The Linkielist

Linking ideas with the world

The Linkielist

Three words you do not want to hear regarding a ‘secure browser’ called SafePay… Remote. Code. Execution

Folks running Bitdefender’s Total Security 2020 package should check they have the latest version installed following the disclosure of a remote code execution bug.

Wladimir Palant, cofounder of Adblock-Plus-maker Eyeo, tipped off Bitdefender about the flaw, CVE-2020-8102, after discovering what he called “seemingly small weaknesses” that could be exploited by a hostile website to take control of a computer running Bitdefender’s antivirus package. The bug, privately reported in April, was patched in May.

[…]

It’s important to note that Bitdefender said the bug was within its Chromium-based “secure browser” SafePay, which is supposed to protect online payments from hackers and is part of its Total Security 2020 suite. Meanwhile, Palant said the vulnerability was within a component called Online Protection within that suite, meaning it could be exploited by any website opened in any browser on any computer running Bitdefender’s vulnerable antivirus package.

[…]

When the antivirus suite wanted to flag up suspicious or broken HTTPS certificates, which are sometimes a sign shenanigans may be afoot, Bitdefender’s code generated a custom error page that appeared as though it came from the requested website. It would do this by modifying the server response.

It’s generally preferable that antivirus vendors stay away from encrypted connections as much as possible

There was nothing to stop a web server with a bad certificate from requesting the contents of Bitdefender’s custom error page, though, because as far as your browser is concerned, the error page came from the web server anyway.

Thus, a malicious web server could serve a page with a good certificate, and cause a new window to open with a page from the same domain and server albeit with an invalid certificate. Bitdefender’s code would jump in, and replace the second webpage with a custom error page. The first page with the good certificate could then use XMLHttpRequest to fetch the contents of the error page, which your browser would hand over.

That error page contained the Bitdefender installation’s session tokens, which could be used to send system commands to the security software suite on the user’s PC to execute. Palant’s proof-of-concept exploit worked against a Windows host, allowing a malicious page to install, say, spyware or ransomware on a victim’s computer.

“The URL in the browser’s address bar doesn’t change,” Palant explained. “So as far as the browser is concerned, this error page originated at the web server and there is no reason why other web pages from the same server shouldn’t be able to access it. Whatever security tokens are contained within it, websites can read them out.

Source: Three words you do not want to hear regarding a ‘secure browser’ called SafePay… Remote. Code. Execution • The Register

Burger King Is Leveraging Tesla Autopilot’s Confusion To Sell Whoppers

the Monarch of Meat announced a campaign that takes advantage of some sloppy sign recognition in the Tesla Autopilot’s Traffic Light and Stop Sign control, specifically in instances where the Tesla confuses a Burger King sign for a stop sign (maybe a “traffic control” sign?) and proceeds to stop the car, leaving the occupants of the car in a great position to consume some Whoppers.

The confusion was first noted by a Tesla Model 3 owner who has confusingly sawed the top off his steering wheel, for some reason, and uploaded a video of the car confusing the Burger King sign for a stop sign.

Burger King’s crack marketing team managed to arrange to use the video in this ad, and built a short promotion around it:

Did you see what I was talking about with that steering wheel? I guess the owner just thought it looked Batmobile-cool, or something? It’s also worth noting that is seems that the car’s map display has been modified, likely to remove any Tesla branding and obscure the actual location:

Illustration for article titled Burger King Is Leveraging Tesla Autopilots Confusion To Sell Whoppers

The promotion, which Burger King is using the #autopilotwhopper hashtag to promote, was only good for June 23rd, when they’d give you a free Whopper if you met the following conditions:

To qualify for the Promotion, guest must share a picture or video on Twitter, Facebook or Twitter with guest’s smart car outside a BK restaurant using #autopilotwhopper and #freewhopper.

Guests who complete step #3 will receive a direct message, within 24 hours of posting the picture/video, with a unique code for a Free Whopper sandwich (“Coupon”). Limit one Coupon per account.

It seems Burger King is using the phrase “smart car” to refer to any car that has some sort of Level 2 semi-autonomous driver’s assistance system that can identify signs, but the use of the “autopilot” in the hashtag and the original video make it clear that Teslas are the targeted cars here.

Source: Burger King Is Leveraging Tesla Autopilot’s Confusion To Sell Whoppers

Talk about the fox guarding the hen house. Comcast to handle DNS-over-HTTPS for Firefox-using subscribers

Comcast has agreed to be the first home broadband internet provider to handle secure DNS-over-HTTPS queries for Firefox browser users in the US, Mozilla has announced.

This means the ISP, which has joined Moz’s Trusted Recursive Resolver (TRR) Program, will perform domain-name-to-IP-address lookups for subscribers using Firefox via encrypted HTTPS channels. That prevents network eavesdroppers from snooping on DNS queries or meddling with them to redirect connections to malicious webpages.

Last year Comcast and other broadband giants were fiercely against such safeguards, though it appears Comcast has had a change of heart – presumably when it figured it could offer DNS-over-HTTPS services as well as its plain-text DNS resolvers.

At some point in the near future, Firefox users subscribed to Comcast will use the ISP’s DNS-over-HTTPS resolvers by default, though they can opt to switch to other secure DNS providers or opt-out completely.

[…]

Incredibly, DNS-over-HTTPS was heralded as a way to prevent, among others, ISPs from snooping on and analyzing their subscribers’ web activities to target them with adverts tailored to their interests, or sell the information as a package to advertisers and industry analysts. And yet, here’s Comcast providing a DNS-over-HTTPS service for Firefox fans, allowing it to inspect and exploit their incoming queries if it so wishes. Talk about a fox guarding the hen house.

ISPs “have access to a stream of a user’s browsing history,” Marshall Erwin, senior director of trust and security at, er, Mozilla, warned in November. “This is particularly concerning in light of the rollback of the broadband privacy rules, which removed guardrails for how ISPs can use your data. The same ISPs are now fighting to prevent the deployment of DNS-over-HTTPS.”

Mozilla today insisted its new best buddy Comcast is going to play nice and follow the DNS privacy program’s rules.

Source: Talk about the fox guarding the hen house. Comcast to handle DNS-over-HTTPS for Firefox-using subscribers • The Register

Russia returns to space tourism and offers a first citizen spacewalk

Russia’s space agency Roscosmos has re-entered the space tourism market and this time will offer one person the chance to spacewalk.

