NASA / JPL honours open source devs with a badge on their github if their code made it to Mars

Posted on by

[…]

we have worked with JPL to place a new Mars 2020 Helicopter Mission badge on the GitHub profile of every developer who contributed to the specific versions of any open source projects and libraries used by Ingenuity. You can check out the full list of projects like SciPy, Linux, and F Prime (F’) that were used by the JPL team here.

[…]

We are also using this opportunity to introduce a new Achievements section to the GitHub profile. Right now, Achievements include the Mars 2020 Helicopter Mission badge, the Arctic Code Vault badge, and a badge for sponsoring open source work via GitHub Sponsors. Watch this space!

Read the story behind the new badge and how open source contributors helped Ingenuity take flight on The ReadME Project.

Congratulations to the teams at NASA and JPL, and to the thousands of developers who made today’s first Martian flight possible. We’re all still here on Earth, but your code is now on Mars!

Source: Open source goes to Mars 🚀 – The GitHub Blog

As FOSS is hugely powered by recognition, this looks like an awesome step to recognise individual developers as well as projects.

Songwriters Are Getting Short-Changed by Music Streaming, Study Shows

Posted on by

Ever since the music industry began its streaming-fueled recovery around five years ago, the songwriting and publishing communities have been protesting not only the uneven payment structure of streaming — which sees recorded-music rights holders being paid three times what publishing is paid — but also the imbalanced power and payment structures of the music industry. This situation has been thrown into dramatic relief in recent weeks by the formation of the songwriters’ group the Pact and its calls for artists to stop demanding credit and publishing income for songs they did not write — but the organization’s founders also say that it is just the first step in a music economy that has tilted against the people who create the very foundation of that economy: songs.

[…]

But as streaming rose and the industry adapted, artists came to accept that their recorded music — which garnered a fraction of the income in the streaming world that it had in the CD era — had essentially become the way to bring people to the place where they really made money: concerts, where fans not only buy tickets but merchandise as well as CDs and albums.

 

 

Needless to say, songwriters saw little income from that business model — which has been completely up-ended by the pandemic. Now, with most areas of the business looking at streaming as a if not the primary generator of income, the songwriter’s plight is more dire than ever, according to “Rebalancing the Song Economy,” an authoritative new report by industry analysts Mark Mulligan and Keith Jopling of Midia Research(with an introduction by Abba’s Bjorn Ulvaeus).

The 35-page report, which is available here for free, lays out both the history of this dilemma and some (admittedly difficult) proposed solutions, but what may be unprecedented is the way that it lays out how skewed against songwriters the new music economy is. A handful of the many statistics from the study follow:

  • The global music industry revenues (recordings, publishing, live, merchandise, sponsorship) fell by 30% in 2020 due to the combined impact of COVID-19 and a recession
  • Streaming has created a song economy, making the song more important than ever, yet music publisher royalties are more than three times smaller than record label royalties
  • Streaming will bring further strong industry growth, reaching 697 million subscribers and $456 billion in retail revenues, but the royalty imbalance means that label streaming revenue will grow by 3.3 times more than publisher streaming revenue
  • The current royalty system assumes all songs are worth the same – they are not – and rewards poor behavior that dilutes artist and songwriter royalties
  • Music subscribers believe in the value of the song: twice as many (60%) state that the song matters more than the artist, than think the artist matters more (29%)
  • They also believe that songwriters should be remunerated properly: 71% of music subscribers consider it important that streaming services pay songwriters fairly

In a section titled “The Songwriter’s Paradox,” it lays out the ways that the song has become more important than ever, but, paradoxically, the songwriter has less income and influence

 

 

  • Big record labels have weaponized songwriting: In order to try to minimize risks, bigger record labels are turning to an ever more elite group of songwriters to create hits.
  • The emergence of the song economy: The audience has shift its focus from albums to songs.
  • Writing and production are fusing: As music production technologies have become more central to both the songwriting process and to the formation of the final recorded work, there has been a growing fusion of the role of production with writing. This has led to a growing body of superstar writer-producers.
  • The industrialization of songwriting: Record labels are reshaping songwriting by pulling together teams of songwriters to create “machine tooled” hits – finely crafted songs that are “optimized for streaming.” While the upside for songwriters is more work, the downside is sharing an already-small streaming royalties pot with a larger team of creators and co-writers.
  • Decline of traditional formats: Songwriters have long relied upon performance royalties from broadcast TV and radio. However, as the audiences on these platforms migrate towards on-demand alternatives, performance royalties face a long-term decline. Similarly, the continued fall in sales means fewer mechanical royalties for songwriters.
  • Streaming royalties: The song is the first in line culturally but it is last in line for streaming royalties. Of total royalties paid by streaming services to rights holders, between a fifth and a quarter is paid for publishing rights to the song. Labels are paid more than three times higher than publishers on streaming. An independent label artist could earn more than three thousand dollars for a million subscriber streams, whereas a songwriter could expect to earn between $1,200 and $1,400, and even then, only if they are the sole songwriter on the track. On average, songwriters will therefore earn between a third and a half of what artists do.

The report then proposes a series of solutions that are far too complex to summarize fully here, but in short:

  • The song economy requires an interconnected set of solutions across three areas: songwriter remuneration and share, streaming pricing and culture and consumption, with rights holders and streaming services working together
  • Streaming royalties will better serve creators if they recognize that different types of behavior (e.g. lean forward, lean back listening) represent different royalty values and that not all songs are worth the same
  • Fan-centric licensing is a simple concept that may be complex to implement but will bring a crucial foundation of fairness into the song economy
  • Streaming pricing needs a rethink, including ensuring price increases benefit creators, a reduction in the discounting of subscriptions and even metered access to music catalogs, to protect against the current situation of royalty deflation
  • Songwriter careers need to be reshaped, with an opportunity for labels and publishers to work more closely together, including secondments for young songwriters into artist projects, providing predictable income and accelerating their development.

