The Linkielist

Linking ideas with the world

The Linkielist

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Net neutrality lives… in Europe, anyway: Top court supports open internet rules, snubs telcos and ISPs

Europe’s top court has decided that the continent’s network neutrality rules will stand, rejecting challenges from the telecoms industry.

In a ruling [PDF] on Tuesday, the Court of Justice of the European Union (CJEU) decided that “the requirements to protect internet users’ rights and to treat traffic in a non-discriminatory manner preclude an internet access provider from favouring certain applications and services.”

Or, in other words, people come before telco business models. And that includes the edge case of “zero tariff” arrangements where data caps don’t apply to specific apps or services that the ISP or telco designates. Picture a broadband provider allowing, say, Netflix streams to not count toward subscribers’ monthly download limits, which squeezes Netflix’s competitors out of the market. Blocking access to, traffic slowdowns of, and “fast lanes” for specific applications are also out.

The decision was welcomed by consumer-rights groups and internet companies, though ISPs and telcos are disappointed: they feel the net neutrality rules are too restrictive, and prevent them from bringing in new revenue to replace falling income from traditional telephone lines.

The judgment came after a Hungarian court asked for guidance when one of its telcos, Telenor Magyarorszag, offered a zero-tariff option to subscribers. The country’s technology regulator said that approach broke Europe’s net neutrality rules, which were passed back in 2015, and the telco challenged its decision.

It is, to the best of our knowledge, the first time the CJEU has weighed in on the open internet. Interest in the case was made clear by the number of comments from countries’ governments that were submitted to the court for review: Austria, the Czech Republic, Finland, Germany, the Netherlands, Romania, and Slovenia all weighed in.

[…]

The court said its interpretation of the relevant regulations was that no company had the right to limit people’s right to an open internet and that people exercised those rights “via their internet access service.”

[…]

And, just to stick the knife in, it argued that any “measures blocking or slowing down traffic are based not on objectively different technical quality of service requirements for specific categories of traffic, but on commercial considerations, those measures must in themselves be regarded as incompatible with Article 3(3).”

In essence, Europe’s top court decided that money does not come before people’s rights. In the United States, meanwhile, the issue of net neutrality has everything to do with money.

[…]

Source: Net neutrality lives… in Europe, anyway: Top court supports open internet rules, snubs telcos and ISPs • The Register

Brit MPs to Apple CEO: Please stop ignoring our questions about repairability and the environment

The UK’s Environmental Audit Committee (EAC) says Apple is still not answering questions relating to its record on the environmental sustainability and repairability of its iStuff.

The EAC – a sounder of Members of Parliament that sit on the select committee in the House of Commons – asked the American company to get involved in the Electronic Waste and Circular Economy inquiry, and Apple had been due to appear before MPs on 16 July but “cancelled is appearance at short notice”.

Committee chairman the Right Honourable Sir Philip Dunne, an MP for Ludlow constituency in Shropshire, then penned a letter [PDF] to Apple boss Tim Apple Cooke early last month and requested a response by Friday last week, 4 September, but the EAC is “yet to receive a substantive reply”, it said.

The contents of the letter, revealed today, points out the anxiety related to the social and environmental footprint of the electronics industry, brought into focus by a United Nations report in July that showed 53.6 million tonnes of so-called e-waste was produced in 2019, up 21 per cent in five years.

Smaller gadgets are often the hardest to collect and recycle, and Apple is one of the largest manufacturers of such equipment worldwide, hence its invitation to partake in the inquiry, EAC said.

In his missive to Cook, Dunne asked 13 questions, including how Apple was tackling past and future carbon emissions; the auditing of third-party emissions in Apple’s supply chain; whether the high price of fixing Apple kit was affecting repairability; what Apple was doing to improve repairability of products; whether Apple would support legislation for repairability standards; what it was doing to take back items being replaced; and a query around plastic packaging.

The timing of this release is very deliberate, coming as Apple prepares to broadcast a live event from California with a slew of new products from next-generation phones to watches, iPads and other gear.

“Apple has made more than two billion iPhones – a phone for every person in the whole of Africa and Europe,” said Dunne in a statement. “Today, as Apple unveils its next generation of gadgets, my committee continues to wait for answers on what the company is doing to tackle its environmental footprint.”

[…]

For its part, Apple claimed previously that it loses money by repairing customers’ gadgets, which rather flies in the face of Apple’s reluctance to allow independent repair shops to do their thing.

In its 2020 Environmental Progress Report, Apple pledged to reduce 75 per cent of its carbon emissions by 2030 and develop “innovative carbon removal solutions for the remaining 25 percent of its comprehensive footprint”. The highlights of that report can be found here.

Source: Brit MPs to Apple CEO: Please stop ignoring our questions about repairability and the environment • The Register

European Police Malware Could Harvest GPS, Messages, Passwords, More from Encrochat devices

The malware that French law enforcement deployed en masse onto Encrochat devices, a large encrypted phone network using Android phones, had the capability to harvest “all data stored within the device,” and was expected to include chat messages, geolocation data, usernames, passwords, and more, according to a document obtained by Motherboard.

The document adds more specifics around the law enforcement hack and subsequent takedown of Encrochat earlier this year. Organized crime groups across Europe and the rest of the world heavily used the network before its seizure, in many cases to facilitate large scale drug trafficking. The operation is one of, if not the, largest law enforcement mass hacking operation to date, with investigators obtaining more than a hundred million encrypted messages.

“The NCA has been collaborating with the Gendarmerie on Encrochat for over 18 months, as the servers are hosted in France. The ultimate objective of this collaboration has been to identify and exploit any vulnerability in the service to obtain content,” the document reads, referring to both the UK’s National Crime Agency and one of the national police forces of France.

As well as the geolocation, chat messages, and passwords, the law enforcement malware also told infected Encrochat devices to provide a list of WiFi access points near the device, the document reads.

[…]

Encrochat was a company that offered custom-built phones that sent end-to-end encrypted messages to one another. Encrochat took a base Android device, installed its own software, and physically removed the GPS, microphone, and camera functionality to lock down the devices further. These modifications may have impacted what sort of data the malware was actually able to obtain once deployed. Encrochat phones had a panic wipe feature, where if a user entered a particular PIN it would erase data stored on the device. The devices also ran two operating systems that sat side by side; one that appeared to be innocuous, and another that contained the users’ more sensitive communications.

In a previous email to Motherboard a representative of Encrochat said the firm is a legitimate company with clients in 140 countries, and that it sets out “to find the best technology on the market to provide a reliable and secure service for any organization or individual that want[s] to secure their information.” The firm had tens of thousands of users worldwide, and decided to shut itself down after discovering the hack against its network.

Encrochat’s customers included a British hitman who assassinated a crime leader and an armed robber, and various violent gangs around Europe including those who used so-called “torture chambers.” Some of the users may have been legitimate, however.

Since the shutdown, police across Europe have arrested hundreds of alleged criminals who used the service. Motherboard previously obtained chat logs that prosecutors have presented as evidence against one drug dealer.

Running an encrypted phone company is not typically illegal in-and-of-itself. The U.S. Department of Justice charged Vince Ramos, the CEO of another firm called Phantom Secure with racketeering conspiracy and other charges after an undercover investigation caught him saying the phones were made for drug trafficking. Phantom Secure started as a legitimate firm before catering more to the criminal market. Ramos was sentenced to nine years in prison in May 2019.

Source: European Police Malware Could Harvest GPS, Messages, Passwords, More

How they harvested GPS from devices with the functionality physically removed is a mystery to me, although wifi networks definitely provide a pretty good form of geolocation

U.S. Concentration Camp in Georgia Sent Women to Be Sterilized

Why are the terms “Nazi Germany” and “Mengele” become trending topics on Twitter? The words dominated the social media platform on Monday after it was revealed that a whistleblower has alleged “high numbers” of immigrant women at a U.S. concentration camp in Georgia were sent to be given unnecessary hysterectomies. Many of the women reportedly didn’t know why they were being sent to have the surgery and were all sent to the same doctor, according to the complaint, with one woman describing the facility as an “experimental concentration camp.”

