All new cell phone users in China must now have their face scanned, as do all US citizens entering or leaving the US (as well as all non-US citizens)

Customers in China who buy SIM cards or register new mobile-phone services must have their faces scanned under a new law that came into effect yesterday. China’s government says the new rule, which was passed into law back in September, will “protect the legitimate rights and interest of citizens in cyberspace.”

A controversial step: It can be seen as part of an ongoing push by China’s government to make sure that people use services on the internet under their real names, thus helping to reduce fraud and boost cybersecurity. On the other hand, it also looks like part of a drive to make sure every member of the population can be surveilled.

How do Chinese people feel about it? It’s hard to say for sure, given how strictly the press and social media are regulated, but there are hints of growing unease over the use of facial recognition technology within the country. From the outside, there has been a lot of concern over the role the technology will play in the controversial social credit system, and how it’s been used to suppress Uighur Muslims in the western region of Xinjiang.

Source: All new cell phone users in China must now have their face scanned – MIT Technology Review

Homeland Security wants to expand facial recognition checks for travelers arriving to and departing from the U.S. to also include citizens, which had previously been exempt from the mandatory checks.

In a filing, the department has proposed that all travelers, and not just foreign nationals or visitors, will have to complete a facial recognition check before they are allowed to enter the U.S., but also to leave the country.

Facial recognition for departing flights has increased in recent years as part of Homeland Security’s efforts to catch visitors and travelers who overstay their visas. The department, whose responsibility is to protect the border and control immigration, has a deadline of 2021 to roll out facial recognition scanners to the largest 20 airports in the United States, despite facing a rash of technical challenges.

But although there may not always be a clear way to opt-out of facial recognition at the airport, U.S. citizens and lawful permanent residents — also known as green card holders — have been exempt from these checks, the existing rules say.

Now, the proposed rule change to include citizens has drawn ire from one of the largest civil liberties groups in the country.

“Time and again, the government told the public and members of Congress that U.S. citizens would not be required to submit to this intrusive surveillance technology as a condition of traveling,” said Jay Stanley, a senior policy analyst at the American Civil Liberties Union .

“This new notice suggests that the government is reneging on what was already an insufficient promise,” he said.

“Travelers, including U.S. citizens, should not have to submit to invasive biometric scans simply as a condition of exercising their constitutional right to travel. The government’s insistence on hurtling forward with a large-scale deployment of this powerful surveillance technology raises profound privacy concerns,” he said.

Citing a data breach of close to 100,000 license plate and traveler images in June, as well as concerns about a lack of sufficient safeguards to protect the data, Stanley said the government “cannot be trusted” with this technology and that lawmakers should intervene.

Source: DHS wants to expand airport face recognition scans to include US citizens

Vulnerability in fully patched Android phones under active attack by bank thieves – watch out for permissions being asked from apps you have installed

A vulnerability in millions of fully patched Android phones is being actively exploited by malware that’s designed to drain the bank accounts of infected users, researchers said on Monday.

The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post. Running under the guise of trusted apps already installed, the malicious apps can then request permissions to carry out sensitive tasks, such as recording audio or video, taking photos, reading text messages or phishing login credentials. Targets who click yes to the request are then compromised.

Researchers with Lookout, a mobile security provider and a Promon partner, reported last week that they found 36 apps exploiting the spoofing vulnerability. The malicious apps included variants of the BankBot banking trojan. BankBot has been active since 2017, and apps from the malware family have been caught repeatedly infiltrating the Google Play Market.

The vulnerability is most serious in versions 6 through 10, which (according to Statista) account for about 80% of Android phones worldwide. Attacks against those versions allow malicious apps to ask for permissions while posing as legitimate apps. There’s no limit to the permissions these malicious apps can seek. Access to text messages, photos, the microphone, camera, and GPS are some of the permissions that are possible. A user’s only defense is to click “no” to the requests.

An affinity for multitasking

The vulnerability is found in a function known as TaskAffinity, a multitasking feature that allows apps to assume the identity of other apps or tasks running in the multitasking environment. Malicious apps can exploit this functionality by setting the TaskAffinity for one or more of its activities to match a package name of a trusted third-party app. By either combining the spoofed activity with an additional allowTaskReparenting activity or launching the malicious activity with an Intent.FLAG_ACTIVITY_NEW_TASK, the malicious apps will be placed inside and on top of the targeted task.

