Draken Doubles Its Fleet Of Private Aggressor F-16s With A Dozen Surplus Jets From Norway

Draken International has signed a contract to bring yet more F-16 fighter jets to its fast-expanding “red air” fleet, as the adversary air support contractor adds ex-Norwegian Vipers to the dozen former Dutch examples it acquired earlier this year. Up to 12 F-16s acquired from Norway will form part of an impressive private tactical jet air force, already one of the world’s largest, which also includes a dozen ex-South African Atlas Cheetahs, and 22 ex-Spanish Air Force Mirage F1Ms, plus assorted other subsonic jets, as well as a deep backstock of MiG-21s.

Draken took to Facebook yesterday to announce it was buying the F-16s plus “supporting assets” in a deal signed with the government of Norway but which still requires approval from U.S. and Norwegian authorities. The value of the contract has not been revealed.

[…]

the Norwegian Defense Materiel Agency provided more details of the sale, noting that the jets could be delivered to Draken as early as next year and they will support training “against American fighter aircraft.” Headquartered at Lakeland Linder International Airport, in Lakeland, Florida, the company also provides contractor adversary services within Europe.

[…]

By adding another batch of F-16s to its adversary fleet, Draken will keep pace with rival red air provider Top Aces, which is now operating the first of the 29 ex-Israeli F-16A/Bs acquired from Israel.

[…]

As well as the former Norwegian F-16s, and the 12 already acquired from the Netherlands, Draken could expand its fleet still further, with the Dutch government having announced an option for the firm to acquire another 28 examples, which are planned to be retired from service by the end of 2024.

As it stands, Draken’s fleet currently includes two supersonic fighter jets for adversary work: a dozen ex-South African Atlas Cheetahs, and 22 ex-Spanish Air Force Mirage F1Ms. One of the latter jets was lost in a fatal crash near Nellis Air Force Base, Nevada, earlier this year.

[…]

Source: Draken Doubles Its Fleet Of Private Aggressor F-16s With A Dozen Surplus Jets From Norway

How to Build a Supersonic Trebuchet

What do you get when you combine ancient designs with modern engineering? An exciting new way to convert time and money into heat and noise! I’m not sure whether to call this a catapult or a trebuchet, but it’s definitely the superior siege engine.

Have you ever sat down and thought “I wonder if a trebuchet could launch a projectile at supersonic speeds?” Neither have we. That’s what separates [David Eade] from the rest of us. He didn’t just ask the question, he answered it! And he documented the entire build in a YouTube video which you can see below the break.

Source: https://hackaday.com/2021/12/01/supersonic-projectile-exceeds-engineers-dreams-the-supersonic-trebuchet/

Documents Shows Just How Much The FBI Can Obtain From Encrypted Communication Services

There is no “going dark.” Consecutive FBI heads may insist there is, but a document created by their own agency contradicts their dire claims that end-to-end encryption lets the criminals and terrorists win.

Andy Kroll has the document and the details for Rolling Stone:

[I]n a previously unreported FBI document obtained by Rolling Stone, the bureau claims that it’s particularly easy to harvest data from Facebook’s WhatsApp and Apple’s iMessage services, as long as the FBI has a warrant or subpoena. Judging by this document, “the most popular encrypted messaging apps iMessage and WhatsApp are also the most permissive,” according to Mallory Knodel, the chief technology officer at the Center for Democracy and Technology.

The document [PDF] shows what can be obtained from which messaging service, with the FBI noting WhatsApp has plenty of information investigators can obtain, including almost real time collection of communications metadata.

WhatsApp will produce certain user metadata, though not actual message content, every 15 minutes in response to a pen register, the FBI says. The FBI guide explains that most messaging services do not or cannot do this and instead provide data with a lag and not in anything close to real time: “Return data provided by the companies listed below, with the exception of WhatsApp, are actually logs of latent data that are provided to law enforcement in a non-real-time manner and may impact investigations due to delivery delays.”

The FBI can obtain this info with a pen register order — the legal request used for years to obtain ongoing call data on targeted numbers, including numbers called and length of conversations. With a warrant, the FBI can get even more information. A surprising amount, actually. According to the document, WhatsApp turns over address book contacts for targeted users as well as other WhatsApp users who happen to have the targeted person in their address books.

