Warren runs a false Facebook ad to protest false Facebook ads – Politicians can lie on social media ads

Elizabeth Warren has taken an attention-getting approach to attacking Facebook’s recent announcement that it won’t fact-check politicians’ posts. She’s running an ad on the social network that deliberately contains a falsehood.

“Breaking news: Mark Zuckerberg and Facebook just endorsed Donald Trump for re-election,” reads the ad, which Warren also tweeted out Saturday. The ad immediately corrects itself but says it’s making a point. “What Zuckerberg *has* done is given Trump free rein to lie on his platform,” it says, “and then pay Facebook gobs of money to push out their lies to American voters.”

Neither Facebook nor the White House immediately responded to a request for comment.

Late last month, Facebook said it exempts politicians from its third-party fact-checking process and that that’s been the policy for more than a year. The company treats speech from politicians “as newsworthy content that should, as a general rule, be seen and heard,” Facebook’s vice president of global affairs and communications, Nick Clegg, said at the time.

“We don’t believe … that it’s an appropriate role for us to referee political debates and prevent a politician’s speech from reaching its audience and being subject to public debate and scrutiny,” Clegg added.

Earlier this week, Facebook told Joe Biden’s presidential campaign that it wouldn’t remove an ad by Trump’s reelection campaign despite assertions that the ad contains misinformation about Biden. The 30-second video said Biden had threatened to withhold $1 billion from Ukraine unless officials there fired the prosecutor investigating a company that employed Biden’s son.

At the time, Tim Murtaugh, a spokesman for Trump’s campaign, said the ads were accurate. But Factcheck.org noted that while Biden did threaten to withhold US money from Ukraine, there’s no evidence he did this to help his son, which is what the Facebook ad implied. Factcheck.org also said there’s no evidence Biden’s son was ever under investigation and that Biden and the US weren’t alone in pressuring Ukraine to fire the prosecutor, who was widely seen as corrupt.

Responding to Facebook’s refusal to pull the ad, Biden spokesman T.J. Ducklo said at the time that  “the spread of objectively false information to influence public opinion poisons the public discourse and chips away at our democracy. It is unacceptable for any social media company to knowingly allow deliberately misleading material to corrupt its platform.”

And Warren tweeted then that Facebook was “deliberately allowing a candidate to intentionally lie to the American people.”

Warren has called for the breakup of Facebook and other big tech companies, saying in part that they wield too much influence. Other lawmakers have called for Facebook and rival platforms to be regulated as a way of addressing concerns about the spread of fake news, among other things.

Source: Warren runs a false Facebook ad to protest false Facebook ads – CNET

And who decides what the definition of a politician is?

White-hat hacks Muhstik ransomware gang and releases decryption keys

A user got his revenge on the ransomware gang who encrypted his files by hacking their server and releasing the decryption keys for all other victims.

This happened earlier today and involved the Muhstik gang. Muhstik is a recent strain of ransomware that has been active since late September, according to reports [1, 2, 3].

This ransomware targets network-attached storage (NAS) devices made by Taiwanese hardware vendor QNAP. The gang behind the Muhstik ransomware is brute-forcing QNAP NAS devices that use weak passwords for the built-in phpMyAdmin service, according to a security advisory published by the company last week.

After gaining access to the phpMyAdmin installation, Muhstik operators encrypt users’ files and save a copy of the decryption keys on their command and control (C&C) server. QNAP files encrypted by Muhstik can be recognized by each file’s new “.muhstik” file extension.

Annoyed software dev hacks back

One of the gang’s victims was Tobias Frömel, a German software developer. Frömel was one of the victims who paid the ransom demand so he could regain access to his files.

However, after paying the ransom, Frömel also analyzed the ransomware, gained insight into how Muhstik operated, and then retrieved the crooks’ database from their server.

“I know it was not legal from me,” the researcher wrote in a text file he published online on Pastebin earlier today, containing 2,858 decryption keys.

“I’m not the bad guy here,” Frömel added.

Free decryption method now available

Besides releasing the decryption keys, the German developer also published a decrypter that all Muhstik victims can use to unlock their files. The decrypter is available on MEGA [VirusTotal scan], and usage instructions are avaiable on the Bleeping Computer forum.

In the meantime, Frömel has been busy notifying Muhstik victims on Twitter about the decrypter’s availability, advising users against paying the ransom.

Source: White-hat hacks Muhstik ransomware gang and releases decryption keys | ZDNet

Apple Safari browser sends some user IP addresses to Chinese conglomerate Tencent by default

Apple admits that it sends some user IP addresses to Tencent in the “About Safari & Privacy” section of its Safari settings which can be accessed on an iOS device by opening the Settings app and then selecting “Safari > About Privacy & Security.” Under the title “Fraudulent Website Warning,” Apple says:

“Before visiting a website, Safari may send information calculated from the website address to Google Safe Browsing and Tencent Safe Browsing to check if the website is fraudulent. These safe browsing providers may also log your IP address.”

The “Fraudulent Website Warning” setting is toggled on by default which means that unless iPhone or iPad users dive two levels deep into their settings and toggle it off, their IP addresses may be logged by Tencent or Google when they use the Safari browser. However, doing this makes browsing sessions less secure and leaves users vulnerable to accessing fraudulent websites.

[…]

Even if people install a third-party browser on their iOS device, viewing web pages inside apps still opens them in an integrated form of Safari called Safari View Controller instead of the third-party browser. Tapping links inside apps also opens them in Safari rather than a third-party browser. These behaviors that force people back into Safari make it difficult for people to avoid the Safari browser completely when using an iPhone or iPad.

