The Linkielist

Linking ideas with the world

The Linkielist

Replacing lithium with sodium in batteries

Posted on by

An international team of scientists from NUST MISIS, Russian Academy of Science and the Helmholtz-Zentrum Dresden-Rossendorf has found that instead of lithium (Li), sodium (Na) “stacked” in a special way can be used for battery production. Sodium batteries would be significantly cheaper and equivalently or even more capacious than existing lithium batteries. The results of the study are published in the journal Nano Energy.

[…]

The most promising replacement for lithium is sodium (Na), since a two-layer arrangement of sodium atoms in bigraphen sandwich demonstrates anode capacity comparable to the capacity of a conventional graphite anode in Li-ion batteries—about 335 mA*h/g against 372 mA*h/g for lithium. However, sodium is much more common than lithium, and therefore cheaper and more easily obtained.

A special way of stacking atoms is actually placing them one above the other. This structure is created by transferring atoms from a piece of metal to the space between two sheets of graphene under high voltage, which simulates the process of charging a battery. In the end, it looks like a sandwich consisting of a layer of carbon, two layers of alkali metal, and another layer of carbon.

[…]

Zakhar Popov, senior researcher at NUST MISIS Laboratory of Inorganic Nanomaterials and RAS, says, “Our simulation shows that lithium atoms bind much more strongly to graphene, but increasing the number of layers of leads to less stability. The opposite trend is observed in the case of sodium—as the number of layers of sodium increases, the stability of such structures increases, so we hope that such materials will be obtained in the experiment.”

The next step of the research team is to create an experimental sample and study it in the laboratory. This will be handled in Max Planck Institute for Solid State Research, Stuttgart, Germany. If successful, it could lead to a new generation of Na batteries that will be significantly cheaper and equivalently or even more capacious than Li-ion batteries.

Source: Replacing lithium with sodium in batteries

FYI Russia is totally hacking the West’s labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies. So is China and Iran.

Posted on by

Russian hackers at the state’s FSB spy agency have been caught breaking into Western institutions working on potential vaccines for the COVID-19 coronavirus in hope of stealing said research. That’s according to the British National Cyber Security Centre and America’s NSA today.

The Kremlin-backed APT29 crew, also known by a variety of other names such as Cozy Bear, Iron Hemlock, or The Dukes, depending on which threat intel company you’re talking to that week, is believed by most reputable analysts to be a wholly owned subsidiary of the FSB, modern-day successor to the infamous Soviet KGB.

NCSC ops director Paul Chichester said in a statement: “We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic.”

Foreign Secretary Dominic Raab added: “It is completely unacceptable that the Russian Intelligence Services are targeting those working to combat the coronavirus pandemic. While others pursue their selfish interests with reckless behaviour, the UK and its allies are getting on with the hard work of finding a vaccine and protecting global health.”

NCSC and its international chums say they are 95 per cent confident that the attacks they investigated came from Russia. By abusing publicly known vulnerabilities, including those in Citrix and popular VPN products, the Russians were able to gain access to targeted networks. Once inside they deploy a custom malware named WellMess or WellMail, it’s claimed.

“WellMess is a lightweight malware designed to execute arbitrary shell commands, upload and download files. The malware supports HTTP, TLS and DNS communications methods,” said NCSC in its advisory [PDF complete with IOCs and detection rules].

WellMail uses SMTP port 25 to communicate, runs commands or scripts, and uploads its findings to a hard-coded command and control server using TLS encryption. Both pieces of malware are written in Go, the open source language devised by Google. The report neatly summarizes the situation:

Throughout 2020, APT29 has targeted various organisations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom, highly likely with the intention of stealing information and intellectual property relating to the development and testing of COVID-19 vaccines.

Intriguingly, NCSC – along with the US CISA and Canada’s Communications Security Establishment – also said APT29 was deploying a custom malware it named SoreFang against products from Chinese enterprise networking biz Sangfor. However, it cautioned that Sangfor was already a target for other malicious folk before APT29 got wind of it and so not all attacks against Sangfor kit were necessarily proof of state-level espionage.

Today’s attribution follows on from warnings back in May that nameless-but-nefarious bods were targeting those same coronavirus research institutions. In light of today’s news, it could be argued that that public shot across the FSB’s bows didn’t do much to stop the digital attacks.

“This also demonstrates that Iron Hemlock (aka APT29, Cozy Bear) is a very capable threat actor that conducts low visibility operations over an extended period, since at least 2018 in this case, while attracting minimal publicity,” Rafe Pilling, a researcher at infosec biz Secureworks, told The Register.

“Every time we see this group emerge in public they are using novel malware and tradecraft. A strong focus on operational security prompts constant change, a stark contrast to some of their comrades in other parts of government and the military.”

He added that it’s not just Russia doing the hacking, although Vladimir Putin’s nation is at the forefront of today’s report: “The NCSC report emphasises that the global interest in COVID-19 is driving an intelligence collection agenda for Russia, as well as nations like Iran, that has previously been identified targeting COVID-19 related research,” he opined.

“The organizations developing vaccines and treatments for the virus are being heavily targeted by Russian, Iranian, and Chinese actors seeking a leg up on their own research.”

Meanwhile, Mandiant Threat Intelligence’s John Hultquist said in a statement that APT29 tended to stay below the radar and steal data, making today’s attribution all the more eye-catching for espionage watchers.

“Despite involvement in several high-profile incidents, APT29 rarely receives the same attention as other Russian actors because they tend to quietly focus on intelligence collection,” he explained. “Whereas GRU actors have brazenly leaked documents and carried out destructive attacks, APT29 digs in for the long term, siphoning intelligence away from its target.”

Back in 2015 Fireeye observed APT29 deploying a Twitter-dependent malware strain it called Hammertoss, while last year Eset spotted the same hackers quietly targeting EU nations’ foreign offices and embassies. It seems the state-backed threat is never all that far away

Source: FYI Russia is totally hacking the West’s labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies • The Register

Secret Trump order gives CIA more powers to launch cyberattacks with less oversight

Posted on by

The Central Intelligence Agency has conducted a series of covert cyber operations against Iran and other targets since winning a secret victory in 2018 when President Trump signed what amounts to a sweeping authorization for such activities, according to former U.S. officials with direct knowledge of the matter.

The secret authorization, known as a presidential finding, gives the spy agency more freedom in both the kinds of operations it conducts and who it targets, undoing many restrictions that had been in place under prior administrations. The finding allows the CIA to more easily authorize its own covert cyber operations, rather than requiring the agency to get approval from the White House.

Unlike previous presidential findings that have focused on a specific foreign policy objective or outcome — such as preventing Iran from becoming a nuclear power — this directive, driven by the National Security Council and crafted by the CIA, focuses more broadly on a capability: covert action in cyberspace.

The “very aggressive” finding “gave the agency very specific authorities to really take the fight offensively to a handful of adversarial countries,” said a former U.S. government official. These countries include Russia, China, Iran and North Korea — which are mentioned directly in the document — but the finding potentially applies to others as well, according to another former official. “The White House wanted a vehicle to strike back,” said the second former official. “And this was the way to do it.”

