The Linkielist

Linking ideas with the world

The Linkielist

Monthly Archives: June 2020

Zoom will offer proper end-to-end encryption to free vid-chat accounts – not just paid-up bods – once you verify your phone number…

Posted on by

Zoom today said it will make end-to-end (E2E) encryption available to all of its users, regardless of whether they pay for it or not.

The videoconferencing overnight-sensation has walked back its initial plan to limit E2E cryptography to schools and paid-for accounts, after facing a storm of criticism for the restriction. It will, from next month, offer strong E2E encryption (E2EE) as a beta to any free account holder willing to hand over their contact number, as well as offering it to enterprise customers. We note that Google Meet and other rival services do not offer E2EE.

“Today, Zoom released an updated E2EE design on GitHub,” Zoom CEO Eric Yuan said. “We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform.

“This will enable us to offer E2EE as an advanced add-on feature for all of our users around the globe – free and paid – while maintaining the ability to prevent and fight abuse on our platform.”

It should be noted that Zoom already encrypts call in transit with AES-256-GCM cryptography, but that isn’t truly end-to-end: E2EE ensures only the meeting participants, and no one else, can encrypt and decrypt the video, voice, and other data flowing between them during a confab. Zoom points out that that this encryption won’t work on PTSN phone lines. This also excludes SIP/H.323 commercial conferencing gear.

Earlier this year, Yuan argued that Zoom couldn’t protect free calls with E2EE because to do so would thwart important law enforcement operations.

“Free users, for sure, we don’t want to give that because we also want to work together with FBI, with local law enforcement in case some people use Zoom for a bad purpose,” Yuan told analysts back in April.

In May, Zoom asked for help from digital rights groups who, apparently, told them to stop messing about and give people encrypted calls, law enforcement concerns be damned.

“Since releasing the draft design of Zoom’s end-to-end encryption (E2EE) on May 22, we have engaged with civil liberties organizations, our CISO council, child safety advocates, encryption experts, government representatives, our own users, and others to gather their feedback on this feature,” Yuan said today.

To satisfy the legal issues and requirements, Zoom is asking users to verify their phone numbers by entering a single-use code delivered via text message. “Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts,” Yuan said. “We are confident that by implementing risk-based authentication, in combination with our current mix of tools — including our Report a User function — we can continue to prevent and fight abuse.”

Needless to say, Zoom has taken no shortage of heat for its handling of security issues since the coronavirus lockdown made the service a household name and brought the upstart under scrutiny.

In response, Zoom moved to bring in the likes of ex-Yahoo! and Facebook CSO Alex Stamos and Luta Security and its founder Katie Mousourris to get its protections up to snuff.

Source: Zoom will offer proper end-to-end encryption to free vid-chat accounts – not just paid-up bods – once you verify your phone number… • The Register

Steris, Medical Device Maker Threatens iFixit Over Ventilator Repair Project, publishing manuals

Posted on by

A popular website with a comprehensive database of repair manuals for ventilators and other medical devices has received a letter from a medical equipment company saying that its copyrights are being infringed.

Kyle Wiens, CEO of the repair website iFixit—which posts guides on how to repair anything from sewing machines to video game consoles—shared the letter on Twitter Thursday, sent to him by counsel for Steris Corporation, which makes sterilization and other medical equipment.

“It has come to my attention that you have been reproducing certain installation and maintenance manuals relating to our products, documentation which is protected by copyright law,” the letter said. The letter then went on to tell Wiens to remove all Steris copyrighted material from the iFixit website within 10 days of the letter.

As Motherboard reported in March, major manufacturers of medical devices have long made it difficult for their devices to be repaired through third party repair professionals. Manufacturers have often lobbied against right to repair legislation and many medical devices are controlled by artificial “software locks” that allow only those with authorization to make modifications.

As reported by VICE News last week, a repair technician contracted to repair ventilators for hospitals preparing for COVID-19 said he has struggled to get repair parts or manuals from manufacturers when he has made requests to them.

“I’m disappointed that Steris is resorting to legal threats to stop hospitals from having access to information about how to maintain critical sterilization equipment during a pandemic,” Wiens told Motherboard in an email.

Wiens said he got the idea to post service manuals for medical equipment on iFixit when he began seeing stories about ventilator shortages in Italy. When he saw how some people were using 3-D printers to create ventilator replacement valves, he said he was inspired to create the database of medical equipment guides as a way to help.

“No manufacturer should be stopping hospitals from repairing their equipment,” Wiens said. “The best way to ensure patient safety is to make sure that equipment is being maintained regularly using the manufacturer’s recommended procedures. The only way to do that is if hospitals have up to date manuals.”

With regards to the letter sent by Steris, Wiens said iFixit has not removed any material from its website.

“We explained to Steris that what we did is a lawful and protected fair use under the U.S. Copyright act,” Wiens said.

“iFixit is protected by Section 512 of the Digital Millennium Copyright Act, which allows online platforms to host content contributed by users provided they comply with the Act’s requirements, which iFixit does,” a letter to Steris from the Electronic Frontier Foundation on behalf of iFixit said.

Source: A Medical Device Maker Threatens iFixit Over Ventilator Repair Project – VICE

Researchers taught a robot to suture by showing it surgery videos

Posted on by

Stitching a patient back together after surgery is a vital but monotonous task for medics, often requiring them to repeat the same simple movements over and over hundreds of times. But thanks to a collaborative effort between Intel and the University of California, Berkeley, tomorrow’s surgeons could offload that grunt work to robots — like a macro, but for automated suturing.

The UC Berkeley team, led by Dr. Ajay Tanwani, has developed a semi-supervised AI deep-learning system, dubbed Motion2Vec. This system is designed to watch publically surgical videos performed by actual doctors, break down the medic’s movements when suturing (needle insertion, extraction and hand-off) and then mimic them with a high degree of accuracy.

“There’s a lot of appeal in learning from visual observations, compared to traditional interfaces for learning in a static way or learning from [mimicking] trajectories, because of the huge amount of information content available in existing videos,” Tanwani told Engadget. When it comes to teaching robots, a picture, apparently, is worth a thousand words.

“YouTube gets 500 hours of new material every minute. It’s an incredible repository, dataset,” Dr. Ken Goldberg, who runs the UC Berkeley lab and advised Tanwani’s team on this study, added. “Any human can watch almost any one of those videos and make sense of it, but a robot currently cannot — they just see it as a stream of pixels. So the goal of this work is to try and make sense of those pixels. That is to look at the video, analyze it, and… be able to segment the videos into meaningful sequences.”

To do this, the team leveraged a siamese network to train its AI. Siamese networks are built to learn the distance functions from unsupervised or weakly-supervised data, Tanwani explained. “The idea here is that you want to produce the high amount of data that is in recombinant videos and compress it into a low dimensional manifold,” he said. “Siamese networks are used to learn the distance functions within this manifold.”

Basically, these networks can rank the degree of similarity between two inputs, which is why they’re often used for image recognition tasks like matching surveillance footage of a person with their drivers license photo. In this case, however, the team is using the network to match the video input of what the manipulator arms are doing with the existing video of a human doctor making the same motions. The goal here being to raise the robot’s performance to near-human levels.

