About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Attackers exploit 0-day vulnerability that gives full control of Android phones

Attackers are exploiting a zero-day vulnerability in Google’s Android mobile operating system that can give them full control of at least 18 different phone models, including four different Pixel models, a member of Google’s Project Zero research group said on Thursday night.

There’s evidence the vulnerability is being actively exploited, either by exploit developer NSO Group or one of its customers, Project Zero member Maddie Stone said in a post. NSO representatives, meanwhile, said the “exploit has nothing to do with NSO.” Exploits require little or no customization to fully root vulnerable phones. The vulnerability can be exploited two ways: (1) when a target installs an untrusted app or (2) for online attacks, by combining the exploit with a second exploit targeting a vulnerability in code the Chrome browser uses to render content.

“The bug is a local privilege escalation vulnerability that allows for a full compromise of a vulnerable device,” Stone wrote. “If the exploit is delivered via the Web, it only needs to be paired with a renderer exploit, as this vulnerability is accessible through the sandbox.”

[…]

The use-after-free vulnerability originally appeared in the Linux kernel and was patched in early 2018 in version 4.14, without the benefit of a tracking CVE. That fix was incorporated into versions 3.18, 4.4, and 4.9 of the Android kernel. For reasons that weren’t explained in the post, the patches never made their way into Android security updates. That would explain why earlier Pixel models are vulnerable and later ones are not. The flaw is now tracked as CVE-2019-2215.

[…]

Project Zero gives developers 90 days to issue a fix before publishing vulnerability reports except in cases of active exploits. The Android vulnerability in this case was published seven days after it was privately reported to the Android team.

Source: Attackers exploit 0-day vulnerability that gives full control of Android phones | Ars Technica

The exploit has been seen being used in the wild, which is why it was disclosed after 7 days.

TensorFlow 2.0 is now available!

TensorFlow 2.0 is driven by the community telling us they want an easy-to-use platform that is both flexible and powerful, and which supports deployment to any platform. TensorFlow 2.0 provides a comprehensive ecosystem of tools for developers, enterprises, and researchers who want to push the state-of-the-art in machine learning and build scalable ML-powered applications.

Coding with TensorFlow 2.0

TensorFlow 2.0 makes development of ML applications much easier. With tight integration of Keras into TensorFlow, eager execution by default, and Pythonic function execution, TensorFlow 2.0 makes the experience of developing applications as familiar as possible for Python developers. For researchers pushing the boundaries of ML, we have invested heavily in TensorFlow’s low-level API: We now export all ops that are used internally, and we provide inheritable interfaces for crucial concepts such as variables and checkpoints. This allows you to build onto the internals of TensorFlow without having to rebuild TensorFlow.

Source: TensorFlow 2.0 is now available! – TensorFlow – Medium

TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

The popular short-form video app will no longer run ads from politicians or candidates at any level of government because “the nature of paid political ads is not something we believe fits the TikTok platform experience,” TikTok’s VP of global business solutions, Blake Chandlee, announced in a blog post Thursday. This ban also covers “election-related ads, advocacy ads, or issue ads.”

And it’s true, TikTok didn’t become the fourth-largest social media platform in record time by facilitating debate and political discussions; we can already yell at each other on Facebook and Twitter for that. No, most users log on to TikTok to post silly lip-sync videos or their take on the newest trending hashtag, and if politics are mentioned it’s usually in reference to whatever’s the latest viral meme.

While TikTok has only begun experimenting with paid ad formats, Chandlee wrote that, throughout the process, the company is committed to preserving “the app’s light-hearted and irreverent feeling” that makes users want to spend their time there in the first place. Political ads often loaded with barbs aimed at tearing down opposing candidates just don’t vibe with that.

Source: TikTok Kicks Political Ads Off Its Platform Because Screw That Noise

Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics

If you’re not a big fan of classical art, you’d probably have a hard time pointing out what artist painted a certain painting. Well, your days of guessing are finally over – someone created a handy, albeit pretty hilarious, guide on how to recognize famous painters by their paintings and it’s surprisingly accurate.

The helpful guide, created by Reddit user DontTacoBoutIt, will help you recognize famous painters by pointing out the distinctive style elements in their paintings – in a hilarious way. From the Putin-like characters of Van Eyck to the chubby cupids of Boucher, check out this funny art guide in the gallery below!

#1 If Everyone – Including The Women – Looks Like Putin, Then It’s Van Eyck

Image source: flickerdart

Jan van Eyck

#2 If Everyone Looks Like Hobos Illuminated Only By A Dim Streetlamp, It’s Rembrandt

Image source: flickerdart

Rembrandt Harmenszoon van Rijn

#3 If It’s Something You Saw On Your Acid Trip Last Night, It’s Dali

Image source: flickerdart

Salvador Dalí

#4 If The Paintings Have Lots Of Little People In Them But Also Have A Ton Of Crazy Bulls#%t, It’s Bosch

Image source: flickerdart

Hieronymus Bosch

#5 If Everybody Has Some Sort Of Body Malfunction, Then It’s Picasso

Image source: flickerdart

Pablo Ruiz Picasso

#6 Lord Of The Rings Landscapes With Weird Blue Mist And The Same Wavy-Haired Aristocratic-Nose Madonna, It’s Da Vinci

Image source: flickerdart

Leonardo da Vinci

#7 Dappled Light And Unhappy Party-Time People, Then It’s Manet

Image source: flickerdart

Édouard Manet

#8 If You See A Ballerina, It’s Degas

Image source: flickerdart

Edgar Degas

#9 Dappled Light But No Figures, It’s Monet

Image source: flickerdart

Claude Monet

#10 If Everyone Is Beautiful, Naked, And Stacked, It’s Michelangelo

Image source: flickerdart

Michelangelo di Lodovico Buonarroti Simoni

#11 Dappled Light And Happy Party-Time People, It’s Renoir

Image source: flickerdart

Pierre-Auguste Renoir

#12 If The Images Have A Dark Background And Everyone Has Tortured Expressions On Their Faces, It’s Titian