Source: Apple Safari browser sends some user IP addresses to Chinese conglomerate Tencent by default

An AI Pioneer Wants His Algorithms to Understand the ‘Why’

In March, Yoshua Bengio received a share of the Turing Award, the highest accolade in computer science, for contributions to the development of deep learning—the technique that triggered a renaissance in artificial intelligence, leading to advances in self-driving cars, real-time speech translation, and facial recognition.

Now, Bengio says deep learning needs to be fixed. He believes it won’t realize its full potential, and won’t deliver a true AI revolution, until it can go beyond pattern recognition and learn more about cause and effect. In other words, he says, deep learning needs to start asking why things happen.

[…]

Machine learning systems including deep learning are highly specific, trained for a particular task, like recognizing cats in images, or spoken commands in audio. Since bursting onto the scene around 2012, deep learning has demonstrated a particularly impressive ability to recognize patterns in data; it’s been put to many practical uses, from spotting signs of cancer in medical scans to uncovering fraud in financial data.

But deep learning is fundamentally blind to cause and effect. Unlike a real doctor, a deep learning algorithm cannot explain why a particular image may suggest disease. This means deep learning must be used cautiously in critical situations.

[…]

At his research lab, Bengio is working on a version of deep learning capable of recognizing simple cause-and-effect relationships. He and colleagues recently posted a research paper outlining the approach. They used a dataset that maps causal relationships between real-world phenomena, such as smoking and lung cancer, in terms of probabilities. They also generated synthetic datasets of causal relationships.

[…]

Others believe the focus on deep learning may be part of the problem. Gary Marcus, a professor emeritus at NYU and the author of a recent book that highlights the limits of deep learning, Rebooting AI: Building Artificial Intelligence We Can Trust, says Bengio’s interest in causal reasoning signals a welcome shift in thinking.

“Too much of deep learning has focused on correlation without causation, and that often leaves deep learning systems at a loss when they are tested on conditions that aren’t quite the same as the ones they were trained on,” he says.

Marcus adds that the lesson from human experience is obvious. “When children ask ‘why?’ they are asking about causality,” he says. “When machines start asking why, they will be a lot smarter.”

Source: An AI Pioneer Wants His Algorithms to Understand the ‘Why’ | WIRED

This is a hugely important – and old – question in this field. Without the ‘why’, humans must ‘just trust’ answers given by AI that seem intuitively strange. When you’re talking about health care or human related activities such as liability ‘just accept what I’m telling you’ isn’t good enough.

Human Employees Are Viewing Clips from Amazon’s Home Surveillance Service

Citing sources familiar with the program, Bloomberg reported Thursday that “dozens” of workers for the e-commerce giant who are based in Romania and India are tasked with reviewing footage collected by Cloud Cams—Amazon’s app-controlled, Alexa-compatible indoor security devices—to help improve AI functionality and better determine potential threats. Bloomberg reported that at one point, these human workers were responsible for reviewing and annotating roughly 150 security snippets of up to 30 seconds in length each day that they worked.

Two sources who spoke with Bloomberg told the outlet that some clips depicted private imagery, such as what Bloomberg described as “rare instances of people having sex.” An Amazon spokesperson told Gizmodo that reviewed clips are submitted either through employee trials or customer feedback submissions for improving the service.

[…]

So to be clear, customers are sharing clips for troubleshooting purposes, but they aren’t necessarily aware of what happens with that clip after doing so.

More troubling, however, is an accusation from one source who spoke with Bloomberg that some of these human workers tasked with annotating the clips may be sharing them with members outside of their restricted teams, despite the fact that reviews happen in a restricted area that prohibits phones. When asked about this, a spokesperson told Gizmodo by email that Amazon’s rules “strictly prohibit employee access to or use of video clips submitted for troubleshooting, and have a zero tolerance policy for about of our systems.”

[…]

To be clear, it’s not just Amazon who’s been accused of allowing human workers to listen in on whatever is going on in your home. Motherboard has reported that both Xbox recordings and Skype calls are reviewed by human contractors. Apple, too, was accused of capturing sensitive recordings that contractors had access to. The fact is these systems just aren’t ready for primetime and need human intervention to function and improve—a fact that tech companies have successfully downplayed in favor of appearing to be magical wizards of innovation.

Source: Human Employees Are Viewing Clips from Amazon’s Home Surveillance Service

System76 Will Begin Shipping 2 Linux Laptops With Coreboot-Based Open Source Firmware

System76, the Denver-based Linux PC manufacturer and developer of Pop OS, has some stellar news for those of us who prefer our laptops a little more open. Later this month the company will begin shipping two of their laptop models with its Coreboot-powered open source firmware.

Beginning today, System76 will start taking pre-orders for both the Galago Pro and Darter Pro laptops. The systems will ship out later in October, and include the company’s Coreboot-based open source firmware which was previously teased at the 2019 Open Source Firmware Conference.

(Coreboot, formerly known as LinuxBIOS, is a software project aimed at replacing proprietary firmware found in most computers with a lightweight firmware designed to perform only the minimum number of tasks necessary to load and run a modern 32-bit or 64-bit operating system.)

What’s so great about ripping out the proprietary firmware included in machines like this and replacing it with an open alternative? To begin with, it’s leaner. System76 claims that users can boot from power off to the desktop 29% faster with its Coreboot-based firmware.

Source: System76 Will Begin Shipping 2 Linux Laptops With Coreboot-Based Open Source Firmware

Managed Retreat Buyout Efforts Have Relocated 40,000 Households to avoid rising seawater: Study

The U.S. is slowly being gripped by a flooding crisis as seas rise and waterways overflow with ever more alarming frequency. An idea at the forefront for how to help Americans cope is so-called managed retreat, a process of moving away from affected areas and letting former neighborhoods return to nature. It’s an idea increasingly en vogue as it becomes clearer that barriers won’t be enough to keep floodwaters at bay.

