Monthly Archives: April 2020

Disney Plus’ butt cover-up hides a much bigger problem – corporations feel free to put out revisionist histories

Posted on by

There’s a scene in Touchstone Pictures’ 1984 movie Splash where a young Tom Hanks watches a beautiful naked mermaid run off into the ocean from which she came. In the original version, the camera follows Hanks’ gaze, showing a brief glimpse of a naked butt. Splash received a PG rating because of the shot (and the insinuation that came with it), but people watching the movie on Disney Plus are greeted with an entirely different version of the scene.

In the re-edited version, which went viral, thanks to the tweet below, Disney used CGI hair to cover actress Daryl Hannah’s body. A Disney representative confirmed to The Verge that a “few scenes” from Splash were “slighted edited to remove nudity,” but they did not specify when the edits were made.

The representative also confirmed that Splash’s rating would revert from PG-13 on Disney Plus (different from the original) back to PG. It’s likely that the original film (with its brief nudity) would have been rated PG-13 if it came out a few months later, but Splash was released in March 1984, and the PG-13 rating didn’t exist until July 1984.

The change has bewildered social media users. If nudity was the issue, why not bring Splash to Hulu, Disney’s other streaming service geared toward older adults? Others have asked why Disney felt the need to re-edit the scene at all; Disney Plus allows movies up to a PG-13 rating on its service, and Splash was only rated PG. Another person pointed out that a scene in Thor: Ragnarok that includes Hulk’s naked butt wasn’t censored when it was brought to Disney Plus. (Although, there’s likely a difference in perception between actual nudity and nudity as it pertains to a completely CGI character.)

Splash is the most egregious, albeit hysterical example of movies being re-edited for Disney Plus, but it’s not a unique case. A new version of Star Wars: A New Hope appeared on Disney Plus the day the streaming service launched, one that was “made by George made prior to the Disney acquisition,” the company confirmed to The Verge at the time.

Disney has also instituted pre-roll messages that play before certain movies to inform viewers that scenes have been edited for specific reasons. The company removed the word “fuck” from movies like Adventures in Babysitting and Free Solo, took out racial slurs that appeared in older titles like The Adventures of Bullwhip Griffin, and edited other material in movies like Empire of Dreams that Disney no longer found suitable.

Splash has found itself in the middle of an ongoing debate over media being altered in digital spaces. It’s a debate that’s raged for decades; fans were upset when George Lucas edited A New Hope, making it so Greedo shot first instead of Han. People bemoaned Lucas and 20th Century Fox for not releasing the original version of the film anywhere, either. The only legal versions of A New Hope that exist for people to buy, download, or stream today feature Greedo shooting first. It wasn’t just that Lucas and Fox replaced the original scene with a slightly altered one, but the original also wasn’t available to purchase when reprints were made.

Last March, Simpsons producer James L. Brooks announced that future syndication packages, streaming, and future DVD releases will not include the season 3 premiere episode, “Stark Raving Dad.” The episode includes voice acting from Michael Jackson, and after renewed allegations against Jackson surfaced, The Simpsons’ team and Fox decided to effectively erase the episode. “This is our book, and we’re allowed to take out a chapter,” Brooks told The Wall Street Journal at the time.

“As physical media gives way to streaming, large corporations have greater and greater control over what we can and cannot see,” Slate’s Isaac Butler wrote on the issue. “This gives them unprecedented power to disappear bothersome work. Whether we agree with a particular instance of memory-holing or not, this practice is deeply troubling, its history even more so.”

Disney is more than just a large corporation. It is arguably the monolith. Disney bought 21st Century Fox, the same corporation that Butler wrote his concerns about. Disney also built an entire sales campaign around the idea of restricting access to physical versions of its films — something it referred to for years as “The Vault.” Now, scenes are being edited for its streaming service, and all people are getting is a message explaining why. Subscribers can’t watch the original films the way they were intended.

It’s an effort from companies to be better or more appropriate, but it doesn’t always work. There are better alternatives. Take Tom and Jerry, for example. The Warner Bros. cartoon series from the 1940s came with a disclaimer about the context of certain scenes when it was originally released on DVD by Warner Home Video and then again in 2014 when the episodes were made available digitally on iTunes and Amazon Prime. Warner Bros. didn’t erase or edit the show; instead, the company decided to give it a critical examination. History can’t be erased, but people can learn from it.

Retroactively editing films to suit a certain narrative or niche is an ongoing problem that’s caused concern in movie, television, and music circles. And as more people turn to streaming services, where files can be edited on the fly, concerns over the original presentation continue to grow. What may just be bad CGI hair over a butt in an old Tom Hanks movie today could be more elaborate edits and alterations tomorrow.

Source: Disney Plus’ butt cover-up hides a much bigger problem – The Verge

For the First Time, a Robot Repaired a Satellite in Orbit

Posted on by

H/O: Northrop Grumman MEV-1 one 200417

Space.com calls it “the first commercial satellite servicing mission.” But more specifically, it’s being called “the first in-orbit rendezvous and docking of two commercial satellites” in a statement from Northrop Grumman Space Systems, which also notes their “subsequent repositioning of the two-spacecraft stack.” And it was all done using robotics floating 36,000km (22,369 miles) above the Earth.

Space.com describes the historic servicing of Intelsat 901 communications satellite (also known IS-901): The satellite, which launched in 2001, had been running low on fuel needed to maintain its correct orbit. But rather than launch a replacement internet satellite, its owner, Intelsat, hired Northrop Grumman to conduct a first-of-its-kind mission. That project sent another satellite, called Mission Extension Vehicle 1 (MEV-1) to connect to IS-901 in February and take responsibility for keeping the internet satellite in the proper location to do its job…

MEV-1 will now spend five years attached to IS-901 to extend that satellite’s tenure. After the contract ends, MEV-1 will steer the old satellite to a safe orbit, detach, and join up with a different satellite to provide the same services. MEV-1 should be able to partner with satellites for a total of 15 years, according to a previous Northrop Grumman statement.

Northrop Grumman is planning to launch a second mission-extension vehicle later this year, which will also aid an Intelsat satellite.
Long-time Slashdot reader mi tipped us off to the story, which included a number of firsts. “Prior to this, no two commercial spacecraft had ever docked in orbit before,” Ars Technica writes.

CNBC notes it also resulted in “one-of-a-kind images“, since a geosynchronous satellite had never even been photographed before by another spacecraft.

H/O: Northrop Grumman MEV-1 three 200417

Source: For the First Time, a Robot Repaired a Satellite in Orbit – Slashdot

MEV-1 Mission w-Images_E5 from Ars Technica on Vimeo.

Sale of .Org Registry Stalled for a few weeks After California AG Steps In

Posted on by

The Internet Corporation for Assigned Names and Numbers (ICANN) has delayed a decision on whether to allow the sale of the organization that controls .org registrations to a band of private equity ghouls after the California attorney general’s office issued a warning

Domain names with .org suffix are used by countless nonprofits, in part because the nonprofit selected by ICANN to run the .org top-level domain—the Internet Society’s Public Interest Registry (ISOC/PIR)—has kept the cost of registration very low year after year. In theory, though, running that .org registry could be a cash cow to anyone who bought it and jacked up the prices, as nonprofits seeking the renewal of .org domains would be a captive market. Such an opportunity would be especially alluring as ICANN removed price caps on .org registration fees in 2019.

