Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Company That Routes Billions of Text Messages Quietly Says It Was Hacked – for years (you know, the messages we now use for 2FA)

Posted on by

A company that is a critical part of the global telecommunications infrastructure used by AT&T, T-Mobile, Verizon and several others around the world such as Vodafone and China Mobile, quietly disclosed that hackers were inside its systems for years, impacting more than 200 of its clients and potentially millions of cellphone users worldwide.

The company, Syniverse, revealed in a filing dated September 27 with the U.S. Security and Exchange Commission that an unknown “individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers.”

A former Syniverse employee who worked on the EDT systems told Motherboard that those systems have information on all types of call records.

[…]

“Syniverse is a common exchange hub for carriers around the world passing billing info back and forth to each other,” the source, who asked to remain anonymous as they were not authorized to talk to the press, told Motherboard. “So it inevitably carries sensitive info like call records, data usage records, text messages, etc. […] The thing is—I don’t know exactly what was being exchanged in that environment. One would have to imagine though it easily could be customer records and [personal identifying information] given that Syniverse exchanges call records and other billing details between carriers.”

The company wrote that it discovered the breach in May 2021, but that the hack began in May of 2016.

[…]

“The world’s largest companies and nearly all mobile carriers rely on Syniverse’s global network to seamlessly bridge mobile ecosystems and securely transmit data, enabling billions of transactions, conversations and connections [daily],” Syniverse wrote in a recent press release.

“Syniverse has access to the communication of hundreds of millions, if not billions, of people around the world. A five-year breach of one of Syniverse’s main systems is a global privacy disaster,” Karsten Nohl, a security researcher who has studied global cellphone networks for a decade, told Motherboard in an email. “Syniverse systems have direct access to phone call records and text messaging, and indirect access to a large range of Internet accounts protected with SMS 2-factor authentication. Hacking Syniverse will ease access to Google, Microsoft, Facebook, Twitter, Amazon and all kinds of other accounts, all at once.”

[…]

Syniverse disclosed the breach in an August SEC filing as the company gearing to go public at a valuation of $2.85 billion via a merger with M3-Brigade Acquisition II Corp., a special purpose acquisition company (SPAC).

[…]

Source: Company That Routes Billions of Text Messages Quietly Says It Was Hacked

Clearview AI Says It Can Do the ‘Computer Enhance’ Thing – wait, this evil has not yet been purged?

Posted on by

Sketchy face recognition company Clearview AI has inflated its stockpile of scraped images to over 10 billion, according to its co-founder and CEO Hoan Ton-That. What’s more, he says the company has new tricks up its sleeve, like using AI to draw in the details of blurry or partial images of faces.

Clearview AI has reportedly landed contracts with over 3,000 police and government customers including 11 federal agencies, which it says use the technology to identify suspects when it might otherwise be impossible. In April, a BuzzFeed report citing a confidential source identified over 1,800 public agencies that had tested or currently uses its products, including everything from police and district attorney’s offices to Immigration and Customs Enforcement and the U.S. Air Force. It also reportedly has worked with dozens of private companies including Walmart, Best Buy, Albertsons, Rite Aid, Macy’s, Kohl’s, AT&T, Verizon, T-Mobile, and the NBA.

Clearview has landed such deals despite facing considerable legal trouble over its unauthorized acquisition of those billions of photos, including state and federal lawsuits claiming violations of biometrics privacy laws, a consumer protection suit brought by the state of Vermont, the company’s forced exit from Canada, and complaints to privacy regulators in at least five other countries. There have also been reports detailing Ton-That’s historic ties to far-right extremists (which he denies) and pushback against the use of face recognition by police in general, which has led to bans on such use in over a dozen U.S. cities.

In an interview with Wired on Monday, Ton-That claimed that Clearview has now scraped over 10 billion images from the open web for use in its face recognition database. According to the CEO, the company is also rolling out a number of machine learning features, including one that uses AI to reconstruct faces that are obscured by masks.

Specifically, Ton-That told Wired that Clearview is working on “deblur” and “mask removal” tools. The first feature should be familiar to anyone who’s ever used an AI-powered image upscaling tool, taking a lower-quality image and using machine learning to add extra details. The mask removal feature uses statistical patterns found in other images to guess what a person might look like under a mask. In both cases, Clearview would essentially be offering informed guesswork. I mean, what could go wrong?

As Wired noted, quite a lot. There’s a very real difference between using AI to upscale Mario’s face in Super Mario 64 and using it to just sort of suggest what a suspect’s face might look like to cops. For example, existing face recognition tools have been repeatedly assessed as riddled with racial, gender, and other biases, and police have reported extremely high failure rates in its use in criminal investigations. That’s before adding in the element of the software not even knowing what a face really looks like—it’s hard not to imagine such a feature being used as a pretext by cops to fast-track investigative leads.

[…]

“… My intention with this technology is always to have it under human control. When AI gets it wrong it is checked by a person.” After all, it’s not like police have a long and storied history of using junk science to justify misconduct or prop up arrests based on flimsy evidence and casework, which often goes unquestioned by courts.

Ton-That is, of course, not that naive to think that police won’t use these kinds of capabilities for purposes like profiling or padding out evidence. Again, Clearview’s backstory is full of unsettling ties to right-wing extremists—like the reactionary troll and accused Holocaust denier Chuck C. Johnson—and Ton-That’s track record is full of incidents where it looks an awful lot like he’s exaggerating capabilities or deliberately stoking controversy as a marketing tool. Clearview itself is fully aware of the possibilities for questionable use by police, which is why the company’s marketing once advertised that cops could “run wild” with their tools and the company later claimed to be building accountability and anti-abuse features after getting its hooks into our justice system.

Source: Clearview AI Says It Can Do the ‘Computer Enhance’ Thing

9 Horrifying Facts From the Facebook Whistleblower Interview

Posted on by

Last week, the Wall Street Journal published internal research from Facebook showing that the social media company knows precisely how toxic its own product is for the people who use it. But tonight, we learned how the Journal obtained those documents: A whistleblower named Frances Haugen, who spoke with CBS News’ 60 Minutes about the ways Facebook is poisoning society.

The 37-year-old whistleblower liberated “tens of thousands” of pages of documents from Facebook and even plans to testify to Congress at some point this week. Haugen has filed at least eight complaints with the SEC alleging that Facebook has lied to shareholders about its own product.

Fundamentally, Haugen alleges there’s a key conflict between what’s good for Facebook and what’s good for society at large. At the end of the day, things that are good for Facebook tend to be bad for the world we live in, according to Haugen. We’ve pulled out some of the most interesting tidbits from Sunday’s interview that highlight this central point.

1) Facebook’s algorithm intentionally shows users things to make them angry

Haugen explained to 60 Minutes how Facebook’s algorithm chooses content that’s likely to make users angry because that causes the most engagement. And user engagement is what Facebook turns into ad dollars.

[…]

2) Facebook is worse than most other social media companies

[…]

Haugen previously worked at Pinterest and Google, and insists that Facebook really is worse than the rest of Big Tech in substantial ways.

3) Facebook dissolved its Civic Integrity unit after the 2020 election and before the Jan. 6 Capitol insurrection

Haugen worked at the so-called Civic Integrity unit of Facebook, in charge of combating political misinformation on the platform. But the social media company seemed to think they were in the clear after the U.S. presidential election in November 2020 and that Civic Integrity could be shut down.

[…]

4) Political parties in Europe ran negative ads because it was the only way to reach people on Facebook

[…]

Summarizing the position of political parties in Europe, Haugen explained, “You are forcing us to take positions that we don’t like, that we know are bad for society. We know if we don’t take those positions, we won’t win in the marketplace of social media.”

5) Facebook only identifies a tiny fraction of hate and misinformation on the platform

Facebook’s internal research shows that it identifies roughly; 3-5% of hate on the platform and less than 1% of violence and incitement, according to one of the studies leaked by Haugen.

[…]

6) Instagram is making kids miserable

Facebook owns Intagram, and as 60 Minutes points out, the documents leaked by Haugen show that 13.5% of teen girls say Instagram makes thoughts of sucide worse, and 17% say it makes their eating disorders worse.

[…]

7) Employees at Facebook aren’t necessarily evil, they just have perverse incentives

Haugen says that the people who work at Facebook aren’t bad people, which seems like the kind of thing someone who previously worked at Facebook might say.

[…]

8) Haugen even has empathy for Zuck

[…]

9) Haugen believes she’s covered by whistleblower laws, but we’ll see

[…]

while Dodd-Frank hypothetically protects employees talking with the SEC, it doesn’t necessarily protect people talking with journalists and taking thousands of pages of documents. But we’re going to find out pretty quickly just how much protection whistleblowers actually get in the U.S. Historically, let’s just say the answer has been “not much.”

 

Source: 9 Horrifying Facts From the Facebook Whistleblower Interview

Millions Experience Browser Problems After Long-Anticipated Expiration of IdentTrust DST Root CA X3 SSL Certificate

Posted on by

“The expiration of a key digital encryption service on Thursday sent major tech companies nationwide scrambling to deal with internet outages that affected millions of online users,” reports the Washington Examiner.

The expiring certificate was issued by Let’s Encrypt — though ZDNet notes there’s been lots of warnings about its pending expiration: Digital Shadows senior cyber threat analyst Sean Nikkel told ZDNet that Let’s Encrypt put everyone on notice back in May about the expiration of the Root CA Thursday and offered alternatives and workarounds to ensure that devices would not be affected during the changeover. They have also kept a running forum thread open on this issue with fairly quick responses, Nikkel added.
Thursday night the Washington Examiner describes what happened when the big day arrived: Tech giants — such as Amazon, Google, Microsoft, and Cisco, as well as many smaller tech companies — were still battling with an endless array of issues by the end of the night… At least 2 million people have seen an error message on their phones, computers, or smart gadgets in the past 24 hours detailing some internet connectivity problems due to the certificate issue, according to Scott Helme, an internet security researcher and well-known cybersecurity expert. “So many people have been affected, even if it’s only the inconvenience of not being able to visit certain websites or some of their apps not working,” Helme said.

“This issue has been going on for many hours, and some companies are only just getting around to fixing it, even big companies with a lot of resources. It’s clearly not going smoothly,” he added.

