The Linkielist

Linking ideas with the world

The Linkielist

Epic Games CEO speaks out against Apple, Google app store monopoly

Posted on by

Tim Sweeney, CEO of Fortnite developer Epic Games, criticized Apple and Google for having an “absolute monopoly” on app stores in a Friday interview with CNBC. There aren’t many viable options for distributing mobile software outside the Apple App Store and the Google Play Store, and Sweeney chides both for taking a 30 percent fee from in-app purchases.

Epic Games launched the Epic Games Store in late 2018 for Windows and Mac computers, and only charges other publishers a 12 percent fee on in-app purchases. The Epic Games Store hasn’t made it to the App Store because of Apple’s strict guidelines against competing software stores.

“They [Apple] are preventing an entire category of businesses and applications from being engulfed in their ecosystem by virtue of excluding competitors from each aspect of their business that they’re protecting,” Sweeney said.

Epic previously made Fortnite available to Android devices not by offering it on the Google Play Store, but instead through a launcher on the Fortnite website that downloaded the game. This allowed Epic to sidestep the 30 percent fee from Google. But the download process was too involved for many users, so Fortnite eventually launched on Google Play earlier this year. Sweeney said the company still plans to bring the Epic Games Store to Android. “Google essentially intentionally stifles competing stores by having user interface barriers and obstruction,” Sweeney said.

Epic isn’t the first company to speak out against Apple and Google’s 30 percent fee. In March of last year, Spotify CEO Daniel Ek filed an unfair competition complaint against Apple with the European Commission, citing the fee as forcing them to artificially inflate the price of its Spotify Premium membership. Last July, Tinder introduced a default payment process into its Android app meant to bypass the Google Play Store fee.

Source: Epic Games CEO speaks out against Apple, Google app store ‘monopoly’ | Engadget

I have been talking about the growing monopoly of the tech giants since beginning of 2019

Will Garmin Pay $10 Million Ransom To End Two-Day Outage?

Posted on by

Garmin is reportedly being asked to pay a $10 million ransom to free its systems from a cyberattack that has taken down many of its services for two days.

The navigation company was hit by a ransomware attack on Thursday, leaving customers unable to log fitness sessions in Garmin apps and pilots unable to download flight plans for aircraft navigation systems, among other problems. The company’s communication systems have also been taken offline, leaving it unable to respond to disgruntled customers.

Garmin employees have told BleepingComputer that the company was struck down by the WastedLocker ransomware. Screenshots sent to BleepingComputer show long lists of the company’s files encrypted by the malware, with a ransom note attached to each file.

MORE FROM FORBESSpotify Security Hole Lets Strangers Into Your Family AccountBy Barry Collins

The ransom note tells the recipient to email one of two email addresses to “get a price for your data”. That price, Garmin’s sources have told BleepingComputer, is $10 million.

Crippled Garmin

The ransomware attack has crippled many of the company’s systems. Reports claim that Garmin’s IT department shut down all of the company’s computers, including those of employees working from home who were connected by VPN, to halt the spread of the ransomware across its network.

Garmin’s Taiwan factories have reportedly closed production lines yesterday and today while the company attempts to unpick the ransomware.

The shutdown is having a big effect on Garmin’s customers. DownDetector reveals a huge spike today in people having trouble accessing Garmin Connect, the app that logs fitness routines for the company’s devices. More people are likely to be using such devices at the weekend.

The problem is even more serious for Garmin’s aviation device customers. Pilots have told ZDNet that they are unable to download a version of Garmin’s aviation database onto their airplane navigation systems, which is an FAA requirement.

Garmin has issued very little public comment about the problem. On Thursday, the company issued a tweet saying “we are currently experiencing an outage that affects Garmin Connect,” adding that the outage “also affects our call centers and we are currently unable to receive any calls, emails or online chats”.

Garmin has been approached for comment, but as you can appreciate from the statement above, that’s somewhat complicated…

Source: Will Garmin Pay $10 Million Ransom To End Two-Day Outage?

Cognitive Radios Will Go Where No Deep-Space Mission Has Gone Before

Posted on by

Space seems empty and therefore the perfect environment for radio communications. Don’t let that fool you: There’s still plenty that can disrupt radio communications. Earth’s fluctuating ionosphere can impair a link between a satellite and a ground station. The materials of the antenna can be distorted as it heats and cools. And the near-vacuum of space is filled with low-level ambient radio emanations, known as cosmic noise, which come from distant quasars, the sun, and the center of our Milky Way galaxy. This noise also includes the cosmic microwave background radiation, a ghost of the big bang. Although faint, these cosmic sources can overwhelm a wireless signal over interplanetary distances.

Depending on a spacecraft’s mission, or even the particular phase of the mission, different link qualities may be desirable, such as maximizing data throughput, minimizing power usage, or ensuring that certain critical data gets through. To maintain connectivity, the communications system constantly needs to tailor its operations to the surrounding environment.

Imagine a group of astronauts on Mars. To connect to a ground station on Earth, they’ll rely on a relay satellite orbiting Mars. As the space environment changes and the planets move relative to one another, the radio settings on the ground station, the satellite orbiting Mars, and the Martian lander will need continual adjustments. The astronauts could wait 8 to 40 minutes—the duration of a round trip—for instructions from mission control on how to adjust the settings. A better alternative is to have the radios use neural networks to adjust their settings in real time. Neural networks maintain and optimize a radio’s ability to keep in contact, even under extreme conditions such as Martian orbit. Rather than waiting for a human on Earth to tell the radio how to adapt its systems—during which the commands may have already become outdated—a radio with a neural network can do it on the fly.

Such a device is called a cognitive radio. Its neural network autonomously senses the changes in its environment, adjusts its settings accordingly—and then, most important of all, learns from the experience. That means a cognitive radio can try out new configurations in new situations, which makes it more robust in unknown environments than a traditional radio would be. Cognitive radios are thus ideal for space communications, especially far beyond Earth orbit, where the environments are relatively unknown, human intervention is impossible, and maintaining connectivity is vital.

