average home internet connection today has a transfer rate of 100 megabits per second (or 100 million bits).

Source: Human speech may have a universal transmission rate: 39 bits per second | Science | AAAS

Hundreds of Millions of Facebook Users Phone Numbers Exposed

Posted on by

Facebook is staring down yet another security blunder, this time with an incident involving an exposed server containing hundreds of millions of phone numbers that were previously associated with accounts on its platform.

The situation appears to be pinned to a feature no longer enabled on the platform but allowed users to search for someone based on their phone number. TechCrunch’s Zack Whittaker first reported Wednesday that a server—which did not belong to Facebook but was evidently not password protected and therefore accessible to anyone who could find it—was discovered online by security researcher Sanyam Jain and found to contain records on more than 419 million Facebook users, including 133 records on users based in the U.S.

(A Facebook spokesperson disputed the 419 million figure in a call with Gizmodo, claiming the server contained “closer to half” of that number, but declined to provide a specific figure.)

According to TechCrunch, records contained on the server included a Facebook user’s phone number and individual Facebook ID. Using both, TechCrunch said it was able to cross-check them to verify records and additionally found that in some cases, records included a user’s country, name, and gender. The report stated that it’s unclear who scraped the data from Facebook or why. The Facebook spokesperson said that the company became aware of the situation a few days ago but would not specify an exact date.

Whittaker noted that having access to a user’s phone number could allow a bad actor to force-reset accounts linked to that number, and could further expose them to intrusions like spam calls or other abuse. But it could also allow a bad actor to pull up a host of private information on a person by inputting it into any number of public databases or with some legwork or by impersonation grant a hacker access to apps or even a bank account.

Source: Hundreds of Millions of Facebook Users Phone Numbers Exposed

More Than Half the Nation’s State Attorneys General Could Sign on to Antitrust Inquiry Against Google

Posted on by

The Washington Post reported on Tuesday that “more than half of the nation’s state attorneys general” have signed on to and are preparing an antitrust investigation against digital titan Google, with the paper writing the inquiry is “scheduled to be announced next week, marking a major escalation in U.S. regulators’ efforts to probe Silicon Valley’s largest companies.”

Details of the investigation remain hazy, but the Post reported that the effort is “expected” to be bipartisan and could involve over 30 state attorneys general. The states’ investigation is as of yet separate from another antitrust review currently being conducted by the Department of Justice, and it comes as both Democrats on the campaign trail and the Trump administration have amped up the pressure on tech giants (albeit for entirely different reasons). The Post wrote:

A smaller group of these state officials, representing the broader coalition, is expected to unveil the investigation at a Monday news conference in Washington, according to three people familiar with the matter who spoke on the condition of anonymity because they were not authorized to discuss a law enforcement proceeding on the record, cautioning the plans could change.

It is unclear whether some or all of the attorneys general also plan to open or announce additional probes into other tech giants, including Amazon and Facebook, which have faced similar U.S. antitrust scrutiny. The states’ effort is expected to be bipartisan and could include more than 30 attorneys general, one of the people said.

While it’s “unclear” whether any DOJ officials will join the attorneys general during the expected announcement next week, the Post wrote, the agency’s antitrust chief Makan Delrahim did say in August that the DOJ was coordinating with state inquiries into possible violations of antitrust law by tech firms. The feds are currently carrying out multiple such antitrust investigations, including Federal Trade Commission probes of Facebook (separate from the paltry $5 billion fine it levied on the company earlier this year) and Amazon and a DOJ probe of Apple.

As the Post noted, the states have more limited powers at their disposal than the feds, which can break up entire firms on the grounds of anticompetition law. However, states can join with the feds in court, as they did during the antitrust investigation into Microsoft in the 1990s, as well as tangle Google up in years of legal battles. Former Maryland attorney general Doug Gansler told the paper, “If multiple states—and I mean not just Democratic attorneys general but Republican attorneys general as well—are all looking into potential antitrust violations, one of the biggest effects might be to pressure the federal government to do a deeper dive.”

Source: More Than Half the Nation’s State Attorneys General Could Sign on to Antitrust Inquiry Against Google

Do those retail apps increase customer engagement and sales in all channels? In the US: Yes.

Posted on by

Researchers from Texas A&M University published new research in the INFORMS journal Marketing Science, which shows that retailers’ branded mobile apps are very effective in increasing customer engagement, increasing sales on multiple levels, not just on the retailer’s website, but also in its stores. At the same time, apps increase the rate of returns, although the increase in sales outweighs the return rates.