The report concludes with a very British statement: “What is clear is that today’s’ song economy is not working as it should and that everyone across the value chain will benefit from a coordinated programme of change.”

In last week’s Variety article on the Pact, hit songwriter Justin Tranter expressed a similar sentiment in far more direct terms: “The business is definitely still broken and songwriters are definitely the least respected people in our industry, no matter how big of a songwriter you become.”

Source: Songwriters Are Getting Short-Changed by Music Streaming, Study Shows – Variety

Posted in Art

This Artist Uses Drones To Create Gigantic Long-Exposure Light Paintings in the Sky

Posted on by

[…]

artist Frodo Álvarez has come up with a different approach, using just a handful of pre-programmed drones to create towering long-exposure light paintings.

Typically these types of images are created by someone standing in front of a camera with its shutter open for a prolonged period and either waving an LED light wand around, or using brightly colored flashlights to sketch out images in the air that are only visible to the camera’s sensor.

[…]

the flight path of a drone can be precisely controlled and pre-programmed, so Álvarez teamed up with the Madrid-based UMILES entertainment who specializes in using drones to create light shows. This particular project required just five drones to create an image of a soccer player ready to kick a ball. The drones were each flown into a very specific position before turning on their LED lights and then performing a pre-determined flight pattern

[…]

According to PetaPixel, thanks to the drone’s limited battery life and an 11pm curfew in place as a result of the pandemic, the team only had time for four attempts once the sky had sufficiently darkened so the long exposure image wouldn’t be blown out. The scale of the image necessitated the use of multiple drones who were each responsible for just a part of the soccer player’s body so that the light painting would be finished in a specific time frame.

[…]

 

Source: This Artist Uses Drones To Create Gigantic Long-Exposure Light Paintings in the Sky

Posted in Art

Snapchat suit defines free speech – US school decides they can hold an iron grip on their students comms any time any place

Posted on by

At the center of the case is Brandi Levy, who in ninth grade let loose on the platform after learning she didn’t make the varsity cheerleading squad. Compared to the sort of stuff teens get caught pulling on social media now, Levy’s Snap was relatively benign: just a photo of her and a friend flipping off the camera, overlaid with the caption “fuck school fuck softball fuck cheer fuck everything.”

But instead of vanishing into the Snapchat ether, it wound up in the hands of one of the school’s two cheerleading coaches after her daughter saw it on her timeline. Levy ended up being suspended from her school’s junior varsity team for the year, which then led to her family suing the school district. Their argument at the time was that these messages—vulgar as they were—were sent on the weekend, and well outside of Levy’s campus.

It turns out the Third Circuit agreed. This past summer, a federal appeals court ruled that the school’s attempt to control Levy’s off-campus speech constituted a First Amendment violation. The school, in its defense, argued that Levy waived her free speech rights by agreeing to certain cheerleading squad rules, like “[avoiding] foul language and inappropriate gestures,” and having “respect” for “coaches [and] teachers.”

The courts didn’t see it that way. “[These rules] would not cover a weekend post to Snapchat unconnected with any game or school event and before the cheerleading season had even begun,” wrote one of the judges overseeing the case. “It is hard to believe a reasonable student would understand that by agreeing to [them], she was waiving all rights to malign the school once safely off-campus and in the world at large.”

At the core of this ruling is a 1969 case—Tinker v. Des Moines—that centered on an Iowa public school that suspended five students who wore armbands to protest the Vietnam war. The students (and their parents) filed suit against the school, and their case ended up in front of the Supreme Court. In a landmark decision, the court sided with the students, on the grounds that they don’t “shed their constitutional rights at the schoolhouse gate.”

The school district fired back that the 52-year-old ruling doesn’t apply to Levy’s case. Back then, the school argued, the lines between “on” and “off” campus were clearly delineated—but those lines are becoming more blurred by the day, particularly when remote learning became the national norm.

Appealing to the Supreme Court last month, the district wrote that the advent of social media makes it “far easier for students’ off-campus messages to instantly reach a wide audience of classmates and dominate the on-campus environment.”

Source: A Single Snapchat Might Change the Way We Define Free Speech

The best thing: she didn’t make it to the cheerleading team and the team is saying that the student should still abide by their rules. America: this is why people don’t like you.

Pentagon doesn’t really explain odd transfer of 175 million IP addresses to obscure company starting 5 minutes before Trump left office

Posted on by

The US Department of Defense puzzled Internet experts by apparently transferring control of tens of millions of dormant IP addresses to an obscure Florida company just before President Donald Trump left the White House, but the Pentagon has finally offered a partial explanation for why it happened. The Defense Department says it still owns the addresses but that it is using a third-party company in a “pilot” project to conduct security research.

“Minutes before Trump left office, millions of the Pentagon’s dormant IP addresses sprang to life” was the title of a Washington Post article on Saturday. Literally three minutes before Joe Biden became president, a company called Global Resource Systems LLC “discreetly announced to the world’s computer networks a startling development: It now was managing a huge unused swath of the Internet that, for several decades, had been owned by the US military,” the Post said.

The number of Pentagon-owned IP addresses announced by the company rose to 56 million by late January and 175 million by April, making it the world’s largest announcer of IP addresses in the IPv4 global routing table.

[…]

Brett Goldstein, the DDS’s director, said in a statement that his unit had authorized a “pilot effort” publicizing the IP space owned by the Pentagon.

“This pilot will assess, evaluate, and prevent unauthorized use of DoD IP address space,” Goldstein said. “Additionally, this pilot may identify potential vulnerabilities.”

Goldstein described the project as one of the Defense Department’s “many efforts focused on continually improving our cyber posture and defense in response to advanced persistent threats. We are partnering throughout DoD to ensure potential vulnerabilities are mitigated.”