Combine this form of contact chaining with a few pen register orders, and the FBI can basically eavesdrop on hundreds of conversations in near-real time. The caveat, of course, is that the FBI has no access to the content of the conversations. That remains locked up by WhatsApp’s encryption. Communications remain “warrant-proof,” to use a phrase bandied about by FBI directors. But is it really?

If investigators are able to access the contents of a phone (by seizing the phone or receiving permission from someone to view their end of conversations), encryption is no longer a problem. That’s one way to get past the going darkness. Then there’s stuff stored in the cloud, which can give law enforcement access to communications despite the presence of end-to-end encryption. Backups of messages might not be encrypted and — as the document points out — a warrant will put those in the hands of law enforcement.

If target is using an iPhone and iCloud backups enabled, iCloud returns may contain WhatsApp data, to include message content.

[…]

Source: Documents Shows Just How Much The FBI Can Obtain From Encrypted Communication Services | Techdirt

‘Wall of secrecy’ in Pfizer contracts as company accused of profiteering

Ministers have agreed a secrecy clause in any dispute with the drugs manufacturer Pfizer over Britain’s Covid vaccine supply. Large portions of the government’s contracts with the company over the supply of 189m vaccine doses have been redacted and any arbitration proceedings will be kept secret.

The revelation comes as Pfizer is accused by a former senior US health official of “war profiteering’’ during the pandemic. In a Channel 4 Dispatches investigation to be broadcast this week, Tom Frieden, who was director of the US Centers for Disease Control and Prevention under Barack Obama, said: “If you’re just focusing on maximising your profits and you’re a vaccine manufacturer … you are war profiteering.”

Zain Rizvi, research director at Public Citizen, a US consumer advocacy organisation which has examined Pfizer’s global vaccine contracts, said: “There is a wall of secrecy surrounding these contracts and it’s unacceptable, particularly in a public health crisis.”

Rizvi said the UK needed to explain why it had agreed to secret arbitration proceedings. He said: “It’s the only high-income country we have seen that has agreed to this provision. It allows pharmaceutical companies to bypass domestic legal processes.

“The UK government has allowed the drug firms to call the shots. How did we end up in a situation where a handful of drug firms were able to exert so much control over the most powerful governments in the world? It points to a broken system.”

Pfizer has won plaudits for its vaccine delivery programme, but the US multinational faces growing scrutiny over the scale of its profits and the proportion of doses it has delivered to low-income countries.

While AstraZeneca agreed to sell its vaccine at cost during the pandemic, Pfizer wanted to secure its profits. The Pfizer/BioNTech vaccine, which now has the brand name Comirnaty, will be one of the most lucrative drugs in pharmaceutical history.

The Channel 4 investigation reveals analysis by one biological engineering expert claiming the Pfizer vaccine costs just 76p to manufacture for each shot. It is reportedly being sold for £22 a dose to the UK government.

The estimated manufacturing costs do not include research, distribution and other costs, but Pfizer says its profit margin as a percentage before tax are in the “high-20s”. Pfizer expects to deliver 2.3bn vaccines this year with predicted revenues of $36bn (£26.3bn).

Vials for vaccine
One biological engineering expert claims the Pfizer vaccine costs just 76p to manufacture for each shot. Photograph: Rafiq Maqbool/AP

A report last month by the People’s Vaccine Alliance, a coalition of organisations including aid charities, said Pfizer and other drug firms have sold the majority of doses to rich countries, leaving low-income countries “out in the cold” . Only 2% of people in low-income countries had been fully vaccinated against coronavirus. Drug firms should suspend intellectual property rights for Covid-19 vaccines, tests, treatments and other medical tools.

Pfizer has faced increased scrutiny allegations of excessive global profits after its partner, the biotechnology company BioNTech, announced in September 2020 it was to receive up to €375m (£320m) from the German government to fund vaccine development.

Anna Marriott, Oxfam’s health policy manager said: “It is deplorable that billions of people around the world are being denied vaccines so that pharmaceutical companies can make obscene profits. Given that public investment was crucial to vaccine development, it’s incomprehensible that pharma monopolies are being prioritised over people’s lives.”

[…]

Source: ‘Wall of secrecy’ in Pfizer contracts as company accused of profiteering | UK news | The Guardian

UK competition regulator orders Meta to sell Giphy

As rumored, the UK’s Competition and Markets Authority (CMA) has ordered Meta (Facebook) to sell Giphy, saying the deal “could harm social media users and UK advertisers.” It found that the deal would boost Meta’s already prodigious market power by limiting other platforms’ access to Giphy GIFs, “driving more traffic to Facebook owned sites — Facebook, WhatsApp and Instagram.”

