‘Spy pixels in emails have become endemic’

The use of “invisible” tracking tech in emails is now “endemic”, according to a messaging service that analysed its traffic at the BBC’s request.Hey’s review indicated that two-thirds of emails sent to its users’ personal accounts contained a “spy pixel”, even after excluding for spam.Its makers said that many of the largest brands used email pixels, with the exception of the “big tech” firms.Defenders of the trackers say they are a commonplace marketing tactic.And several of the companies involved noted their use of such tech was mentioned within their wider privacy policies.Emails pixels can be used to log: if and when an email is opened how many times it is opened what device or devices are involved the user’s rough physical location, deduced from their internet protocol (IP) address – in some cases making it possible to see the street the recipient is onThis information can then be used to determine the impact of a specific email campaign, as well as to feed into more detailed customer profiles.Hey’s co-founder David Heinemeier Hansson says they amount to a “grotesque invasion of privacy”.

Source: ‘Spy pixels in emails have become endemic’ – BBC News

‘Roaring Kitty’ GameStop investor hit with lawsuit by American idiot

Keith Gill, known as ‘Roaring Kitty’ on YouTube, allegedly duped retail investors into buying inflated stocks while hiding his sophisticated financial background.Mr Gill has downplayed his impact and rebutted claims he violated any laws.Separately, he will testify on Thursday to Congress about the “Reddit rally”.”The idea that I used social media to promote GameStop stock to unwitting investors is preposterous,” Mr Gill said in the prepared testimony.”I was abundantly clear that my channel was for educational purposes only, and that my aggressive style of investing was unlikely to be suitable for most folks checking out the channel.” GameStop: What is it and why is it trending? Real Wolf of Wall Street warns of GameStop losses Share buying mistakes ‘on the rise’Mr Gill allegedly bought GameStop shares for $5 (£3.60) and then used social media to drive shares from around $20 in early January to more than $400 in just two weeks.This violated securities laws against manipulating the market, according to the lawsuit filed by Christian Iovin, a Washington state resident who purchased GameStop stock options.Mr Gill said he used publicly available information to determine GameStop was undervalued, and shared this view with a “tiny” following on social media ahead of January’s huge price surge.The lawsuit also names as defendants Massachusetts Mutual Life Insurance Co and its subsidiary MML Investors Services, which employed Mr Gill until 28 January.The company told Massachusetts regulators it was unaware of Mr Gill’s outside activities.Grilling from lawmakersA number of people involved in the so-called “Reddit rally” are due to appear before Congress on Thursday, including Mr Gill.Others called to testify include Wall Street hedge fund Melvin Capital, along with the chief executive of Reddit.media captionGameStop investors on a wild rideThe chief executive of Robinhood, the trading platform that restricted the purchases of GameStop shares to investors during the trading frenzy, is also expected to testify.The GameStop saga was hailed as a victory of the little guys against big Wall Street hedge funds that were betting against video games retailer GameStop and other struggling businesses.But it is unclear what role hedge funds had in the rally as some are reported to have made millions from the GameStop share rally, that was inspired by Reddit users.

Source: ‘Roaring Kitty’ GameStop investor hit with lawsuit – BBC News

France has been suffering A Very ‘Solar Winds’-Like Cyberattack since 2017

As the U.S. continues to chart the damage from the sweeping “SolarWinds” hack, France has announced that it too has suffered a large supply chain cyberattack. The news comes via a recently released technical report published by the Agence Nationale de la sécurité des systèmes d’information—or simply ANSSI—the French government’s chief cybersecurity agency. Like the U.S., French authorities have implied that Russia is probably involved.According to ANSSI, a sophisticated hacker group has successfully penetrated the Centreon Systems products, a French IT firm specializing in network and system monitoring that is used by many French government agencies, as well as some of the nation’s biggest companies (Air France, among others). Centreon’s client page shows that it partners with the French Department of Justice, Ecole Polytechnique, and regional public agencies, as well as some of the nation’s largest agri-food production firms.Illustration for article titled France Just Suffered a SolarWinds-Style CyberattackThe SolarWinds Hack Just Keeps Getting More WildNow the Chinese are involved. That’s one of the newest allegations to emerge in the SolarWinds…Read moreWhile ANSSI did not officially attribute the hack to any organization, the agency says the techniques used bear similarities to those of the Russian military hacker group “Sandworm” (also known as Unit 74455). The intrusion campaign, which dates back at least to 2017, allowed the hackers to breach the systems of a number of French organizations, though ANSSI has declined to name the victims or say how many were affected.

Source: France Just Suffered A Very ‘Solar Winds’-Like Cyberattack

Apple new M1 chip specific Malware Has Arrived

Now that Apple has officially begun the transition to Apple Silicon, so has malware.

Security researcher Patrick Wardle published a blog detailing that he’d found a malicious program dubbed GoSearch22, a Safari browser extension that’s been reworked for Apple’s M1 processor. (The extension is a variant of the Pirrit adware family, which is notorious on Macs.) Meanwhile, a new report from Wired also quotes other security researchers as finding other, distinct instances of native M1 malware from Wardle’s findings.