There was an expectation before the certificate expired, Helme said, that the problem would be limited to gadgets and devices bought before 2017 that use the Let’s Encrypt digital certificate and haven’t updated their software. However, many users faced issues on Thursday despite having the most cutting-edge devices and software on hand. Dozens of major tech products and services have been significantly affected by the certificate expiration, such as cloud computing services for Amazon, Google, and Microsoft; IT and cloud security services for Cisco; sellers unable to log in on Shopify; games on RocketLeague; and workflows on Monday.com.
Security researcher Scott Helme also told ZDNet he’d also confirmed issues at many other companies, including Guardian Firewall, Auth0, QuickBooks, and Heroku — but there might be many more beyond that: “For the affected companies, it’s not like everything is down, but they’re certainly having service issues and have incidents open with staff working to resolve. In many ways, I’ve been talking about this for over a year since it last happened, but it’s a difficult problem to identify. it’s like looking for something that could cause a fire: it’s really obvious when you can see the smoke…!”

Digital certificates expert Tim Callan added that the popularity of DevOps-friendly architectures like containerization, virtualization and cloud has greatly increased the number of certificates the enterprise needs while radically decreasing their average lifespan. “That means many more expiration events, much more administration time required, and greatly increased risk of a failed renewal,” he said.

Source: Millions Experience Browser Problems After Long-Anticipated Expiration of ‘Let’s Encrypt’ Certificate – Slashdot

Just How Much Time Do We Spend On Our Phones?

Posted on by

Just How Much Time Do We Spend On Our Phones?

Phones have become so essential that it’s become tough to imagine our lives without them. What’s funny about this is that most people alive today can remember a time when we didn’t have cell phones, let alone smartphones. Even so, it’s difficult to recall exactly how we lived back then.

However, while we all know that our phones have become a big part of our lives, many of us aren’t aware of just how much time we spend looking at these devices. If you had to make a guess, you’d probably say “a lot.” However, that answer isn’t good enough for us. We want to know what’s really going on.

Below you will find a lot of data about how much time we spend on our phones, how this impacts us, both positive and negative, and some tips on developing healthy screen habits and ensuring our phones are having a positive impact on our lives.

How Much Time Do We Spend on Our Phones?

Let’s dive right in with some cold, hard numbers.

In total, we spend around five hours per day looking at our phones.

Yes, this seems like a lot, but if we stop to think about all the time we spend texting, scrolling through social media, watching YouTube videos, streaming Netflix, getting directions, and more, it’s easy to see how this can quickly add up to five hours. Of course, this is an average, so many people spend less, but others spend more.

No matter what, this is a pretty large number, and if we extrapolate it out, here’s how much time we really spend looking at our smartphones:

To put these numbers in context, this means that we spend a little bit less than one-third of our time on this planet looking at our phones, an astronomical number when you stop to think about it. Sure, presenting the numbers like this seems pretty dramatic. Still, if we live to be 75-years-old, we will have spent 15 of those years on our phones.

Is this a good or bad thing? Well, that depends on how you use your phone. Scrolling through social media for hours and hours probably isn’t the best idea, but watching educational YouTube videos doesn’t seem to be quite as bad. Again, it all depends on your perspective. Later on, we’ll discuss some of the potential impacts of too much screen time. For now, sit with the fact that you spend more time looking at your phone than you do going to school as a kid…

Other Phone Usage Statistics

Learning that we spend so much of our lives on our phones begs the question: what are we doing with all this time? Here are some stats that help shed some light on what we’re doing while we’re spending a third of our waking hours on our phones:

More Than Half of All Web Traffic Comes from Phones and Mobile Devices

This stat tells us that one of the biggest things we’re doing when we’re on our phones is searching the web. This could include shopping, social media, reading the news, etc. For some, it might come as a surprise that mobile phones make up such a large portion of overall internet traffic, but if we stop to think how far things have come, it makes sense.

For example, when smartphones first came out, their web browsers were terrible. That is no longer the case, in part because website developers are now forced to make sure a website is mobile-friendly. Also, mobile networks have improved considerably. The prevalence of apps has also helped usher in this mobile revolution.

Here are some other stats that we should all know:

 [1], [2], [3], [4], [5], [6]

Nomophobia: Our Phone Addiction

Given how much we use our phones, it’s normal to wonder: are we addicted?

If this is indeed your question, it turns out you’re not the only one to ask it. Several studies have looked into this very issue, and here’s what they found:

 [1], [2], [3], [4]

The Risks of Too Much Screen Time

Based on the numbers we’ve presented so far, it’s fair to wonder if all this screen time is good for us. At the moment, we don’t know the impact of screen time, though we have some indications.

Below are a few of the complications that can arise if you spend too much time looking at your phone:

Weight Gain/Obesity

No, there is nothing about your phone itself that will make you gain weight. Instead, it’s what we’re doing when we use our phones, mainly sitting down.

Of course, a phone is small enough where you could be doing something physical while looking at it, such as watching a show while running on a treadmill. Still, the vast majority of the time we spend looking at our phones, we spend sitting down contributing to our already sedentary lifestyles.

Obesity is the major public health issue in the United States, and while poor diet and lifestyle habits are to blame, the amount of time we spend sitting and consuming media also plays a role. Therefore, if you’re going to spend this much time on your phone, make sure you’re also making time to move your body and ward off the problems that can come from sitting so much.

Poor Sleep

Because of all our phones can do, it’s common to use them in some capacity before bed. As we saw earlier, the vast majority of people use their phones an hour before they go to bed and an hour after they awake.

Looking at your phone first thing in the morning isn’t going to impact your sleep, though it can take a toll on our mental health if it means we’re not making time for ourselves. Instead, excessive phone time before bed is much more harmful.

This is because our phone screens emit blue light. Our brains can’t distinguish this light from that which shines during the day, so looking at your phone, or any screen for that matter, can mess up your body’s internal clock and disrupt the natural processes that induce sleep.

Many phones now come with blue light filter settings to help deal with this, and while they are effective, they don’t completely solve the problem. Even without the light, looking at your phone before you go to bed means you’re mentally engaged with something at a time when you should be winding down and relaxing for bed. The best thing to do is try and limit the amount of time you look at your phone in the hour leading up to your bedtime.

Eye/Neck Strain and Headaches

Looking at screens for a long time can produce eye strain and headaches, primarily because of the light and because focusing on such a tiny screen for a long time can put undue stress on our eyes.

In addition to this, spending too much time on a phone can also lead to neck pain. When we use our phones, our necks are usually bent down, a posture that puts considerable stress on our spinal cord.

You may not realize this is happening at first, but if you are spending lots and lots of time on your phone, eventually, you will start to experience these pains. When this happens, put the phone down and take a break. Moving forward, pay attention to how you’ve positioned your body when you’re using your phone.

Stress

While our phones are meant to be useful and fun, for some, they can also be quite stressful. This is particularly the case if you use your personal phone for work. You’ll likely get messages at all hours of the day, and this can easily make it feel like you’re always working or that you should be. This is no fun for anyone.

Most of us also use our phones to check the news and social media, two realms that have become, shall we say, a bit negative. Constantly consuming this media is not a good idea, especially if you’re trying to relax. Try to set some limits and some ground rules so that you’re not exposing yourself to too much negativity.

We place a lot of expectations around phone use. For example, it’s become the norm to respond to text messages as soon as we receive and see them. However, this isn’t always ideal. If we don’t set proper boundaries, then our phones can easily overwhelm us. It might begin to feel like people are always trying to reach you and that you must always be available.

To combat this, try to manage expectations. You do not need to respond to messages right away, and if people demand that from you and you don’t want to meet that demand, you have a right to say something. It might take some time to train yourself that not every message or alert you receive is a command to respond, but if you manage to do this, then it’s likely your life will get a bit better.

Communication Breakdown

Lastly, and this is definitely a debatable point, but so much time on our phones has impacted how we communicate. Not only has it dramatically reduced our exposure to all-important non-verbal communication, but it has also started to interfere with our interpersonal interactions. How many times have you been at a social gathering where everyone has their phone out on the table or is actively looking at them while everyone is socializing.

Again, this isn’t necessarily a bad thing, but it is concerning. In-person communication is the best form, and it requires effort and energy. Consider making an effort to keep the phone stashed away while in the presence of others, or at the very least, limit how much you check it during social gatherings.

Some might argue that phones have made us better at communicating since we can do it more often and across long distances, but with the good comes the bad. At the end of the day, the best thing we can do is strive for balance.

How to Use Your Phone Responsibly

We’ve already mentioned some things you can do to make sure you’re using your phone responsibly, but here are a few other things you can do to help you develop a positive relationship with your device.

Take Breaks

Get in the habit of taking breaks from your phone. This has lots of benefits, but one of the most significant is that it gives us the chance to focus. If you’re working on something and are constantly checking your phone, each distraction breaks your attention and slows you down. One time might not be a big deal, but if you do this frequently, it will eat into your productivity and start causing problems in your life.

Make use of the “do not disturb” mode. This blocks all notifications so that you can’t get distracted. Another option is to just simply put your phone in airplane mode from time to time. This might be weird at first, but once you get used to it, you’ll see that it’s a straightforward way to stop yourself from reaching for your phone.

Use Timers

Another option is to use a timer app. These programs allow you to set time limits for specific apps, so you don’t use them as much. Many people put this in place for social media since it’s so easy to get sucked into the vortex and lose lots of time.

Flora is a good app for this, and every time you set a timer, the company plants a tree, which is nice! Another solid option is Space. This app has you take a small quiz when you first download it so that it can find out about your screen habits and develop a plan that’s going to be the most effective at helping you limit screen time.

There are many other apps you could use, so if you’re serious about reducing phone time, spend some time trying a few out to see which one works best for you.

Set Up a Cutoff Time

One simple trick is setting a time in the evening when you stop looking at your phone. If you struggle to do this, there’s a simple solution: turn the phone off!

Voluntarily turning your phone off in this day and age is not exactly a normal thing to do, but you’d be surprised how positive the impact can be. There’s something about having to turn it on to look at it that gets us to stop and think twice before checking the device.

At first, you may experience a bit of anxiety, but after a few times, you’ll likely find that the peace is welcome.

Don’t Sleep With Your Phone

Lastly, a surprising number of people sleep with their phones either in their beds or right next to them. If you want to cut back on how much you use it, then consider breaking this habit. Having it so close to you makes it all too tempting to use it right until the moment you decide to go to bed, which we all know can have some negative consequences. It also encourages you to reach for it the moment you wake up, which can induce stress.

Find a Good Balance

In the end, the phones themselves are neutral. It’s how we choose to use them that can be problematic. This article’s point was to shed some light on just how connected to our phones we’ve become and offer some guidance on how you can achieve a better balance. If you’re someone who uses their phone all the time, making a change might be challenging, but stick with it. You’ll likely experience some benefits. Ultimately, it’s all up to you, and if you’re happy with your phone usage, then we’re happy too!

