The Linkielist

Linking ideas with the world

The Linkielist

Daily Archives: July 14, 2022

Hasbro will 3D-print your face onto its iconic action figures

Posted on by

Have you ever wanted to see your own face on the body of a Power Ranger or a Ghostbuster? Thanks to an ingenious partnership between Hasbro and 3D-printing specialists Formlabs, now you can. The Hasbro Selfie Series will let would-be heroes take a scan of their face with their phone and have a custom-made, look-a-like action figure delivered at some point afterward. In this initial blast, you can opt to become an X-Wing Pilot, Ghostbuster, Power Ranger or Snake Eyes from GI Joe, amongst others.

It’s part of Formlabs’ growing project to turn 3D printing into a technological cul-de-sac into a viable way of making customized, mass-market products. The company has already teamed up with Sennheiser to make 3D-printed earbuds, and has branched out into making jewelry moulds, ventilator parts and false teeth. It also teamed up with Gillette to create customized razor handles which were manufactured using Formlabs’ industrial printers.

Hasbro’s Brian Chapman explained that, a few years ago, the company ran a competition at a comic-con to make custom action figures for five winners. They found the interest in the promo was so enormous that the company has always had an eye on developments in the 3D printing market.

Unfortunately, while it’s been announced today, the Hasbro Selfie Series won’t actually let you start scanning your head for a little while. In order to start, you’ll need to download Hasbro Pulse, the company’s dedicated mobile app, and get your face ready to be immortalized. Scans will open up closer to the expected ship date in the Fall, after which point you’ll be asked to pony up $60 (plus taxes) and wait for your six-inch, “collector-grade” figure to arrive. Unfortunately, for now, the offering is only available to customers in the US, but hopefully over time, we’ll see this make its way across the world.

Source: Hasbro will 3D-print your face onto its iconic action figures | Engadget

X.Org Server Hit By New Local Privilege Escalation, Remote Code Execution Vulnerabilities

Posted on by

[…] CVE-2022-2319 and CVE-2022-2320 were made public this morning and both deal with the X.Org Server’s Xkb keyboard extension not properly validating input that could lead to out-of-bounds memory writes. Hopefully though in 2022 you aren’t relying on your xorg-server running as root.

Fixes for these XKB vulnerabilities have been patched in X.Org Server Git and xorg-server 21.1.4 point release is expected soon with these fixes. Both vulnerabilities were discovered by Trend Micro’s Zero Day Initiative.

More details in today’s X.Org Security Advisory.

Update: X.Org Server 21.1.4 is now available. In addition to these security fixes there is also a large number of XQuartz fixes from Apple, a GCC 12 build fix in the render code, a possible crash fix in the PRESENT code, and various other small fixes.

Source: X.Org Server Hit By New Local Privilege Escalation, Remote Code Execution Vulnerabilities – Phoronix

Supremes ‘doxxed’ after overturning Roe v Wade

Posted on by

The US Supreme Court justices who overturned Roe v. Wade last month may have been doxxed – had their personal information including physical and IP addresses, and credit card info revealed – according to threat intel firm Cybersixgill.

As expected, the fallout from the controversial ruling, which reversed the court’s 1973 decision that federally protected access to abortion, has been immense, creating deep ripples across the cybersphere where data privacy concerns abound.

[…]

In a twist on using personal data for questionable purposes, it appears some hacktivists are taking matters into their own hands and seemingly leaked private information about five conservative Supremes: Justices Samuel Alito, Clarence Thomas, Neil Gorsuch, Brett Kavanaugh and Amy Coney Barrett, according to research published today by Cybersixgill’s security research lead Dov Lerner.

Although Chief Justice John Roberts voted with the majority, the doxxers didn’t expose his personal data.

Lerner, who told The Register he found the doxes on “various dark web forums,” said the “most notable” dox happened on June 30, and alleges to include physical addresses, IP addresses, and credit card information, including CVV (which the doxers called “little funny 3 numbers on the back”) and expiration date.

[…]

Source: Supremes ‘doxxed’ after overturning Roe v Wade • The Register

Maybe this is an expression of the right to bear arms.

Amazon Ring Tells Sen. Markey It Won’t Enhance Doorbell Privacy, will listen in to long range conversations

Posted on by

Ring is rejecting the request of a U.S. senator to introduce privacy-enhancing changes to its flagship doorbell video camera after product testing showed the device capable of recording conversations well beyond the doorsteps of its many millions of customers. Security and privacy experts expressed alarm at the quality of the distant recordings, raising concerns about the potential for blackmail, stalking, and other forms of invasion

In a letter to the company last month, Sen. Ed Markey, a Democrat of Massachusetts, said Ring was capturing “significant amounts of audio on private and public property adjacent to dwellings with Ring doorbells,” putting the right to “assemble, move, and converse without being tracked” at risk.