Twitter users made several analogies to various Nazi atrocities on Monday, like the sadistic medical experiments performed on Jews by Josef Mengele during the Holocaust in the 1930s and ‘40s. And while U.S. concentration camps aren’t currently operating as anything close to the European death camps of the Holocaust, there’s still reasonable concern about what the fuck is happening in the U.S. right now under the Trump regime.

The whistleblower, a nurse named Dawn Wooten, worked full time at a concentration camp run by Immigration and Customs Enforcement called the Irwin County Detention Center, until her work hours were cut in July, a result of alleged retaliation for speaking up internally about health and sanitary conditions in the prison. The facility is technically owned by a private company called LaSalle Corrections, much like several other ICE and CBP concentration camps across the U.S. that currently house tens of thousands of detainees under a for-profit model.\

[…]

the most shocking revelations involve many women who were sent to have hysterectomies—a medical procedure to remove the uterus, rendering the women unable to become pregnant and have children—without getting a clear answer on why they were having the surgeries done.

From the complaint to the OIG, which is available online:

One woman told Project South in 2019 that Irwin sends many women to see a particular gynecologist outside the facility but that some women did not trust him. She also stated that “a lot of women here go through a hysterectomy” at ICDC. More recently, a detained immigrant told Project South that she talked to five different women detained at ICDC between October and December 2019 who had a hysterectomy done. When she talked to them about the surgery, the women “reacted confused when explaining why they had one done.” The woman told Project South that it was as though the women were “trying to tell themselves it’s going to be OK.” She further said: “When I met all these women who had had surgeries, I thought this was like an experimental concentration camp. It was like they’re experimenting with our bodies.”

The whistleblower, nurse Wooten, explained in her own words how one unnamed doctor was allegedly carrying out this mass sterilization effort on immigrant women. Wooten even called the doctor a “uterus collector”:

Everybody he sees has a hysterectomy—just about everybody. He’s even taken out the wrong ovary on a young lady [detained immigrant woman]. She was supposed to get her left ovary removed because it had a cyst on the left ovary; he took out the right one. She was upset. She had to go back to take out the left and she wound up with a total hysterectomy. She still wanted children—so she has to go back home now and tell her husband that she can’t bear kids… she said she was not all the way out under anesthesia and heard him [doctor] tell the nurse that he took the wrong ovary.

[…]

We’ve questioned among ourselves like goodness he’s taking everybody’s stuff out…That’s his specialty, he’s the uterus collector. I know that’s ugly…is he collecting these things or something…Everybody he sees, he’s taking all their uteruses out or he’s taken their tubes out. What in the world.

The complaint also alleges that the women in custody aren’t getting clear communication about what procedure is about to be done on them, with some medical staff in the facility allegedly using Google to translate things from English to Spanish before surgery. Some women were told conflicting things about why they needed to have hysterectomies, like one woman who was given three very different reasons

[…]

ICE did not immediately respond to a request for comment on Tuesday morning, but sent out a statement to several news outlets insisting that, “in general, anonymous, unproven allegations, made without any fact-checkable specifics, should be treated with the appropriate skepticism they deserve.” Notably, that’s not a flat denial of the allegations. And DHS restricts access to the facilities to such a degree that journalists have previously tried to use drones just to get a look inside. Even members of Congress have struggled to get an unfiltered look at what’s happening in these facilities.

ICE and its parent agency, the U.S. Department of Homeland Security, have a history of outright lies and running interference for objectively racist policies. The former head of DHS, Kirstjen Nielsen, lied to Congress on multiple occasions, claiming that the Trump regime did not have a policy of separating families at the U.S.-Mexico border. That was flatly wrong and Nielsen has never been held accountable for the lies, let alone the atrocities she committed against countless asylum seekers. The current head of DHS, Acting Secretary Chad Wolf, has never been confirmed by the Senate and the nonpartisan Government Accountability Office found last month that he was illegally appointed to his position in late 2019. Wolf is still the head of DHS.

[…]

Source: U.S. Concentration Camp in Georgia Sent Women to Be Sterilized

Nikola Admits Prototype Was Rolling Downhill In Promo Video

In late 2016, Nikola Motor Company founder Trevor Milton unveiled a prototype of the Nikola One truck, claiming it “fully functions and works, which is really incredible.” A couple years later, in January 2018, the company showed the Nikola One truck moving rapidly along a two-lane desert highway. But last week, the short-selling investment firm Hindenburg Research published a bombshell report, accusing Nikola Motors of massive fraud, having no proprietary technology and vastly overstating the capabilities of their prototypes to investors.

Incredibly, “Hindenburg reported that the truck in the ‘Nikola One in motion’ video wasn’t moving under its own power,” reports Ars Technica. “Rather, Nikola had towed the truck to the top of a shallow hill and let it roll down. The company allegedly tilted the camera to make it look like the truck was traveling under its own power on a level roadway.” From the report: On Monday morning, Nikola sent out a lengthy press release titled “Nikola Sets the Record Straight on False and Misleading Short Seller Report.” While the statement nitpicks a number of claims in the Hindenburg report, it tacitly concedes Hindenburg’s main claim about the Nikola One. Nikola now admits that the Nikola One prototype wasn’t functional in December 2016 and still wasn’t functional when the company released the “in motion” video 13 months later. Nikola claims that the gearbox, batteries, inverters, power steering, and some other components of the truck were functional at the time of the December 2016 show. But Nikola doesn’t claim that the truck had a working hydrogen fuel cell or motors to drive the wheels — the two key components Hindenburg stated were missing from the truck in December 2016.

And Nikola now admits that it never got the truck to fully function. “As Nikola pivoted to the next generation of trucks, it ultimately decided not to invest additional resources into completing the process to make the Nikola One drive on its own propulsion,” Nikola wrote in its Monday statement. Instead, Nikola pivoted to working on its next vehicle, the Nikola Two. So what about that video of the Nikola One driving across the desert? “Nikola never stated its truck was driving under its own propulsion in the video,” Nikola wrote. “Nikola described this third-party video on the Company’s social media as ‘In Motion.’ It was never described as ‘under its own propulsion’ or ‘powertrain driven.’ Nikola investors who invested during this period, in which the Company was privately held, knew the technical capability of the Nikola One at the time of their investment.”

Source: Nikola Admits Prototype Was Rolling Downhill In Promo Video – Slashdot

Whistleblower Shows How Facebook Deals With Global Political Manipulation – not enough according to her

The 6,600-word memo, written by former Facebook data scientist Sophie Zhang, is filled with concrete examples of heads of government and political parties in Azerbaijan and Honduras using fake accounts or misrepresenting themselves to sway public opinion. In countries including India, Ukraine, Spain, Brazil, Bolivia, and Ecuador, she found evidence of coordinated campaigns of varying sizes to boost or hinder political candidates or outcomes, though she did not always conclude who was behind them.

“In the three years I’ve spent at Facebook, I’ve found multiple blatant attempts by foreign national governments to abuse our platform on vast scales to mislead their own citizenry, and caused international news on multiple occasions,” wrote Zhang, who declined to talk to BuzzFeed News. Her LinkedIn profile said she “worked as the data scientist for the Facebook Site Integrity fake engagement team” and dealt with “bots influencing elections and the like.”

“I have personally made decisions that affected national presidents without oversight, and taken action to enforce against so many prominent politicians globally that I’ve lost count,” she wrote.

The memo is a damning account of Facebook’s failures. It’s the story of Facebook abdicating responsibility for malign activities on its platform that could affect the political fate of nations outside the United States or Western Europe. It’s also the story of a junior employee wielding extraordinary moderation powers that affected millions of people without any real institutional support, and the personal torment that followed.

“I know that I have blood on my hands by now,” Zhang wrote.