President Trump and the CIA. (Photo illustration: Yahoo News; photos: AP(3), Getty Images)
President Trump and the CIA. (Photo illustration: Yahoo News; photos: AP(3), Getty Images)

The CIA’s new powers are not about hacking to collect intelligence. Instead, they open the way for the agency to launch offensive cyber operations with the aim of producing disruption — like cutting off electricity or compromising an intelligence operation by dumping documents online — as well as destruction, similar to the U.S.-Israeli 2009 Stuxnet attack, which destroyed centrifuges that Iran used to enrich uranium gas for its nuclear program.

The finding has made it easier for the CIA to damage adversaries’ critical infrastructure, such as petrochemical plants, and to engage in the kind of hack-and-dump operations that Russian hackers and WikiLeaks popularized, in which tranches of stolen documents or data are leaked to journalists or posted on the internet. It has also freed the agency to conduct disruptive operations against organizations that were largely off limits previously, such as banks and other financial institutions.

Another key change with the finding is it lessened the evidentiary requirements that limited the CIA’s ability to conduct covert cyber operations against entities like media organizations, charities, religious institutions or businesses believed to be working on behalf of adversaries’ foreign intelligence services, as well as individuals affiliated with these organizations, according to former officials.

“Before, you would need years of signals and dozens of pages of intelligence to show that this thing is a de facto arm of the government,” a former official told Yahoo News. Now, “as long as you can show that it vaguely looks like the charity is working on behalf of that government, then you’re good.”

The CIA has wasted no time in exercising the new freedoms won under Trump. Since the finding was signed two years ago, the agency has carried out at least a dozen operations that were on its wish list, according to this former official. “This has been a combination of destructive things — stuff is on fire and exploding — and also public dissemination of data: leaking or things that look like leaking.”

Some CIA officials greeted the new finding as a needed reform that allows the agency to act more nimbly. “People were doing backflips in the hallways [when it was signed],” said another former U.S. official.

But critics, including some former U.S. officials, see a potentially dangerous attenuation of intelligence oversight, which could have unintended consequences and even put people’s lives at risk, according to former officials.

The involvement of U.S. intelligence agencies in hack-and-dump activities also raises uncomfortable comparisons for some former officials. “Our government is basically turning into f****ing WikiLeaks, [using] secure communications on the dark web with dissidents, hacking and dumping,” said one such former official.

The CIA declined to comment or respond to an extensive list of questions from Yahoo News. The National Security Council did not respond to multiple written requests for comment.

[…]

Source: Secret Trump order gives CIA more powers to launch cyberattacks

Zoom fixed a vanity URL issue that could have led to phishing attacks

Posted on by

Zoom says it has fixed a security issue that would have let hackers manipulate organizations’ custom URLs for the service and send legitimate-seeming meeting invitations. If a victim accepted the invitation and attended the meeting, the phony caller may have been able to inject malware into their device or carry out a phishing attack.

Hackers could have taken advantage of the exploit in two ways. One involved changing a vanity URL (i.e. http://[whatever].zoom.com) to include a direct link to a phony meeting. The other centered around targeting an organization’s own Zoom web interface, and urging a victim to enter their meeting ID into a malicious vanity URL instead. A video shared by Zoom and Check Point Research, which helped identify and resolve the issue, shows how the exploit worked.

Zoom’s popularity exploded amid the COVID-19 pandemic as people were looking to chat with friends, family and co-workers via video call. In December, around 10 million people participated in Zoom meetings each day, but by April, that figure had shot up exponentially to 300 million. It just launched a lineup of video-calling devices targeted at people who are working from home.

With the increased attention on Zoom came more focus on its security and privacy issues. The company has been trying to fix some of its vulnerabilities in recent months, having announced a 90-day plan in April to beef up security. Among the measures it undertook were the formation of a security council and the rollout of a patch packed with security updates.

Zoom also announced it would incorporate end-to-end encryption (E2EE) on video calls for greater security. At first, it was only going to enable E2EE for paying customers, before it relented and said it’d offer it to all users.

Source: Zoom fixed a vanity URL issue that could have led to phishing attacks | Engadget

Twitter says hack of key staff led to celebrity, politician, biz account hijack mega-spree

Posted on by

Twitter has offered its initial analysis of the Wednesday mass hijacking of prominent twits’ accounts – and suggested it all kicked off after its staff fell for social engineering.

Judging from leaked screenshots of Twitter’s internal systems circulating online and seen by El Reg, it appears one or more miscreants were able to gain direct or indirect access to an administration panel used by Twitter employees to configure accounts, by tricking or coercing the social network’s staff.

From there, the crooks were, at least in some cases, seemingly able to change the registered email addresses of celebrities, corporations, crypto-coin exchanges, publications, and politicians’ accounts – think Apple, Uber, Bill Gates, Elon Musk, Joe Biden, and so on – to an inbox they controlled, requested password resets, and logged in to tweet Bitcoin scams to millions of followers. The miscreants may have been able to disable multi-factor authentication from the inside, too.

According to Vice, hackers boasted they had a paid mole inside Twitter who did all the dirty work for them. The social network’s spokespeople said it was still investigating exactly how it all went down.

Twitter’s support account spelled out its side of the story so far this evening:

The Twitter accounts of both The Register and your humble hack’s brother Anthony Sharwood are verified by the avian network. Both were unable to tweet once Twitter discovered the incident and both received no direct communication from Twitter about the status of our accounts nor any details of whether the incident posed a risk to personal data.

But not all functionality was removed. Sharwood the younger said he was able to send direct messages during the incident. “I sent a guy a DM to apologise that I couldn’t respond to a tweet,” he said.

Indeed, The Register‘s own verified account couldn’t tweet, but could send direct messages as well as retweet and like other tweets.

[…]

The hijackers used their ill-gotten access to post tweets in which celebrities promised to double users’ Bitcoin balances as an act of philanthropy – and more than $100,000 in cryptocurrency was transferred by hopefuls with no sign of any payback. That’s probably a better result than putting incendiary remarks in the mouth of a world leader with millions of followers, though. Or more-than-usually incendiary in the case of a certain US President

Source: Twitter says hack of key staff led to celebrity, politician, biz account hijack mega-spree • The Register

Company that contributes majority of LibreOffice code complains ecosystem is ‘beyond utterly broken’ – no financial model for FOSS

Posted on by

The companies that do most to develop and evolve the LibreOffice productivity suite, both for desktop and cloud, say the project’s business model is “beyond utterly broken” and that The Document Foundation (TDF), the charity that hosts the project, has to change its approach.

The matter is a subject of intense debate within the board of the foundation, set up in 2010 to oversee LibreOffice, a fork of Oracle’s OpenOffice. It touches on a question that crops up repeatedly in various contexts: as usage of open-source software continues to grow, what is the right business model to fund its development?

The TDF’s manifesto promises “to eliminate the digital divide in society by giving everyone access to office productivity tools free of charge.” The document adds that “we encourage corporate participation” but there is nothing about providing an incentive for such companies.

Michael Meeks, managing director at Cambridge-based Collabora, the company that contributes most full-time developers to LibreOffice, has set out the situation in (opinionated) detail here and here.

Meeks is an open-source veteran, having worked on GNOME, OpenOffice, and other prominent projects. Everything was fine at LibreOffice to begin with, and he calls 2012-2014 “the flourishing years.”

Alongside Collabora, there were 15 developers from SUSE, five from Red Hat, one from Canonical, seven from the city of Munich (part of its embrace of open source), and some 40 others from various companies. Many of those have now dropped out, or reduced their commitment, leaving around 40 paid developers in total – of whom Collabora provides 25 and CIB, a Munich-based specialist in document management, seven.