Worcester Polytechnic Institute and Penn State University, in cooperation with NASA, recently tested the first cognitive radios designed to operate in space and keep missions in contact with Earth. In our tests, even the most basic cognitive radios maintained a clear signal between the International Space Station (ISS) and the ground. We believe that with further research, more advanced, more capable cognitive radios can play an integral part in successful deep-space missions in the future, where there will be no margin for error.

Future crews to the moon and Mars will have more than enough to do collecting field samples, performing scientific experiments, conducting land surveys, and keeping their equipment in working order. Cognitive radios will free those crews from the onus of maintaining the communications link. Even more important is that cognitive radios will help ensure that an unexpected occurrence in deep space doesn’t sever the link, cutting the crew’s last tether to Earth, millions of kilometers away.

Cognitive radio as an idea was first proposed by Joseph Mitola III at the KTH Royal Institute of Technology, in Stockholm, in 1998. Since then, many cognitive radio projects have been undertaken, but most were limited in scope or tested just a part of a system. The most robust cognitive radios tested to date have been built by the U.S. Department of Defense.

When designing a traditional wireless communications system, engineers generally use mathematical models to represent the radio and the environment in which it will operate. The models try to describe how signals might reflect off buildings or propagate in humid air. But not even the best models can capture the complexity of a real environment.

A cognitive radio—and the neural network that makes it work—learns from the environment itself, rather than from a mathematical model. A neural network takes in data about the environment, such as what signal modulations are working best or what frequencies are propagating farthest, and processes that data to determine what the radio’s settings should be for an optimal link. The key feature of a neural network is that it can, over time, optimize the relationships between the inputs and the result. This process is known as training.

[…]

Source: Cognitive Radios Will Go Where No Deep-Space Mission Has Gone Before – IEEE Spectrum

EU demands strange concessions from Google over Fitbit deal – wants to share movement data to third parties

Posted on by

The EU has demanded that Google make major concessions relating to its $2.1 billion acquisition of fitness-tracking company Fitbit if the deal is to be allowed to proceed imminently, according to people with direct knowledge of the discussions.

Since it was announced last November, the acquisition has faced steep opposition from consumer groups and regulators, who have raised concerns over the effect of Google’s access to Fitbit’s health data on competition.

EU regulators now want the company to pledge that it will not use that information to “further enhance its search advantage” and that it will grant third parties equal access to it, these people said.

The move comes days after the EU regulators suffered a major blow in Luxembourg, losing a landmark case that would have forced Apple to pay back €14.3 billion in taxes to Ireland.

Brussels insiders said that a refusal by Google to comply with the new demands would probably result in a protracted investigation, adding that such a scenario could ultimately leave the EU at a disadvantage.

“It is like a poker game,” said a person following the case closely. “In a lengthy probe, the commission risks having fewer or no pledges and still having to clear the deal.”

They added that the discussions over the acquisition were “intense,” and there was no guarantee that any agreement between Brussels and Google would be reached.

Google had previously promised it would not use Fitbit’s health data to improve its own advertising, but according to Brussels insiders, the commitment was not sufficient to assuage the EU’s concerns nor those of US regulators also examining the deal.

Source: EU demands major concessions from Google over Fitbit deal | Ars Technica

Uhmmm so they want everybody to have access to this extremely private data?

More than 1,000 people at Twitter had ability to aid hack of accounts

Posted on by

Twitter said on Saturday that the perpetrators “manipulated a small number of employees and used their credentials” to log into tools and turn over access to 45 accounts. here On Wednesday, it said that the hackers could have read direct messages to and from 36 accounts but did not identify the affected users.

The former employees familiar with Twitter security practices said that too many people could have done the same thing, more than 1,000 as of earlier in 2020, including some at contractors like Cognizant.

Twitter declined to comment on that figure and would not say whether the number declined before the hack or since. The company was looking for a new security head, working to better secure its systems and training employees on resisting tricks from outsiders, Twitter said. Cognizant did not respond to a request for comment.

“That sounds like there are too many people with access,” said Edward Amoroso, former chief security officer at AT&T. Responsibilities among the staff should have been split up, with access rights limited to those responsibilities and more than one person required to agree to make the most sensitive account changes. “In order to do cyber security right, you can’t forget the boring stuff.”

Threats from insiders, especially lower-paid outside support staff, are a constant worry for companies serving large numbers of users, cyber security experts said. They said that the greater the number of people who can change key settings, the stronger oversight must be.

[…]

On a call to discuss company earnings on Thursday, Twitter Chief Executive Jack Dorsey acknowledged past missteps.

“We fell behind, both in our protections against social engineering of our employees and restrictions on our internal tools,” Dorsey told investors.

Source: Exclusive: More than 1,000 people at Twitter had ability to aid hack of accounts – Reuters

Giant waves of sand are moving on Mars

Posted on by

Researchers have spotted large waves of martian sand migrating for the first time. The discovery dispels the long-held belief that these “megaripples” haven’t moved since they formed hundreds of thousands of years ago. They’re also evidence of stronger-than-expected winds on the Red Planet.

It’s pretty staggering that humans can detect these changes on Mars, says Ralph Lorenz, a planetary scientist at the Johns Hopkins University Applied Physics Laboratory who was not involved in the research. “We can now measure processes on the surface of another planet that are just a couple times faster than our hair grows.”

Megaripples are found in deserts on Earth, often between dunes. Waves in the sand spaced up to tens of meters apart, they’re a larger version of ripples that undulate every 10 centimeters or so on many sand dunes.