But new research shows a startling finding: Americans are already retreating. More than 40,000 households have been bought out by the federal government over the past three decades. The research published in Science Advances on Wednesday also reveals that there are disparities between which communities opt-in for buyout programs and, even more granularly, which households take the offers and relocate away. The cutting-edge research answers questions that have been out there for a while and raises a whole host of new ones that will only become more pressing in the coming decades as Earth continues to warm.

“People are using buyouts and doing managed retreat,” AR Siders, a climate governance researcher at Harvard and study author, said during a press call. “No matter how difficult managed retreat sounds, we know that there are a thousand communities in the United States, all over the country, who have made it work. I want to hear their stories, I want to know how they did it.”

Source: Managed Retreat Buyout Efforts Have Relocated 40,000 Households: Study

Meet the Money Behind The Climate Denial Movement

Nearly a billion dollars a year is flowing into the organized climate change counter-movement

The overwhelming majority of climate scientists, international governmental bodies, relevant research institutes and scientific societies are in unison in saying that climate change is real, that it’s a problem, and that we should probably do something about it now, not later. And yet, for some reason, the idea persists in some peoples’ minds that climate change is up for debate, or that climate change is no big deal.

Actually, it’s not “for some reason” that people are confused. There’s a very obvious reason. There is a very well-funded, well-orchestrated climate change-denial movement, one funded by powerful people with very deep pockets. In a new and incredibly thorough study, Drexel University sociologist Robert Brulle took a deep dive into the financial structure of the climate deniers, to see who is holding the purse strings.

According to Brulle’s research, the 91 think tanks and advocacy organizations and trade associations that make up the American climate denial industry pull down just shy of a billion dollars each year, money used to lobby or sway public opinion on climate change and other issues.

“The anti-climate effort has been largely underwritten by conservative billionaires,” says the Guardian, “often working through secretive funding networks. They have displaced corporations as the prime supporters of 91 think tanks, advocacy groups and industry associations which have worked to block action on climate change.”

Source: Meet the Money Behind The Climate Denial Movement | Smart News | Smithsonian

Twitter: No, really, we’re very sorry we sold your security info for a boatload of cash

Twitter says it was just an accident that caused the microblogging giant to let advertisers use private information to better target their marketing materials at users.

The social networking giant on Tuesday admitted to an “error” that let advertisers have access to the private information customers had given Twitter in order to place additional security protections on their accounts.

“We recently discovered that when you provided an email address or phone number for safety or security purposes (for example, two-factor authentication) this data may have inadvertently been used for advertising purposes, specifically in our Tailored Audiences and Partner Audiences advertising system,” Twitter said.

“When an advertiser uploaded their marketing list, we may have matched people on Twitter to their list based on the email or phone number the Twitter account holder provided for safety and security purposes. This was an error and we apologize.”

Twitter assures users that no “personal” information was shared, though we’re not sure what Twitter would consider “personal information” if your phone number and email address do not meet the bar.

Source: Twitter: No, really, we’re very sorry we sold your security info for a boatload of cash • The Register

Remember the FBI’s promise it wasn’t abusing the NSA’s data on US citizens? Well, guess what… It was worse than the privacy advocates dreamt

The FBI routinely misused a database, gathered by the NSA with the specific purpose of searching for foreign intelligence threats, by searching it for everything from vetting to spying on relatives.

In doing so, it not only violated the law and the US constitution but knowingly lied to the faces of congressmen who were asking the intelligence services about this exact issue at government hearings, hearings that were intended to find if there needed to be additional safeguards added to the program.

That is the upshot of newly declassified rulings of the secret FISC court that decides issues of spying and surveillance within the United States.

On Tuesday, in a year-old ruling [PDF] that remains heavily redacted, everything that both privacy advocates and a number of congressmen – particularly Senator Ron Wyden (D-OR) – feared was true of the program turned out to be so, but worse.

Even though the program in question – Section 702 – is specifically designed only to be used for US government agencies to be allowed to search for evidence of foreign intelligence threats, the FBI gave itself carte blanche to search the same database for US citizens by stringing together a series of ridiculous legal justifications about data being captured “incidentally” and subsequent queries of that data not requiring a warrant because it had already been gathered.

Despite that situation, the FBI repeatedly assured lawmakers and the courts that it was using its powers in a very limited way. Senator Wyden was not convinced and used his position to ask questions about the program, the answers to which raised ever greater concerns.

For example, while the NSA was able to outline the process by which its staff was allowed to make searches on the database, including who was authorized to dig further, and it was able to give a precise figure for how many searches there had been, the FBI claimed it was literally not able to do so.

Free for all

Any FBI agent was allowed to search the database, it revealed under questioning, any FBI agent was allowed to de-anonymize the data and the FBI claimed it did not have a system to measure the number of search requests its agents carried out.

In a year-long standoff between Senator Wyden and the Director of National Intelligence, the government told Congress it was not able to get a number for the number of US citizens whose details had been brought up in searches – something that likely broke the Fourth Amendment.

Today’s release of the FISC secret opinion reveals that giving the FBI virtually unrestricted access to the database led to exactly the sort of behavior that people were concerned about: vast number of searches, including many that were not remotely justified.

For example, the DNI told Congress that in 2016, the NSA had carried out 30,355 searches on US persons within the database’s metadata and 2,280 searches on the database’s content. The CIA had carried out 2,352 search on content for US persons in the same 12-month period. The FBI said it had no way to measure it the number of searches it ran.

But that, it turns out, was a bold-faced lie. Because we now know that the FBI carried out 6,800 queries of the database in a single day in December 2017 using social security numbers. In other words, the FBI was using the NSA’s database at least 80 times more frequently than the NSA itself.

