FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more

In fact, the marketing database also contained some subscribers’ requests to block or unblock access to X-rated and gambling websites, unique ID numbers of stolen cellphones, and records of whichever site they were visiting before arriving at the Virgin Media website.

This is according to British infosec shop Turgensec, which discovered the poorly secured Virgin Media info silo and privately reported it to the broadband-and-TV-and-phone provider. The research team today said the extent of the data spill was more extensive, and personal, than Virgin Media’s official disclosure seemed to suggest.

Here, in full, is what Turgensec said it found in the data cache that was exposed from mid-April to this month:

* Full names, addresses, date of birth, phone numbers, alternative contact phone numbers and IP addresses – corresponding to both customers and “friends” referred to the service by customers.

* Requests to block or unblock various pornographic, gore related and gambling websites, corresponding to full names and addresses. IMEI numbers associated with stolen phones.

* Subscriptions to the different aspects of their services, including premium components.

* The device type owned by the user, where relevant.

* The “Referrer” header taken seemingly from a users browser, containing what would appear to be the previous website that the user visited before accessing Virgin Media.

* Form submissions by users from their website.

Those website block and unblock requests were a result of Britain’s ruling class pressuring ISPs to implement filters to prevent kids viewing adult-only material via their parents’ home internet connections. The filters were also supposed to stop Brits from seeing any particularly nasty unlawful content.

Virgin Media today stressed the database held about a thousand subscribers’ filter request inquiries.

Source: FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more • The Register

NASA declares Starliner mishap a “high visibility close call”

After pondering the totality of issues that arose during a December test flight of Boeing’s Starliner spacecraft this week, NASA chief of human spaceflight Doug Loverro said Friday that he decided to escalate the incident.

So he designated Starliner’s uncrewed mission, during which the spacecraft flew a shortened profile and did not attempt to dock with the International Space Station, as a “high visibility close call.” This relatively rare designation for NASA’s human spaceflight program falls short of “loss of mission” but is nonetheless fairly rare. It was last used by NASA after a spacewalk in 2013 when water began to dangerously pool in the helmet of astronaut Luca Parmitano.

Asked to explain during a conference call with reporters why he did this, Loverro said, “We could have lost a spacecraft twice during this mission.”

In this, Loverro referred to two software errors that occurred during the two-day flight. The first problem occurred when Starliner captured the wrong “mission elapsed time” from its Atlas V launch vehicle—it was supposed to pick up this time during the terminal phase of the countdown, but instead it grabbed data 11 hours off of the correct time. This led to a delayed push to reach orbit. The second error, caught and fixed just a few hours before the vehicle returned to Earth through the atmosphere, was due to a software mapping error that would have caused thrusters on Starliner’s service module to fire in the wrong manner.

NASA and Boeing officials held Friday’s teleconference to announce the conclusion of a report from an Independent Review Team established after December’s flight. These reviewers made 60 recommendations to NASA and Boeing for corrective actions that ranged from fixing these software issues to ferreting out others that may still exist in the spacecraft’s flight code. The investigative team is also still looking into an issue that led to multiple dropouts in communications between the ground and spacecraft during key moments of the flight.

Corrective action plan

By declaring the Starliner mishap a “close call,” Loverro also formally opened a process during which the space agency’s Safety Office will investigate the organization elements that may have led to the incident—likely focusing on why NASA did not detect the errors in Starliner’s flight software.

Loverro said no decisions are close to being made on when Starliner will return to flight or whether Boeing will have to fly another uncrewed demonstration test flight before NASA astronauts fly on Starliner. The next step, he said, is for Boeing to prepare a “corrective action plan” to implement the review team’s findings, and that will include a schedule. NASA will evaluate that plan and then it may be in a position to decide whether another test flight is needed.

Source: NASA declares Starliner mishap a “high visibility close call” | Ars Technica

The Truth About Bioplastic

Bioplastics date back more than 160 years, but they’ve seen a surge in interest and production in the past few decades. In 2018, the world produced 2.6 million tons of bioplastic, according to data from the Institute for Bioplastics and Biocomposites (IFBB). That’s a fraction of the 300 million tons of plastic produced, but IFBB also projects bioplastic production could grow 65 percent by 2023.

More bioplastic isn’t inherently bad. Done right, it could reduce plastic carbon emissions by up to 3.8 gigatons by 2050. But the done right part is the key, and so far, the world has shown little propensity to do that.

Bioplastic actually breaks into two categories: plastics made from plants and algae and plastic that biodegrades over time. The companies producing each of these types of plastic have in some ways banked on the hazy label bioplastic to make their plastic seem more environmentally friendly than regular old plastic made from oil.

“It has been controlled as a marketing arm, not a science one,” Taylor Weiss, an engineering working on algae-based plastics at the Arizona State University, told Earther. “Companies who say ‘this is biodegradable,’ just because it’s possible, it’s not likely.”