The agency on Thursday announced a new deal with US outfit Space Adventures to take two people to the International Space Station atop a Soyuz rocket. One of the tourists, according to Space Adventures’ announcement, “will have an opportunity to conduct a spacewalk outside the space station, becoming the first private citizen in history to experience open space.”

The spacewalking tourist will be accompanied by a professional Russian cosmonaut.

The two companies have previously launched seven space tourists including Ubuntu daddy Mark Shuttleworth in 2002. Your correspondent interviewed him about the experience in 2005 and he was still clearly awed by the power of the Soyuz, weightlessness and the views from above, to the extent that he said a sub-orbital tourist flight with the likes of Virgin Galactic held little appeal.

The trip will see the pair of tourists spend 14 days in the Russian module of the ISS.

Source: Russia returns to space tourism and offers a first citizen spacewalk • The Register

As advertisers revolt, Facebook commits to flagging ‘newsworthy’ political speech that violates policy

As advertisers pull away from Facebook to protest the social networking giant’s hands-off approach to misinformation and hate speech, the company is instituting a number of stronger policies to woo them back.

In a livestreamed segment of the company’s weekly all-hands meeting, CEO Mark Zuckerberg recapped some of the steps Facebook is already taking, and announced new measures to fight voter suppression and misinformation — although they amount to things that other social media platforms like Twitter have already enahatected and enforced in more aggressive ways.

At the heart of the policy changes is an admission that the company will continue to allow politicians and public figures to disseminate hate speech that does, in fact, violate Facebook’s own guidelines — but it will add a label to denote they’re remaining on the platform because of their “newsworthy” nature.

It’s a watered-down version of the more muscular stance that Twitter has taken to limit the ability of its network to amplify hate speech or statements that incite violence.

Zuckerberg said:

A handful of times a year, we leave up content that would otherwise violate our policies if the public interest value outweighs the risk of harm. Often, seeing speech from politicians is in the public interest, and in the same way that news outlets will report what a politician says, we think people should generally be able to see it for themselves on our platforms.

We will soon start labeling some of the content we leave up because it is deemed newsworthy, so people can know when this is the case. We’ll allow people to share this content to condemn it, just like we do with other problematic content, because this is an important part of how we discuss what’s acceptable in our society — but we’ll add a prompt to tell people that the content they’re sharing may violate our policies.

The problems with this approach are legion. Ultimately, it’s another example of Facebook’s insistence that with hate speech and other types of rhetoric and propaganda, the onus of responsibility is on the user.

Source: As advertisers revolt, Facebook commits to flagging ‘newsworthy’ political speech that violates policy | TechCrunch

Apple: We’re defending your privacy by nixing 16 browser APIs. Rivals: You mean defending your bottom line

Apple has said it has decided not to implement 16 web APIs in its Safari browser’s WebKit engine in part because they pose a privacy threat. Critics of the iGiant, including competitors like Google, see Apple’s stance as a defense against a competitive threat.

These APIs, developed in recent years to allow web developers to have access to capabilities available to native mobile platform coders, have the potential to be abused for device fingerprinting, a privacy-violating technique for constructing a unique identifier out of readable device characteristics that can be used for tracking individuals across websites and can be correlated to follow people across devices.

“WebKit’s first line of defense against fingerprinting is to not implement web features which increase fingerprintability and offer no safe way to protect the user,” explains the WebKit team’s recently updated post on tracking prevention.

[…]

In a message to The Register, Lukasz Olejnik, an independent researcher and consultant, characterized the decision as a win for privacy, noting that research he co-authored in 2015 and subsequently on the privacy risks of the Battery Status API and other browser fingerprinting threats helped shape Apple’s policy.

Concern about abuse of the Battery Status API, which websites and browser-based apps can use to check the battery level of a visitor’s/user’s mobile device, prompted Mozilla to remove support in October 2016. Around the same time, Apple, which had implemented the API in code but never activated it, decided not ship it.

Google meanwhile shipped the Battery Status API in Chrome 45, which debuted on July 10, 2015. Rather than removing it, the web giant in May committed to modifying it by allowing developers to disable the API with their apps and in third-party components.

Apple, trying to control its market? No!

Google engineers coincidentally are among those expressing frustration with Apple for holding the web platform back.

Apple requires that all web browsers on iOS devices use Safari’s WebKit rendering engine, which has made mobile browsers on iOS something of a monoculture: Though users may choose to run Chrome on iOS, it’s essentially Safari under the hood.

Over the past few years, Apple’s leisurely (or cautious) pace of API deployment in Safari has meant that Progressive Web Apps (PWAs) – installable web apps that run offline – haven’t worked properly on iOS devices.

As a result, web developers, particularly those interested in PWA adoption, have accused Apple of trying to hamstring web apps to protect its financial stake in native iOS apps, for which it gets a 30 per cent share of revenue through its App Store rules. Those same rules are now the subject of an EU antitrust inquiry.

[…]

Or as Ben Thompson, tech analyst for Stratechery, put it in a blog post on Monday, “Making the web less useful makes apps more useful, from which Apple can take its share; similarly, it is notable that Apple is expanding its own app install product even as it is kneecapping the industry’s.”

Asked about whether these competitive concerns have substance, Olejnik acknowledged that some people see Apple’s technical decisions in that light.

“That said, some privacy concerns are legitimate,” he said.

And for what it’s worth, the technical barriers to PWAs have been falling.

Source: Apple: We’re defending your privacy by nixing 16 browser APIs. Rivals: You mean defending your bottom line • The Register

How to jam neural networks

Sponge Examples: Energy-Latency Attacks on Neural Networks shows how to find adversarial examples that cause a DNN to burn more energy, take more time, or both. They affect a wide range of DNN applications, from image recognition to natural language processing (NLP). Adversaries might use these examples for all sorts of mischief – from draining mobile phone batteries, though degrading the machine-vision systems on which self-driving cars rely, to jamming cognitive radar.

So far, our most spectacular results are against NLP systems. By feeding them confusing inputs we can slow them down over 100 times. There are already examples in the real world where people pause or stumble when asked hard questions but we now have a dependable method for generating such examples automatically and at scale. We can also neutralize the performance improvements of accelerators for computer vision tasks, and make them operate on their worst case performance.