Image source: flickerdart

Tiziano Vecelli

#13 Excel Sheet With Coloured Squares, It’s Mondrian

Image source: flickerdart

Piet Mondrian

#14 If All The Men Look Like Cow-Eyed Curly-Haired Women, It’s Caravaggio

Image source: flickerdart

Michelangelo Merisi da Caravaggio

#15 If The Paintings Have Tons Of Little People In Them But Otherwise Seem Normal, It’s Bruegel

Image source: flickerdart

Pieter Bruegel the Elder

#16 If Everyone In The Paintings Has Enormous Asses, Then It’s Rubens

Image source: flickerdart

Sir Peter Paul Rubens

#17 If Every Painting Is The Face Of A Uni-Browed Woman, It’s Frida

Image source: flickerdart

Frida Kahlo

#18 If Everything Is Highly-Contrasted And Sharp, Sort Of Bluish, And Everyone Has Gaunt Bearded Faces, It’s El Greco

Image source: flickerdart

Doménikos Theotokópoulos – El Greco (“The Greek”)

#19 If The Painting Could Easily Have A Few Chubby Cupids Or Sheep Added (Or Already Has Them), It’s Boucher

Image source: flickerdart

François Boucher

Source: Someone Created A Funny Guide On How To Recognize Famous Painters And It’s Surprisingly Accurate (19 Pics) | DeMilked

Posted in Art

Scientists Uncover New Organic Molecules Coming Off Saturn’s Moon Enceladus

Scientists have discovered nitrogen- and oxygen- containing organic molecules in ice grains blown out by Saturn’s moon Enceladus, according to a new study.

Gas giants Saturn and Jupiter are orbited by some moons that almost seem more like planets themselves. One such moon is Saturn’s Enceladus, an icy orb thought to contain a very deep subsurface water ocean beneath a thick icy crust. Finding organic molecules on Enceladus is exciting, since water plus energy plus organic molecules might be the ingredients for life.

Enceladus blasted the material out in plumes from cracks in its south polar crust. The plumes carry a mixture of material from the moon’s rocky core and subsurface ocean. The Cassini mission flew through these plumes in 2004 and 2008, gathering data on the material with two of its instruments, the Ion and Neutral Mass Spectrometer (INMS) and the Cosmic Dust Analyser (CDA). For the new study, researchers based in Germany and the United States took a deeper look at the CDA’s data and found new organic compounds, according to the paper published in the Monthly Notices of the Royal Astronomical Society.

The molecules included amines, which are nitrogen- and oxygen-containing organic molecules similar to those on Earth that turn into amino acids. As a reminder, “organic” in this case simply means “containing carbon,” though these are the kind of compounds that can produce the complex molecules found in life on Earth.

[…]

Scientists have previously reported finding large organic molecules in Cassini data. This paper presents a new kind of molecule, one of interest to those hunting for life.

Source: Scientists Uncover New Organic Molecules Coming Off Saturn’s Moon Enceladus

silk is proven to thrive in outer space temperatures

Their initial discovery had seemed like a contradiction because most other polymer fibres embrittle in the cold. But after many years of working on the problem, the group of researchers have discovered that silk’s cryogenic toughness is based on its nano-scale fibrills. Sub-microscopic order and hierarchy allows a silk to withstand temperatures of down to -200 C. And possibly even lower, which would make these classic natural luxury fibres ideal for applications in the depths of chilly outer-space.

The interdisciplinary team examined the behaviour and function of several animal silks cooled down to liquid nitrogen temperature of -196 C. The fibres included spider silks but the study focused on the thicker and much more commercial fibres of the wild silkworm Antheraea pernyi.

In an article published today in Materials Chemistry Frontiers, the team was able to show not only ‘that’ but also ‘how’ silk increases its toughness under conditions where most materials would become very brittle. Indeed, silk seems to contradict the fundamental understanding of polymer science by not losing but gaining quality under really cold conditions by becoming both stronger and more stretchable. This study examines the ‘how’ and explains the ‘why’. It turns out that the underlying processes rely on the many nano-sized fibrils that make up the core of a silk fibre.

[…]

It would appear that this study has far-reaching implications by suggesting a broad spectrum of novel applications for silks ranging from new materials for use in Earth’s polar regions to novel composites for light-weight aeroplanes and kites flying in the strato- and meso-sphere to, perhaps, even giant webs spun by robot spiders to catch astro-junk in space.

Source: A filament fit for space—silk is proven to thrive in outer space temperatures

U.S. Plans to Test DNA of Immigrants in Detention Centers

The Trump administration is moving to start testing the DNA of people detained by U.S. immigration officers, according to reports of call on Wednesday between senior Department of Homeland Security (DHS) officials and reporters.

Justice Department officials are reportedly developing a new rule that would allow immigration officers to begin collecting the private genetic information of those being held in the more than 200 prison-like facilities spread across the U.S.

The New York Times reported that Homeland Security officials said the testing is part of a plan to root out “fraudulent family units.” Children and people applying for asylum at legal ports of entry may be tested under the proposed rule, which is likely to elicit strong concerns from privacy and immigration advocates in coming days.

The officials also said the DNA of U.S. citizens mistakenly booked in the facilities could be collected, according to the Times.

DHS did not respond to a request for comment.

