Researchers Control Monkeys’ Decisions With Bursts of Ultrasonic Waves

New research published today in Science Advances suggests pulses of ultrasonic waves can be used to partially control decision-making in rhesus macaque monkeys. Specifically, the ultrasound treatments were shown to influence their decision to look either left or right at a target presented on a screen, despite prior training to prefer one target over the other.

The new study, co-authored by neuroscientist Jan Kubanek from the University of Utah, highlights the potential use of this non-invasive technique for treating certain disorders in humans, like addictions, without the need for surgery or medication. The procedure is also completely painless.

Scientists had previously shown that ultrasound can stimulate neurons in the brains of mice, including tightly packed neurons deep in the brain. By modulating neuronal activity in mice, researchers could trigger various muscle movements across their bodies. That said, other research has been less conclusive about this and whether high-frequency sound waves can trigger neuromodulatory effects in larger animals.

The new research suggests they can, at least in a pair of macaque monkeys.

Source: Researchers Control Monkeys’ Decisions With Bursts of Ultrasonic Waves

UK takes a step closer to domestic launches as Skyrora fires up Skylark-L

Blighty is preparing for take-off as Edinburgh-based rocket-botherer Skyrora test-fired its Skylark-L rocket from a location in the heart of the Scottish Highlands.

Those hoping to send a satellite to orbit from UK soil might have a while to wait, however. The Skylark-L is only capable of flinging a 60kg payload 100km up. The beefier Skyrora XL will be capable of carrying far greater payloads into Low Earth Orbit (LEO) by 2023.

The test, which occurred earlier this month at the Kildermorie Estate in North Scotland, saw the Skylark-L vehicle erected, fuelled and ignited. The rocket was held down while engineers checked systems were behaving as they should.

The team made much of the fact that it had built a mobile launch complex and tested a rocket within five days.

[… snarky bit …].

Skylark-L on mobile launch pad (pic: Skyrora)

Light the blue touchpaper, then stand well back Pic: Skyrora

Click to enlarge

A company representative told The Register that the five days also included digging the flame trench visible above.

[… more snarky stuff…]

the endeavour still represents the first complete ground rocket test in the UK since the glory days of the Black Arrow, some 50 years ago.Prior to the static firing, the 30kN engine had been through three hot fires before integration. It was fuelled by a combination of hydrogen peroxide and kerosene (to be replaced by the company’s own Ecosene, made from plastic waste). The Skylark-L itself was then mounted on a transporter-erector that was fixed to a trailer.

“It is very hard to oversell what we have achieved here,” said operations leader Dr Jack-James Marlow, before trying his hardest to do so: “The whole team has pulled through again to deliver another UK first. We have successfully static tested a fully integrated, sub-orbital Skylark L launch vehicle in flight configuration. This means we performed all actions of a launch but did not release the vehicle.”

While the test was indeed a complete success, and validated both the vehicle and its ground systems, there is still a while to wait before a Skylark-L is launched. The company put that first flight from a British spaceport as being “as early as spring 2021”. CEO Volodymyr Levykin added: “We are now in a full state of readiness for launch.”

Source: UK takes a step closer to domestic launches as Skyrora fires up Skylark-L • The Register

Good luck to them!

Hey Siri, are you still recording people’s conversations despite promising not to do so nine months ago?

Apple may still be recording and transcribing conversations captured by Siri on its phones, despite promising to put an end to the practice nine months ago, claims a former Apple contractor who was hired to listen into customer conversations.

In a letter [PDF] sent to data protection authorities in Europe, Thomas Le Bonniec expresses his frustration that, despite exposing in April 2019 that Apple has hired hundreds of people to analyze recordings that its users were unaware had been made, nothing appears to have changed.

Those recordings were captured by Apple’s Siri digital assistant, which constantly listens out for potential voice commands to obey. The audio was passed to human workers to transcribe, label, and analyze to improve Siri’s neural networks that process what people say. Any time Siri heard something it couldn’t understand – be it a command or someone’s private conversation or an intimate moment – it would send a copy of the audio to the mothership for processing so that it could be retrained to do better next time.

Le Bonniec worked for Apple subcontractor Globe Technical Services in Ireland for two months, performing this manual analysis of audio recorded by Siri, and witnessed what he says was a “massive violation of the privacy of millions of citizens.”

“All over the world, people had their private life recorded by Apple up to the most intimate and sensitive details,” he explained. “Enormous amounts of personal data were collected, stored and analyzed by Apple in an opaque way. These practices are clearly at odds with the company’s privacy-driven policies and should be urgently investigated by Data Protection Authorities and Privacy watchdogs.”

But despite the fact that Apple acknowledged it was in fact transcribing and tagging huge numbers of conversations that users were unaware had been recorded by their Macs and iOS devices, promised a “thorough review of our practices and policies,” and apologized that it hadn’t “been fully living up to our high ideals,” Le Bonniec says nothing has changed.