The study to be published in the September edition of the INFORMS journal Marketing Science is titled “Mobile App Introduction and Online and Offline Purchases and Product Returns,” and is authored by Unnati Narang and Ventakesh Shankar, both of the Mays Business School at Texas A&M University.

The study authors found that retail app users buy 33 percent more frequently, they buy 34 percent more items, and they spend 37 percent more than non-app user customers over 18 months after app launch.

At the same time, app users return products 35 percent more frequently, and they return 35 percent more items at a 41 percent increase in .

All factors considered, the researchers found that app users spend 36 percent more net of returns.

“Overall, we found that retail app users are significantly more engaged at every level of the retail experience, from making purchases to returning items,” said Narang. “Interestingly, we also found that app users tend to a more diverse set of items, including less popular products, than non-app users. This is particular helpful for long-tail products, such as video games and music.”

“For the retailer, the lesson is that having a retail app will likely increase customer engagement and expand the range of products being sold online and in store,” added Shankar. “We also found that some app users who make a purchase within 48 hours of actually using an app, tend to use it when they are physically close to the store of purchase. They are most likely to access the app for loyalty rewards, product details and notifications.”

Source: Do those retail apps increase customer engagement and sales in all channels?

Managers rated as highly emotionally intelligent are more ineffective and unpopular, research shows

Posted on by

Professor Nikos Bozionelos, of the EMLyon Business School, France, and Dr. Sumona Mukhuty, Manchester Metropolitan University, asked staff in the NHS to assess their managers’ emotional intelligence—defined as their level of empathy and their awareness of their own and others’ emotions.

The 309 managers were also assessed on the amount of effort they put into the job, the staff’s overall satisfaction with their manager, and how well they implemented change within the NHS system.

Professor Bozionelos told the British Academy of Management’s annual conference in Birmingham today [Wednesday 4 September 2019] that beyond a certain point managers rated as having high emotional intelligence were also scored as lower for most of the outcomes.

Those managers rated in the top 15 percent for emotional intelligence were evaluated lower that those who performed in the top 65 percent to 85 percent in the amount of effort they put into the job, and how satisfied their subordinates were with them.

The NHS was undergoing fundamental reorganization at the time of the study, and managers rated as most emotionally intelligent were scored as less effective at implementing this change, but highly for their continuing involvement in the process.

“Increases in emotional intelligence beyond a moderately high level are detrimental rather than beneficial in terms of leader’s effectiveness,” said Professor Bozionelos.

“Managers who were rated beyond a particular threshold are considered less effective, and their staff are less satisfied with them.

“Too much emotional intelligence is associated with too much empathy, which in turn may make a manager hesitant to apply measures that he or she feels will impose excessive burden or discomfort to subordinates.”

The research contradicted the general assumption that the more emotional intelligence in a manager the better, he said, which had led to “an upsurge in investment in emotional intelligence training programs for leaders.”

“Beyond a particular level, emotional intelligence may not add anything to many aspects of manager’s performance, and in fact may become detrimental. Simply considering that the more emotional the manager has the better it is may be an erroneous way of thinking.”

The researchers took into account a host of factors, such as leaders’ age and biological sex, in order to study the effects of in isolation.

Source: Managers rated as highly emotionally intelligent are more ineffective and unpopular, research shows

SpaceX Says a ‘Bug’ Prevented It From Receiving Warning of Possible ESA Satellite Collision. For the first time ESA had to unexpectedly avoid a satellite constellation.

Posted on by

The European Space Agency was forced to perform a “collision avoidance maneuver” to prevent its Aeolus spacecraft from potentially smashing into one of Elon Musk’s Starlink satellites, in what is quickly becoming an all-too-common occurrence. According to SpaceX, it never received the expected alert that a collision was possible.

ESA pumped out a series of tweets yesterday describing the incident, in which the Aeolus satellite “fired its thrusters, moving it off a collision course with a @SpaceX satellite in their #Starlink constellation” on Monday morning. Launched in August 2018, the Aeolus Earth science satellite monitors the planet’s wind from space, allowing for better weather predictions and climate modeling.