But unlike dunes, megaripples are made up of two sizes of sand grains. Coarser, heavier grains cap the crests of megaripples, making it harder for wind to move these features around, says Simone Silvestro, a planetary scientist at Italy’s National Institute of Astrophysics in Naples.

Since the early 2000s, Mars rovers and orbiters have repeatedly spotted megaripples on the Red Planet. But they didn’t seem to change in any measurable way, which led some scientists to think they were relics from Mars’s past, when its thicker atmosphere permitted stronger winds.

Now, using images captured by NASA’s Mars Reconnaissance Orbiter, Silvestro and his colleagues have shown that some megaripples do creep along—just very slowly.

The researchers focused on two sites near the equator of Mars. They analyzed roughly 1100 megaripples in McLaughlin crater and 300 in the Nili Fossae region. They looked for signs of movement by comparing time-lapse images of each site—taken 7.6 and 9.4 years apart, respectively. Megaripples in both regions advanced by about 10 centimeters per year, the team reports in the Journal of Geophysical Research: Planets. That’s about how fast megaripples move in the Lut Desert of Iran.

It’s a surprise that megaripples move at all on Mars, says Jim Zimbelman, a planetary geologist at the Smithsonian Institution’s Air and Space Museum. Just a few decades ago, there was no evidence that sands on Mars were mobile, he says. “None of us thought that the winds were strong enough.”

[…]

Source: Giant waves of sand are moving on Mars | Science | AAAS

Ongoing Meow attack has nuked >4,000 MongoDB and Elastic databases with default settings left on

Posted on by

More than 1,000 unsecured databases so far have been permanently deleted in an ongoing attack that leaves the word “meow” as its only calling card, according to Internet searches over the past day.

The attack first came to the attention of researcher Bob Diachenko on Tuesday, when he discovered a database that stored user details of the UFO VPN had been destroyed. UFO VPN had already been in the news that day because the world-readable database exposed a wealth of sensitive user information, including:

  • Account passwords in plain text
  • VPN session secrets and tokens
  • IP addresses of both user devices and the VPN servers they connected to
  • Connection timestamps
  • Geo-tags
  • Device and OS characteristics
  • Apparent domains from which advertisements are injected into free users’ Web browsers

Besides amounting to a serious privacy breach, the database was at odds with the Hong Kong-based UFO’s promise to keep no logs. The VPN provider responded by moving the database to a different location but once again failed to secure it properly. Shortly after, the Meow attack wiped it out.

Representatives of UFO didn’t immediately respond to an email seeking comment.

Since then, Meow and a similar attack have destroyed more than 1,000 other databases. At the time this post went live, the Shodan computer search site showed that 987 ElasticSearch and 70 MongoDB instances had been nuked by Meow. A separate, less-malicious attack tagged an additional 616 ElasticSearch, MongoDB, and Cassandra files with the string “university_cybersec_experiment.” The attackers in this case seem to be demonstrating to the database maintainers that the files are vulnerable to being viewed or deleted.

Just for fun

It’s not the first time attackers have targeted unsecured databases, which have become increasingly common with the growing use of cloud computing services from Amazon, Microsoft, and other providers. In some cases, the motivation is to make money through ransomware rackets. In other cases—including the current Meow attacks—the data is simply wiped out with no ransomware note or any other explanation. The only thing left behind in the current attacks is the word “meow.”

One database affected by the Meow attack.
One database affected by the Meow attack.

“I think that in most [of the latter] cases, malicious actors behind the attacks do it just for fun, because they can, and because it is really simple to do,” Diachenko told me. “Thus, it is another wake-up call for the industry and companies which ignore cyber hygiene and lose their data and data of their customers in a blink of an eye.”

Source: Ongoing Meow attack has nuked >1,000 databases without telling anyone why | Ars Technica

SpaceX’s Starlink Satellites ‘Photo-Bombing’ Shots of Comet Neowise

Posted on by

“Comet Neowise has been the brightest and most visible space snowball in a generation, but it’s also the first naked-eye comet to visit us in the new era of satellite mega-constellations like SpaceX’s Starlink,” writes CNET.

Image

“In just the latest episode of Starlink ‘trains’ irritating astronomers, a number of images have been circulating of the satellites photo-bombing Comet Neowise glamour shots…”

Live Science explains: Visible just above the horizon right now, the comet appears faint and small to the naked eye, but can be seen clearly through cameras with long, telephoto lenses. Usually, when photographers capture objects like this in the night sky they use long exposure times, leaving the camera aperture open to collect light over the course of several seconds. But now comet-chasers report that a new fleet of SpaceX’s Starlink satellites is leaving bright smears across their NEOWISE snaps, as the shiny orbiters streak through their frames during long exposures.

Source: SpaceX’s Starlink Satellites Accused of ‘Photo-Bombing’ Shots of Comet Neowise – Slashdot

Historic Moon Landing Footage Enhanced By AI, and the Results Are Incredible

Posted on by

“A photo and film restoration specialist, who goes by the name of DutchSteamMachine, has worked some AI magic to enhance original Apollo film, creating strikingly clear and vivid video clips and images,” reports Universe Today: Take a look at this enhanced footage from an Apollo 16 lunar rover traverse with Charlie Duke and John Young, where the footage that was originally shot with 12 frames per second (FPS) has been increased to 60 FPS… And I was blown away by the crisp view of the Moon’s surface in this enhanced view of Apollo 15’s landing site at Hadley Rille… Or take a look at how clearly Neil Armstrong is visible in this enhanced version of the often-seen “first step” video from Apollo 11 taken by a 16mm video camera inside the Lunar Module…

The AI that DutchSteamMachine uses is called Depth-Aware video frame INterpolation, or DAIN for short. This AI is open source, free and constantly being developed and improved upon… “People have used the same AI programs to bring old film recordings from the 1900s back to life, in high definition and colour,” he said. “This technique seemed like a great thing to apply to much newer footage….”