The GoSearch22 malware was signed with an Apple developer ID on Nov. 23,  2020—not long after the first M1 laptops were first unveiled. Having a developer ID means a user downloading the malware wouldn’t trigger Gatekeeper on macOS, which notifies users when an application they’re about to download may not be safe. Developers can take the extra step of submitting apps to Apple to be notarized for extra confirmation. However, Wardle notes in his writeup that it’s unclear whether Apple ever notarized the code, as the certificate for GoSearch22 has since been revoked. Unfortunately, he also writes that since this malware was detected in the wild, regardless of whether Apple notarized it, “macOS users were infected.”

[…]

Source: The M1 Malware Has Arrived

FortressIQ just comes out and says it: To really understand business processes, feed your staff’s screen activity to an AI

In a sign that interest in process mining is heating up, vendor FortressIQ is launching an analytics platform with a novel approach to understanding how users really work – it “videos” their on-screen activity for later analysis.

According to the San Francisco-based biz, its Process Intelligence platform will allow organisations to be better prepared for business transformation, the rollout of new applications, and digital projects by helping customers understand how people actually do their jobs, as opposed to how the business thinks they work.

The goal of process mining itself is not new. German vendor Celonis has already marked out the territory and raised approximately $290m in a funding round in November 2019, when it was valued at $2.5bn.

Celonis works by recording a users’ application logs, and by applying machine learning to data across a number of applications, purports to figure out how processes work in real life. FortressIQ, which raised $30m in May 2020, uses a different approach – recording all the user’s screen activity and using AI and computer vision to try to understand all their behaviour.

Pankaj Chowdhry, CEO at FortressIQ, told The Register that the company had built was a “virtual process analyst”, a software agent which taps into a user’s video card on the desktop or laptop. It streams a low-bandwidth version of what is occuring on the screen to provide the raw data for the machine-learning models.

“We built machine learning and computer vision AI that will, in essence, watch that movie, and convert it into a structured activity,” he said.

In an effort to assure those forgiven for being a little freaked out by the recording of users’ every on-screen move, the company said it anonymises the data it analyses to show which processes are better than others, rather than which user is better. Similarly, it said it guarantees the privacy of on-screen data.

Nonetheless, users should be aware of potential kickbacks when deploying the technology, said Tom Seal, senior research director with IDC.

“Businesses will be somewhat wary about provoking that negative reaction, particularly with the remote working that’s been triggered by COVID,” he said.

At the same time, remote working may be where the approach to process mining can show its worth, helping to understand how people adapt their working patterns in the current conditions.

FortressIQ may have an advantage over rivals in that it captures all data from the users’ screen, rather than the applications the organisation thinks should be involved in a process, said Seal. “It’s seeing activity that the application logs won’t pick up, so there is an advantage there.”

Of course, there is still the possibility that users get around prescribed processes using Post-It notes, whiteboards and phone apps, which nobody should put beyond them.

Celonis and FortressIQ come from very different places. The German firm has a background in engineering and manufacturing, with an early use case at Siemens led by Lars Reinkemeyer who has since joined the software vendor as veep for customer transformation. He literally wrote the book on process mining while at the University of California, Santa Barbara. FortressIQ, on the other hand, was founded by Chowdhry who worked as AI leader at global business process outsourcer Genpact before going it alone.

And it’s not just these two players. Software giant SAP has bought Signavio, a specialist in business process analysis and management, in a deal said to be worth $1.2bn to help understand users’ processes as it readies them for the cloud and application upgrades. ®

Source: FortressIQ just comes out and says it: To really understand business processes, feed your staff’s screen activity to an AI • The Register

Kia’s Network Is Down, Finance Sites to Owner Apps, Nobody Will Say Why – yay connected cars

Like it or not, connected cars have become a staple of every day life for millions of Americans. The ability to interact with our cars from afar past the key fob has become something we expect to work, but that all relies on the underpinnings of critical IT infrastructure. And when something isn’t working as expected, a minor inconvenience can translate into a customer nightmare.

Someone over at Kia has been having a very bad week. Since Saturday, Kia’s online and connected services have been down, leaving owners unable to pay their bills, remotely unlock their vehicles, or even warm them up in the middle of one of the harshest winters that parts of the U.S. have seen in quite some time.

via Kia, Twitter

Kia’s hamsters have their work cut out for them.

Owners took to Twitter and various online forums to complain about the unscheduled outage, many confused why they couldn’t view the details of their cars on Kia’s website or various phone apps.

Some owners looking to pay their bills also visited Kia’s finance site where they were unable to login and pay their bills, so they resorted to the phonelines which played a message stating that the self-service options were down for scheduled maintenance. Needless to say, that led to a flurry of people tweeting at Kia because they were unsure of the outcome should they miss a payment due to the outage.

via Kia

Now, it’s not just existing Kia drivers that are affected. New buyers are also stuck, unable to set up accounts with Kia’s online services. We confirmed this by trying to create an account on the Kia owners’ portal, but were greeted with an “Internal Server Error” and couldn’t proceed.

[…]

Source: Kia’s Network Is Down, From Finance Sites to Owner Apps, and Nobody Will Say Why