US govt says Chinese duo hacked, stole blueprints from just about everyone and then extorted cash.

On Tuesday, the US Department of Justice charged two Chinese nationals with allegedly hacking hundreds of organizations and individuals in America and elsewhere to steal confidential corporate secrets on behalf of Beijing for more than a decade.

The pilfered files are said to be worth hundreds of millions of dollars, and in some cases, it is claimed, the pair tried to extort money out of their victims: pay up, or the trade secrets leak.

The targeted organizations are said to include a British AI and cancer research biz, an Australian defense contractor, a South Korean shipbuilder and engineering giant, German software makers, American pharmaceutical, software, and defense corporations, and the US Dept of Energy’s Hanford site.

Assistant Attorney General John Demers and other US officials held a press conference on Tuesday to unseal the 11-count indictment [PDF], returned by a grand jury on July 7, against Li Xiaoyu, 34, and Dong Jiazhi, 33.

“The campaign targeted intellectual property and confidential business information held by the private sector, including COVID-19-related treatment, testing, and vaccines,” said Demers in prepared remarks.

“The hackers also targeted the online accounts of non-governmental organizations and individual dissidents, clergy, and democratic and human rights activists in the United States, China, Hong Kong, and abroad.”

According to the indictment, Li and Dong, former classmates at an electrical engineering college in Chengdu, China, have been hacking into high tech manufacturing, civil, industrial, and medical engineering firms, software companies of all sorts, solar companies, and pharmaceuticals, among others, since 2009.

The US claims that the two accused worked both for themselves and with the backing of the Chinese government’s Ministry of State Security. This assistance included being supplied with zero-day vulnerabilities exploits to facilitate their intrusion.

But often their hacking sprees, it’s alleged, involved the exploitation of publicly known vulnerabilities. The accused hackers are said to have used a program called China Chopper to install web shells to execute commands on victims’ networks and exfiltrate documents. The duo also uploaded password-stealing malware, it is claimed.

The pilfered data, it’s claimed, was often packed up on the RAR archive files that were concealed through the use of innocuous file names and common file extensions like .jpg. The hackers are said to have frequently used the recycle bin on Windows machines to store and move files because administrators are less likely to look there.

Adding insult to injury

“The defendants stole hundreds of millions of dollars’ worth of trade secrets, intellectual property, and other valuable business information,” the indictment says.

“At least once, they returned to a victim from which they had stolen valuable source code to attempt an extortion – threatening to publish on the internet, and thereby destroy the value of, the victim’s intellectual property unless a ransom was paid.”

The indictment also accuses the pair of providing Chinese authorities with the passwords of email accounts belonging to Chinese dissidents and to academics in the US and other countries.

Recently, Li and Dong are said to have been researching vulnerabilities in the networks of biotech firms involved in COVID-19 vaccine research. It’s claimed they have gone after organizations and individuals in the United States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the United Kingdom.

“China’s anti-competitive behavior and flagrant disregard for their promises not to engage in cyber-enabled intellectual property theft is not just a domestic issue; it is a global issue,” said Demers.

The defendants have each been charged with one count of conspiracy to commit computer fraud, theft of trade secrets, wire fraud, and unauthorized access of a computer, and with seven counts of aggravated identity theft.

China has no extradition treaty with the US, and relations between two countries are not particularly cordial at the moment, which makes it highly unlikely either of the two defendants will ever appear in a US courtroom unless they get really stupid crossing borders. That seems unlikely now.

Source: Bad: US govt says Chinese duo hacked, stole blueprints from just about everyone. Also bad: They extorted cash • The Register

Sick of AI engines scraping your pics for facial recognition? Fawkes breaks the AI for you

Researchers at the University of Chicago’s Sand Lab have developed a technique for tweaking photos of people so that they sabotage facial-recognition systems.

The project, named Fawkes in reference to the mask in the V for Vendetta graphic novel and film depicting 16th century failed assassin Guy Fawkes, is described in a paper scheduled for presentation in August at the USENIX Security Symposium 2020.

Fawkes consists of software that runs an algorithm designed to “cloak” photos so they mistrain facial recognition systems, rendering them ineffective at identifying the depicted person. These “cloaks,” which AI researchers refer to as perturbations, are claimed to be robust enough to survive subsequent blurring and image compression.