[…]

“There was so much violating behavior worldwide that it was left to my personal assessment of which cases to further investigate, to file tasks, and escalate for prioritization afterwards,” she wrote.

That power contrasted with what she said seemed to be a lack of desire from senior leadership to protect democratic processes in smaller countries. Facebook, Zhang said, prioritized regions including the US and Western Europe, and often only acted when she repeatedly pressed the issue publicly in comments on Workplace, the company’s internal, employee-only message board.

“With no oversight whatsoever, I was left in a situation where I was trusted with immense influence in my spare time,” she wrote. “A manager on Strategic Response mused to myself that most of the world outside the West was effectively the Wild West with myself as the part-time dictator – he meant the statement as a compliment, but it illustrated the immense pressures upon me.”

A former Facebook engineer who knew her told BuzzFeed News that Zhang was skilled at discovering fake account networks on the platform.

[…]

“I have made countless decisions in this vein – from Iraq to Indonesia, from Italy to El Salvador,” she wrote. “Individually, the impact was likely small in each case, but the world is a vast place.”

Still, she did not believe that the failures she observed during her two and a half years at the company were the result of bad intent by Facebook’s employees or leadership. It was a lack of resources, Zhang wrote, and the company’s tendency to focus on global activity that posed public relations risks, as opposed to electoral or civic harm.

“Facebook projects an image of strength and competence to the outside world that can lend itself to such theories, but the reality is that many of our actions are slapdash and haphazard accidents,” she wrote.

[…]

Source: Whistleblower Says Facebook Ignored Global Political Manipulation

A really good insight into the problems that Faebook has to look at. I’m pretty sure that it’s not Facebook ignoring the problem, it’s that their solution was in the person of the whislteblower, who felt underappreciated and alone and seems to have been unable to garner support within Facebook for more resources.

Private data gone public: Razer leaks 100,000+ gamers’ personal info

In August, security researcher Volodymyr Diachenko discovered a misconfigured Elasticsearch cluster, owned by gaming hardware vendor Razer, exposing customers’ PII (Personal Identifiable Information).

The cluster contained records of customer orders and included information such as item purchased, customer email, customer (physical) address, phone number, and so forth—basically, everything you’d expect to see from a credit card transaction, although not the credit card numbers themselves. The Elasticseach cluster was not only exposed to the public, it was indexed by public search engines.

[…]

One of the things Razer is well-known for—aside from their hardware itself—is requiring a cloud login for just about anything related to that hardware. The company offers a unified configuration program, Synapse, which uses one interface to control all of a user’s Razer gear.

Until last year, Synapse would not function—and users could not configure their Razer gear, for example change mouse resolution or keyboard backlighting—without logging in to a cloud account. Current versions of Synapse allow locally stored profiles for off-Internet use and what the company refers to as “Guest mode” to bypass the cloud login.

Many gamers are annoyed by the insistence on a cloud account for hardware configuration that doesn’t seem to really be enhanced by its presence. Their pique is understandable, because the pervasive cloud functionality comes with cloud vulnerabilities. Over the last year, Razer awarded a single HackerOne user, s3cr3tsdn, 28 separate bounties.

We applaud Razer for offering and paying bug bounties, of course, but it’s difficult to forget that those vulnerabilities wouldn’t have been there (and globally exploitable), if Razer hadn’t tied their device functionality so thoroughly to the cloud in the first place.

Source: Private data gone public: Razer leaks 100,000+ gamers’ personal info | Ars Technica

Google Faces $3 Billion U.K. Suit Over Use of Children’s Data

Alphabet Inc.’s Google faces a multibillion-dollar lawsuit in the U.K. over claims that YouTube routinely breaks privacy laws by tracking children online.

The suit, filed on behalf of more than 5 million British children under 13 and their parents, is being brought by privacy campaigner Duncan McCann and being supported by Foxglove, a tech justice group. The claimants estimate that if they’re successful, there would be as much as 2.5 billion pounds ($3.2 billion) in compensation, worth between 100 to 500 pounds per child.

The filing alleges that YouTube’s methods of targeting underage audiences constitute “major breaches” of U.K. and European privacy and data rules designed to protect citizens’ control over their own private information. YouTube has “systematically broken these laws by harvesting children’s data without obtaining prior parental consent,” it alleges.

A spokesperson for YouTube declined to comment on the lawsuit Monday but added that the video streaming service isn’t designed for users under the age of 13.

“We launched the YouTube Kids app as a dedicated destination for kids and are always working to better protect kids and families on YouTube,” the company said in an emailed statement.

Source: Google Faces $3 Billion U.K. Suit Over Use of Children’s Data – Bloomberg

Hints of life on Venus: Scientists detect phosphine molecules in high cloud decks

An international team of astronomers, led by Professor Jane Greaves of Cardiff University, today announced the discovery of a rare molecule—phosphine—in the clouds of Venus. On Earth, this gas is only made industrially, or by microbes that thrive in oxygen-free environments.

[…]

finding that phosphine is present but scarce—only about twenty molecules in every billion.

The astronomers then ran calculations to see if the phosphine could come from natural processes on Venus. They caution that some information is lacking—in fact, the only other study of phosphorus on Venus came from one lander experiment, carried by the Soviet Vega 2 mission in 1985.

Massachusetts Institute of Technology scientist Dr. William Bains led the work on assessing natural ways to make phosphine. Some ideas included sunlight, minerals blown upwards from the surface, volcanoes, or lightning, but none of these could make anywhere near enough of it. Natural sources were found to make at most one ten thousandth of the amount of phosphine that the telescopes saw.

To create the observed quantity of phosphine on Venus, terrestrial organisms would only need to work at about 10% of their maximum productivity, according to calculations by Dr. Paul Rimmer of Cambridge University. Any microbes on Venus will likely be very different to their Earth cousins though, to survive in hyper-acidic conditions.

[…]

She comments: “Finding phosphine on Venus was an unexpected bonus! The discovery raises many questions, such as how any organisms could survive. On Earth, some microbes can cope with up to about 5% of acid in their environment—but the clouds of Venus are almost entirely made of acid.”

[…]

confirming the presence of “life” needs a lot more work. Although the high clouds of Venus have temperatures up to a pleasant 30 degrees centigrade, they are incredibly acidic—around 90% sulphuric acid—posing major issues for microbes to survive there.

[…]

Source: Hints of life on Venus: Scientists detect phosphine molecules in high cloud decks

Eterbase cryptocurrency exchange hacked and $5.4 million stolen

Cryptocurrency exchange Eterbase last week admitted hackers broke into its computers and made off with other people’s coins, said to be worth $5.4m.

The plug was pulled on the digital dosh exchange as a result, though it may return at some point: it claims to have enough capital to surmount the cyber-heist. Investigations by staff and law enforcement are ongoing.

“We want to inform our users that we have enough capital to meet all our obligations,” the site’s operators said in a statement.

“We want to reassure everyone that this event won’t stop our journey. After the security audit of renowned global companies, our operations will continue. We will announce the date of the reopening of the ETERBASE Exchange platform as soon as possible.”

Source: Another month, another cryptocurrency exchange hacked and ‘millions of dollars’ stolen by miscreants • The Register

Shenzhen Zhenua Data Leak – high profile international contacts database kept by Chinese leaked

The database built by Shenzhen Zhenhua from a variety of sources is technically complex using very advanced language, targeting, and classification tools. Shenzhen Zhenhua claims to work with, and our research supports, Chinese intelligence, military, and security agencies use the open information environment we in open liberal democracies take for granted to target individuals and institutions. Our research broadly support their claims.

The information specifically targets influential individuals and institutions across a variety of industries. From politics to organized crime or technology and academia just to name a few, the database flows from sectors the Chinese state and linked enterprises are known to target.

The breadth of data is also staggering. It compiles information on everyone from key public individuals to low level individuals in an institution to better monitor and understand how to exert influence when needed.