The CMA said that Meta’s sites dominated social media user time to the tune of 73 percent and that it could further muscle out rivals like TikTok, Twitter and Snapchat by leveraging Giphy. It added that prior to the merger, Giphy launched “innovative advertising services” used by brands like Dunkin’ Donuts and Pepsi that it could have brought to the UK.

“Facebook terminated Giphy’s advertising services at the time of the merger, removing an important source of potential competition,” the regulator wrote. “The CMA considers this particularly concerning given that Facebook controls nearly half of the £7 billion display advertising market in the UK.”

[…]

Source: UK competition regulator orders Meta to sell Giphy | Engadget

Someone is hacking receipt printers with ‘antiwork’ messages

Hackers are attacking business receipt printers to insert pro-labor messages, according to a report from Vice and posts on Reddit. “Are you being underpaid?”, reads one message and “How can the McDonald’s in Denmark pay their staff $22 an hour and still manage to sell a Big Mac for less than in America?” another states.

Numerous similar images have been posted on Reddit, Twitter and elsewhere. The messages vary, but most point readers toward the r/antiwork subreddit that recently became popular during the COVID-19 pandemic, as workers starting demanding more rights.

Some users suggested that the messages were fake, but a cybersecurity firm that monitors the internet told Vice that they’re legit. “Someone is… blast[ing] raw TCP data directly to printer services across the internet,” GreyNoise founder Andrew Morris told Vice. “Basically to every single device that has port TCP 9100 open, and print[ing] a pre-written document that references /r/antiwork with some workers rights/counter capitalist messaging.”

The individual[s] behind the attack are using 25 separate servers, according to Morris, so blocking one IP won’t necessarily stop the attacks. “A technical person is broadcasting print requests for a document containing workers rights messaging to all printers that are misconfigured to be exposed to the internet, and we’ve confirmed that it is printing successfully in some number of places,” he said.

[…]

Source: Someone is hacking receipt printers with ‘antiwork’ messages | Engadget

Studying our solar system’s protective bubble

Astrophysicists believe the heliosphere protects the planets within our solar system from powerful radiation emanating from supernovas, the final explosions of dying stars throughout the universe. They believe the heliosphere extends far beyond our solar system, but despite the massive buffer against cosmic radiation that the heliosphere provides Earth’s life-forms, no one really knows the shape of the heliosphere—or, for that matter, the size of it.

[…]

Opher’s team has constructed some of the most compelling computer simulations of the heliosphere, based on models built on observable data and theoretical astrophysics.

[…]

a paper published by Opher and collaborators in Astrophysical Journal reveals that neutral hydrogen particles streaming from outside our solar system most likely play a crucial role in the way our heliosphere takes shape.

[…]

models predict that the heliosphere, traveling in tandem with our sun and encompassing our solar system, doesn’t appear to be stable. Other models of the heliosphere developed by other astrophysicists tend to depict the heliosphere as having a comet-like shape, with a jet—or a “tail”—streaming behind in its wake. In contrast, Opher’s model suggests the heliosphere is shaped more like a croissant or even a donut.

The reason for that? Neutral hydrogen particles, so-called because they have equal amounts of positive and negative charge that net no charge at all.

“They come streaming through the solar system,” Opher says. Using a computational model like a recipe to test the effect of ‘neutrals’ on the shape of the heliosphere, she “took one ingredient out of the cake—the neutrals—and noticed that the jets coming from the sun, shaping the heliosphere, become super stable. When I put them back in, things start bending, the center axis starts wiggling, and that means that something inside the heliospheric jets is becoming very unstable.”

Instability like that would theoretically cause disturbance in the solar winds and jets emanating from our sun, causing the heliosphere to split its shape—into a croissant-like form. Although astrophysicists haven’t yet developed ways to observe the actual shape of the heliosphere, Opher’s model suggests the presence of neutrals slamming into our system would make it impossible for the heliosphere to flow uniformly like a shooting comet. And one thing is for sure—neutrals are definitely pelting their way through space.

[…]

Source: Studying our solar system’s protective bubble

U.S. Indicts Two Men for Running a $20 Million YouTube Content ID Scam – after 4 years of warnings

Two men have been indicted by a grand jury for running a massive YouTube Content ID scam that netted the pair more than $20m. Webster Batista Fernandez and Jose Teran managed to convince a YouTube partner that the pair owned the rights to 50,000+ tracks and then illegally monetized user uploads over a period of four years.