[…]

Experts in the ESA’s Space Debris Team “calculated the risk of collision between these two active satellites,” determining that the safest option for Aeolus was to increase its height and have it pass over the SpaceX satellite, according to an ESA tweet. It marked the first time the ESA had to perform “a collision avoidance manoeuvre’ to protect one of its satellites from colliding with a ‘mega constellation,’” noted the space agency.

[…]

But as the ESA tweeted yesterday, as “the number of satellites in orbit increases, due to ‘mega constellations’ such as #Starlink comprising hundreds or even thousands of satellites, today’s ‘manual’ collision avoidance process will become impossible…”

[…]

An ESA graphic identified the culprit as being Starlink 44. The maneuver was done a half-Earth-orbit before Aeolus’ closest approach to the Starlink satellite. Jeff Foust from SpaceNews provides more insight into the incident:

Holger Krag, director of ESA’s Space Safety Programme Office, said in a Sept. 3 email that the agency’s conjunction assessment team noticed the potential close approach about five days in advance, using data provided by the U.S. Air Force’s 18th Space Control Squadron. “We have informed SpaceX and they acknowledged,” he said. “Over the days the collision probability exceeded the decision threshold and we started the maneuver preparation and shared our plans with SpaceX. The decision to maneuver was then made the day before.”

The odds of a collision were calculated at 1 in 1,000, which was high enough to warrant the maneuver. ESA scientists assessed the threat using data gathered by the U.S. Air Force, along with the “operators’ own knowledge of spacecraft positions,” according to SpaceNews.

In a statement emailed to Gizmodo, a SpaceX spokesperson said the Starlink team “last exchanged an email with the Aeolus operations team on August 28, when the probability of collision was only in the [1 in 50,000 range], well below the [1 in 10,000] industry standard threshold and 75 times lower than the final estimate.”

Once the U.S. Air Force’s updates showed that the probability had increased to more than 1 in 10,000, “a bug in our on-call paging system prevented the Starlink operator from seeing the follow on correspondence on this probability increase,” according to the spokesperson, who said “SpaceX is still investigating the issue and will implement corrective actions…. had the Starlink operator seen the correspondence, we would have coordinated with ESA to determine best approach with their continuing with their maneuver or our performing a maneuver.”

Yikes. This incident reveals the flimsy and primitive state of space traffic management, in which a failed communication led to ESA having to act unilaterally on the issue.

Source: SpaceX Says a ‘Bug’ Prevented It From Receiving Warning of Possible Satellite Collision

Well done, Elon Musk, incompetence does it again.

Mozilla says Firefox won’t defang ad blockers – unlike Google Chrome, which is steadily removing your privacy from 3rd parties

Posted on by

On Tuesday, Mozilla said it is not planning to change the ad-and-content blocking capabilities of Firefox to match what Google is doing in Chrome.

Google’s plan to revise its browser extension APIs, known as Manifest v3, follows from the web giant’s recognition that many of its products and services can be abused by unscrupulous developers. The search king refers to its product security and privacy audit as Project Strobe, “a root-and-branch review of third-party developer access to your Google account and Android device data.”

In a Chrome extension, the manifest file (manifest.json) tells the browser which files and capabilities (APIs) will be used. Manifest v3, proposed last year and still being hammered out, will alter and limit the capabilities available to extensions.

Developers who created extensions under Manifest v2 may have to revise their code to keep it working with future versions of Chrome. That may not be practical or possible in all cases, though. The developer of uBlock Origin, Raymond Hill, has said his web-ad-and-content-blocking extension will break under Manifest v3. It’s not yet clear whether uBlock Origin can or will be adapted to the revised API.

The most significant change under Manifest v3 is the deprecation of the blocking webRequest API (except for enterprise users), which lets extensions intercept incoming and outgoing browser data, so that the traffic can be modified, redirected or blocked.

Firefox not following

“In its place, Google has proposed an API called declarativeNetRequest,” explains Caitlin Neiman, community manager for Mozilla Add-ons (extensions), in a blog post.

“This API impacts the capabilities of content blocking extensions by limiting the number of rules, as well as available filters and actions. These limitations negatively impact content blockers because modern content blockers are very sophisticated and employ layers of algorithms to not only detect and block ads, but to hide from the ad networks themselves.”

Mozilla offers Firefox developers the Web Extensions API, which is mostly compatible with the Chrome extensions platform and is supported by Chromium-based browsers Brave, Opera and Vivaldi. Those other three browser makers have said they intend to work around Google’s changes to the blocking webRequest API. Now, Mozilla says as much.