Meeks believes “LibreOffice is at serious risk,” though the matter is complex. TDF has around €1.5m in the bank, Meeks said, but something that may surprise outsiders is that the foundation cannot and does not use that money to employ developers.

Thorsten Behrens, IT lead for LibreOffice at CIB, told The Register: “The TDF is a charity; it’s not in the business of developing software and actually cannot, because that would put it in competition with the commercial ecosystem,” as well as threatening its charitable status.

Most donations go to TDF so if the commercial providers of developers reduce their commitment, TDF remains but the development effort diminishes.

This also means that contributing to LibreOffice by paying for support is currently more effective than donating money to TDF.

Could LibreOffice succeed without paid-for developers?

Behrens pointed to Apache OpenOffice as an example of why this does not work. “It is limping,” he said. “Every two years they release a new version, but everyone who cares moved on to LibreOffice. OpenOffice is the best argument that we have that we need a commercial ecosystem. If we don’t have that, we will end up like them.”

[…]

Source: Company that contributes majority of LibreOffice code complains ecosystem is ‘beyond utterly broken’ • The Register

In 2017 I spoke about this – it’s a tough nut to crack, because there are open source fanatics – who just happen to be paid to develop and promote open source – who keep holding onto a definition of “open source” developed in the 70s. Open source projects are much more complex than they were then, have a much larger user base and require much more coordination from people who aren’t being paid (by a university or foundation) to develop them.

E.U. Court Invalidates Data-Sharing Agreement With U.S.

Posted on by

The European Union’s top court ruled Thursday that an agreement that allows big tech companies to transfer data to the United States is invalid, and that national regulators need to take tougher action to protect the privacy of users’ data.

The ruling does not mean an immediate halt to all data transfers outside the EU, as there is another legal mechanism that some companies can use. But it means that the scrutiny over data transfers will be ramped up and that the EU and U.S. may have to find a new system that guarantees that Europeans’ data is afforded the same privacy protection in the U.S. as it is in the EU.

The case began after former U.S. National Security Agency contractor Edward Snowden revealed in 2013 that the American government was snooping on people’s online data and communications. The revelations included detail on how Facebook gave U.S. security agencies access to the personal data of Europeans.

Austrian activist and law student Max Schrems that year filed a complaint against Facebook, which has its EU base in Ireland, arguing that personal data should not be sent to the U.S., as many companies do, because the data protection is not as strong as in Europe. The EU has some of the toughest data privacy rules under a system known as GDPR.

Source: E.U. Court Invalidates Data-Sharing Agreement With U.S. | Time

Big tech’s reckoning starts with an antitrust committee

Posted on by

On July 27th, the CEOs of Apple, Facebook, Amazon and Google — the “GAFA” companies — will testify in front of the House Judiciary Antitrust Subcommittee. Getting those four people into the same room — even virtually — on the same day is something of a feat and it speaks to how seriously these companies are taking the committee’s long-standing investigation into their practices.

In June last year, the House Judiciary Committee launched a bipartisan investigation into competition in “digital markets.” It said that a “small number of dominant, unregulated platforms,” hold “extraordinary power” over e-commerce, online communication and digital information. It added that this power has a stifling effect on competition and entrepreneurship in both the US and the wider world.

Each CEO will need to explain how their monolithic platforms, like Facebook’s social network, Google’s advertising business and Apple’s App Store, do not violate antitrust law. “Antitrust” is shorthand for the rules around businesses stifling competition in a free and fair market. That includes blocking powerful companies from buying up, copying or pricing out their rivals to the detriment of competition. Regulators are now turning their beady eye toward what ‘big tech’ has been up to for all of these years.

“Both Democrats and Republicans do seem to believe that there’s something wrong with how these big tech companies are operating.” Joel Mitnick is an antitrust lawyer at Cadwalader in New York who began his career as a trial lawyer at the Federal Trade Commission. He says that lawmakers suspect that there’s “something abusive going on terms of their market power.” He added that there’s a belief that these companies are blocking, or excluding, competitors.

As well as these hearings, it’s likely that Google is going to face a separate antitrust lawsuit that’ll be filed towards the end of 2020.  The Wall Street Journal said a cadre of attorneys general want to scrutinize Google’s online advertising business. Apple looks like it’ll be next on the block, with a Politico report from last month saying that Apple’s “easy ride” from lawmakers is coming to an end. It contends that Apple’s control of the app store, and how it treats competing apps from rival developers within its ecosystem, is under quiet scrutiny.

News of a potential US probe into Apple came roughly a week after the European Union began its own investigation. EU officials are investigating whether Apple’s control of the app store “violate EU competition rules,” because you can only buy system apps from the App Store. The fact that apps that offer in-app purchases can only do so through Apple’s system, earning the latter 30 percent commission, is also under scrutiny.

The ultimate goal of any antitrust investigation is to promote competition that will, it’s hoped, benefit the consumer. Critics believe that Apple’s control of the App Store stifles competition and, by extension, is ultimately harmful to consumers. They believe that Apple is essentially creating a market that forces people to use Apple’s own products and services.

The obvious example is the App Store, which is the only way for developers to get their software onto people’s iOS, iPad OS and Watch OS devices. But look at HomePod, the Apple speaker that can only directly access Apple Music. If you want to play from Spotify or other services, you’ll have to use your phone to cast to the speaker. In late June, however, Apple said that it would open HomePod up to third-party services in the coming months as it opens up its products.

Mitnick explained that rather than simply examining companies through the lens of being a “monopolist,” you need to look at “market power.” Apple has historically eschewed being the biggest player in town in favor of catering to a smaller, premium segment of the market. And in consumer technology, there is a wide variety of cheaper products available from its bigger, albeit potentially less profitable, rivals.

But that’s not the case with the iOS ecosystem.  In the US, StatCounter says that iOS has around 58 percent of the market compared to Android’s 41 percent. iPad OS, the tablet-friendly version of iOS, is even more dominant in the US, with StatCounter reporting close to 65 percent of the market. It’s not a monopoly, but Apple appears to be the dominant player in the US.

And, says Mitnick, when a company gets that big “they lose the right to be so exclusionary,” essentially that with great power comes an obligation to be even more scrupulous. After all, if officials can demonstrate in a court that the App Store rules are boxing out developers and stifling competition, they could insist on radical changes. Or, they could decide that buying an Android phone offers enough of an alternative, and that Apple isn’t doing anything wrong.

Apple’s counter-argument to this is that it has done plenty to create a level playing field for its rivals. It charges just a $99 flat fee to any app developer and only asks for a 30-percent cut of any qualifying transaction. (That includes digital goods within the app or subscriptions, although that fee falls to 15 percent in subsequent years.) So long as apps don’t contravene Apple’s own rules, or break the law then developers have carte blanche to do whatever they want. And, right now, the arrangement benefits iPhone/iPad/Watch users who can count on secure apps that have been vetted by Apple.

[…]

Source: Big tech’s reckoning starts with an antitrust committee | Engadget

Let’s be clear – a 30% cut AND a flat fee is a mafia type ripoff only monopolies and the taxman can pull off.

I spoke about this in Zagreb in 2019 and it’s fun to see it all happening.