“Thus the malicious activity hijacks the target’s task,” Promon researchers wrote. “The next time the target app is launched from Launcher, the hijacked task will be brought to the front and the malicious activity will be visible. The malicious app then only needs to appear like the target app to successfully launch sophisticated attacks against the user. It is possible to hijack such a task before the target app has even been installed.”

Promon said Google has removed malicious apps from its Play Market, but, so far, the vulnerability appears to be unfixed in all versions of Android. Promon is calling the vulnerability “StrandHogg,” an old Norse term for the Viking tactic of raiding coastal areas to plunder and hold people for ransom. Neither Promon nor Lookout identified the names of the malicious apps. That omission makes it hard for people to know if they are or were infected.

[…]

Suspicious signs include:

  • An app or service that you’re already logged into is asking for a login.
  • Permission popups that don’t contain an app name.
  • Permissions asked from an app that shouldn’t require or need the permissions it asks for. For example, a calculator app asking for GPS permission.
  • Typos and mistakes in the user interface.
  • Buttons and links in the user interface that do nothing when clicked on.
  • Back button does not work as expected.

Source: Vulnerability in fully patched Android phones under active attack by bank thieves | Ars Technica

123Autoit – NonRoot trial – Apps on Google Play

***** No Root Required, ***** *****Please Look the Following***** ****However need to start a (Backend Service) Per every Boot ***** *****the Install package can be found at the following link***** http://123autoit.blogspot.tw/2016/08/123autoit-non-root-daemon-service.html Please update the backend service for Version 1.3 to use (Speed up mode) ***Daemon Script Install Video*** https://www.youtube.com/watch?v=awCz9A_FLk0 It is now supported both ARM and Intel Android Device If it is not support your phone or Install, setting , usage, any problem can reach me on E M A l L (kevinyiu82@gmail.com) or send me a hangout https://plus.google.com/+kevinyiu82 I am here to help Video Tutorial https://www.youtube.com/playlist?list=PLp0O8ko3Htr4YcZYXe2pyqG2lARTDqwoD Continue updating 123AutoIt (Automate repetitive tasks based on predefined logic) [BETA STAGE] Requirements -Android 5+ -best to run on safe mode -ram 1G + Features: match conditions trigger Taps, Swipes, pauses supported (Drag is still in beta stage, if experience any problem restart and try again using another mode) repeat number set to repeat actions accordingly validation at the point, to quick examine your check point placement add, select, edit and remove action from the logic different profile supported allow extra control to change the logic flow provide basic start and stop function (if more than one action within a page, then need to press a few more time to stop the process. +added extra options to disable auto rotate in screen capture (to handle for some device landscape screen capture problem) +added in app video tutorial + added FloatLayout to Control Panel + added Accumulated Count Click action + change name Counter Click to (Consecutive Counter Click) + Duplicate Image can’t show image bug fix +added setting storage location +added validation storage location +added magnifying glasses +added ads cache +added WiFi ON & OFF Action +softkeyboard input bug fix +UI minor adjustment +Update Edit Mode UI +Update Text Description +In Edit mode back press twice to get back full screen +fixed Recharge Button +Start up version check has been added +Edit mode z-index fixed +Fixed Repeat number can’t be saved issue(android 5.0+) +Fixed locale Issue +Added Same Page ? Times trigger Click Action +Added Action notificiation +Added Error notificiation +Added OCR checks Quick tips: -make sure your phone/tablet is fully charge and connected to a charger -fan the device, it sure produce a lot of heat -lower the backlight -turn on the developer mode to show the current click/swipe points -make sure turn off other background app except the app itself, and the targeted app. just to make app more stable ***Please notice, in some devices (such as Xiaomi) more action is needed for the application to work. such as allowing “pop up window” *** bug report: http://123autoit.blogspot.tw/2016/06/bug-report.html tutorial: http://123autoit.blogspot.tw/ ################################## OCR Using Open Source Tesseract library OpenCV Library ##################################

Source: 123Autoit – NonRoot trial – Apps on Google Play

For automating gaming clicks and anti-afk on Android