“Nothing has been done to verify if Apple actually stopped the programme. Some sources already confirmed to me that Apple has not,” he said.

“I believe that Apple’s statements merely aim to reassure their users and public authorities, and they do not care for their user’s consent, unless being forced to obtain it by law,” says the letter. “It is worrying that Apple (and undoubtedly not just Apple) keeps ignoring and violating fundamental rights and continues their massive collection of data.”

In effect, he argues, “big tech companies are basically wiretapping entire populations despite European citizens being told the EU has one of the strongest data protection laws in the world. Passing a law is not good enough: it needs to be enforced upon privacy offenders.”

Not good

How bad is the situation? According to Le Bonniec: “I listened to hundreds of recordings every day, from various Apple devices (e.g. iPhones, Apple Watches, or iPads). These recordings were often taken outside of any activation of Siri, e.g. in the context of an actual intention from the user to activate it for a request.

“These processings were made without users being aware of it, and were gathered into datasets to correct the transcription of the recording made by the device. The recordings were not limited to the users of Apple devices, but also involved relatives, children, friends, colleagues, and whoever could be recorded by the device.

“The system recorded everything: names, addresses, messages, searches, arguments, background noises, films, and conversations. I heard people talking about their cancer, referring to dead relatives, religion, sexuality, pornography, politics, school, relationships, or drugs with no intention to activate Siri whatsoever.”

So, pretty bad.

Source: Hey Siri, are you still recording people’s conversations despite promising not to do so nine months ago? • The Register

DNS this week stands for Drowning Needed Services: Design flaw in name server system can be exploited to flood machines offline

Dubbed NXNSAttack, the flaw [PDF] can be abused to pull off a classic amplification attack: you send a small amount of specially crafted data to a DNS server, which responds by sending a lot of data to a victim’s server. If you have an army of hacked PCs or devices – a botnet – at your command, and can find a DNS service that’s vulnerable, you can theoretically generate enough network traffic to overwhelm a victim’s system and knock it offline for all users.

Although denial-of-service attacks are a little 1990s, blasting a business off the web can lead to a loss of sales, reputation damage, and so on.

Lior Shafir and Yehuda Afek of Tel Aviv University, along with Anat Bremler-Barr of the Interdisciplinary Center, also in Israel, found the vulnerability which is illustrated below. APNIC, which oversees IP address allocation among other duties for the Asia-Pacific region, has a deep dive here.

How does it work?

Here’s a summary. You, as the attacker, need to set up a domain name like badperson.com. You want to take down victim.com‘s DNS servers. You connect to a recursive DNS server on the internet – such as one provided by your ISP or a cloud platform – and you ask it to resolve, say, i.am.a.badperson.com into an IP address. The recursive server contacts your DNS server for your dot.com for that information.

Your name server tells the recursive server it needs to look up another.victim.com, sad.victim.com, tragic.victim.com, fashion.victim.com, and so on, to get the answer it seeks. This message neglects to include any glue records containing IP addresses. So the recursive server – key word recursive – connects to the DNS server for victim.com and asks for the records on all those sub-domains, and the victim.com DNS server replies with error messages for the non-existent sub-domains.

As you can see, you’ve turned that one request into a small storm of data exchanged between the recursive and the victim.com name servers. If you get a botnet to do this many times a second or minute, you can flood both of those name servers with packets, preventing legit look-ups from getting through from netizens, and the systems will appear down. According to the academics, you can perform double amplification of network traffic by extending the attack recursively. If the servers start to cache their look ups, and do not send any further packets, simply specify new and unique sub-domains.

[…]

To mitigate the problem, the researchers suggest name servers implement an algorithm they devised dubbed Max1Fetch that reduces the storm of traffic between the DNS components involved.

The trio said they responsibly disclosed the hole well in advance of going public, and various DNS software makers have already patched, or are in the process of patching, the vulnerability – at least some of which using the Max1Fetch method. We’re told the following software suppliers and service providers have fixed up their vulnerable DNS server software:

ISC BIND (CVE-2020-8616), NLnet labs Unbound (CVE-2020-12662), PowerDNS (CVE-2020-10995), CZ.NIC Knot Resolver (CVE-2020-12667), Cloudflare, Google, Amazon, Microsoft, Oracle (DYN), Verisign, IBM Quad9, and ICANN.