The FBI’s use of the database – which, again, is specifically defined in law as only being allowed to be used for foreign intelligence matters – was completely routine. And a result, agents started using it all the time for anything connected to their work, and sometimes their personal lives.

In the secret court opinion, now made public (but, again, still heavily redacted), the government was forced to concede that there were “fundamental misunderstandings” within the FBI staff over what criteria they needed to meet before carrying out a search.

Source: Remember the FBI’s promise it wasn’t abusing the NSA’s data on US citizens? Well, guess what… • The Register

Article continues on the site

FBI warns about attacks that bypass multi-factor authentication (MFA)

Basically sim swapping, man in the middle attacks and poor URL protections

FBI warns about SIM swapping and tools like Muraen and NecroBrowser.

“The FBI has observed cyber actors circumventing multi-factor authentication through common social engineering and technical attacks,” the FBI wrote in a Private Industry Notification (PIN) sent out on September 17.

Past incidents of MFA bypasses

While nowadays there are multiple ways of bypassing MFA protections, the FBI alert specifically warned about SIM swapping, vulnerabilities in online pages handling MFA operations, and the use of transparent proxies like Muraen and NecroBrowser.

To get the point across, the FBI listed recent incidents where hackers had used these techniques to bypass MFA and steal money from companies and regular users alike. We cite from the report:

  • In 2016 customers of a US banking institution were targeted by a cyber attacker who ported their phone numbers to a phone he owned-an attack called SIM swapping. The attacker called the phone companies’ customer service representatives, finding some who were more willing to provide him information to complete the SIM swap. Once the attacker had control over the customers’ phone numbers, he called the bank to request a wire transfer from the victims’ accounts to another account he owned. The bank, recognizing the phone number as belonging to the customer, did not ask for full security questions but requested a one-time code sent to the phone number from which he was calling. He also requested to change PINs and passwords and was able to attach victims’ credit card numbers to a mobile payment application.
  • Over the course of 2018 and 2019, the FBI’s Internet Crime Complaint Center and FBI victim complaints observed the above attack-SIM swapping-as a common tactic from cyber criminals seeking to circumvent two-factor authentication. Victims of these attacks have had their phone numbers stolen, their bank accounts drained, and their passwords and PINs changed. Many of these attacks rely on socially engineering customer service representatives for major phone companies, who give information to the attackers.
  • In 2019 a US banking institution was targeted by a cyber attacker who was able to take advantage of a flaw in the bank’s website to circumvent the two-factor authentication implemented to protect accounts. The cyber attacker logged in with stolen victim credentials and, when reaching the secondary page where the customer would normally need to enter a PIN and answer a security question, the attacker entered a manipulated string into the Web URL setting the computer as one recognized on the account. This allowed him to bypass the PIN and security question pages and initiate wire transfers from the victims’ accounts.
  • In February 2019 a cyber security expert at the RSA Conference in San Francisco, demonstrated a large variety of schemes and attacks cyber actors could use to circumvent multi-factor authentication. The security expert presented real-time examples of how cyber actors could use man-in-the-middle attacks and session hijacking to intercept the traffic between a user and a website to conduct these attacks and maintain access for as long as possible. He also demonstrated social engineering attacks, including phishing schemes or fraudulent text messages purporting to be a bank or other service to cause a user to log into a fake website and give up their private information.
  • At the June 2019 Hack-in-the-Box conference in Amsterdam, cyber security experts demonstrated a pair of tools – Muraena and NecroBrowser – which worked in tandem to automate a phishing scheme against users of multi-factor authentication. The Muraena tool intercepts traffic between a user and a target website where they are requested to enter login credentials and a token code as usual. Once authenticated, NecroBrowser stores the data for the victims of this attack and hijacks the session cookie, allowing cyber actors to log into these private accounts, take them over, and change user passwords and recovery e-mail addresses while maintaining access as long as possible.

MFA is still effective

The FBI made it very clear that its alert should be taken only as a precaution, and not an attack on the efficiency of MFA, which the agency still recommends. The FBI still recommends that companies use MFA.

Source: FBI warns about attacks that bypass multi-factor authentication (MFA) | ZDNet

Saturn surpasses Jupiter after the discovery of 20 new moons and you can help name them!

A team led by Carnegie’s Scott S. Sheppard has found 20 new moons orbiting Saturn.  This brings the ringed planet’s total number of moons to 82, surpassing Jupiter, which has 79. The discovery was announced Monday by the International Astronomical Union’s Minor Planet Center.

Each of the newly discovered moons is about five kilometers, or three miles, in diameter. Seventeen of them orbit the planet backwards, or in a retrograde direction, meaning their movement is opposite of the planet’s rotation around its axis. The other three moons orbit in the prograde—the same direction as Saturn rotates.

Two of the prograde moons are closer to the planet and take about two years to travel once around Saturn. The more-distant retrograde moons and one of the prograde moons each take more than three years to complete an orbit.

Source: Saturn surpasses Jupiter after the discovery of 20 new moons and you can help name them! | Carnegie Institution for Science

Rodents With Part-Human Brains Pose a New Challenge for Bioethics

Rapid progress in research involving miniature human brains grown in a dish has led to a host of ethical concerns, particularly when these human brain cells are transplanted into nonhuman animals. A new paper evaluates the potential risks of creating “humanized” animals, while providing a pathway for scientists to move forward in this important area.

Neuroscientist Isaac Chen from the Perelman School of Medicine at the University of Pennsylvania, along with his colleagues, has written a timely Perspective paper published today in the science journal Cell Stem Cell. The paper was prompted by recent breakthroughs involving the transplantation of human brain organoids into rodents—a practice that’s led to concerns about the “humanization” of lab animals.