One implication is that engineers designing real-time systems that use machine learning will have to pay more attention to worst-case behaviour; another is that when custom chips used to accelerate neural network computations use optimisations that increase the gap between worst-case and average-case outcomes, you’d better pay even more attention.

Source: How to jam neural networks | Light Blue Touchpaper

OpenAI GPT-2 creates credible texts from minimal input

We’ve trained a large-scale unsupervised language model which generates coherent paragraphs of text, achieves state-of-the-art performance on many language modeling benchmarks, and performs rudimentary reading comprehension, machine translation, question answering, and summarization—all without task-specific training.

Our model, called GPT-2 (a successor to GPT), was trained simply to predict the next word in 40GB of Internet text. Due to our concerns about malicious applications of the technology, we are not releasing the trained model. As an experiment in responsible disclosure, we are instead releasing a much smaller model for researchers to experiment with, as well as a technical paper.

[…]

GPT-2 displays a broad set of capabilities, including the ability to generate conditional synthetic text samples of unprecedented quality, where we prime the model with an input and have it generate a lengthy continuation. In addition, GPT-2 outperforms other language models trained on specific domains (like Wikipedia, news, or books) without needing to use these domain-specific training datasets. On language tasks like question answering, reading comprehension, summarization, and translation, GPT-2 begins to learn these tasks from the raw text, using no task-specific training data. While scores on these downstream tasks are far from state-of-the-art, they suggest that the tasks can benefit from unsupervised techniques, given sufficient (unlabeled) data and compute.

Samples

GPT-2 generates synthetic text samples in response to the model being primed with an arbitrary input. The model is chameleon-like—it adapts to the style and content of the conditioning text. This allows the user to generate realistic and coherent continuations about a topic of their choosing, as seen by the following select samples

Source: Better Language Models and Their Implications

Experiment confirms 50-year-old theory describing how black holes could generate energy

In 1969, British physicist Roger Penrose suggested that energy could be generated by lowering an object into the black hole’s ergosphere—the outer layer of the black hole’s event horizon, where an object would have to move faster than the speed of light in order to remain still.

Penrose predicted that the object would acquire a negative energy in this unusual area of space. By dropping the object and splitting it in two so that one half falls into the black hole while the other is recovered, the recoil action would measure a loss of negative energy—effectively, the recovered half would gain energy extracted from the black hole’s rotation. The scale of the engineering challenge the process would require is so great, however, that Penrose suggested only a very advanced, perhaps alien, civilisation would be equal to the task.

Two years later, another physicist named Yakov Zel’dovich suggested the theory could be tested with a more practical, earthbound experiment. He proposed that “twisted” light waves, hitting the surface of a rotating metal cylinder turning at just the right speed, would end up being reflected with additional energy extracted from the cylinder’s rotation thanks to a quirk of the rotational doppler effect.

But Zel’dovich’s idea has remained solely in the realm of theory since 1971 because, for the experiment to work, his proposed metal cylinder would need to rotate at least a billion times a second—another insurmountable challenge for the current limits of human engineering.

Now, researchers from the University of Glasgow’s School of Physics and Astronomy have finally found a way to experimentally demonstrate the effect that Penrose and Zel’dovich proposed by twisting instead of light—a much lower frequency source, and thus much more practical to demonstrate in the lab.

[…]

Marion Cromb, a Ph.D. student in the University’s School of Physics and Astronomy, is the paper’s lead author. Marion said: “The linear version of the doppler effect is familiar to most people as the phenomenon that occurs as the pitch of an ambulance siren appears to rise as it approaches the listener but drops as it heads away. It appears to rise because the sound waves are reaching the listener more frequently as the ambulance nears, then less frequently as it passes.

“The rotational doppler effect is similar, but the effect is confined to a circular space. The twisted sound waves change their pitch when measured from the point of view of the rotating surface. If the surface rotates fast enough then the sound frequency can do something very strange—it can go from a positive frequency to a negative one, and in doing so steal some energy from the rotation of the surface.”

As the speed of the spinning disc increases during the researchers’ experiment, the pitch of the sound from the speakers drops until it becomes too low to hear. Then, the pitch rises back up again until it reaches its previous pitch—but louder, with amplitude of up to 30% greater than the original sound coming from the speakers.

Marion added: “What we heard during our experiment was extraordinary. What’s happening is that the frequency of the is being doppler-shifted to zero as the spin speed increases. When the sound starts back up again, it’s because the waves have been shifted from a positive frequency to a negative frequency. Those negative-frequency waves are capable of taking some of the from the spinning foam disc, becoming louder in the process—just as Zel’dovich proposed in 1971.”

Professor Daniele Faccio, also of the University of Glasgow’s School of Physics and Astronomy, is a co-author on the paper. Prof Faccio added: “We’re thrilled to have been able to experimentally verify some extremely odd physics a half-century after the theory was first proposed. It’s strange to think that we’ve been able to confirm a half-century-old theory with cosmic origins here in our lab in the west of Scotland, but we think it will open up a lot of new avenues of scientific exploration. We’re keen to see how we can investigate the effect on different sources such as electromagnetic waves in the near future.”

The research team’s paper, titled “Amplification of waves from a rotating body,” is published in Nature Physics.


Explore further

Reversal of orbital angular momentum arising from an extreme Doppler shift


More information: Marion Cromb et al. Amplification of waves from a rotating body, Nature Physics (2020). DOI: 10.1038/s41567-020-0944-3

Source: Experiment confirms 50-year-old theory describing how an alien civilization could exploit a black hole

Depixelizing Video Game Characters using AI Creates Monsters

A new digital tool built to depixelize photos sounds scary and bad. Another way to remove privacy from the world. But this tool is also being used for a sillier and not terrible purpose: Depixelizng old game characters. The results are…nevermind, this is also a terrible use of this tool.

“Face Depixelizer” is a tool Created by Alex Damian, Sachit Menon, and Denis Malimonov. It does exactly what you expect with a name like that. Users can upload a pixelated photo of a face and the tool spits out what that person might look like based on algorithms and all that stuff. In the wrong hands, this type of tech can be used to do some bad shit and will make it harder to hide in this world from police and other powerful and dangerous groups.

But it can also be used to create monsters out of old game characters. Look what this thing did to Mario, for example.

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

Steve from Minecraft turns into a dude who doesn’t wear a mask because “It’s all a hoax dude.”