The paper [PDF], titled, “Fawkes: Protecting Privacy against Unauthorized Deep Learning Models,” is co-authored by Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Zhao, all with the University of Chicago.

“Our distortion or ‘cloaking’ algorithm takes the user’s photos and computes minimal perturbations that shift them significantly in the feature space of a facial recognition model (using real or synthetic images of a third party as a landmark),” the researchers explain in their paper. “Any facial recognition model trained using these images of the user learns an altered set of ‘features’ of what makes them look like them.”

Figure 16 from the Fawkes: Protecting Privacy against Unauthorized Deep Learning Models paper

Two examples from the paper showing how different levels of perturbation applied to original photos can derail a facial-recognition system so that future matches are unlikely or impossible … Click to enlarge. Credit: Shan et al.

The boffins claim their pixel scrambling scheme provides greater than 95 per cent protection, regardless of whether facial recognition systems get trained via transfer learning or from scratch. They also say it provides about 80 per cent protection when clean, “uncloaked” images leak and get added to the training mix alongside altered snapshots.

They claim 100 per cent success at avoiding facial recognition matches using Microsoft’s Azure Face API, Amazon Rekognition, and Face++. Their tests involve cloaking a set of face photos and providing them as training data, then running uncloaked test images of the same person against the mistrained model.

Fawkes differs from adversarial image attacks in that it tries to poison the AI model itself, so it can’t match people or their images to their cloaked depictions. Adversarial image attacks try to confuse a properly trained model with specific visual patterns.

The researchers have posted their Python code on GitHub, with instructions for users of Linux, macOS, and Windows. Interested individuals may wish to try cloaking publicly posted pictures of themselves so that if the snaps get scraped and used to train to a facial recognition system – as Clearview AI is said to have done – the pictures won’t be useful for identifying the people they depict.

Fawkes is similar in some respects to the recent Camera Adversaria project by Kieran Browne, Ben Swift, and Terhi Nurmikko-Fuller at Australian National University in Canberra.

Camera Adversia adds a pattern known as Perlin Noise to images that disrupts the ability of deep learning systems to classify images. Available as an Android app, a user could take a picture of, say, a pipe and it would not be a pipe to the classifier.

The researchers behind Fawkes say they’re working on macOS and Windows tools that make their system easier to use.

Source: Sick of AI engines scraping your pics for facial recognition? Here’s a way to Fawkes them right up • The Register

Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn

The former head of DNS regulator ICANN has been named as co-CEO of a company that launched a controversial attempt to purchase the .org internet registry earlier this year. The news has again raised concerns over the revolving doors between regulators and those who need regulation.

In the past week, the website of Ethos Capital, the private equity firm that offered $1.13bn to take control of the popular .org registry, was updated to list ex-ICANN CEO Fadi Chehade as its joint head.

The change is significant because it was Chehade’s involvement in the attempted .org purchase that first alerted internet users that the deal deserved closer scrutiny.

The sale was ultimately vetoed several months later by ICANN, but only after the Attorney General of California got involved and sent a last-minute letter to LA-based ICANN telling it not to approve the deal in part due to the “lack of transparency” on Ethos Capital.

Part of that lack of transparency was who would actually own the .org registry after the sale: behind Ethos was a complex structure of no less than four shell companies that were all registered on the same day in Delaware with the prefix “Purpose Domains.” Ethos Capital refused to divulge who all the directors of those companies actually were despite repeat requests, including from ICANN, which had the power to refuse the sale.

Chehade’s close link to the proposed sale was only noticed because he had registered Ethos Capital’s .org domain name, EthosCapital.org, under his own name on May 7, 2019. The company Ethos Capital LLC was registered in Delaware one week later, on May 14, 2019.

All in the timing

That date is significant because May 13, 2019, the day before Ethos Capital was established, was the deadline for ICANN staff to publish a report on the controversial lifting of price caps on .org domains.

For the previous 20 years, the price of .org domains had been strictly limited by ICANN to a specific annual percentage increase. However, under reforms Chehade made as CEO of ICANN, prior to his departure in 2016, registries were allowed to request the caps be removed altogether when their current contract expired.

The company that runs .org, the Internet-Society-owned Public Internet Registry (PIR), had made that request for its contract expiring June 30, 2019, sparking a furious backlash from the internet community. ICANN public comment periods typically attract between five and 50 comments but when it came to the lifting of price caps on .org domains, there were over 3,200 responses of which more than 98 per cent were opposed to the idea.