Compiling public and non-public personal and institutional data, Shenzhen Zhenhua has likely broken numerous laws in foreign jurisdictions. Claiming to partner with state intelligence and security services in China, Shenzhen Zhenhua operates collection centers in foreign countries that should be considered for investigation in those jurisdictions.

s that should be considered for investigation in those jurisdictions.

Source: Statement on Shenzhen Zhenua Data Leak – Balding’s WorldBalding’s World

The personal details of millions of people around the world have been swept up in a database compiled by a Chinese tech company with reported links to the country’s military and intelligence networks, according to a trove of leaked data.

About 2.4 million people are included in the database, assembled mostly based on public open-source data such as social media profiles, analysts said. It was compiled by Zhenhua Data, based in the south-eastern Chinese city of Shenzhen.

Internet 2.0, a cybersecurity consultancy based in Canberra whose customers include the US and Australian governments, said it had been able to recover the records of about 250,000 people from the leaked dataset, including about 52,000 Americans, 35,000 Australians and nearly 10,000 Britons. They include politicians, such as prime ministers Boris Johnson and Scott Morrison and their relatives, the royal family, celebrities and military figures.

When contacted by the Guardian for comment, a representative of Zhenhua said: “The report is seriously untrue.”

“Our data are all public data on the internet. We do not collect data. This is just a data integration. Our business model and partners are our trade secrets. There is no database of 2 million people,” said the representative surnamed Sun, who identified herself as head of business.

“We are a private company,” she said, denying any links to the Chinese government or military. “Our customers are research organisations and business groups.”

Source: Zhenhua Data leak: personal details of millions around world gathered by China tech company

Official launch of ELLIS Units – 15th of September 2020! | European Lab for Learning & Intelligent Systems

The European Laboratory for Learning and Intelligent Systems (ELLIS) is officially launching its 30 ELLIS research units on Tuesday, September 15. Since the first 17 units were announced in December 2019, the ELLIS initiative has gained significant momentum, adding another 13 units at top research institutions across Europe. To highlight this rapid progress toward securing the future of European AI research, each unit will be presenting its research focus. While an in-person launch was initially planned in spring at the Royal Society in London, the event was postponed as a result of the global COVID-19 pandemic and will now take place online. The event will be will be open to the general public via livestreaming. A detailed agenda and the YouTube link will be posted shortly.

Source: Official launch of ELLIS Units – 15th of September 2020! | European Lab for Learning & Intelligent Systems

Cory Doctorow Crowdfunds His New Audiobook to Protest Amazon/Audible DRM

Science fiction writer Cory Doctorow (also a former EFF staffer and activist) explains why he’s crowdfunding his new audiobook online. Despite the large publishers for his print editions, “I can’t get anyone to do my audiobooks. Amazon and its subsidiary Audible, which controls 90% of the audiobook sales, won’t carry any of my audiobooks because I won’t let them put any of their digital rights management on it.

“I don’t want you locked in with their DRM as a condition of experiencing my work,” he explains in a video on Kickstarter. “And so I have to do it myself.”

He’s promising to sell the completed book through all the usual platforms “except Audible,” because “I want to send a message. If we get a lot of pre-orders for this, it’s going to tell something to Amazon and Audible about how people prioritize the stories they love over the technology they hate, and why technological freedom matters to people.

“It’s also going to help my publisher and other major publishers understand that there is an opportunity here to work with crowdfunding platforms in concert with the major publishers’ platforms to sell a lot of books in ways that side-step the monopolists, and that connect artists and audiences directly.”

it’s the third book in a series which began with the dystopian thriller Little Brother (recommended by Neil Gaiman) and continued with a sequel named Homeland. (“You may have seen Edward Snowden grab it off his bedstand and put it in his go bag and go into permanent exile in Hong Kong” in the documentary Citizen 4,” Doctorow says in his fundraising video.) The newest book, Attack Surface, finds a “technologist from the other side” — a surveillance contractor — now reckoning with their conscience while being hunted with the very cyber-weapons they’d helped to build. “There are a lot of technologists who are reckoning with the moral consequences of their actions these days,” Doctorow says, adding “that’s part of what inspired me to write this…

“Anyone who’s been paying attention knows that there’s been a collision between our freedom and our technology brewing for a long time.”

Just three days after launching the Kickstarter campaign, Doctorow had already raised over $120,000 over his original goal of $7,000 — with 26 days left to go. And he also promises that the top pledge premium is for real….

$10,000 You and Cory together come up with the premise for his next story in the “Little Brother” universe.
$75 or more All three novels as both audiobooks and ebooks
$40 or more All three novels as audiobooks
$35 or more All three novels as ebooks
$25 or more The audiobook and the ebook of Cory’s new novel, Attack Surface
$15 or more The audiobook for Attack Surface
$14 or more The new book Attack Surface in ebook format as a .mobi/.epub file
$11 or more The second book in the series, Homeland, in ebook format as a .mobi/.epub file
$10 or more The first novel in the series in ebook format as a .mobi/.epub file
$1 or more Cory will email you the complete text of “Little Brother,” the first book in the series, cryptographically signed with his private key

Source: Cory Doctorow Crowdfunds His New Audiobook to Protest Amazon/Audible DRM – Slashdot

It’s good to see that there are ways around the duopolies / monopolies that have taken control of so many facets of our lives. The books are available for free but paying helps break the system.

Swedish Company Unveils A Wind-Powered Car Carrier Ship That Uses Wings, Not Sails

KTH Royal Institute of Technology in Stockholm and the maritime consultancy SSPA partnered with shipbuilders Wallenius Marine in Sweden to design a cargo ship capable of reducing the industry’s huge carbon footprint. Around three percent of today’s carbon dioxide emissions come from the shipping industry, a figure that accounts for the 90,000 ships responsible for 90 percent of all trade on the planet, according to the Financial Times. That much carbon dioxide each year rivals the output of some industrialized nations.

The regulatory body International Maritime Organization has set a goal of cutting emissions by 40 percent over the next decade. That’s going to be a tall order, requiring drastic changes in the industry.

Enter Wallenius Marine’s Oceanbird, also known as the wind-Powered Car Carrier.

The ship will run on wind, but not by using conventional sails. Instead, the Oceanbird will use five 80-foot-tall wings, similar in shape to airplane wings, for propulsion. Those huge fins will be able to collapse down like a telescope to 45 feet in order to slip under bridges or when encountering rough seas. The plan is for the Oceanbird to be capable of transporting 7,000 cars across the Atlantic in 12 days, a trip that with current internal combustion engines takes seven or eight days. The ship will also be equipped with a small motor, probably electric, for navigating harbors and tricky areas.

Wallenius says the concept starts with cargo shipping but could be used by cruise lines as well. Of course, the Oceanbird concept won’t be ready for launch until probably 2025, according to SSPA. All the cool, world-changing technology seems to always be a few years away, doesn’t it? Still, Wallenius has been in the shipbuilding and logistics business for 30 years, and it has built 70 ships during that time. Maybe this could actually work. We’ve got to try something.

Source: Swedish Company Unveils A Wind-Powered Car Carrier Ship That Uses Wings, Not Sails

Watchdog accuses Amazon of price gouging during the pandemic

A new report by the consumer watchdog group Public Citizen accuses Amazon of price gouging during the pandemic. According to the group, Amazon increased the prices of essential items like masks, hand sanitizer, disinfectant spray, paper towels and toilet paper.

According to the report, the cost of a 50-pack of disposable face masks jumped from about $4 on April 1st to $39.99 on August 16th. That’s a 900 percent increase. Toilet paper sold by other retailers for $6.89 sold on Amazon for nearly $37, Public Citizen says. In August, the cost of disinfectant spray reportedly increased from about $7 to $13, a jump of more than 80 percent. Even the prices of flour, sugar and cornstarch varied widely.