That egregious scenario appears to be in the cards with Ethos Capital, a private equity firm that came out of nowhere to offer ISOC $1.1 billion for control of the PIR, which would be converted to a for-profit firm. (While Ethos appears to only have two employees, it is backed by the tight-fisted goons at Perot Holdings, Fidelity Investments owner FMR LLC, and Solamere Capital, which was started by Mitt Romney’s son.) Ethos has sought to allay concerns with a series of meaningless commitments, such as limiting price increase to 10 percent per year for the first eight years, or approximately 214 percent in under a decade.

ISOC has more or less admitted that it considered the $1.1 billion offer out of greed, with officials telling the L.A. Times the number was so huge “we couldn’t just say no without considering.” ISOC has cleared the sale to move forward, despite the opposition of its own Chapters Advisory Council and the troubling arrangement that PIR would take on $300 million in debt as part of the deal, putting it under immense pressure to rapidly increase revenue. But one big catch is ICANN has to approve the deal or it might fall through. As Ars Technica noted, ICANN’s governance structure allows only limited influence from the internet community and it is subject to only lax regulation from the feds, while the Ethos deal involves several former ICANN officials, so any approval would immediately come under suspicion.

In a letter dated April 15, state A.G. Xavier Becerra—whose office demanded to see confidential documents in January—put everyone involved on blast. Becerra’s letter opens by citing his authority to regulate California-based charitable trusts and public benefits organizations, then cites elements of ICANN’s charter to warn the org that it “must exercise its authority to withhold approval”:

ICANN selected PIR as the registry operator for the .ORG top level domain because of PIR’s commitment to “institute mechanisms for promoting the registry’s operation in a manner that is responsive to the needs, concerns, and views of the non-commercial Internet user community.” If, as proposed, Ethos Capital is permitted to purchase PIR, it will no longer have the unique characteristics that ICANN valued at the time that it selected PIR as the nonprofit to be responsible for the .ORG registry. In effect, what is at stake is the transfer of the world’s second largest registry to a for-profit private equity firm that, by design, exists to profit from millions of nonprofit and non-commercial organizations.

According to the Register, sources with knowledge of the matter said that the letter had unnerved ICANN enough to delay a planned decision on the sale from April 17 to May 4. The California Attorney General’s office declined to comment on whether its investigation into the deal has turned up new information, citing the inquiry’s ongoing nature. But the letter makes clear that the AG has identified particularly troubling elements of an already suspicious arrangement.

“PIR and Ethos have failed to respond to ICANN’s questions regarding PIR’s financial picture after the sale,” Becerra wrote in the letter. “PIR maintains that its anticipated income will be sufficient to service the $300 million loan necessary to complete this purchase and maintain its level of operation. Additionally, as a for-profit entity, PIR will now incur tax liabilities, and its loan will be due in five years.”

“It is, therefore, disturbing that Ethos has failed to identify the new services it contends will generate the necessary revenue to cover those expenses,” he added. “While PIR currently has sufficient income for its operations, as a nonprofit it pays no taxes and is not saddled with a $300 million loan and investors who expect a rate of return.”

Becerra then questioned whether ISOC actually has a legitimate reason to sell the PIR, how the Ethos deal would actually solve those problems, and whether the process by which it agreed to the sale was in good faith:

There has been too little information provided about the sale process by which the proposed transfer sale was agreed to by ISOC. If ISOC was concerned about diversifying its revenue streams, what did ISOC do, if anything, before deciding to sell the .ORG registry agreement? Why did ISOC not conduct a competitive bid process for a new registry operator if it wanted a change in the registry operator? Did ISOC explore options other than a sale to a private equity firm, given that its nonprofit status was key to PIR becoming the .ORG registrar? What consultation, if any, did ISOC conduct with its stakeholders prior to proceeding with the proposed sale?

Furthermore, Becerra warned that ICANN’s arrangement with ISOC to handle the .org registry through PIR “contains a presumption in favor of renewing the agreement following its expiration,” stating that section “makes no sense” if PIR is converted to a for-profit entity.

“Empowering a for-profit entity that could undermine the accessibility and affordability of the .org domain, which serves nonprofits, should concern all of us,” Becerra told Gizmodo in a statement. “We’re urging ICANN to deny the request to transfer control of the .org domain to a for-profit private equity firm. In California, we’re committed to an Internet that serves everyone and we’re simply concerned that this transfer puts profits above the public interest.”

According to the Register, ICANN’s founding CEO Mike Roberts and founding chairman Esther Dyson wrote a letter to Becerra earlier this month accusing ICANN of hypocrisy and urging him to delay the deal by six months.

Becerra didn’t explicitly threaten ICANN or ISOC in the letter, but he did end the letter by reiterating that his office has jurisdiction to intervene.

“ISOC and PIR are charitable organizations that are accountable to their community stakeholders and to the public at large,” Becerra concluded. “… This office will continue to evaluate this matter, and will take whatever action necessary to protect Californians and the nonprofit community.”

In a statement on its website, ICANN acknowledged the letter but disputed that the deal would make PIR beholden only to the demands of its new private equity overlords.

“The Attorney General’s letter does not take into account the recent work that PIR has done to make the entity more responsible to the community,” ICANN wrote. “ICANN requested that PIR strengthen the Public Interest Commitments to ensure meaningful enforceability; a draft of the revised PICs has been provided to the ICANN Board.”

Source: Sale of .Org Registry Stalled After California AG Steps In

Buyer beware—that 2TB-6TB “NAS” drive you’ve been eyeing might be SMR – and won’t work in your NAS

Posted on by

Storage vendors, including but reportedly not limited to Western Digital, have quietly begun shipping SMR (Shingled Magnetic Recording) disks in place of earlier CMR (Conventional Magnetic Recording) disks.

SMR is a technology that allows vendors to eke out higher storage densities, netting more TB capacity on the same number of platters—or fewer platters, for the same amount of TB.

Until recently, the technology has only been seen in very large disks, which were typically clearly marked as “archival”. In addition to higher capacities, SMR is associated with much lower random I/O performance than CMR disks offer.

Storage vendors appear to be getting much bolder about deploying the new technology into ever-smaller formats, presumably to save a bit on manufacturing costs. A few weeks ago, a message popped up on the zfs-discuss mailing list:

WD and Seagate are both submarining Drive-managed SMR (DM-SMR) drives into channels, disguised as “normal” drives.

For WD REDs this shows as EFRX (standard drive) suffix being changed to EFAX suffix (DM-SMR) […] The only clue you’ll get about these drives being SMR is the appalling sequential write speeds (~40MB/s from blank) and the fact that they report a “trim” function.

The unexpected shift from CMR to SMR in these NAS (Network Attached Storage) drives has caused problems above and beyond simple performance; the user quoted above couldn’t get his SMR disks to stay in his ZFS storage array at all.

There has been speculation that the drives got kicked out of the arrays due to long timeouts—SMR disks need to perform garbage-collection routines in the background and store incoming writes in a small CMR-encoded write-cache area of the disk, before moving them to the main SMR encoded storage.