“We have no immediate plans to remove blocking webRequest and are working with add-on developers to gain a better understanding of how they use the APIs in question to help determine how to best support them,” said Neiman.

[…]

Google maintains, “We are not preventing the development of ad blockers or stopping users from blocking ads,” even as it acknowledges “these changes will require developers to update the way in which their extensions operate.”

Yet Google’s related web technology proposal two weeks ago to build a “privacy sandbox,” through a series of new technical specifications that would hinder anti-tracking mechanisms, has been dismissed as disingenuous “privacy gaslighting.”

On Friday, EFF staff technologist Bennett Cyphers, lambasted the ad biz for its self-serving specs. “Google not only doubled down on its commitment to targeted advertising, but also made the laughable claim that blocking third-party cookies – by far the most common tracking technology on the Web, and Google’s tracking method of choice – will hurt user privacy,” he wrote in a blog post.

Source: Mozilla says Firefox won’t defang ad blockers – unlike a certain ad-giant browser • The Register

REVEALED: Hundreds of words to avoid using online if you don’t want the government spying on you

Posted on by

The Department of Homeland Security has been forced to release a list of keywords and phrases it uses to monitor social networking sites and online media for signs of terrorist or other threats against the U.S.

The intriguing the list includes obvious choices such as ‘attack’, ‘Al Qaeda’, ‘terrorism’ and ‘dirty bomb’ alongside dozens of seemingly innocent words like ‘pork’, ‘cloud’, ‘team’ and ‘Mexico’.

Released under a freedom of information request, the information sheds new light on how government analysts are instructed to patrol the internet searching for domestic and external threats.

The words are included in the department’s 2011 ‘Analyst’s Desktop Binder‘ used by workers at their National Operations Center which instructs workers to identify ‘media reports that reflect adversely on DHS and response activities’.

Department chiefs were forced to release the manual following a House hearing over documents obtained through a Freedom of Information Act lawsuit which revealed how analysts monitor social networks and media organisations for comments that ‘reflect adversely’ on the government.

However they insisted the practice was aimed not at policing the internet for disparaging remarks about the government and signs of general dissent, but to provide awareness of any potential threats.

As well as terrorism, analysts are instructed to search for evidence of unfolding natural disasters, public health threats and serious crimes such as mall/school shootings, major drug busts, illegal immigrant busts.

The list has been posted online by the Electronic Privacy Information Center – a privacy watchdog group who filed a request under the Freedom of Information Act before suing to obtain the release of the documents.

In a letter to the House Homeland Security Subcommittee on Counter-terrorism and Intelligence, the centre described the choice of words as ‘broad, vague and ambiguous’.

Threat detection: Released under a freedom of information request, the information sheds new light on how government analysts are instructed to patrol the internet searching for domestic and external threats

They point out that it includes ‘vast amounts of First Amendment protected speech that is entirely unrelated to the Department of Homeland Security mission to protect the public against terrorism and disasters.’

A senior Homeland Security official told the Huffington Post that the manual ‘is a starting point, not the endgame’ in maintaining situational awareness of natural and man-made threats and denied that the government was monitoring signs of dissent.

However the agency admitted that the language used was vague and in need of updating.

Spokesman Matthew Chandler told website: ‘To ensure clarity, as part of … routine compliance review, DHS will review the language contained in all materials to clearly and accurately convey the parameters and intention of the program.’

MIND YOUR LANGUAGE: THE LIST OF KEYWORDS IN FULL

List1

List

list3

Source: REVEALED: Hundreds of words to avoid using online if you don’t want the government spying on you | Daily Mail Online

Basically you’re being censored through the use of unnecessary, ubiquitous surveillance – by a democracy.

Scammer Successfully Deepfaked CEO’s Voice To Fool Underling Into Transferring $243,000

Posted on by

The CEO of an energy firm based in the UK thought he was following his boss’s urgent orders in March when he transferred funds to a third-party. But the request actually came from the AI-assisted voice of a fraudster.

The Wall Street Journal reports that the mark believed he was speaking to the CEO of his businesses’ parent company based in Germany. The German-accented caller told him to send €220,000 ($243,000 USD) to a Hungarian supplier within the hour. The firm’s insurance company, Euler Hermes Group SA, shared information about the crime with WSJ but would not reveal the name of the targeted businesses.