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

Guybrush changed quite a bit and also grew weirdly disturbing hair…

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

These might be strange or even a bit monstrous, but things start getting much worse when you feed the tool images that don’t look like people at all. For example, this is what someone got after uploading an image of a Cacodemon from Doom.

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

Poor Peppy turns into a demon from a horror film.

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

And the Creeper from Minecraft somehow becomes even scarier.

Illustration for article titled Depixelizing Video Game Characters Creates Monsters
Screenshot: Twitter

There’s a bunch more in this thread. There’s also a bunch of Tweets all about uploading Black people’s faces and learning that the tool isn’t great at dealing with them. Almost seems like you should have diverse teams working on tech projects so as to not overlook a small detail like an entire group of people. Though in this case, I’m fine with the creators screwing up.

Maybe if people keep uploading video game images to tools like this we can eventually make them worthless.

Source: Depixelizing Video Game Characters Creates Monsters

Big Tech on the hook for billions in back taxes after US Supreme Court rejects Altera stock options case hearing

Google, Apple, Facebook, Amazon and a host of other tech giants will have to pay billions of dollars in extra tax after the Supreme Court refused to hear an appeal on a stock-option case.

America’s top court said [PDF] on Monday it will not review a decision by the Ninth Circuit of Appeals that stock-based compensation should be considered a US taxable asset.

The case concerns the tax years 2004-2007 and Intel-owned tech company Altera, which provided its employees with the ability to buy company shares at a set price in future – a common practice in the tech industry. But that benefit was not included in an accounting of an Altera subsidiary based in a Cayman Islands tax haven just prior to Intel’s purchase.

The shifting of intangible assets has become a common tax-reducing tactic by large tech companies and saves those companies billions of dollars every year that they would otherwise pay to US tax authorities.

However, the Internal Revenue Service (IRS) insisted that Altera’s stock-option compensation be taxed under US tax rules. Facing a massive tax bill- Altera refused to accept the rule and challenged it in court, arguing that “the amount of money at stake is enormous.”

The company accused the IRS of over-reach and claimed it had not provided sufficient evidence to prove its case. And Altera won with a unanimous decision in tax court.

But the IRS appealed and the Ninth Circuit then found in the IRS’ favor, arguing in its 2-1 decision [PDF] in June 2019 that it was “uncontroversial” that stock options should be treated as accounting costs. It then refused a request for the whole court to rehear the case. So Altera appealed the decision to the Supreme Court.

Big Tech weighs in

Among the companies that urged the Supreme Court to take up the case were Apple, Google and Facebook – all of which now face massive tax bills for having done exactly the same thing.

The tech giants argued that the Ninth Circuit decision threatened to ruin “the hard-won but fragile international consensus on treatment of hundreds of billions of dollars of intercompany payments.” In other words, land them with massive, unexpected tax bills.

Ranged against the tech giants were a clump of law professors who argued that the IRS was right to make stock-option compensation a taxable asset.

It’s hard to know the true impact on those companies but the bills are expected to run to billions of dollars, possibly tens of billions. But in a sign of just how big those companies have become the Supreme Court judgment had no impact on share prices this morning – Wall Street knows quite how much cash these companies are sitting on.

If that news wasn’t bad enough however, there is a bigger tax issue hovering over Big Tech: the so-called digital tax threatened by the European Union, which is also fed up with companies like Google, Apple and Facebook paying almost no tax in their countries because of creative accounting through subsidiaries.

That digital tax became more likely this month after the US walked away from discussions at the Organisation for Economic Co-operation and Development (OECD) that were focused on developing a global tax agreement for digital companies.

With the OECD approach faltering, the EU has already made it clear that it will introduce its own version of a digital tax that is likely to make tech giants pay much more to countries in which they operate. Those new taxes are expected to kick in at the start of 2021.

Source: Big Tech on the hook for billions in back taxes after US Supreme Court rejects Altera stock options case hearing • The Register

‘BlueLeaks’ Exposes Files, personal and banking details, emails from Hundreds of Police Departments spanning 24 years

Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed “BlueLeaks” and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.

The collection — nearly 270 gigabytes in total — is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.

A partial screenshot of the BlueLeaks data cache.

In a post on Twitter, DDoSecrets said the BlueLeaks archive indexes “ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources,” and that “among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more.”

Fusion centers are state-owned and operated entities that gather and disseminate law enforcement and public safety information between state, local, tribal and territorial, federal and private sector partners.

KrebsOnSecurity obtained an internal June 20 analysis by the National Fusion Center Association (NFCA), which confirmed the validity of the leaked data. The NFCA alert noted that the dates of the files in the leak actually span nearly 24 years — from August 1996 through June 19, 2020 — and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files.

“Additionally, the data dump contains emails and associated attachments,” the alert reads. “Our initial analysis revealed that some of these files contain highly sensitive information such as ACH routing numbers, international bank account numbers (IBANs), and other financial data as well as personally identifiable information (PII) and images of suspects listed in Requests for Information (RFIs) and other law enforcement and government agency reports.”

[…]


22
Jun 20

‘BlueLeaks’ Exposes Files from Hundreds of Police Departments

Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed “BlueLeaks” and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.

The collection — nearly 270 gigabytes in total — is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.

A partial screenshot of the BlueLeaks data cache.

In a post on Twitter, DDoSecrets said the BlueLeaks archive indexes “ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources,” and that “among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more.”

Fusion centers are state-owned and operated entities that gather and disseminate law enforcement and public safety information between state, local, tribal and territorial, federal and private sector partners.

KrebsOnSecurity obtained an internal June 20 analysis by the National Fusion Center Association (NFCA), which confirmed the validity of the leaked data. The NFCA alert noted that the dates of the files in the leak actually span nearly 24 years — from August 1996 through June 19, 2020 — and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files.

“Additionally, the data dump contains emails and associated attachments,” the alert reads. “Our initial analysis revealed that some of these files contain highly sensitive information such as ACH routing numbers, international bank account numbers (IBANs), and other financial data as well as personally identifiable information (PII) and images of suspects listed in Requests for Information (RFIs) and other law enforcement and government agency reports.”

The NFCA said it appears the data published by BlueLeaks was taken after a security breach at Netsential, a Houston-based web development firm.

“Preliminary analysis of the data contained in this leak suggests that Netsential, a web services company used by multiple fusion centers, law enforcement, and other government agencies across the United States, was the source of the compromise,” the NFCA wrote. “Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data.”