[…]

The Washington Post and Associated Press weren’t able to dig up many details about Global Resource Systems. “The company did not return phone calls or emails from The Associated Press. It has no web presence, though it has the domain grscorp.com,” an AP story yesterday said. “Its name doesn’t appear on the directory of its Plantation, Florida, domicile, and a receptionist drew a blank when an AP reporter asked for a company representative at the office earlier this month. She found its name on a tenant list and suggested trying email. Records show the company has not obtained a business license in Plantation.” The AP apparently wasn’t able to track down people associated with the company.

The AP said that the Pentagon “has not answered many basic questions, beginning with why it chose to entrust management of the address space to a company that seems not to have existed until September.” Global Resource Systems’ name “is identical to that of a firm that independent Internet fraud researcher Ron Guilmette says was sending out email spam using the very same Internet routing identifier,” the AP continued. “It shut down more than a decade ago. All that differs is the type of company. This one’s a limited liability corporation. The other was a corporation. Both used the same street address in Plantation, a suburb of Fort Lauderdale.”

The AP did find out that the Defense Department still owns the IP addresses, saying that “a Defense Department spokesman, Russell Goemaere, told the AP on Saturday that none of the newly announced space has been sold.”

[…]

Madory’s conclusion was that the new statement from the Defense Department “answers some questions,” but “much remains a mystery.” It isn’t clear why the Defense Department didn’t simply announce the address space itself instead of using an obscure outside entity, and it’s unclear why the project came “to life in the final moments of the previous administration,” he wrote.

But something good might come out of it, Madory added: “We likely won’t get all of the answers anytime soon, but we can certainly hope that the DoD uses the threat intel gleaned from the large amounts of background traffic for the benefit of everyone. Maybe they could come to a NANOG conference and present about the troves of erroneous traffic being sent their way.”

Source: Pentagon explains odd transfer of 175 million IP addresses to obscure company | Ars Technica

The Postal Service is running a running a ‘covert operations program’ that monitors Americans’ social media posts

Posted on by

The law enforcement arm of the U.S. Postal Service has been quietly running a program that tracks and collects Americans’ social media posts, including those about planned protests, according to a document obtained by Yahoo News.

The details of the surveillance effort, known as iCOP, or Internet Covert Operations Program, have not previously been made public. The work involves having analysts trawl through social media sites to look for what the document describes as “inflammatory” postings and then sharing that information across government agencies.

[…]

The government’s monitoring of Americans’ social media is the subject of ongoing debate inside and outside government, particularly in recent months, following a rise in domestic unrest. While posts on platforms such as Facebook and Parler have allowed law enforcement to track down and arrest rioters who assaulted the Capitol on Jan. 6, such data collection has also sparked concerns about the government surveilling peaceful protesters or those engaged in protected First Amendment activities.

[…]

The Postal Service isn’t the only part of government expanding its monitoring of social media. In a background call with reporters last month, DHS officials spoke about that department’s involvement in monitoring social media for domestic terrorism threats. “We know that this threat is fueled mainly by false narratives, conspiracy theories and extremist rhetoric read through social media and other online platforms,” one of the officials said. “And that’s why we’re kicking off engagement directly with social media companies.”

[…]

Source: The Postal Service is running a running a ‘covert operations program’ that monitors Americans’ social media posts

New Technique Could Turn Plastic Back Into Oil

Posted on by

There is way too much plastic in the world—and we’re making more every day, even as we struggle to find a way to get rid of the old stuff. A new study poses an interesting solution: Melting plastic bags and bottles back into the oil it was originally made from.

The new research, published Wednesday in Science Advances, looks at a technique called pyrolysis, which essentially melts down polyolefin into its original form—aka oil and gas. Polyolefins are a very common type of plastic in everyday items from drinking straws to packaging to thermal underwear to plastic cling wrap.

[…]

One of the most notable things about the new technique is that it’s able to break down the plastics at lower temperatures than other pyrolysis methods, which helps transform the plastic into denser fuel and uses two to three times less energy.

[…]

Source: New Technique Could Turn Plastic Back Into Oil

The article then goes on to miss the implication that plastics filling our landfills could be reduced massively as they also miss the relevance of old plastics decaying and releasing poisons into the environment.

Signal maker exploits Cellebrite – authoritarian govt phone spying software – to create false reports on phones scanned by them and then forever after

Posted on by

Cellebrite makes software to automate physically extracting and indexing data from mobile devices. They exist within the grey – where enterprise branding joins together with the larcenous to be called “digital intelligence.” Their customer list has included authoritarian regimes in Belarus, Russia, Venezuela, and China; death squads in Bangladesh; military juntas in Myanmar; and those seeking to abuse and oppress in Turkey, UAE, and elsewhere. A few months ago, they announced that they added Signal support to their software.

[…]

They produce two primary pieces of software (both for Windows): UFED and Physical Analyzer.

UFED creates a backup of your device onto the Windows machine running UFED (it is essentially a frontend to adb backup on Android and iTunes backup on iPhone, with some additional parsing). Once a backup has been created, Physical Analyzer then parses the files from the backup in order to display the data in browsable form.

When Cellebrite announced that they added Signal support to their software, all it really meant was that they had added support to Physical Analyzer for the file formats used by Signal. This enables Physical Analyzer to display the Signal data that was extracted from an unlocked device in the Cellebrite user’s physical possession.

One way to think about Cellebrite’s products is that if someone is physically holding your unlocked device in their hands, they could open whatever apps they would like and take screenshots of everything in them to save and go over later. Cellebrite essentially automates that process for someone holding your device in their hands.

[…]

we were surprised to find that very little care seems to have been given to Cellebrite’s own software security. Industry-standard exploit mitigation defenses are missing, and many opportunities for exploitation are present.