[…]

Source: Watchdog accuses Amazon of price gouging during the pandemic | Engadget

Three middle-aged Dutch hackers slipped into Donald Trump’s Twitter account days before 2016 US election

Three “grumpy old hackers” in the Netherlands managed to access Donald Trump’s Twitter account in 2016 by extracting his password from the 2012 Linkedin hack.

The pseudonymous, middle-aged chaps, named only as Edwin, Mattijs and Victor, told reporters they had lifted Trump’s particulars from a database that was being passed about hackers, and tried it on his account.

To their considerable surprise, the password – but not the email address associated with @realdonaldtrump – worked the first time they tried it, with Twitter’s login process confirming the password was correct.

The explosive allegations were made by Vrij Nederland (VN), a Dutch magazine founded during WWII as part of the Dutch resistance to Nazi German occupation.

“A digital treasure chest with 120 million usernames and hashes of passwords. It was the spoil of a 2012 digital break-in,” wrote VN journalist Gerard Janssen, describing the LinkedIn database hack. After the networking website for suits was hacked in 2012 by a Russian miscreant, the database found its way onto the public internet in 2016 when researchers eagerly pored over the hashes. Critically, the leaked database included 6.5 million hashed but unsalted passwords.

Poring through the database, the trio found an entry for Trump as well as the hash for Trump’s password: 07b8938319c267dcdb501665220204bbde87bf1d. Using John the Ripper, a hash-reversing tool, they were able to uncover one of the Orange One’s login credentials. Some considerable searching revealed the correct email address (twitter@donaldjtrump.com – a different one from the one Trump used on LinkedIn and which was revealed in the hack)… only for the “middle aged” hackers to be defeated by Twitter detecting that the man who would become the 45th president of the United States had logged in earlier from New York.

One open proxy server later, they were in.

VN published screenshots supplied by the three showing a browser seemingly logged into Trump’s Twitter account, displaying a tweet dating from 27 October 2016 referring to a speech Trump delivered in Charlotte, North Carolina, USA.

The Dutch hackers also alleged that they found Trump’s details in a database hacked from Ashley Madison, a dating website aimed at cheating spouses. Amusingly, just 1.4 per cent of its 31 million users were actual women.

Despite trying to alert American authorities to just how insecure Trump’s account was (no multi-factor authentication, recycled password from an earlier breach) the hackers’ efforts got nowhere, until in desperation they tried Netherland’s National Cyber Security Centrum – which acknowledged receipt of their prepared breach report, which the increasingly concerned men had prepared immediately once they realised their digital trail was not particularly well covered.

“In short, the grumpy old hackers must set a good example. And to do it properly with someone they ‘may not really like’ they think this is a good example of a responsible disclosure, the unsolicited reporting of a security risk,” concluded VN’s Janssen.

Professor Alan Woodward of the University of Surrey added: “It’s password hygiene 101: use a different password for each account. And, if you know a password has been compromised in a previous breach (I think LinkedIn is well known) then for goodness sake, don’t use that one. [This is] a textbook example of credential stuffing.”

Source: Three middle-aged Dutch hackers slipped into Donald Trump’s Twitter account days before 2016 US election • The Register

High-fidelity record of Earth’s climate history puts current changes in context of orbital variation

For the first time, climate scientists have compiled a continuous, high-fidelity record of variations in Earth’s climate extending 66 million years into the past. The record reveals four distinctive climate states, which the researchers dubbed Hothouse, Warmhouse, Coolhouse, and Icehouse.

These major states persisted for millions and sometimes tens of millions of years, and within each one the climate shows rhythmic variations corresponding to changes in Earth’s orbit around the sun. But each climate state has a distinctive response to orbital variations, which drive relatively small changes in compared with the dramatic shifts between different climate states.

[…]

“We’ve known for a long time that the glacial-interglacial cycles are paced by changes in Earth’s orbit, which alter the amount of solar energy reaching Earth’s surface, and astronomers have been computing these orbital variations back in time,” explained coauthor James Zachos, distinguished professor of Earth and planetary sciences and Ida Benson Lynn Professor of Ocean Health at UC Santa Cruz.

“As we reconstructed past climates, we could see long-term coarse changes quite well. We also knew there should be finer-scale rhythmic variability due to orbital variations, but for a long time it was considered impossible to recover that signal,” Zachos said. “Now that we have succeeded in capturing the natural climate variability, we can see that the projected anthropogenic warming will be much greater than that.”

For the past 3 million years, Earth’s climate has been in an Icehouse state characterized by alternating glacial and interglacial periods. Modern humans evolved during this time, but and other human activities are now driving the planet toward the Warmhouse and Hothouse climate states not seen since the Eocene epoch, which ended about 34 million years ago. During the early Eocene, there were no polar ice caps, and average global temperatures were 9 to 14 degrees Celsius higher than today.

[…]

Critical to compiling the new climate record was getting high-quality sediment cores from deep ocean basins through the international Ocean Drilling Program (ODP, later the Integrated Ocean Drilling Program, IODP, succeeded in 2013 by the International Ocean Discovery Program). Signatures of past climates are recorded in the shells of microscopic plankton (called foraminifera) preserved in the seafloor sediments. After analyzing the sediment cores, researchers then had to develop an “astrochronology” by matching the climate variations recorded in sediment layers with variations in Earth’s orbit (known as Milankovitch cycles).

“The community figured out how to extend this strategy to older time intervals in the mid-1990s,” said Zachos, who led a study published in 2001 in Science that showed the climate response to orbital variations for a 5-million-year period covering the transition from the Oligocene epoch to the Miocene, about 25 million years ago.

“That changed everything, because if we could do that, we knew we could go all the way back to maybe 66 million years ago and put these transient events and major transitions in Earth’s climate in the context of orbital-scale variations,” he said.

[…]

Now that they have compiled a continuous, astronomically dated climate record of the past 66 million years, the researchers can see that the climate’s response to orbital variations depends on factors such as greenhouse gas levels and the extent of polar ice sheets.

“In an extreme greenhouse world with no ice, there won’t be any feedbacks involving the ice sheets, and that changes the dynamics of the climate,” Zachos explained.

Most of the major climate transitions in the past 66 million years have been associated with changes in greenhouse gas levels.

[…]

The new climate record provides a valuable framework for many areas of research, he added. It is not only useful for testing climate models, but also for geophysicists studying different aspects of Earth dynamics and paleontologists studying how changing environments drive the evolution of species.

Source: High-fidelity record of Earth’s climate history puts current changes in context

TikTok reveals details of how its algorithm works

TikTok Wednesday revealed some of the elusive workings of the prized algorithm that keeps hundreds of millions of users worldwide hooked on the viral video app.

[…]

TikTok’s algorithm uses machine learning to determine what content a user is most likely to engage with and serve them more of it, by finding videos that are similar or that are liked by people with similar user preferences.

  • When users open TikTok for the first time, they are shown 8 popular videos featuring different trends, music, and topics. After that, the algorithm will continue to serve the user new iterations of 8 videos based on which videos the user engages with and what the user does.
  • The algorithm identifies similar videos to those that have engaged a user based on video information, which could include details like captions, hashtags or sounds. Recommendations also take into account user device and account settings, which include data like language preference, country setting, and device type.
  • Once TikTok collects enough data about the user, the app is able to map a user’s preferences in relation to similar users and group them into “clusters.” Simultaneously, it also groups videos into “clusters” based on similar themes, like “basketball” or “bunnies.”
  • Using machine learning, the algorithm serves videos to users based on their proximity to other clusters of users and content that they like.
  • TikTok’s logic aims to avoid redundancies that could bore the user, like seeing multiple videos with the same music or from the same creator.

Yes, but: TikTok concedes that its ability to nail users’ preferences so effectively means that its algorithm can produce “filter bubbles,” reinforcing users’ existing preferences rather than showing them more varied content, widening their horizons, or offering them opposing viewpoints.