Source: ‘BlueLeaks’ Exposes Files from Hundreds of Police Departments — Krebs on Security

Machine-learning models trained on pre-COVID data are now completely out of whack, says Gartner

Machine learning models built for doing business prior to the COVID-19 pandemic will no longer be valid as economies emerge from lockdowns, presenting companies with new challenges in machine learning and enterprise data management, according to Gartner.

The research group has reported that “the extreme disruption in the aftermath of COVID-19… has invalidated many models that are based on historical data.”

Organisations commonly using machine learning for product recommendation engines or next-best-offer, for example, will have to rethink their approach. They need to broaden their machine learning techniques as there is not enough post-COVID-19 data to retrain supervised machine learning models.

Advanced modelling techniques can help

In any case the ‘new normal’ is still emerging, making the validity of prediction models a challenge, said Rita Sallam, distinguished research vice president at Gartner.

“It’s a lot harder to just say those models based on typical data that happened prior to the COVID-19 outbreak, or even data that happened during the pandemic, will be valid. Essentially what we’re seeing is [a] complete shift in many ways in customer expectations, in their buying patterns. Old processing, products, customer needs and wants, and even business models are being replaced. Organisations have to replace them at a pace that is just unprecedented,” she said.

Source: Machine-learning models trained on pre-COVID data are now completely out of whack, says Gartner • The Register

Beidou: China completes rival to the US-owned GPS system

China sent the last satellite to space on Tuesday to complete its global navigation system that will help wean it off U.S. technology in this area.

The network known as Beidou, which has been in the works for over two decades, is a significant step for China’s space and technology ambitions.

Beidou is a rival to the U.S. government-owned Global Positioning System (GPS), which is widely-used across the world.

Experts previously told CNBC that Beidou will help China’s military stay online in case of a conflict with the U.S. But the launch is also part of Beijing’s push to increase its technological influence globally.

Source: Beidou: China completes rival to the US-owned GPS system

tens of thousands of mobile numbers of 50+ year olds sold for whatsapp fraud

Names, adresses and mobile numbers have been sold for fraud using WhatsApp. Most of these numbers come from callcentres, mainly those selling energy contracts. The fresher a lead is, the more they are worth: betwween 25 cents and 2 euros. The money is usually transferred through mules, who keep a percentage of the proceeds.

Source: ’06-nummers van tienduizenden vijftigplussers doorverkocht voor WhatsAppfraude’ – Emerce

Microsoft Edge Accused of Sneakily Importing Firefox Data on Windows 10

In the case of Firefox users, some discovered that the new default Windows 10 browser, which is shipped to their devices via Windows Update, sometimes imports the data from Mozilla’s application even if they don’t give their permission.

Some of these Firefox users decided to kill the initial setup process of Microsoft Edge, only to discover that despite the wizard shutting down prematurely, the browser still copied data stored by Mozilla’s browser.

Several users confirmed on reddit that this behavior happened on their computers too.

Silent data importing

“Love rebooting my computer to get treated to a forced tour of a browser I’m not going to use that I have to force close through the task manager to escape, and then finding out it’s been copying over my data from Firefox without permission,” one user explains.

“Unless you close it via task manager instead of doing the forced setup, in which case it copies your data anyway, and the worst part is most people will never know what it’s doing because they’ll never open it again. I only reopened it because I noticed it automatically signed me into the browser as it was closing and wanted to sign out before not touching it again, at which point I discovered it had already copied my Firefox data over despite the fact I didn’t go through the setup process,” someone else explains.

Microsoft has remained tight-lipped on this, so for the time being, it’s still not known why Edge imports Firefox data despite the initial wizard actually killed off manually by the user.

Users who don’t want to be offered the new Edge on Windows Update can turn to the dedicated toolkit that Microsoft released earlier this year, while removing the browser is possible by just uninstalling the update from the device.

Source: Microsoft Edge Accused of Sneakily Importing Firefox Data on Windows 10

Facebook Bans Sale of Historical Artifacts Due to Rampant Black Market Trade also from within conflict zones by terrorists

Facebook has finally said it would now prohibit the sale of all historical artifacts due to rampant black market trade in looted antiquitieson the site, per the New York Times—a problem the social media company has known about for years.

The new rules ban any “attempts to buy, sell or trade in historical artifacts,” defined as “rare items of significant historical, cultural or scientific value,” on Facebook or Instagram. It also comes after years of Facebook doing very little to restrict trade in those same objects.

Reporting last month in the Times found at least 90 Facebook groups, mostly written in Arabic, with tens of thousands of members that were “connected to the illegal trade in Middle Eastern antiquities.” In those groups, salespeople would post images or descriptions of objects and often then direct interested buyers to contact them via chat or other services to arrange payment or meetings in person; in some cases, the buyers simply posted that they were interested in acquiring a specific type of artifact. Some of the groups also trafficked in do-it-yourself guides on how others could get into the black market antiquities trade.

Some of the items may have been originally acquired by Islamic State terrorists, who in addition to destroying thousands of years’ worth of artifacts and archaeological sites in regions under their control in Iraq, Syria, and Libya, looted those sites and other cultural institutions like museums for profit. Armed groups affiliated or working with other extremist groups and criminal organizations have participated as well. A United Nations Security Council report in January 2020 noted evidence of numerous excavations by Islamic State or al-Qaeda affiliates and concluded that social media groups “dedicated to antiquities trafficking continue to be created, while the area of origin of trafficked artefacts increases, continuously revealing a web of interconnectivity among antiquities traffickers.”

While in some cases looters and buyers used coded language to discuss the deals, Antiquities Trafficking and Heritage Anthropology Research Project (ATHAR) co-directors Katie Paul told the Times, in other instances it was all playing out in the open, right down to photos and videos of the objects being stolen to prove they were genuine. Paul told Artnet News that the countries of origin are “places where no legal trade exists,” making the sales uniformly illegal.

The total number of groups identified by researchers and activists is at least 200, according to the Times, and those are just the ones that they have caught onto. ATHAR released a report in 2019 finding “488 individual admins managing a collective 1,947,195 members across 95 Facebook Groups” comprised of a “mix of average citizens, middlemen, and violent extremists,” with what appeared to be a high degree of coordination between the admins of those groups:

Group members include a mix of average citizens, middlemen, and violent extremists. Violent extremists currently include individuals associated with Syrian-based groups like Hay’at Tahrir Al Sham (HTS), Hurras Al-Din, the Zinki Brigade and other non-Syrian based Al-Qaeda or Islamic State in Iraq and Syria (ISIS) affiliates. All of these groups are using Facebook as a platform for antiquities trafficking, whether through direct interaction with buyers and sellers or through the use of middlemen who straddle transactions between the general public and terrorist groups.