Source: U.S. Plans to Test DNA of Immigrants in Detention Centers

Zimbabwe shuts down mobile money because cash is being sold at a premium of 50%: basically two competing currencies with the same label

Mobile money is fast blossoming in Africa, boosted by rising mobile adoption across the continent, but in Zimbabwe—which is battling a severe financial crunch—the most common cash-in and cash-out functionalities have just been killed off as the government battles to contain the country’s economic crisis.

Cash-out is process of converting mobile wallet balances into hard cash while cash-in refers to the process of depositing cash into a mobile wallet. Mobile money agents facilitate these processes and normally, the agents have to get the cash from banks against their mobile money balances which are referred to as “float”. These agents then act as mini banks, basically facilitating deposit or withdrawal of cash (cash-in and cash out respectively) by account holders from mobile wallets.

These functionalities, in addition to sending and receiving money as well as payments at supermarkets and other merchants and cross transfers from and into bank accounts constitute the most impactful financial inclusion use cases that mobile money is hinged on across Africa. Success cases also include Kenya and Tanzania while MTN is ready to roll out mobile money in Nigeria.

Yet in Zimbabwe, cash-in and cash-out has just been killed off by the government, because authorities have concluded the functions are being abused. Zimbabwean mobile money agents, mostly with the dominant EcoCash platform, have been capitalizing on cash shortages in Zimbabwe to buy cash for re-sale to mobile wallet holders at a premium of up to 50%. This means that when trying to access funds in your mobile wallet through the agents, one would only get about 50% of their balance.

[…]

This has given rise to the high premiums on cash and also occasioned heavy discounts for cash purchases in retail outlets. However, the Reserve Bank of Zimbabwe justified the freeze on mobile money cash-in and cash-out functionalities, saying on Monday “some economic agents are engaging in illegal activities abusing the cash-in and cash-out facilities” which was compromising national payment systems.

[…]

Large chunks of the country’s economy runs through electronic systems and mobile money, which is dominated by Econet’s Ecocash with 95% market share. It’s estimated around 5 million transactions a day moving more than $200 million.

Most recently Ecocash has struggled to maintain the mobile money system working round the clock as the country has been hit with electricity shortages which have forced it to consider options including Tesla Powerwall storage batteries.

Source: Zimbabwe shuts down mobile money cash options with ecocash — Quartz Africa

​Docker has a business plan headache, another showcase for FOSS money making failure

We love containers. And, for most of us, containers means Docker. As RightScale observed in its RightScale 2018 State of the Cloud report, Docker’s adoption by the industry has increased to 49 percent from 35 percent in 2017.

All’s not well in Docker-land

There’s only one problem with this: While Docker, the technology, is going great guns, Docker, the business, isn’t doing half as well.

[…]

What’s the business plan?

Docker’s problem is simple: It doesn’t have a viable business plan.

It’s not the market. According to 451 Research, “the application container market will explode over the next five years. Annual revenue is expected to increase by 4x, growing from $749 million in 2016 to more than $3.4 billon by 2021, representing a compound annual growth rate (CAGR) of 35 percent.”

But to make that revenue, you need a business that can exploit containers. So, Google, Microsoft, Amazon Web Services (AWS), and all the rest of the big public cloud companies, earn their dollars from customers eager to make the most of their server resources. Others, like Red Hat/CoreOS, Canonical, and Mirantis, provide easy-to-use container approaches for private clouds.

Docker? It provides the open-source framework for the most popular container format. That’s great, but it’s not a business plan.

[…]

Docker’s plan had been, according to former CEO Ben Golub, to build up a subscription business model. The driver behind its Enterprise Edition, with its three levels of service and functionality, was container orchestration using Docker Engine’s swarm mode. Docker, the company, also rebranded Docker, the open-source software, to Moby while continuing to use Docker as the name for its commercial software products.

This led to more than a little confusion. Quick! How many of you knew Moby was now the “official” name for Docker the program? Confusion is not what you want in sales.

Mere weeks later, Golub was out, and Steve Singh, from SAP, was in.

[…]

As Dave Bartoletti, a Forrester analyst, told The Register at the time: “The poor guy has to figure out how to make money at Docker. That’s not easy when a lot of people in the community just bristle at anyone trying to make money.”

The rise of Kubernetes

Making matters much harder for Docker’s business plans is that Docker swarm and all other orchestration programs have found themselves overwhelmed by the rise of Kubernetes.

Today, Kubernetes — whether it’s a grand Google plan to create a Google cloud stack or notdominates cloud orchestration. Even Docker adopted Kubernetes because of customer demand in October 2017.

When your main value-add is container orchestration and everyone and their uncle has adopted another container orchestration program, what can you offer customers? Good question.

[…]

In the last few months, Docker raised another $75 million in venture capital. This brings the total capitalization of Docker to a rather amazing $250 million from ME Cloud Ventures, Benchmark, Coatue Management, Goldman Sachs, and Greylock Partners. That’s a lot of money, but I still don’t see how Docker will pay out.

Cash from investors is great, but what Docker really needs is cash from customers.

For most enterprise users, there are no real worries here. Docker or Moby, the container standard is both open source and an open standard. For Docker investors, well, that’s another story.

Source: ​Docker has a business plan headache | ZDNet

This article suggests that if Docker the company goes bust, it won’t be a problem for Docker users because it’s open source and the community will pick it up and continue development. Unfortunately it’s often the case that the “community” are just the people reporting the bugs and it’s the original handful of developers that are all the people writing the bugfixes and carrying the project forward. In this case it’s a great team of people, who – if they are out of a job – will probably disband and the project will be forked by an internet giant who will repurpose for their own needs and wants.