Markey did not asked the company to adjust the range of the device, but adjust the doorbell’s settings so audio wouldn’t be recorded by default. Ring, which was acquired by retail giant Amazon in 2018, rejected the idea, arguing that doing so would be a “negative experience” for customers, who might easily get confused by the settings “in an emergency situation.” What’s more, Ring appeared to reject a request never to link the devices to voice recognition software, offering only that it hasn’t done so thus far.

Experts such as Matthew Guariglia, a policy analyst at the Electronic Frontier Foundation, have said the device is particularly harmful to the privacy of individuals who live in close quarters — think apartment buildings and condos — where they may be unknowingly recorded the moment they open their doors.

[…]

Source: Amazon Ring Tells Sen. Markey It Won’t Enhance Doorbell Privacy

Google files a lawsuit that could kick Tinder out of the Play Store because Match refuses to pay illegally forced fees

Posted on by

Google has counter-sued Match seeking monetary damages and a judgement that would let it kick Tinder and the group’s other dating apps out of the Play Store, Bloomberg has reported. Earlier this year, Match sued Google alleging antitrust violations over a decision requiring all Android developers to process “digital goods and services” payments through the Play Store billing system.

Following the initial lawsuit in May, Google and Match reached a temporary agreement allowing Match to remain on the Play Store and use its own payments system. Google also agreed to make a “good faith” effort to address Match’s billing concerns. Match, in turn, was to make an effort to offer Google’s billing system as an alternative.

However, Google parent Alphabet claims that Match Group now wants to avoid paying “nothing at all” to Google, including its 15 to 30 percent Play Store fees, according to a court filing. “Match Group never intended to comply with the contractual terms to which it agreed… it would also place Match Group in an advantaged position relative to other app developers,” the document states.

Match group said that Google’s Play Store policies violate federal and state laws. “Google doesn’t want anyone else to sue them so their counterclaims are designed as a warning shot,” Match told Bloomberg in a statement. “We are confident that our suit, alongside other developers, the US Department of Justice and 37 state attorneys general making similar claims, will be resolved in our favor early next year.”

Match is referring to an antitrust action launched last year by States and the federal government probing Google’s Play Store fees. Shortly before that, Google dropped its fee on app developer revenue to 15 percent on the first $1 million, and 30 percent after that. At the same time, it announced it would enforce a policy requiring all developers to process payments through the Play Store’s billing system. Earlier this year, a Senate bill moved forward targeting in-app payments in both Google and Apple’s stores.

Source: Google files a lawsuit that could kick Tinder out of the Play Store | Engadget

Greedy bastards at Google – nope, you can’t force a marketplace on people and you can’t force these fees on them either.

A Bored Chinese Housewife Spent Years Falsifying Russian History on Wikipedia

Posted on by

Posing as a scholar, a Chinese woman spent years writing alternative accounts of medieval Russian history on Chinese Wikipedia, conjuring imaginary states, battles, and aristocrats in one of the largest hoaxes on the open-source platform.

The scam was exposed last month by Chinese novelist Yifan, who was researching for a book when he came upon an article on the Kashin silver mine.

Discovered by Russian peasants in 1344, the Wikipedia entry goes, the mine engaged more than 40,000 slaves and freedmen, providing a remarkable source of wealth for the Russian principality of Tver in the 14th and 15th centuries as well as subsequent regimes. The geological composition of the soil, the structure of the mine, and even the refining process were fleshed out in detail in the entry.

Yifan thought he’d found interesting material for a novel. Little did he know he’d stumbled upon an entire fictitious world constructed by a user known as Zhemao. It was one of 206 articles she has written on Chinese Wikipedia since 2019, weaving facts into fiction in an elaborate scheme that went uncaught for years and tested the limits of crowdsourced platforms’ ability to verify information and fend off bad actors.

[…]

Yifan was tipped off when he ran the silver mine story by Russian speakers and fact-checked Zhemao’s references, only to find that the pages or versions of the books she cited did not exist. People he consulted also called out her lengthy entries on ancient conflicts between Slavic states, which could not be found in Russian historical records. “They were so rich in details they put English and Russian Wikipedia to shame,” Yifan wrote on Zhihu, a Chinese site similar to Quora, where he shared his discovery last month and caused a stir.