In their paper, the authors evaluate the current limits of this biotechnology and the potential risks involved, while also looking ahead to the future. Chen and his colleagues don’t believe anything needs to be done right now to limit these sorts of experiments, but that could change once scientists start to enhance certain types of brain functions in chimeric animals, that is, animals endowed with human attributes, in this case human brain cells.

In the future, the authors said, scientists will need to be wary of inducing robust levels of consciousness in chimeric animals and even stand-alone brain organoids, similar to the sci-fi image of a conscious brain in a vat.

Cross-section of a brain organoid.
Image: Trujillo et al., 2019, Cell Stem Cell

Human brain organoids are proving to be remarkably useful. Made from human stem cells, brain organoids are tiny clumps of neural cells which scientists can use in their research.

To be clear, pea-sized organoids are far too basic to induce traits like consciousness, feelings, or any semblance of awareness, but because they consist of living human brain cells, scientists can use them to study brain development, cognitive disorders, and the way certain diseases affect the brain, among other things. And in fact, during the opening stages of the Zika outbreak, brain organoids were used to study how the virus infiltrates brain cells.

The use of brain organoids in this way is largely uncontroversial, but recent research involving the transplantation of human brain cells into rodent brains is leading to some serious ethical concerns, specifically the claim that scientists are creating part-human animals.

Anders Sandberg, a researcher at the University of Oxford’s Future of Humanity Institute, said scientists are not yet able to generate full-sized brains due to the lack of blood vessels, supporting structure, and other elements required to build a fully functioning brain. But that’s where lab animals can come in handy.

“Making organoids of human brain cells is obviously interesting both for regenerating brain damage and for research,” explained Sandberg, who’s not affiliated with the new paper. “They do gain some structure, even though it is not like a full brain or even part of a brain. One way of getting around the problem of the lack of blood vessels in a petri dish is to implant them in an animal,” he said. “But it’s at this point when people start to get a bit nervous.”

The concern, of course, is that the human neural cells, when transplanted into a nonhuman animal, say a mouse or rat, will somehow endow the creature with human-like traits, such as greater intelligence, more complex emotions, and so on.

Source: Rodents With Part-Human Brains Pose a New Challenge for Bioethics

This is a very well considered article, very much worth reading further above.

To find the best parking spot, do the math

The next time you’re hunting for a parking spot, mathematics could help you identify the most efficient strategy, according to a recent paper in the Journal of Statistical Mechanics. It’s basically an optimization problem: weighing different variables and crunching the numbers to find the optimal combination of those factors. In the case of where to put your car, the goal is to strike the optimal balance of parking close to the target—a building entrance, for example—without having to waste too much time circling the lot hunting for the closest space.

Paul Krapivsky of Boston University and Sidney Redner of the Santa Fe Institute decided to build their analysis around an idealized parking lot with a single row (a semi-infinite line), and they focused on three basic parking strategies. A driver who employs a “meek” strategy will take the first available spot, preferring to park as quickly as possible even if there might be open spots closer to the entrance. A driver employing an “optimistic” strategy will go right to the entrance and then backtrack to find the closest possible spot.

Finally, drivers implementing a “prudent” strategy will split the difference. They might not grab the first available spot, figuring there will be at least one more open spot a bit closer to the entrance. If there isn’t, they will backtrack to the space a meek driver would have claimed immediately.

[…]

Based on their model, the scientists concluded that the meek strategy is the least effective of the three, calling it “risibly inefficient” because “many good parking spots are unfilled and most cars are parked far from the target.”

Determining whether the optimistic or prudent strategy was preferable proved trickier, so they introduced a cost variable. They defined it as “the distance from the parking spot to the target plus time wasted looking for a parking spot.” Their model also assumes the speed of the car in the lot is the same as average walking speed.

“On average, the prudent strategy is less costly,” the authors concluded. “Thus, even though the prudent strategy does not allow the driver to take advantage of the presence of many prime parking spots close to the target, the backtracking that must always occur in the optimistic strategy outweighs the benefit.” Plenty of people might indeed decide that walking a bit farther is an acceptable tradeoff to avoid endlessly circling a crowded lot hunting for an elusive closer space. Or maybe they just want to rack up a few extra steps on their FitBit.

The authors acknowledge some caveats to their findings. This is a “minimalist physics-based” model, unlike more complicated models used in transportation studies that incorporate factors like parking costs, time limits, and so forth. And most parking lots are not one-dimensional (a single row). The model used by the authors also assumes that cars enter the lot from the right at a fixed rate, and every car will have time to find a spot before the next car enters—a highly unrealistic scenario where there is no competition between cars for a given space. (Oh, if only…)

Source: To find the best parking spot, do the math | Ars Technica

US, UK and Australia want Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook’s Apps – because they want to be able to spy on you. As will other criminals. What happened to the “Free world”?

Attorney General Bill Barr, along with officials from the United Kingdom and Australia, is set to publish an open letter to Facebook CEO Mark Zuckerberg asking the company to delay plans for end-to-end encryption across its messaging services until it can guarantee the added privacy does not reduce public safety.

A draft of the letter, dated Oct. 4, is set to be released alongside the announcement of a new data-sharing agreement between law enforcement in the US and the UK; it was obtained by BuzzFeed News ahead of its publication.

Signed by Barr, UK Home Secretary Priti Patel, acting US Homeland Security Secretary Kevin McAleenan, and Australian Minister for Home Affairs Peter Dutton, the letter raises concerns that Facebook’s plan to build end-to-end encryption into its messaging apps will prevent law enforcement agencies from finding illegal activity conducted through Facebook, including child sexual exploitation, terrorism, and election meddling.