Source: https://www.cellphonedeal.com/blog/just-how-much-time-do-we-spend-on-our-phones

Edit: https://www.cablecompare.com/blog/children-and-screen-time also has a good reading on this for children

Hackers Rob Thousands Coinbase Customers through SMS MFA Flaw – discloses today, happened around the IPO

Posted on by

Coinbase, a major U.S.-based bitcoin and cryptocurrency exchange, disclosed today that a hacker was able to bypass the company’s SMS multi-factor authentication mechanism and steal funds from 6,000 users, Bleeping Computer reported.

The breach of Coinbase customers’ accounts happened between March and May 20, 2021, in a hacking campaign that combined phishing scams and a vulnerability exploit on the company’s security measures.

The U.S.-based exchange, which has approximately 68 million users from more than 100 countries, reportedly said that in order to conduct the attack, the hackers needed to know the user’s email address, password, and phone number, as well as have access to their email accounts. It is not clear how the hackers gained access to that information.

“In this incident, for customers who use SMS texts for two-factor authentication, the third party took advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account,” Coinbase told customers in electronic notifications.

Beyond stealing funds, the hackers also exposed customers’ personal information, “including their full name, email address, home address, date of birth, IP addresses for account activity, transaction history, account holdings, and balances,” per the report.

[…]

Source: Hackers Rob Thousands Coinbase Customers SMS MFA Flaw – Bitcoin Magazine: Bitcoin News, Articles, Charts, and Guides

The IPO happened in April. There is no way Coinbase didn’t know about this then! Maybe this is related to the heavy selling from company executives?

Knowbots – the first way to search, relevant again?

Posted on by

Back before the search engines, the internet was relatively small but still growing enough that it needed searching. Computers were slower so the speed with which we expect results from Google was impossible. In order to search the internet, Gopher users had Archie, Veroncia and Jughead as well as lists of known Gopher servers – which linked to more lists of known Gopher servers. If you are interested in this system, it’s still online and a good start to look is http://gopher.floodgap.com/gopher/. Another way to search, however, was through Knowbots. These consist of several components

  • A server (the “Knowbot Operating System”, or KOS) that runs on a host to enable it to run Knowbot programs. (In our terminology, this makes it a “Knowbot service station”.)
  • A distributed, replicated namespace server (the “worldroot server”) which provides the shared namespace used by Knowbot programs for navigation and environmental inquiries.
  • Tools to manage, create, submit, monitor and debug Knowbot programs.
  • Tools to monitor and control collections of Knowbot service stations.
  • A library of Python modules for use by Knowbot programs as well as by the support tools.

Usually to access a knowbot you telnet to a certain port and issue commands (and wait) or you email them and wait for a response.

The first knowbots up were Knowbot Information Services (KIS) to search for people.

The Knowbot Information Service (KIS) is another “white pages” service that performs a broad name search, checking MCI Mail, the X.500 White Pages Pilot Project, various Whois servers at various organizations (Whois is yet another directory service), and the UNIX finger command. It can be used either as a client program resident on your local machine, through e-mail, or by Telneting to a public server.

KIS uses subprograms called Knowbots to search for information. Each Knowbot looks for specific information from a site and reports back to the main program with the results.

Two hosts running KIS servers are info.cnri.reston.va.us and regulus.cs.bucknell.edu. You can access either one by electronic mail (send mail to netaddress@nri.reston.va.us, for instance) or using Telnet. (If you Telnet to a KIS server, you need to request port 185: instead of typing telnet regulus.cs.buckness.edu, you’d actually type telnet regulus.cs.buckness.edu 185.)

Because searching can take several minutes, I prefer to use the e-mail method; once KIS knows the results of the search, it mails them back to you.

In the body of your mail message to netaddress, put names of your associates, one per line. You may use first and last names or a login if you know them. Sending johnson will search the default list of directory servers for user johnson. Because KIS checks a predefined set of services, you do not need to supply an organization name to check for.

KIS also includes commands for narrowing your search and searching for an organization. For more help, include the word man in your e-mail to KIS or your interactive session.

Source: https://www.savetz.com/yic/YIC04FI_23.html

The University of Illinois had the following knowbot:

INTERNET ADDRESSES:
	nri.reston.va.us 185
	132.151.1.1 185
	sol.bucknell.edu 185
	134.82.1.8 185

DESCRIPTION:
	Knowbot is an useful information service for locating
someone with an Internet address. Knowbot does not
have its own "white pages" recording internet users like a
telephone book. However, Knowbot can access to other
information services that have their own "white pages"
and search for you. Commands to operate knowbot service
are easy but not very user friendly to first time users.

SERVICES:

Knowbot serves as a gateway for internet users in remote hosts by
sending searching commands to find someone in internet, receiving the
searching results and presenting results in a uniform format for the
user. However, very often the Knowbot search is fruitless, because
of the incomplete information of internet users.

Listed below are remote host accessible to Knowbot. They all have
their own users information pools.
	nic
	mcimail
	ripe
	x500
	finger
	nwhois
	mitwp
	quipu-country
	quipu-org
	ibm-whois
	site-contacts

LOGIN SEQUENCE:
	At system prompt, type 	telnet nri.reston.va.us 185
	systemprompt> 		telnet nri.reston.va.us 185

EXIT SEQUENCE:
	To exit Knowbot, type RquitS at the Knowbot prompt.
	 >quit
	
ACCESS COMMANDS:
	To enact command, type the command at Knowbot
	prompt,
	 >[command]
	 e.g. >help

	Access commands of Knowbot include:
	 >help
		to print a summary of Knowbot commands on
		screen

	 >man
		to print an on-line manual of Knowbot on screen

	 >quit
		to exit Knowbot information system

	 >[name]
		to start searching a name of person with internet
		address
		e.g. >Krol

	 >services
		to list all Knowbot accessible hosts

	 >service [hostname]
		to narrow the search service on a specific host
		e.g. > service nic

	 >org [organization]
		to narrow the search service on a specific
		organization
		e.g. >org University of Illinois

	 >country [country name]
		to narrow the search service on a specific country
		e.g. >country US

SAMPLE LOGIN:
	1. telnet to Knowbot at system prompt
		systemprompt> telnet nri.reston.va.us 185
		
	2. specify the organization of the person to be searched
		> org university of Illinois

	 and/or you may specify the host service
		> service nic
	
	3. type in the name to start searching
		> krol

	4. You may get the following result:

	Name:		Ed Krol
	Organization: 	University of Illinois
	Address:	 	Computing and Communications Service
			 	Office,195 DCL, 1304 West Springfield
			 	Avenue
	City:	 		Urbana
	State:	 	IL
	Country:	 	US
	Zip:	 	 	61801-4399
	Phone:	 	(217) 333-7886
	E-Mail:	 	Krol@UXC.CSO.UIUC.EDU
	Source:	 	whois@nic.ddn.mil
	Ident:	 	EK10
	Last Updated:	27-Nov-91

	5. exit Knowbot	
	 > quit

FRIENDLY ADVICE:
	Since there are no complete recordings of all Internet
	users, it is better not to expect to locate every internaut
	through Knowbot. However, the more you know about
	the person you want to locate, the easier the searching
	process, because you can narrow the search by specifying
	organization, country, or host of the person to be
	searched, which will save you a lot of time.

DOCUMENT AUTHORS: 	Hsien Hu
	 			Irma Garza

Source: https://www.ou.edu/research/electron/internet/knowbot.htm

These knowbots were developed before and during 1995 – NASA had plans for the Iliad knowbot (which gave me much better results than google, altavista, askjeeves or the other search engines of the time for specific tasks) back then.

https://ntrs.nasa.gov/api/citations/19970006511/downloads/19970006511.pdf

or https://www.linkielist.com/wp-content/uploads/2021/10/NASA-knowbots-iliad-19970006511-1.pdf

Iliad was developed as a resource for blind people but it waas realised that it worked well for teachers too. By sending an email to iliad@prime.jsc.nasa.gov you would receive the following reply:

about:blankPreformatted: Change block type or styleAdd titleKnowbots – the first way to search, relevant again?

Back before the search engines, the internet was relatively small but still growing enough that it needed searching. Computers were slower so the speed with which we expect results from Google was impossible. In order to search the internet, Gopher users had Archie, Veroncia and Jughead as well as lists of known Gopher servers – which linked to more lists of known Gopher servers. If you are interested in this system, it’s still online and a good start to look is http://gopher.floodgap.com/gopher/. Another way to search, however, was through Knowbots. These consist of several components

  • A server (the “Knowbot Operating System”, or KOS) that runs on a host to enable it to run Knowbot programs. (In our terminology, this makes it a “Knowbot service station”.)
  • A distributed, replicated namespace server (the “worldroot server”) which provides the shared namespace used by Knowbot programs for navigation and environmental inquiries.
  • Tools to manage, create, submit, monitor and debug Knowbot programs.
  • Tools to monitor and control collections of Knowbot service stations.
  • A library of Python modules for use by Knowbot programs as well as by the support tools.

Usually to access a knowbot you telnet to a certain port and issue commands (and wait) or you email them and wait for a response.

The first knowbots up were Knowbot Information Services (KIS) to search for people.

The Knowbot Information Service (KIS) is another “white pages” service that performs a broad name search, checking MCI Mail, the X.500 White Pages Pilot Project, various Whois servers at various organizations (Whois is yet another directory service), and the UNIX finger command. It can be used either as a client program resident on your local machine, through e-mail, or by Telneting to a public server.

KIS uses subprograms called Knowbots to search for information. Each Knowbot looks for specific information from a site and reports back to the main program with the results.

Two hosts running KIS servers are info.cnri.reston.va.us and regulus.cs.bucknell.edu. You can access either one by electronic mail (send mail to netaddress@nri.reston.va.us, for instance) or using Telnet. (If you Telnet to a KIS server, you need to request port 185: instead of typing telnet regulus.cs.buckness.edu, you’d actually type telnet regulus.cs.buckness.edu 185.)

Because searching can take several minutes, I prefer to use the e-mail method; once KIS knows the results of the search, it mails them back to you.

In the body of your mail message to netaddress, put names of your associates, one per line. You may use first and last names or a login if you know them. Sending johnson will search the default list of directory servers for user johnson. Because KIS checks a predefined set of services, you do not need to supply an organization name to check for.

