DOJ Recovers Most of Colonial Pipeline Hack Ransom

(WASHINGTON) — The Justice Department has recovered most of a multimillion-dollar ransom payment made to hackers after a cyberattack that caused the operator of the nation’s largest fuel pipeline to halt its operations last month, officials said Monday.

The operation to seize cryptocurrency paid to the Russia-based hacker group is the first of its kind to be undertaken by a specialized ransomware task force created by the Biden administration Justice Department.

[…]

Colonial officials have said they took their pipeline system offline before the attack could spread to its operating system, and decided soon after to pay ransom of 75 bitcoin — then valued at roughly $4.4 million — in hopes of bringing itself back online as soon as it could. The company’s president and chief executive, Joseph Blount, is set to testify before congressional panels this week.

[…]

The Bitcoin amount seized — 63.7, currently valued at $2.3 million after the price of Bitcoin tumbled— amounted to 85% of the total ransom paid, which is the exact amount that the cryptocurrency-tracking firm Elliptic says it believes was the take of the affiliate who carried out the attack. The ransomware software provider, DarkSide, would have gotten the other 15%.

“The extortionists will never see this money,” said Stephanie Hinds, the acting U.S. attorney for the Northern District of California, where a judge earlier Monday authorized the seizure warrant.

[…]

Source: DOJ Recovers Most of Colonial Pipeline Hack Ransom | Time

[…]

Despite paying for the ransom, the encryption tools handed over did not work or help the company’s efforts to restore its systems.   

The Justice Department obtained a warrant from a California district court on Monday in order to seize the money. 

“Following the money remains one of the most basic, yet powerful tools we have,” Monaco said. “Today’s announcements also demonstrate the value of early notification to law enforcement; we thank Colonial Pipeline for quickly notifying the FBI when they learned that they were targeted by DarkSide.”

[…]

Colonial Pipeline faced significant backlash for paying the ransom but the FBI and Justice Department said they were able to use the Bitcoin public ledger to trace the payments back to “a specific address, for which the FBI has the ‘private key,’ or the rough equivalent of a password needed to access assets accessible from the specific Bitcoin address.”

[…]

“We cannot guarantee and we may not be able to do this in every instance.”

Source: ‘Majority’ of ransom paid by Colonial Pipeline seized and returned by DOJ | ZDNet

European Commission Betrays Internet Users By Cravenly Introducing Huge Loophole For Copyright Companies In Upload Filter Guidance

As a recent Techdirt article noted, the European Commission was obliged to issue “guidance” on how to implement the infamous Article 17 upload filters required by the EU’s Copyright Directive. It delayed doing so, evidently hoping that the adviser to the EU’s top court, the Court of Justice of the European Union (CJEU), would release his opinion on Poland’s attempt to get Article 17 struck down before the European Commission revealed its one-sided advice. That little gambit failed when the Advocate General announced that he would publish his opinion after the deadline for the release of the guidance. The European Commission has finally provided its advisory document on Article 17 and, as expected, it contains a real stinker of an idea. The best analysis of what the Commission has done, and why it is so disgraceful comes from Julia Reda and Paul Keller on the Kluwer Copyright Blog. Although Article 17 effectively made upload filters mandatory, it also included some (weak) protections for users, to allow people to upload copyright material for legal uses such as memes, parody, criticism etc. without being blocked. The copyright industry naturally hates any protections for users, and has persuaded the European Commission to eviscerate them:

According to the final guidance, rightholders can easily circumvent the principle that automatic blocking should be limited to manifestly infringing uses by “earmarking” content the “unauthorised online availability of which could cause significant economic harm to them” when requesting the blocking of those works. Uploads that include protected content thus “earmarked” do not benefit from the ex-ante protections for likely legitimate uses. The guidance does not establish any qualitative or quantitative requirements for rightholders to earmark their content. The mechanism is not limited to specific types of works, categories of rightholders, release windows, or any other objective criteria that could limit the application of this loophole.