What is more important is that this is yet another showcase for a hugely popular FOSS project showcasing how ridiculously impossible it is to make money. FOSS needs to change.

ETSI launches specification group on Securing Artificial Intelligence

ETSI is pleased to announce the creation of a new Industry Specification Group on Securing Artificial Intelligence (ISG SAI). The group will develop technical specifications to mitigate threats arising from the deployment of AI throughout multiple ICT-related industries. This includes threats to artificial intelligence systems from both conventional sources and other AIs.

The ETSI Securing Artificial Intelligence group was initiated to anticipate that autonomous mechanical and computing entities may make decisions that act against the relying parties either by design or as a result of malicious intent. The conventional cycle of networks risk analysis and countermeasure deployment represented by the Identify-Protect-Detect-Respond cycle needs to be re-assessed when an autonomous machine is involved.

The intent of the ISG SAI is therefore to address 3 aspects of artificial intelligence in the standards domain:

  • Securing AI from attack e.g. where AI is a component in the system that needs defending
  • Mitigating against AI e.g. where AI is the ‘problem’ or is used to improve and enhance other more conventional attack vectors
  • Using AI to enhance security measures against attack from other things e.g. AI is part of the ‘solution’ or is used to improve and enhance more conventional countermeasures.

The purpose of the ETSI ISG SAI is to develop the technical knowledge that acts as a baseline in ensuring that artificial intelligence is secure. Stakeholders impacted by the activity of ETSI’s group include end users, manufacturers, operators and governments.

Source: ETSI – ETSI launches specification group on Securing Artificial Intelligence

EU court of justice rules opt in is not on if the tickbox is pre ticked

In a court case vs Planet 49 the EU has ruled that you can’t start collecting data just by showing a warning that you are doing so or by having a preselected tickbox stating it’s OK to collect data. The user has to actually go and click the tickbox or OK before any data collection is allowed.

the consent referred to in those provisions is not validly constituted if, in the form of cookies, the storage of information or access to information already stored in a website user’s terminal equipment is permitted by way of a pre-checked checkbox which the user must deselect to refuse his or her consent.

Source: CURIA – Documents

This is a good thing which fights off dark patterning – forcing users into things  they don’t consent to or understand, of which there is more than enough of thank you very much.

EC rules make household appliances more sustainable by forcing right to repair

In a continued effort to reduce Europe’s carbon footprint and to make energy bills cheaper for European consumers, the Commission today adopted new eco-design measures for products such as refrigerators, washing machines, dishwashers and televisions.Improving the ecodesign of products contributes to implementing the ‘Energy efficiency first’ principle of the EU’s Energy Union priority. For the first time the measures include requirements for repairability and recyclability, contributing to circular economy objectives by improving the life span, maintenance, re-use, upgrade, recyclability and waste handling of appliances.

[…]

After a consultation process, the Commission has adopted 10 ecodesign implementing Regulations, setting out energy efficiency and other requirements for the following product groups: refrigerators; washing machines; dishwashers; electronic displays (including televisions); light sources and separate control gears; external power supplies; electric motors; refrigerators with a direct sales function (e.g. fridges in supermarkets, vending machines for cold drinks); power transformers; and welding equipment.

Source: European Commission – PRESS RELEASES – Press release – New rules make household appliances more sustainable

Thousands of ships fitted with ‘cheat devices’ to divert poisonous pollution into sea

Global shipping companies have spent billions rigging vessels with “cheat devices” that circumvent new environmental legislation by dumping pollution into the sea instead of the air, The Independent can reveal.

More than $12bn (£9.7bn) has been spent on the devices, known as open-loop scrubbers, which extract sulphur from the exhaust fumes of ships that run on heavy fuel oil.

This means the vessels meet standards demanded by the International Maritime Organisation (IMO) that kick in on 1 January.

However, the sulphur emitted by the ships is simply re-routed from the exhaust and expelled into the water around the ships, which not only greatly increases the volume of pollutants being pumped into the sea, but also increases carbon dioxide emissions.

The change could have a devastating effect on wildlife in British waters and around the world, experts have warned.

Source: Thousands of ships fitted with ‘cheat devices’ to divert poisonous pollution into sea | The Independent

MS really really wants to know who is using Windows, make it very hard for Win 10 users to create local accounts.

Microsoft has annoyed some of its 900 million Windows 10 device users after apparently removing the ‘Use offline account’ as part of its effort to herd users towards its cloud-based Microsoft Account.

The offline local account is specific to one device, while the Microsoft Account can be used to log in to multiple devices and comes with the benefit of Microsoft’s recent work on passwordless authentication with Windows Hello.

The local account doesn’t require an internet connection or an email address – just a username and password that are stored on the PC

[…]

A user on a popular Reddit thread notes that the local account option is now invisible if the device is connected to the internet.

“Either run the setup without being connected to the internet, or type in a fake phone number a few times and it will give you the prompt to create a local account,” Froggyowns suggested as a solution.

So there is a way around the obstacle but as Reddit user Old_Traveller noted: “It’s such a dick move. I’ll never tie my main OS with an online account.”

[…]

as a user on Hacker News wrote, Microsoft has changed the name of the local account option to ‘Domain join instead’, which then allows admins to create an offline account.

Windows 10 users are accusing Microsoft of employing ‘dark-pattern’ techniques to usher them off local accounts, referring to tricks on websites that software makers use to choose an option that benefits the seller.

Source: Windows 10 users fume: Microsoft, where’s our ‘local account’ option gone? | ZDNet

My PC is at home. Microsoft, who sell the OS, have no right to know who I am or what I am doing with MY PC.