DutchSteamMachine does this work in his spare time, and posts it for free on his YouTube page. His tagline is “Preserving the past for the future…” And he’s planning to keep it all coming. “I plan to improve tons of Apollo footage like this,” he said. “A lot more space and history-related footage is going to be published on my YT channel continuously.” He also has a Flickr page with more enhanced imagery. [And a Patreon page…]
Long-time Slashdot reader schwit1 calls it “similar to what Peter Jackson did with old World War I footage for They Shall Not Grow Old .”

Source: Historic Moon Landing Footage Enhanced By AI, and the Results Are Incredible – Slashdot

Instagram and 50 other apps found that quietly access iOS device’s camera

Posted on by

Apple’s iOS 14 beta has proven surprisingly handy at sussing out what apps are snooping on your phone’s data. It ratted out LinkedIn, Reddit, and TikTok for secretly copying clipboard content earlier this month, and now Instagram’s in hot water after several users reported that their camera’s “in use” indicator stays on even when they’re just scrolling through their Instagram feed.

According to reports shared on social media by users with the iOS 14 beta installed, the green “camera on” indicator would pop up when they used the app even when they weren’t taking photos or recording videos. If this sounds like deja vu, that’s because Instagram’s parent company, Facebook, had to fix a similar issue with its iOS app last year when users found their device’s camera would quietly activate in the background without their permission while using Facebook.

In an interview with the Verge, an Instagram spokesperson called this issue a bug that the company’s currently working to patch.

[…]

Even though iOS 14 is still in beta mode and its privacy features aren’t yet available to the general public, it’s already raised plenty of red flags about apps snooping on your data. Though TikTok, LinkedIn, and Reddit may have been the most high-profile examples, researchers Talal Haj Bakry and Tommy Mysk found more than 50 iOS apps quietly accessing users’ clipboards as well. And while there are certainly more malicious breaches of privacy, these kinds of discoveries are a worrying reminder about how much we risk every time we go online.

Source: Instagram to fix bug that quietly accesses iOS device’s camera

Video Game HUDs Used To Be Cool

Posted on by

Video games look really good these days. I boot up almost any PS4 game released in the last few years and I’m impressed. But while games might look nicer than ever before, we lost cool looking “heads-up displays”, HUDs, in the process. Was it worth it?

I’ve been playing a lot of Assassin’s Creed: Odyssey lately. A lot. And it got me interested in the past games, most of which I played long ago when they first released. In going back and looking at these games, I immediately noticed something. Their HUDs were so much cooler than what’s in Odyssey.

Here’s a screenshot of Odyssey via Stephen’s wonderful post about an annoying bow that he kept finding.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Ubisoft

Now here’s a screenshot of the first Assassin’s Creed via WSGF.com.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Ubisoft (Fair Use)

Look at the weird map! And the cool looking DNA-inspired life bar. I also like how high contrast it feels. Odyssey’s HUD is clean and efficient. It gets the job done, for sure, but it lacks personality. And if we go back even further, to the PS2 era of gaming, we can find even more wild HUDs, as pointed about by Twitter user @BlacWeird a few months back.

Here’s what the HUD looked like in SkyGunner. It’s got a steampunk vibe to it.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Atlus (Fair Use)

Or how about Project Snowblind. What is happening in that mini-map in the top right? I have no idea.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Edios / Square Enix

And even a less obscure PS2 game, the original God of War, had a giant sword for its health meter.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Sony

Compared that last screen to this screenshot from the newest entry in the God of War series, confusingly named God of War, released on PS4 back in 2018.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Sony

Again, like Odyssey, it works great. But it also has almost no personality. It’s boring. And yet, for the most part, this is what all video game HUDs have become. Clean, slightly transparent boxes and white lines that often fade away when not needed. I understand, and even agree, that these new HUDS are more effective at translating information and data to players. But there has to be a middle ground?

An example of a game that has HUD graphics that aren’t boring, but not too weird or big is last year’s Devil May Cry 5.

Illustration for article titled Video Game HUDs Used To Be Cool
Screenshot: Capcom

The text is sharp and clean and the icons are small, but there’s also a variety of colors, a weird devil face, and some broken glass on the corners. It has style. It doesn’t look like a console from a JJ Abrams Star Trek film. It looks exciting but also I can clearly understand what information the game is sharing with me, which is always vital.

Source: Video Game HUDs Used To Be Cool

 

US govt says Chinese duo hacked, stole blueprints from just about everyone and then extorted cash.

Posted on by

On Tuesday, the US Department of Justice charged two Chinese nationals with allegedly hacking hundreds of organizations and individuals in America and elsewhere to steal confidential corporate secrets on behalf of Beijing for more than a decade.

The pilfered files are said to be worth hundreds of millions of dollars, and in some cases, it is claimed, the pair tried to extort money out of their victims: pay up, or the trade secrets leak.

The targeted organizations are said to include a British AI and cancer research biz, an Australian defense contractor, a South Korean shipbuilder and engineering giant, German software makers, American pharmaceutical, software, and defense corporations, and the US Dept of Energy’s Hanford site.

Assistant Attorney General John Demers and other US officials held a press conference on Tuesday to unseal the 11-count indictment [PDF], returned by a grand jury on July 7, against Li Xiaoyu, 34, and Dong Jiazhi, 33.

“The campaign targeted intellectual property and confidential business information held by the private sector, including COVID-19-related treatment, testing, and vaccines,” said Demers in prepared remarks.

“The hackers also targeted the online accounts of non-governmental organizations and individual dissidents, clergy, and democratic and human rights activists in the United States, China, Hong Kong, and abroad.”

According to the indictment, Li and Dong, former classmates at an electrical engineering college in Chengdu, China, have been hacking into high tech manufacturing, civil, industrial, and medical engineering firms, software companies of all sorts, solar companies, and pharmaceuticals, among others, since 2009.