As just one example (unrelated to what follows), their software bundles FFmpeg DLLs that were built in 2012 and have not been updated since then. There have been over a hundred security updates in that time, none of which have been applied.

FFmpeg vulnerabiltiies by year

The exploits

Given the number of opportunities present, we found that it’s possible to execute arbitrary code on a Cellebrite machine simply by including a specially formatted but otherwise innocuous file in any app on a device that is subsequently plugged into Cellebrite and scanned. There are virtually no limits on the code that can be executed.

For example, by including a specially formatted but otherwise innocuous file in an app on a device that is then scanned by Cellebrite, it’s possible to execute code that modifies not just the Cellebrite report being created in that scan, but also all previous and future generated Cellebrite reports from all previously scanned devices and all future scanned devices in any arbitrary way (inserting or removing text, email, photos, contacts, files, or any other data), with no detectable timestamp changes or checksum failures. This could even be done at random, and would seriously call the data integrity of Cellebrite’s reports into question.

Any app could contain such a file, and until Cellebrite is able to accurately repair all vulnerabilities in its software with extremely high confidence, the only remedy a Cellebrite user has is to not scan devices.

[…]

In completely unrelated news, upcoming versions of Signal will be periodically fetching files to place in app storage. These files are never used for anything inside Signal and never interact with Signal software or data, but they look nice,

[…]

We have a few different versions of files that we think are aesthetically pleasing, and will iterate through those slowly over time.

Source: Signal >> Blog >> Exploiting vulnerabilities in Cellebrite UFED and Physical Analyzer from an app’s perspective

Nice – so installing Signal on your phone means there is a real possibility that you will get a Cellebrite breaking file on your phone. If they tap you, they will unknowingly break the Cellebrite unit permanently.

NASA Generates Oxygen on Mars, Setting Stage for Crewed Missions

Posted on by

[…]

On April 20, the MOXIE device on Perseverance produced roughly 5 grams of oxygen. That’s a tiny step for NASA and its rover, but a potentially huge leap for humanity and our aspirations on Mars. This small amount of oxygen—extracted from the carbon dioxide-rich Martian atmosphere—is only enough to sustain an astronaut for about five minutes, but it’s the principle of the experiment that matters. This technology demonstration shows that it’s possible to produce oxygen on Mars, a necessary requirement for sustainably working on and departing the Red Planet.

[…]

“Someday we hope to send people to Mars, but they will have to take an awful lot of stuff with them,” Michael Hecht, the principal investigator of the MOXIE project, explained in an email. “The single biggest thing will be a huge tank of oxygen, about 25 tonnes of it.”

Yikes—that converts to approximately 55,100 pounds, or 25,000 kg.

Some of this oxygen will be for the astronauts to breathe, but the “bulk of it” will be used for the rocket “to take the crew off the planet and start them on their journey home again,” Hecht said.

Hence the importance of the MOXIE experiment. Should we be capable of making that oxygen on Mars, it would “save a lot of money, time, and complexity,” said Hecht, but it’s a “challenging new technology that we can only really test properly if we actually do it on Mars,” and that’s “what MOXIE is for, even though it’s a very small scale model.”

[…]

MOXIE works by separating oxygen from carbon dioxide, leaving carbon monoxide as the waste product.

“MOXIE uses electrical energy to take carbon dioxide molecules, CO2, and separate them into two other types of molecule, carbon monoxide (CO) and oxygen (O2),” Hecht explained. “It uses a technology called electrolysis that is very similar to a fuel cell, except that a fuel cell goes the other way—it starts with fuel and oxygen and combines them to get electrical energy out.”

[…]

When asked what surprised him most about the first test, Hecht said it was the identical performance compared to tests done on Earth.

[…]

 

Source: NASA Generates Oxygen on Mars, Setting Stage for Crewed Missions

China behind another hack as U.S. cybersecurity issues mount

Posted on by

China is behind a newly discovered series of hacks against key targets in the U.S. government, private companies and the country’s critical infrastructure, cybersecurity firm Mandiant said Wednesday.

The hack works by breaking into Pulse Secure, a program that businesses often use to let workers remotely connect to their offices. The company announced Tuesday how users can check to see if they were affected but said the software update to prevent the risk to users won’t go out until May.

The campaign is the third distinct and severe cyberespionage operation against the U.S. made public in recent months, stressing an already strained cybersecurity workforce. The U.S. government accused Russia in January of hacking nine government agencies via SolarWinds, a Texas software company widely used by American businesses and government agencies. In March, Microsoft blamed China for starting a free-for-all where scores of different hackers broke into organizations around the world through the Microsoft Exchange email program.

In all three campaigns, the hackers first used those programs to hack into victims’ computer networks, then created backdoors to spy on them for months, if not longer.

The U.S. Cybersecurity and Infrastructure Security Agency, or CISA, said in a warning Tuesday evening the latest hacking campaign is currently “affecting U.S. government agencies, critical infrastructure entities, and other private sector organizations.”

[…]

Source: China behind another hack as U.S. cybersecurity issues mount

If you have a QNAP NAS, stop what you’re doing right now and install latest updates before Qlocker gets you

Posted on by

Two file-scrambling nasties, Qlocker and eCh0raix, are said to be tearing through vulnerable QNAP storage equipment, encrypting data and demanding ransoms to restore the information.

In response, QNAP said on Thursday users should do the following to avoid falling victim:

  • Install the latest software updates for the Multimedia Console, Media Streaming Add-on, and Hybrid Backup Sync apps on their QNAP NAS gear to close off vulnerabilities that can be exploited by ransomware to infect devices.
  • Install the latest Malware Remover tool from QNAP, and run a malware scan. The manufacturer said it has “released an updated version of Malware Remover for operating systems such as QTS and QuTS hero to address the ransomware attack.”
  • Change the network port of the web-based user interface away from the default of 8080, presumably to mitigate future attacks. We’ll assume for now that vulnerable devices are being found and attacked by miscreants scanning the internet for public-facing QNAP products – we’ve asked the manufacturer to comment on this.
  • Make sure they use strong, unique passwords that can’t easily be brute-forced or guessed.
  • If possible, follow the 3-2-1 rule on backups: have at least three good recent copies of your documents stored on at least two types of media, at least one of which is off-site. That means if your files are scrambled, you have a good chance of restoring them from a backup untouched by the malware, thus avoiding having to cough up the demand, if you make sure the software nasty can’t alter said backups.