House Antitrust Investigators Now Scrutinizing Google’s Plans to Add DNS Encryption to Chrome

Antitrust investigators with the House Judiciary Committee are looking into Google’s plans to add Domain Name System over Transport Layer Security (DNS over TLS) to its Chrome browser, the Wall Street Journal reported on Sunday, in the latest escalation of scrutiny over the company’s business practices. The Department of Justice has also heard complaints, a source told the paper.

DNS translates a domain name (such as Gizmodo.com) into an IP address. It’s essentially an internet phonebook. While encryption tech like HTTPS is already in place across much of the web, DNS is currently largely unencrypted by default, meaning it’s possible for service providers to ascertain which web sites a user is visiting and thus monetize traffic records.

Google has reportedly been integrating TLS, an additional layer of encryption, into DNS in Chrome—which the Journal notes could protect users against spoofing attacks or unauthorized snooping into their web traffic, but could also prevent the many “service providers who don’t support the new standard from observing user behavior in gathering data.” Opponents have also raised concerns that as Google controls 64 percent of the worldwide browser market and operates its own DNS system, Google Public DNS, the company could flip a switch transferring Chrome users away from service provider-operated DNS. That, the critics say, could allow Google to gain an unfair advantage over user behavior data invaluable for advertising purposes.

In a Sept. 13 letter to the company, investigators with the House committee asked Google for more information on why it is promoting DNS over TLS and whether any of the data collected or processed will be used for profit, the Journal wrote.

“Because the majority of world-wide internet traffic…runs through the Chrome browser or the Android operating system, Google could become the overwhelmingly predominant DNS lookup provider,” a coalition of service providers wrote in a letter to lawmakers this month, per the Journal. “Google would acquire greater control over user data across networks and devices around the world. This could inhibit competitors and possibly foreclose competition in advertising and other industries.”

“Right now, each internet service provider has insight into the traffic of their users, and that’s going to shift,” chief security officer Andy Ellis of Akamai, which does not support the new standard, told the Journal.

Google is planning on starting tests with the new protocol involving one percent of its user base, a less “aggressive strategy” than Mozilla’s Firefox, which the Journal wrote plans to switch users “to the new standard automatically, even if the change involves switching their DNS service providers.” Google denied that it has any plans to become “the centralized DNS provider,” while Mozilla has characterized the issue as griping by service providers who fear it will make it harder to track users for ad purposes,

[…]

Source: House Antitrust Investigators Now Scrutinizing Google’s Plans to Add DNS Encryption to Chrome

There are many problems and advantages with DNS over TLS – basically you make the browser the resolver instead of the (many) DNS providers. This means that you cannot add a private, secret, DNS provider or ISP and not let Google (or Mozilla) know. Countries where censorship exists only have to call these guys up for information on where their websurfing netizens are going. On the other hand, ISPs now have no idea where they are heading.

This happened when SSL/TLS was enforced and suddenly none of the other website statistics providers had any idea how the traffic on the site got there, with the result that almost all of them have died out. There is no real choice but Google Analytics any more for referral traffic, because such a large amount is referred from Google.

Flying Replacement Batteries Could Massively Boost a Drone’s Flight Time

Borrowing a trick from the Air Force, whose planes can complete long-range missions thanks to in-flight refueling from tanker aircraft, researchers at UC Berkeley showed off a novel way to keep small drones in the air almost indefinitely: flying replacement batteries that can be swapped without landing.

The use of four propellers not only helps improve the stability of quadcopter drones while hovering in position, it also makes them incredibly maneuverable and fast. Drone racing has become a dizzying spectacle, but races rarely last longer than a few minutes because four propellers also require four electric motors which can quickly drain a battery. Adding more batteries adds weight, which requires stronger motors, and eventually you reach the point where the length of drone flights reaches a limit and fresh batteries are needed.

For drone racers, swapping in a new power pack between races isn’t a problem. But for other drone applications, like long-range reconnaissance missions or delivering parcels across a large city, having to land to recharge or grab a new battery can add unwanted complications and time delays. Seeking a different solution, researchers at UC Berkeley’s HiPeR Lab (High Performance Robotics Lab) came up with replacement batteries that can not only fly, but also connect to larger drones mid-flight.

To streamline the battery swapping process, which usually requires a cable to be unplugged and plugged back in, the researchers created a quadcopter with a landing pad featuring electrical contact pads on top. The replacement batteries have their own sets of propellers and motors and are designed to fly up and meet the larger drone and then touch down on the landing pad after the craft has stabilized itself. Power is then transferred through the battery’s landing legs, which feature electrical contacts.

Source: Flying Replacement Batteries Could Massively Boost a Drone’s Flight Time

Facebook, WhatsApp Will Have to Share Messages With U.K. Police, breaking encryption. Don’t they realises this gives criminals access too?

Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users’ encrypted messages with British police under a new treaty between the two countries, according to a person familiar with the matter.

The accord, which is set to be signed by next month, will compel social media firms to share information to support investigations into individuals suspected of serious criminal offenses including terrorism and pedophilia, the person said.

Priti Patel, the U.K.’s home secretary, has previously warned that Facebook’s plan to enable users to send end-to-end encrypted messages would benefit criminals, and called on social media firms to develop “back doors” to give intelligence agencies access to their messaging platforms.

The U.K. and the U.S. have agreed not to investigate each other’s citizens as part of the deal, while the U.S. won’t be able to use information obtained from British firms in any cases carrying the death penalty.

Source: Facebook, WhatsApp Will Have to Share Messages With U.K. Police – BNN Bloomberg

Not being able to encrypt stuff ends up benifitting criminals just as much as it does the police, because they will also be able to access the poorly secured information.