It’s possible that long periods of time with no new writes accepted triggered failure-detection routines that marked the disk as bad. We don’t know the details for certain, but several users have reported that these disks cannot be successfully used in their NAS systems—despite the fact that the name of the actual product is WD Red NAS Hard Drive.

[…]

What really grinds our gears about this is that the only conceivable reason to shift to SMR technology in such small disks—lowered manufacturing costs due to fewer platters required—doesn’t seem to be being passed down to the consumer. The screenshot above shows the Amazon price of a WD Red 2TB EFRX and WD Red 2TB EFAX—the EFRX is the faster CMR drive, and the EFAX is the much slower SMR drive.

Western Digital doesn’t appear to be the only hard drive manufacturer doing this—blocksandfiles has confirmed quiet, undocumented use of SMR in small retail drives from Seagate and Toshiba as well.

We suspect the greater ire aimed at Western Digital is due both to the prominent NAS branding of the Red line and the general best-in-class reputation it has enjoyed in that role for several years.

Source: Buyer beware—that 2TB-6TB “NAS” drive you’ve been eyeing might be SMR | Ars Technica

Security lapse exposed creepy Clearview AI source code

Posted on by

Since it exploded onto the scene in January after a newspaper exposé, Clearview AI quickly became one of the most elusive, secretive and reviled companies in the tech startup scene.

The controversial facial recognition startup allows its law enforcement users to take a picture of a person, upload it and match it against its alleged database of 3 billion images, which the company scraped from public social media profiles.

But for a time, a misconfigured server exposed the company’s internal files, apps and source code for anyone on the internet to find.

Mossab Hussein, chief security officer at Dubai-based cybersecurity firm SpiderSilk, found the repository storing Clearview’s source code. Although the repository was protected with a password, a misconfigured setting allowed anyone to register as a new user to log in to the system storing the code.

The repository contained Clearview’s source code, which could be used to compile and run the apps from scratch. The repository also stored some of the company’s secret keys and credentials, which granted access to Clearview’s cloud storage buckets. Inside those buckets, Clearview stored copies of its finished Windows, Mac and Android apps, as well as its iOS app, which Apple recently blocked for violating its rules. The storage buckets also contained early, pre-release developer app versions that are typically only for testing, Hussein said.

The repository also exposed Clearview’s Slack tokens, according to Hussein, which, if used, could have allowed password-less access to the company’s private messages and communications.

Clearview has been dogged by privacy concerns since it was forced out of stealth following a profile in The New York Times, but its technology has gone largely untested and the accuracy of its facial recognition tech unproven. Clearview claims it only allows law enforcement to use its technology, but reports show that the startup courted users from private businesses like Macy’s, Walmart and the NBA. But this latest security lapse is likely to invite greater scrutiny of the company’s security and privacy practices.

[…]

Ton-That accused the research firm of extortion, but emails between Clearview and SpiderSilk paint a different picture.

Hussein, who has previously reported security issues at several startups, including MoviePass, Remine and Blind, said he reported the exposure to Clearview but declined to accept a bounty, which he said if signed would have barred him from publicly disclosing the security lapse.

It’s not uncommon for companies to use bug bounty terms and conditions or non-disclosure agreements to prevent the disclosure of security lapses once they are fixed. But experts told TechCrunch that researchers are not obligated to accept a bounty or agree to disclosure rules.

Ton-That said that Clearview has “done a full forensic audit of the host to confirm no other unauthorized access occurred.” He also confirmed that the secret keys have been changed and no longer work.

Hussein’s findings offer a rare glimpse into the operations of the secretive company. One screenshot shared by Hussein showed code and apps referencing the company’s Insight Camera, which Ton-That described as a “prototype” camera, since discontinued.

A screenshot of Clearview AI’s app for macOS. It connects to Clearview’s database through an API. The app also references Clearview’s former prototype camera hardware, Insight Camera.

According to BuzzFeed News, one of the firms that tested the cameras is New York City real estate firm Rudin Management, which trialed use of a camera at two of its city residential buildings.

Hussein said that he found some 70,000 videos in one of Clearview’s cloud storage buckets, taken from a camera installed at face-height in the lobby of a residential building. The videos show residents entering and leaving the building.

Source: Security lapse exposed Clearview AI source code | TechCrunch

Curves for the 1918 flu pandemic

Posted on by

For National Geographic, Nina Strochlic and Riley D. Champine look back at the 1918 pandemic for clues about the future:

The 1918 flu, also known as the Spanish Flu, lasted until 1920 and is considered the deadliest pandemic in modern history. Today, as the world grinds to a halt in response to the coronavirus, scientists and historians are studying the 1918 outbreak for clues to the most effective way to stop a global pandemic. The efforts implemented then to stem the flu’s spread in cities across America—and the outcomes—may offer lessons for battling today’s crisis.

Source: Curves for the 1918 flu pandemic | FlowingData

Samsung ‘s TV Boxes Can Now Be Easily Upcycled Into Cat Houses

Posted on by

Taking a cue from anyone under 10 years old who can come up with endless imaginative uses for an empty cardboard box, Samsung is now making it easy for anyone to recycle or upcycle its TV packaging into other useful household items like magazine racks and fancy cat houses.

As competition between flat screen TV makers pushes those companies to release larger and larger sets to woo buyers, the packaging used to safely ship those TVs has grown along with them, leaving consumers with mountains of cardboard to dispose of afterward. In order to help reduce its carbon footprint, Samsung will start using packaging made from “eco-friendly corrugated cardboard” on its higher-end TVs including The Serif, The Frame, and the rotating, portrait mode-friendly, The Sero. The company didn’t go into detail about what makes the type of cardboard its using more eco-friendly, but presumably, and hopefully, it will include a higher percentage of recycled materials.

Source: Samsung ‘s TV Boxes Can Now Be Easily Upcycled Into Cat Houses

That critical VMware vuln allowed anyone on your network to create new admin users, no creds needed

Posted on by

A critical vulnerability in VMware’s vCenter management product allowed any old bod on the same network to remotely create an admin-level user, research by Guardicore Labs has revealed.

The astonishing vuln (CVE-2020-3952), details of which were quite spare when VMWare issued a patch last week, was rated by VMware itself as CVSS v3 10.0, the highest level.

Admins in charge of VMware estates should probably patch this one immediately, if they haven’t already.

Guardicore researcher JJ Lehman told The Register: “You have to be network accessible but you don’t have to be authenticated in any way to pull this off. Which means as an attacker who has already breached the perimeter of a network, as long as [you have] access to the vCenter, you essentially control everything on their VMware hosts.”

The virtualization vendor issued an advisory note and patch on 9 April that explained that a “malicious actor with network access to port 389 on an affected vmdir deployment may be able to extract highly sensitive information such as administrative account credentials”.

“It’s very unique,” Guardicore head of research Ofri Ziv told The Reg, explaining that the 10.0 CVSS impact rating on an enterprise virtualization product caught his enterprise security team’s eye. “This is why this is such a critical issue and this is why we believe it’s important for people to understand and mitigate it as fast as possible.”

He added that Guardicore had not seen evidence of the vuln being abused in the wild, though Lehman explained that by its nature, it would be difficult to see traces of its use.