And since the system relies on a semi-supervised learning structure, the team needed just 78 videos from the JIGSAWS database to train their AI to perform its task with 85.5 percent segmentation accuracy and an average 0.94 centimeter error in targeting accuracy.

It’s going to be years before these sorts of technologies make their way to actual operating theaters but Tanwani believes that once they do, surgical AIs will act much like Driver Assist does on today’s semi-autonomous cars. They won’t replace human surgeons so much as augment their performance by taking over low-level, repetitive tasks. The Motion2Vec system isn’t just for suturing. Given proper training data, the AI could eventually be tasked with any of a number of duties, such as debridement (picking dead flesh and debris from a wound), but don’t expect it to perform your next appendectomy.

“We’re not there yet, but what we’re moving towards is the ability for a surgeon, who would be watching the system, indicate where they want a row of sutures, convey that they want six overhand sutures,” Goldberg said. “Then the robot would essentially start doing that and the surgeon would… be able to relax a little bit so that they could then be more rested and able to focus on more complex or nuanced parts of the surgery.”

“We believe that would help the surgeons productively focus their time in performing more complicated tasks,” Tanwani added, “and use technology to assist them in taking care of the mundane routine.”

Source: Researchers taught a robot to suture by showing it surgery videos | Engadget

‘DeepFaceDrawing’ AI can turn simple sketches into detailed photo portraits

Posted on by

Researchers have found a way to turn simple line drawings into photo-realistic facial images. Developed by a team at the Chinese Academy of Sciences in Beijing, DeepFaceDrawing uses artificial intelligence to help “users with little training in drawing to produce high-quality images from rough or even incomplete freehand sketches.”

This isn’t the first time we’ve seen tech like this (remember the horrifying results of Pix2Pix’s autofill tool?), but it is certainly the most advanced to date, and it doesn’t require the same level of detail in source sketches as previous iterations have. It works largely through probability — instead of requiring detailed eyelid or lip shapes, for example, the software refers to a database of faces and facial components, and considers how each facial element works with each other. Eyes, nose, mouth, face shape and hair type are all considered separately, and then assembled into a single image.

As the paper explains, “Recent deep image-to-image translation techniques allow fast generation of face images from freehand sketches. However, existing solutions tend to overfit to sketches, thus requiring professional sketches or even edge maps as input. To address this issue, our key idea is to implicitly model the shape space of plausible face images and synthesize a face image in this space to approximate an input sketch. Our method essentially uses input sketches as soft constraints and is thus able to produce high-quality face images even from rough and/or incomplete sketches.”

It’s not clear how the software will handle race. Of the 17,000 sketches and their corresponding photos created so far, the majority have been Caucasian and South American faces. This could be a result of the source data (bias is an ongoing problem in the world of AI), or down to the complexity of face shapes — the researchers don’t provide any further details.

In any case, the technology is due to go on show at this year’s (virtual) SIGGRAPH conference in July. According to the project’s website, code for the software is “coming soon,” which suggests we could see its application in the wild in the coming months — not only as a fun app to play around with, but also potentially in law enforcement, helping to rapidly generate images of suspects.

Source: ‘DeepFaceDrawing’ AI can turn simple sketches into detailed photo portraits | Engadget

Super secretive Russian disinfo operation discovered dating back to 2014

Posted on by

Social media research group Graphika published today a 120-page report [PDF] unmasking a new Russian information operation of which very little has been known so far.

Codenamed Secondary Infektion, the group is different from the Internet Research Agency (IRA), the Sankt Petersburg company (troll farm) that has interfered in the US 2016 presidential election.

Graphika says this new and separate group has been operating since 2014 and has been relying on fake news articles, fake leaks, and forged documents to generate political scandals in countries across Europe and North America.

The research team says it  first learned of the group from reports published by Reddit and Facebook last year, along with previous research done by the Atlantic Council’s Digital Forensic Research Lab.

Graphika says that based on previous research, they’ve now tracked down more than 2,500 pieces of content the Secondary group Infektion has posted online since early 2014.

graphika-timeline.png
Image: Graphika

According to Graphika’s analysis, most of the group’s content has followed nine primary themes:

  • Ukraine as a failed state or unreliable partner
  • The United States and NATO as aggressive and interfering in other countries
  • Europe as weak and divided
  • Critics of the Russian government as morally corrupt, alcoholic, or otherwise mentally unstable
  • Muslims as aggressive invaders
  • The Russian government as the victim of Western hypocrisy or plots
  • Western elections as rigged and candidates who criticized the Kremlin as unelectable
  • Turkey as an aggressive and destabilizing state
  • World sporting bodies and competitions as unfair, unprofessional, and Russophobic

Graphika says that most of this content has been aimed at attacking classic Russian political rivals like Ukraine, the US, Poland, and Germany, but also other countries where Russian influence came under attack, at one point or another.

Graphika said the group didn’t publish only in English, but also adapted to each target and published content in its local language. In total, researchers found content posted in seven languages.

graphika-articles-per-country.jpg
Image: Graphika

Unlike the IRA, which was primarily focused on creating division at the level of regular citizens, Secondary Infektion’s primary role appears to been to influence decisions at the highest level of foreign governments.

This was done by attempting to influence political decisions by creating fake narratives, pitting Western countries against each other, and by embarrassing anti-Russian politicians using fake articles and forged documents.

“The ‘leaks’ typically exposed some dramatic geopolitical scandal, such as a prominent Kremlin critic’s corrupt dealings or secret American plans to overthrow pro-Kremlin governments around the world,” the Graphika team said today.

The group had operations going during the US presidential elections in 2016, the French elections in 2017, and in Sweden in 2018, but election interferene was never the group’s primary target.

Graphika said the group “aimed to exacerbate divisions between countries, trying to set Poles against Germans, Germans against Americans, Americans against Britons, and absolutely everyone against Ukrainians.”

Secondary Infektion liked blogs more than social media

Furthermore, another way in which Secondary Infektion differed from the more well-known IRA was that while the IRA was mostly active on social media networks, the Secodanry Infektion gang had a broader reach, with a lot of its content being published on blogs and news  sites.

Graphika said it found content published on more than 300 platforms, from social media giants such as Facebook, Twitter, YouTube, and Reddit to blogging platforms like WordPress and Medium, but also niche discussion forums in Pakistan and Australia.

graphika-platforms.png
Image: Graphika

Graphika researchers also said Secondary Infektion was more advanced than the IRA. Unlike the sloppy IRA operators who were easily traced back to an exact building in Sankt Petersburg, Russia, the mystery about Secondary Infektion’s real identity remains unsolved.

“[Secondary Infektion’s] identity is the single most pressing question to emerge from this study,” the Graphika team wrote in its report today.

Researchers said the group managed to keep its identity secret because they paid very close attention to operational security (OpSec). Graphika says Secondary Infektion agents employed single-use burner accounts for almost everything they posted online, abandoning each account in less than an hour after promoting their content.

This approach has made it more difficult for the group to build a dedicated audience but has allowed it to orchestrate high-impact operations for years, without giving away their infrastructure, modus operandi, and goals.

With its identity still a secret, the group is expected to continue operating and sowing conflict between Russia’s rivals.