[…]

YouTube previously said that it paid $5.5 billion in ad revenue to rightsholders from content claimed and monetized through Content ID but the system doesn’t always work exactly as planned.

Over the years, countless YouTube users have complained that their videos have been claimed and monetized by entities that apparently have no right to do so but, fearful of what a complaint might do to the status of their accounts, many opted to withdraw from battles they feared they might lose.

[…]

Complaints are not hard to find. Large numbers of YouTube videos uploaded by victims of the scam dating back years litter the platform, while a dedicated Twitter account and a popular hashtag have been complaining about MediaMuv since 2018.

 

Mediamuv
 

As early as 2017, complaints were being made on YouTube/Google’s support forums, with just one receiving more than 150 replies.

“I want to make a claim through this place, since a few days ago a said company called MEDIAMUV IS STEALING CONTENT FROM MY CHANNEL AND FROM OTHER USERS, does anyone know something about said company?” one reads.

“[I] investigated and there is nothing in this respect. I only found a channel saying that several users are being robbed and that when they come to upload their own songs, MEDIAMUV detects the videos as theirs.”

[…]

Source: U.S. Indicts Two Men for Running a $20 Million YouTube Content ID Scam * TorrentFreak

Someone Is Running Hundreds of Malicious Servers on Tor Network

New research shows that someone has been running hundreds of malicious servers on the Tor network, potentially in an attempt to de-anonymize users and unmask their web activity. As first reported by The Record, the activity would appear to be emanating from one particular user who is persistent, sophisticated, and somehow has the resources to run droves of high-bandwidth servers for years on end.

[…]

The malicious servers were initially spotted by a security researcher who goes by the pseudonym “nusenu” and who operates their own node on the Tor network. On their Medium, nusenu writes that they first uncovered evidence of the threat actor—which they have dubbed “KAX17”—back in 2019. After doing further research into KAX17, they discovered that they had been active on the network as far back as 2017.

In essence, KAX appears to be running large segments of Tor’s network—potentially in the hopes of being able to track the path of specific web users and unmask them.

[…]

in the case of KAX17, the threat actor appears to be substantially better resourced than your average dark web malcontent: they have been running literally hundreds of malicious servers all over the world—activity that amounts to “running large fractions of the tor network,” nusenu writes. With that amount of activity, the chances that a Tor user’s circuit could be traced by KAX is relatively high, the researcher shows.

Indeed, according to nusenu’s research, KAX at one point had so many servers—some 900—that you had a 16 percent likelihood of using their relay as a first “hop” (i.e., node in your circuit) when you logged onto Tor. You had a 35 percent chance of using one of their relays during your 2nd “hop,” and a 5 percent chance of using them as an exit relay, nusenu writes.

There’s also evidence that the threat actor engaged in Tor forum discussions, during which they seem to have lobbied against administrative actions that would have removed their servers from the network.

[…]

Many of the threat actor’s servers were removed by the Tor directory authorities in October 2019. Then, just last month, authorities again removed a large number of relays that seemed suspicious and were tied to the threat actor. However, in both cases, the actor seems to have immediately bounced back and begun reconstituting, nusenu writes.

It’s unclear who might be behind all this, but it seems that, whoever they are, they have a lot of resources. “We have no evidence, that they are actually performing de-anonymization attacks, but they are in a position to do so,” nusenu writes. “The fact that someone runs such a large network fraction of relays…is enough to ring all kinds of alarm bells.”

“Their actions and motives are not well understood,” nusenu added.

Source: Someone Is Running Hundreds of Malicious Servers on Tor Network

U.S. State Department phones hacked with Israeli company NSO spyware

Apple Inc iPhones of at least nine U.S. State Department employees were hacked by an unknown assailant using sophisticated spyware developed by the Israel-based NSO Group, according to four people familiar with the matter.

The hacks, which took place in the last several months, hit U.S. officials either based in Uganda or focused on matters concerning the East African country, two of the sources said.

The intrusions, first reported here, represent the widest known hacks of U.S. officials through NSO technology. Previously, a list of numbers with potential targets including some American officials surfaced in reporting on NSO, but it was not clear whether intrusions were always tried or succeeded.

Reuters could not determine who launched the latest cyberattacks.