The requirements that copyright companies must meet are so weak that it is probably inevitable that they will claim most uploads “could cause significant economic harm”, and should therefore be earmarked. Here’s what happens then: before it can be posted online, every earmarked upload requires a “rapid” human review of whether it is infringing or not. Leaving aside the fact that it is very hard for legal judgements to be both “rapid” and correct, there’s also the problem that copyright companies will earmark millions of uploads (just look at DMCA notices), making it infeasible to carry out proper review. But the European Commission also says that if online platforms fail to carry out a human review of everything that is earmarked, and allow some unchecked items to be posted, they will lose their liability protection:

this means that service providers face the risk of losing the liability protections afforded to them by art. 17(4) unless they apply ex-ante human review to all uploads earmarked by rightholders as merely having the potential to “cause significant economic harm”. This imposes a heavy burden on platform operators. Under these conditions rational service providers will have to revert to automatically blocking all uploads containing earmarked content at upload. The scenario described in the guidance is therefore identical to an implementation without safeguards: Platforms have no other choice but to block every upload that contains parts of a work that rightholders have told them is highly valuable.

Thus the already unsatisfactory user rights contained in Article 17 are rendered null and void because of the impossibility of following the European Commission’s new guidance. That’s evidently the result of recent lobbying from the copyright companies, since none of this was present in previous drafts of the guidance. Not content with making obligatory the upload filters that they swore would not be required, copyright maximalists now want to take away what few protections remain for users, thus ensuring that practically all legal uses of copyright material — including memes — are likely to be automatically blocked.

The Kluwer Copyright blog post points out that this approach was not at all necessary. As Techdirt reported a couple of weeks ago, Germany has managed to come up with an implementation of Article 17 that preserves most user rights, even if it is by no means perfect. The European Commission, by contrast, has cravenly given what the copyright industry has demanded, and effectively stripped out those rights. But this cowardly move may backfire. Reda and Keller explain:

the Commission does not provide any justification or rationale why users’ fundamental rights do not apply in situations where rightholders claim that there is the potential for them to suffer significant economic harm. It’s hard to imagine that the CJEU will consider that the version of the guidance published today provides meaningful protection for users’ rights when it has to determine the compliance of the directive with fundamental rights [in the case brought by Poland]. The Commission appears to be acutely aware of this as well and so it has wisely included the following disclaimer in the introductory section of the guidance (emphasis ours):

“The judgment of the Court of Justice of the European Union in the case C-401/192 will have implications for the implementation by the Member States of Article 17 and for the guidance. The guidance may need to be reviewed following that judgment“.

In the end this may turn out to be the most meaningful sentence in the entire guidance.

It would be a fitting punishment for betraying the 450 million citizens the European Commission is supposed to serve, but rarely does, if this final overreach causes upload filters to be thrown out completely.

Source: European Commission Betrays Internet Users By Cravenly Introducing Huge Loophole For Copyright Companies In Upload Filter Guidance | Techdirt

Google to adapt its ad technology after France hands it a $267 million fine

Google has agreed to pay a €220 million ($267 million) fine and change its ad practices after France’s competition authority found it had abused its dominant online ad position. Following a 2019 complaint by News Corp. and French newspaper Le Figaro, France ruled that Google was favoring its own advertising services to the detriment of rivals.

[…]

In a blog post, Google explained how it planned to change its ad rules by offering publishers “increased flexibility” by improving interoperability between its ad manager and third-party ad servers. “Also, we are reaffirming that we will not limit Ad Manager publishers from negotiating specific terms or pricing directly with other sell-side platforms.”

Google’s ad division has faced scrutiny from French regulators in the past. In 2019, the watchdog fined Google €150 million ($167 million) for opaque and unpredictable advertising rules after it suspended the Google Ads account of a French company without notice. Google has also clashed with regulators and publishers in the nation over the use of snippets of content in its news section.

Source: Google to adapt its ad technology after France hands it a $267 million fine | Engadget

Apple’s tightly controlled App Store is teeming with scams

Apple chief executive Tim Cook has long argued it needs to control app distribution on iPhones, otherwise the App Store would turn into “a flea market.”