Source: Super secretive Russian disinfo operation discovered dating back to 2014 | ZDNet

From the crew behind the Sony Pictures hack comes Operation Interception: An aerospace cyber-attack thriller

Posted on by

Threat intel researchers have uncovered a phishing and malware campaign that targeted “a large European aerospace company” and which was run by the same North Koreans behind the hack of Sony Pictures.

While there are quite a few European aerospace firms, Slovakian infosec biz ESET was more concerned with the phishing ‘n’ malware campaign it detected on behalf of its unnamed client.

Branded “Operation Interception” by ESET, the researchers claimed the “highly targeted cyberattacks” were being spread by North Korean baddies Lazarus Group, who were behind the 2014 hack of Sony’s American entertainment business.

The threat group’s latest detected campaign involved targeting aerospace folk via LinkedIn, said the infoseccers. ESET researcher Jean-Ian Boutin explained: “In our case they were impersonating Collins Aerospace and General Dynamics (GD), two organisations in the same vertical as the targeted European organisations,”. He said the Norks were targeting people who worked in “sales, marketing, tech, general admin” roles.

Collins and GD are two of the bigger names in North American aerospace; among other things, Collins makes avionic instruments and software while GD has fingers in pies ranging from the F-16 fighter jet through Gulfstream corporate aircraft, US Navy submarines and armoured vehicles. As bait dangled before honest people hoping to take a major step forwards in an aerospace career, these two companies were tempting lures.

“The [job] offer seemed too good to be true,” said Boutin as he explained the Lazarus ruse to The Reg. “Maybe [the recipient’s] career could take off in a big way?”

Once into a target’s network the criminals would try to brute-force any Active Directory admin accounts they could find, as well as exfiltrate data by bundling it into a RAR archive and trying to upload it to a Dropbox account.

After the victim had been suitably reeled in, Lazarus would try to induce them to download a password-protected RAR archive “containing a LNK file.” Once clicked, that LNK file appeared to the victim to download a PDF containing job information. In the background, however, it also downloaded a malicious EXE that created a bunch of folders and set a Windows scheduled task to run a remote script every so often.

ESET illustration showing the Lazarus Group attack progression

ESET illustration showing the Lazarus Group attack progression

The attackers were most insistent that the victim only respond to their job offer on a Windows machine running Internet Explorer. Once in, they resorted to PowerShell – taking advantage of the fact that “the logging of executed PowerShell commands is disabled by default,” although evidence was found that the Lazarus crew went through the connected domain to enumerate all Active Directory accounts before trying to brute-force their way into admin accounts.

To avoid Windows security features blocking their malware, Lazarus also signed their code using a certificate first issued to 16:20 Software LLC, an American firm said by ESET to have been incorporated in May 2010.

Among other clues linking the malware’s components back to North Korea, Boutin said his team had seen build timestamps “added by the compiler showing when the executable was compiled” which neatly cross-referenced with normal office hours for East Asia. Corroborating that were some “host fingerprinting” techniques which uncovered various digital fragments “similar to backdoors the Lazarus Group is known to use,” as Boutin put it.

What made the lure so sneaky was the fact it was targeting potential jobseekers looking to leave their current employer, a fact that Boutin speculated may have made some victims less likely to report it to their current employer’s cybersecurity teams.

Lazarus Group was last seen in public after it was caught sniffing around macOS with a trojan targeting users of Apple’s desktop operating system. ®

Source: From the crew behind the Sony Pictures hack comes Operation Interception: An aerospace cyber-attack thriller

Flushing toilets create clouds of virus-containing particles

Posted on by

Researchers used a computer simulation to show how a flushing toilet can create a cloud of virus-containing aerosol droplets that is large and widespread and lasts long enough that the droplets could be breathed in by others.

With recent studies showing the novel coronavirus that causes COVID-19 can survive in the human digestive tract and show up in feces of the infected, this raises the possibility the disease could be transmitted with the use of toilets.

Toilet flushing creates a great deal of turbulence, and qualitative evidence suggests this can spread both bacteria and viruses. The public, however, remains largely unaware of this infection pathway, since few quantitative studies have been carried out to investigate this possible mechanism.

In the journal Physics of Fluids, precise computer models were used to simulate water and air flows in a flushing and the resulting droplet cloud. The investigators used a standard set of fluid dynamic formulas, known as the Navier-Stokes equations, to simulate flushing in two types of toilet—one with a single inlet for flushing water, and another with two inlets to create a rotating flow.

The investigators also used a discrete phase model to simulate movement of the numerous tiny likely to be ejected from the toilet bowl into the air. A similar model was used recently to simulate the movement of aerosol droplets ejected during a human cough.

The results of the simulations were striking.

As water pours into the toilet bowl from one side, it strikes the opposite side, creating vortices. These vortices continue upward into the air above the bowl, carrying droplets to a height of nearly 3 feet, where they might be inhaled or settle onto surfaces. These droplets are so small they float in the air for over a minute. A toilet with two inlet ports for water generates an even greater velocity of upward flowing aerosol particles.

“One can foresee that the velocity will be even higher when a toilet is used frequently, such as in the case of a family toilet during a busy time or a public toilet serving a densely populated area,” said co-author Ji-Xiang Wang, of Yangzhou University.

The simulations show that nearly 60% of the ejected particles rise high above the seat for a toilet with two inlet ports. A solution to this deadly problem is to simply close the lid before flushing, since this should decrease aerosol spread.

However, in many countries, including the United States, toilets in are often without lids. This poses a serious hazard. The investigators also suggest a better toilet design would include a lid that closes automatically before flushing.

Source: Flushing toilets create clouds of virus-containing particles

More information: “Can a toilet promote virus transmission? From a fluid dynamics perspective,” Physics of Fluids, aip.scitation.org/doi/10.1063/5.0013318

Journal information: Physics of Fluids

Researchers Have Created a Tool That Can Perfectly Depixelate Faces

Posted on by

The typical approach to increasing the resolution of an image is to start with the low-res version and use intelligent algorithms to predict and add additional details and pixels in order to artificially generate a high-res version. But because a low-res version of an image can lack significant details, fine features are often lost in the process, resulting in, particularly with faces, an overly soft and smoothed out appearance in the results lacking fine details. The approach a team of researchers from Duke University has developed, called Pulse (Photo Upsampling via Latent Space Exploration), tackles the problem in an entirely different way by taking advantage of the startling progress made with machine learning in recent years.

The Pulse research team from Duke University demonstrating the results (the lower row of headshots) of Pulse processing a low-res image (the middle row of headshots) compared to the original (the top row of headshots) high-res photos.
The Pulse research team from Duke University demonstrating the results (the lower row of headshots) of Pulse processing a low-res image (the middle row of headshots) compared to the original (the top row of headshots) high-res photos.
Photo: Duke University

Pulse starts with a low-res image, but it doesn’t work with or process it directly. It instead uses it as a target reference for an AI-based face generator that relies on generative adversarial networks to randomly create realistic headshots. We’ve seen these tools used before in videos where thousands of non-existent but lifelike headshots are generated, but in this case, after the faces are created, they’re downsized to the resolution of the original low-res reference and compared it against it, looking for a match. It seems like an entirely random process that would take decades to find a high-res face that matches the original sample when it’s shrunk, but the process is able to quickly find a close comparison and then gradually tweak and adjust it until it produces a down-sampled result that matches the original low-res sample.