Massive wave of account hijacks hits YouTube car community creators, bypassing 2FA

Over the past few days, a massive wave of account hijacks has hit YouTube users, and especially creators in the auto-tuning and car review community, a ZDNet investigation discovered following a tip from one of our readers.

Several high-profile accounts from the YouTube creators car community have fallen victim to these attacks already. The list includes channels such as Built [Instagram post, YouTube channel], Troy Sowers [Instagram post, YouTube channel], MaxtChekVids [YouTube channel], PURE Function [Instagram post, YouTube Support post, YouTube channel], and Musafir [Instagram post, YouTube channel].

But the YouTube car community wasn’t the only one targeted. Other YouTube creatorss also reported having their accounts hijacked last week, and especially over the weekend, with tens of complaints flooding Twitter [1, 2, 3, 4, 5, 6, 7, 8, 9, and many more] and the YouTube support forum [1, 2, 3, 4, 5, 6, 7, 8, 9, and many more].

Coordinated campaign bypassed 2FA

The account hacks are the result of a coordinated campaign that consisted of messages luring users to phishing sites, where hackers logged account credentials.

According to a channel owner who managed to recover their account before this article’s publication and received additional information from YouTube’s staff, we got some insight into how the full attack chain might have gone down.

  • Hackers use phishing emails to lure victims on fake Google login pages, where they collect users’ account credentials
  • Hackers break into Google accounts
  • Hackers re-assign popular channels to new owners
  • Hackers change the channel’s vanity URL, giving the original account owner and his followers the impression that their account had been deleted.
youtube-hacked.png
mage: ZDNet

Some users reported receiving individual emails, while others said they received email chains that included the addresses of multiple YouTube creators, usually from the same community or niche.

This is what appears to have happened with the phishing attacks that targeted the YouTube creators car community, according to a YouTube video from Life of Palos, uploaded over the weekend — see 01:50 video mark.

The same Life of Palos also reported that hackers were capable of bypassing two-factor authentication on users’ accounts. He suggested that hackers might have used Modlishka, a reverse proxy-based phishing toolkit that can also intercept 2FA SMS codes.

However, this is only hearsay, and there is no actual evidence to confirm that hackers used Modlishka specifically. There are plenty of reverse proxy-based phishing toolkits around that can do the same.

Nevertheless, Ryan Scott, the owner of the PURE Function YouTube channel confirmed he used two-factor authentication on his account, validating that hackers did bypass 2FA on some of the hacked accounts.

Source: Massive wave of account hijacks hits YouTube creators | ZDNet

Both YouTube and Facebook allow politicians to ignore their community standards.

Facebook this week finally put into writing what users—especially politically powerful users—have known for years: its community “standards” do not, in fact, apply across the whole community. Speech from politicians is officially exempt from the platform’s fact checking and decency standards, the company has clarified, with a few exceptions.

Facebook communications VP Nick Clegg, himself a former member of the UK Parliament, outlined the policy in a speech and company blog post Tuesday.

Facebook has had a “newsworthiness exemption” to its content guidelines since 2016. That policy was formalized in late October of that year amid a contentious and chaotic US political season and three weeks before the presidential election that would land Donald Trump the White House.

Facebook at the time was uncertain how to handle posts from the Trump campaign, The Wall Street Journal reported. Sources told the paper that Facebook employees were sharply divided over the candidate’s rhetoric about Muslim immigrants and his stated desire for a Muslim travel ban, which several felt were in violation of the service’s hate speech standards. Eventually, the sources said, CEO Mark Zuckerberg weighed in directly and said it would be inappropriate to intervene. Months later, Facebook finally issued its policy.

“We’re going to begin allowing more items that people find newsworthy, significant, or important to the public interest—even if they might otherwise violate our standards,” Facebook wrote at the time.

Clegg’s update says that Facebook by default “will treat speech from politicians as newsworthy content that should, as a general rule, be seen and heard.” Nor will it be subject to fact-checking, as the company does not believe that it is appropriate for it to “referee political debates” or prevent a polician’s speech from both reaching its intended audience and “being subject to public debate and scrutiny.”

https://arstechnica.com/tech-policy/2019/09/facebook-confirms-its-standards-dont-apply-to-politicians/

YouTube CEO Susan Wojcicki said today that content by politicians would stay up on the video-sharing website even if it violates the company’s standards, echoing a position staked out by Facebook this week.

“When you have a political officer that is making information that is really important for their constituents to see, or for other global leaders to see, that is content that we would leave up because we think it’s important for other people to see,” Wojcicki told an audience at The Atlantic Festival this morning.

Wojcicki said the news media is likely to cover controversial content regardless of whether it’s taken down, giving context to understand it. YouTube is owned by Google.

A YouTube spokesperson later told POLITICO that politicians are not treated differently than other users and must abide by its community guidelines. The company grants exemptions to some political speech if the company considers it to be educational, documentary, scientific, or artistic in nature.Morning Tech

Social media firms have seen their policies for reviewing and removing content come under fire in recent years, particularly when such content endorses hate-filled views or incites real-world violence. The issue is even more prickly when it involves world leaders like President Donald Trump, who has used bullying or violent language in social media posts.

YouTube CEO: Politicians can break our content rules

But what constitutes a politician? Anyone in or running for office? What about public servants? County sherrifs? And who decides which of these groups are exempt? That’s the problem with exceptions, you get to make more and more exceptions until almost everyone is an exception.

US immigration uses Google Translate to scan people’s social media for bad posts – Er, don’t do that, says everyone else, including Google

Google recommends that anyone using its translation technology add a disclaimer that translated text may not be accurate.