Euler Hermes fraud expert Rüdiger Kirsch told WSJ that the victim recognized his superior’s voice because it had a hint of a German accent and the same “melody.” This was reportedly the first time Euler Hermes has dealt with clients being affected by crimes that used AI mimicry.

Source: Scammer Successfully Deepfaked CEO’s Voice To Fool Underling Into Transferring $243,000

A way to repair tooth enamel

Posted on by

A team of researchers from Zhejiang University and Xiamen University has found a way to repair human tooth enamel. In their paper published in the journal Science Advances, the group describes their process and how well it worked when tested.

[…]

the researchers first created extremely tiny (1.5-nanometer diameter) clusters of calcium phosphate, the main ingredient of natural enamel. Each of the tiny clusters was then prepared with the triethylamine—doing so prevented the clusters from clumping together. The clusters were then mixed with a gel that was applied to a sample of crystalline hydroxyapatite—a material very similar to human enamel. Testing showed that the clusters fused with the stand-in, and in doing so, created a layer that covered the sample. They further report that the layer was much more tightly arranged than prior teams had achieved with similar work. They claim that such tightness allowed the new material to fuse with the old as a single layer, rather than multiple crystalline areas.

The team then carried out the same type of testing using real human teeth that had been treated with acid to remove the enamel. They report that within 48 hours of application, crystalline layers of approximately 2.7 micrometers had formed on the teeth. Close examination with a microscope showed that the had a fish-scale like structure very similar to that of natural enamel. Physical testing showed the enamel to be nearly identical to natural in strength and wear resistance.

The researchers note that more work is required before their technique can be used by dentists—primarily to make sure that it does not have any undesirable side effects.

Source: A way to repair tooth enamel

ESA satellite dodges a “mega constellation” – Musks cluster satellites

Posted on by

The European Space Agency (ESA) accomplished a first today: moving one of its satellites away from a potential collision with a “mega constellation”.

The constellation in question was SpaceX’s Starlink, and the firing of the thrusters of the Aeolus Earth observation satellite was designed to raise the orbit of the spacecraft to allow SpaceX’s satellite to pass beneath without risking a space slam.

The ESA operations team confirmed that this morning’s manoeuvre took place approximately half an orbit before the potential pileup. It also warned that, with further Starlink satellites in the pipeline and other constellations from the likes of Amazon due to launch, performing such moves manually would soon become impossible.

If plans to orbit thousands more satellites (to bring broadband to remote areas, or inflict it on air-travellers, for example) come to fruition, the ESA team reckons that things will need to be a lot more automated. Acronyms such as AI have been bandied around to create debris and constellation avoidance systems that move faster than the current human-based approach.

We contacted SpaceX to get its take on ESA’s antics, but nothing has yet emerged from Musk’s media orifice. If it does, we will update this article accordingly.

While this is a first for a “mega constellation”, ESA is well practiced at dodging satellites, although mostly dead ones (or debris.) In 2018, the boffins keeping track of things had to perform 28 manoeuvres. A swerve to miss an active spacecraft is, however, unusual.

Aeolus itself was launched on 22 August 2018, and is designed to acquire profiles of the Earth’s winds, handy for understanding the dynamics of weather and improving forecasting.

You can make your own joke about nervous squeaks of flatulence as scientists realised that the spacecraft, designed to spend just over three years in orbit, was headed toward a possible mash-up with one of Musk’s finest.

The incident serves as a timely reminder of the risks of flinging up thousands of small satellites to blanket the Earth with all manner of services. Keeping the things out of the way of each other and those spacecraft with more scientific goals will be an ever increasing challenge if the plans of Musk et al become a reality.

Source: Everyone remembers their first time: ESA satellite dodges a “mega constellation” • The Register

up to 2% of all Apple iPhones Hacked, says Google, and Breaks ALL messaging Encryption as well as sending location data

Posted on by

The potential impact of the latest attack on iPhones is massive, not to mention hugely concerning for every user of Apple’s famous smartphone.

That simply visiting a website can lead to your iPhone being hacked silently by some unknown party is worrying enough. But given that, according to Google researchers, it’s possible for the hackers to access encrypted messages on WhatsApp, iMessage, Telegram and others, the attacks undermine the security promised by those apps. It’s a stark reminder that should Apple’s iOS be compromised by hidden malware, encryption can be entirely undone. Own the operating system, own everything inside.