The US claims that the two accused worked both for themselves and with the backing of the Chinese government’s Ministry of State Security. This assistance included being supplied with zero-day vulnerabilities exploits to facilitate their intrusion.

But often their hacking sprees, it’s alleged, involved the exploitation of publicly known vulnerabilities. The accused hackers are said to have used a program called China Chopper to install web shells to execute commands on victims’ networks and exfiltrate documents. The duo also uploaded password-stealing malware, it is claimed.

The pilfered data, it’s claimed, was often packed up on the RAR archive files that were concealed through the use of innocuous file names and common file extensions like .jpg. The hackers are said to have frequently used the recycle bin on Windows machines to store and move files because administrators are less likely to look there.

Adding insult to injury

“The defendants stole hundreds of millions of dollars’ worth of trade secrets, intellectual property, and other valuable business information,” the indictment says.

“At least once, they returned to a victim from which they had stolen valuable source code to attempt an extortion – threatening to publish on the internet, and thereby destroy the value of, the victim’s intellectual property unless a ransom was paid.”

The indictment also accuses the pair of providing Chinese authorities with the passwords of email accounts belonging to Chinese dissidents and to academics in the US and other countries.

Recently, Li and Dong are said to have been researching vulnerabilities in the networks of biotech firms involved in COVID-19 vaccine research. It’s claimed they have gone after organizations and individuals in the United States, Australia, Belgium, Germany, Japan, Lithuania, the Netherlands, Spain, South Korea, Sweden, and the United Kingdom.

“China’s anti-competitive behavior and flagrant disregard for their promises not to engage in cyber-enabled intellectual property theft is not just a domestic issue; it is a global issue,” said Demers.

The defendants have each been charged with one count of conspiracy to commit computer fraud, theft of trade secrets, wire fraud, and unauthorized access of a computer, and with seven counts of aggravated identity theft.

China has no extradition treaty with the US, and relations between two countries are not particularly cordial at the moment, which makes it highly unlikely either of the two defendants will ever appear in a US courtroom unless they get really stupid crossing borders. That seems unlikely now.

Source: Bad: US govt says Chinese duo hacked, stole blueprints from just about everyone. Also bad: They extorted cash • The Register

Sick of AI engines scraping your pics for facial recognition? Fawkes breaks the AI for you

Posted on by

Researchers at the University of Chicago’s Sand Lab have developed a technique for tweaking photos of people so that they sabotage facial-recognition systems.

The project, named Fawkes in reference to the mask in the V for Vendetta graphic novel and film depicting 16th century failed assassin Guy Fawkes, is described in a paper scheduled for presentation in August at the USENIX Security Symposium 2020.

Fawkes consists of software that runs an algorithm designed to “cloak” photos so they mistrain facial recognition systems, rendering them ineffective at identifying the depicted person. These “cloaks,” which AI researchers refer to as perturbations, are claimed to be robust enough to survive subsequent blurring and image compression.

The paper [PDF], titled, “Fawkes: Protecting Privacy against Unauthorized Deep Learning Models,” is co-authored by Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Zhao, all with the University of Chicago.

“Our distortion or ‘cloaking’ algorithm takes the user’s photos and computes minimal perturbations that shift them significantly in the feature space of a facial recognition model (using real or synthetic images of a third party as a landmark),” the researchers explain in their paper. “Any facial recognition model trained using these images of the user learns an altered set of ‘features’ of what makes them look like them.”

Figure 16 from the Fawkes: Protecting Privacy against Unauthorized Deep Learning Models paper

Two examples from the paper showing how different levels of perturbation applied to original photos can derail a facial-recognition system so that future matches are unlikely or impossible … Click to enlarge. Credit: Shan et al.

The boffins claim their pixel scrambling scheme provides greater than 95 per cent protection, regardless of whether facial recognition systems get trained via transfer learning or from scratch. They also say it provides about 80 per cent protection when clean, “uncloaked” images leak and get added to the training mix alongside altered snapshots.

They claim 100 per cent success at avoiding facial recognition matches using Microsoft’s Azure Face API, Amazon Rekognition, and Face++. Their tests involve cloaking a set of face photos and providing them as training data, then running uncloaked test images of the same person against the mistrained model.

Fawkes differs from adversarial image attacks in that it tries to poison the AI model itself, so it can’t match people or their images to their cloaked depictions. Adversarial image attacks try to confuse a properly trained model with specific visual patterns.

The researchers have posted their Python code on GitHub, with instructions for users of Linux, macOS, and Windows. Interested individuals may wish to try cloaking publicly posted pictures of themselves so that if the snaps get scraped and used to train to a facial recognition system – as Clearview AI is said to have done – the pictures won’t be useful for identifying the people they depict.

Fawkes is similar in some respects to the recent Camera Adversaria project by Kieran Browne, Ben Swift, and Terhi Nurmikko-Fuller at Australian National University in Canberra.

Camera Adversia adds a pattern known as Perlin Noise to images that disrupts the ability of deep learning systems to classify images. Available as an Android app, a user could take a picture of, say, a pipe and it would not be a pipe to the classifier.

The researchers behind Fawkes say they’re working on macOS and Windows tools that make their system easier to use.

Source: Sick of AI engines scraping your pics for facial recognition? Here’s a way to Fawkes them right up • The Register

Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn

Posted on by

The former head of DNS regulator ICANN has been named as co-CEO of a company that launched a controversial attempt to purchase the .org internet registry earlier this year. The news has again raised concerns over the revolving doors between regulators and those who need regulation.

In the past week, the website of Ethos Capital, the private equity firm that offered $1.13bn to take control of the popular .org registry, was updated to list ex-ICANN CEO Fadi Chehade as its joint head.

The change is significant because it was Chehade’s involvement in the attempted .org purchase that first alerted internet users that the deal deserved closer scrutiny.