Administrators usually demanded that the black market traders cough up fees from any sales related to their membership in groups, according to the report. Around 36 percent of the sellers in an ATHAR case study of Syrian groups were actually located in conflict zones, while another 44 percent were in countries bordering conflict zones.

ATHAR co-director and Shawnee State University professor Amr Al-Azm, who had previously worked in Syria as an antiquities official, told the Times artifacts were also flowing from Yemen, Egypt, and Tunisia and that Facebook could have taken action as early as 2014, when deleting the groups would have had a bigger impact. He added it was a “supply and demand issue” and that deleting Facebook pages instead of archiving evidence destroys “a huge corpus of evidence” that might later be used to track down artifacts.

A Facebook report released on Tuesday acknowledged the issue, conceding significant pitfalls in policies that allowed trade in historical artifacts except where “it is clear that the artifacts have been looted.” Key findings included there is a “good chance that historical artifacts traded online are either illegal or fake, as an estimated 80% of antiquities have ‘sketchy provenances,’” as well as that there “is criticism that Facebook’s policy has led the platform to become a digital black market where users buy and sell illicit antiquities originating from conflict zones.”

Greg Mandel, a spokesperson for Facebook, told the Times that trade in “stolen artifacts” was already prohibited by site rules. (Paul and Al-Azm have disagreed that Facebook was actively enforcing those policies in the past, writing in 2018 that “Facebook does not currently enforce an explicit ban on transactions involving illicit cultural property.”)

“To keep these artifacts and our users safe, we’ve been working to expand our rules, and starting today, we now prohibit the exchange, sale or purchase of all historical artifacts on Facebook and Instagram,” Mandel added.

Paul told the Times the new policy is “an important shift in [Facebook’s] position on the trade in cultural heritage” and demonstrates they are aware of “illegal and harmful activity” on the site. But the policy is “only as good as its enforcement,” she added.

Source: Facebook Bans Sale of Historical Artifacts Due to Rampant Black Market Trade

Teaching physics to neural networks removes ‘chaos blindness’

a can be trained to identify photos of dogs by sifting through a large number of photos, making a guess about whether the photo is of a dog, seeing how far off it is and then adjusting its weights and biases until they are closer to reality.

The drawback to this is something called “ blindness”—an inability to predict or respond to chaos in a system. Conventional AI is chaos blind. But researchers from NC State’s Nonlinear Artificial Intelligence Laboratory (NAIL) have found that incorporating a Hamiltonian function into neural networks better enables them to “see” chaos within a system and adapt accordingly.

Simply put, the Hamiltonian embodies the complete information about a dynamic physical system—the total amount of all the energies present, kinetic and potential. Picture a swinging pendulum, moving back and forth in space over time. Now look at a snapshot of that pendulum. The snapshot cannot tell you where that pendulum is in its arc or where it is going next. Conventional neural networks operate from a snapshot of the pendulum. Neural networks familiar with the Hamiltonian flow understand the entirety of the pendulum’s movement—where it is, where it will or could be, and the energies involved in its movement.

In a proof-of-concept project, the NAIL team incorporated Hamiltonian structure into neural networks, then applied them to a known model of stellar and called the Hénon-Heiles model. The Hamiltonian neural network accurately predicted the dynamics of the system, even as it moved between order and chaos.

“The Hamiltonian is really the ‘special sauce’ that gives neural networks the ability to learn order and chaos,” says John Lindner, visiting researcher at NAIL, professor of physics at The College of Wooster and corresponding author of a paper describing the work. “With the Hamiltonian, the neural network understands underlying dynamics in a way that a conventional cannot. This is a first step toward physics-savvy neural networks that could help us solve hard problems.”

Source: Teaching physics to neural networks removes ‘chaos blindness’

More information: Anshul Choudhary et al, Physics-enhanced neural networks learn order and chaos, Physical Review E (2020). DOI: 10.1103/PhysRevE.101.062207

Journal information: Physical Review E

Netgear was told in January its routers can be hacked and hijacked. This week, first patches released – after exploits, details made public

Netgear has issued patches to squash security vulnerabilities in two router models that can be exploited to, for instance, open a superuser-level telnet backdoor.

Those two devices are the R6400v2 and R6700v3, and you can get hot-fixes for the holes here. However, some 77 models remain reportedly vulnerable, and no fixes are available. For the full list of Netgear SOHO products said to be at-risk, see the afore-linked page.

Exploit code, developed by infosec outfit Grimm, is available on GitHub for all the models said to be vulnerable: it opens telnet daemon on port 8888, if successful. There’s technical details here.

The bugs lie in the web-based control panel of the Linux-powered equipment. It can be hijacked by sending it specially crafted data, bypassing the password protection, via the local network, or the internet if it is exposed to the world, or by tricking a victim into opening a webpage that automatically connects to the device on the LAN. Once exploited, the device can be commanded to open a backdoor, change its DNS and DHCP settings to redirect users to phishing websites, and so on.

How we got to this situation is an interesting tale. In January, Trend Micro’s Zero-Day Initiative (ZDI) privately contacted Netgear on behalf of a security researcher, called d4rkn3ss, at the Vietnamese government’s national telecoms provider. The egghead had found a way into R6700 routers via a classic buffer overflow attack, and Netgear was informed of the weakness.

ZDI and Netgear eventually agreed on a deadline of June 15 to release any necessary security updates: on that day, ZDI would go public with details of the flaw. At the end of May, Netgear asked for an extension to the end of June. ZDI rejected the request, and on Monday, emitted its advisory.

“This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Netgear R6700 routers,” ZDI explained. “Authentication is not required to exploit this vulnerability.

“The specific flaw exists within the httpd service, which listens on TCP port 80 by default. The issue results from the lack of proper validation of the length of user-supplied data prior to copying it to a fixed-length, stack-based buffer. An attacker can leverage this vulnerability to execute code in the context of root.”

Since it’s remote code execution, you can completely take over the router.