KIS also includes commands for narrowing your search and searching for an organization. For more help, include the word man in your e-mail to KIS or your interactive session.Source: https://www.savetz.com/yic/YIC04FI_23.html

The University of Illinois had the following knowbot:

INTERNET ADDRESSES:
	nri.reston.va.us 185
	132.151.1.1 185
	sol.bucknell.edu 185
	134.82.1.8 185

DESCRIPTION:
	Knowbot is an useful information service for locating
someone with an Internet address. Knowbot does not
have its own "white pages" recording internet users like a
telephone book. However, Knowbot can access to other
information services that have their own "white pages"
and search for you. Commands to operate knowbot service
are easy but not very user friendly to first time users.

SERVICES:

Knowbot serves as a gateway for internet users in remote hosts by
sending searching commands to find someone in internet, receiving the
searching results and presenting results in a uniform format for the
user. However, very often the Knowbot search is fruitless, because
of the incomplete information of internet users.

Listed below are remote host accessible to Knowbot. They all have
their own users information pools.
	nic
	mcimail
	ripe
	x500
	finger
	nwhois
	mitwp
	quipu-country
	quipu-org
	ibm-whois
	site-contacts

LOGIN SEQUENCE:
	At system prompt, type 	telnet nri.reston.va.us 185
	systemprompt> 		telnet nri.reston.va.us 185

EXIT SEQUENCE:
	To exit Knowbot, type RquitS at the Knowbot prompt.
	 >quit
	
ACCESS COMMANDS:
	To enact command, type the command at Knowbot
	prompt,
	 >[command]
	 e.g. >help

	Access commands of Knowbot include:
	 >help
		to print a summary of Knowbot commands on
		screen

	 >man
		to print an on-line manual of Knowbot on screen

	 >quit
		to exit Knowbot information system

	 >[name]
		to start searching a name of person with internet
		address
		e.g. >Krol

	 >services
		to list all Knowbot accessible hosts

	 >service [hostname]
		to narrow the search service on a specific host
		e.g. > service nic

	 >org [organization]
		to narrow the search service on a specific
		organization
		e.g. >org University of Illinois

	 >country [country name]
		to narrow the search service on a specific country
		e.g. >country US

SAMPLE LOGIN:
	1. telnet to Knowbot at system prompt
		systemprompt> telnet nri.reston.va.us 185
		
	2. specify the organization of the person to be searched
		> org university of Illinois

	 and/or you may specify the host service
		> service nic
	
	3. type in the name to start searching
		> krol

	4. You may get the following result:

	Name:		Ed Krol
	Organization: 	University of Illinois
	Address:	 	Computing and Communications Service
			 	Office,195 DCL, 1304 West Springfield
			 	Avenue
	City:	 		Urbana
	State:	 	IL
	Country:	 	US
	Zip:	 	 	61801-4399
	Phone:	 	(217) 333-7886
	E-Mail:	 	Krol@UXC.CSO.UIUC.EDU
	Source:	 	whois@nic.ddn.mil
	Ident:	 	EK10
	Last Updated:	27-Nov-91

	5. exit Knowbot	
	 > quit

FRIENDLY ADVICE:
	Since there are no complete recordings of all Internet
	users, it is better not to expect to locate every internaut
	through Knowbot. However, the more you know about
	the person you want to locate, the easier the searching
	process, because you can narrow the search by specifying
	organization, country, or host of the person to be
	searched, which will save you a lot of time.

DOCUMENT AUTHORS: 	Hsien Hu
	 			Irma Garza

Source: https://www.ou.edu/research/electron/internet/knowbot.htm


These knowbots were developed before and during 1995 – NASA had plans for the Iliad knowbot (which gave me much better results than google, altavista, askjeeves or the other search engines of the time for specific tasks) back then.

Information Infrastructure Technology Applications (IITA) Program Annual K-12 Workshop April 11 – 13 1995 (PDF)

Iliad was developed as a resource for blind people but it waas realised that it worked well for teachers too. By sending an email to iliad@prime.jsc.nasa.gov you would receive the following reply:

Your question has been received and is being processed by the ILIAD
knowbot.

Responses will be sent to the email address provided in the heading.

You can now specify 

	*outputtype: dwl

(document with links) to receive documents with embedded hot links in the
documents.

For example:

	Subject: iliad query

	*outputtype: dwl
	?q: nasa jsc ltp

An example query response would consist of the documents found and a summary. It was surpisingly well curated. Here is an example summary:

Dear ILIAD User:

This is a summary of the documents sent to you by ILIAD in response to
your email question.  The number order of the summarized documents
corresponds to the number on the individual documents you received.

Your question was:


internet bots automated retrieval=20


Output Type: documents

 1)
"http://navigation.us.realnames.com/resolver.dll?action=resolution&charset
=utf-8&realname=TEKTRAN+%3A+USDA+Technology+Transfer+Automated+Retrieval+S
ystem&providerid=154"
    TEKTRAN : USDA Technology Transfer  Automated  Retrieval
    System   TEKTRAN : USDA Technology Transfer  Automated
    Retrieval System: TEKTRAN : USDA Technology Transfer
    Automated  Retrieval System Click on this
    Internet  Keyword to go directly to the TEKTRAN : USDA
    Technology Transfer  Automated  Retrieval System Web
    site. 1000,http://www.nal.usda.gov/ttic/tektran/tektran.html
    ( Internet Keyword).+\( (\S+).*\)  OCLC
    Internet  Cataloging Project Colloquium Field Report By
    Amanda Xu MIT Libraries When we joined the OCLC Intercat Project, our
    first concern was the feasibility of using MARC formats and AACR2 for
    describing and accessing  Internet  resources of various
    types. 999,http://www.oclc.org/oclc/man/colloq/xu.htm (
    WebCrawler)

 2) "http://www.botspot.com/faqs/article3.htm" BotSpot ® : The Spot
    for all  Bots  & Intelligent Agents   search botspot free
    newsletter  internet.com  internet.commerce PAGE 3 OF
    6 Beyond Browsing... Offline Web Agents by Joel T. Patz is an
excellent
    article comparing the current Offline Web Agents and giving detailed
    explanations and instructions including head-to-head feature
    charts and downloading
    sites. 888,http://www.botspot.com/faqs/article3.htm (
    WebCrawler)

 3) "http://www.insead.fr/CALT/Encyclopedia/ComputerSciences/Agents/"
    Agent Technologies   Agent
    technologies
789,http://www.insead.fr/CALT/Ency...pedia/ComputerSciences/Agents/
    ( WebCrawler)

 4) "http://lonestar.texas.net/disclaimers/aup.html" Acceptable
    Use Policy   Texas.Net Acceptable Use Policy In order for Texas
    Networking to keep your service the best it can be, we have a set of
    guidelines known as our "Acceptable Use Policy." These guidelines
    apply to all customers equally and covers dialup account usage as well
    as mail, news, and other
    services. 480,http://lonestar.texas.net/disclaimers/aup.html
    ( WebCrawler)

 5)
"http://navigation.us.realnames.com/resolver.dll?action=resolution&charset
=utf-8&realname=Automated+Traveller%27s+Internet+Site&providerid=154"
    Automated  Traveller's  Internet  Site
    Automated  Traveller's  Internet  Site: The
    Automated  Traveller-Discounted Airfares
    Worldwide Click on this  Internet  Keyword to go directly to
    the  Automated  Traveller's  Internet  Site Web
    site. 333,http://www.theautomatedtraveller.com/ ( Internet
    Keyword).+\( (\S+).*\)  This site provides you with an
    assortment of search devices along with their brief descriptions.
    Also, you will find recommendations for using specific research tools
    and their combinations that we have found more productive in our own
    research. 284,http://www.brint.com/Sites.htm ( WebCrawler)


The following references were not verified for uniqueness.
You can retrieve any these references by sending ILIAD an email
request in the following format:

        Subject: get url
        url: <the url name>

for example:

        Subject: get url
        url: http://prime.jsc.nasa.gov/iliad/index.html


If you want embedded hot links in the document add "*outputtype: dwl"
before the first url: line

for example:

	Subject: get url

	*outputtype: dwl
	url: http://prime.jsc.nasa.gov/index.html


 1) "http://gsd.mit.edu/~history/search/engine/history.html" A
    History of Search Engines   What's a Robot got to do with the
    Internet ? Other types of robots on the  Internet  push
    the interpretation of the  automated  task definition. The
    chatterbot variety is a perfect
    example. 681,http://gsd.mit.edu/~history/search/engine/history.html
    ( WebCrawler)

 2)
"http://navigation.us.realnames.com/resolver.dll?action=resolution&charset
=utf-8&realname=Automated+Information+Retrieval+Systems+%28AIRS%29&provide
rid=154"
    Automated  Information Retrieval Systems (AIRS)
    Automated  Information Retrieval Systems (AIRS):
    Automated  Information Retrieval Systems (AIRS) Click on
    this  Internet  Keyword to go directly to the  Automated
    Information Retrieval Systems (AIRS) Web
    site. 666,http://www.re-airs.com/ ( Internet Keyword)
    .+\( (\S+).*\)  The  Internet  Communications
    LanguageTM News Events Technology 30-October-1999: Linux World A
    REBOL Incursion It's not a scripting language, not a programming
    language -- and not a new Amiga,
    either. 584,http://www.rebol.com/inthenews.html (
    WebCrawler)

 3)
"http://www.pcai.com/pcai/New_Home_Page/ai_info/intelligent_agents.html"
    PC AI - Intelligent Agents   Requires Netscape 2.0 or later
    compatibility. Intelligent Agents execute tasks on behalf of a
    business process, computer application, or an
    individual.
384,http://www.pcai.com/pcai/New_H...i_info/intelligent_agents.html
    ( WebCrawler)

 4) "http://www.rci.rutgers.edu/~brcoll/search_engines.htm"
    Searching with Style   Motto for the Day: Hypberbole n:
    extravagant exaggeration; see also computer industry. Last Updated:
    November 10, 1996 Very few aspects of the Web are developing as fast
as
    the search engines, except for the sheer volume of
    information. 186,http://www.rci.rutgers.edu/~brcoll/search_engines.htm
    ( WebCrawler)

 5) "http://www.aci.net/kalliste/echelon/ic2000.htm" STOA Report:
    Interception Capabilities 2000   Interception Capabilities
    2000 Report to the Director General for Research of the European
    Parliament (Scientific and Technical Options Assessment programme
    office) on the development of surveillance technology and risk of
    abuse of economic
    information. 89,http://www.aci.net/kalliste/echelon/ic2000.htm
    ( WebCrawler)


Thank you for using ILIAD.  This marks the end of your results.


5 files passed analysis.

Search performed by metacrawler.