Source: If you have a QNAP NAS, stop what you’re doing right now and install latest updates. Do it before Qlocker gets you • The Register

Samsung Electronics Expands its Galaxy Upcycling Program to Enable Consumers to Repurpose Galaxy Smartphones into Smart Home Devices

Posted on by

With Galaxy Upcycling at Home, users can easily turn their old Galaxy devices² into smart home devices like a childcare monitor, a pet care solution and other tools that meet individual lifestyle needs.

Make Any Home a Smart Home

The Galaxy Upcycling at Home program provides enhanced sound and light-control features, by repurposing built-in sensors. Users can transform their old devices through SmartThings Labs, a feature within the SmartThings app.

[…]

For a device to continuously detect sound and light, it needs to be actively operating for long periods of time. For this reason, Samsung equipped the Galaxy Upcycling at Home upgrade with battery optimization solutions to minimize battery usage. Devices will also be able to connect effortlessly to SmartThings, allowing them to interact with countless other IoT devices in the SmartThings ecosystem.

[…]

Source: Samsung Electronics Expands its Galaxy Upcycling Program to Enable Consumers to Repurpose Galaxy Smartphones into Smart Home Devices – Samsung US Newsroom

So it can do sound and light detection stuff for you or be used as a controller for your other IoT equipment

Man sues Apple for terminating Apple ID with $24K worth of content and no reason

Posted on by

Apple has been hit with a lawsuit alleging that its media services terms and conditions, which permit the company to terminate an Apple ID, are “unlawful” and “unconscionable.”

The complaint, filed on Tuesday in the U.S. District Court for the Northern District of California, goes after an Apple services clause that states a user with a terminated Apple ID cannot access media content that they’ve purchased.

Through its terms and conditions, Apple retains the right to terminate an Apple ID. More than that, the lawsuit claims that Apple can terminate an account based on mere suspicion.

“Apple’s unlawful and unconscionable clause as a prohibited de facto liquidated damages provision which is triggered when Apple suspects its customers have breached its Terms and Conditions,” the lawsuit reads.

[…]

The plaintiff in the case, Matthew Price, reportedly spent nearly $25,000 on content attached to an Apple ID. When Apple terminated Price’s Apple ID for an alleged violation of its terms and conditions, Price lost access to all of that content.

Source: Man sues Apple for terminating Apple ID with $24K worth of content | AppleInsider

Deere John: Researcher Warns Ag Giant’s Site Provides a Map to Customers, Equipment

Posted on by

Web sites for customers of agricultural equipment maker John Deere contained vulnerabilities that could have allowed a remote attacker to harvest sensitive information on the company’s customers including their names, physical addresses and information on the Deere equipment they own and operate.

The researcher known as “Sick Codes” (@sickcodes) published two advisories on Thursday warning about the flaws in the myjohndeere.com web site and the John Deere Operations Center web site and mobile applications. In a conversation with Security Ledger, the researcher said that a he was able to use VINs (vehicle identification numbers) taken from a farm equipment auction site to identify the name and physical address of the owner. Furthermore, a flaw in the myjohndeere.com website could allow an unauthenticated user to carry out automated attacks against the site, possibly revealing all the user accounts for that site.

Sick Codes disclosed both flaws to John Deere and also to the U.S. Government’s Cybersecurity and Infrastructure Security Agency (CISA), which monitors food and agriculture as a critical infrastructure sector. As of publication, the flaws discovered in the Operations Center have been addressed while the status of the myjohndeere.com flaws is not known.

[…]

the national security consequences of the company’s leaky website could be far greater. Details on what model combines and other equipment is in use on what farm could be of very high value to an attacker, including nation-states interested in disrupting U.S. agricultural production at key junctures, such as during planting or harvest time.

The consolidated nature of U.S. farming means that an attacker with knowledge of specific, Internet connected machinery in use by a small number of large-scale farming operations in the midwestern United States could launch targeted attacks on that equipment that could disrupt the entire U.S. food supply chain.

Despite creating millions of lines of software to run its sophisticated agricultural machinery, Deere has not registered so much as a single vulnerability with the Government’s CVE database, which tracks software flaws.

[…]

“Unlike many industries, there is extreme seasonality in the way John Deere’s implements are used,” Jahn told Security Ledger. “We can easily imagine timed interference with planting or harvest that could be devastating. And it wouldn’t have to persist for very long at the right time of year or during a natural disaster – a compound event.”

[…]

Source: Deere John: Researcher Warns Ag Giant’s Site Provides a Map to Customers, Equipment | The Security Ledger

CEO of Turkish Crypto Platform Thodex Flees Country as Users Say They’re Locked Out

Posted on by

Federal police in Turkey are investigating Thodex, a cryptocurrency trading platform that handles hundred of millions of dollars in trades every day, after users complained they’d been locked out of their accounts, according to new reports from Reuters and Turkey’s TRT World news service. CEO Faruk Fatih Ozer reportedly fled Turkey on Tuesday and 62 people connected to Thodex have reportedly been detained.

Investigators raided Thodex’s headquarters in Istanbul on Thursday after
“thousands” of people in Turkey filed criminal complaints, according to TRT World. Users have been unable to access money in their accounts over the past three days and federal authorities have issued at least 78 arrest warrants, according to Reuters.