Speaking to The Register, ZDI senior manager of vulnerability analysis Abdul-Aziz Hariri said: “Since authentication is not required to reach this bug, anyone who can connect to the local network of the router would be capable of exploiting this vulnerability. Since it’s remote code execution, you can completely take over the router.

“In most scenarios, the attacker would be able to possibly upload a custom backdoor software and establish persistence or launch further attacks, like man-in-the-middle attacks.”

While ZDI waited for Netgear to release its patches, Grimm privately reported to Netgear in May it had found the same security hole in a bunch of the manufacturer’s products. When ZDI went public, so did Grimm: publishing an in-depth advisory showing how to exploit the holes, and released full, working proof-of-concept exploit code.

Three days later, Netgear released the aforementioned hot-fixes for two of the models. “We have already provided hot fixes for the R7000 and the R6700. The rest are forth coming,” the router-maker told The Register on Thursday.

The Grimm team noted that Netgear’s firmware lacked basic protections, such as ASLR for its programs, which makes the bugs in the equipment easy to exploit.

Source: Netgear was told in January its routers can be hacked and hijacked. This week, first patches released – after exploits, details made public • The Register

And this is why responsible disclosure is a good idea.

Massive spying on users of Google’s Chrome shows new security weakness

A newly discovered spyware effort attacked users through 32 million downloads of extensions to Google’s market-leading Chrome web browser, researchers at Awake Security told Reuters, highlighting the tech industry’s failure to protect browsers as they are used more for email, payroll and other sensitive functions.

Alphabet Inc’s (GOOGL.O) Google said it removed more than 70 of the malicious add-ons from its official Chrome Web Store after being alerted by the researchers last month.

[,,,]

Most of the free extensions purported to warn users about questionable websites or convert files from one format to another. Instead, they siphoned off browsing history and data that provided credentials for access to internal business tools.

Based on the number of downloads, it was the most far-reaching malicious Chrome store campaign to date, according to Awake co-founder and chief scientist Gary Golomb.

Google declined to discuss how the latest spyware compared with prior campaigns, the breadth of the damage, or why it did not detect and remove the bad extensions on its own despite past promises to supervise offerings more closely.

It is unclear who was behind the effort to distribute the malware. Awake said the developers supplied fake contact information when they submitted the extensions to Google.

“Anything that gets you into somebody’s browser or email or other sensitive areas would be a target for national espionage as well as organized crime,” said former National Security Agency engineer Ben Johnson, who founded security companies Carbon Black and Obsidian Security.

The extensions were designed to avoid detection by antivirus companies or security software that evaluates the reputations of web domains, Golomb said.

If someone used the browser to surf the web on a home computer, it would connect to a series of websites and transmit information, the researchers found. Anyone using a corporate network, which would include security services, would not transmit the sensitive information or even reach the malicious versions of the websites.

“This shows how attackers can use extremely simple methods to hide, in this case, thousands of malicious domains,” Golomb said.

After this story’s publication, Awake released its research, including the list of domains and extensions. here

All of the domains in question, more than 15,000 linked to each other in total, were purchased from a small registrar in Israel, Galcomm, known formally as CommuniGal Communication Ltd.

Awake said Galcomm should have known what was happening.

In an email exchange, Galcomm owner Moshe Fogel told Reuters that his company had done nothing wrong.

“Galcomm is not involved, and not in complicity with any malicious activity whatsoever,” Fogel wrote. “You can say exactly the opposite, we cooperate with law enforcement and security bodies to prevent as much as we can.”

[…]

Malicious developers have been using Google’s Chrome Store as a conduit for a long time. After one in 10 submissions was deemed malicious, Google said in 2018 here it would improve security, in part by increasing human review.

But in February, independent researcher Jamila Kaya and Cisco Systems’ Duo Security uncovered here a similar Chrome campaign that stole data from about 1.7 million users. Google joined the investigation and found 500 fraudulent extensions.

Source: Exclusive: Massive spying on users of Google’s Chrome shows new security weakness – Reuters

Google isn’t even trying to not be creepy: ‘Continuous Match Mode’ in Assistant will listen to everything until it’s disabled

Google has introduced “continuous match mode” for apps on its voice-powered Assistant platform, where it will listen to everything without pausing. At the same time it has debuted related developer tools, new features, and the ability to display web content on its Smart Display hardware using the AMP component framework.

The Chocolate Factory has big plans for its voice assistant. “We consider voice to be the biggest paradigm shift around us,” said director of product Baris Gultekin, speaking at the Voice Global summit, where the new features were introduced.

The goal is “ambient computing”, where you can interact with the big G anywhere at any time, so pervasively that you do not notice it. Voice interaction is a key part of this since it extends the ability to perform searches or run applications to scenarios where tapping a keyboard or touching a display are not possible.

Google Assistant exists in many guises such as on smartphones and watches, TVs, PCs, and also on dedicated hardware, such as the voice-only Google Home and Google Home Mini, or with “smart display” screens on the Google Nest Hub or devices from Lenovo and Harman. While assistant devices have been popular, Android phones (which nag you to set up the Assistant) must form the largest subset of users. Over all the device types, the company claims over 500 million active users.

[…]

Actions Builder will “replace DialogFlow as the preferred way to develop actions on the assistant,” said Shodjai.

Google's new Action Builder at work

Google’s new Action Builder at work

Trying out the new Action Builder, we discovered that running an action under development is impossible if you have the Web and App Activity permission, which lets Google keep a record of your actions, disabled. A dialog appears prompting you to enable it. It is a reminder of how Google Assistant is entwined with the notion that you give Google your data in return for personalised experiences.

[…]

“Sometimes you want to build experiences that enable the mic to remain open, to enable users to speak more naturally with your action, without waiting for a change in mic states,” said Shodjai at the summit and in the developer post.

“Today we are announcing an early access program for Continuous Match Mode, which allows the assistant to respond immediately to user’s speech enabling more natural and fluid experiences. This is done transparently, so that before the mic opens the assistant will announce, ‘the mic will stay open temporarily’, so users know they can now speak freely without waiting for additional prompts.”

The mode is not yet publicly documented. The demonstrated example was for a game with jolly cartoon pictures; but there may be privacy implications since in effect this setting lets the action continue to listen to everything while the mode is active.

Shodjai did not explain how users will end a Continuous Match Mode session but presumably this will be either after a developer-defined exit intent, or via a system intent as with existing actions. Until that happens, the action will be able to keep running.