NSO Group said in a statement on Thursday that it did not have any indication their tools were used but canceled access for the relevant customers and would investigate based on the Reuters inquiry.

[…]

Source: U.S. State Department phones hacked with Israeli company spyware – sources | Reuters

Qualcomm’s new always-on smartphone camera is always looking out for you

“Your phone’s front camera is always securely looking for your face, even if you don’t touch it or raise to wake it.” That’s how Qualcomm Technologies vice president of product management Judd Heape introduced the company’s new always-on camera capabilities in the Snapdragon 8 Gen 1 processor set to arrive in top-shelf Android phones early next year.

[…]

But for those of us with any sense of how modern technology is used to violate our privacy, a camera on our phone that’s always capturing images even when we’re not using it sounds like the stuff of nightmares and has a cost to our privacy that far outweighs any potential convenience benefits.

Qualcomm’s main pitch for this feature is for unlocking your phone any time you glance at it, even if it’s just sitting on a table or propped up on a stand. You don’t need to pick it up or tap the screen or say a voice command — it just unlocks when it sees your face. I can see this being useful if your hands are messy or otherwise occupied (in its presentation, Qualcomm used the example of using it while cooking a recipe to check the next steps). Maybe you’ve got your phone mounted in your car, and you can just glance over at it to see driving directions without having to take your hands off the steering wheel or leave the screen on the entire time.

[…]

Qualcomm is framing the always-on camera as similar to the always-on microphones that have been in our phones for years. Those are used to listen for voice commands like “Hey Siri” or “Hey Google” (or lol, “Hi Bixby”) and then wake up the phone and provide a response, all without you having to touch or pick up the phone. But the difference is that they are listening for specific wake words and are often limited with what they can do until you do actually pick up your phone and unlock it.

It feels a bit different when it’s a camera that’s always scanning for a likeness.

It’s true that smart home products already have features like this. Google’s Nest Hub Max uses its camera to recognize your face when you walk up to it and greet you with personal information like your calendar. Home security cameras and video doorbells are constantly on, looking for activity or even specific faces. But those devices are in your home, not always carried with you everywhere you go, and generally don’t have your most private information stored on them, like your phone does. They also frequently have features like physical shutters to block the camera or intelligent modes to disable recording when you’re home and only resume it when you aren’t. It’s hard to imagine any phone manufacturer putting a physical shutter on the front of their slim and sleek flagship smartphone.

Lastly, there have been many reports of security breaches and social engineering hacks to enable smart home cameras when they aren’t supposed to be on and then send that feed to remote servers, all without the knowledge of the homeowner. Modern smartphone operating systems now do a good job of telling you when an app is accessing your camera or microphone while you’re using the device, but it’s not clear how they’d be able to inform you of a rogue app tapping into the always-on camera.

To be honest, these things are also pretty damn scary! I understand that Americans have been habituated to ubiquitous surveillance, but here in the EU we still value our privacy and don’t like it much at all.

Ultimately, it comes down to a level of trust — do you trust that Qualcomm has set up the system in a way that prevents the always-on camera from being used for other purposes than intended? Do you trust that the OEM using Qualcomm’s chips won’t do things to interfere with the system, either for their own profit or to satisfy the demands of a government entity?

Even if you do have that trust, there’s a certain level of comfort with an always-on camera on your most personal device that goes beyond where we are currently.

Maybe we’ll just start having to put tape on our smartphone cameras like we already do with laptop webcams.

Source: Qualcomm’s new always-on smartphone camera is a potential privacy nightmare – The Verge

How We Determined Predictive Policing Software Disproportionately Targeted Low-Income, Black, and Latino Neighborhoods

[…]

One of the first, and reportedly most widely used, is PredPol, its name an amalgamation of the words “predictive policing.” The software was derived from an algorithm used to predict earthquake aftershocks that was developed by professors at UCLA and released in 2011. By sending officers to patrol these algorithmically predicted hot spots, these programs promise they will deter illegal behavior.

But law enforcement critics had their own prediction: that the algorithms would send cops to patrol the same neighborhoods they say police always have, those populated by people of color. Because the software relies on past crime data, they said, it would reproduce police departments’ ingrained patterns and perpetuate racial injustice, covering it with a veneer of objective, data-driven science.

PredPol has repeatedly said those criticisms are off-base. The algorithm doesn’t incorporate race data, which, the company says, “eliminates the possibility for privacy or civil rights violations seen with other intelligence-led or predictive policing models.”