That staff report of the comment period, due on May 13, was supposed to be an objective review of what the internet community has said; the internet community meanwhile, has long complained that ICANN’s staff frequently skew such reports to fit with a predetermined outcome.

The .org price cap issue was no exception, and despite overwhelming opposition, the staff report gave equal weight to the few comments in favor of the change as to the thousands opposed to it. It was clear that ICANN’s staff would recommend their board approve lifting the .org price caps: a decision that was potentially worth hundreds of millions of dollars over the course of the new ten-year contract.

There are just over 10 million .org domains, and the registry is one of the oldest and most stable in the market. In 2019, PIR reported [PDF] a 78.2 per cent renewal rate, meaning that the vast majority of existing domain holders automatically renewed their names for another year (you can register domains for multiple years but roughly 70 per cent of people renew a domain every year). To put it into hard numbers, there were 6.9 million .org renewals in 2019.

License to print money

That extraordinary loyalty rate, believed to be the highest in the domain industry, is what makes .org so valuable. Many organizations have built their websites and online reputation on .org domains for a decade or more, and domain names are incredibly cheap (roughly $10 a year) when compared to the enormous costs associated with moving to a different online home.

That makes the .org registry home to over eight million domain registrants who would likely pay many multiples of the current annual cost to keep their name. Even if PIR doubled its price from $10 to $20, the renewal rate would be unlikely to fall very much, resulting in an additional $69m in revenue, or thereabouts, just for that one year. In short, the .org registry without price caps was a money-printing machine.

Chehade was clearly following the issue closely, and the day after the staff report deadline, Ethos Capital – the private equity outfit that would a few months later approach the owner of the .org registry, the Internet Society – was registered in Delaware.

What makes this timeline all the more peculiar is that it isn’t clear that the staff report was actually published on Monday, May 13, 2019. Due to the volume of comments, ICANN’s staff asked for, and were granted, an extension. And so the final report that those outside the domain industry saw for the first time was published [PDF] three weeks later on June 3, 2019.

Did the former CEO of ICANN use his many connections with staff, many of whom he had hired and promoted, to get an early copy of the staff report? And is that why when Ethos Capital was named as the company trying to buy the .org registry there was no mention of Chehade’s close connection?

Despite the evidence and repeat requests, Ethos Capital refused to acknowledge Chehade’s involvement, even when he was spotted at the PIR offices, shortly after the deal was announced, with Ethos Capital CEO Erik Brooks, a former business partner, to discuss the acquisition.

Oh, that Chehade?

Eventually, Ethos Capital admitted its relationship with Chehade several months later in January in response to very specific questions posed by ICANN about the deal. On page 25 of a 27-page response [PDF] from Ethos, it answered a request that it name “former directors, officers or employees of ICANN that are or have been involved in, have advised on or otherwise have an interest in the transaction.”

And it named Nora Abusitta-Ouri, Chehade’s former personal assistant who had worked with him at previous companies; Allen Grogan, whom Chehade had hired to be ICANN’s head of compliance, and Fadi Chehade himself. They were “acting as advisors to Ethos Capital,” the company insisted, and provided no more details. Grogan, incidentally, is now listed as an Ethos Capital “executive partner” on its website.

It’s possible that Chehade’s connections with the CEOs of PIR, Jon Nevett, and the Internet Society, Andrew Sullivan, that made the dot-org takeover even remotely possible. It was always going to be a hard sell – as was made clear from the response when the deal, which had been green-lit in secret and in record time by the Internet Society and PIR boards, was announced.

When the Internet Society revealed that it was not only selling .org to a private equity firm but would also change PIR’s status from a non-profit organization to a for-profit one as part of the deal, the internet community and .org registrants were stunned. And then outraged.

Chehade had had plenty of time to work out the details and he knew the key person, PIR CEO Jonathon Nevett, extremely well. Nevett was co-founder of registry operator Donuts and had been a persistent presence in the domain name industry for years, many of them when Chehade was head of the industry’s regulator. The connection continued after Chehade left ICANN.

When Nevett sold Donuts in 2018 to Abry Partners, it was in a deal that was brokered by… Fadi Chehade and Erik Brooks. Within a few months, Nevett became CEO of PIR. And his position at Donuts was taken by another long-term Chehade business associate Akram Atallah, who had taken over as interim CEO of ICANN after Chehade left.