So kind of SAP NetWeaver to hand out admin accounts to anyone who can reach it. You’ll want to patch this

Posted on by

Dubbed RECON, aka Remotely Exploitable Code On NetWeaver, by its discoverers, security shop Onapsis, the bug in SAP’s NetWeaver AS JAVA (LM Configuration Wizard) allows a remote unathenticated hacker to take over a vulnerable NetWeaver-based system by creating admin accounts without any authorization.

The bug, CVE-2020-6287, is a lack of proper authentication in NetWeaver. This lets unauthorized users create new admin accounts via HTTP, granting miscreants full access: it’s rated 10 out of 10 in terms of severity. The vulnerable Java component is used throughout much of SAP’s product line, so it would be a good idea to check for updates on any SAP code running on your network.

To exploit the flaw, a hacker just needs to be able to reach the software over the network, or the internet if it is public facing.

[…]

Onapsis said it reported the flaw to SAP on May 27. The bug was confirmed later that day and, on June 8, was issued a CVSS score of 10. The flaw was kept under wraps until July 14, when SAP could put out a patch (support note 2934135) as part of its scheduled monthly security update cycle.

Source: So kind of SAP NetWeaver to hand out admin accounts to anyone who can reach it. You’ll want to patch this • The Register

Google faces lawsuit over tracking in apps even when users opted out

Posted on by

Google records what people are doing on hundreds of thousands of mobile apps even when they follow the company’s recommended settings for stopping such monitoring, a lawsuit seeking class action status alleged on Tuesday.

The data privacy lawsuit is the second filed in as many months against Google by the law firm Boies Schiller Flexner on behalf a handful of individual consumers.

[…]

The new complaint in a U.S. district court in San Jose accuses Google of violating federal wiretap law and California privacy law by logging what users are looking at in news, ride-hailing and other types of apps despite them having turned off “Web & App Activity” tracking in their Google account settings.

The lawsuit alleges the data collection happens through Google’s Firebase, a set of software popular among app makers for storing data, delivering notifications and ads, and tracking glitches and clicks. Firebase typically operates inside apps invisibly to consumers.

“Even when consumers follow Google’s own instructions and turn off ‘Web & App Activity’ tracking on their ‘Privacy Controls,’ Google nevertheless continues to intercept consumers’ app usage and app browsing communications and personal information,” the lawsuit contends.

Google uses some Firebase data to improve its products and personalize ads and other content for consumers, according to the lawsuit.

Reuters reported in March that U.S. antitrust investigators are looking into whether Google has unlawfully stifled competition in advertising and other businesses by effectively making Firebase unavoidable.

In its case last month, Boies Schiller Flexner accused Google of surreptitiously recording Chrome browser users’ activity even when they activated what Google calls Incognito mode. Google said it would fight the claim.

Source: Google faces lawsuit over tracking in apps even when users opted out – Reuters

The days of “Do No Evil” are long past

Whiteboard coding interviews are ‘anti-women psychological stress examinations’

Posted on by

People applying for software engineering positions at companies are often asked to solve problems on a whiteboard, under the watchful eye of an interviewer, as a way to assess technical problem solving skills.

But recent research suggests that whiteboard technical tests – so daunting to job seekers that there are books on how to deal with them – often fail to assess technical skill, according to new research. Instead, they’re all about pressure.

In a paper [PDF] to be presented later this year at the ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, researchers from North Carolina State University (NCSU) and Microsoft in the US argue that whiteboard sessions test for stage fright rather than, y’know, coding competency.

The title of the paper hints at its conclusion: “Does Stress Impact Technical Interview Performance?” NCSU authors Mahnaz Behroozi, Shivani Shirolkar, and Chris Parnin, with Titus Barik from Microsoft, say it most certainly does.

“Through a happy accident, the software industry has seemingly reinvented a crude yet effective instrument for reliably introducing stress in subjects, which typically manifests as performance anxiety,” the paper explains.

“A technical interview has an uncanny resemblance to the Trier Social Stress Test, a procedure used for decades by psychologists and is the best known ‘gold standard’ procedure for the sole purpose of reliably inducing stress.”

As a consequence, whiteboard interviews may fail to assess coder competency. Rather, the researchers argue, they measure how well job candidates handle anxiety.

Using 48 graduate and undergraduate students with programming experience, the researchers conducted a randomized controlled trial to compare the traditional technical interview (done while being watched) with a private session evaluation (done without being observed). The experiment was designed to measure cognitive load and stress through the collection of eye tracking metrics, specifically fixation duration and pupil dilation.

The researchers found that stress hinders interview performance, with participants in the traditional technical interview exhibiting higher cognitive load, lower scores, and higher stress levels. In essence, social anxiety took otherwise qualified job candidates out of the running because of the circumstances of the interview.

Further flaws

What’s more, whiteboard technical interviews appear to favor men over women.

“We also observed that no women successfully solved the problem in the public setting, whereas all women solved it correctly in the private setting,” the paper says.

In a phone interview with The Register, Christopher Parnin, assistant professor at NC State University and one of the paper’s co-authors, said he doesn’t have a conclusive reason why this might be the case. He said there’s some support in academic literature to indicate the women have more performance anxiety than men, but he stressed that’s a gross oversimplification because men experience performance anxiety too.

For Parnin, the problem is whiteboard tests themselves. “It all comes down to the fact that the test is designed to make almost anyone fail,” he said. “You’re basically having to interview tons of people just to find those who can pass it.”

Parnin took issue with the way the industry has dealt with the difficulty of its tests. Rather than coming up with a fair way to evaluate software engineers, companies like Google advise at least 40 practice sessions – a time commitment that’s not an option for everyone. This amounts to stress inoculation training and it does help people pass whiteboard tests, he said, but it doesn’t make the tests an effective skill assessment tool.

As an alternative, the paper points to the way devops biz Honeycomb (Hound Technology) – overseen by a female CEO, CTO, CMO and VP of engineering – approaches hiring. The company provides interview questions in advance so it’s not a Trier Social Stress Test.

As the company explains on its website, its goal is to avoid surprises. “The research is clear: unknowns cause anxiety, and people don’t perform well when they’re anxious,” the company says.

“The big picture is to provide more accessible alternatives,” said Parnin. “There are a lot of ways to test for the same thing without putting all this pressure on people.”

Source: You’re testing them wrong: Whiteboard coding interviews are ‘anti-women psychological stress examinations’ • The Register

What Parnin forgets, is that pressure is actually a great part of a software developers’ life and so a very valid thing to test for.

Privacy watchdogs from the UK, Australia team up, snap on gloves to probe AI-for-cops creeeps Clearview

Posted on by

Following Canada’s lead earlier this week, privacy watchdogs in Britain and Australia today launched a joint investigation into how Clearview AI harvests and uses billions of images it scraped from the internet to train its facial-recognition algorithms.

The startup boasted it had collected a database packed with more than three billion photos downloaded from people’s public social media pages. That data helped train its facial-recognition software, which was then sold to law enforcement as a tool to identify potential suspects.

Cops can feed a snapshot of someone taken from, say, CCTV footage into Clearview’s software, which then attempts to identify the person by matching it up with images in its database. If there’s a positive match, the software links to that person’s relevant profiles on social media that may reveal personal details such as their name or where they live. It’s a way to translate previously unseen photos of someone’s face into an online handle so that person can be tracked down.