Source: Attorney General Bill Barr Will Ask Zuckerberg To Halt Plans For End-To-End Encryption Across Facebook’s Apps

Bitcoin Isn’t the World’s Most-Used Cryptocurrency – it’s a centralised one run by some private company in Hong Kong

With Tether’s monthly trading volume about 18% higher than that of Bitcoin, it’s arguably the most important coin in the crypto ecosystem. Tether’s also one of the main reasons why regulators regard cryptocurrencies with a wary eye, and have put the breaks on crypto exchange-traded funds amid concern of market manipulation.

“If there is no Tether, we lose a massive amount of daily volume — around $1 billion or more depending on the data source,” said Lex Sokolin, global financial technology co-head at ConsenSys, which offers blockchain technology. “Some of the concerning potential patters of trading in the market may start to fall away.”

Coins With Biggest Daily Trading Volumes

In billions of U.S. dollars

Source: CoinMarketCap.com

Values as of Sept. 27, 2019

Tether is the world’s most used stablecoin, a category of tokens that seek to avoid price fluctuations, often through pegs or reserves. It’s also a pathway for most of the world’s active traders into the crypto market. In countries like China, where crypto exchanges are banned, people can pay cash over the counter to get Tethers with few questions asked, according to Sokolin. From there, they can trade Tethers for Bitcoin and other cryptocurrencies, he said.

“For many people in Asia, they like the idea that it’s this offshore, opaque thing out of reach of the U.S. government,” said Jeremy Allaire, chief executive officer of Circle, which supports a rival stablecoin called USD Coin. “It’s a feature, not a problem.”

Read more: A QuickTake explains the allure of stablcoins

Tether, which is being sued by New York for allegedly commingling funds including reserves, says using a know-your-customer form and approval process is required to issue and redeem the coin.

Asian traders account for about 70% of all crypto trading volume, according to Allaire, and Tether was used in 40% and 80% of all transactions on two of the world’s top exchanges, Binance and Huobi, respectively, Coin Metrics said earlier this year.

Many people don’t even know they use Tether, said Thaddeus Dryja, a research scientist at the Massachusetts Institute of Technology. Because traditional financial institutions worry that they don’t sniff out criminals and money launderers well enough, most crypto exchanges still don’t have bank accounts and can’t hold dollars on behalf of customers. So they use Tether as a substitute, Dryja said.

“I don’t think people actually trust Tether — I think people use Tether without realizing that they are using it, and instead think they have actual dollars in a bank account somewhere,” Dryja said. Some exchanges mislabel their pages, to convey the impression that customers are holding dollars instead of Tethers, he said.

Tether’s Market Cap Balloons

In U.S. dollars

Source: CoinMarketCap.com

The way Tether is managed and governed makes it a black box. While Bitcoin belongs to no one, Tether is issued by a Hong Kong-based private company whose proprietors also own the Bitfinex crypto exchange. The exact mechanism by which Tether’s supply is increased and decreased is unclear. Exactly how much of the supply is covered by fiat reserves is in question, too, as Tether is not independently audited. In April, Tether disclosed that 74% of the Tethers are covered by cash and short-term securities, while it previously said it had a 100% reserve.

The disclosure was a part of an ongoing investigation into Tether by the New York Attorney General, which accused the companies behind the coin of a coverup to hide the loss of $850 million of comingled client and corporate funds.

John Griffin, a finance professor at the University of Texas at Austin, said that half of Bitcoin’s runup in 2017 was the result of market manipulation using Tether. Last year Bloomberg reported that the U.S. Justice Department is investigating Tether’s role in this market manipulation.

Convenience Versus Risk

“Being controlled by centralized parties defeats the entire original purpose of blockchain and decentralized cryptocurrencies,” Griffin said. “By avoiding government powers, stablecoins place trust instead in the hands of big tech companies, who have mixed accountability. So while the idea is great in theory, in practice it is risky, open to abuse, and plagued by similar problems to traditional fiat currencies.”

Source: Bitcoin Isn’t the World’s Most-Used Cryptocurrency – Bloomberg

Egypt caught spying on journalists and human rights activists through malware and phishing

Back in March 2019, Amnesty International published a report that uncovered a targeted attack against journalists and human rights activists in Egypt. The victims even received an e-mail from Google warning them that government-backed attackers attempted to steal their passwords.

According to the report, the attackers did not rely on traditional phishing methods or credential-stealing payloads, but rather utilized a stealthier and more efficient way of accessing the victims’ inboxes: a technique known as “OAuth Phishing”. By abusing third-party applications for popular mailing services such as Gmail or Outlook, the attackers manipulated victims into granting them full access to their e-mails.

Fig 1: Previous OAuth phishing campaign

Recently, we were able to find previously unknown or undisclosed malicious artifacts belonging to this operation. A new website we attributed to this malicious activity revealed that the attackers are going after their prey in more than one way, and might even be hiding in plain sight: developing mobile applications to monitor their targets, and hosting them on Google’s official Play Store.

After we notified Google about the involved applications, they quickly took them off of the Play Store and banned the associated developer.

 

Infrastructure: The Early Days

The full list of indicators belonging to this campaign and shared by Amnesty on GitHub showed multiple websites that used keywords such as “mail”, “secure”, or “verify”, possibly not to arouse any suspicions and to masquerade as legitimate mailing services.

By visualizing the information available about each of these websites, we saw clear connections between them: they were registered using NameCheap, had HTTPS certificates, and many of them resolved to the same IP addresses.

The addresses shared the same IPv4 range or netblock (185.125.228[.]0/22), which belongs to a Russian telecommunications company called MAROSNET.