The sale was ultimately vetoed several months later by ICANN, but only after the Attorney General of California got involved and sent a last-minute letter to LA-based ICANN telling it not to approve the deal in part due to the “lack of transparency” on Ethos Capital.

Part of that lack of transparency was who would actually own the .org registry after the sale: behind Ethos was a complex structure of no less than four shell companies that were all registered on the same day in Delaware with the prefix “Purpose Domains.” Ethos Capital refused to divulge who all the directors of those companies actually were despite repeat requests, including from ICANN, which had the power to refuse the sale.

Chehade’s close link to the proposed sale was only noticed because he had registered Ethos Capital’s .org domain name, EthosCapital.org, under his own name on May 7, 2019. The company Ethos Capital LLC was registered in Delaware one week later, on May 14, 2019.

All in the timing

That date is significant because May 13, 2019, the day before Ethos Capital was established, was the deadline for ICANN staff to publish a report on the controversial lifting of price caps on .org domains.

For the previous 20 years, the price of .org domains had been strictly limited by ICANN to a specific annual percentage increase. However, under reforms Chehade made as CEO of ICANN, prior to his departure in 2016, registries were allowed to request the caps be removed altogether when their current contract expired.

The company that runs .org, the Internet-Society-owned Public Internet Registry (PIR), had made that request for its contract expiring June 30, 2019, sparking a furious backlash from the internet community. ICANN public comment periods typically attract between five and 50 comments but when it came to the lifting of price caps on .org domains, there were over 3,200 responses of which more than 98 per cent were opposed to the idea.

That staff report of the comment period, due on May 13, was supposed to be an objective review of what the internet community has said; the internet community meanwhile, has long complained that ICANN’s staff frequently skew such reports to fit with a predetermined outcome.

The .org price cap issue was no exception, and despite overwhelming opposition, the staff report gave equal weight to the few comments in favor of the change as to the thousands opposed to it. It was clear that ICANN’s staff would recommend their board approve lifting the .org price caps: a decision that was potentially worth hundreds of millions of dollars over the course of the new ten-year contract.

There are just over 10 million .org domains, and the registry is one of the oldest and most stable in the market. In 2019, PIR reported [PDF] a 78.2 per cent renewal rate, meaning that the vast majority of existing domain holders automatically renewed their names for another year (you can register domains for multiple years but roughly 70 per cent of people renew a domain every year). To put it into hard numbers, there were 6.9 million .org renewals in 2019.

License to print money

That extraordinary loyalty rate, believed to be the highest in the domain industry, is what makes .org so valuable. Many organizations have built their websites and online reputation on .org domains for a decade or more, and domain names are incredibly cheap (roughly $10 a year) when compared to the enormous costs associated with moving to a different online home.

That makes the .org registry home to over eight million domain registrants who would likely pay many multiples of the current annual cost to keep their name. Even if PIR doubled its price from $10 to $20, the renewal rate would be unlikely to fall very much, resulting in an additional $69m in revenue, or thereabouts, just for that one year. In short, the .org registry without price caps was a money-printing machine.

Chehade was clearly following the issue closely, and the day after the staff report deadline, Ethos Capital – the private equity outfit that would a few months later approach the owner of the .org registry, the Internet Society – was registered in Delaware.

What makes this timeline all the more peculiar is that it isn’t clear that the staff report was actually published on Monday, May 13, 2019. Due to the volume of comments, ICANN’s staff asked for, and were granted, an extension. And so the final report that those outside the domain industry saw for the first time was published [PDF] three weeks later on June 3, 2019.

Did the former CEO of ICANN use his many connections with staff, many of whom he had hired and promoted, to get an early copy of the staff report? And is that why when Ethos Capital was named as the company trying to buy the .org registry there was no mention of Chehade’s close connection?

Despite the evidence and repeat requests, Ethos Capital refused to acknowledge Chehade’s involvement, even when he was spotted at the PIR offices, shortly after the deal was announced, with Ethos Capital CEO Erik Brooks, a former business partner, to discuss the acquisition.

Oh, that Chehade?

Eventually, Ethos Capital admitted its relationship with Chehade several months later in January in response to very specific questions posed by ICANN about the deal. On page 25 of a 27-page response [PDF] from Ethos, it answered a request that it name “former directors, officers or employees of ICANN that are or have been involved in, have advised on or otherwise have an interest in the transaction.”

And it named Nora Abusitta-Ouri, Chehade’s former personal assistant who had worked with him at previous companies; Allen Grogan, whom Chehade had hired to be ICANN’s head of compliance, and Fadi Chehade himself. They were “acting as advisors to Ethos Capital,” the company insisted, and provided no more details. Grogan, incidentally, is now listed as an Ethos Capital “executive partner” on its website.

It’s possible that Chehade’s connections with the CEOs of PIR, Jon Nevett, and the Internet Society, Andrew Sullivan, that made the dot-org takeover even remotely possible. It was always going to be a hard sell – as was made clear from the response when the deal, which had been green-lit in secret and in record time by the Internet Society and PIR boards, was announced.

When the Internet Society revealed that it was not only selling .org to a private equity firm but would also change PIR’s status from a non-profit organization to a for-profit one as part of the deal, the internet community and .org registrants were stunned. And then outraged.

Chehade had had plenty of time to work out the details and he knew the key person, PIR CEO Jonathon Nevett, extremely well. Nevett was co-founder of registry operator Donuts and had been a persistent presence in the domain name industry for years, many of them when Chehade was head of the industry’s regulator. The connection continued after Chehade left ICANN.

When Nevett sold Donuts in 2018 to Abry Partners, it was in a deal that was brokered by… Fadi Chehade and Erik Brooks. Within a few months, Nevett became CEO of PIR. And his position at Donuts was taken by another long-term Chehade business associate Akram Atallah, who had taken over as interim CEO of ICANN after Chehade left.