Now, the UK’s Information Commissioner (ICO) and the Office of the Australian Information Commissioner (OAIC) are collaborating to examine the New York-based upstart’s practices. The investigation will focus “on the company’s use of ‘scraped’ data and biometrics of individuals,” the ICO said in a statement.

“The investigation highlights the importance of enforcement cooperation in protecting the personal information of Australian and UK citizens in a globalised data environment,” it added. “No further comment will be made while the investigation is ongoing.”

Source: Privacy watchdogs from the UK, Australia team up, snap on gloves to probe AI-for-cops upstart Clearview • The Register

Guilty: Russian miscreant who hacked LinkedIn, Dropbox, Formspring, stole 200-million-plus account records

Posted on by

The Russian hacker accused of raiding LinkedIn, Dropbox and Formspring, and obtaining data on 213 million user accounts, has been found guilty.

On Friday, Yevgeniy Nikulin was convicted [PDF] by a San Francisco jury of committing computer intrusion, data theft, and other charges [PDF] relating to the databases he broke into and siphoned off in 2012.

The jury reckoned Nikulin probably swiped the LinkedIn account details, all 117 million of them, for commercial gain, though they didn’t think greed played a role in his theft of 28 million account records from Formspring and 68 million from Dropbox. The Linkedin info was put up for sale, and leaked online along with the Dropbox data and at least a portion of the Formspring haul. The data contained usernames, email addresses, and hashed passwords.

The prosecution outlined how Nikulin had stolen the login credentials of employees at a bunch of US tech firms, and then used them to access back-end systems before downloading vast amounts of personal data that he later sold. Much of the case rested on persuading the jury that various pseudonyms used by the hacker were, in fact, Nikulin.

Despite the unanimous jury decision, it was far from certain Nikulin would be found guilty, with district judge William Alsup repeatedly criticizing the prosecution’s case, at one point calling it “gobbledygook,” and the next day “mumbo jumbo,” as prosecutors tried to connect Nikulin to a wider hacking conspiracy.

Nikulin’s defense team argued the only solid evidence connecting him to the hacker was a document provided by the Russian government whose reliability it questioned, arguing that Nikulin had been set up by the Russians, who were feeding misinformation. Nikulin himself may have been hacked, his lawyer argued.

The FBI in response said that it had tracked Nikulin down to his Moscow apartment by following the hacker’s IP addresses and then confirmed it was him by observing his communications with others. As one example, an FBI agent testified that the hacker, using the alias “dex.007”, had told another hacker that he was going to buy himself a $25,000 watch for his 25th birthday. Nikulin turned 25 the day afterwards, said the agent.

Flash the cash… then dash

It was Nikulin’s ostentatious taste that finally led to his downfall. He was a wanted man, and Interpol, at the request of the US, had issued a Red Notice for his arrest. He attracted the attention of the Czech police when he visited Prague in 2016 with his girlfriend, driving around in a flashy car and spending liberally. The cops nabbed him in a restaurant.

Despite having been arrested four years ago, the trial has been dogged by delays; first by Russian authorities who tried to prevent him being extradited to America, and then following a lengthy dispute over whether he was mentally fit to stand trial.

When the trial finally began, it was almost immediately put on hold due to the coronavirus outbreak and was nearly abandoned after jury members made it plain they were uncomfortable spending the whole day in a confined space.

Source: Guilty: Russian miscreant who hacked LinkedIn, Dropbox, Formspring, stole 200-million-plus account records • The Register

Collabera hacked: IT staffing’n’services giant hit by ransomware, employee personal data stolen

Posted on by

Hackers infiltrated Collabera, siphoned off at least some employees’ personal information, and infected the US-based IT consultancy giant’s systems with ransomware.

We understand this swiped data included workers’ names, addresses, contact and social security numbers, dates of birth, employment benefits, and passport and immigration visa details. Basically, everything needed for identity theft. The recruitment’n’staffing biz, which employs more than 16,000 people globally and banks hundreds of millions of dollars a year in sales, does not believe the lifted records have been used for fraud.

Collabera could not be reached for comment, though El Reg has seen a copy of the internal memo sent to staff disclosing the details of the leak. File-scrambling malware was detected on the IT consultants’ network on June 8, and within a couple of days, it emerged at least some data had been stolen, according to the business.

Source: Collabera hacked: IT staffing’n’services giant hit by ransomware, employee personal data stolen • The Register

Porsche Found a Way to 3D-Print Lightweight Pistons That Add Even More Horsepower

Posted on by

With select bucket seats from the 911 and 718 as well as various classic car parts—including clutch release levers for the 959—already being produced using 3D printing, Porsche is more familiar with the technology than most. Now, the automaker is taking things even further, 3D printing entire pistons for its most powerful 991-gen 911, the GT2 RS.

Although it doesn’t sound like these 3D-printed pistons will actually be found in many production Porsches anytime soon, they represent a bit more than just an engineering flex. There are some very real mechanical benefits here. For starters, they weigh 10 percent less than their forged equivalents and feature an integrated and closed cooling duct in the piston crown that’s apparently unable to be reproduced using traditional manufacturing methods. The decrease in weight and temperature results in an extra 30 horsepower on top of the GT2 RS’s already mighty 700.

Porsche

“Thanks to the new, lighter pistons, we can increase the engine speed, lower the temperature load on the pistons and optimize combustion,” said Porsche advance drive senior engineer Frank Ickinger. “This makes it possible to get up to 30 [horsepower] more power from the 700 [hp] bi-turbo engine, while at the same time improving efficiency.”

Produced in partnership with German auto part maker Mahle and industrial machine manufacturer Trumpf, the pistons are made out of a high-purity metal powder developed in-house by the former using the laser metal fusion process, essentially a laser beam that heats and melts the metal powder into the desired shape. The end result is then validated using measurement technology from Zeiss, the German optics company best known for camera lenses.

With the advent of electric cars, it’s only a matter of time before internal combustion engines become a novelty rather than the default. It’ll be interesting to see how much efficiency (and, in turn, time) 3D-printed components buy for the internal-combustion engine as a whole.

Source: Porsche Found a Way to 3D-Print Lightweight Pistons That Add Even More Horsepower – The Drive

GitHub starts week with 4 whole hours of downtime

Posted on by

GitHub marked the start of the week with more than four hours of downtime, as GitHub Issues, Actions, Pages, Packages and API requests all reported “degraded performance.”

A problem on the world’s most popular code repository and developer collaboration site was first reported around 05:00 UK time (04:00 UTC) this morning and was resolved at 09:30 UK time (08:30 UTC). Basic Git operations were not affected.

GitHub, on the whole, is a relatively reliable site but the impact of downtime is considerable because of its wide use and critical importance. The site has over 44 million users and over 100 million repositories (nearly 34 million of which are public).

The last major outage before today was on 29th June, and before that on 19 June, and 22nd and 23rd May. In the context of such a key service, that isn’t a great recent track record. “You are a dependency to our systems and if this keeps happening, many will say goodbye,” said developer Emad Mokhtar on Twitter.

[…]

GitHub reported on what went wrong in May and June. It turns out that database issues are the most common problem. On May 5, “a shared database table’s auto-incrementing ID column exceeded the size that can be represented by the MySQL Integer type,” said GitHub’s SVP of engineering, Keith Ballinger.