The scale of the scam came to light after a group of volunteer editors and other Wikipedians, such as Yip, combed through her past contributions to nearly 300 articles.

One of her longest articles was almost the length of “The Great Gatsby.” With the formal, authoritative tone of an encyclopedia, it detailed three Tartar uprisings in the 17th century that left a lasting impact on Russia, complete with a map she made. In another entry, she shared rare images of ancient coins, which she claimed to have obtained from a Russian archaeological team.

[…]

Source: A Bored Chinese Housewife Spent Years Falsifying Russian History on Wikipedia

Brilliant – and she’s not the only one!

Joshua Schulte: Former CIA hacker convicted of Vault 7 data leak

Posted on by

[…]

Joshua Schulte was convicted of sending the CIA’s “Vault 7” cyber-warfare tools to the whistle-blowing platform. He had denied the allegations.

The 2017 leak of some 8,761 documents revealed how intelligence officers hacked smartphones overseas and turned them into listening devices.

Prosecutors said the leak was one of the most “brazen” in US history.

Damian Williams, the US attorney for the Southern District of New York, said Mr Schulte’s actions had “a devastating effect on our intelligence community by providing critical intelligence to those who wish to do us harm”.

Mr Schulte, who represented himself at the trial in Manhattan federal court, now faces decades in prison. He also faces a separate trial on charges of possessing images and videos of child abuse, to which he has pleaded not guilty.

After joining the CIA in 2010, Mr Schulte soon achieved the organisation’s highest security clearance. He went on to work at the agency’s headquarters in Langley, Virginia, designing a suite of programmes used to hack computers, iPhones and Android phones and even smart TVs.

Prosecutors alleged in 2016 that he transmitted the stolen information to Wikileaks and then lied to FBI agents about his role in the leak.

They added that he was seemingly motivated by anger over a workplace dispute in which his employer ignored his complaints. The software engineer had been struggling to meet deadlines and Assistant US Attorney Michael Lockard said one of his projects was so far behind schedule that he had earned the nickname “Drifting Deadline”.

The prosecutors said he wanted to punish those he perceived to have wronged him and said in “carrying out that revenge, he caused enormous damage to this country’s national security”.

But Mr Schulte said the government had no evidence that he was motivated by revenge and called the argument “pure fantasy”. In his closing argument, he claimed that “hundreds of people had access” to the leaked files and that “hundreds of people could have stolen it”.

“The government’s case is riddled with reasonable doubt,” he added.

[…]

Source: Joshua Schulte: Former CIA hacker convicted of ‘brazen’ data leak – BBC News

Amazon’s Ring gave a record amount of doorbell footage to the US government in 2021

Posted on by

Ring, the maker of internet-connected video doorbells and security cameras, said in its latest transparency report that it turned over a record amount of doorbell footage and other information to U.S. authorities last year.

The Amazon-owned company said in two biannual reports covering 2021 that it received 3,147 legal demands, an increase of about 65% on the year earlier, up from about 1,900 legal demands in 2020.

More than 85% of the legal demands processed were by way of court-issued search warrants, allowing Ring to turn over both information about a Ring user and video footage from those accounts. Ring said it turned over user content in response to about four out of 10 demands it received during the year.

Transparency reports allow U.S. companies to disclose the number of legal law orders they are given over a particular time period, often six-months or a year. But Ring has been criticized for having unusually cozy relationships with about 2,200 police departments around the United States, latest figures show, allowing police to request video doorbell camera footage from homeowners.

Ring said it also notified 648 users during the year that their user information had been requested by law enforcement. According to its law enforcement guidelines, Ring notifies users before disclosing their user information, such as name, address, email address and billing information, unless it is prohibited by way of a secrecy order.

In a new breakout, Ring also revealed it received 2,774 preservation orders, which allow police departments and law enforcement agencies to ask Amazon — not demand — to preserve a user’s account for up to six months to allow the requesting agency to gather enough information to a court-issued order, such as a search warrant.

Amazon executive Brian Huseman told lawmakers in a letter published Wednesday that Ring shared doorbell footage at least 11 times with U.S. authorities so far in 2022 without the consent of the device’s owner, reports Politico. According to the letter, Amazon said it “made a good-faith determination that there was an imminent danger of death or serious physical injury to a person requiring disclosure of information without delay.” Under emergency disclosure orders, companies can respond with data when a requesting agency doesn’t have the time to obtain a court order.

Ring has not yet revealed how many times it has disclosed user data under emergency circumstances in previous years, including its most recent transparency report.

Source: Amazon’s Ring gave a record amount of doorbell footage to the government in 2021 | TechCrunch