[…]

There have been thousands of criminal complaints made in many places around Turkey,” he told Reuters, adding that the platform had 400,000 users, 391,000 of whom were active.

While Reuters reports the CEO had fled to the city of Tirana, Albanian, apparently people at Thodex insist he will be returning to Turkey soon. He’s going to be returning to a lot of pissed off people.

Source: CEO of Turkish Crypto Platform Flees Country as Users Say They’re Locked Out

Apple AirDrop Security Flaw Exposes iPhone Numbers, Emails: Researchers

Posted on by

Apple’s AirDrop feature is a convenient way to share files between the company’s devices, but security researchers from Technische Universitat Darmstadt in Germany are warning that you might be sharing way more than just a file.

According to the researchers, it’s possible for strangers to discover the phone number and email of any nearby AirDrop user. All a bad actor needs is a device with wifi and to be physically close by. They can then simply open up the AirDrop sharing pane on an iOS or macOS device. If you have the feature enabled, it doesn’t even require you to initiate or engage with any sharing to be at risk, according to their findings.

The problem is rooted in AirDrop’s “Contacts Only” option. The researchers say that in order to suss out whether an AirDrop user is in your contacts, it uses a “mutual authentication mechanism” to cross-reference that user’s phone number and email with another’s contacts list. Now, Apple isn’t just doing that willy nilly. It does use encryption for this exchange. The problem is that the hash Apple uses is apparently easily cracked using “simple techniques such as brute-force attacks.” It is not clear from the research what level of computing power would be necessary to brute-force the hashes Apple uses.

[…]

Source: Apple AirDrop Security Flaw Exposes iPhone Numbers, Emails: Researchers

This New App Lets You Turn Anything and Everything Into an NFT

Posted on by

Well, if you have an iPhone, now you can turn practically anything into a unique, one-of-a-kind digital token. A new app is out that, by its own admission, lets you turn “every idea” into an NFT. It’s called S!NG, and it is the first and only free iOS app designed to let you create as many NFTs as you want. Where previously you would have had to pay a crypto exchange to get your asset minted, S!NG does all the minting for you, free of charge.

Founded by ex-Apple executive Geoff Osler, the company has sought to make its product really easy to use, too: it has a point-and-click function—so it’s basically as simple as taking a picture or making a recording on your phone to create them. You can also upload files.

[…]

As the name of the app might suggest, it’s being marketed to artists and musicians. A video on the company’s website claims that S!NG wants to use NFTs to protect creators from intellectual property theft—which is an interesting idea. The thinking here seems to be that because the non-fungibles designate specific ownership over a unique digital asset, they can preclude you from getting your song lyrics or digital recording copied and legally foisted away from you. Thus, the website claims S!NG is the “easiest way to put a stamp on an idea, label it as your own, convert to an NFT and stored in a centralized portfolio,” also adding that the app is a space where ideas can be shared “confidently and hesitation free, without having to lawyer up.” In other words, it’s like that old trick of sending yourself a certified letter to copyright text or song lyrics: it works, but only barely.

While this all sounds pretty good, the flip side is that it makes S!NG sound almost like a notepad app, where every note becomes an NFT. When you consider the ecological toll that NFTs purportedly are wreaking on the world, maybe it’s not a great idea to make every thought you jot down a non-fungible? Then again, people are apparently working on this problem, so maybe we can assume it’ll be a short-lived issue.

[…]

Source: This New App Lets You Turn Anything and Everything Into an NFT

I’m very curious what their business model is. Put an advert into every NFT they create?

Jaguar Land Rover to suspend output due to chip shortage

Posted on by

Jaguar Land Rover (JLR) is shutting its two main car factories temporarily due to a shortage of computer chips.

The difficulties at Britain’s biggest carmaker echo similar problems at other manufacturers, including Ford, who have been hit by a global shortage of chips.

JLR said there would be a “limited period” of closure at its Halewood and Castle Bromwich sites from Monday.

A mixture of strong demand and Covid shutdowns at chipmakers has also hit phone, TV and video games companies.

[…]

Source: Jaguar Land Rover to suspend output due to chip shortage – BBC News

Another fatality of the growing chip shortage

Passwordstate password manager Hacked, Exposing Users’ Passwords for 28 Hours with automatic update

Posted on by

Passwordstate, the enterprise password manager offered by Australian software developer Click Studios, was hacked earlier this week, exposing the passwords of an undisclosed number of its clients for approximately 28 hours. The hack was carried out through an upgrade feature for the password manager and potentially harvested the passwords of those who carried out upgrades.

On Friday, Click Studios issued an incident management advisory about the hack. It explained that the initial vulnerability was related to its upgrade director—which points the in-place update to the appropriate version of the software on the company’s content distribution network—on its website. When customers performed in-place upgrades on Tuesday and Wednesday, they potentially downloaded a malicious file, titled “moserware.secretsplitter.dll,” from a download network not controlled by Click Studios.

Once the malicious file was loaded, it set off a process that extracted information about the computer system as well as data stored in Passwordstate, including URLs, usernames and passwords. The information was then posted to the hackers’ content distribution network.

According to the company, the vulnerability has been addressed and eliminated. Click Studios said that only customers who performed in-place updates between Tuesday, April 20 at 4:33 p.m. ET and Thursday, April 22 at 8:30 p.m. ET are believed to be affected. Customers who carried out manual upgrades of Passwordstate are not compromised.

[…]

Source: Passwordstate Hacked, Exposing Users’ Passwords for 28 Hours

These Are Ingenuity’s First Color In-Flight Photos of Mars

Posted on by

In recent days, NASA published three aerial photos taken by Ingenuity. These aren’t the first photos taken by the rover. It has previously sent back images of its shadows taken with its downward-facing navigation camera. And let’s not forget its watchful and proud surrogate parent, the Perseverance rover, which snaps magnificent photos of the helicopter in action. However, this latest set of images is special because they’re the first color photos of Mars taken by an aerial vehicle while it’s in the air.