Source: Researchers Have Created a Tool That Can Perfectly Depixelate Faces

T-Mobile US outage finally ends after more than twelve hours (updated)

Posted on by

T-Mobile’s network is having an issue with voice and data service. There was a huge spike in outage reports on Down Detector starting at around 1 PM ET today, with many people across the US suggesting on that site and Twitter that they’re having problems. By around 3:30 PM ET, Down Detector had collected more than 82,000 outage reports.

Some people are unable to make or receive calls, but Wi-Fi calling still seems to work (in case you’re wondering why you can still call someone else from a T-Mobile phone right now). There are problems with data service too. T-Mobile’s president of technology Neville Ray confirmed the issue and said the company’s engineers are working to resolve them:

Source: T-Mobile outage finally ends after more than twelve hours (updated) | Engadget

Apple Pay and the App Store are under EU antitrust investigation

Posted on by

The European Commission has launched two separate antitrust investigations into Apple, focused on the App Store and Apple Pay.

The executive branch of the European Union said it would consider App Store rules that force developers to use its own payment and in-app purchase system. In a press release, the Commission referenced a complaint filed by Spotify more than a year ago. At the time, CEO and founder Daniel Ek argued that the 30 percent cut that Apple takes on all transactions — including in-app purchases, which includes Free to Premium Spotify conversions — meant that it would have to raise its prices beyond those offered by Apple Music.

“To keep our price competitive for our customers, that isn’t something we can do,” he explained in a blog post. Of course, it’s possible for Spotify users to upgrade their account on a different platform, including the web. But if you try to sidestep Apple’s payment system, the company will limit your marketing and communications with customers, Elk argued. “In some cases, we aren’t even allowed to send emails to our customers who use Apple,” he wrote. “Apple also routinely blocks our experience-enhancing upgrades. Over time, this has included locking Spotify and other competitors out of Apple services such as Siri, HomePod, and Apple Watch.”

The Commission said it had completed a “preliminary investigation” and found “concerns” that discouraged competition against Apple’s own services. “Apple’s competitors have either decided to disable the in-app subscription possibility altogether or have raised their subscription prices in the app and passed on Apple’s fee to consumers,” the executive branch explained in its press release. “In both cases, they were not allowed to inform users about alternative subscription possibilities outside of the app.”

[…]

The second antitrust investigation will look at Apple Pay, which is effectively the only mobile payments solution available to iPhone and iPad users.

Following a preliminary investigation, the Commission has “concerns” that the situation is stifling competition and reducing consumer choice on the platform. Vestager noted that mobile payments will likely increase even further as European citizens looks to minimize physical contact with physical money and store clerks.

“It is important that Apple’s measures do not deny consumers the benefits of new payment technologies, including better choice, quality, innovation and competitive prices,” she argued. “I have therefore decided to take a close look at Apple’s practices regarding Apple Pay and their impact on competition.”

Source: Apple Pay and the App Store are under EU antitrust investigation | Engadget

845GB of racy dating app records exposed to entire internet via leaky AWS buckets

Posted on by

Hundreds of thousands of sensitive dating app profiles – including images of “a graphic, sexual nature” – were exposed online for anyone stumbling across them to download.

Word of the uncontrolled emission burst forth from vpnMentor this week, which claims it found a misconfigured AWS S3 bucket containing 845GB of private dating app records.

Data exposed included photos, many of a graphic, sexual nature; private chats and details of financial transactions; audio recordings; and limited personally identifiable information, the biz stated, adding that it thinks it found sufficient data to blackmail people.

“Aside from exposing potentially millions of users of the apps to danger, the breach also exposed the various apps’ entire AWS infrastructure through unsecured admin credentials and passwords,” vpnMentor’s researchers wrote.

The haul is estimated to contain hundreds of thousands of users’ data, all exposed to the public internet without any authentication. We note vpnMentor thinks this figure could be in the millions.

The storage silo was used by nine rather niche dating apps, including SugarD, which connects sugar daddies with sugar babies, whom they financially support with gifts and cash. Gay Daddy Bear, which targets plus-sized, hairy gay men, was also exposed, we’re told. Data from the-self-explanatory-but-puzzling-in-other-ways Herpes Dating was also revealed.

Just who built the apps and made the fateful decision to misconfigure the buckets is not known, though vpnMentor suspects the nine services share a common developer. Whoever is to blame, they ignored the regular warnings Amazon Web Services sends to S3 customers regarding controlling and limiting access to cloud-hosted data.

Users of the apps can take some small comfort from the fact the buckets were taken offline on 27 May, a day after the researchers informed one of the websites about the risk of unauthorized access

Source: 845GB of racy dating app records exposed to entire internet via leaky AWS buckets • The Register

Polish President Says LGBT ‘Ideology’ Worse Than Communism

Posted on by

Polish President Andrzej Duda accused the LGBT rights movement Saturday of promoting a viewpoint more harmful than communism and said he agreed with another conservative politician who stated that “LGBT is not people, it’s an ideology.”

Duda made his comments in the small southwestern town of Brzeg as he campaigns for reelection in Poland, a predominantly Catholic nation that spent more than four decades under communist governments.

Gay rights is emerging as a key campaign theme in the presidential election as the race grows close between Duda, backed by the nationalist conservative ruling party, and Warsaw Mayor Rafal Trzaskowski, who has called for tolerance for gays and lesbians.

Duda, who is 48, told his supporters that his parents’ generation did not struggle to cast off communism only to now accept “an ideology” that he thinks “is even more destructive to the human being.”

The president said that during Poland’s communist era, regimes ensured survival by indoctrinating the youngest generation.

“That was Bolshevism. It was the ideologizing of children,” he said. “Today, there are also attempts to push an ideology on us and our children, but different. It’s totally new, but it is also neo-Bolshevism.”

Earlier in the week, Duda signed a declaration drafted for the stated purpose of helping families that included language on “protecting children from LGBT ideology” with a ban on “propagating LGBT ideology in public institutions.”

Many conservative politicians in Poland say they are not against gay men and lesbians as individuals, but insist they oppose the goals of a civil rights movement they claim is imported from abroad and threatens to sexualize young people.

But gay and lesbian Poles and liberal Poles say government officials are adopting a language of dehumanization. They believe Duda and others are targeting homosexuals to curry favor with the powerful Catholic church — which faces allegations of covering up clerical abuse — and shore up support among conservative voters ahead of the election.

Some analysts also suspect that Duda and the governing Law and Justice party are making a bid for far-right voters who will mostly support the candidate of a smaller party, Confederation, in the election’s first round but whose votes will be up for grabs in a runoff.

Source: Polish President Says LGBT ‘Ideology’ Worse Than Communism | Time

Trillions of Words Analyzed, OpenAI Sets Loose AI Language Colossus – The API

Posted on by

Over the past few months, OpenAI has vacuumed an incredible amount of data into its artificial intelligence language systems. It sucked up Wikipedia, a huge swath of the rest of the internet and tons of books. This mass of text – trillions of words – was then analyzed and manipulated by a supercomputer to create what the research group bills as a major AI breakthrough and the heart of its first commercial product, which came out on Thursday.