The most common form of bioplastic is PLA, a hard plastic that can replace the bottle, cups, and other vessels. It’s biodegradable and companies that sell PLA products often play that up from their names like Planet+ and Repurpose to their green branding. But what the companies don’t advertise as clearly is that while these cups are compostable, they need to go to the proper facilities.

“PLA is biodegradable but it’s biodegradable like wood,” Weiss said. “It will degrade over time but you’ll need industrial facilities.”

Flicking one into your recycling bin won’t get it there. Instead, it “can contaminate and disrupt the recycling stream if intermixed with petroleum-based plastics that are non-compostable,” according to the Environmental Protection Agency. And most municipalities simply don’t have a a curbside compostable plastic pickup. That means your compostable cup will usually end up in a landfill.

In fact, most of your recycling increasingly ends up in landfills owing to the fact that China banned many recyclable items it used to import and U.S. facilities don’t have the capacity to handle that. Once in a landfill, the PLA will breakdown, but like the plants it came from, it will emit greenhouse gases.

“If it’s a section of landfill with open recycling pits, it’s eventually going to become carbon dioxide [as it biodegrades],” Weiss said. “At worst, it could become methane, which is extremely more potent.”

Unlike plants, any benefits from its breakdown will not go back into the soil. Instead, its remnants will fester in a huge pile of garbage. Not exactly regenerative!

In addition, PLA is much like biofuels that can displace food production. The world population is projected to balloon to 9 billion by midcentury, and research has shown we’re going to need all the land we can get.

The algae- and bacteria-based bioplastics known as PHA offer a more effective avenue to reducing the forever-impacts of plastic, getting us closer to a circular economy. But it’s still more expensive to make that type of bioplastic and like PLA they require proper sorting and recycling.

There are a few fixes in the interim like improved bioplastic labeling that makes clear how likely it is to be composted, akin a program in the UK for regular plastics. The industry itself could also be better-regulated and municipalities could do a better job educating residents about what to do with bioplastics in the first place. And perhaps the best fix is to cut down on plastic use, bio-based or otherwise, all together.

“It’s this great big global complicated problem,” Weiss said. “People should be aware there are no silver bullets, there’s a quiver full of arrows.”

Source: The Truth About Bioplastic

Open Source Small Nuclear Reactors Designs

What would happen if everyone in the world had access to nuclear reactor blueprints? We’re about to find out. A mechanical engineer-turned-tech entrepreneur has plans to, well, empower people around the world to build their own 100-megawatt nuclear power reactors. That’s much larger than some of the modular reactors designed by nuclear startups, but still much smaller than operating nuclear power plants in the U.S.

The Energy Impact Center (EIC) is an energy nonprofit that engineer Bret Kugelmass founded in 2017. The organization’s goals are similar to other groups working toward carbon neutrality or negativity, except Kugelmass has decided “cheap nuclear” is the only avenue he wants to pursue. By doing that, he’s essentially operating a startup model, and for his technology to take hold, a new paradigm for nuclear power plants will have to be installed.

“Today, we offer reference plant schematics and a platform to compile ongoing design work. With the help of our partners and the National Labs, these drawings will evolve into a fully detailed, ready-to-build blueprint,” the project website says. It seems like EIC exists to feed new technology into the nuclear startup development pipeline, with the lampshade that nuclear is considered a cleaner power source in the carbon interregnum.

The details of Kugelmass’s plants are exciting. “This standardized pressurized water reactor (PWR) power plant is sized at 100MWe output to fit within project finance and timetable constraints,” he writes. “It is detailed enough for any utility to begin early site studies with +/- 20 [percent] cost predictability. It is abstract enough to allow for site-specific engineering details to be added, with a 50M dollar budget allocated per plant for such efforts.”

Source: Small Nuclear Reactors | Nuclear Reactor Types and Designs

Utah has given all its camera feeds to an AI, turning it Into a Surveillance Panopticon

The state of Utah has given an artificial intelligence company real-time access to state traffic cameras, CCTV and “public safety” cameras, 911 emergency systems, location data for state-owned vehicles, and other sensitive data.

The company, called Banjo, says that it’s combining this data with information collected from social media, satellites, and other apps, and claims its algorithms “detect anomalies” in the real world.

The lofty goal of Banjo’s system is to alert law enforcement of crimes as they happen. It claims it does this while somehow stripping all personal data from the system, allowing it to help cops without putting anyone’s privacy at risk. As with other algorithmic crime systems, there is little public oversight or information about how, exactly, the system determines what is worth alerting cops to.

Source: This Small Company Is Turning Utah Into a Surveillance Panopticon – VICE

Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Clearview AI worked to build a national database of every mug shot taken in the United States during the past 15 years, according to an email obtained by OneZero through a public records request.