Among the trove of data released by Google researcher Ian Beer on the attacks was detail on the “monitoring implant” hackers installed on the iPhone. He noted that it had access to all the database files on the victim’s phone used by those end-to-end encrypted apps. Those databases “contain the unencrypted, plain-text of the messages sent and received using the apps.”

Today In: Innovation

The implant would also enable hackers to snoop on Gmail and Google Hangouts, contacts and photos. The hackers could also watch where users were going with a live GPS location tracker. And the malware stole the “keychain” where passwords, such as those for all remembered Wi-Fi points, are stored.

Shockingly, according to Beer, the hackers didn’t even bother encrypting the data they were stealing, making a further mockery of encrypted apps. “Everything is in the clear. If you’re connected to an unencrypted Wi-Fi network, this information is being broadcast to everyone around you, to your network operator and any intermediate network hops to the command and control server,” the Google researcher wrote. “This means that not only is the end-point of the end-to-end encryption offered by messaging apps compromised; the attackers then send all the contents of the end-to-end encrypted messages in plain text over the network to their server.”

Beer’s ultimate assessment is sobering: “The implant has access to almost all of the personal information available on the device, which it is able to upload, unencrypted, to the attacker’s server.”

And, Beer added, even once the iPhone has been cleaned of infection (which would happen on a device restart or with the patch applied), the information the hackers pilfered could be used to maintain access to people’s accounts. “Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device.

Iphone users should upgrade to the latest iOS as soon as they can to get a patch for the flaw, which was fixed earlier this year. Apple did not comment.

[…]

Avraham said he’d analyzed many cases of attacks on iPhones and iPads. He said he wouldn’t be surprised if the number of remotely infected iOS devices was anywhere between 0.1% and 2% of all 1 billion iPhones in use. That’d be either 1 million or 20 million.

“The only way to fight back is to patch vulnerabilities used as part of exploit chains while strategic mitigations are developed. This cannot be done effectively solely by Apple without the help of the security community,” Avraham added.

“Unfortunately the security community cannot help much due to Apple’s own restrictions. The current sandbox policies do not allow security analysts to extract malware from the device even if the device is compromised.”

Source: Apple iPhone Hack Exposed By Google Breaks WhatsApp Encryption

Some of The World’s Most-Cited Scientists Have Been Citing Themselves Through Citation Farms

Posted on by

A new study has revealed an unsettling truth about the citation metrics that are commonly used to gauge scientists’ level of impact and influence in their respective fields of research.

Citation metrics indicate how often a scientist’s research output is formally referenced by colleagues in the footnotes of their own papers – but a comprehensive analysis of this web of linkage shows the system is compromised by a hidden pattern of behaviour that often goes unnoticed.

Specifically, among the 100,000 most cited scientists between 1996 to 2017, there’s a stealthy pocket of researchers who represent “extreme self-citations and ‘citation farms’ (relatively small clusters of authors massively citing each other’s papers),” explain the authors of the new study, led by physician turned meta-researcher John Ioannidis from Stanford University.

[…]

Among the 100,000 most highly cited scientists for the period of 1996 to 2017, over 1,000 researchers self-cited more than 40 percent of their total citations – and over 8,500 researchers had greater than 25 percent self-citations.

There’s no suggestion that any of these self-citations are necessarily or automatically unethical or unwarranted or self-serving in themselves. After all, in some cases, your own published scientific research may be the best and most relevant source to link to.

But the researchers behind the study nonetheless suggest that the prevalence of extreme cases revealed in their analysis debases the value of citation metrics as a whole – which are often used as a proxy of a scientist’s standing and output quality (not to mention employability).

“With very high proportions of self-citations, we would advise against using any citation metrics since extreme rates of self-citation may herald also other spurious features,” the authors write.

“These need to be examined on a case-by-case basis for each author, and simply removing the self-citations may not suffice.”

[…]

“When we link professional advancement and pay attention too strongly to citation-based metrics, we incentivise self-citation,” psychologist Sanjay Srivastava from the University of Oregon, who wasn’t involved in the study, told Nature.

“Ultimately, the solution needs to be to realign professional evaluation with expert peer judgement, not to double down on metrics.”

The findings are reported in PLOS Biology.

Source: Some of The World’s Most-Cited Scientists Have a Secret That’s Just Been Exposed