Source: That critical VMware vuln allowed anyone on your network to create new admin users, no creds needed • The Register

ESO Telescope Sees Star Dance Around Supermassive Black Hole, Proves Einstein’s Theory of Relativity

Posted on by

Observations made with ESO’s Very Large Telescope (VLT) have revealed for the first time that a star orbiting the supermassive black hole at the centre of the Milky Way moves just as predicted by Einstein’s general theory of relativity. Its orbit is shaped like a rosette and not like an ellipse as predicted by Newton’s theory of gravity. This long-sought-after result was made possible by increasingly precise measurements over nearly 30 years, which have enabled scientists to unlock the mysteries of the behemoth lurking at the heart of our galaxy.

“Einstein’s General Relativity predicts that bound orbits of one object around another are not closed, as in Newtonian Gravity, but precess forwards in the plane of motion. This famous effect — first seen in the orbit of the planet Mercury around the Sun — was the first evidence in favour of General Relativity. One hundred years later we have now detected the same effect in the motion of a star orbiting the compact radio source Sagittarius A* at the centre of the Milky Way. This observational breakthrough strengthens the evidence that Sagittarius A* must be a supermassive black hole of 4 million times the mass of the Sun,” says Reinhard Genzel, Director at the Max Planck Institute for Extraterrestrial Physics (MPE) in Garching, Germany and the architect of the 30-year-long programme that led to this result.

Located 26 000 light-years from the Sun, Sagittarius A* and the dense cluster of stars around it provide a unique laboratory for testing physics in an otherwise unexplored and extreme regime of gravity. One of these stars, S2, sweeps in towards the supermassive black hole to a closest distance less than 20 billion kilometres (one hundred and twenty times the distance between the Sun and Earth), making it one of the closest stars ever found in orbit around the massive giant. At its closest approach to the black hole, S2 is hurtling through space at almost three percent of the speed of light, completing an orbit once every 16 years. “After following the star in its orbit for over two and a half decades, our exquisite measurements robustly detect S2’s Schwarzschild precession in its path around Sagittarius A*,” says Stefan Gillessen of the MPE, who led the analysis of the measurements published today in the journal Astronomy & Astrophysics.

Most stars and planets have a non-circular orbit and therefore move closer to and further away from the object they are rotating around. S2’s orbit precesses, meaning that the location of its closest point to the supermassive black hole changes with each turn, such that the next orbit is rotated with regard to the previous one, creating a rosette shape. General Relativity provides a precise prediction of how much its orbit changes and the latest measurements from this research exactly match the theory. This effect, known as Schwarzschild precession, had never before been measured for a star around a supermassive black hole.

The study with ESO’s VLT also helps scientists learn more about the vicinity of the supermassive black hole at the centre of our galaxy. “Because the S2 measurements follow General Relativity so well, we can set stringent limits on how much invisible material, such as distributed dark matter or possible smaller black holes, is present around Sagittarius A*. This is of great interest for understanding the formation and evolution of supermassive black holes,” say Guy Perrin and Karine Perraut, the French lead scientists of the project.

Source: ESO Telescope Sees Star Dance Around Supermassive Black Hole, Proves Einstein Right | ESO

India says ‘Zoom is a not a safe platform’ and bans government users

Posted on by

India has effectively banned videoconferencing service Zoom for government users and repeated warnings that consumers need to be careful when using the tool.

The nation’s Cyber Coordination Centre has issued advice (PDF) titled “Advisory on Secure use of Zoom meeting platform by private individuals (not for use by government offices/officials for official purpose)”.

The document refers to past advisories that offered advice on how to use Zoom securely and warned that Zoom has weak authentication methods. Neither of those notifications mentioned policy about government use of the tool, meaning the new document is a significant change in position!

The document is otherwise a comprehensive-if-dull guide to using Zoom securely.

[…]

Source: India says ‘Zoom is a not a safe platform’ and bans government users • The Register

The secret behind “unkillable” Android backdoor called xHelper has been revealed

Posted on by

In February, a researcher detailed a widely circulating Android backdoor that’s so pernicious that it survives factory resets, a trait that makes the malware impossible to remove without taking unusual measures.

The analysis found that the unusual persistence was the result of rogue folders containing a trojan installer, neither of which was removed by a reset. The trojan dropper would then reinstall the backdoor in the event of a reset. Despite those insights, the researcher still didn’t know precisely how that happened. Now, a different researcher has filled in the missing pieces. More about that later. First, a brief summary of xHelper.

[…]

Once installed, xHelper installs a backdoor that remotely installs apps downloaded from an attacker-controlled server. It also executes commands as a superuser, a powerful privilege setting that gives the malware unfettered system rights.

[…]

Last week, Kaspersky Lab researcher Igor Golovin published a post that filled in some of the gaps. The reinfections, he said, were the result of files that were downloaded and installed by a notorious trojan known as Triada, which ran once the xHelper app was installed. Triada roots the devices and then uses its powerful system rights to install a series of malicious files directly into the system partition. It does this by remounting the system partition in write mode. To make the files even more persistent, Triada gives them an immutable attribute, which prevents deleting, even by superusers. (Interestingly, the attribute can be deleted using the chattr command.)

A file named install-recovery.sh makes calls to files added to the /system/xbin folder. That allows the malware to run each time the device is rebooted. The result is what Golovin described as an “unkillable” infection that has extraordinary control over a device.

[…]

The researcher initially thought that it might be possible to remove xHelper by remounting the system partition in write mode to delete the malicious files stored there. He eventually abandoned that theory.

“Triada’s creators also contemplated this question, and duly applied another protection technique that involved modifying the system library /system/lib/libc.so,” Golovin explained. “This library contains common code used by almost all executable files on the device. Triada substitutes its own code for the mount function (used to mount file systems) in libc, thereby preventing the user from mounting the /system partition in write mode.”

Fortunately, the reinfection method divined in last week’s report works only on devices running older Android versions with known rooting vulnerabilities. Golovin, however, held out the possibility that, in some cases, xHelper may maintain persistence through malicious files that come preinstalled on phones or tablets.

People can disinfect devices by using their recovery mode, when available, to replace the infected libc.so file with the legitimate one included with the original firmware. Users can then either remove all malware from the system partition or, simpler still, reflash the device.

Source: The secret behind “unkillable” Android backdoor called xHelper has been revealed | Ars Technica

ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale

Posted on by

ICANN has been accused by its founding CEO and original chair of abandoning the organization’s core principles and accepting commitments it knows it cannot enforce in order to push through the sale of the .org registry later this week.

In a furious letter [PDF] from Mike Roberts and Esther Dyson to the attorney generals of California and Pennsylvania, the DNS overseer is also accused of circumventing its own decision-making processes and using the coronavirus pandemic to push through the $1.13bn sale.

The two internet veterans ask the state’s top legal representatives to step in and suspend any sale for another six months “to permit your offices, ICANN and the US Congress, to revisit the questions of ICANN’s process and public-interest regulatory duty at a point when the pandemic is no longer the public’s principal concern”.

ICANN is due to decide at a board meeting on Thursday whether to approve or block the sale of the registry from the Internet Society to private equity firm Ethos Capital.

But despite five months of discussions and repeat efforts by Ethos to tackle concerns, many in the internet community remain extremely skeptical of the deal, particularly its financing and the unusual corporate structure of Ethos, which comprises no less than six different companies, all of which were registered on the same day in 2019.