The US government’s Citizenship and Immigration Services (USCIS) nonetheless has been relying on online translation services offered by Google, Microsoft, and Yahoo to read refugees’ non-English social media posts and judge whether or not they should be allowed into the Land of the Free™.

According to a report from ProPublica, USCIS uses these tools to help evaluate whether refugees should be allowed into the US. In so doing, agency personnel are putting their trust in an untrustworthy algorithm to make entry decisions that may have profound consequences for the health and welfare of those seeking admission to the country.

“The translation of these social media posts can mean life or death for refugees seeking to reunite with their family members,” said Betsy Fisher, director of strategy for the International Refugee Assistance Project (IRAP),” in an email to The Register. “It is dangerous to rely on inadequate technology to inform these unreasonable procedures ostensibly used to vet refugees.”

IRAP obtained a USCIS manual through a public records request and shared it with ProPublica. The manual advises USCIS personnel to use free online translation tools and provides a walkthrough for using Google Translate.

Scanning social media posts for content that would disqualify entry into the US follows from a 2017 executive order and memorandum. The impact of social media scrutiny was made clear recently when Ismail Ajjawi, a resident of Lebanon admitted to Harvard’s class of 2023, was denied entry into America by US Customs and Border Protection because of anti-US posts apparently made by friends.

After ten days of pressure from student petitioners and advocacy groups, CBP determined Ajjawi met its requirements for US entry after all.

To demonstrate the inaccuracy of Google Translate, ProPublica asked Mustafa Menai, who teaches Urdu at the University of Pennsylvania, to translate a Twitter post written in Urdu. By Menai’s estimation, an accurate English translation would be, “I have been spanked a lot and have also gathered a lot of love (from my parents).”

Google Translate’s rendering of the post is, “The beating is too big and the love is too windy.”

Source: US immigration uses Google Translate to scan people’s social media for bad posts – Er, don’t do that, says everyone else • The Register

Card stealing MageCart infection swipes customers details and payment cards from fragrancedirect.co.uk

Online merchant fragrancedirect.co.uk has confirmed a miscreant broke into its systems and made off with a raft of customers’ personal data, including payment card details.

The e-retailer, based in Macclesfield, England, wrote to punters this week to inform them of the digital burglary and the subsequent data leakage.

“We recently discovered that some of our user data may have been compromised as a result of unauthorised access to our website by a malicious third party,” the email states.

The online store then launched an investigation and “quickly identified the root cause and have taken the necessary steps to address the issue”, the note continues.

It added that “Fragrance Direct Username and Password”, along with “Name, Address and Phone Number”, and “Credit and Debit Card Details” spilled into the wrong hands.

Source: What’s that smell? Perfume merchant senses the scent of a digital burglary • The Register

Doordash  Food delivery services Latest Data Breach – 4.9m people have their physical addresses floating around the internet now

Doordash is the latest of the “services you probably use, or at least have an account with” companies to suffer a large data breach. And while your passwords likely haven’t been compromised, it’s possible that your physical address is floating around in the Internet somewhere, among other identifying information.

As Doordash wrote yesterday, an unknown individual accessed data they shouldn’t have on May 4. Among the information that was compromised included:

“Profile information including names, email addresses, delivery addresses, order history, phone numbers, as well as hashed, salted passwords — a form of rendering the actual password indecipherable to third parties.”

Approximately 4.9 million Doordash customers were affected by the breach, but only those who joined the site prior to April 5, 2018. If you signed up for Doordash after that, you’re in the clear.

However, the leaked information doesn’t stop with emails, phone numbers, and names—to name a few. For a subset of those affected, the attacker was able to access the last four digits of their stored credit card, their bank account number, or their drivers’ license numbers.

Doordash is currently reaching out to those whose data might have been compromised; if you haven’t received an email yet, you might be in the clear, but it’s also taking the company a bit of time to send these, so it’s OK to be slightly anxious.

Source: Doordash’s Latest Data Breach: How to Protect Yourself

AI equal with human experts in medical diagnosis with images, study finds

Artificial intelligence is on a par with human experts when it comes to making medical diagnoses based on images, a review has found.

The potential for artificial intelligence in healthcare has caused excitement, with advocates saying it will ease the strain on resources, free up time for doctor-patient interactions and even aid the development of tailored treatment. Last month the government announced £250m of funding for a new NHS artificial intelligence laboratory.

However, experts have warned the latest findings are based on a small number of studies, since the field is littered with poor-quality research.

One burgeoning application is the use of AI in interpreting medical images – a field that relies on deep learning, a sophisticated form of machine learning in which a series of labelled images are fed into algorithms that pick out features within them and learn how to classify similar images. This approach has shown promise in diagnosis of diseases from cancers to eye conditions.

However questions remain about how such deep learning systems measure up to human skills. Now researchers say they have conducted the first comprehensive review of published studies on the issue, and found humans and machines are on a par.

Prof Alastair Denniston, at the University Hospitals Birmingham NHS foundation trust and a co-author of the study, said the results were encouraging but the study was a reality check for some of the hype about AI.

Dr Xiaoxuan Liu, the lead author of the study and from the same NHS trust, agreed. “There are a lot of headlines about AI outperforming humans, but our message is that it can at best be equivalent,” she said.

Writing in the Lancet Digital Health, Denniston, Liu and colleagues reported how they focused on research papers published since 2012 – a pivotal year for deep learning.

An initial search turned up more than 20,000 relevant studies. However, only 14 studies – all based on human disease – reported good quality data, tested the deep learning system with images from a separate dataset to the one used to train it, and showed the same images to human experts.

The team pooled the most promising results from within each of the 14 studies to reveal that deep learning systems correctly detected a disease state 87% of the time – compared with 86% for healthcare professionals – and correctly gave the all-clear 93% of the time, compared with 91% for human experts.