End of ILIAD Session ID: SEN38899
---------------------------------------------------------

Illiad could be searched through tenet and msstate and a few other providers:

You can use the well-known e-mail meta-finder
ILIAD (Internet Library Information Access Device) knowbot,
which can be found at <iliad@msstate.edu> or
<iliad@algol.jsc.nasa.gov>. You will receive instructions at the request of
“startiliad” in the subject of the message.

The query sent to the ILIAD server will be sent to several largest
search servers (eg Altavista, Excite, InfoSeek, Lycos,
WebCrawler, …) removes duplicate and overly
irrelevant documents from the results , and
sends the already downloaded pages (without graphics) back within 15 – 20 minutes. You can also try ILIAD on the WWW,
via the form at
<http://www.tenet.edu/library/iliad.html>.

A list of email services can be found here but is copied as these pages are going down pretty quickly

Get webpages via eMail

Several years ago when the Internet connections where slow and the “www” just invented, many people just got a to email restricted access to the Internet. That’s the origin of the “Agora” and “www4email” software. Some of these email robots are still available and we can use them to bypass Internet censorship. The best thing would be to subscribe to a free email provider which allows SSL-connections (like https://www.fastmail.fm/, https://www.ziplip.com/, https://www.hushmail.com/, https://www.safe-mail.net/, https://www.mail2world.com/, https://www.webmails.com/ e.t.c) and use that account with the email addresses below. I put the field where you have to input the URL in brackets. It still works great for text. But sure there are big problems with images or even DHTML, JavaScript, Java, Flash e.t.c. Also other services besides www are possible, for a very good tutorial on this see ftp://rtfm.mit.edu/pub/usenet/news.answers/internet-services/access-via-email. There is also a web based service under http://www.web2mail.com/. I again used www.web.freerk.com/c/ as an example because the URL is all time accessible and the ‘.com’ in the original Google address is often considered as a .com DOS-file by some computers and censorship systems. The www4mail software (http://www.www4mail.org/) is newer than the Agora software.
A eMail with just “help” in the subject line will get you a tutorial on howto use the service properly.

page@grabpage.org
[SUBJECT] url: http://www.web.freerk.com/c/
info: http://www.grabpage.org/

frames@pagegetter.com
[BODY] http://www.web.freerk.com/c/
info: http://www.pagegetter.com/
web@pagegetter.com
[BODY] http://www.web.freerk.com/c/
info: http://www.pagegetter.com/

webgate@vancouver-webpages.com
[BODY] get http://www.web.freerk.com/c/
info: http://vancouver-webpages.com/webgate/

webgate@vancouver-webpages.com
[BODY] mail http://www.web.freerk.com/c/
info: http://vancouver-webpages.com/webgate/

www4mail@wm.ictp.trieste.it
[BODY] http://www.web.freerk.com/c/
info: http://www.ictp.trieste.it/~www4mail/

www4mail@access.bellanet.org
[BODY] http://www.web.freerk.com/c/
info: http://www.bellanet.org/email.html

www4mail@kabissa.org
[BODY] http://www.web.freerk.com/c/
info: http://www.kabissa.org/members/www4mail/

www4mail@ftp.uni-stuttgart.de
[BODY] http://www.web.freerk.com/c/

www4mail@collaborium.org
[BODY] http://www.web.freerk.com/c/
info: http://www.collaborium.org/~www4mail/

binky@junoaccmail.org
[BODY] url http://www.web.freerk.com/c/
info: http://boas.anthro.mnsu.edu/

iliad@prime.jsc.nasa.gov
[SUBJECT] GET URL
[BODY] url:http://www.web.freerk.com/c/
info: http://prime.jsc.nasa.gov/iliad/

Google Search via eMail:
google@capeclear.com
[Subject] search keywords
info: http://www.capeclear.com/google/

More info: http://www.cix.co.uk/~net-services/mrcool/stats.htm
ftp://rtfm.mit.edu/pub/usenet/news.answers/internet-services/access-via-email

Information by Fravia on building them can be found https://www.theoryforce.com/fravia/searchlores/bots.htm – there seems to be a copy up to phase five at http://www.woodmann.com/fravia/botstart.htm

A complete knowbot software suite can be downloaded from https://www.cnri.reston.va.us/home/koe/index.html. This was written by the CNRI [1].

Knowbot programming: System support for mobile agents is another useful overview

A short history (in Czech) can be found here: Vše, co jste chtěli vědět o Internetu… nebojte se zeptat!

Today with the volume of information on the web being so huge, there may be a market for a resurgence of this kind of software. Google realises that it’s fast become impossible to find what you are looking for accurately and has responded by having specific search engines (eg scholar, books, images, shopping, etc) for specific tasks. However for specific fields this is still way too large. A way to handle this would be to have semi-curated search sources added to a knowbot within a very specific field (eg energy, psychology, hardware) allowing you to search easily within expertise. If you can then heuristically detect which field is being searched you can direct the searcher to that specific knowbot.

Google (G00G) Urges EU Judges to Slash ‘Staggering’ $5 Billion Fine

Posted on by

Google called on European Union judges to cut or cancel a “staggering” 4.3 billion euro ($5 billion) antitrust fine because the search giant never intended to harm rivals.

The company “could not have known its conduct was an abuse” when it struck contracts with Android mobile phone makers that required them to take its search and web-browser apps, Google lawyer Genevra Forwood told the EU’s General Court in Luxembourg.

[…]

The European Commission’s lawyer, Anthony Dawes, scoffed at Google’s plea, saying the fine was a mere 4.5% of the company’s revenue in 2017, well below a 10% cap.

[…]

Source: Google (G00G) Urges EU Judges to Slash ‘Staggering’ $5 Billion Fine – Bloomberg

Because Google had never ever heard of Microsoft and the antitrust lawsuits around Internet Explorer? Come on!

Lawsuit prepped against Google for using Brit patients’ data

Posted on by

A UK law firm is bringing legal action on behalf of patients it says had their confidential medical records obtained by Google and DeepMind Technologies in breach of data protection laws.

Mishcon de Reya said today it planned a representative action on behalf of Mr Andrew Prismall and the approximately 1.6 million individuals whose data was used as part of a testing programme for medical software developed by the companies.

It told The Register the claim had already been issued in the High Court.

DeepMind, acquired by Google in 2014, worked with the search software giant and Royal Free London NHS Foundation Trust under an arrangement formed in 2015.

The law firm said that the tech companies obtained approximately 1.6 million individuals’ confidential medical records without their knowledge or consent.

The Register has contacted Google, DeepMind and the Royal Free Hospital for their comments.

“Given the very positive experience of the NHS that I have always had during my various treatments, I was greatly concerned to find that a tech giant had ended up with my confidential medical records,” lead claimant Prismall said in a statement.

“As a patient having any sort of medical treatment, the last thing you would expect is your private medical records to be in the hands of one of the world’s biggest technology companies.

[…]

In April 2016, it was revealed that the web giant had signed a deal with the Royal Free Hospital in London to build an application called Streams, which can analyse patients’ details and identify those who have acute kidney damage. The app uses a fixed algorithm, developed with the help of doctors, so not technically AI.

The software – developed by DeepMind, Google’s AI subsidiary – was first tested with simulated data. But it was tested again using 1.6 million sets of real NHS medical files provided by the London hospital. However, not every patient was aware that their data was being given to Google to test the Streams software. Streams had been deployed inwards, and thus now handles real people’s details, but during development, it also used live medical records as well as simulated inputs.

Dame Caldicott told the hospital’s medical director, Professor Stephen Powis, that he overstepped the mark, and that there was no consent given by people to have their information used in this way pre-deployment.

[…]

In a data-sharing agreement uncovered by the New Scientist, Google and its DeepMind artificial intelligence wing were granted access to current and historic patient data at three London hospitals run by the Royal Free NHS Trust.

Source: Lawsuit prepped against Google for using Brit patients’ data • The Register

New GriftHorse malware has infected more than 10 million Android phones

Posted on by

Security researchers have found a massive malware operation that has infected more than 10 million Android smartphones across more than 70 countries since at least November 2020 and is making millions of dollars for its operators on a monthly basis.

Discovered by mobile security firm Zimperium, the new GriftHorse malware has been distributed via benign-looking apps uploaded on the official Google Play Store and on third-party Android app stores.

Malware subscribes users to premium SMS services

If users install any of these malicious apps, GriftHorse starts peppering users with popups and notifications that offer various prizes and special offers.

Users who tap on these notifications are redirected to an online page where they are asked to confirm their phone number in order to access the offer. But, in reality, users are subscribing themselves to premium SMS services that charge over €30 ($35) per month, money that are later redirected into the GriftHorse operators’ pockets.

[…]

the two Zimperium researchers said that besides numbers, the GriftHorse coders also invested in their malware’s code quality, using a wide spectrum of websites, malicious apps, and developer personas to infect users and avoid detection for as much as possible.

“The level of sophistication, use of novel techniques, and determination displayed by the threat actors allowed them to stay undetected for several months,” Yaswant and Gupta explained.

“In addition to a large number of applications, the distribution of the applications was extremely well-planned, spreading their apps across multiple, varied categories, widening the range of potential victims,”

GriftHorse-app-category
Image: Zimperium

GriftHorse is making millions in monthly profits

Based on what they’ve seen until now, the researchers estimated that the GriftHorse gang is currently making between €1.2 million and €3.5 million per month from their scheme ($1.5 million to $4 million per month).

[…]

Source: New GriftHorse malware has infected more than 10 million Android phones – The Record by Recorded Future

Unpatched flaw creates ‘weaponised’ Apple AirTags

Posted on by

[…]

Should your AirTag-equipped thing not be where you thought it was, you can enable Lost Mode. When in Lost Mode, an AirTag scanned via NFC provides a unique URL which lets the finder get in contact with the loser – and it’s this page where security researcher Bobby Rauch discovered a concerning vulnerability.

“An attacker can carry out Stored XSS on this https://found.apple.com page by injecting a malicious payload into the AirTag ‘Lost Mode’ phone number field,” Rauch wrote in an analysis of the issue. “A victim will believe they are being asked to sign into iCloud so they can get in contact with the owner of the AirTag, when in fact, the attacker has redirected them to a credential hijacking page.

“Other XSS exploits can be carried out as well like session token hijacking, clickjacking, and more. An attacker can create weaponised AirTags and leave them around, victimising innocent people who are simply trying to help a person find their lost AirTag.”