There have been few independent, empirical reviews of predictive policing software because the companies that make these programs have not publicly released their raw data.

A seminal, data-driven study about PredPol published in 2016 did not involve actual predictions. Rather the researchers, Kristian Lum and William Isaac, fed drug crime data from Oakland, California, into PredPol’s open-source algorithm to see what it would predict. They found that it would have disproportionately targeted Black and Latino neighborhoods, despite survey data that shows people of all races use drugs at similar rates.

PredPol’s founders conducted their own research two years later using Los Angeles data and said they found the overall rate of arrests for people of color was about the same whether PredPol software or human police analysts made the crime hot spot predictions. Their point was that their software was not worse in terms of arrests for people of color than nonalgorithmic policing.

However, a study published in 2018 by a team of researchers led by one of PredPol’s founders showed that Indianapolis’s Latino population would have endured “from 200% to 400% the amount of patrol as white populations” had it been deployed there, and its Black population would have been subjected to “150% to 250% the amount of patrol compared to white populations.” The researchers said they found a way to tweak the algorithm to reduce that disproportion but that it would result in less accurate predictions—though they said it would still be “potentially more accurate” than human predictions.

[…]

Other predictive police programs have also come under scrutiny. In 2017, the Chicago Sun-Times obtained a database of the city’s Strategic Subject List, which used an algorithm to identify people at risk of becoming victims or perpetrators of violent, gun-related crime. The newspaper reported that 85% of people that the algorithm saddled with the highest risk scores were Black men—some with no violent criminal record whatsoever.

Last year, the Tampa Bay Times published an investigation analyzing the list of people that were forecast to commit future crimes by the Pasco Sheriff’s Office’s predictive tools. Deputies were dispatched to check on people on the list more than 12,500 times. The newspaper reported that at least one in 10 of the people on the list were minors, and many of those young people had only one or two prior arrests yet were subjected to thousands of checks.

For our analysis, we obtained a trove of PredPol crime prediction data that has never before been released by PredPol for unaffiliated academic or journalistic analysis. Gizmodo found it exposed on the open web (the portal is now secured) and downloaded more than 7 million PredPol crime predictions for dozens of American cities and some overseas locations between 2018 and 2021.

[…]

rom Fresno, California, to Niles, Illinois, to Orange County, Florida, to Piscataway, New Jersey. We supplemented our inquiry with Census data, including racial and ethnic identities and household incomes of people living in each jurisdiction—both in areas that the algorithm targeted for enforcement and those it did not target.

Overall, we found that PredPol’s algorithm relentlessly targeted the Census block groups in each jurisdiction that were the most heavily populated by people of color and the poor, particularly those containing public and subsidized housing. The algorithm generated far fewer predictions for block groups with more White residents.

Analyzing entire jurisdictions, we observed that the proportion of Black and Latino residents was higher in the most-targeted block groups and lower in the least-targeted block groups (about 10% of which had zero predictions) compared to the overall jurisdiction. We also observed the opposite trend for the White population: The least-targeted block groups contained a higher proportion of White residents than the jurisdiction overall, and the most-targeted block groups contained a lower proportion.

[…]

We also found that PredPol’s predictions often fell disproportionately in places where the poorest residents live

[…]

To try to determine the effects of PredPol predictions on crime and policing, we filed more than 100 public records requests and compiled a database of more than 600,000 arrests, police stops, and use-of-force incidents. But most agencies refused to give us any data. Only 11 provided at least some of the necessary data.

For the 11 departments that provided arrest data, we found that rates of arrest in predicted areas remained the same whether PredPol predicted a crime that day or not. In other words, we did not find a strong correlation between arrests and predictions. (See the Limitations section for more information about this analysis.)

We do not definitively know how police acted on any individual crime prediction because we were refused that data by nearly every police department.

[…]

Overall, our analysis suggests that the algorithm, at best, reproduced how officers have been policing, and at worst, would reinforce those patterns if its policing recommendations were followed.

[…]

 

Source: How We Determined Predictive Policing Software Disproportionately Targeted Low-Income, Black, and Latino Neighborhoods

Clear These Recalled Cancer Causing Antiperspirants From Your Home

If you’re a fan of aerosol spray antiperspirants and deodorants, you’re going to want to check to see whether the one you use is part of a voluntary recall issued by Procter & Gamble (P&G).