The email, sent by a representative for Clearview AI in August 2019, was in response to an inquiry from the Green Bay Police Department in Wisconsin, which had asked if there was a way to upload its own mug shots to Clearview AI’s app.

“We are… working to acquire all U.S. mugshots nationally from the last 15 years, so once we have that integrated in a few months’ time it might just be superfluous anyway,” wrote the Clearview AI employee, whose name was redacted.

Clearview AI is best known for scraping the public internet, including social media, for billions of images to power its facial recognition app, which was first reported on by the New York Times. Some of those images are pulled from online repositories of mug shots, like Rapsheets.org and Arrests.org, according to other emails obtained by OneZero. Acquiring a national mug shot database would make Clearview AI an even more powerful tool for police departments, which would be able to easily match a photograph of an individual against their criminal history.

Clearview AI did not immediately respond to a request for comment from OneZero. It is unclear whether the company ultimately succeeded in acquiring such a database.

Source: Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Clearview AI Let Celebs, Investors Use Facial Recognition App for fun

Creepy facial recognition firm Clearview AI—which claims to have built an extensive database from billions of photos scraped from the public web—allowed the rich and powerful to use its app as a personal plaything and spy tool, according to reporting from the New York Times on Thursday.

Clearview and its founder, Hoan Ton-That, claim that the database is only supposed to be used by law enforcement and “select security professionals” in the course of investigations. Prior reports from the Times revealed that hundreds of law enforcement agencies, including the Department of Justice and Immigration and Customs Enforcement, had used Clearview’s biometric tools, which is alarming enough, given the total lack of any U.S. laws regulating how face recognition can be used and its proven potential in mass surveillance of anyone from minorities to political targets. Clearview also pitched itself and its tools to white supremacist Paul Nehlen, then a candidate for Congress, saying it could provide “unconventional databases” for “extreme opposition research.”

But the Times has now found that Clearview’s app was “freely used in the wild by the company’s investors, clients and friends” in situations ranging from showing off at parties to, in the case of billionaire Gristedes founder John Catsimatidis, correctly identifying a man his daughter was on a date with. More alarmingly, Catsimatidis launched a trial run of Clearview’s potential as a surveillance tool at his chain of grocery stores.

Catsimatidis told the Times that a Gristedes in Manhattan had used Clearview to screen for “shoplifters or people who had held up other stores,” adding, “People were stealing our Häagen-Dazs. It was a big problem.” That dovetails with other reporting by BuzzFeed that found Clearview is developing security cameras designed to work with its face recognition tools and that corporations including Kohl’s, Macy’s, and the NBA had tested it.

Source: Clearview AI Let Celebs, Investors Use Facial Recognition App

DuckDuckGo Made a List of Jerks Tracking You Online

DuckDuckGo, a privacy-focused tech company, today launched something called Tracker Radar—an open-source, automatically generated and continually updated list that currently contains more than 5,000 domains that more than 1,700 companies use to track people online.

The idea behind Tracker Radar, first reported by CNET, is to share the data DuckDuckGo has collected to create a better set of tracker blockers. DuckDuckGo says that the majority of existing tracker data falls into two types: block lists and in-browser tracker identification. The issue is the former relies on crowd-sourcing and manual maintenance. The latter is difficult to scale and also can be potentially abused due to the fact it’s generating a list based on your actual browsing habits. Tracker Radar supposedly gets around some of these issues by looking at the most common cross-site trackers and including a host of information about their behavior, things like prevalence, fingerprinting, cookies, and privacy policies, among other considerations.

This can be weedsy, especially if the particulars of adtech make your eyeballs roll out of their sockets. The gist is, that creepy feeling you get when you see ads on social media for that product you googled the other day? All that is powered by the types of hidden trackers DuckDuckGo is trying to block. On top of shopping data, these trackers can also glean your search history, location data, along with a number of other metrics. That can then be used to infer data like age, ethnicity, and gender to create a profile that then gets shared with other companies looking to profit off you without your explicit consent.

As for how people can actually take advantage of it, it’s a little more roundabout. The average joe mostly benefits by using… DuckDuckGo’s browser mobile apps for iOS and Android, or desktop browser extensions for Chrome, Firefox, and Safari.

As for developers, DuckDuckGo is encouraging them to create their own tracker block lists. The company is also suggesting researchers use Tracker Radar to help them study online tracking. You can find the data set here.

Source: DuckDuckGo Made a List of Jerks Tracking You Online

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Over the past few years, owners of cars with keyless start systems have learned to worry about so-called relay attacks, in which hackers exploit radio-enabled keys to steal vehicles without leaving a trace. Now it turns out that many millions of other cars that use chip-enabled mechanical keys are also vulnerable to high-tech theft. A few cryptographic flaws combined with a little old-fashioned hot-wiring—or even a well-placed screwdriver—lets hackers clone those keys and drive away in seconds.