Fig 2: Maltego visualization of campaign infrastructure

Naturally, the websites cannot be accessed nowadays, but by looking over public scans available for some of them we could see that in addition to being related to OAuth phishing, they hosted phishing pages that impersonated Outlook or Facebook and tried to steal log-in credentials for those services

[…]

Following up on the investigation first conducted by Amnesty International, we revealed new aspects of the attack that has been after Egypt’s civil society since at least 2018.

Whether it is phishing pages, legitimate-looking applications for Outlook and Gmail, and mobile applications to track a device’s communications or location, it is clear that the attackers are constantly coming up with creative and versatile methods to reach victims, spy on their accounts, and monitor their activity.

We discovered a list of victims that included handpicked political and social activists, high-profile journalists and members of non-profit organizations in Egypt.

The information we gathered from our investigation suggested that the perpetrators are Arabic speakers, and well familiar with the Egyptian ecosystem. Because the attack might be government-backed, it means that we are looking at what might be a surveillance operation of a country against its own citizens or of another government that screens some other attack using this noisy one.

Source: The Eye on the Nile – Check Point Research

Paralysed man moves in mind-reading exoskeleton

A man has been able to move all four of his paralysed limbs with a mind-controlled exoskeleton suit, French researchers report.

Thibault, 30, said taking his first steps in the suit felt like being the “first man on the Moon”.

His movements, particularly walking, are far from perfect and the robo-suit is being used only in the lab.

But researchers say the approach could one day improve patients’ quality of life.

Thibault had surgery to place two implants on the surface of the brain, covering the parts of the brain that control movement

Sixty-four electrodes on each implant read the brain activity and beam the instructions to a nearby computer

Sophisticated computer software reads the brainwaves and turns them into instructions for controlling the exoskeleton

[…]

in 2017, he took part in the exoskeleton trial with Clinatec and the University of Grenoble.

Initially he practised using the brain implants to control a virtual character, or avatar, in a computer game, then he moved on to walking in the suit.

Media captionMind-controlled exoskeleton allows paralysed 30-year-old man to walk in French lab

“It was like [being the] first man on the Moon. I didn’t walk for two years. I forgot what it is to stand, I forgot I was taller than a lot of people in the room,” he said.

It took a lot longer to learn how to control the arms.

“It was very difficult because it is a combination of multiple muscles and movements. This is the most impressive thing I do with the exoskeleton.”

[…]

“This is far from autonomous walking,” Prof Alim-Louis Benabid, the president of the Clinatec executive board, told BBC News.

[…]

In tasks where Thibault had to touch specific targets by using the exoskeleton to move his upper and lower arms and rotate his wrists, he was successful 71% of the time.

Prof Benabid, who developed deep brain stimulation for Parkinson’s disease, told the BBC: “We have solved the problem and shown the principle is correct. This is proof we can extend the mobility of patients in an exoskeleton.

[…]

At the moment they are limited by the amount of data they can read from the brain, send to a computer, interpret and send to the exoskeleton in real-time.

They have 350 milliseconds to go from thought to movement otherwise the system becomes difficult to control.

It means out of the 64 electrodes on each implant, the researchers are using only 32.

So there is still the potential to read the brain in more detail using more powerful computers and AI to interpret the information from the brain.

Source: Paralysed man moves in mind-reading exoskeleton – BBC News

Iran tried to hack hundreds of politicians, journalists email accounts last month, warns Microsoft

The Iranian government has attempted to hack into hundreds of Office 365 email accounts belonging to politicians, government officials and journalists last month, Microsoft has warned.

“We’ve recently seen significant cyber activity by a threat group we call Phosphorous, which we believe originates from Iran and is linked to the Iranian government,” Microsoft’s vice president of customer security and trust Tom Burt said in a blog post on Friday.

Redmond’s bit wranglers observed more than 2,700 attempts to hack into 241 different accounts, according to the software giant. It noted that those accounts “are associated with a US presidential campaign, current and former US government officials, journalists covering global politics and prominent Iranians living outside Iran.”

Microsoft says that only four of the 241 accounts were compromised and none of them were connected to government officials or presidential campaigns. It says the accounts are now secure the owners are aware of the activity.

Notably, Microsoft says the hacking efforts were “not technically sophisticated” but used personal information gathered elsewhere to try to prompt password reset or account recovery in an effort to get into the accounts.

“For example, they would seek access to a secondary email account linked to a user’s Microsoft account, then attempt to gain access to a user’s Microsoft account through verification sent to the secondary account,” Microsoft explained.

It also appears that the hackers attempted to bypass two-factor authentication. “In some instances, they gathered phone numbers belonging to their targets and used them to assist in authenticating password resets,” the company said. It described the attackers as “highly motivated and willing to invest significant time and resources.”

Instead Microsoft proposes that people used its Authenticator app, which provides a login code that changes every 30 seconds in order to access their accounts.

How come Iran?

The company did not go into any detail over why it believes the Iranian government is behind the hacks beyond noting that those targeted included “prominent Iranians living outside Iran.” Presumably, it was able to identify the same pattern of hacking efforts with other accounts not directly connected with Iran and extrapolated from that.

Source: Iran tried to hack hundreds of politicians, journalists email accounts last month, warns Microsoft • The Register

Attackers exploit 0-day vulnerability that gives full control of Android phones

Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night.

There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the “exploit has nothing to do with NSO.” Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content.

“The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”

[…]

The use-after-free vulnerability originally appeared in the Linux kernel and was patched in early 2018 in version 4.14, without the benefit of a tracking CVE. That fix was incorporated into versions 3.18, 4.4, and 4.9 of the Android kernel. For reasons that weren’t explained in the post, the patches never made their way into Android security updates. That would explain why earlier Pixel models are vulnerable and later ones are not. The flaw is now tracked as CVE-2019-2215.

[…]

Project Zero gives developers 90 days to issue a fix before publishing vulnerability reports except in cases of active exploits. The Android vulnerability in this case was published seven days after it was privately reported to the Android team.