The recall comes after a citizen’s petition filed with the U.S. Food and Drug Administration (FDA) last month that claims more than half of the batches of antiperspirant and deodorant sprays they tested contained benzene—a chemical that, when found at high levels, can cause cancer. Here’s what you need to know.

[…]

They found that out of the 108 batches of products tested, 59 (or 54%) of them had levels of benzene exceeding the 2 parts per million permitted by the FDA.

[…]

Valisure’s tests included 30 different brands, but according to CNN, P&G is the only company to issue a recall for its products containing benzene; specifically, the recall covers 17 types of Old Spice and Secret antiperspirant.

The full list of products Valisure tested and found to contain more than 2 parts per million of benzene can be found on the company’s petition to the FDA. Examples include products from other familiar brands like Tag, Sure, Equate, Suave, Right Guard, Brut, Summer’s Eve, Right Guard, Power Stick, Soft & Dri, and Victoria’s Secret.

If you have purchased any of the Old Spice or Secret products included in P&G’s recall, the company instructs consumers to stop using them, throw them out, and contact their customer care team (at 888-339-7689 from Monday – Friday from 9 a.m. – 6 p.m. EST) to learn how to be reimbursed for eligible products.

Source: Clear These Recalled Antiperspirants From Your Home

Really stupid “smart contract” bug let hackers steal $31 million in digital coin

Blockchain startup MonoX Finance said on Wednesday that a hacker stole $31 million by exploiting a bug in software the service uses to draft smart contracts.

The company uses a decentralized finance protocol known as MonoX that lets users trade digital currency tokens without some of the requirements of traditional exchanges. “Project owners can list their tokens without the burden of capital requirements and focus on using funds for building the project instead of providing liquidity,” MonoX company representatives say here. “It works by grouping deposited tokens into a virtual pair with vCASH, to offer a single token pool design.”

An accounting error built into the company’s software let an attacker inflate the price of the MONO token and to then use it to cash out all the other deposited tokens, MonoX Finance revealed in a post. The haul amounted to $31 million worth of tokens on the Ethereum or Polygon blockchains, both of which are supported by the MonoX protocol.

Specifically, the hack used the same token as both the tokenIn and tokenOut, which are methods for exchanging the value of one token for another. MonoX updates prices after each swap by calculating new prices for both tokens. When the swap is completed, the price of tokenIn—that is, the token sent by the user—decreases and the price of tokenOut—or the token received by the user—increases.

By using the same token for both tokenIn and tokenOut, the hacker greatly inflated the price of the MONO token because the updating of the tokenOut overwrote the price update of the tokenIn. The hacker then exchanged the token for $31 million worth of tokens on the Ethereum and Polygon blockchains.

There’s no practical reason for exchanging a token for the same token, and therefore the software that conducts trades should never have allowed such transactions. Alas, it did, despite MonoX receiving three security audits this year.

[…]

Blockchain researcher Igor Igamberdiev took to Twitter to break down the makeup of the drained tokens. Tokens included $18.2 million in Wrapped Ethereum, $10.5 in MATIC tokens, and $2 million worth of WBTC. The haul also included smaller amounts of tokens for Wrapped Bitcoin, Chainlink, Unit Protocol, Aavegotchi, and Immutable X.

Only the latest DeFi hack

MonoX isn’t the only decentralized finance protocol to fall victim to a multimillion-dollar hack. In October, Indexed Finance said it lost about $16 million in a hack that exploited the way it rebalances index pools. Earlier this month, blockchain-analysis company Elliptic said so-called DeFi protocols have lost $12 billion to date due to theft and fraud. Losses in the first roughly 10 months of this year reached $10.5 billion, up from $1.5 billion in 2020.

[…]

Source: Really stupid “smart contract” bug let hackers steal $31 million in digital coin | Ars Technica

Elon Musk Email Warns of Potential SpaceX Bankruptcy

SpaceX employees received a nightmare email over the holiday weekend from CEO Elon Musk, warning them of a brewing crisis with its Raptor engine production that, if unsolved, could result in the company’s bankruptcy. The email, obtained by SpaceExplored, CNBC, and The Verge, urged employees to work over the weekend in a desperate attempt to increase production of the engine meant to power its next-generation Starship launch vehicle.

“Unfortunately, the Raptor production crisis is much worse than it seemed a few weeks ago,” Musk reportedly wrote. “As we have dug into the issues following exiting prior senior management, they have unfortunately turned out to be far more severe than was reported. There is no way to sugarcoat this.”