“We write to express our deep dismay at ICANN’s rejection of its defining public-interest regulatory purpose as demonstrated in the totally inappropriate proposed sale of the .ORG delegation,” the letter begins. “ICANN is failing to deliver on the purpose it was created to serve, and is abandoning its core duty to protect the public interest.”

Accountability fail

Roberts was ICANN’s first CEO and was in charge of the organization for its first three years as it attempted to put a structure around the domain name system (DNS).

Dyson was its chair for the first two years. Back then, ICANN was a semi-autonomous body overseen by the US government. That oversight ended in January 2017 after a number of new accountability measures were introduced to ensure ICANN would remain answerable to the internet community rather than itself.

The most important of those new measures is called “Empowered Community” and, in theory, allows the internet community to force the organization to hand over documents and pause decisions. It has failed on its first use, Roberts and Dyson note, referencing a letter from ICANN’s general counsel in February that rejected an effort to use the oversight.

The oversight request [PDF] asked for records covering ICANN’s consideration of the .org sale as well as details on the process it would use to gain the internet community’s approval of its decision. ICANN responded [PDF] by claiming the request “exceeded the permissible scope” of the mechanism and refused to hand over any documents.

Source: ICANN’s founding CEO and chair accuse biz of abandoning principles in push for billion-dollar .org sale • The Register

Linksys forces password reset for Smart Wi-Fi accounts after router DNS hack pointed users at COVID-19 malware

Posted on by

Router biz Linksys has reset all its customers’ Smart Wi-Fi account passwords after cybercrims accessed a bunch and redirected hapless users to COVID-19 themed malware.

The mass reset took place after all user accounts were locked on 2 April, following infosec firm Bitdefender revealing that malicious persons were pwning Linksys devices through cred-stuffing attacks.

Hackers with access to Linksys Smart Wi-Fi accounts were changing home routers’ DNS server settings. Compromised users’ attempts to reach domains ranging from Disney, pornography, and Amazon AWS were redirected to a webpage peddling a coronavirus-themed app “that displays a message purportedly from the World Health Organization, telling users to download and install an application that offers instructions and information about COVID-19.”

The app was hosted on Bitbucket, a Git-style collaboration tool. Instead of health advice it dispensed the Oski info-stealing malware, which helps itself to one’s login credentials for various services, including cryptocurrency wallets.

Linksys customers were told of the password reset by the firm earlier this week, along with cryptic and confusing references to “the COVID-19 malware”. Affected users must now change their passwords the next time they log into the Linksys Smart Wi-Fi app.

Source: Linksys forces password reset for Smart Wi-Fi accounts after router DNS hack pointed users at COVID-19 malware • The Register

60,000 Eastern Europeans to be flown in to pick fruit and veg – turns out they weren’t stealing jobs then, brexit!

Posted on by

Air Charter Service has told the BBC that the first flight will land on Thursday in Stansted carrying 150 Romanian farm workers.

The firm told the BBC that the plane is the first of up to six set to operate between mid-April and the end of June.

Government department Defra said it was encouraging people across the UK “to help bring the harvest in”.

British farmers recently warned that crops could be left to rot in the field because of a shortage of seasonal workers from Eastern Europe. Travel restrictions due to the coronavirus lockdown have meant most workers have stayed at home.

Several UK growers have launched a recruitment drive, calling for local workers to join the harvest to prevent millions of tonnes of fruit and vegetables going to waste. However concerns remain that they won’t be able to fulfil the demand on farms.

Source: Eastern Europeans to be flown in to pick fruit and veg – BBC News

Over 500,000 Zoom accounts sold on hacker forums, some being given away for free

Posted on by

Over 500,000 Zoom accounts are being sold on the dark web and hacker forums for less than a penny each, and in some cases, given away for free.

These credentials are gathered through credential stuffing attacks where threat actors attempt to login to Zoom using accounts leaked in older data breaches. The successful logins are then compiled into lists that are sold to other hackers.

Some of these Zoom accounts are offered for free on hacker forums so that hackers can use them in zoom-bombing pranks and malicious activities. Others are sold for less than a penny each.

Cybersecurity intelligence firm Cyble told BleepingComputer that around April 1st, 2020, they began to see free Zoom accounts being posted on hacker forums to gain an increased reputation in the hacker community.

Zoom accounts offered to gain reputation
Zoom accounts offered to gain reputation

These accounts are shared via text sharing sites where the threat actors are posting lists of email addresses and password combinations.

In the below example, 290 accounts related to colleges such as the University of Vermont, University of Colorado, Dartmouth, Lafayette, University of Florida, and many more were released for free.

Zoom accounts offered for free
Zoom accounts offered for free

BleepingComputer has contacted random email addresses exposed in these lists and has confirmed that some of the credentials were correct.

One exposed user told BleepingComputer that the listed password was an old one, which indicates that some of these credentials are likely from older credential stuffing attacks.

Accounts sold in bulk

After seeing a seller posting accounts on a hacker forum, Cyble reached out to purchase a large number of accounts in bulk so that they could be used to warn their customers of the potential breach.

Cyble was able to purchase approximately 530,000 Zoom credentials for less than a penny each at $0.0020 per account.

The purchased accounts include a victim’s email address, password, personal meeting URL, and their HostKey.

Source: Over 500,000 Zoom accounts sold on hacker forums, the dark web

Medical Device ‘Jailbreak’ Could Help Solve the Dangerous Shortage of Ventilators

Posted on by

Security researcher Trammell Hudson analyzed the AirSense 10 — the world’s most widely used CPAP — and made a startling discovery. Although its manufacturer says the AirSense 10 would require “significant rework to function as a ventilator,” many ventilator functions were already built into the device firmware. Its manufacturer, ResMed, says the $700 device solely functions as a continuous positive airway pressure machine used to treat sleep apnea. It does this by funneling air into a mask. ResMed says the device can’t work as a bilevel positive airway pressure device, which is a more advanced machine that pushes air into a mask and then pulls it back out. With no ability to work in both directions or increase the output when needed, the AirSense 10 can’t be used as the type of ventilator that could help patients who are struggling to breathe. After reverse-engineering the firmware, Hudson says the ResMed claim is simply untrue.

To demonstrate his findings, Hudson on Tuesday is releasing a patch that he says unlocks the hidden capabilities buried deep inside the AirSense 10. The patch is dubbed Airbreak in a nod to jailbreaks that hobbyists use to remove technical barriers Apple developers erect inside iPhones and iPads. Whereas jailbreaks unlock functions that allow the installation of unauthorized apps and the accessing of log files and forensic data, Airbreak allows the AirSense 10 to work as a bilevel positive airway pressure machine, a device that many people refer to as a BiPAP. “Our changes bring the AirSense S10 to near feature parity with BiPAP machines from the same manufacturer, boost the maximum pressure output available, and provide a starting point to add more advanced emergency ventilator functionality,” Hudson and other researchers wrote on their website disclosing the findings. The researchers say Airbreak isn’t ready to be used on any device to treat a patient suffering from COVID-19 — it’s simply to prove that the AirSense 10 does have the ability to provide emergency ventilator functions, and to push ResMed to release its own firmware update that unlocks the ventilator functions.