But among the 1.8 million apps on the App Store, scams are hiding in plain sight. Customers for several VPN apps, which allegedly protect users’ data, complained in Apple App Store reviews that the apps told users their devices have been infected by a virus to dupe them into downloading and paying for software they don’t need. A QR code reader app that remains on the store tricks customers into paying $4.99 a week for a service that is now included in the camera app of the iPhone. Some apps fraudulently present themselves as being from major brands such as Amazon and Samsung.

Of the highest 1,000 grossing apps on the App Store, nearly two percent are scams, according to an analysis by The Washington Post. And those apps have bilked consumers out of an estimated $48 million during the time they’ve been on the App Store, according to market research firm Appfigures. The scale of the problem has never before been reported. What’s more, Apple profits from these apps because it takes a cut of up to a 30 percent of all revenue generated through the App Store. Even more common, according to The Post’s analysis, are “fleeceware” apps that use inauthentic customer reviews to move up in the App Store rankings and give apps a sense of legitimacy to convince customers to pay higher prices for a service usually offered elsewhere with higher legitimate customer reviews.

Two-thirds of the 18 apps The Post flagged to Apple were removed from the App Store.

[…]

Apple has long maintained that its exclusive control of the App Store is essential to protecting customers, and it only lets the best apps on its system. But Apple’s monopoly over how consumers access apps on iPhones can actually create an environment that gives customers a false sense of safety, according to experts. Because Apple doesn’t face any major competition and so many consumers are locked into using the App Store on iPhones, there’s little incentive for Apple to spend money on improving it, experts say.

[…]

Apple unwittingly may be aiding the most sophisticated scammers by eliminating so many of the less competent ones during its app review process, said Miles, who co-authored a paper called “The Economics of Scams.”

[…]

Apple has argued that it is the only company with the resources and know-how to police the App Store. In the trial that Epic Games, the maker of the popular video game “Fortnite,” brought against Apple last month for alleged abuse of its monopoly power, Apple’s central defense was that competition would loosen protections against unwanted apps that pose security risks to customers. The federal judge in the case said she may issue a verdict by August.

The prevalence of scams on Apple’s App Store played a key role at trial. Apple’s lawyers were so focused on the company’s role in making the App Store safe that Epic’s attorneys accused them of trying to scare the court into a ruling in favor of Apple. In other internal emails unearthed during trial that date as far back as 2013, Apple’s Phil Schiller, who runs the App Store, expressed dismay when fraudulent apps made it past App Store review.

After a rip-off version of the Temple Run video game became the top-rated app, according to Schiller’s email exchange, he sent an irate message to two other Apple executives responsible for the store. “Remember our talking about finding bad apps with low ratings? Remember our talk about becoming the ‘Nordstroms’ of stores in quality of service? How does an obvious rip off of the super popular Temple Run, with no screenshots, garbage marketing text, and almost all 1-star ratings become the #1 free app on the store?” Schiller asked his team. “Is no one reviewing these apps? Is no one minding the store?” Apple declined to make Schiller available to comment. At trial, Schiller defended the safety of the app store on the stand. The app review process is “the best way we could come up with … to make it safe and fair.”

Eric Friedman, head of Apple’s Fraud Engineering Algorithms and Risk unit, or FEAR, said that Apple’s screening process is “more like the pretty lady who greets you with a lei at the Hawaiian airport than the drug sniffing dog,” according to a 2016 internal email uncovered during the Epic Games trial. Apple employs a 500-person App Review team, which sifts through submissions from developers. “App Review is bringing a plastic butter knife to a gun fight,” Friedman wrote in another email.

[…]

Though the App Store ratings section is filled with customer complaints referring to apps as scams, there is no way for Apple customers to report this to Apple, other than reaching out to a regular Apple customer service representative. Apple used to have a button, just under the ratings and reviews section in the App Store, that said “report a problem,” which allowed users to report inappropriate apps. Based on discussions among Apple customers on Apple’s own website, the feature was removed some time around 2016.