Researchers from KU Leuven in Belgium and the University of Birmingham in the UK earlier this week revealed new vulnerabilities they found in the encryption systems used by immobilizers, the radio-enabled devices inside of cars that communicate at close range with a key fob to unlock the car’s ignition and allow it to start. Specifically, they found problems in how Toyota, Hyundai, and Kia implement a Texas Instruments encryption system called DST80. A hacker who swipes a relatively inexpensive Proxmark RFID reader/transmitter device near the key fob of any car with DST80 inside can gain enough information to derive its secret cryptographic value. That, in turn, would allow the attacker to use the same Proxmark device to impersonate the key inside the car, disabling the immobilizer and letting them start the engine.

The researchers say the affected car models include the Toyota Camry, Corolla, and RAV4; the Kia Optima, Soul, and Rio; and the Hyundai I10, I20, and I40. The full list of vehicles that the researchers found to have the cryptographic flaws in their immobilizers is below:

a chart of car models and makes
A list of the cars the researchers say are vulnerable to their immobilizer-disabling attack. Although the list includes the Tesla S, Tesla pushed out an update last year to address the vulnerability.

Courtesy of University of Birmingham and KU Leuven

Though the list also includes the Tesla S, the researchers reported the DST80 vulnerability to Tesla last year, and the company pushed out a firmware update that blocked the attack.

Toyota has confirmed that the cryptographic vulnerabilities the researchers found are real. But their technique likely isn’t as easy to pull off as the “relay” attacks that thieves have repeatedly used to steal luxury cars and SUVs. Those generally require only a pair of radio devices to extend the range of a key fob to open and start a victim’s car. You can pull them off from a fair distance, even through the walls of a building.

Source: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys | WIRED

More than one billion Android devices at risk of malware threats, no longer being updated

Based on Google data, two in five of Android users worldwide may no longer be receiving updates, and while these devices won’t immediately have problems, without security support there is an increased risk to the user.

Our latest tests have shown how such phones and tablets, including handsets still available to buy from online marketplaces such as Amazon, could be affected by a range of malware and other threats. This could result in personal data being stolen, getting spammed by ads or even signed up to a premium rate phone service.

[…]

Generally speaking, the older the phone, the greater the risk. With the Android versions released in the past five years (Android 5.0 to 10.0), Google put more effort into enhancing security and privacy to give the user greater protection, transparency and control over their data. But smartphones can still be an attractive target, and it’s important to be aware of the threat.

Based on Google’s own data from May 2019, 42.1% of Android active users worldwide are on version 6.0 or earlier: Marshmallow (2015), Lollipop (2014), KitKat (2013), Jellybean (2012), Ice Cream Sandwich (2011) and Gingerbread (2010).

According to the Android Security Bulletin, there were no security patches issued for the Android system in 2019 that targeted Android versions below 7.0 Nougat.

That means more than one billion phones and tablets may be active around the world that are no longer receiving security updates.

[…]

We tasked expert antivirus lab, AV Comparatives, to try to infect them with malware, and it managed it on every phone, including multiple infections on some.

As you can see in the above chart, all the Android phones we used in our test lacked the more modern security features introduced by Google to the latest Android 9.0 or 10.

Source: More than one billion Android devices at risk of malware threats – Which? News

Virgin broadband ISP spills 900,000 punters’ records into wrong hands from insecure database

Virgin Media, one of the UK’s biggest ISPs, on Thursday admitted it accidentally spilled 900,000 of its subscribers’ personal information onto the internet via a poorly secured database.

The cableco said it “incorrectly configured” a storage system so that at least one miscreant was able to access it and potentially siphon off customer records. The now-secured marketing database – containing names, home and email addresses, and phone numbers, and some dates of birth, plus other info – had been left open since mid-April 2019.

Crucially, the information “was accessed on at least one occasion but we do not know the extent of the access,” Virgin Media’s CEO Lutz Schüler said in a statement this evening. Said access, we speculate, could have been from an automated bot scanning the internet, or someone prowling around looking for open gear; at this stage, we don’t know.

In a separate email to subscribers, shared with El Reg by dozens of readers, the telco expanded: “The database was used to manage information about our existing and potential customers in relation to some of our marketing activities. This included: contact details (such as name, home and email address and phone numbers), technical and product information, including any requests you may have made to us using forms on our website. In a very small number of cases, it included date of birth.”

The storage box, we understand, not only contained Virgin Media broadband and fixed-line subscriber records – some 15 per cent of that total customer base – but also info on some cellular users. If a punter referred a friend to Virgin Media, that pal’s details may be in the silo, too.

Source: Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punters’ records into wrong hands from insecure database • The Register