Contractual terms

As for the also-new CEO of the Internet Society, Andrew Sullivan, he had previously worked at Afilias, which runs the technical back-end of .org for the Internet Society’s PIR, and was the person responsible more than any other of helping the Internet Society win the contract to run .org 20 years previously. More than 80 per cent of the Internet Society’s annual revenue comes from the sale of .org domains.

Chehade was the connection between all these men who pushed through a proposal that the internet community, .org registrants, the internet society chapters, not to mention a former CEO and the former chair of ICANN, and US senators all condemned in the strongest terms.

Eventually it took the Attorney General of California, and an explicit threat to audit the notoriously secretive non-profit organization based in Los Angeles, to push ICANN off the .org sell-off and refuse it.

As for why Chehade persisted in only being an advisor to Ethos Capital when he almost certainly helped establish the company, filled it with his old staff, and was the point person for the entire deal, the answer to that may be in responses to questions put to the Internet Society and PIR about when they were first approached about a possible sale of .org.

“The Internet Society was first approached by Ethos Capital in September,” the organization told us in an official statement in response to our questions about interactions and timing of the deal. When PIR was asked the same question, its CEO Jon Nevett answered that he had no knowledge of any planned sale to Ethos Capital when he took over the CEO job in December 2018, or when his organization decided to formally ask for pricing caps to be lifted.

But of course, Ethos Capital only formally existed in May 2019. And Fadi Chehade was not a representative of Ethos Capital, merely an advisor, until last week when he suddenly became co-CEO. As to conversations Chehade may have had with his former staff to smooth the path of the billion-dollar sale, ICANN continues to refuse to supply records of staff or board communications, citing confidentiality.

Source: Ex-boss of ICANN shifts from ‘advisor’ to co-CEO of private equity biz that tried to buy .org for $1bn+ • The Register

Microsoft’s Doing the Monopoly Thing Again, Slack Says

Posted on by

Workplace messaging software company Slack is accusing Microsoft of monopoly behavior in an antitrust complaint filed today to European Union regulators. Unsurprisingly, the accusations hinge on the same practice that helped make Microsoft rich in the first place.

Bill Gates, Windows, innovation, yes, yes, OK—undoubtedly Microsoft had a lot to contribute to the early years of home computing. But what helped it grow to mammoth scale was software bundling: specifically, the practice of getting its products pre-installed on brand new machines built by third parties—and making it hard to delete those programs and replace them with competitors.

You might remember this refrain from such hits as United States v. Microsoft Corporation, and Microsoft Corp. vs. Commission, the latter of which eventually cost the company over a billion dollars after it became “the first company in 50 years of EU competition policy that the Commission has had to fine for failure to comply with an antitrust decision,” according to the European Commission’s then-Competition Commissioner Neelie Kroes.

Kind of makes you wonder how Apple still gets away with setting Safari as the default browser on iOS devices, but I digress…

While those early cases against Microsoft focused on software like Internet Explorer and Windows Media Player, Slack’s new legal salvo concerns the company’s bundling of competing chat app Teams with its ubiquitous productivity suite Microsoft Office. In a press release, Slack accused its rival of “force installing it for millions, blocking its removal, and hiding the true cost to enterprise customers,” which Slack believes to be an “illegal and anti-competitive practice.”

“We’re confident that we win on the merits of our product, but we can’t ignore illegal behavior that deprives customers of access to the tools and solutions they want,” said Jonathan Prince, vice president of communications and policy at Slack. “Slack threatens Microsoft’s hold on business email, the cornerstone of Office, which means Slack threatens Microsoft’s lock on enterprise software.”

Reached for comment, a Microsoft spokesperson sniped that “we created Teams to combine the ability to collaborate with the ability to connect via video, because that’s what people want. With COVID-19, the market has embraced Teams in record numbers while Slack suffered from its absence of video-conferencing. We’re committed to offering customers not only the best of new innovation, but a wide variety of choice in how they purchase and use the product.”

The merits of the case will be decided by the Commission, but the existence of the suit is a smart play for Slack, which has seen its stock slip recently, perhaps as a result of Teams’s encroachment on its market share. The EU has consistently had a greater appetite to pursue antitrust concerns compared to the U.S., where both companies are headquartered, making it a doubly clever play for the considerably smaller and more vulnerable party.

Source: Microsoft’s Doing the Monopoly Thing Again, Slack Says

test detects cancer four years before conventional diagnosis using a blood test

Posted on by

Early detection has the potential to reduce cancer mortality, but an effective screening test must demonstrate asymptomatic cancer detection years before conventional diagnosis in a longitudinal study. In the Taizhou Longitudinal Study (TZL), 123,115 healthy subjects provided plasma samples for long-term storage and were then monitored for cancer occurrence. Here we report the preliminary results of PanSeer, a noninvasive blood test based on circulating tumor DNA methylation, on TZL plasma samples from 605 asymptomatic individuals, 191 of whom were later diagnosed with stomach, esophageal, colorectal, lung or liver cancer within four years of blood draw. We also assay plasma samples from an additional 223 cancer patients, plus 200 primary tumor and normal tissues. We show that PanSeer detects five common types of cancer in 88% (95% CI: 80–93%) of post-diagnosis patients with a specificity of 96% (95% CI: 93–98%), We also demonstrate that PanSeer detects cancer in 95% (95% CI: 89–98%) of asymptomatic individuals who were later diagnosed, though future longitudinal studies are required to confirm this result. These results demonstrate that cancer can be non-invasively detected up to four years before current standard of care.

Source: Non-invasive early detection of cancer four years before conventional diagnosis using a blood test | Nature Communications

China successfully launches Mars probe that packs an orbiter, lander, rover

Posted on by

China has successfully launched a Mars probe.