May 22 was another bad day for the company’s MySQL servers. A primary MySQL instance was failed over for planned maintenance, but the newly promoted instance crashed after six seconds. “We manually redirected traffic back to the original primary,” said Ballinger. Recovering the six seconds of writes to the crashed instance, though, caused delays. “A restore of replicas from the new primary was initiated which took approximately four hours with a further hour for cluster reconfiguration to re-enable full read capacity,” he added.

Source: GitHub is just like all of us: The week has just started but it needed 4 whole hours of downtime • The Register

Only 9% of visitors give GDPR consent to be tracked

Posted on by

Most GDPR consent banner implementations are deliberately engineered to be difficult to use and are full of dark patterns that are illegal according to the law.

I wanted to find out how many visitors would engage with a GDPR banner if it were implemented properly and how many would grant consent to their information being collected and shared.

[…]

If you implement a proper GDPR consent banner, a vast majority of visitors will most probably decline to give you consent. 91% to be exact out of 19,000 visitors in my study.

What’s a proper and legal implementation of a GDPR banner?

  • It’s a banner that doesn’t take much space
  • It allows people to browse your site even when ignoring the banner
  • It’s a banner that allows visitors to say “no” just as easy as they can say “yes”

[…]

Source: Only 9% of visitors give GDPR consent to be tracked

JK Rowling joins 150 public figures warning over free speech and instant judgement

Posted on by

They say they applaud a recent “needed reckoning” on racial justice, but argue it has fuelled stifling of open debate.

The letter denounces “a vogue for public shaming and ostracism” and “a blinding moral certainty”.

Several signatories have been attacked for comments that caused offence.

“The free exchange of information and ideas, the lifeblood of a liberal society, is daily becoming more constricted,” says the letter.

US intellectual Noam Chomsky, eminent feminist Gloria Steinem, Russian chess grandmaster Garry Kasparov and author Malcolm Gladwell also put their names to the letter, which was published on Tuesday in Harper’s Magazine.

The appearance of Harry Potter author Rowling’s name among signatories comes after she recently found herself under attack online for comments that offended transgender people.

Her fellow British writer, Martin Amis, also signed the letter.

It also says: “We uphold the value of robust and even caustic counter-speech from all quarters.

“But it is now all too common to hear calls for swift and severe retribution in response to perceived transgressions of speech and thought.”

The letter condemns “disproportionate punishments” meted out by institutional leaders conducting “panicked damage control”.

Media captionWatch former US President Obama talk about “woke” culture

It continues: “Editors are fired for running controversial pieces; books are withdrawn for alleged inauthenticity; journalists are barred from writing on certain topics; professors are investigated for quoting works of literature in class; a researcher is fired for circulating a peer-reviewed academic study; and the heads of organizations are ousted for what are sometimes just clumsy mistakes.”

It was signed by New York Times op-ed contributors David Brooks and Bari Weiss. The newspaper’s editorial page editor was recently removed amid uproar after publishing an opinion piece by Republican Senator Tom Cotton.

Media captionWhat it’s like to be “cancelled”?

“We are already paying the price in greater risk aversion among writers, artists, and journalists who fear for their livelihoods if they depart from the consensus, or even lack sufficient zeal in agreement,” the letter says.

It adds: “We need to preserve the possibility of good-faith disagreement without dire professional consequences.”

Media captionPresident Trump: “Angry mobs are trying to tear down statues of our founders.”

One signatory – Matthew Yglesias, co-founder of liberal news analysis website Vox – was rebuked by a colleague on Tuesday for putting his name to the letter.

Vox critic at large Emily VanDerWerff, a trans woman, tweeted that she had written a letter to the publication’s editors to say that Yglesias signing the letter “makes me feel less safe at Vox”.

But VanDerWerff said she did not want Yglesias to be fired or apologise because it would only convince him he was being “martyred”.

One signatory recanted within hours of the letter being published.

Jennifer Finney Boylan, a US author and transgender activist, tweeted: “I did not know who else had signed that letter.

“I thought I was endorsing a well-meaning, if vague, message against internet shaming.”

She added: “I am so sorry.”

Source: JK Rowling joins 150 public figures warning over free speech – BBC News

This is part of a weaponisation of offensive feelings where moralistic high horse people feels that saying that they’re offended by something allows them to transgress the bounds of normal behaviour.

New study detects global atmosphere rings like a bell

Posted on by

A ringing bell vibrates simultaneously at a low-pitched fundamental tone and at many higher-pitched overtones, producing a pleasant musical sound. A recent study, just published in the Journal of the Atmospheric Sciences by scientists at Kyoto University and the University of Hawai’i at Mānoa, shows that the Earth’s entire atmosphere vibrates in an analogous manner, in a striking confirmation of theories developed by physicists over the last two centuries.

In the case of the , the “music” comes not as a sound we could hear, but in the form of large-scale waves of spanning the globe and traveling around the equator, some moving east-to-west and others west-to-east. Each of these waves is a resonant vibration of the global atmosphere, analogous to one of the resonant pitches of a bell. The basic understanding of these atmospheric resonances began with seminal insights at the beginning of the 19th century by one of history’s greatest scientists, the French physicist and mathematician Pierre-Simon Laplace. Research by physicists over the subsequent two centuries refined the theory and led to detailed predictions of the wave frequencies that should be present in the atmosphere. However, the actual detection of such waves in the has lagged behind the theory.

Now in a new study by Takatoshi Sakazaki, an assistant professor at the Kyoto University Graduate School of Science, and Kevin Hamilton, an Emeritus Professor in the Department of Atmospheric Sciences and the International Pacific Research Center at the University of Hawai?i at Mānoa, the authors present a detailed analysis of observed atmospheric pressure over the globe every hour for 38 years. The results clearly revealed the presence of dozens of the predicted wave modes.

The study focused particularly on waves with periods between 2 hours and 33 hours which travel horizontally through the atmosphere, moving around the globe at great speeds (exceeding 700 miles per hour). This sets up a characteristic “chequerboard” pattern of high and low pressure associated with these waves as they propagate (see figure).

Pressure patterns for 4 of the modes as they propagate around the globe. Credit: Sakazaki and Hamilton (2020)

“For these rapidly moving wave modes, our observed frequencies and global patterns match those theoretically predicted very well,” stated lead author Sakazaki. “It is exciting to see the vision of Laplace and other pioneering physicists so completely validated after two centuries.”

But this discovery does not mean their work is done.

“Our identification of so many modes in real data shows that the atmosphere is indeed ringing like a bell,” commented co-author Hamilton. “This finally resolves a longstanding and classic issue in atmospheric science, but it also opens a new avenue of research to understand both the processes that excite the waves and the processes that act to damp the waves.”

So let the atmospheric music play on!

More information: Takatoshi Sakazaki et al, An Array of Ringing Global Free Modes Discovered in Tropical Surface Pressure Data, Journal of the Atmospheric Sciences (2020). DOI: 10.1175/JAS-D-20-0053.1

Source: New study detects ringing of the global atmosphere

Detroit cops employed facial recognition algos that only misidentifies suspects 96 per cent of the time

Posted on by

Cops in Detroit have admitted using facial-recognition technology that fails to accurately identify potential suspects a whopping 96 per cent of the time.

The revelation was made by the American police force’s chief James Craig during a public hearing, this week. Craig was grilled over the wrongful arrest of Robert Williams, who was mistaken as a shoplifter by facial-recognition software used by officers.