Apple has not commented publicly on the vulnerability nor does it seem to be taking the issue particularly seriously. Speaking to Brian Krebs, Rauch claimed that Apple sat on the flaw for three months – and that while it confirmed it planned to resolve the vulnerability in a future update, the company has not yet done so. Apple also refused to confirm whether Rauch’s discovery would qualify for its bug bounty programme and a potential cash payout – a final insult which led to his public release of the flaw.

It’s not the first time Apple has stood accused of failing to respond to security researchers. Earlier this month a pseudonymous researcher known as “IllusionOfChaos” dropped three zero-day vulnerabilities affecting Apple’s iOS 15 – six months after originally reporting them to the company. A fourth flaw had been fixed in an earlier iOS release, the researcher noted, “but Apple decided to cover it up and not list it on the security content page.”

The company has also been experiencing a few problems with the patches it does release. An update released to fix a vulnerability in the company’s Finder file manager, capable of bypassing the Quarantine and Gatekeeper security functions built into macOS, only worked for lowercase URLs – although emergency patches released two weeks ago appear to have had better luck.

[…]

Source: Unpatched flaw creates ‘weaponised’ Apple AirTags • The Register

CRISPR Gene-Editing Experiment using direct injection Partly Restores Vision In Legally Blind Patients

Posted on by

Carlene Knight’s vision was so bad that she couldn’t even maneuver around the call center where she works using her cane. But that’s changed as a result of volunteering for a landmark medical experiment. Her vision has improved enough for her to make out doorways, navigate hallways, spot objects and even see colors. Knight is one of seven patients with a rare eye disease who volunteered to let doctors modify their DNA by injecting the revolutionary gene-editing tool CRISPR directly into cells that are still in their bodies. Knight and [another volunteer in the experiment, Michael Kalberer] gave NPR exclusive interviews about their experience. This is the first time researchers worked with CRISPR this way. Earlier experiments had removed cells from patients’ bodies, edited them in the lab and then infused the modified cells back into the patients. […]

CRISPR is already showing promise for treating devastating blood disorders such as sickle cell disease and beta thalassemia. And doctors are trying to use it to treat cancer. But those experiments involve taking cells out of the body, editing them in the lab, and then infusing them back into patients. That’s impossible for diseases like [Leber congenital amaurosis, or LCA], because cells from the retina can’t be removed and then put back into the eye. So doctors genetically modified a harmless virus to ferry the CRISPR gene editor and infused billions of the modified viruses into the retinas of Knight’s left eye and Kalberer’s right eye, as well as one eye of five other patients. The procedure was done on only one eye just in case something went wrong. The doctors hope to treat the patients’ other eye after the research is complete. Once the CRISPR was inside the cells of the retinas, the hope was that it would cut out the genetic mutation causing the disease, restoring vision by reactivating the dormant cells.

The procedure didn’t work for all of the patients, who have been followed for between three and nine months. The reasons it didn’t work might have been because their dose was too low or perhaps because their vision was too damaged. But Kalberer, who got the lowest dose, and one volunteer who got a higher dose, began reporting improvement starting at about four to six weeks after the procedure. Knight and one other patient who received a higher dose improved enough to show improvement on a battery of tests that included navigating a maze. For two others, it’s too soon to tell. None of the patients have regained normal vision — far from it. But the improvements are already making a difference to patients, the researchers say. And no significant side effects have occurred. Many more patients will have to be treated and followed for much longer to make sure the treatment is safe and know just how much this might be helping.

Source: CRISPR Gene-Editing Experiment Partly Restores Vision In Legally Blind Patients – Slashdot

China to have insight into and regulate web giants’ algorithms using governance model

Posted on by

China’s authorities have called for internet companies to create a governance system for their algorithms.

A set of guiding opinions on algorithms, issued overnight by nine government agencies, explains that algorithms play a big role in disseminating information online and enabling growth of the digital economy. But the guiding opinions also point out that algorithms employed online can also impact society, and financial markets.

[…]

To achieve its aims, Beijing expects that algo-wielding organisations will create algorithm governance teams to assess their code and detect any security or ethical flaws. Self-regulation is expected, as is continuous revision and self-improvement.

Chinese authorities will watch those efforts and will be unsparing when they find either harmful algorithms, or less-than-comprehensive compliance efforts. Citizen reports of erroneous algos will inform some regulatory actions.

Organisations have been given three years to get this done, with further guidance to come from Beijing.

[…]

Requiring oversight of algorithms suggests that Beijing is worried on two fronts. First, it’s concerned about how automation is already playing out on China’s internet. Second, it has observed that western web giants have used algorithms to increase user engagement in ways that amplify misinformation and that have clearly caused considerable real-world harm.

The new regulations are further evidence that Beijing wants to exercise control over what Chinese citizens can see online. That desire has already seen China crack down on depictions of effeminate men, warn fan clubs not to turn mean, ban racy online content aimed at kids, and crack down on computer games – including those that aren’t historically accurate – and even advise on what songs make for acceptable karaoke.

Source: China to regulate -may censor – web giants’ algorithms • The Register

Leaked Documents Show How Amazon’s Astro Robot Tracks Everything You Do – incompetently

Posted on by

Amazon’s new robot called Astro is designed to track the behavior of everyone in your home to help it perform its surveillance and helper duties, according to leaked internal development documents and video recordings of Astro software development meetings obtained by Motherboard. The system’s person recognition system is heavily flawed, according to two sources who worked on the project.

The documents, which largely use Astro’s internal codename “Vesta” for the device, give extensive insight into the robot’s design, Amazon’s philosophy, how the device tracks customer behavior as well as flow charts of how it determines who a “stranger” is and whether it should take any sort of “investigation activity” against them.

[…]

The meeting document spells out the process in a much blunter way than Amazon’s cutesy marketing suggests.

“Vesta slowly and intelligently patrols the home when unfamiliar person are around, moving from scan point to scan point (the best location and pose in any given space to look around) looking and listening for unusual activity,” one of the files reads. “Vesta moves to a predetermined scan point and pose to scan any given room, looking past and over obstacles in its way. Vesta completes one complete patrol when it completes scanning all the scan point on the floorplan.”

[…]

“Sentry is required to investigate any unrecognized person detected by it or Audio Event in certain set of conditions are met,” one file reads. “Sentry should first try to identify the person if they are not still unrecognized for as long as 30s [seconds]. When the person is identified as unknown or 30s passed, Sentry should start following the person until Sentry Mode is turned off.”

Screen Shot 2021-09-28 at 2.33.19 PM.png

A flow chart presented during the meeting explains exactly what happens when Astro detects a “presence” and how it is designed for “investigating strangers.” If a user has disabled “stranger investigation,” the robot will ignore a stranger. If it’s set to “Sentry mode” or a patrol mode, it will either approach the stranger or follow them, and begin a series of “investigation activities,” which Amazon describes as “a series of actions Sentry takes to investigate audio or presence while recording.” Generally, if Astro begins an investigation, it will follow the stranger, record audio and video of them, and then automatically upload a recording the user can view later.

[…]

Developers who worked on Astro say the versions of the robot they worked on did not work well.

“Astro is terrible and will almost certainly throw itself down a flight of stairs if presented the opportunity. The person detection is unreliable at best, making the in-home security proposition laughable,” a source who worked on the project said. “The device feels fragile for something with an absurd cost. The mast has broken on several devices, locking itself in the extended or retracted position, and there’s no way to ship it to Amazon when that happens.”

[…]

Another source who worked on the project mentioned privacy and navigation as chief concerns. “As for my personal opinions on the device, it’s a disaster that’s not ready for release,” they said. “They break themselves and will almost certainly fall down stairs in real world users’ homes. In addition it’s also (in my opinion) a privacy nightmare that is an indictment of our society and how we trade privacy for convenience with devices like Vesta.”

The source also corroborated that Astro’s facial recognition abilities perform poorly, which is concerning for a device designed mainly to follow people around and determine if they’re a stranger or not.

[…]

“The goal is to make Vesta an ‘intelligent robot,’ and allow some simple but magical interactions with people,” the social robotics document states. To do this, Astro needs to fully map a user’s home, creating a heat map of “choke points” and highly trafficked areas where the robot is likely to get stuck or “places where it will easily get hit by humans” such as hallways, doorways, and the kitchen.

Screen Shot 2021-09-28 at 2.58.52 PM.png

A map of a user’s home, with “choke points” in red

Astro is supposed to learn over time, meaning that it must track what humans are doing, where they are going, and where they are likely to congregate.

[…]

 

Source: Leaked Documents Show How Amazon’s Astro Robot Tracks Everything You Do

Face ID on the iPhone 13 stops working if a third-party replaces the phone’s display

Posted on by

With the addition of features like a 120Hz display on some models, Apple’s iPhone 13 lineup is many ways a step above the phones the company shipped last year. But when it comes to the question of repairability, the story is more complicated. Conducting a teardown of the device, iFixit found it couldn’t get the iPhone 13’s Face ID feature to work if replaced the phone’s display. No matter what workaround it tried, iFixit could not get Face ID to work again. By its estimation, the display on the iPhone 13 lineup is serial-locked to the device. “Right now, if you replace your screen, Apple kills your Face ID, unless they control the repair,” the company warns.

While obviously not a good look for Apple, there may be a simple explanation for what’s happening. iFixit says it spoke to a licensed repair technician who said they were told by Apple support that the issue is a bug the company plans to fix in a future iOS release. We’ve reached out to Apple for more information. If it turns that limitation is not a mistake, it would be a brazen move on Apple’s part given that the FTC, at the behest of President Joe Biden, recently voted unanimously to tackle unlawful repair restrictions.

Source: Face ID on the iPhone 13 stops working if a third-party replaces the phone’s display | Engadget

A Tesla Big Battery Is Getting Sued Over Power Grid Failures In Australia for not providing promised backup

Posted on by

Tesla’s Big Battery, located in southern Australia, just got hit with a federal lawsuit for failing to provide the crucial grid support it once promised it could.

Built by Tesla in 2017, the 150-megawatt battery supplies 189 megawatt-hours of storage and was designed to support the grid when it becomes overloaded. Now operated by French renewable energy producer Neoen, it supplies storage for the adjacent Hornsdale wind farm, using clean energy to fill gaps that coal power leaves behind. It made waves at the time of its construction for being the largest lithium-ion battery in the world—though it’s now been superseded by another Tesla battery, the 300-megawatt Victorian Big Battery, also in Australia, which caught fire in July.

On Wednesday, the Australian Energy Regulator (AER), the body that oversees the country’s wholesale electricity and gas markets, announced it had filed a federal lawsuit against the Hornsdale Power Reserve (HPR)—the energy storage system that owns the Tesla battery—for failing to provide “frequency control ancillary services” numerous times over the course of four months in the summer and fall of 2019. In other words, the battery was supposed to supply grid backup when a primary power source, like a coal plant, fails.