[…]

In his email, Musk advised workers to cut their holiday weekend short and called for an “all hands on deck to recover from what is, quite frankly, a disaster.” Summing up the problem, Musk warned the company could face bankruptcy if it could not get Starship flights running once every two weeks in 2022. If all of this sounds familiar, that’s because Musk has previously spoken publicly about times where both SpaceX and Tesla were on the verge of bankruptcy in their early years. More recently Musk claimed Tesla came within “single digits” of bankruptcy as recent as 2018.

[…]

The alarming news comes near the close of what’s been an otherwise stellar year for SpaceX. In 11 months SpaceX managed to launch 25 successful Falcon 9 missions, sent a dozen astronauts to space and drew a roadmap to mass commercialization with its Starlink satellite internet service.

You can read the full email over at The Verge.

Source: Elon Musk Email Warns of Potential SpaceX Bankruptcy

So the peons are taking the brunt and having to fix the failures of upper management – for free, probably.

Malware Attack Via Millions of Phishing Text Messages Spreads in Finland

Finland is working to stop a flood of text messages of an unknown origin that are spreading malware.

The messages with malicious links to malware called FluBot number in the millions, according to Aino-Maria Vayrynen, information security specialist at the National Cyber Security Centre. Telia Co AB, the country’s second-biggest telecommunications operator, has intercepted some hundreds of thousands of messages.

“The malware attack is extremely exceptional and very worrying,” Teemu Makela, chief information security officer at Elisa Oyj, the largest telecoms operator, said by phone. “Considerable numbers of text messages are flying around.”

The messages started beeping of Finns’ mobiles late last week, prompting the National Cyber Security Centre to issue a “severe alert.” The campaign is worse than a previous bout of activity in the summer, Antti Turunen, fraud manager at Telia, said.

Many of the messages claim that the recipient has received a voice mail, asking them to open a link. On Android devices, that brings up a prompt that requests user to allow installation of an application that contains the malware, and on Apple Inc.’s iPhones users are taken to other fraudulent material on the website, authorities said.

[…]

Source: Malware Attack Via Millions of Text Messages Spreads in Finland – Bloomberg

Don’t click on linkbait!

150 HP multi-function printer types vulnerable to exploit

Tricking users into visiting a malicious webpage could allow malicious people to compromise 150 models of HP multi-function printers, according to F-Secure researchers.

The Finland-headquartered infosec firm said it had found “exploitable” flaws in the HP printers that allowed attackers to “seize control of vulnerable devices, steal information, and further infiltrate networks in pursuit of other objectives such as stealing or changing other data” – and, inevitably, “spreading ransomware.”

“In all likelihood, a lot of companies are using these vulnerable devices,” said F-Secure researchers Alexander Bolshev and Timo Hirvonen.

“To make matters worse, many organizations don’t treat printers like other types of endpoints. That means IT and security teams forget about these devices’ basic security hygiene, such as installing updates.”

Tricking a user into visiting a malicious website could, so F-Secure said, result in what the infosec biz described as a “cross-site printing attack.”

The heart of the attack is in the document printed from the malicious site: it contained a “maliciously crafted font” that gave the attacker code execution privileges on the multi-function printer.

[…]

The vulns were publicly disclosed a month ago. The font vulnerability is tracked as CVE-2021-39238 and is listed as affecting HP Enterprise LaserJet, LaserJet Managed, Enterprise PageWide, and PageWide Managed product lines. It is rated as 9.3 out of 10 on the CVSS 3.0 severity scale.

[…]

F-Secure advised putting MFPs inside a separate, firewalled VLAN as well as adding physical security controls including anti-tamper stickers and CCTV.

Updated firmware is available for download from HP, the company said in a statement.

[…]

Source: 150 HP multi-function printer types vulnerable to exploit • The Register

Tensorflow model zoo

A repository that shares tuning results of trained models generated by Tensorflow. Post-training quantization (Weight Quantization, Integer Quantization, Full Integer Quantization, Float16 Quantization), Quantization-aware training. I also try to convert it to OpenVINO’s IR model as much as possible.

TensorFlow Lite, OpenVINO, CoreML, TensorFlow.js, TF-TRT, MediaPipe, ONNX [.tflite, .h5, .pb, saved_model, tfjs, tftrt, mlmodel, .xml/.bin, .onnx]

https://github.com/PINTO0309/PINTO_model_zoo