  • The company says that it’s studying filter bubbles, including how long they last and how a user encounters them, to get better at breaking them when necessary.
  • Since filter bubbles can reinforce conspiracy theories, hoaxes and other misinformation, TikTok’s product and policy teams study which accounts and video information — themes, hashtags, captions, and so on — might be linked to misinformation.
  • Videos or creators linked to misinformation are sent to the company’s global content reviewers so they can be managed before they are distributed to users on the main feed, which is called the “For You” page.

The briefing also featured updates about TikTok’s data, privacy and security practices.

  • The company says it tries to triage and prevent incidents on its platform before they happen by working to detect patterns of problems before they spread.
  • TikTok’s chief security officer, Roland Cloutier, said it plans to hire more than 100 data, security and privacy experts by year’s end in the U.S.
  • He also said that the company will be building a monitoring, response and investigative response center in Washington D.C. to actively detect and respond to critical incidents in real time.

The big picture: Beckerman says that TikTok’s transparency efforts are meant to position the company as a leader in Silicon Valley.

  • “We want to take a leadership position and show more about how the app works,” he said. “For us, we’re new, and we want to do this because we don’t have anything to hide. The more we’re talking to and meeting with lawmakers, the more comfortable they are with the product. That’s the way it should be.”

Source: TikTok reveals details of how its coveted algorithm works – Axios

Who Emerges into Virtual Team Leadership Roles? Different people from face to face leadership

It turns out that where in traditional face to face leadership, people prefer leaders who are vocal, charming, friendly (ascription qualities). In virtual leadership, people prefer leaders who facilitate, are organised and actually do stuff (achievement factors).

 In two independent samples—a laboratory experiment involving 86 teams (n = 340; sample one) and a semester long project involving 134 teams (n = 430; sample two)—we found that in low virtuality contexts, ascription factors accounted for incremental variance over achievement factors in predicting leadership emergence, and had larger relative importance. Conversely, in high virtuality contexts, achievement factors accounted for incremental variance over ascription factors in predicting leadership emergence, and had larger relative importance.

Source: Who Emerges into Virtual Team Leadership Roles? The Role of Achievement and Ascription Antecedents for Leadership Emergence Across the Virtuality Spectrum | SpringerLink

This seed of professional vexation has borne fruit, with new data showing that the confidence, intelligence and extroversion that have long propelled ambitious workers into the executive suite are not enough online, because they simply don’t translate into virtual leadership. Instead, workers who are organised, dependable and productive take the reins of virtual teams. Finally, doers lead the pack – at least remotely.

The study shows that, instead of those with the most dynamic voices in the room, virtual teams informally anoint leaders who actually do the work of getting projects done. “They are the individuals who help other team members with tasks, and keep the team on schedule and focused on goals,” says lead author Radostina Purvanova, an associate professor of management and leadership at Drake University in the US state of Iowa.

Source: The surprising traits of good remote leaders

BlindSide: Watch speculative memory probing bypass kernel defenses, give malware root control

Boffins in America, the Netherlands, and Switzerland have devised a Spectre-style attack on modern processors that can defeat defenses that are supposed to stop malicious software from hijacking a computer’s operating system. The end result is exploit code able to bypass a crucial protection mechanism and take over a device to hand over root access.

That’s a lot to unpack so we’ll start from the top. Let’s say you find a security vulnerability, such as a buffer overflow, in the kernel of an OS like Linux. Your aim is to use this programming flaw to execute code within the kernel so that you can take over the whole machine or device. One way to do this, and sidestep things like stack cookies and the prevention of data execution, is to use return-orientated programming (ROP). This involves chaining together snippets of instruction sequences in the kernel to form an ad-hoc program that does whatever you want: hand control of the machine to you, for example.

To thwart ROP-based exploits, a defense called Address Space Layout Randomization (ASLR) was devised some years back that, as the name suggests, randomizes the locations of an application or operating system kernel’s code and libraries in memory. That makes it difficult to write working ROP exploits as the snippets of code they need aren’t in their expected locations; they are randomly placed during boot. Some information needs to be leaked from the kernel that reveals the current layout of its components in RAM. If a ROP exploit just guesses the kernel’s layout and is wrong, it will trigger a crash, and this can be detected and acted on by an administrator.

Enter Spectre. This is the family of vulnerabilities that can be exploited by malware or a rogue user to obtain secret, privileged information – such as passwords and keys – by taking advantage of speculative execution, which is when a processor performs an operation before it’s needed and either retains or tosses the result, depending on the processor instructions ultimately executed.

What the team say they’ve done is designed a Spectre-style technique that can silently speculatively probe memory to determine the location of the kernel’s parts without triggering a crash. And that makes a blind return-oriented programming (BROP) attack possible, bypassing any ASLR in the way.

Hijack merchant

The technique, dubbed BlindSide, is explained in a paper [PDF] by Enes Göktaş and Georgios Portokalidis (Stevens Institute of Technology), Herbert Bos and Cristiano Giuffrida (Vrije Universiteit Amsterdam), and Kaveh Razavi (ETH Zürich). Scheduled to be presented at the ACM Conference on Computer and Communications Security (CCS) 2020, it involves memory-corruption-based speculative control-flow hijacking.

“Using speculative execution for crash suppression allows the elevation of basic memory write vulnerabilities into powerful speculative probing primitives that leak through microarchitectural side effects,” the paper stated. “Such primitives can repeatedly probe victim memory and break strong randomization schemes without crashes and bypass all deployed mitigations against Spectre-like attacks.”

The basic memory write vulnerability in this case was a heap buffer overflow patched some time ago in the Linux kernel (CVE-2017-7308). But the boffins insist other vulnerabilities that provide access to a write primitive, such as CVE-2017-1000112, CVE-2017-7294, and CVE-2018-5332, would work too. So to be clear: you need to find an unpatched hole in the kernel, get some kind of code execution on the machine in question, and then deploy the BROP technique with an exploit to gain root privileges.

The boffins show that they can break KASLR (Kernel ASLR) to run an ROP exploit; leak the root password hash; and undo fine-grained randomization (FGR) and kernel execute-only memory (XoM) protections to access the entire kernel text and perform an ROP exploit.

A video of one such attack shows that the technique takes a few minutes, but does manage to elevate the user to root privileges:

The computer scientists confirmed their technique on Linux kernel version 4.8.0 compiled with gcc and all mitigations enabled on a machine with an Intel Xeon E3-1270 v6 processor clocked at 3.80GHz with 16GB of RAM.

They also did so on Linux kernel version 5.3.0-40-generic with all the mitigations (e.g., Retpoline) enabled on an Intel i7-8565U chip (Whiskey Lake) with the microcode update for the IBPB, IBRS and STIBP mitigations. What’s more, the technique worked on Intel Xeon E3-1505M v5, Xeon E3-1270 v6 and Core i9-9900K CPUs (Skylake, Kaby Lake, and Coffee Lake) and on AMD Ryzen 7 2700X and Ryzen 7 3700X CPUs (Zen+ and Zen2).

“Overall, our results confirm speculative probing is effective on a modern Linux system on different microarchitectures, hardened with the latest mitigations,” the paper stated.

Potential mitigations involve preventing, detecting, and hindering speculative probing, but none of these approaches, the authors suggest, can deal with the issue very well. Intel and AMD did not immediately respond to requests for comment.

Source: Don’t be BlindSided: Watch speculative memory probing bypass kernel defenses, give malware root control • The Register

Several Fish Can Secretly Walk on Land, Study Suggests

A surprising number of hillstream loaches—a family of Asian fish—are capable of walking on land using all four limbs, according to a new study. It’s a discovery that could explain how some of the earliest animals managed to stroll on solid ground.

South Asian hillstream loaches are a family of small fish that can often be found clinging to rocks in fast-moving waters. New research published in the Journal of Morphology suggests at least 11 species of hillstream loaches can also walk on land, as evidenced by their peculiar anatomies. At least one species, a blind cavefish known as Cryptotora thamicola, has actually been caught in the act, but the new research suggests other hillstream loaches can do it as well.