The HPR’s alleged pattern of failures was first brought to light during a disruption to a nearby coal plant in 2019, according to the regulator. When the nearby Queensland’s Kogan Creek power station tripped on October 9, 2019, the HPR was called on to offer grid backup, having made offers to the Australian Energy Market Operator (AEMO) to do so.

But the power reserve failed to provide the level of grid support that AEMO expected, and, in fact, was never able to do so in the first place, the lawsuit alleges, despite making money off of offering them. Though HPR did step in eventually, and no outages were recorded, the incident spurred investigation into a number of similar failures over the course of July to November 2019. The reserve’s failure to support the grid in the way it promised created “a risk to power system security and stability,” a press release on the lawsuit says.

“Contingency FCAS providers receive payment from AEMO to be on standby to provide the services they offer,” Clare Savage, chair of AER, said in a press release on the suit. “We expect providers to be in a position, and remain in a position, to respond when called upon by AEMO.”

[…]

Source: A Tesla Big Battery Is Getting Sued Over Power Grid Failures In Australia

Samsung’s has larger, stretchier OLED display that looks a bit like a rubber sheet

Posted on by

Hot on the heels of LG’s “Real Folding Window” showcase, Samsung is taking its moment to shine with a new stretchable OLED display demo.

At this week’s Global Tech Korea 2021, Samsung presented an impressive 13-inch OLED panel that appears to stretch at varying degrees. The panel displayed a video of lava flowing while different sections rose and fell as if to mimic the flow of the lava and thus adding another level of 3D immersion to the content.

According to Changhee Lee, executive vice president of Samsung Display, the degree at which stretchable displays could be deformed “was about 5% in the past, but now it has improved significantly,” going on to suggest that the company plans to use this technology in future products like rollable smartphones and more (via ETNews).

This isn’t the first time Samsung showcased impressive display technology aimed at future form factors. Earlier this year, the company presented a video showing off display concepts like a slideable smartphone, a display that folds in two parts, and folding tablets. The company has also shown off an earlier concept of its stretchable display technology back in 2017, although the panel was smaller at 9.1-inches.

[…]

Source: Samsung’s larger, stretchier OLED display technology is creepy and cool | Android Central

Bing Search Results Erases Images Of ‘Tank Man’ On Anniversary Of Tiananmen Square Crackdown (2021)

Posted on by

On the 32nd anniversary of the Tiananmen Square protests, internet users noticed Microsoft’s Bing search engine was producing some interesting results. Or, rather, it wasn’t producing expected search results for some possibly interesting reasons.

Users searching for the most iconic image of the protests — that of the unidentified person known only as “Tank Man” — were coming up empty. It appeared that Microsoft’s search engine was blocking results for an image that often serves as shorthand for rebellion against the Chinese government.

As was reported by several web users, followed by several news outlets, the apparent blocking of search results could be observed in both the United States and the United Kingdom, leaving users with the impression the Chinese government had pressured Microsoft to moderate search results for “tank man” in hopes of reducing any remembrance of the Tiananmen Square Massacre, which resulted in the deaths of 2,500-3,500 protesters.

The apparent censorship was blamed on Microsoft’s close relationship with the Chinese government, which allowed its search engine to be accessed by Chinese residents in exchange for complying with government censorship requests.

This led to Microsoft being criticized by prominent politicians for apparently allowing the Chinese government to dictate what users around the world could access in relation to the Tiananmen Square protests.

[…]

Shortly after the apparent censorship of the iconic “Tank Man” image was reported, Microsoft claimed the very timely removal of relevant search results was the byproduct of “accidental human error.”

However, the company refused to offer any additional explanation. And, while searching the term “Tank Man” produced search results in Bing, it did not generate the expected results.

Image via The Verge

Several hours after the first “fix,” things returned to normal, with “Tank Man” searches bringing up the actual Tank Man, rather than just tanks or tanks with men near or on the tanks.

Image via Twitter user Steven F

More clarification and comment was sought, but Microsoft apparently had nothing more to say about this “human error” and its conspicuous timing. Nor did it offer any details on whether or not this “human error” originated with its Beijing team. It also didn’t explain why the first fix resulted in images very few people would associate with the term “Tank Man.”

Source: Content Moderation Case Study: Bing Search Results Erases Images Of ‘Tank Man’ On Anniversary Of Tiananmen Square Crackdown (2021) | Techdirt

Marvel Files Lawsuit to Keep Iron Man, Spider-Man Rights From Creators

Posted on by

The families of iconic Marvel comic book writers and artists Stan Lee, Steve Ditko, Don Heck, Gene Colan, and Don Rico have filed termination of copyright notices on the superheroes they helped create. Marvel—which Disney has owned since 2009—unsurprisingly, disagrees and has filed lawsuits against all five to keep the characters in the Marvel stable and making the company billions.

The Hollywood Reporter broke the news. Without trying to get into too much legalese, creators can file termination of copyright notices to reclaim rights to their work after a set amount of time, with a minimum of 35 years. Marvel’s suits argue that the characters are ineligible for copyright termination because they were made as “work-for-hire”—as in Marvel paid people to create characters for the company, meaning the company owns them outright. According to the report, if the creators’ heirs notices were accepted, Marvel would lose rights to characters including Iron Man, Spider-Man, Hawkeye, Black Widow, Doctor Strange, Falcon, Ant-Man, and more. One caveat is this only matters in the United States. According to THR, even if Marvel loses, Disney can continue making money off the characters everywhere else. If the heirs win, Disney would still share ownership.

Since Marvel has pro-actively sued to keep the copyrights to these characters, I suppose the creators’ claims have some validity to them, but as a layman, the case looks hopeless to me. Not only does the Walt Disney Company have the infinite cash reserves to keep the rights tied up with them for years, but there have been previous cases where Marvel creators have claimed ownership and had to settle. Additionally, the lawyer representing the heirs is Marc Toberoff, who also represented the families of Superman creators Joe Shuster and Jerry Siegel when they tried to terminate DC Comics’ rights to the Man of Steel. DC was successfully represented by Dan Petrocelli—and he’s the one who just filed the lawsuits for Marvel.

More likely, the case will ultimately be about paying people some kind of fair compensation for turning Marvel into a billion-dollar company, which Disney has no desire to do (remember, Disney’s reportedly been paying creators a mere $5,000 for work it’s made those billions on). This is unfair, immoral, and purely greedy; the company has more than enough money to make all of these creators rich without coming close to losing a profit. In the best-case scenario, Disney/Marvel will give these folks as little as possible to make these legal annoyances go away early. It won’t be nearly as much as the company could and should give them, but at least it’ll be something.

Source: Marvel Files Lawsuit to Keep Iron Man, Spider-Man Rights From Creators

Even the fact that there is copyright on these characters still after the original creators have died is downright ridiculous

Apple’s App Tracking Transparency Feature Doesn’t Stop Tracking

Posted on by

In 2014, some very pervy creeps stole some very personal iCloud photos from some very high-profile celebs and put them on the open web, creating one very specific PR crisis for Apple’s CEO, Tim Cook. The company was about to roll out Apple Pay as part of its latest software update, a process that took more than a decade bringing high-profile payment processors and retailers on board. The only issue was that nobody seemed to want their credit card details in the hands of the same company whose service had been used to steal dozens of nude photos of Jennifer Lawrence just a week earlier.

Apple desperately needed a rebrand, and that’s exactly what we got. Within days, the company rolled out a polished promotional campaign—complete with a brand new website and an open letter from Cook himself—explaining the company’s beefed-up privacy prowess, and the safeguards adopted in the wake of that leak. Apple wasn’t only a company you could trust, Cook said, it was arguably the company—unlike the other guys (*cough* Facebook *cough*) who built their Silicon Valley empires off of pawning your data to marketing companies, Apple’s business model is built off of “selling great products,” no data-mining needed.

That ad campaign’s been playing out for the last seven years, and by all accounts, it’s worked. It’s worked well enough that in 2021, we trust Apple with our credit card info, our personal health information, and most of what’s inside our homes. And when Tim Cook decried things like the “data-industrial complex” in interviews earlier this year and then rolled out a slew of iOS updates meant to give users the power they deserved, we updated our iPhones and felt a tiny bit safer.

The App Tracking Transparency (ATT) settings that came bundled in an iOS 14 update gave iPhone users everywhere the power to tell their favorite apps (and Facebook) to knock off the whole tracking thing. Saying no, Apple promised, would stop these apps from tracking you as you browse the web, and through other apps on your phone. Well, it turns out that wasn’t quite the case. The Washington Post was first to report on a research study that put Apple’s ATT feature to the test, and found the setting… pretty much useless. As the researchers put it:

In our tests of ten top-ranked apps, we found no meaningful difference in third-party tracking activity when choosing App Tracking Transparency’s “Ask App Not To Track.” The number of active third-party trackers was identical regardless of a user’s ATT choice, and the number of tracking attempts was only slightly (~13%) lower when the user chose “Ask App Not To Track”.

So, what the hell happened? In short, ATT addresses one specific (and powerful) piece of digital data that advertisers use to identify your specific device—and your specific identity—across multiple sites and services: the so-called ID for Advertisers, or IDFA. Telling an app not to track severs their access to this identifier, which is why companies like Facebook lost their minds over these changes. Without the IDFA, Facebook had no way to know whether, say, an Instagram ad translated into a sale on some third-party platform, or whether you downloaded an app because of an ad you saw in your news feed.

Luckily for said companies (but unluckily for us), tracking doesn’t start and end with the IDFA. Fingerprinting—or cobbling together a bunch of disparate bits of mobile data to uniquely identify your device—has come up as a pretty popular alternative to some major digital ad companies, which eventually led Apple to tell them to knock that shit off. But because “fingerprinting” encompasses so many different kinds of data in so many different contexts (and can go by many different names), nobody knocked anything off. And outside of one or two banned apps, Apple really didn’t seem to care.

[…]

Some Apple critics in the marketing world have been raising red flags for months about potential antitrust issues with Apple’s ATT rollout, and it’s not hard to see why. It gave Apple exclusive access to a particularly powerful piece of intel on all of its customers, the IDFA, while leaving competing tech firms scrambling for whatever scraps of data they can find. If all of those scraps become Apple’s sole property, too, that’s practically begging for even more antitrust scrutiny to be thrown its way. What Apple seems to be doing here is what any of us would likely do in its situation: picking its battles.