“If we would use the software only [to identify subjects], we would not solve the case 95-97 per cent of the time,” Craig said, Vice first reported. “That’s if we relied totally on the software, which would be against our current policy … If we were just to use the technology by itself, to identify someone, I would say 96 per cent of the time it would misidentify.”

The software was developed by DataWorks Plus, a biometric technology biz based in South Carolina. Multiple studies have demonstrated facial-recognition algorithms often struggle with identifying women and people with darker skin compared to Caucasian men.

Source: Detroit cops employed facial recognition algos that only misidentifies suspects 96 per cent of the time • The Register

Fraunhofer releases H.266/VVC which encodes video 50% smaller

Posted on by

Fraunhofer HHI (together with partners from industry including Apple, Ericsson, Intel, Huawei, Microsoft, Qualcomm, and Sony) is celebrating the release and official adoption of the new global video coding standard H.266/Versatile Video Coding (VVC). This new standard offers improved compression, which reduces data requirements by around 50% of the bit rate relative to the previous standard H.265/High Efficiency Video Coding (HEVC) without compromising visual quality. In other words, H.266/VVC offers faster video transmission for equal perceptual quality. Overall, H.266/VVC provides efficient transmission and storage of all video resolutions from SD to HD up to 4K and 8K, while supporting high dynamic range video and omnidirectional 360° video.

[…]

Through a reduction of data requirements, H.266/VVC makes video transmission in mobile networks (where data capacity is limited) more efficient. For instance, the previous standard H.265/HEVC requires ca. 10 gigabytes of data to transmit a 90-min UHD video. With this new technology, only 5 gigabytes of data are required to achieve the same quality. Because H.266/VVC was developed with ultra-high-resolution video content in mind, the new standard is particularly beneficial when streaming 4K or 8K videos on a flat screen TV. Furthermore, H.266/VVC is ideal for all types of moving images: from high-resolution 360° video panoramas to screen sharing contents.

Source: Fraunhofer Heinrich Hertz Institute HHI

Research Libraries Tell Publishers To Drop Their Awful Lawsuit Against The Internet Archive

Posted on by

I’ve seen a lot of people — including those who are supporting the publishers’ legal attack on the Internet Archive — insist that they “support libraries,” but that the Internet Archive’s Open Library and National Emergency Library are “not libraries.” First off, they’re wrong. But, more importantly, it’s good to see actual librarians now coming out in support of the Internet Archive as well. The Association of Research Libraries has put out a statement asking publishers to drop this counter productive lawsuit, especially since the Internet Archive has shut down the National Emergency Library.

The Association of Research Libraries (ARL) urges an end to the lawsuit against the Internet Archive filed early this month by four major publishers in the United States District Court Southern District of New York, especially now that the National Emergency Library (NEL) has closed two weeks earlier than originally planned.

As the ARL points out, the Internet Archive has been an astounding “force for good” for the dissemination of knowledge and culture — and that includes introducing people to more books.

For nearly 25 years, the Internet Archive (IA) has been a force for good by capturing the world’s knowledge and providing barrier-free access for everyone, contributing services to higher education and the public, including the Wayback Machine that archives the World Wide Web, as well as a host of other services preserving software, audio files, special collections, and more. Over the past four weeks, IA’s Open Library has circulated more than 400,000 digital books without any user cost—including out-of-copyright works, university press titles, and recent works of academic interest—using controlled digital lending (CDL). CDL is a practice whereby libraries lend temporary digital copies of print books they own in a one-to-one ratio of “loaned to owned,” and where the print copy is removed from circulation while the digital copy is in use. CDL is a practice rooted in the fair use right of the US Copyright Act and recent judicial interpretations of that right. During the COVID-19 pandemic, many academic and research libraries have relied on CDL (including IA’s Open Library) to ensure academic and research continuity at a time when many physical collections have been inaccessible.

As ARL and our partner library associations acknowledge, many publishers (including some involved in the lawsuit) are contributing to academic continuity by opening more content during this crisis. As universities and libraries work to ensure scholars and students have the information they need, ARL looks forward to working with publishers to ensure open and equitable access to information. Continuing the litigation against IA for the purpose of recovering statutory damages and shuttering the Open Library would interfere with this shared mutual objective.

It would be nice if the publishers recognized this, but as we’ve said over and over again, these publishers would sue any library if libraries didn’t already exist. The fact that the Open Library looks just marginally different from a traditional library, means they’re unlikely to let go of this stupid, counterproductive lawsuit.

Source: Research Libraries Tell Publishers To Drop Their Awful Lawsuit Against The Internet Archive | Techdirt

European police hacked encrypted phones used by thousands of criminals

Posted on by

In one of the largest law enforcement busts ever, European police and crime agencies hacked an encrypted communications platform used by thousands of criminals and drug traffickers. By infiltrating the platform, Encrochat, police across Europe gained access to a hundred million encrypted messages. In the UK, those messages helped officials arrest 746 suspects, seize £54 million (about $67 million) and confiscate 77 firearms and two tonnes of Class A and B drugs, the National Crime Agency (NCA) reported. According to Vice, police also made arrests in France, the Netherlands, Norway and Sweden.

Encrochat promised highly secure phones that, as Vice explains, were essentially modified Android devices. The company installed its own encrypted messaging platform, removed the GPS, camera and microphone functions and offered features like the ability to wipe the device with a PIN. The phones could make VOIP calls and send texts, but they did little else. They ran two operating systems, one of which appeared normal to evade suspicion. Encrochat used a subscription model, which cost thousands of dollars per year, and users seemed to think that it was foolproof.

Law enforcement agencies began collecting data from Encrochat on April 1st. According to the BBC, the encryption code was likely cracked in early March. It’s not clear exactly how officials hacked the platform, which is now shut down.

Source: European police hacked encrypted phones used by thousands of criminals | Engadget

Uncovered: 1,000 phrases that incorrectly trigger Alexa, Siri, and Google Assistant

Posted on by

As Alexa, Google Home, Siri, and other voice assistants have become fixtures in millions of homes, privacy advocates have grown concerned that their near-constant listening to nearby conversations could pose more risk than benefit to users. New research suggests the privacy threat may be greater than previously thought.

The findings demonstrate how common it is for dialog in TV shows and other sources to produce false triggers that cause the devices to turn on, sometimes sending nearby sounds to Amazon, Apple, Google, or other manufacturers. In all, researchers uncovered more than 1,000 word sequences—including those from Game of Thrones, Modern Family, House of Cards, and news broadcasts—that incorrectly trigger the devices.

“The devices are intentionally programmed in a somewhat forgiving manner, because they are supposed to be able to understand their humans,” one of the researchers, Dorothea Kolossa, said. “Therefore, they are more likely to start up once too often rather than not at all.”

That which must not be said

Examples of words or word sequences that provide false triggers include

  • Alexa: “unacceptable,” “election,” and “a letter”
  • Google Home: “OK, cool,” and “Okay, who is reading”
  • Siri: “a city” and “hey jerry”
  • Microsoft Cortana: “Montana”

The two videos below show a GoT character saying “a letter” and Modern Family character uttering “hey Jerry” and activating Alexa and Siri, respectively.

Accidental Trigger #1 – Alexa – Cloud
Accidental Trigger #3 – Hey Siri – Cloud

In both cases, the phrases activate the device locally, where algorithms analyze the phrases; after mistakenly concluding that these are likely a wake word, the devices then send the audio to remote servers where more robust checking mechanisms also mistake the words for wake terms. In other cases, the words or phrases trick only the local wake word detection but not algorithms in the cloud.