[…]

 

Source: Apple’s tightly controlled App Store is teeming with scams – Anchorage Daily News

Apple settles with student after authorized repair workers leaked her naked pics to her Facebook page. Apple blocks Right to repair for danger by unauthorised parties. Hmm.

Apple has paid a multimillion-dollar settlement to an unnamed Oregon college student after one of its outsourced repair facilities posted explicit pictures and videos of her to her Facebook page.

According to legal documents obtained by The Telegraph, the incident occurred in 2016 at a Pegatron-owned repair centre in Sacramento, California. The student had mailed in her device to have an unspecified fault fixed.

While it was at the facility, two technicians published a series of photographs showing the complainant unclothed to her Facebook account, as well as a “sex video.” The complaint said the post was made in a way that impersonated the victim, and was only removed after friends informed her of its existence.

The two men responsible were fired after an investigation. It is not known if the culprits faced criminal charges.

Much of the details of the case, as well as the exact size of the settlement, were sealed. Lawyers for the plaintiff sought a $5m payout. The settlement included non-disclosure provisions that prevented the student from revealing details about the case, or the exact size of the compensation.

Counsel for the victim threatened to sue for infliction of emotional distress, as well as invasion of privacy. The filings show they warned Apple that any lawsuit would result in inevitable negative publicity for the company.

Pegatron settled with the victim separately, per the filings.

In its fight against the right to repair, Apple has argued that allowing independent third-party businesses to service its computers and smartphones would present an unacceptable risk to user privacy and security.

This incident, which occurred at the facilities of an authorised contractor, has undercut that argument somewhat.

It follows a similar incident in November 2019, where a Genius Bar employee texted himself an explicit image taken from an iPhone he was repairing. After the victim complained, the employee was fired.

[…]

Source: Apple settles with student after authorized repair workers leaked her naked pics to her Facebook page • The Register

Bing Censors Image Search for ‘Tank Man’ Even in US

Bing, the search engine owned by Microsoft, is not displaying image results for a search for “Tank man,” even when searching from the United States. The apparent censorship comes on the anniversary of China’s violent crackdown on protests in Tiananmen Square in 1989.

“There are no results for tank man,” the Bing website reads after searching for the term. “Tank man” relates to the infamous image of a single protester standing in front of a line of Chinese tanks during the crackdown.

China censors and blocks distribution of discussion of tank man and Tiananmen Square more generally. This year, anniversary events in Hong Kong have dwindled in size after authorities banned a vigil.

tankman.png

Image: A screenshot of the search results.

Bing displays ordinary, non-image search results for tank man when searching from a U.S. IP address; the issue only impacts the images and videos tabs. Google, for its part, displays both when connecting from the same IP address.

[…]

Source: Bing Censors Image Search for ‘Tank Man’ Even in US

Google, Facebook, Chaos Computer Club join forces to oppose German state spyware

Plans by the German government to allow the police to deploy malware on any target’s devices, and force the tech world to help them, has run into some opposition, funnily enough.

In an open letter this month, the Chaos Computer Club – along with Google, Facebook, and others – said they are against proposals to dramatically expand the use of so-called state trojans, aka government-made spyware, in Germany. Under planned legislation, even people not suspected of committing a crime can be infected, and service providers will be forced to help. Plus all German spy agencies will be allowed to infiltrate people’s electronics and communications.

The proposals bypass the whole issue of backdooring or weakening encryption that American politicians seem fixated on. Once you have root access on a person’s computer or handheld, the the device can be an open book, encryption or not.

“The proposals are so absurd that all of the experts invited to the committee hearing in the Bundestag sharply criticized the ideas,” the CCC said.

“Even Facebook and Google – so far not positively recognized as pioneers of privacy – speak out vehemently against the project. Protect security and trust online – against an unlimited expansion of surveillance and for the protection of encryption.”

Source: Google, Facebook, Chaos Computer Club join forces to oppose German state spyware • The Register

The Navy’s Tanker Drone Makes History By Refueling A Manned Aircraft For The First Time (Updated)

Boeing’s MQ-25 Stingray test asset, known as T1, has conducted the first successful aerial refueling of a manned receiver aircraft by an unmanned tanker. The landmark is a vital one as the U.S. Navy looks forward to adding the MQ-25 to its carrier air wings, or CVWs, in the future.