However, the healthcare professionals in these scenarios were not given additional patient information they would have in the real world which could steer their diagnosis.

Prof David Spiegelhalter, the chair of the Winton centre for risk and evidence communication at the University of Cambridge, said the field was awash with poor research.

“This excellent review demonstrates that the massive hype over AI in medicine obscures the lamentable quality of almost all evaluation studies,” he said. “Deep learning can be a powerful and impressive technique, but clinicians and commissioners should be asking the crucial question: what does it actually add to clinical practice?”

Source: AI equal with human experts in medical diagnosis, study finds | Technology | The Guardian

Darknet cybercrime servers hosted in former NATO bunker in Germany busted in 600 policemen operation

A cybercrime data center that was shut down by German authorities was housed inside a former NATO bunker in a sleepy riverside town, police revealed on Friday.

More than 600 law enforcement personnel including Germany’s elite federal police unit, the GSG 9, were involved in an anti-cybercrime operation that took place in the town of Traben-Trarbach on the banks of the Mosel river.

Police officers succeeded in penetrating the building, a 5,000 square meter former NATO bunker with iron doors that goes five floors deep underground. The building was located on a 1.3-hectare (3.2 acre) property secured with a fence and surveillance cameras.

“We had to overcome not only real, or analog, protections; we also cracked the digital protections of the data center,” said regional police chief Johannes Kunz.

Read more: Darknet operator gets six years in connection with 2016 German shooting rampage

The target of the operation was a so-called “bulletproof hosting” service provider. Bulletproof hosters provide IT infrastructure that protects online criminal activity from government intervention.

In the raid, police seized 200 servers along with documents, cell phones, and large quantities of cash. Thursday’s operation was the first time German investigators were able to apprehend a bulletproof hoster, according to German media outlets.

Watch video 01:35

German police claim victory against cyber crime

Cracking the security codes to access the contents of the servers was another difficult task for the police. On the servers, they found countless websites facilitating the illegal sale of drugs, weapons, counterfeit documents, and stolen data as well as sites distributing child pornography. The servers hosted Wall Street Market, formerly the second largest darknet market place for drugs in the word before law enforcement shut the platform down earlier this year.

The police arrested 13 people between the ages of 20 and 59 allegedly tied to the operation. Seven are held in custody. The ringleader is a 59-year-old Dutch man with ties to organized crime in the Netherlands. He established the server in Traben-Trarbach in 2013. While his official residency is listed in Singapore, he had been living in the bunker.

Source: Darknet cybercrime servers hosted in former NATO bunker in Germany | News | DW | 28.09.2019

GNOME is Being Sued Because Shotwell Photo Manager can wirelessly transfer images. The US Patent Office really gave a patent to transfer images and label them to a patent troll.

The GNOME Foundation is facing a lawsuit from Rothschild Patent Imaging, LLC. Rothschild allege that Shotwell, a free and open source personal photo manager infringes its patent.

Neil McGovern, Executive Director for the GNOME Foundation says “We have retained legal counsel and intend to vigorously defend against this baseless suit. Due to the ongoing litigation, we unfortunately cannot make any further comments at this time.”

While Neil cannot make any further comments on this issue, let me throw some lights on this matter.

The patent in the question deals with wireless image distribution. The patent is ridiculous because it could mean any software that transfers images from one device to another could be violating this patent.

And that’s what this lawsuit is about. If you read the lawsuit, you’ll see why Neil called it baseless:

Gnome Shotwell Lawsuite
GNOME Shotwell Lawsuit

Shotwell is not the only one being sued

I did a quick web search with “Rothschild Patent Imaging” and I couldn’t find their website. I am guessing that it doesn’t exist. However, I come across a number of “Rothschild Patent Imaging vs XYZ” lawsuits.

I dig a little deeper. As per patent litigation website RPX Insight, there are six active cases and forty two inactive cases involving Rothschild Patent Imaging.

Rothschiled Patent
Rothschild Patent Imaging Lawsuits

There are a number of companies being sued if there product mentions grouping photos based on date, location etc, facial recognition and transferring images from one device to another. Sounds crazy, right?

But it won’t be crazy if it’s someone’s full time job.

Patent Litigation Abuse aka Patent Trolling

Patent Troll Attacks Gnome Foundation

Rothschild Patent Imaging is owned by Leigh M Rothschild.

The modus operandi of ‘inventor’ Leigh M Rothschild is to get patents on obvious ideas. And that obvious idea would be so broad that they could sue a huge number of organizations. Defendants have two choices, either pay Rothschild to settle the lawsuit or pay even more to lawyers and fight the court battle.

Rothschild Patent Imaging LLC might be formed to sue companies dealing with grouping and transferring images. In 2017, Rothschild Connected Devices Innovations LLC also filed a number of patent infringement lawsuits against companies that hinted mixing drinks and connected devices.

Ars Technica called Rothschild a patent troll because he was demanding $75,000 from each defendant for settling the lawsuits.

Smaller companies might have been intimidated but when Rothschild targeted a giant like Garmin, they hit back. Rothschild backed out of the lawsuit but Garmin filed a counter and Rothschild was asked to pay the legal expenses to Garmin.

Unfortunately, patent trolling is a big business, specially in the United States of America. There are companies with the sole business model of suing other companies. They are almost exclusively based in East Texas where the laws favors such patent trolls. EFF has a dedicated page that lists the victims of patent trolls.

I am so glad that GNOME Foundation has decided to fight this lawsuit vigorously.

Source: GNOME is Being Sued Because of Shotwell Photo Manager