Source: Medical Device ‘Jailbreak’ Could Help Solve the Dangerous Shortage of Ventilators – Slashdot

It’s nice to say this, but the respiration functions on the Airsense are probably not medically validated and thus not necessarily safe to use. When does fairly safe become acceptable in an emergency?

Apple: We respect your privacy so much we’ve revealed a little about what we can track when you use Maps

Posted on by

Apple has released a set of “Mobility Trends Reports” – a trove of anonymised and aggregated data that describes how people have moved around the world in the three months from 13 January to 13 April.

The data measures walking, driving and public transport use. And as you’d expect and as depicted in the image atop this story, human movement dropped off markedly as national coronavirus lockdowns came into effect.

Apple has explained the source of the data as follows:

This data is generated by counting the number of requests made to Apple Maps for directions in select countries/regions and cities. Data that is sent from users’ devices to the Maps service is associated with random, rotating identifiers so Apple doesn’t have a profile of your movements and searches. Data availability in a particular country/region or city is subject to a number of factors, including minimum thresholds for direction requests made per day.

Apple justified the release by saying it thinks it’ll help governments understand what its citizens are up to in these viral times. The company has also said this is a limited offer – it won’t be sharing this kind of analysis once the crisis passes.

But the data is also a peek at what Apple is capable of. And presumably also what Google, Microsoft, Waze, Mapquest and other spatial services providers can do too. Let’s not even imagine what Facebook could produce. ®

Source: Apple: We respect your privacy so much we’ve revealed a little about what we can track when you use Maps • The Register

‘Crime against humanity’: Trump (the man who mismanaged Corona most in!) condemned for WHO funding freeze

Posted on by

Leading health experts have labelled Donald Trump’s decision to cut funding to the World Health Organization (WHO) as a “crime against humanity” and a “damnable” act that will cost lives.

The move also drew a rebuke from the head of the United Nations, who said the WHO was “absolutely critical to the world’s efforts to win the war against Covid-19”.

Late on Tuesday Trump declared US funding would be put on hold for 60-90 days pending a review “to assess the World Health Organization’s role in severely mismanaging and covering up the spread of the coronavirus”. The US is the single largest contributor to the WHO.

Richard Horton, the editor-in-chief of the Lancet medical journal, wrote that Trump’s decision was “a crime against humanity … Every scientist, every health worker, every citizen must resist and rebel against this appalling betrayal of global solidarity.”

Antonio Guterres, the UN secretary general, said it was “not the time” to cut funding or to question errors. “Once we have finally turned the page on this epidemic, there must be a time to look back fully to understand how such a disease emerged and spread its devastation so quickly across the globe, and how all those involved reacted to the crisis,” said Guterres.

“The lessons learned will be essential to effectively address similar challenges, as they may arise in the future. But now is not that time … It is also not the time to reduce the resources for the operations of the World Health Organization or any other humanitarian organization in the fight against the virus.”

Echoing Guterres’s plea, Dr Amesh Adalja, a senior scholar at the Johns Hopkins University Center for Health Security, said the WHO did make mistakes and may need reform but that work needed to take place after the crisis had passed. “It’s not the middle of a pandemic that you do this type of thing,” he said.

Dr Nahid Bhadelia, an infectious disease doctor and associate professor at Boston University’s school of medicine, said the cut was “an absolute disaster. WHO is a global technical partner, the platform through which sovereign countries share data/technology, our eyes on the global scope of this pandemic.”

Laurie Garrett, a former senior fellow of the Council on Foreign Relations, said the decision was a “damnable” act by a “spiteful” Trump and would cost lives. “Meanwhile, WHO is the only lifeline most African, Latin American and Asia Pacific nations have.”

Lawrence Gostin, the director of the WHO centre on public health and human rights, predicted the US would ultimately lose out because other countries would step into the vacuum with increased funding. “In global health and amidst a pandemic, America will lose its voice,” said Gostin.

The WHO has come under fire over some aspects of its handling of the pandemic, and has been accused of being too deferential to China, considering the Communist party’s early suppression of information and punishment of whistleblowers. Much of the focus of the criticism has been on a 14 January tweet from the WHO that said “preliminary investigations conducted by the Chinese authorities have found no clear evidence of human-to-human transmission”. But WHO officials also told their counterparts in technical briefings on 10 and 11 January, and briefed the press on 14 January, that human-to-human transmission was a strong possibility given the experience of past coronavirus epidemics and urged suitable precautions.

The WHO has also been attacked over its continuing exclusion of Taiwan from membership because Beijing considers it to be Chinese territory. Trump’s decision to cut funding was welcomed in some quarters, including by the Hong Kong democracy activist Joshua Wong, who called the WHO an “arm of Chinese diplomacy”.

Trump’s pronouncement came amid sustained criticism of his failure to prepare for the epidemic, which has infected more than 600,000 people and killed more than 24,000 inside his country. The US is the worst affected country in the world in terms of infection numbers. On Wednesday it was reported that $1,200 relief cheques for as many as 70 million people could be delayed for several days because Trump wanted his name printed on them.

Source: ‘Crime against humanity’: Trump condemned for WHO funding freeze | World news | The Guardian

Foreign Spies Target Zoom, U.S. Intel Officials Say

Posted on by

As much of the world works from home, an explosion of video conference calls has provided a playground not just for Zoombombers, phishermen and cybercriminals, but also for spies. Everyone from top business executives to government officials and scientists are using conferencing apps to stay in touch during the new coronavirus lockdowns and U.S. counterintelligence agencies have observed the espionage services of Russia, Iran, and North Korea attempting to spy on Americans’ video chats, three U.S. intelligence officials tell TIME.

But the cyberspies that have moved fastest and most aggressively during the pandemic, the intelligence officials say, have been China’s. “More than anyone else, the Chinese are interested in what American companies are doing,” said one of the three. And that, in turn, has some U.S. counterintelligence officials worrying about one video conference platform in particular: Zoom. While the Chinese, Russians, and others are targeting virtually every tool Americans and others are using now that they’re forced to work from home, Zoom is an attractive target, especially for China, the intelligence officials and internet security researchers say.

Source: Foreign Spies Target Zoom, U.S. Intel Officials Say | Time

Redox-Flow Cell Stores Renewable Energy as Hydrogen

Posted on by

The solution, some propose, is to store energy chemically—in the form of hydrogen fuel—rather than electrically. This involves using devices called electrolyzers that make use of renewable energy to split water into hydrogen and oxygen gas.

“Hydrogen is a very good carrier for this type of work,” says Wei Wang, who is the chief scientist for stationary energy storage research at the Pacific Northwest National Laboratory in Washington. It’s an efficient energy carrier, and can be easily stored in pressurized tanks. When needed, the gas can then be converted back into electrical energy via a fuel cell and fed into the grid.

But water electrolyzers are expensive. They work under acidic conditions which require corrosion-resistant metal plates and catalysts made from precious metals such as titanium, platinum, and iridium. “Also, the oxygen electrode isn’t very efficient,” says Kathy Ayers, vice-president of R&D at Nel Hydrogen, an Oslo-based company that specializes in hydrogen production and storage. “You lose about 0.3 volts just from the fact that you’re trying to convert water to oxygen or vice versa,” she says. Splitting a water molecule requires 1.23 V of energy.