Just as with personalisation via tracking and data collection, privacy and pervasive computing do not sit comfortably together, and with the new Continuous Match Mode a little more privacy slips away.

Source: Google isn’t even trying to not be creepy: ‘Continuous Match Mode’ in Assistant will listen to everything until it’s disabled • The Register

Groundbreaking Technology Allows 3D Tissues To Be Printed Directly Into Human Body

LOS ANGELES — The world of 3D printing has come so far that scientists can actually produce biological products like bone, skin and blood vessels. Of course, there are numerous safety risks involved in using 3D-printed body parts in human patients. There is progress on that front, though. Scientists have developed a method for printing body parts that will make procedures involving 3D-printed tissues much safer.

Typically, when scientists print tissues, they transplant them into their patients after being printed. Thanks to a research team led by researchers at the Terasaki Institute, tissues can now be printed directly into a patient’s body.

[…]

“This bio-ink formulation is 3D printable at physiological temperature, and can be crosslinked safely using visible light inside the body.” says first author Ali Asghari Adib, Ph.D, in a media release.

Like squeezing icing onto a cake

Researchers also created a groundbreaking 3D-printing nozzle and an “interlocking” printing technique to use with their bio-ink. Bio-ink can be squeezed through the nozzle of the printer like cake icing is squeezed through a tube. The nozzle also punctures the tissue it’s about to print on so some bio-ink can fill the gaps the nozzle created and serve as an anchor for the 3D-printed tissue

“The interlocking mechanism enables stronger attachments of the scaffolds to the soft tissue substrate inside the patient body,” adds Asghari Adib.

Source: Groundbreaking Technology Allows 3D Tissues To Be Printed Directly Into Human Body – Study Finds

New Technique Allows 3D Printing of Flexible Materials using droplets

Engineers at the University of California, Davis, have developed a new approach to 3D printing that allows printing of finely tuned flexible materials. By using a droplet-based, multiphase microfluidic system, the team was able to efficiently print materials with potential applications in soft robotics, tissue engineering and wearable technology. The work is published June 15 in the Proceedings of the National Academy of Sciences.

In traditional extrusion-based 3D printers, printing material is pushed through a nozzle and added to the structure repeatedly until the product is complete. While this is efficient and cost-effective, it makes it hard to print structures made of more than one material, and getting the right amount of softness can be challenging.

Jiandi Wan, assistant professor of chemical engineering at UC Davis, noticed that this nozzle was similar to the glass capillary microfluidic devices that his lab studies. These devices have multiple nozzles placed inside of each other.

“Most extrusion-based 3D printers use very simple nozzles and since we had already developed these glass microfluidics, we thought, ‘why not apply it to 3D printing?’” said Wan.

Wan, UC Davis graduate student Hing Jii Mea and Luis Delgadillo, University of Rochester, developed a device that uses a multiphase drip system to encapsulate droplets of a water-based solution containing polyethylene glycol diacrylate, or PEGDA, inside of a common silicon-based organic polymer called polydimethylsiloxane, or PDMS. The PDMS flows around a dripper, which makes tiny droplets of the PEGDA that it evenly inserts into the PDMS as both materials flow onto the structure that’s being printed.

The resulting structure looks like a Pac-Man maze, with little dots of PEGDA droplets surrounded by PDMS. Once the PEGDA diffuses out of the droplets, it chemically softens the PDMS, making the structure more flexible.

“You can also encapsulate other chemicals in the droplets to make the overall matrix much softer or harder,” Wan said.

Structure flexibility can be tuned

The team also showed that droplet-based 3D printing can be used to produce flexible porous objects, and constructs with encapsulated polymer particles and metal droplets. In addition, structure flexibility can be easily tuned by changing the droplet size and flow rate. This gives researchers a wide range of options to truly design their structure and vary flexibility to fit their needs in a way that’s difficult with the conventional nozzle-based method.

Though microfluidic-based 3D printing has been done before, Wan’s group is the first to use this droplet-based multiphase emulsion approach. The team is already looking into potential applications and learning what other combinations of materials they can use to change the mechanical or chemical properties of 3D printed products. They think the work could have applications in bioprinting and wearable electronics, like smart fabrics.

“I think this will open a new area of research, since applying the established microfluidics technology to 3D printing represents a new direction to go,” he said.

Media contact(s)

Jiandi Wan, Chemical Engineering, jdwan@ucdavis.edu

Andy Fell, News and Media Relations, 530-752-4533, ahfell@ucdavis.edu

Media Resources

Source: New Technique Allows 3D Printing of Flexible Materials | UC Davis

3d Printing tissue inside the body

Abstract

We develop and characterize a biomaterial formulation and robotic methods tailored for intracorporeal tissue engineering (TE) via direct-write (DW) 3D printing. Intracorporeal TE is defined as the biofabrication of 3D TE scaffolds inside of a living patient, in a minimally invasive manner. A biomaterial for intracorporeal TE requires to be 3D printable and crosslinkable via mechanisms that are safe to native tissues and feasible at physiological temperature (37 °C). The cell-laden biomaterial (bioink) preparation and bioprinting methods must support cell viability. Additionally, the biomaterial and bioprinting method must enable the spatially accurate intracorporeal 3D delivery of the biomaterial, and the biomaterial must adhere to or integrate into the native tissue. Current biomaterial formulations do not meet all the presumed intracorporeal DW TE requirements. We demonstrate that a specific formulation of gelatin methacryloyl (GelMA)/Laponite®/methylcellulose (GLM) biomaterial system can be 3D printed at physiological temperature and crosslinked using visible light to construct 3D TE scaffolds with clinically relevant dimensions and consistent structures. Cell viability of 71-77% and consistent mechanical properties over 21 days are reported. Rheological modifiers, Laponite® and methylcellulose, extend the degradation time of the scaffolds. The DW modality enables the piercing of the soft tissue and over-extrusion of the biomaterial into the tissue, creating a novel interlocking mechanism with soft, hydrated native tissue mimics and animal muscle with a 3.5-4 fold increase in the biomaterial/tissue adhesion strength compared to printing on top of the tissue. The developed GLM biomaterial and robotic interlocking mechanism pave the way towards intracorporeal TE.

Source: Direct-write 3D printing and characterization of a GelMA-based biomaterial for intracorporeal tissue engineering – IOPscience