Ingenuity’s First Aerial Color Image of Mars

At the time of this image, Ingenuity was 17 feet (5.2 meters) above the surface and pitching (moving the camera’s field of view upward) so the helicopter could begin its 7-foot (2-meter) translation to the west.
At the time of this image, Ingenuity was 17 feet (5.2 meters) above the surface and pitching (moving the camera’s field of view upward) so the helicopter could begin its 7-foot (2-meter) translation to the west.
Photo: NASA/JPL-Caltech

This is the first color image taken by Ingenuity, which is equipped with a high-resolution color camera that contains a 4208 x 3120-pixel sensor, on its April 22 test flight. According to NASA, Ingenuity was 17 feet (5.2 meters) above the surface. It was also moving its field of view upward as it prepared to move sideways for its 51.9-second flight.

Read More

In Third Mars Flight, Ingenuity Goes Beyond All Tests Done on Earth
NASA’s Ingenuity Helicopter Just Completed Its Second Flight on Mars
NASA Generates Oxygen on Mars, Setting Stage for Crewed Missions

“The image, as well as the inset showing a closeup of a portion of the tracks [of] the Perseverance Mars rover and Mars surface features, demonstrates the utility of scouting Martian terrain from an aerial perspective,” NASA explained in the photo’s description.

Speaking of Perseverance, you can check out the six-wheeled rover’s tracks in the winding parallel discolorations on the surface. Apparently, Perseverance itself isn’t too far away, but rather top center and unfortunately out of frame.

“Wright Brothers Field,” which is what NASA has named Ingenuity’s official launch zone, is in the vicinity of the helicopter’s shadow at the bottom center, the space agency said, and its point of takeoff is just below the image. Meanwhile, the black objects on the sides of the photo are Ingenuity’s landing pads. And in case this photo couldn’t get any better, you can see a small part of the horizon on the upper left and right corners.

Ingenuity’s Second Aerial Color Image of Mars

This is the second color image taken by NASA’s Ingenuity helicopter.
This is the second color image taken by NASA’s Ingenuity helicopter.
Photo: NASA/JPL-Caltech

Besides stating that this photo was also taken at an altitude of 17 feet (5.2 meters), NASA didn’t have much to say. Nonetheless, the space agency noted that you could see tracks made by Perseverance here as well.

Ingenuity’s Third Aerial Color Image of Mars

This is the third color image taken by NASA’s Ingenuity helicopter.
This is the third color image taken by NASA’s Ingenuity helicopter.
Photo: NASA/JPL-Caltech

NASA was short on words for this photo, too, but helpfully reminded us that Perseverance’s tracks can be seen in this case if you’re looking. (I was). I see the tracks at the bottom of the photo, but the rest of the picture is a lot more captivating to me.

Source: These Are Ingenuity’s First Color In-Flight Photos of Mars

A Hacker Got All My Texts for $16 – SMS forwarding is a real problem for 2fa

Posted on by

I didn’t expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me.

[…]

I hadn’t been SIM swapped, where hackers trick or bribe telecom employees to port a target’s phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him

[…]

“Welcome to create an account if you want to mess with it, literally anyone can sign up,”

[…]

This also doesn’t rely on SS7 exploitation, where more sophisticated attackers tap into the telecom industry’s backbone to intercept messages on the fly. What Lucky225 did with Sakari is easier to pull off and requires less technical skill or knowledge. Unlike SIM jacking, where a victim loses cell service entirely, my phone seemed normal. Except I never received the messages intended for me, but he did.

[…]

“I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info,” Lucky225 added, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers. (Cyber security company Okey Systems, where Lucky225 is Director of Information, has released a tool that companies and consumers can use to detect this attack and other types of phone number takeovers).

[…]

“Sakari is a business text messaging service that allows businesses to send SMS reminders, alerts, confirmations and marketing campaigns,” the company’s website reads.

For businesses, sending text messages to hundreds, thousands, or perhaps millions of customers can be a laborious task. Sakari streamlines that process by letting business customers import their own number. A wide ecosystem of these companies exist, each advertising their own ability to run text messaging for other businesses. Some firms say they only allow customers to reroute messages for business landlines or VoIP phones, while others allow mobile numbers too.

Sakari offers a free trial to anyone wishing to see what the company’s dashboard looks like. The cheapest plan, which allows customers to add a phone number they want to send and receive texts as, is where the $16 goes. Lucky225 provided Motherboard with screenshots of Sakari’s interface, which show a red “+” symbol where users can add a number.

While adding a number, Sakari provides the Letter of Authorization for the user to sign. Sakari’s LOA says that the user should not conduct any unlawful, harassing, or inappropriate behaviour with the text messaging service and phone number.

But as Lucky225 showed, a user can just sign up with someone else’s number and receive their text messages instead.

[…]

In Sakari’s case, it receives the capability to control the rerouting of text messages from another firm called Bandwidth, according to a copy of Sakari’s LOA obtained by Motherboard. Bandwidth told Motherboard that it helps manage number assignment and traffic routing through its relationship with another company called NetNumber. NetNumber owns and operates the proprietary, centralized database that the industry uses for text message routing, the Override Service Registry (OSR), Bandwidth said.

[…]

Source: A Hacker Got All My Texts for $16

Internet Privacy in the Age of Surveillance – China, Russia, Nork vs USA + GB

Posted on by

Pew Research Center reports that “91% of adults agree or strongly agree that consumers have lost control of how personal information is collected.”

That incredibly-high statistic must describe victims under authoritarian governments like China, Russia, or North Korea, right?

Wrong.

That study was about US citizens. You know, the land of the free.

91%
That’s the percentage of adults living in the US who agree that consumers have lost control of how personal information is collected and used by companies.