The product name — OpenAI calls it “the API” — might not be magical, but the things it can accomplish do seem to border on wizardry at times. The software can perform a broad set of language tasks, including translating between languages, writing news stories and poems and answering everyday questions. Ask it, for example, if you should keep reading a story, and you might be told, “Definitely. The twists and turns keep coming.”

OpenAI wants to build the most flexible, general purpose AI language system of all time. Typically, companies and researchers will tune their AI systems to handle one, limited task. The API, by contrast, can crank away at a broad set of jobs and, in many cases, at levels comparable with specialized systems. While the product is in a limited test phase right now, it will be released broadly as something that other companies can use at the heart of their own offerings such as customer support chat systems, education products or games, OpenAI Chief Executive Officer Sam Altman said.

[…]

Software developers can begin training the AI system just by showing it a few examples of what they want the code to do. If you ask it a number of questions in a row, for example, the system starts to sense it’s in question-and-answer mode and tweaks its responses accordingly. There are also tools that let you alter how literal or creative you want the AI to be.

But even a layperson – i.e. this reporter – can use the product. You can simply type text into a box, hit a button and get responses. Drop a couple paragraphs of a news story into the API, and it will try to complete the piece with results that vary from I-kinda-fear-for-my-job good to this-computer-might-be-on-drugs bad.

Source: Trillions of Words Analyzed, OpenAI Sets Loose AI Language Colossus – Bloomberg

Amazon Set to Face Antitrust Charges in European Union

Posted on by

European Union officials are preparing to bring antitrust charges against Amazon for abusing its dominance in internet commerce to box out smaller rivals, according to people with knowledge of the case.

Nearly two years in the making, the case is one of the most aggressive attempts by a government to crimp the power of the e-commerce giant, which has largely sidestepped regulation throughout its 26-year history.

The European Union regulators, who already have a reputation as the world’s most aggressive watchdogs of the technology industry, have determined that Amazon is stifling competition by unfairly using data collected from third-party merchants to boost its own product offerings, said the people, who spoke on the condition of anonymity because the deliberations were private.

The case against Amazon is part of a broader attempt in the United States and Europe to probe the business practices of the world’s largest technology companies, as authorities on both sides of the Atlantic see what they believe is a worrying concentration of power in the digital economy.

Margarethe Vestager, the European Commissioner who leads antitrust enforcement and digital policy, is also examining practices by Apple and Facebook. In Washington, the Justice Department, Federal Trade Commission and Congress are targeting Amazon, Apple, Facebook and Google.

William Kovacic, a law professor at George Washington University, said the tech industry was facing a “striking critical mass” of attention from governments around the world, including Australia, Brazil and India. He said that regulators in Brussels and Washington may deploy so-called interim measures against the companies, a rarely used tool that could force Amazon and other large tech platforms to halt certain practices while a case is litigated.

[…]

The case stems from Amazon’s treatment of third-party merchants who rely on its website to reach customers. Investigators have focused on Amazon’s dual role as both the owner of its online store and a seller of goods that compete with other sellers, creating a conflict of interest.

Authorities in Europe have concluded that Amazon abuses its position to give its own products preferential treatment. European officials have spent the past year interviewing merchants and others who depend on Amazon to better understand how it collects data to use to its advantage, including agreements that require them to share certain data with Amazon as a condition of selling goods on the platform.

Many merchants have complained that if they have a product that is selling well on Amazon, the company will then introduce its own product at a lower price, or give it more prominent placement on the website.

Source: Amazon Set to Face Antitrust Charges in European Union – The New York Times

So yeah, I had a talk about that in 2019

Internet Archive Ends Free Ebook Program Early due to money grubbing copyright enforcers suing them for being a library

Posted on by

Back in March, the Internet Archive launched its National Emergency Library, a program that made roughly 1.4 million books available to the public without the usual waitlists. But on Wednesday, the organization announced it was ending the program two weeks early after four major publishers decided to sue Internet Archive for copyright infringement.

Internet Archive explained in a blog post that after June 16, it would revert to a controlled digital lending model, in which libraries lend patrons digitized copies of a physical book one at a time. “We moved up our schedule because, last Monday, four commercial publishers chose to sue Internet Archive during a global pandemic,” the non-profit said. “However, this lawsuit is not just about the temporary National Emergency Library. The complaint attacks the concept of any library owning and lending digital books, challenging the very idea of what a library is in the digital world.”

By eliminating waitlists, the National Emergency Library program effectively upended how publishers have thus far controlled how libraries distribute ebooks. Under the usual system, publishers sell two-year licenses that cost several times more than what you’d pay if you just bought the book outright. Internet Archive’s program basically made it so any number of people could temporarily download a single ebook an infinite number of times between March 24 and June 30, the original end date for the program.

In their complaint, Hachette, HarperCollins, Penguin Random House, and John Wiley & Sons allege that in addition to violating copyrights, Internet Archive’s free ebook program “grossly exceed legitimate library services” and “constitute willful digital piracy on an industrial scale.”

Before blasting Internet Archive for capitulating, this lawsuit has the ability to tank the organization—probably best known for its Wayback Machine web archiving tool—for good. Publishers could claim up to $150,000 in damages per title. When you multiply that by the 1.4 million works Internet Archive put up for free, the final number could be astronomical, and well beyond the nonprofit’s ability to pay. A win for publishers would put Internet Archive’s other projects at risk.

It appears that publishers aren’t just after Internet Archive’s temporary free ebook initiative. The complaint also contends that controlled digital lending is an “invented theory” and that its rules “have been concocted from whole cloth and continue to get worse.” It also contends that Internet Archive’s “one-to-one conflation of print and ebooks is fundamentally flawed.” Controlled digital lending, however, isn’t unique to Internet Archive. It’s a framework that’s been supported by several libraries over the years, including many university libraries like UC Berkeley Library. Publishers winning this lawsuit may potentially also put the kibosh on the entire controlled digital lending model.

It’s clear that Internet Archive’s decision was intended to appease publishers into dropping the suit. According to Internet Archive, some academic publishers who were initially displeased with the National Emergency Library eventually came around. That said, it’s unclear whether commercial publishers would do the same, as they have everything to gain by strengthening their hold over ebook copyrights.

Source: Internet Archive Ends Free Ebook Program Early

Spies Can Eavesdrop by Watching a Light Bulb’s Vibrations

Posted on by

The list of sophisticated eavesdropping techniques has grown steadily over years: wiretaps, hacked phones, bugs in the wall—even bouncing lasers off of a building’s glass to pick up conversations inside. Now add another tool for audio spies: Any light bulb in a room that might be visible from a window.

Researchers from Israeli’s Ben-Gurion University of the Negev and the Weizmann Institute of Science today revealed a new technique for long-distance eavesdropping they call “lamphone.” They say it allows anyone with a laptop and less than a thousand dollars of equipment—just a telescope and a $400 electro-optical sensor—to listen in on any sounds in a room that’s hundreds of feet away in real-time, simply by observing the minuscule vibrations those sounds create on the glass surface of a light bulb inside. By measuring the tiny changes in light output from the bulb that those vibrations cause, the researchers show that a spy can pick up sound clearly enough to discern the contents of conversations or even recognize a piece of music.