In a bid to overcome this problem, Nel Hydrogen and Wang’s team at Pacific Northwest joined forces in 2016, after receiving funding from the U.S. Department of Energy’s Advanced Research Projects Agency-Energy. The solution they’ve come up with is a fuel cell that acts as both a battery and hydrogen generator.

“We call it a redox-flow cell because it’s a hybrid between a redox-flow battery and a water electrolyzer,” explains Wang.

A redox-flow battery, in essence a reversible fuel cell, is typically made up of a positive and negative electrolyte stored in two separate tanks. When the liquids are pumped into the battery cell stack situated between the tanks, a redox reaction occurs, and generates electricity at the battery’s electrodes.

By comparison, the new invention has only one electrolyte, comprised of an iron salt (rather than the more commonly used vanadium) dissolved in acid. When hydrogen ions react with the iron salt (Fe2+), hydrogen gas is produced at the platinum-coated carbon cathode in the battery stack.

“We introduce iron as a middleman, so we can separate electrolysis into two reactions,” says Wang. Doing so allows one to control where and when to reverse the reaction to produce electrical energy to supply to the grid. “The system gives you flexibility… you could do the regeneration during evening time when electricity prices are at a peak,” he says.

Regenerating Fe2+ in the reverse reaction also allows for the continuous production of hydrogen gas, he says. “And because the hydrogen-iron cell uses about half the voltage of a traditional electrolyzer, you can generate hydrogen at a much cheaper cost if you do everything right.”

It also helps that iron is much cheaper and more abundant compared with vanadium.

Qing Wang, a materials scientist at the National University of Singapore, sees another benefit. “If you care more about purity and want to have ultra-pure hydrogen, then maybe it’s a good solution,” he says. Cross-contamination can sometimes occur during electrolysis because the hydrogen and oxygen gases produced are so small that they are able to traverse the membrane separator.

The new redox-flow cell performed well in lab tests, exhibiting a charge capacity of up to one ampere per square centimeter, a ten-fold increase over normal flow batteries. It was also able to withstand “several hundred cycles” of charging, which has never been demonstrated before in hydrogen ion flow batteries, says Wang, who has a number of patents for the invention, with a few more pending.

While the PNNL team experimented on a single cell measuring 10 square centimeters, Ayers and her colleagues at Nel Hydrogen proved that the technology could work even when scaled up to a five-cell stack measuring 100 square centimeters. They plan to spend the next few months fine-tuning the system and eliminating kinks, such as how to minimize damage to the pumps caused by the acidic electrolyte, before commercializing it.

Source: Redox-Flow Cell Stores Renewable Energy as Hydrogen – IEEE Spectrum

ICANN suffers split-personality disorder as deadline for .org sale decision draws close

Posted on by

With just seven days left until it has to make a decision on the $1.13bn sale of the .org registry to a private equity firm, DNS overseer ICANN appears in chaos.

In a series of communications from senior executives, ICANN has embarked on a public negotiation with potential buyer Ethos Capital over the sale of the domain, while at the same time aggressively questioning its corporate structure.

A blog post from ICANN’s CEO Goran Marby late last week highlighted revised “public interest commitments” (PICs) that Ethos Capital had published as a way to resolve ongoing concerns over the sale, and gave the clear signal that ICANN is intending to approve the deal on April 20.

There has been a clear negotiation between the two sides: Marby’s post came one day after an email from Ethos’ lawyer (since published [PDF] noted that the new changes were in direct response to a letter from ICANN sent just a few days earlier. “In making these changes, they specifically focused on changes that go to the clarity and enforceability of the PICs as you mentioned,” Ethos noted.

At the same time as it is moving forward on a deal, however, ICANN continues to dig [PDF] into Ethos Capital’s unusual corporate structure: something that critics say is no more a corporate shell game designed to hide the true owners of the company.

ICANN is also looking at its financing of the deal, which financial experts have warned is typical of a debt-leveraged buyout where a founding firm is saddled with debt after the financiers walk away with a healthy profit.

Debt pile

“Can you please provide more detail on PIR’s current plans with respect to the repayment of the $360m term loan at the maturity date in light of Ethos Capital’s ten plus investment horizon for PIR?,” reads just one of dozens of pointed questions in a letter from ICANN to the company nominally in charge of .org, Public Interest Registry (PIR).

Another makes it plain that ICANN believes information is being hidden: “ICANN has specifically requested that PIR provide the entities and individuals that will ‘control’ PIR post-transaction as that is defined in PIR’s registry agreements. PIR has provided some information regarding share ownership but has not provided the specific information regarding ‘control’.”

There are no less than six different companies involved on the Ethos side of the transaction, all of them based in Delaware, a common base for shell companies, and all but one was incorporated on the same day, October 24, 2019.

In addition to Ethos Capital LLC, which was incorporated in May – the day after ICANN made it clear it was planning to remove price caps on .org domains in a decision worth tens of millions of dollars – there is also Ethos Purpose GP, LLC, and then four “Purpose Domains” companies: Purpose Domains Direct, Feeder, Holdings and Investments.

ICANN has asked for the directors of each of these companies and the structural connections between them but from published letters from Ethos and ICANN is it clear that Ethos has been withholding specific pieces of information.

Public interest

In addition to this mixed message, ICANN has still not outlined its decision-making process despite repeat calls from the internet community, including the world’s governments, to do so.

There is an obvious public interest in the sale of millions of .org domains but ICANN has repeatedly failed to say how or whether it will factor that in its decision. At a recent public meeting its general counsel failed to use the term “public interest” when discussing how a decision would be made; an omission that prompted the Governmental Advisory Committee (GAC) to pointedly note [PDF] that the ICANN Board had told it that “all options remain open and that the Board will consider the public interest in its decision-making.”

However, when PIR argued that ICANN only had grounds to reject the sale on issues of “security, reliability, or stability of services,” ICANN pushed back saying that it would not accept “any artificial restriction,” and noted “the obvious importance to the public interest of its operation.”

ICANN changes tune however when other groups point to “public interest” as a key reason for denying the sale. In his most recent letter to the GAC [PDF], ICANN’s chair Maarten Bottermann said that the organization “will apply a standard of reasonableness in making its determination on whether to provide or withhold its consent to the request.”

In a second sentence, he then notes that “the ICANN Board will continue to consider the public interest in all its decision-making using the totality of the information received.”

The difference between “apply” and “consider” is not lost on those watching the process; nor is the fact that ICANN has failed to define the term “reasonableness,” despite it now being the main factor of consideration.

[…]

Source: ICANN suffers split-personality disorder as deadline for .org sale decision draws close • The Register

Amazon hiring 75,000 more workers as demand rises due to coronavirus, after hiring 100k more last month

Posted on by

Amazon is hiring an additional 75,000 workers at its facilities, on top of the 100,000 new positions it created last month, the company said Monday.

In March, the company said it would hire additional warehouse and delivery workers across the country amid a surge in online shopping during the coronavirus outbreak. Since then, Amazon said it has hired more than 100,000 new employees and, as a result, is staffing up even more to help fulfill orders.