The sad truth is that governments of every shape and size are ramping up mass surveillance with little-to-no objection.

We live on the internet. But does that interconnection work in their favor, providing more opportunities to pierce our online privacy?

The simplest way to settle that score is to compare how the espionage efforts of the United States and their allies compare to other oppressive regimes.

[…]

Source: Internet Privacy in the Age of Surveillance | CyberGhostVPN Privacy Hub – Latest Privacy and Security News

Well, the US and the UK don’t come out favoribly.

EU draft AI regulation is leaked. Deostn’ define what AI is, but what risk is and how to handle it.

Posted on by

the draft “Regulation On A European Approach For Artificial Intelligence” leaked earlier this week, it made quite the splash – and not just because it’s the size of a novella. It goes to town on AI just as fiercely as GDPR did on data, proposing chains of responsibility, defining “high risk AI” that gets the full force of the regs, proposing multi-million euro fines for non-compliance, and defining a whole set of harmful behaviours and limits to what AI can do with individuals and in general.

What it does not do is define AI, saying that the technology is changing so rapidly it makes sense only to regulate what it does, not what it is. So yes, chatbots are included, even though you can write a simple one in a few lines of ZX Spectrum BASIC. In general, if it’s sold as AI, it’s going to get treated like AI. That’ll make marketing think twice.

[…]

A regulated market puts responsibilities on your suppliers that will limit your own liabilities: a well-regulated market can enable as much as it moderates. And if AI doesn’t go wrong, well, the regulator leaves you alone. Your toy Spectrum chatbot sold as an entertainment won’t hurt anyone: chatbots let loose on social media to learn via AI what humans do and then amplify hate speech? Doubtless there are “free speech for hatebots” groups out there: not on my continent, thanks.

It also means that countries with less-well regulated markets can’t take advantage. China has a history of aggressive AI development to monitor and control its population, and there are certainly ways to turn a buck or yuan by tightly controlling your consumers. But nobody could make a euro at it, as it wouldn’t be allowed to exist within, or offer services to, the EU. Regulations that are primarily protectionist for economic reasons are problematic, but ones that say you can’t sell cut-price poison in a medicine bottle tend to do good.

[…]

There will be regulation. There will be costs. There will be things you can’t do then that you can now. But there will be things you can do that you couldn’t do otherwise, and while the level playing field of the regulators’ dreams is never quite as smooth for the small company as the big, there’ll be much less snake oil to slip on.

It may be an artificial approach to running a market, but it is intelligent.

Source: Truth and consequences for enterprise AI as EU know who goes legal: GDPR of everything from chatbots to machine learning • The Register

They classify high risk AIs and require them to be registered and monitored and there to be contact people for them as well as give insight into how they work. They also want a pan EU dataset for AIs to train on. There’s a lot of really good stuff in there.

Nasa successfully flies small helicopter on Mars – first powered flight on another planet

Posted on by

The drone, called Ingenuity, was airborne for less than a minute, but Nasa is celebrating what represents the first powered, controlled flight by an aircraft on another world.

Confirmation came via a satellite at Mars which relayed the chopper’s data back to Earth.

The space agency is promising more adventurous flights in the days ahead.

Ingenuity will be commanded to fly higher and further as engineers seek to test the limits of the technology.

The rotorcraft was carried to Mars in the belly of Nasa’s Perseverance Rover, which touched down in Jezero Crater on the Red Planet in February.

Graphic

“We can now say that human beings have flown a rotorcraft on another planet,” said a delighted MiMi Aung, project manager for Ingenuity at Nasa’s Jet Propulsion Laboratory (JPL) in Pasadena, California.

[…]

Ingenuity even carries a small swatch of fabric from one of the wings of Flyer 1, the aircraft that made that historic flight at Kitty Hawk, North Carolina, more than 117 years ago.

Shadowimage copyrightNASA/JPL-CALTECH
image captionThe chopper took this image of its own shadow on the ground

[…]

The demonstration saw the Mars-copter rise to about 3m, hover, swivel and then land. In all, it managed almost 40 seconds of flight, from take-off to landing.

Getting airborne on the Red Planet is not easy. The atmosphere is very thin, just 1% of the density here at Earth. This gives the blades on a rotorcraft very little to bite into to gain lift.

There’s help from the lower gravity at Mars, but still – it takes a lot of work to get up off the ground

Ingenuity was therefore made extremely light and given the power (a peak power of 350 watts) to turn those blades extremely fast – at over 2,500 revolutions per minute for this particular flight.

Control was autonomous. The distance to Mars – currently just under 300 million km – means radio signals take minutes to traverse the intervening space. Flying by joystick is simply out of the question.

[…]

Ingenuity has two cameras onboard. A black-and-white camera that points down to the ground, which is used for navigation, and a high-resolution colour camera that looks out to the horizon.

A sample navigation image sent back to Earth revealed the helicopter’s shadow on the floor of the crater as it came back in to land. Satellites will send home more pictures of the flight over the next day. There was only sufficient bandwidth in the orbiters’ first overflight to return a short snatch of video from Perseverance, which was watching and snapping away from a distance of 65m. Longer sequences should become available in due course.

Selfie of helicopter and roverimage copyrightNasa
image captionA selfie of the Ingenuity helicopter and the Perseverance rover

Nasa has announced that the “airstrip” in Jezero where Perseverance dropped off Ingenuity for its demonstration will henceforth be known as the “Wright Brothers Field”.

The International Civil Aviation Organization (ICAO) – the United Nations’ civil aviation agency – has also presented the Nasa and the US Federal Aviation Administration with an official ICAO designator: IGY, call-sign INGENUITY.

A successful maiden outing means that a further four flights will be attempted over the coming days, each one taking the helicopter further afield.

Source: Nasa successfully flies small helicopter on Mars – BBC News