“Any sound in the room can be recovered from the room with no requirement to hack anything and no device in the room,” says Ben Nassi, a security researcher at Ben-Gurion who developed the technique with fellow researchers Yaron Pirutin and Boris Zadov, and who plans to present their findings at the Black Hat security conference in August. “You just need line of sight to a hanging bulb, and this is it.”

In their experiments, the researchers placed a series of telescopes around 80 feet away from a target office’s light bulb, and put each telescope’s eyepiece in front of a Thorlabs PDA100A2 electro-optical sensor. They then used an analog-to-digital converter to convert the electrical signals from that sensor to digital information. While they played music and speech recordings in the faraway room, they fed the information picked up by their set-up to a laptop, which analyzed the readings.

side by side images of telescope pointing to window and aerial of bridge
The researchers’ experimental setup, with an electro-optical sensor behind the eyepiece of a telescope, pointing at a lightbulb inside an office building more than 80 feet away.Courtesy of Ben Nassi

The researchers found that the tiny vibrations of the light bulb in response to sound—movements that they measured at as little as a few hundred microns—registered as a measurable changes in the light their sensor picked up through each telescope. After processing the signal through software to filter out noise, they were able to reconstruct recordings of the sounds inside the room with remarkable fidelity: They showed, for instance, that they could reproduce an audible snippet of a speech from President Donald Trump well enough for it to be transcribed by Google’s Cloud Speech API. They also generated a recording of the Beatles’ “Let It Be” clear enough that the name-that-tune app Shazam could instantly recognize it.

The technique nonetheless has some limitations. In their tests, the researchers used a hanging bulb, and it’s not clear if a bulb mounted in a fixed lamp or a ceiling fixture would vibrate enough to derive the same sort of audio signal. The voice and music recordings they used in their demonstrations were also louder than the average human conversation, with speakers turned to their maximum volume. But the team points out that they also used a relatively cheap electro-optical sensor and analog-to-digital converter, and could have upgraded to a more expensive one to pick up quieter conversations. LED bulbs also offer a signal-to-noise ratio that’s about 6.3 times that of an incandescent bulb and 70 times a fluorescent one.

Source: Spies Can Eavesdrop by Watching a Light Bulb’s Vibrations  | WIRED

Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it

Posted on by

Fed up with the DRM in a General Electric refrigerator that pushed the owner to buy expensive manufacturer-approved replacement water filters, an anonymous hacker went to the trouble of buying a domain name and setting up a website at gefiltergate.com to pen a screed about appliance digital rights restriction management (DRM) and how to bypass it.

The fridge in question required a GE RPWFE refrigerator water filter. It has an RFID chip, which the fridge uses to verify the authenticity of the part. The RPWFE filter costs much more than unapproved filters: about $50 compared to $13.

“Some ******* at GE thought it would be a good idea to include a ******* RFID DRM module in select refrigerators,” the unidentified individual wrote, without using the asterisks we’ve included because online profanity filters are awful.

The Register contacted GE to ask about this, and the American giant’s corporate communications director promptly replied that GE sold its appliance unit to China-based Haier in 2016, which continues to use its brand. Haier did not immediately respond to our inquiry.

The gefiltergate.com website, borrowing from a similar post on another website back in May, explains how to hack your Haier GE-brand fridge by affixing an RFID tag – stripped from a component for bypassing the water filter system – to the RFID sensor.

The GE website suggests that a water filter is a good idea to avoid exposure to unfiltered water and sediment, inadvertently offering a sad commentary on public water infrastructure and government funding priorities. It recommends its RFID water filter because the chip chats with the fridge to report leaks, and will shut off the water supply if a leak is detected.

But the appliance doesn’t require the RFID filter; fridge owners can use the bypass plug, and still get unfiltered water.

“Non-GE filters and counterfeit filters without this technology will not perform the same way in the event of a water leak,” the company’s website explains. “The refrigerator has the option to use a bypass plug should you not want to use a genuine GE Appliances water filter.”

That makes it sound as if fridge owners can use water filters from another vendor but that’s not the case – the bypass plug is just to silence the fridge display screen warnings coming from the filtration system’s RFID sensor. “The ID chip on the filter detects when a wrong or non-genuine GE Appliance part is used,” the GE Appliances website states. “If this happens, the dispenser will not work and the display may read ‘Leak Detected.'”

Hence the need to hack the fridge, which is something product owners evidently have been doing for years. The Amazon.com webpage for the bypass plug contains a string of user reviews indicating that customers only purchased the thing for its RFID chip. And complaints abound on discussion site Reddit.

In a phone interview with The Register, Gay Gordon-Byrne, executive director of The Repair Association, said product hacking of this sort is entirely legal, in America at least. The US Copyright Office, she said, included software-enabled appliance repair in its 2018 rulemaking [PDF], and patents are not an issue in this case. And the Magnuson-Moss Warranty Act guarantees that consumers can use parts not from the original manufacturer.

Asked whether such practices generate enough ill-will to make them unprofitable, Gordon-Byrne said they can, pointing to Keurig’s problems selling coffee makers with digital locks, but added that people have to be aware of the problem.

“It generates some ill will but not enough to offset the value of controlling the whole parts market,” she said. “But it’s a stupid, stupid thing to do. There’s no reason to do this.”

Right-to-repair legislation, which aims to ensure consumers have a legal right to repair products where product makers or laws deny that possibility, was being considered in about 20 US states last year. However, Gordon-Byrne said that progress has stalled due to the coronavirus outbreak. She expects repair bills will have to be reintroduced in January next year.

Current US Copyright Office exemptions, she said, should be renewed for 2021 and she expects to lobby for new exemptions for product categories where repairs that require breaking digital locks are still not allowed, like boats, medical equipment, and game consoles.

Source: Someone got so fed up with GE fridge DRM – yes, fridge DRM – they made a whole website on how to bypass it • The Register

Trump Administration Eliminates Transgender Health Protections

Posted on by

In an utterly heartless move, the Trump administration on Friday eliminated health care protections for transgender people during an ongoing global pandemic that has claimed more lives in the U.S. than in any other country.

It did this by finalizing a rule under Section 1557 of the Affordable Care Act (ACA), which prohibits health programs or activities from discriminating on the basis of race, color, national origin, sex, age, or disability. The Trump administration rule—announced on the fourth anniversary of the Pulse nightclub shooting and in the middle of Pride month—changes the definition of sex discrimination, eliminating protections due to gender identity, and considers the word “sex” to refer to “male or female and as determined by biology.”

[…]

The nondiscrimination provisions were established by the Obama administration in 2016. That year, the Obama administration issued a rule to implement Section 1557 that redefined sex discrimination to include gender identity, which it defined as, “an individual’s internal sense of gender, which may be male, female, neither, or a combination of male and female, and which may be different from an individual’s sex assigned at birth.”

Under the new rule, a transgender person could be refused care for a checkup at a doctor’s office, according to NPR. Other possible scenarios include a transgender man being denied treatment for ovarian cancer, or a hysterectomy not being covered by an insurer. Some experts say that the rule opens the door for medical providers to refuse to test someone for covid-19, the disease caused by the novel coronavirus, simply because they’re transgender.