Brooke Flammang, a biologist at the New Jersey Institute of Technology and the study’s lead principal investigator, along with her colleagues, analyzed 29 hillstream loach specimens. Using micro-CT scans, the team studied and compared the various specimens, looking at their distinctive shapes, muscle groups, and skeletal structures.

 Cryptotora thamicola as seen in multiple perspectives.
Cryptotora thamicola as seen in multiple perspectives.
Image: Zach Randall, Florida Museum of Natural History, and BE Flammang, NJIT

This international team of researchers, which included scientists from the Florida Museum of Natural History, Louisiana State University, and Thailand’s Maejo University, also conducted some genetic work, sampling the DNA of 72 loaches in order to reconstruct their evolutionary family tree.

Together, the physical and genetic analysis revealed the fishes’ unusual land-walking capabilities.

“In most fishes, there is no bony connection between the backbone and the pelvic fins. These fish are different because they have hips,” explained Flammang in an email. “The hip bone is a sacral rib, and within the fishes we studied, we found three morphological variants ranging from very thin and not well-connected to robust and having a sturdy connection. We expect that those with the largest, most robust ‘hip’-bones have the best walking ability.”

Cryptotora thamicola in the wild.
Cryptotora thamicola in the wild.
Image: Florida Museum

Of the fish studied, 11 were found to have these robust hips, or pelvic girdles. Interestingly, the resulting gait is reminiscent of the way salamanders walk on land. As noted, the only documented example of a walking hillstream loach is Cryptotora thamicola, also known as the cave angel fish. These blind fish, in addition to walking on land, have been seen climbing up waterfalls, which they do using all four limbs.

[…]

Flammang said these fish don’t represent an intermediate species, that is, some kind of missing link between fully aquatic animals and those capable of living on land.

“But we know that throughout evolution, organisms have repeatedly converged on similar morphologies as a result of facing similar pressures of natural selection,” she said. “And we also know that physics does not change with time. Therefore, we can learn from the mechanics of how this fish walks and use it to better understand how extinct early animals may have walked.”

Source: Several Fish Can Secretly Walk on Land, Study Suggests

How Britain can help you get away with stealing millions: a five-step guide

Step 1: Forget what you think you know

If you want to commit significant financial crime, therefore, you need a bank account, because electronic cash weighs nothing, no matter how much of it there is. But that causes a new problem: the bank account will have your name on it, which will alert the authorities to your identity if they come looking.

This is where shell companies come in. Without a company, you have to act in person, which means your involvement is obvious and overt: the bank account is in your name. But using a company to own that bank account is like robbing a house with gloves on – it leaves no fingerprints, as long as the company’s ownership information is hidden from the authorities. This is why all sensible crooks do it.

[…]

Here is the secret you need to know to get started in the shell company game: the British company registration system contains a giant loophole – the kind of loophole you can drive a billion euros through without touching the sides.

[…]

. The true image associated with “shell companies” these days should not be an exotic island redolent of the sound of the sea and the smell of rum cocktails, but a damp-stained office block in an unfashionable London suburb, or a nondescript street in a northern city. If you want to set up in the money-laundering business, you don’t need to move to the Caribbean: you’d be far better off doing it from the comfort of your own home.

Step 2: Set up a company

The second step is easy, and involves creating a company on the Companies House website. Companies House maintains the UK’s registry of corporate structures and publishes information on shareholders, directors, accounts, partners and so on, so anyone can check up on their bona fides.

Setting up a company costs £12 and takes less than 24 hours. According to the World Bank’s annual Doing Business report, the UK is one of the easiest places anywhere to create a company, so you’ll find the process pretty straightforward.

[…]

While it has bullied the tax havens into checking up on their customers, Britain itself doesn’t bother with all those tiresome and expensive “due diligence” formalities. It is true that, while registering your company on the Companies House website, you will find that it asks for information such as your name and address.

[…]

Step 3: Make stuff up

This third step may be the hardest to really take in, because it seems too simple. Since 2016, the UK government has made it compulsory for anyone setting up a company to name the individual who actually owns it: “the person with significant control”, or PSC.

[…]

Here is the secret: no one checks the accuracy of the information you provide when you register with Companies House. You can say pretty much anything and Companies House will accept it.

[…]

Suspicious typos are everywhere once you start delving into the Companies House database.

[…]

Recently, while messing about on the Companies House website, I came across a PSC named Mr Xxx Stalin, who is apparently a Frenchman resident in east London.

[…]

Xxx Stalin led me to a PSC of a different company, who was named Mr Kwan Xxx, a Kazakh citizen, resident in Germany; then to Xxx Raven; to Miss Tracy Dean Xxx; to Jet Xxx; and finally to (their distant cousin?) Mr Xxxx Xxx. These rabbitholes are curiously engrossing, and before long I’d found Mr Mmmmmmm Yyyyyyyyyyyyyyyyyy, and Mr Mmmmmm Xxxxxxxxxxx (correspondence address: Mmmmmmm, Mmmmmm, Mmm, MMM), at which point I decided to stop.

As trolling goes, it is quite funny, but the implications are also very serious, if you think about what companies are supposed to be for. Limited companies and partnerships have their liability for debts limited, which means that if they go bust, their investors are not personally bankrupted. It’s a form of insurance – society as a whole is accepting responsibility for entrepreneurs’ debts, because we want to encourage entrepreneurial behaviour. In return, entrepreneurs agree to publish details about their companies so we can all check what they are up to, and to make sure they’re not abusing our trust.

[…]

The anti-corruption campaign group Global Witness looked into PSCs last year, and found 4,000 of them were under the age of two. One hadn’t even been born yet. At the opposite end of the spectrum, its researchers found five individuals who each controlled more than 6,000 companies. There are more than 4m companies at Companies House, which is a very large haystack to hide needles in.

You don’t actually even need to list a person as your company’s PSC. It’s permissible to say that your company doesn’t know who owns it (no, you’re not misunderstanding; that just doesn’t make sense), or simply to tie the system up in knots by listing multiple companies in multiple jurisdictions that no investigator without the time and resources of the FBI could ever properly check.

This is why step three is such an important one in the five-step pathway to creating a British shell company. If you can invent enough information when filing company accounts, then the calculation that underpins the whole idea of a company goes out of the window: you gain the protection from legal action, without giving up anything in return. It’s brilliant.

[…]

Step 4: Lie – but do so cleverly

Most of the daft examples earlier (Mmmmmmm, Mmmmmm, Mmm, MMM) would not be useful for committing fraud, since anyone looking at them can tell they’re not serious. Cumberland Capital Ltd, however, was a different matter. It looked completely legitimate.

[…]

When US police came looking for the people behind Cumberland Capital Ltd, they searched the Companies House website and found that its director was an Australian citizen called Manford Martin Mponda. Anyone researching binary-options fraud might quickly conclude that Mponda was a kingpin. He was a serial company director, with some 80 directorships in UK-registered companies to his name, and features in dozens of complaints.

It already looked like a major scandal that British regulation was so lax that Mponda could have been allowed to conduct a global fraud epidemic behind the screen of UK-registered companies, but the reality was even more remarkable: Mponda had nothing to do with it. He was a victim, too.

Police officers suspect that, after Mponda submitted his details to join a binary-options website, his identity was stolen so it could be used to register him as a director of dozens of UK companies. The scheme was only exposed after complaints to consumer protection bodies were passed onto the City of London police, who then asked their Australian colleagues to investigate.

[…]

So here is step four: don’t just lie, lie cleverly. British companies look legitimate, so look legitimate yourself. Steal a real person’s name, and put that on the company documents. Don’t put your own address on the documents, rent a serviced office to take your post: Paul Manafort used one in Finchley, the binary options fraudsters went to Liverpool, and Lantana Trade was based in the London suburb of Harrow.