Source: Attackers exploit 0-day vulnerability that gives full control of Android phones | Ars Technica

The exploit has been seen being used in the wild, which is why it was disclosed after 7 days.

TensorFlow 2.0 is now available!

TensorFlow 2.0 is driven by the community telling us they want an easy-to-use platform that is both flexible and powerful, and which supports deployment to any platform. TensorFlow 2.0 provides a comprehensive ecosystem of tools for developers, enterprises, and researchers who want to push the state-of-the-art in machine learning and build scalable ML-powered applications.

Coding with TensorFlow 2.0

TensorFlow 2.0 makes development of ML applications much easier. With tight integration of Keras into TensorFlow, eager execution by default, and Pythonic function execution, TensorFlow 2.0 makes the experience of developing applications as familiar as possible for Python developers. For researchers pushing the boundaries of ML, we have invested heavily in TensorFlow’s low-level API: We now export all ops that are used internally, and we provide inheritable interfaces for crucial concepts such as variables and checkpoints. This allows you to build onto the internals of TensorFlow without having to rebuild TensorFlow.

Source: TensorFlow 2.0 is now available! – TensorFlow – Medium

TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

The popular short-form video app will no longer run ads from politicians or candidates at any level of government because “the nature of paid political ads is not something we believe fits the TikTok platform experience,” TikTok’s VP of global business solutions, Blake Chandlee, announced in a blog post Thursday. This ban also covers “election-related ads, advocacy ads, or issue ads.”

And it’s true, TikTok didn’t become the fourth-largest social media platform in record time by facilitating debate and political discussions; we can already yell at each other on Facebook and Twitter for that. No, most users log on to TikTok to post silly lip-sync videos or their take on the newest trending hashtag, and if politics are mentioned it’s usually in reference to whatever’s the latest viral meme.

While TikTok has only begun experimenting with paid ad formats, Chandlee wrote that, throughout the process, the company is committed to preserving “the app’s light-hearted and irreverent feeling” that makes users want to spend their time there in the first place. Political ads often loaded with barbs aimed at tearing down opposing candidates just don’t vibe with that.

Source: TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics

If you’re not a big fan of classical art, you’d probably have a hard time pointing out what artist painted a certain painting. Well, your days of guessing are finally over – someone created a handy, albeit pretty hilarious, guide on how to recognize famous painters by their paintings and it’s surprisingly accurate.

The helpful guide, created by Reddit user DontTacoBoutIt, will help you recognize famous painters by pointing out the distinctive style elements in their paintings – in a hilarious way. From the Putin-like characters of Van Eyck to the chubby cupids of Boucher, check out this funny art guide in the gallery below!

#1 If Everyone – Including The Women – Looks Like Putin, Then It’s Van Eyck

Image source: flickerdart

Jan van Eyck

#2 If Everyone Looks Like Hobos Illuminated Only By A Dim Streetlamp, It’s Rembrandt

Image source: flickerdart

Rembrandt Harmenszoon van Rijn

#3 If It’s Something You Saw On Your Acid Trip Last Night, It’s Dali

Image source: flickerdart

Salvador Dalí

#4 If The Paintings Have Lots Of Little People In Them But Also Have A Ton Of Crazy Bulls#%t, It’s Bosch

Image source: flickerdart

Hieronymus Bosch

#5 If Everybody Has Some Sort Of Body Malfunction, Then It’s Picasso

Image source: flickerdart

Pablo Ruiz Picasso

#6 Lord Of The Rings Landscapes With Weird Blue Mist And The Same Wavy-Haired Aristocratic-Nose Madonna, It’s Da Vinci

Image source: flickerdart

Leonardo da Vinci

#7 Dappled Light And Unhappy Party-Time People, Then It’s Manet

Image source: flickerdart

Édouard Manet

#8 If You See A Ballerina, It’s Degas

Image source: flickerdart

Edgar Degas

#9 Dappled Light But No Figures, It’s Monet

Image source: flickerdart

Claude Monet

#10 If Everyone Is Beautiful, Naked, And Stacked, It’s Michelangelo

Image source: flickerdart

Michelangelo di Lodovico Buonarroti Simoni

#11 Dappled Light And Happy Party-Time People, It’s Renoir

Image source: flickerdart

Pierre-Auguste Renoir

#12 If The Images Have A Dark Background And Everyone Has Tortured Expressions On Their Faces, It’s Titian

Image source: flickerdart

Tiziano Vecelli

#13 Excel Sheet With Coloured Squares, It’s Mondrian

Image source: flickerdart

Piet Mondrian

#14 If All The Men Look Like Cow-Eyed Curly-Haired Women, It’s Caravaggio

Image source: flickerdart

Michelangelo Merisi da Caravaggio

#15 If The Paintings Have Tons Of Little People In Them But Otherwise Seem Normal, It’s Bruegel

Image source: flickerdart

Pieter Bruegel the Elder

#16 If Everyone In The Paintings Has Enormous Asses, Then It’s Rubens

Image source: flickerdart

Sir Peter Paul Rubens

#17 If Every Painting Is The Face Of A Uni-Browed Woman, It’s Frida

Image source: flickerdart

Frida Kahlo

#18 If Everything Is Highly-Contrasted And Sharp, Sort Of Bluish, And Everyone Has Gaunt Bearded Faces, It’s El Greco

Image source: flickerdart

Doménikos Theotokópoulos – El Greco (“The Greek”)

#19 If The Painting Could Easily Have A Few Chubby Cupids Or Sheep Added (Or Already Has Them), It’s Boucher

Image source: flickerdart

François Boucher

Source: Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics) | DeMilked

Posted in Art