“We continue to see increased demand as our teams support their communities, and are going to continue to hire, creating an additional 75,000 jobs to help serve customers during this unprecedented time,” the company said.

As it continues to hire more workers, Amazon has also raised employees’ hourly pay and doubled overtime pay for warehouse workers. Through the end of April, warehouse and delivery workers can earn an additional $2 per hour in the U.S., 2 pounds per hour in the U.K., and approximately 2 euros per hour in many EU countries. Amazon currently pays $15 per hour or more in some areas of the U.S. for warehouse and delivery jobs.

Amazon has announced several benefits changes on top of the pay increases. The company has allowed workers to take unlimited unpaid time off and provides two weeks of paid leave for workers who tested positive for the virus or are in quarantine.

Amazon said it expects to continue investing in pay increases, benefits and safety improvements for warehouse and delivery workers. The company previously expected to spend $350 million on pay increases, but now estimates it will spend more than $500 million on those efforts.

Despite the pay increases and benefits changes, Amazon workers from at least three facilities have staged protests to call for the company to better protect workers amid the coronavirus outbreak. A dozen workers told CNBC they felt Amazon needed to provide employees with paid time off, among other concerns.

Source: Amazon hiring 75,000 more workers as demand rises due to coronavirus

Suspicious senate stock sale spurt spurs scrutiny scheme: This website tracks which shares US senators are unloading mid-pandemic

Posted on by

In the wake of reports last month that four US senators sold stocks shortly after a classified briefing on January 24 about the risk posed by the novel coronavirus, Timothy Carambat, a mechanical and software engineer, created a website to make stock sales by every senator more visible.

In an email to The Register, Carambat, who runs a design firm based in Covington, Louisiana, called Industrial Object, explained he was motivated to create Senate Stock Watcher after news broke that Senators Richard Burr (R-NC), Dianne Feinstein (D-CA), James Inhofe (R-OK), and Kelly Loeffler (R-GA) had dumped stocks before most people in America understood the implications of the outbreak. It is illegal for senators to buy and sell shares using non-public information.

Burr, chairman of the Senate Intelligence Committee, has been sued for alleged securities fraud, a charge he has denied. It is said he unloaded up to $1.7m in stocks in mid-February, particularly in hotel groups that would be later hit hard by the virus pandemic, all while receiving daily confidential briefings about the impact of the bio-nasty – and reassuring the public everything would be fine.

“As public servants, there are some senators making alarmingly large money movements at what would seem to be very fortunate timing in the market,” Carambat said.

“I understand some senators were previously very accomplished businesspeople, but in my opinion, the level of access they have to information currently is highly privileged and it would only make sense to keep their own financial best interests at heart.”

Details about the stock sales in news reports prompted Carambat to look into the source of the data, which turned out to be the US Senate Financial Disclosures website.

Source: Suspicious senate stock sale spurt spurs scrutiny scheme: This website tracks which shares US senators are unloading mid-pandemic • The Register

Twitter Obliterates Its Users’ Privacy Choices

Posted on by

The EFF’s staff technologist — also an engineer on Privacy Badger and HTTPS Everywhere, writes: Twitter greeted its users with a confusing notification this week. “The control you have over what information Twitter shares with its business partners has changed,” it said. The changes will “help Twitter continue operating as a free service,” it assured. But at what cost?

Twitter has changed what happens when users opt out of the “Allow additional information sharing with business partners” setting in the “Personalization and Data” part of its site. The changes affect two types of data sharing that Twitter does… Previously, anyone in the world could opt out of Twitter’s conversion tracking (type 1), and people in GDPR-compliant regions had to opt in. Now, people outside of Europe have lost that option. Instead, users in the U.S. and most of the rest of the world can only opt out of Twitter sharing data with Google and Facebook (type 2).
The article explains how last August Twitter discovered that its option for opting out of device-level targeting and conversion tracking “did not actually opt users out.” But after fixing that bug, “advertisers were unhappy. And Twitter announced a substantial hit to its revenue… Now, Twitter has removed the ability to opt out of conversion tracking altogether.”

While users in Europe are protected by GDPR, “users in the United States and everywhere else, who don’t have the protection of a comprehensive privacy law, are only protected by companies’ self-interest…” BoingBoing argues that Twitter “has just unilaterally obliterated all its users’ privacy choices, announcing the change with a dialog box whose only button is ‘OK.’

Source: Twitter Accused of Obliterating Its Users’ Privacy Choices – Slashdot

Mozilla installs Scheduled Telemetry Task on Windows with Firefox 75 – if you had put telemetry on

Posted on by

Observant Firefox users on Windows who have updated the web browser to Firefox 75 may have noticed that the upgrade brought along with it a new scheduled tasks. The scheduled task is also added if Firefox 75 is installed on a Windows device.

The task’s name is Firefox Default Browser Agent and it is set to run once per day. Mozilla published a blog post on the official blog of the organization that provides information on the task and why it has been created.

firefox default browser agent

According to Mozilla, the task has been created to help the organization “understand changes in default browser settings”. At its core, it is a Telemetry task that collects information and sends the data to Mozilla.

Here are the details:

  • The Task is only created if Telemetry is enabled. If Telemetry is set to off (in the most recently used Firefox profile), it is not created and thus no data is sent. The same is true for Enterprise telemetry policies if they are configured. Update: Some users report that the task is created while Telemetry was set to off on their machine.
  • Mozilla collects information “related to the system’s current and previous default browser setting, as w2ell as the operating system locale and version”.
  • Mozilla notes that the data cannot be “associated with regular profile based telemetry data”.
  • The data is sent to Mozilla every 24 hours using the scheduled task.

Mozilla added the file default-browser-agent.exe to the Firefox installation folder on Windows which defaults to C:\Program Files\Mozilla Firefox\.

Firefox users have the following options if they don’t want the data sent to Mozilla:

  • Firefox users who opted-out of Telemetry are good, they don’t need to make any change as the new Telemetry data is not sent to Mozilla; this applies to users who opted-out of Telemetry in Firefox or used Enterprise policies to do so.
  • Firefox users who have Telemetry enabled can either opt-out of Telemetry or deal with the task/executable that is responsible.

Disable the Firefox Default Browser Agent task

firefox-browser agent task disabled

Here is how you disable the task:

  1. Open Start on the Windows machine and type Task Scheduler.
  2. Open the Task Scheduler and go to Task Scheduler Library > Mozilla.
  3. There you should find listed the Firefox Default Browser Agent task.
  4. Right-click on the task and select Disable.
  5. Note: Nightly users may see the Firefox Nightly Default Browser Agent task there as well and may disable it.

The task won’t be executed anymore once it is disabled.

Closing Words

The new Telemetry task is only introduced on Windows and runs only if Telemetry is enabled (which it is by default [NOTE: Is it? I don’t think so! It asks at install!]). Mozilla is transparent about the introduction and while that is good, I’d preferred if the company would have informed users about it in the browser after the upgrade to Firefox 75 or installation of the browser and before the task is executed the first time.

Source: Mozilla installs Scheduled Telemetry Task on Windows with Firefox 75 – gHacks Tech News

Go  to about:telemetry in Firefox to see what it’s collecting. In my case this was none, because when FF was installed it asked me whether I wanted it on or off and I said off.