[…]

Step 5: Don’t worry about it

I know what you’re thinking: it cannot be this easy. Surely you’ll be arrested, tried and jailed if you try to follow this five-step process. But if you look at what British officials do, rather than at what they say, you’ll begin to feel a lot more secure. The Business Department has repeatedly been warned that the UK is facilitating this kind of financial crime for the best part of a decade, and is yet to take any substantive action to stop it. (Though, to be fair, it did recently launch a “consultation”.)

[…]

In 2011, then-business secretary and Liberal Democrat MP Vince Cable decided to open up Companies House, and everything changed. After Cable’s reform, anyone with an internet connection, anywhere in the world, could create a UK company in about as much time as it takes to order a couple of pizzas, and for approximately the same amount of money. The checks were gone; there was no longer any connection to a verifiably existing person; it was as easy to create a UK company as it was to set up a Twitter account. The rationale was that this would unleash the latent entrepreneurship within the British nation by making it easy to turn business ideas into thriving concerns.

Instead of unchaining a new generation of British businesspeople, however, Cable let slip the dogs of fraud. At first, this rather technical modification to an obscure corner of the British machinery of state did not garner much attention, but for people who understood what it meant it was alarming.

[…]

There is, it turns out, a simple explanation for why successive governments have failed to do anything about it. Last year, when challenged in the House of Commons, Treasury minister John Glen stated that Companies House simply couldn’t afford to check the information filed with it, since that would cost the UK economy hundreds of millions of pounds a year. This is almost certainly an exaggeration. Anti-corruption activists who have looked at the data say the cost would in fact be far less than that, but the key point is that the reform would pay for itself. As Brewer has pointed out, “the burden of cost is one thing. But the cost of fraud is far greater.”

VAT fraud alone costs the UK more than £1bn a year, while the National Crime Agency estimates the cost of all fraud to the UK economy to be £190bn. The cost to the rest of the world of the money laundering enabled by UK corporate entities is almost certainly far higher.

[…]

lesson number five: don’t worry about it. Commit as much fraud as you like, fill your boots, the only reason anyone would care is if you kick up a fuss. And what sensible fraudster is going to do that?

Source: How Britain can help you get away with stealing millions: a five-step guide | World news | The Guardian

Researchers reveal a much richer picture of the past with new DNA recovery technique

Researchers at McMaster University have developed a new technique to tease ancient DNA from soil, pulling the genomes of hundreds of animals and thousands of plants—many of them long extinct—from less than a gram of sediment.

The DNA extraction method, outlined in the journal Quarternary Research, allows scientists to reconstruct the most advanced picture ever of environments that existed thousands of years ago.

The researchers analyzed permafrost samples from four sites in the Yukon, each representing different points in the Pleistocene-Halocene transition, which occurred approximately 11,000 years ago.

This transition featured the extinction of a large number of animal species such as mammoths, mastodons and ground sloths, and the new process has yielded some surprising new information about the way events unfolded, say the researchers. They suggest, for example, that the survived far longer than originally believed.

In the Yukon samples, they found the genetic remnants of a vast array of , including mammoths, horses, bison, reindeer and thousands of varieties of plants, all from as little as 0.2 grams of sediment.

The scientists determined that woolly mammoths and horses were likely still present in the Yukon’s Klondike region as recently as 9,700 years ago, thousands of years later than previous research using fossilized remains had suggested.

[…]

The technique resolves a longstanding problem for scientists, who must separate DNA from other substances mixed in with sediment. The process has typically required harsh treatments that actually destroyed much of the usable DNA they were looking for. But by using the new combination of extraction strategies, the McMaster researchers have demonstrated it is possible to preserve much more DNA than ever.

[…]

Source: Researchers reveal a much richer picture of the past with new DNA recovery technique

Apple sues Epic for destroying the App store and won’t let their users log in using Apple log in (whatever that is)

So, Apple is trying to frame it’s strong arming of companies into paying 30% protection money… uh… app store fees – well… unless you have an agreement to pay less, but only one or two have that… as being in the interest of the people who’s arms they are ripping out. Because we believe the scary man in the suit who has been ripping off customers and consumers left and right over the man who is saying he’s had enough.

Apple has filed a countersuit against Epic Games as the two companies continue their battle over App Store royalties.

The Cupertino giant is seeking a declaratory judgement [PDF] for breach of contract as it claims Epic has broken their agreement to distribute software and in-app purchases though the App Store. The filing is part formal response to the original Epic suit and part Apple making legal allegations of its own.

“Although Epic portrays itself as a modern corporate Robin Hood, in reality it is a multi-billion dollar enterprise that simply wants to pay nothing for the tremendous value it derives from the App Store,” Apple claims.

“Epic’s demands for special treatment and cries of ‘retaliation’ cannot be reconciled with its flagrant breach of contract and its own business practices, as it rakes in billions by taking commissions on game developers’ sales and charging consumers up to $99.99 for bundles of V-Bucks.”

Source: Apple to Epic: Sue me? No, sue you, pal! • The Register

“Epic’s actions have caused Apple to suffer reputational harm and loss of goodwill with consumers who rely on Apple to offer the apps they want to download, like Fortnite, with all of the safety, security, and privacy protections that they expect from Apple,” Apple said in its filing. “Left unchecked, Epic’s conduct threatens the very existence of the iOS ecosystem and its tremendous value to consumers.”

Apple claimed that Epic purposefully sent a “Trojan horse” to the App Store, hiding a line of code in a Fortnite hotfix that allowed the gaming company to “bypass Apple’s app review process” so it could trigger the option for users to pay Epic directly for V-Bucks, the game’s currency. Epic has denied that it hid anything from Apple.

Apple said this hotfix amounted to “little more than theft,” claiming that Epic purposefully tried to find a way to “enjoy all of the benefits of Apple’s iOS platform and related services” without paying Apple what it was contractually owed.

Source: Apple Says ‘Epic’s Conduct Threatens the Very Existence of the iOS Ecosystem’ in Countersuit

As of September 11th, Apple will no longer allow users to sign into Epic Games accounts using “Sign in with Apple.” If you’re using the Apple sign-in feature, make sure to update your Epic Games account email and password before Friday.

This change is the latest petty move in the Apple versus Epic battle.

Source: Apple will stop letting Epic Games use ‘Sign in with Apple’ on September 11th

Hacked Windows 10 Themes Can Swipe Your Microsoft Login

Windows 10 users can customize their desktops with unique themes, and are able to create and share those themes with others. Hackers can also use them to steal your credentials.

A flaw in Windows 10’s theme-creation feature lets hackers modify custom themes that, once installed, trick users into passing over their Microsoft account name and password data via counterfeit login pages. This technique wouldn’t necessarily raise any red flags for an average person, as some legit Windows 10 themes have you sign in after installation.

This “Pass the Hash” attack doesn’t steal your password verbatim, but rather the password hash—a jumbled up and obfuscated version of your password’s data. Companies hash password data to keep it more secure when stored on remote servers, but hackers can unscramble passwords with readily available software. In some cases, passwords can be cracked in just a few seconds.

This vulnerability was discovered by cybersecurity researcher Jimmy Bayne, who publicly disclosed the findings in a Twitter thread.

Bayne alerted Microsoft to the security risk, but the company says it has no plans to change the Theme feature since the credential passing is an intended feature; Hackers have simply found a way to use it maliciously.

With no official action being taken, it’s up to users to keep themselves safe from shady Windows 10 themes.

BleepingComputer and Bayne outline options for enterprise versions of Windows 10, but these won’t work for general users. The smartest move is to avoid custom themes entirely, but if you keep using them, make sure you’re only downloading official themes from secure sources like the Windows Store.

Whether you keep using custom themes or not, you should also update your accounts with unique passwords, turn on two-factor authentication, and use an encrypted password manager. I would also suggest unlinking third-party accounts from your Microsoft account and using local user accounts to sign in to your PC, rather than your Microsoft Account. Protective steps like these make it harder for outsiders to steal your data, even if they happen to snag a password.

Source: Hacked Windows 10 Themes Can Swipe Your Microsoft Login