The Navy’s Naval Air Systems Command (NAVAIR) and Boeing announced today that the T1 test article had demonstrated its tanker capability with an F/A-18F Super Hornet jet fighter on June 4, 2021. The drone had flown from MidAmerica Airport in Mascoutah, Illinois. The MQ-25 demonstrator aircraft passed fuel to the Super Hornet using an Aerial Refueling Store (ARS) mounted under its wing.

Boeing

The MQ-25 T1 refuels an F/A-18F during the drone’s June 4 flight out of MidAmerica Airport, Illinois.

As well as the fighter actually ‘plugging in’ to the drone to receive fuel, the same test mission involved evaluation of formation flying between the manned and unmanned assets, with as little as 20 feet separation between the two. Other test points included tracking the drogue — the basket-like assembly trailed by the MQ-25 that connects with a receiver aircraft’s standard refueling probe. Both aircraft were flying at operationally relevant speeds and altitudes, according to Boeing.

“This flight lays the foundation for integration into the carrier environment, allowing for greater capability toward manned-unmanned teaming concepts,” said Navy Rear Admiral Brian Corey, head of the Program Executive Office for Unmanned Aviation and Strike Weapons. “MQ-25 will greatly increase the range and endurance of the future carrier air wing — equipping our aircraft carriers with additional assets well into the future.”

[…]

In 2015, Northrop Grumman and the Navy successfully demonstrated fully autonomous aerial refueling using the X-47B Unmanned Combat Air System Demonstration (UCAS-D) drone, which refueled in flight from a contractor-operated Boeing 707 tanker. That was the first time an unmanned aircraft had been refueled in-flight.

U.S. Navy

An X-47B completes the first autonomous aerial refueling demonstration over Chesapeake Bay on April 22, 2015.

Prior to that, in 2012, DARPA’s Autonomous High-Altitude Refueling program demonstrated fully autonomous aerial refueling of unmanned air vehicles at high altitude. This culminated with two modified RQ-4 Global Hawkdrones flying in close formation to test probe-and-drogue contacts, as seen in this video:

The first refueling sortie for the MQ-25 demonstrator was the 26th for the T1 test vehicle but there has also been extensive simulations of aerial refueling using MQ-25 digital models.

[…]

Source: The Navy’s Tanker Drone Makes History By Refueling A Manned Aircraft For The First Time (Updated)

Mapped: A Detailed Map of the Online World in Incredible Detail

View the giant full-size (20 MB) version of this map.

Map of the internet's most popular websites

A Map of the Online World in Incredible Detail

The internet is intangible, and because you can’t see it, it can be hard to comprehend its sheer vastness. As well, it’s difficult to gauge the relative size of different web properties. However, this map of the internet by Halcyon Maps offers a unique solution to these problems.

Inspired by the look and design of historical maps, this graphic provides a snapshot of the current state of the World Wide Web, as of April 2021. Let’s take a closer look!

But First, Methodology

Before diving into an analysis, it’s worth touching on the methodology behind this graphic’s design.

This map highlights thousands of the world’s most popular websites by visualizing them as “countries.” These “countries” are organized into clusters that are grouped by their content type (whether it’s a news website, search engine, e-commerce platform, etc).

Visual Capitalist on the mapEditor’s fun fact: Can you spot Visual Capitalist? We’re right in between TechCrunch and The Guardian above.

 

The colored borders represent a website’s logo or user interface. In terms of scale, each website’s territory size is based on its average Alexa web traffic ranking. The data is a yearly average, measured from January 2020 to January 2021.

Along the borders of the map, you can find additional information, from ranked lists of social media consumption to a mini-map of average download speeds across the globe.

According to the designer Martin Vargic, this map took about a year to complete.

[…]

Source: Mapped: A Detailed Map of the Online World in Incredible Detail

Posted in Art