Unacceptable privacy intrusion

When devices wake, the researchers said, they record a portion of what’s said and transmit it to the manufacturer. The audio may then be transcribed and checked by employees in an attempt to improve word recognition. The result: fragments of potentially private conversations can end up in the company logs.

The risk to privacy isn’t solely theoretical. In 2016, law enforcement authorities investigating a murder subpoenaed Amazon for Alexa data transmitted in the moments leading up to the crime. Last year, The Guardian reported that Apple employees sometimes transcribe sensitive conversations overheard by Siri. They include private discussions between doctors and patients, business deals, seemingly criminal dealings, and sexual encounters.

The research paper, titled “Unacceptable, where is my privacy?,” is the product of Lea Schönherr, Maximilian Golla, Jan Wiele, Thorsten Eisenhofer, Dorothea Kolossa, and Thorsten Holz of Ruhr University Bochum and Max Planck Institute for Security and Privacy. In a brief write-up of the findings, they wrote:

Our setup was able to identify more than 1,000 sequences that incorrectly trigger smart speakers. For example, we found that depending on the pronunciation, «Alexa» reacts to the words “unacceptable” and “election,” while «Google» often triggers to “OK, cool.” «Siri» can be fooled by “a city,” «Cortana» by “Montana,” «Computer» by “Peter,” «Amazon» by “and the zone,” and «Echo» by “tobacco.” See videos with examples of such accidental triggers here.

In our paper, we analyze a diverse set of audio sources, explore gender and language biases, and measure the reproducibility of the identified triggers. To better understand accidental triggers, we describe a method to craft them artificially. By reverse-engineering the communication channel of an Amazon Echo, we are able to provide novel insights on how commercial companies deal with such problematic triggers in practice. Finally, we analyze the privacy implications of accidental triggers and discuss potential mechanisms to improve the privacy of smart speakers.

The researchers analyzed voice assistants from Amazon, Apple, Google, Microsoft, and Deutsche Telekom, as well as three Chinese models by Xiaomi, Baidu, and Tencent. Results published on Tuesday focused on the first four. Representatives from Apple, Google, and Microsoft didn’t immediately respond to a request for comment.

The full paper hasn’t yet been published, and the researchers declined to provide a copy ahead of schedule. The general findings, however, already provide further evidence that voice assistants can intrude on users’ privacy even when people don’t think their devices are listening. For those concerned about the issue, it may make sense to keep voice assistants unplugged, turned off, or blocked from listening except when needed—or to forgo using them at all.

Source: Uncovered: 1,000 phrases that incorrectly trigger Alexa, Siri, and Google Assistant | Ars Technica

Ads are taking over Samsung’s Galaxy smartphones — and it needs to stop

Posted on by

I’ve used a Samsung Galaxy smartphone almost every day for nearly 4 years. I used them because Samsung had fantastic hardware that was matched by (usually) excellent software. But in 2020, a Samsung phone is no longer my daily driver, and there’s one simple reason that’s the case: Ads.

Ads Everywhere

Ads in Samsung phones never really bothered me, at least not until the past few months. It started with the Galaxy Z Flip. A tweet from Todd Haselton of CNBC, embedded below, is what really caught my eye. Samsung had put an ad from DirectTV in the stock dialer app. This is really something I never would have expected from any smartphone company, let alone Samsung.

It showed up in the “Places” tab in the dialer app, which is in partnership with Yelp and lets you search for different businesses directly from the dialer app so you don’t need to Google somewhere to find the address or phone number. I looked into it, to see if this was maybe a mistake on Yelp’s part, accidentally displaying an ad where it shouldn’t have, but nope. The ad was placed by Samsung, in an area where it could blend in so they could make money.

Similar ads exist throughout a bunch of Samsung apps. Samsung Music has ads that look like another track in your library. Samsung Health and Samsung Pay have banners for promotional ads. The stock weather app has ads that look like they could be news. There is also more often very blatant advertising in most of these apps as well.

Samsung Music will give you a popup ad for Sirius XM, even though Spotify is built into the Samsung Music app. You can hide the SiriusXM popup, but only for 7 days at a time. A week later, it will be right back there waiting for you. Samsung will also give you push notification ads for new products from Bixby, Samsung Pay, and Samsung Push Service.

If you’re wondering which Samsung apps have ads, I’ve listed all the ones I’ve seen ads in and ad-less alternatives to them below.

Why are there even ads in the first place?

To really understand Samsung’s absurd and terrible advertising on its smartphones, you have to understand why big companies advertise. Google advertises because its “free services” still cost money to provide. The ads they serve you in Google services help cover the cost of that 15GB of storage, Google Voice phone number, unlimited Google Photos storage, and whatnot. That’s all to say there is a reason for it, you are getting something in return for those ads.

Websites and YouTube channels serve ads because the content they are providing to you for free is not free for them to make. They need to be compensated for what they are providing to you for free. Again, you are getting something for free, and serving you an ad acts as a form of payment. There was no purchase of a product, hardware or software, for you to have access to their content and services.

Even Samsung’s top-tier foldables come packed with ads.

Where it differs with Samsung is you are paying — for their hardware. My $1,980 Galaxy Fold is getting ads while using the phone as anyone normally would. While Samsung doesn’t tell us the profit margins on their products, it would not strain anybody’s imagination to suggest that these margins should be able to cover the cost of the services, tenfold. I could maybe understand having ads on the sub-$300 phones where margins are likely much lower, but I think we can all agree that a phone which costs anywhere near $1,000 (or in my case, far more) should not be riddled with advertisements. Margins should be high enough to cover these services, and if they don’t, Samsung is running a bad business.

These ads are showing up on my $1,980 Galaxy Fold, $1,380 Z Flip, $1,400 S20 Ultra, $1,200 S20+, $1,100 Note 10+, $1,000 S10+, and $750 S10e along with the $100 A10e. I can understand it on a $100 phone, but it is inexcusable to have them on a $750 phone, let alone a $1980 phone.

Every other major phone manufacturer provides basically the same services without requiring ads in their stock apps to subsidize them. OnePlus, OPPO, Huawei, and LG all have stock weather apps, payment apps, phone apps, and even health apps that don’t show ads. Sure, some of these OEMs include pre-installed bloatware, like Facebook, Spotify, and Netflix, but these can generally be disabled or uninstalled. Samsung’s ads can not (at least not fully).

When you consider that Samsung not only sells among the most expensive smartphones money can buy, but that it’s blatantly using them as an ad revenue platform, you’re left with one obvious conclusion: Samsung is getting greedy. Samsung is just being greedy. They hope most Samsung customers aren’t going to switch to other phones and will just ignore and deal with the ads. While that’s a very greedy and honestly just bad tactic, it was largely working until they started pushing it with more ads in more apps.

You can’t disable them

If you’re a Samsung user who’s read through all of this, you might be wondering “how do I shut off the ads?” The answer is, unfortunately, you (mostly) can’t.

You can disable Samsung Push Services, which is sometimes used to feed you notifications from Samsung apps. So disabling Push Services means no more push notification ads, but also no more push notifications at all in some Samsung apps.

Source: Ads are taking over Samsung’s Galaxy smartphones — and it needs to stop