You should check for updates for your DNS server installation, and install them to avoid being blown over by a distributed denial-of-service attack. “If you operate your own DNS resolver, no matter what brand it is, please upgrade to the latest version now,” APNIC urged

Source: DNS this week stands for Drowning Needed Services: Design flaw in name server system can be exploited to flood machines offline • The Register

Command and Conquer Tiberium Dawn and Red Alert Source code Released by EA

Remaster Update and Open Source / Mod Support
byu/EA_Jimtern incommandandconquer

Today we are proud to announce that alongside the launch of the Remastered Collection, Electronic Arts will be releasing the TiberianDawn.dll and RedAlert.dll and their corresponding source code under the GPL version 3.0 license. This is a key moment for Electronic Arts, the C&C community, and the gaming industry, as we believe this will be one of the first major RTS franchises to open source their source code under the GPL. It’s worth noting this initiative is the direct result of a collaboration between some of the community council members and our teams at EA. After discussing with the council members, we made the decision to go with the GPL license to ensure compatibility with projects like CnCNet and Open RA. Our goal was to deliver the source code in a way that would be truly beneficial for the community, and we hope this will enable amazing community projects for years to come.

So, what does it mean for Mod Support within the Remastered Collection? Along with the inclusion of a new Map Editor, these open-source DLLs should assist users to design maps, create custom units, replace art, alter gameplay logic, and edit data. The community council has already been playing with the source code and are posting some fun experiments in our Discord channel. But to showcase a tangible example of what you can do with the software, Petroglyph has actually created a new modded unit to play with. So we asked a fun question – “What would the Brotherhood of Nod do if they captured the Mammoth Tank?” Well, one guess is they’d replace the turret with a giant artillery cannon and have it fire tactical nukes! Thus the Nuke Tank was born. This is a unit which is fully playable in the game via a mod (seen in the screenshot above), and we hope to have it ready to play and serve as a learning example when the game launches.

Rogue ADT tech spied on hundreds of customers in their homes via CCTV – teen girls, young mums repeatedly watched

A technician at ADT remotely accessed hundreds of customers’ CCTV cameras to spy on people in their own homes, the burglar-alarm biz has admitted.

At least one of the victims was a teenage girl, and another a young mother, according to court filings.

Last month, an ADT customer in Dallas, Texas, spotted and reported an unexpected email address listed as an admin user on their home security system. An internal investigation by ADT revealed it was the personal email of one of its employees, and he had seemingly used it to view the home’s camera system nearly a hundred times.

A probe found the same technician had made himself an admin on 220 customers’ accounts, meaning he could lock and unlock doors remotely, as well as access the live feed of cameras connected to the ADT network. His access is said to have stretched back seven years.

When ADT dug into the logs, it became clear their rogue insider had been regularly spying on customers, including, it is claimed, accessing the video feed from the bedroom of one teenage girl dozens of times. That teenager this week sued ADT for negligence and emotional distress, seeking a class-action lawsuit against the US corp, and naming the technician in question: it is alleged Telesforo Aviles was responsible.

ADT reassured them both that the security system was perfectly safe

The allegations are the stuff of nightmares: the lawsuit [PDF] details how the teenage daughter and her mother were initially uncomfortable about the idea of installing security cameras inside their house, though ADT “reassured them both that the security system was perfectly safe,” according to court filings, and a technician later fitted the kit.

But then, on April 24, “ADT called to explain that one of its technicians had gained access” to her mother’s account “and had been watching” the mother and daughter “on approximately 73 different occasions,” according to court filings.

Her lawsuit then alleges, “based upon the cameras’ wide-angle lens and placement, the ADT employee had an opportunity to watch at least” the teenager “nude, in various states of undress, getting ready for bed, and moments of physical intimacy.”

Fool me once

An almost identical [PDF] lawsuit has been filed by a second person – a young mother – whose security system installation “included an indoor security camera with a wide-angle view that provided a visual of a bathroom, entryway, family room and dining space, stairs, and into the master bedroom.”

To its credit, when ADT heard about the unauthorized access, it did the right thing: it fired the worker, reported him to the cops, and then contacted all those affected explaining the situation.

According to ADT, its unnamed technician abused a service mode function while physically present in customers’ homes in the Dallas area to add his personal email address – a feature that is “neither necessary nor permitted,” and which the company will remove in an upcoming software update. ADT technicians do not have remote access to that function, but once the technician included himself on the system while physically present, he could access the surveillance gear remotely.

Source: Rogue ADT tech spied on hundreds of customers in their homes via CCTV – including me, says teen girl • The Register

EasyJet admits data of nine million hacked

EasyJet has admitted that a “highly sophisticated cyber-attack” has affected approximately nine million customers.

It said email addresses and travel details had been stolen and that 2,208 customers had also had their credit and debit card details “accessed”.

The firm has informed the UK’s Information Commissioner’s Office while it investigates the breach.

EasyJet first became aware of the attack in January.

It told the BBC that it was only able to notify customers whose credit card details were stolen in early April.

“This was a highly sophisticated attacker. It took time to understand the scope of the attack and to identify who had been impacted,” the airline told the BBC.

“We could only inform people once the investigation had progressed enough that we were able to identify whether any individuals have been affected, then who had been impacted and what information had been accessed.”

Stolen credit card data included the three digital security code – known as the CVV number – on the back of the card itself.

Source: EasyJet admits data of nine million hacked – BBC News