When it comes to health insurance and health care, transgender people are vulnerable to being treated negatively by their insurance and health care providers. According to the (old broken link: 2015 U.S. Transgender Survey) 2015 US Transgender Survey (new link) carried out by the National Center for Transgender Equality, transgender people have been denied coverage for care related to their gender transition, for routine care because they were transgender, or for transition-related surgery.

The survey found that 23 percent of respondents reported not going to see a doctor when they needed to because of fear of being mistreated as a transgender person. Of those who did go see a healthcare provider, 33 percent reported that they had had at least one negative experience related to being transgender, such as being refused treatment, verbally harassed, or physically or sexually assaulted, among other horrible experiences.

Source: Trump Administration Eliminates Transgender Health Protections

So Trump is following in the illustrious footsteps of Hungary, whos president immediately used the emergency dictatorial powers bestowed upon him due to Covid to changes the “sex” category in official documents like birth certificates to “sex at birth,” which can never be changed.

Source: Hungary bans legal recognition of its transgender citizens

Tanvas Haptic Touch Screen

Posted on by

With touch screens getting more and more prevalent, we’re seeing more experimentation with haptics. Being able to feel something other than just the smooth glass surface can be incredibly advantageous. Have you been in a car with a touch screen radio system? If so you’ll know the frustration.

Tanvas is a system that adds haptics by changing the amount of adhesion your finger tip experiences on the screen. Basically, they’re increasing the friction in a controlled manner. The result is a distinct difference between various areas of the screen. To be clear, you’re not feeling ridges, edges, or other 3 dimensional items, but you can definitely feel where something exists and something does not.

The touch screen itself isn’t really a consumer product. This is a dev kit, so you could incorporate their tech into your projects. Admittedly, this is only appealing to a very narrow subset of our readership (those developing a product that uses a touch screen) but I felt the tech was very interesting and wanted to share. Personally, I’d love to see this technology employed in popular consumer devices such as iPads!

Source: Quick Look: Tanvas Haptic Touch Screen

Keepnet fires legal threats at bloggers for exposing their 876GB unsecured database with years of leaked credentials, backfires

Posted on by

UK-based infosec outfit Keepnet Labs left an 867GB database of previously compromised website login details accessible to world+dog earlier this year – then sent lawyers’ letters to bloggers in a bid to erase their reports of its blunder.

A contractor left the Keepnet Elasticsearch database unsecured back in March after disabling a firewall, exposing around five billion harvested records to the public internet, the firm admitted in a statement yesterday.

The database was indexed by a search engine, and came to the attention of noted infosec blogger Volodymyr “Bob” Diachenko, who wrote it all up. Keepnet disputed Diachenko’s initial characterisation of the breach, and things spiralled from there.

As reported by news website Verdict, Keepnet was stung by Diachenko’s initial post about the gaffe, which Keepnet interpreted as the blogger blaming the business for leaking its own customers’ data – none of its own clients’ data was exposed, but rather info from previous publicly known database exposures. Diachenko said the database contained email addresses, hashed passwords, the sources of the information, and other details, all gathered from previous leaks by hackers.

What actually happened, Keepnet later insisted, was that a contractor had screwed up by turning off a firewall. The 867GB database, claimed Keepnet, contained email addresses harvested from other data spillages that took place between 2013 and 2019.

“As part of the Keepnet Labs Solution, we provide a ‘compromised email credentials’ threat intelligence service. To provide this service, we are continuously collecting publicly known data-breach data from online public resources. We then store this data in our own secure Elasticsearch database and provide companies with the information relating to their business email domains via our Keepnet platform,” the firm insisted.

Nonetheless, Keepnet responded to the bloggerati by sending lawyers’ letters to all and sundry, demanding its name be removed from the posts about the prone Elasticsearch database. Unfortunately for Keepnet, one of those letters landed on the doormat of veteran infosec scribbler Graham Cluley. Not one to be cowed, Cluley removed the firm’s name from his blog post – then tweeted about it.

In a subsequent post about the kerfuffle, Cluley said: “I gave Keepnet Labs multiple opportunities to tell me what was incorrect in my article, or to offer me a public statement that I could include in the article. I told them I was keen to present the facts accurately.” This is best practice for bloggers and standard practice for reputable news organs.

El Reg has received its fair share of lawyers’ letters commissioned by red-faced company execs determined to disrupt and deter news reporting of their doings. The letter sent to Cluley (seen by The Register and screenshotted at the link just above) seemingly complained that Cluley had defamed the company. It called out words that weren’t actually in his blog post; cited part of an EU directive that has nothing to do with defamation law either in the political bloc or in the UK as justification; and threatened legal action, injunctions, costs and damages (£££) unless the entire blog post was deleted.

Whether the Elasticsearch database truly was exposed for just 10 minutes as Keepnet claimed, and whether those 10 minutes were long enough for it to be indexed, that index to be seeded through BinaryEdge, Diachenko to notice the new result, click around as required, download 2MB of it, inspect the download and then figure out who owned the database, is all moot. Keepnet’s actions after the discovery eclipsed the original screw-up completely.

An unrepentant Keepnet said in its statement: “We have been working over the past few months to get in contact with the authors of posts who have shared inaccurate aspects of this story and have politely asked them to update their articles,” which is a funny way of saying “hired a lawyer to threaten a defamation lawsuit unless the posts were deleted.” This was only ever going to produce one result, and not the one Keepnet wanted.

As Cluley put it: “Security firms should be examples for all businesses on how to behave after a security breach. Transparency, disclosure of what went wrong, and what steps are being taken to ensure that something similar doesn’t happen again are key to building trust and confidence from customers and the rest of the industry.”

For what it’s worth, El Reg didn’t cover the breach at the time it was first reported because, well, it involved public information becoming public again. It is to be hoped that Keepnet’s entirely self-inflicted reputational harm here teaches its founder a sharp and valuable lesson.

Keepnet did not respond last week when we asked the firm for comment.

Source: Keepnet kerfuffle: Firing legal threats at bloggers did infosec biz more damage than its exposed database • The Register

Planet’s SkySats zoom in for a closer look at the Earth, get 50cm per pixel granularity

Posted on by

The remote-sensing firm Planet operates more than one hundred satellites that constantly orbit the earth, collecting imagery of the world’s entire landmass each day. Now, to offer more clarity to its customers, it has flown a handful of its satellites 50 km closer to the Earth.

This literal zoom-in effort will allow the firm to offer imagery with a resolution of 50 cm of earth per pixel, an increase from 80 cm. In one example, that means that as well as seeing the shape of a car, analysts will also be able to clearly discern the position of its windshield.

By the end of the summer, the company plans to add six new satellites to its constellation, allowing it to take those higher resolution pictures of the same area twelve times a day.

“We felt like 50 centimeters was an important threshold, but where we are really pushing the envelope is on that revisit,” Jim Thomason, a Planet vice president, told Quartz.

The ability to view the same area repeatedly means customers will get their imagery sooner after they request it, and they may be able to see what is changing on the ground. That also means a higher chance of dodging the bane of optical space imagery: clouds.

Planet
A “before” image.
An “after” image. “Orthorectified” refers to the process where sensor data taken of uneven terrain is accurately mapped onto a flat image.