Source: Apple’s App Tracking Transparency Feature Doesn’t Stop Tracking

110,000 Affected by Epik Breach – Including Those Who Trusted Epik to Hide Their Identity as hate mongerers

Posted on by

Epik’s massive data breach is already affecting lives. Today the Washington Post describes a real estate agent in Pompano Beach who urged buyers on Facebook to move to “the most beautiful State.” His name and personal details “were found on invoices suggesting he had once paid for websites with names such as racisminc.com, whitesencyclopedia.com, christiansagainstisrael.com and theholocaustisfake.com”. The real estate brokerage where he worked then dropped him as an agent. The brokerage’s owner told the Post they didn’t “want to be involved with anyone with thoughts or motives like that.”

“Some users appear to have relied on Epik to lead a double life,” the Post reports, “with several revelations so far involving people with innocuous day jobs who were purportedly purveyors of hate online.” (Alternate URL here.) Epik, based outside Seattle, said in a data-breach notice filed with Maine’s attorney general this week that 110,000 people had been affected nationwide by having their financial account and credit card numbers, passwords and security codes exposed…. Heidi Beirich, a veteran researcher of hate and extremism, said she is used to spending weeks or months doing “the detective work” trying to decipher who is behind a single extremist domain. The Epik data set, she said, “is like somebody has just handed you all the detective work — the names, the people behind the accounts…”

Many website owners who trusted Epik to keep their identities hidden were exposed, but some who took additional precautions, such as paying in bitcoin and using fake names, remain anonymous….

Aubrey “Kirtaner” Cottle, a security researcher and co-founder of Anonymous, declined to share information about the hack’s origins but said it was fueled by hackers’ frustrations over Epik serving as a refuge for far-right extremists. “Everyone is tired of hate,” Cottle said. “There hasn’t been enough pushback, and these far-right players, they play dirty. Nothing is out of bounds for them. And now … the tide is turning, and there’s a swell moving back in their direction.”
Earlier in the week, the Post reported: Since the hack, Epik’s security protocols have been the target of ridicule among researchers, who’ve marveled at the site’s apparent failure to take basic security precautions, such as routine encryption that could have protected data about its customers from becoming public… The hack even exposed the personal records from Anonymize, a privacy service Epik offered to customers wanting to conceal their identity.

Source: 110,000 Affected by Epik Breach – Including Those Who Trusted Epik to Hide Their Identity – Slashdot

Microsoft Exchange protocol can leak credentials cleartext

Posted on by

A flaw in Microsoft’s Autodiscover protocol, used to configure Exchange clients like Outlook, can cause user credentials to leak to miscreants in certain circumstances.

The upshot is that your Exchange-connected email client may give away your username and password to a stranger, if the flaw is successfully exploited. In a report scheduled to be published on Wednesday, security firm Guardicore said it has identified a design blunder that leaks web requests to Autodiscover domains that are outside the user’s domain but within the same top-level domain (TLD).

Exchange’s Autodiscover protocol, specifically the version based on POX XML, provides a way for client applications to obtain the configuration data necessary to communicate with the Exchange server. It gets invoked, for example, when adding a new Exchange account to Outlook. After a user supplies a name, email address, and password, Outlook tries to use Autodiscover to set up the client.

As Guardicore explained in a report provided to The Register, the client parses the email address – say, user@example.com – and tries to construct a URL for the configuration data using combinations of the email domain, a subdomain, and a path string as follows:

  • https://Autodiscover.example.com/Autodiscover/Autodiscover.xml
  • http://Autodiscover.example.com/Autodiscover/Autodiscover.xml
  • https://example.com/Autodiscover/Autodiscover.xml
  • http://example.com/Autodiscover/Autodiscover.xml

If the client doesn’t receive any response from these URLs – which would happen if Exchange was improperly configured or was somehow prevented from accessing the designated resources – the Autodiscover protocol tries a “back-off” algorithm that uses Autodiscover with a TLD as a hostname. Eg:

  • http://Autodiscover.com/Autodiscover/Autodiscover.xml

“This ‘back-off’ mechanism is the culprit of this leak because it is always trying to resolve the Autodiscover portion of the domain and it will always try to ‘fail up,’ so to speak,” explained Amit Serper, Guardicore area vice president of security research for North America, in the report. “This means that whoever owns Autodiscover.com will receive all of the requests that cannot reach the original domain.”

In an email to The Register, Serper said, “I believe that this was the consequence of careless, or rather, naïve design. [The] same flaws appear in other Microsoft protocols of similar functions.”

Sensing a potential problem with making credentials available to any old TLD with Autodiscover, Guardicore acquired several variations on that theme: Autodiscover.com.br, Autodiscover.com.cn, Autodiscover.com.co, Autodiscover.uk, and Autodiscover.online, among others.

After assigning these domains to its web server, Guardicore started receiving numerous requests to Autodiscover endpoints from assorted IP addresses and clients. It turns out a lot of Exchange servers and clients aren’t set up very carefully.

… with the Authorization header already populated with credentials in HTTP basic authentication

“The most notable thing about these requests was that they requested the relative path of /Autodiscover/Autodiscover.xml with the Authorization header already populated with credentials in HTTP basic authentication,” said Serper, who observed that web requests of this sort should not be sent blindly pre-authentication.

HTTP basic access authentication is Base64 encoded but is not encrypted, so this amounts to sending credentials in cleartext.

Between April 16, 2021 and August 25, 2021, Guardicore received about 649,000 HTTP requests aimed at its Autodiscover domains, 372,000 requests with credentials in basic authentication, and roughly 97,000 unique pre-authentication requests.

The credentials came from publicly traded companies in China, food makers, investment banks, power plants, energy delivery firms, real estate businesses, shipping and logistics operations, and fashion/jewelry companies.

There were also many requests that used alternatives to HTTP basic authentication, like NTLM and Oauth, that didn’t expose associated credentials immediately. To obtain access to these, Guardicore set up a downgrade attack.

So upon receiving an HTTP request with an authentication token or NLTM hash, the Guardicore server responded with an HTTP 401 with the WWW-Authenticate: basic header, which tells the client that the server only supports HTTP basic authentication. Then to make the session look legit, the company used a Let’s Encrypt certificate to prevent an SSL warning and ensure the presentation of a proper Outlook authentication prompt so potential victims enter their credentials with confidence.

[…]

Source: Microsoft Exchange protocol can leak credentials • The Register

Apple Confirms Fortnite Won’t Come Back to iPhones Anytime Soon

Posted on by

Today, Tim Sweeney confirmed on Twitter just how massive of an “L” Epic took in its recent trial against Apple. Apple has effectively “blacklisted” Fortnite from all Apple products until the legal clash between the two massive corporations reaches its conclusion, which could take as long as five years. (It’s even longer in Peely years.)

In the tweet, Sweeney posted a letter Epic had received from Apple confirming that Epic’s Apple developer account will not be reinstated, and that Epic cannot even request reinstatement until “the court’s judgement becomes final and unappealable.” That can take up to five years, according to Sweeney, who also claims that this is a renege on Apple’s previous position expressed to both the court and the press. However, given that Epic is currently trying to appeal the decision, I’d argue that Apple’s reticence to let it return to the platform makes perfect sense.

This letter reinforces the reality of this trial, that both Epic and Apple resoundingly lost. There was no court order to get Fortnite back on the store, and Apple lost its ability to refuse payments outside of its ecosystem. Both massive corporations lost, and all other developers will reap the rewards of Epic’s hubris.

[…]

 

Source: Apple Confirms Fortnite Won’t Come Back to iPhones Anytime Soon

I’m not sure Epic minds so much, considering Apples are only used by parents, but it sure shows how childish Apple is.

Lithuania tells citizens to throw Xiaomi mobiles away for censoring functionality

Posted on by

In an audit it published yesterday [PDF] the agency called out Xiaomi’s Mi 10T 5G phone handset firmware for being able to censor terms such as “Free Tibet”, “Long live Taiwan independence” or “democracy movement”.

Defence Deputy Minister Margiris Abukevicius told reporters at the audit’s release: “Our recommendation is to not buy new Chinese phones, and to get rid of those already purchased as fast as reasonably possible.”

Although the censorship setting was disabled for phones sold into the manufacturer’s “European region”, the Lithuanian NCSC said (page 22):

It has been established that during the initialisation of the system applications factory-installed on a Xiaomi Mi 10T device, these applications contact a server in Singapore at the address globalapi.ad.xiaomi.com (IP address 47.241.69.153) and download the JSON file MiAdBlacklistConfig, and save this file in the metadata catalogues of the applications.

That file contained a list of more than 400 terms, including “free Tibet”, “89 Democracy Movement” (a reference to Tiananmen Square) and “long live Taiwan’s independence”.

The local security agency’s 32-page report, titled “Assessment of cybersecurity of mobile devices supporting 5G technology sold in Lithuania”, focused on devices from Xiaomi, Huawei and OnePlus.

“It is believed that this functionality allows a Xiaomi device to perform an analysis of the target multimedia content entering the phone; to search for keywords based on the MiAdBlacklist list received from the server,” said the Lithuanian report.

“Once the device determines that the content contains certain keywords, the device performs filtering of this content and the user cannot see it. The principle of data analysis allows analysis not only of words written in letters; the list that is regularly downloaded from the server can be formed in any language.”

The agency said the censorship could be remotely re-enabled at any time by Xiaomi.

Source: Lithuania tells citizens to throw Xiaomi mobiles away • The Register

Ministry of Defence: Another huge Afghanistan email blunder

Posted on by

A second leak of personal data was reportedly committed by the Ministry of Defence, raising further questions about the ministry’s commitment to the safety of people in Afghanistan, some of whom are its own former employees.

The BBC reported overnight that the details of a further 55 Afghans  – claimed to be candidates for potential relocation – had been leaked through the classic cc-instead-of-bcc email blunder, echoing the previously reported breach of 250 Afghan interpreters’ data through a similar failure.

An MoD spokeswoman said in a statement: “We have been made aware of a data breach that occurred earlier this month by the Afghan Relocation and Assistance Policy (Arap) team. This week, the defence secretary instigated an investigation into data-handling within that team.”

A defence official has reportedly been suspended from duty, following demands from defence secretary Ben Wallace for an immediate enquiry into how the blunder happened.

After the US-led military coalition left Afghanistan, a number of local civilians employed as translators were left behind as the Taliban re-established control over the country. Some of those civilians have since been murdered for their perceived support of the Western militaries.

[…]

Source: Ministry of Defence: Another huge Afghanistan email blunder • The Register