Contractual terms

As for the also-new CEO of the Internet Society, Andrew Sullivan, he had previously worked at Afilias, which runs the technical back-end of .org for the Internet Society’s PIR, and was the person responsible more than any other of helping the Internet Society win the contract to run .org 20 years previously. More than 80 per cent of the Internet Society’s annual revenue comes from the sale of .org domains.

Chehade was the connection between all these men who pushed through a proposal that the internet community, .org registrants, the internet society chapters, not to mention a former CEO and the former chair of ICANN, and US senators all condemned in the strongest terms.

Eventually it took the Attorney General of California, and an explicit threat to audit the notoriously secretive non-profit organization based in Los Angeles, to push ICANN off the .org sell-off and refuse it.

As for why Chehade persisted in only being an advisor to Ethos Capital when he almost certainly helped establish the company, filled it with his old staff, and was the point person for the entire deal, the answer to that may be in responses to questions put to the Internet Society and PIR about when they were first approached about a possible sale of .org.

“The Internet Society was first approached by Ethos Capital in September,” the organization told us in an official statement in response to our questions about interactions and timing of the deal. When PIR was asked the same question, its CEO Jon Nevett answered that he had no knowledge of any planned sale to Ethos Capital when he took over the CEO job in December 2018, or when his organization decided to formally ask for pricing caps to be lifted.

But of course, Ethos Capital only formally existed in May 2019. And Fadi Chehade was not a representative of Ethos Capital, merely an advisor, until last week when he suddenly became co-CEO. As to conversations Chehade may have had with his former staff to smooth the path of the billion-dollar sale, ICANN continues to refuse to supply records of staff or board communications, citing confidentiality.

Source: Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn+ • The Register

Microsoft’s Doing the Monopoly Thing Again, Slack Says

Workplace messaging software company Slack is accusing Microsoft of monopoly behavior in an antitrust complaint filed today to European Union regulators. Unsurprisingly, the accusations hinge on the same practice that helped make Microsoft rich in the first place.

Bill Gates, Windows, innovation, yes, yes, OK—undoubtedly Microsoft had a lot to contribute to the early years of home computing. But what helped it grow to mammoth scale was software bundling: specifically, the practice of getting its products pre-installed on brand new machines built by third parties—and making it hard to delete those programs and replace them with competitors.

You might remember this refrain from such hits as United States v. Microsoft Corporation, and Microsoft Corp. vs. Commission, the latter of which eventually cost the company over a billion dollars after it became “the first company in 50 years of EU competition policy that the Commission has had to fine for failure to comply with an antitrust decision,” according to the European Commission’s then-Competition Commissioner Neelie Kroes.

Kind of makes you wonder how Apple still gets away with setting Safari as the default browser on iOS devices, but I digress…

While those early cases against Microsoft focused on software like Internet Explorer and Windows Media Player, Slack’s new legal salvo concerns the company’s bundling of competing chat app Teams with its ubiquitous productivity suite Microsoft Office. In a press release, Slack accused its rival of “force installing it for millions, blocking its removal, and hiding the true cost to enterprise customers,” which Slack believes to be an “illegal and anti-competitive practice.”

“We’re confident that we win on the merits of our product, but we can’t ignore illegal behavior that deprives customers of access to the tools and solutions they want,” said Jonathan Prince, vice president of communications and policy at Slack. “Slack threatens Microsoft’s hold on business email, the cornerstone of Office, which means Slack threatens Microsoft’s lock on enterprise software.”

Reached for comment, a Microsoft spokesperson sniped that “we created Teams to combine the ability to collaborate with the ability to connect via video, because that’s what people want. With COVID-19, the market has embraced Teams in record numbers while Slack suffered from its absence of video-conferencing. We’re committed to offering customers not only the best of new innovation, but a wide variety of choice in how they purchase and use the product.”

The merits of the case will be decided by the Commission, but the existence of the suit is a smart play for Slack, which has seen its stock slip recently, perhaps as a result of Teams’s encroachment on its market share. The EU has consistently had a greater appetite to pursue antitrust concerns compared to the U.S., where both companies are headquartered, making it a doubly clever play for the considerably smaller and more vulnerable party.

Source: Microsoft’s Doing the Monopoly Thing Again, Slack Says