Planet was founded in 2010 by former NASA scientists who wanted to leverage new advances in satellite technology and expand access to space data. Its customers include US intelligence agencies, the NGOs that second-guess them, agricultural conglomerates, and firms that use machine learning to gain insight from remote-sensing data.

Planet operates more than 150 satellites, most of which are Doves, toaster-oven sized craft that collectively “scan” the earth each day, producing imagery with a resolution about three meters per pixel. You may have seen the company’s widely-shared image of a new mural in Washington, D.C.

Source: Planet’s SkySats zoom in for a closer look at the Earth — Quartz

Obscure Indian cyber firm spied on politicians, investors worldwide

Posted on by

New Delhi-based BellTroX InfoTech Services targeted government officials in Europe, gambling tycoons in the Bahamas, and well-known investors in the United States including private equity giant KKR and short seller Muddy Waters, according to three former employees, outside researchers, and a trail of online evidence.

Aspects of BellTroX’s hacking spree aimed at American targets are currently under investigation by U.S. law enforcement, five people familiar with the matter told Reuters. The U.S. Department of Justice declined to comment.

Reuters does not know the identity of BellTroX’s clients. In a telephone interview, the company’s owner, Sumit Gupta, declined to disclose who had hired him and denied any wrongdoing.

Muddy Waters founder Carson Block said he was “disappointed, but not surprised, to learn that we were likely targeted for hacking by a client of BellTroX.” KKR declined to comment.

Researchers at internet watchdog group Citizen Lab, who spent more than two years mapping out the infrastructure used by the hackers, released a report here on Tuesday saying they had “high confidence” that BellTroX employees were behind the espionage campaign.

“This is one of the largest spy-for-hire operations ever exposed,” said Citizen Lab researcher John Scott-Railton.

Although they receive a fraction of the attention devoted to state-sponsored espionage groups or headline-grabbing heists, “cyber mercenary” services are widely used, he said. “Our investigation found that no sector is immune.”

A cache of data reviewed by Reuters provides insight into the operation, detailing tens of thousands of malicious messages designed to trick victims into giving up their passwords that were sent by BellTroX between 2013 and 2020. The data was supplied on condition of anonymity by online service providers used by the hackers after Reuters alerted the firms to unusual patterns of activity on their platforms.

The data is effectively a digital hit list showing who was targeted and when. Reuters validated the data by checking it against emails received by the targets.

On the list: judges in South Africa, politicians in Mexico, lawyers in France and environmental groups in the United States. These dozens of people, among the thousands targeted by BellTroX, did not respond to messages or declined comment.

Reuters was not able to establish how many of the hacking attempts were successful.

BellTroX’s Gupta was charged in a 2015 hacking case in which two U.S. private investigators admitted to paying him to hack the accounts of marketing executives. Gupta was declared a fugitive in 2017, although the U.S. Justice Department declined to comment on the current status of the case or whether an extradition request had been issued.

Speaking by phone from his home in New Delhi, Gupta denied hacking and said he had never been contacted by law enforcement. He said he had only ever helped private investigators download messages from email inboxes after they provided him with login details.

Source: Exclusive: Obscure Indian cyber firm spied on politicians, investors worldwide – Reuters

Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers

Posted on by

Japanese car maker Honda has been hit by ransomware that disrupted its production of vehicles and also affected internal communications, according to reports.

The ransomware, of an as-yet unidentified strain, appeared to have spread through the multinational firm’s network. A Honda spokesman told the media it appeared to have “hit the company’s internal servers.”

Some Honda factories around the world were forced to suspend production, though output from Turkey, India, USA and Brazil locations remain on hold at the time of writing.

Sky News reported yesterday that Honda’s networks began to suffer “issues” on Monday, and that “the company believed it was the result of unauthorised attempts to breach its systems.”

A Honda spokesbeing told several outlets: “We can confirm some impact in Europe and are currently investigating the exact nature.”

Another statement from the firm today added: “Work is being undertaken to minimise the impact and to restore full functionality of production, sales and development activities.”

In the meantime, multiple researchers have suggested the culprit was Ekans, with one Milkr3am, posting screenshots on Twitter of a sample submitted to VirusTotal today that checks for the internal Honda network name of “mds.honda.com”.

Professor Alan Woodward of the University of Surrey told El Reg: “With a just-in-time system you need only a small outage in IT to cause a problem. As it happens I think Honda have recovered quite quickly. A few countries’ facilities are still affected but they seem to be coming back very fast, which suggests they had a good response plan in place.”

The speed at which the malware spread in Honda’s network indicates that some the company has centralised functions, “the usual culprits are finance,” he added.

Source: Hospital-busting hacker crew may be behind ransomware attack that made Honda halt car factories, say researchers • The Register

WhatsApp was exposing users’ phone numbers in Google search

Posted on by

WhatsApp claims it fixed an issue that was showing users’ phone numbers in Google search results, TechCrunch reports. The change comes after security researcher Athul Jayaram revealed that phone numbers of WhatsApp users who used the Click to Chat feature were being indexed in search.

Click to Chat allows users to create a link with their phone number in plain text. According to Jayaram, because the links don’t have a robot.txt file in the server root, they cannot stop Google or other search engine bots from crawling and indexing the links. Jayaram says as many as 300,000 phone numbers may have appeared in Google search results, and they could be found by searching “site:wa.me.”

As TechCrunch notes, Jayaram isn’t the first to report this issue. WaBetaInfo pointed it out in February. While the issue seems to be fixed, it’s a pretty big security flaw and apparently it’s been a problem for at least several months.

Source: WhatsApp was exposing users’ phone numbers in Google search | Engadget

From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work – and outside of US business hours

Posted on by

IBM’s cloud has gone down hard across the world.

We’d love to tell you just how hard the service has hit the dirt, but even the Big Blue status page is intermittently unavailable:

IBM cloud outage June 10 2020

IBM Cloud status page … Click to enlarge

Your humble hack has an IBM Cloud account, and when attempting to login in the hope that a customer-facing page could offer some information, he saw only the following error message:

IBM cloud outage login

Click to enlarge

IBM’s social feeds are silent on the outage at the time of writing.

One Australian IBM Cloud user told us that the outage has run for at least two hours, and means he is unable to deliver business services that customers depend on as they start their days. The breakdown is said to be global.

Clients are mad as hell because the blunder appears to have hit after business hours on the east coast of America, and IBM has not been responsive.

The Register has asked IBM to explain the outage, and we will update this story if and when more information becomes available. ®

Updated to add at 0020 UTC on June 10

The user we spoke to earlier tells us that their IBM-hosted services have come back to life. However, the IBM Cloud status page is still not working, and when this vulture tried to view it or to log on, this appeared…

IBM cloud outage continues

Your cloud is important to us. If you’d like to know more, press refresh for an hour or more.

Final update at 0140 UTC on June 10

The IBM Cloud’s status page is live again, and users can log in once more.

The status page lists fifteen active events though offers almost no detail other than the admission that: “Technical teams are engaged and have identified a broad network incident that is impacting many cloud services.” That information appears in a notification titled “Watson Platform users are unable to access console or applications in all regions.”

Source: From off-prem to just off: IBM Cloud goes down planet-wide so hard even the status page didn’t work • The Register