The middle kingdom’s previous red planet effort, 2011’s Yinghuo-1, rode on a Russian rocket that failed to leave Earth orbit and therefore did not fulfill its orbital observation mission.

For this new mission, dubbed Tianwen-1, China has used its own Long March 5 heavy lifter and packed in an orbiter, lander and rover.

Chinese State media has confirmed the launch and a People’s Daily social media post includes video of a rocket heading upwards and says it’s Mars-bound.

China’s being typically cagey about the mission, which is believed to plan a landing with a combination of parachutes and airbags before the rover deploys a range of instruments capable of investigating Martian magnetic fields, geology and chemistry. The orbiter packs a camera capable of two-metre resolution from a height of 400kms, plus more magnetosphere-sensing kit.

If the mission succeeds, China will join the USA, Soviet Union, European Union and India as successful sponsors of Mars missions. Only the USA, Soviet Union and EU have landed rovers on the red planet.

Source: China successfully launches Mars probe that packs an orbiter, lander, rover • The Register

Twitter hack latest: Up to 36 compromised accounts had their private messages read – including a Dutch politician’s

Posted on by

Twitter has admitted that the naughty folk who hijacked verified accounts last week read a portion of hacked users’ direct messages.

Among the 36 Twitter users whose direct messages (DMs), email addresses and phone numbers were definitely accessed by account hijackers last week was one Dutch politician, the microblogging platform said overnight.

“We believe that for up to 36 of the 130 targeted accounts, the attackers accessed the DM inbox, including 1 elected official in the Netherlands. To date, we have no indication that any other former or current elected official had their DMs accessed,” Twitter said in an updated post.

The hack happened after an individual or persons unknown gained access to Twitter’s administrative tools, allegedly after bribing a company insider.

As we reported last week, a number of Twitter accounts belonging to high-profile individuals were compromised. Those accounts all have blue ticks, indicating that they really do belong to whomever’s name and mugshot they bear.

Source: Twitter hack latest: Up to 36 compromised accounts had their private messages read – including a Dutch politician’s • The Register

Fitness freaks flummoxed as massive global Garmin outage leaves them high and dry for hours

Posted on by

Garmin’s Connect service has been down for more than seven hours today to the frustration of fitness enthusiasts keen to upload running times or synchronise with other services such as Strava. So, too, is the company’s web shop and support forums.

Users have expressed obvious concern that such an extended outage is indicative of a problem beyond maintenance, worrying perhaps about their personal data stored there, and for sure the company’s communication has been poor.

Garmin Connect lets owners of Garmin devices such as fitness trackers and smart watches upload their activity, enabling analysis of activity, achievements, and optionally sharing with friends. It can be linked with other services like Strava so data uploaded to Garmin Connect also appears there.

[…]

Initially the Garmin social media accounts were for the most part silent on the matter. “@GarminFitness @Garmin @GarminUK Garmin Connect has now been down for over 6 hours. Your forums are returning a runtime error and are down. Not one of these three accounts has even mentioned this,” said one customer.

[…]

A customer was quick to comment that “the fact that this makes my watch not talk to my phone makes me upset”. The phone is working, the watch is working, both are nearby, but data has to go to the internet and back for the two to communicate. It is an IoT issue, which nobody notices while connectivity is good.

“What’s going on @Garmin. Something don’t feel right. You can’t get us to buy watches and make it part of our daily lives and one day just to AWOL,” complained another.

Strava has pointed users at a support note explaining how to upload a file in .FIT format directly, though this is a tedious process compared to wireless synchronisation.

We have asked Garmin for more information. ®

Updated to add

It is suspected that Garmin has been hit by the WastedLocker ransomware, ZDNet reports citing the manufacturer’s staff on Twitter and an article from Taiwan that Garmin’s production line will be shut for two days due to a computer virus.

Source: Fitness freaks flummoxed as massive global Garmin outage leaves them high and dry for hours • The Register

And this is why we like stuff that isn’t in the cloud

US accuses Chinese-Made Drones with Security Weakness: the possiblity to update their software

Posted on by

In two reports, the researchers contended that an app on Google’s Android operating system that powers drones made by China-based Da Jiang Innovations, or DJI, collects large amounts of personal information that could be exploited by the Beijing government. Hundreds of thousands of customers across the world use the app to pilot their rotor-powered, camera-mounted aircraft.

The world’s largest maker of commercial drones, DJI has found itself increasingly in the cross hairs of the United States government, as have other successful Chinese companies. The Pentagon has banned the use of its drones, and in January the Interior Department decided to continue grounding its fleet of the company’s drones over security fears. DJI said the decision was about politics, not software vulnerabilities.

[…]

The security research firms that documented it, Synacktiv, based in France, and GRIMM, located outside Washington, found that the app not only collected information from phones but that DJI can also update it without Google reviewing the changes before they are passed on to consumers. That could violate Google’s Android developer terms of service.

The changes are also difficult for users to review, the researchers said, and even when the app appears to be closed, it awaits instructions from afar, they found.

“The phone has access to everything the drone is doing, but the information we are talking about is phone information,” said Tiphaine Romand-Latapie, a Synacktiv engineer. “We don’t see why DJI would need that data.”

[…]

Synacktiv did not identify any malicious uploads but simply raised the prospect that the drone app could be used that way.

A New York Times analysis of the software confirmed the functionality. An attempt to update the app directly from DJI’s servers delivered a message indicating that the phone The Times used “did not meet the qualifications for an update package.”

Source: Popular Chinese-Made Drone Is Found to Have Security Weakness – The New York Times

Note: nowhere do they say what data is supposedly being stolen, in fact they admit there has been no data stolen as far as they have seen. This is stirring the pot: you want your stuff to get updates in life. That’s called security.

Facebook settles unauthorised use of facial recognition for $650 million

Posted on by

Facebook has agreed to pay a total of $650 million in a landmark class action lawsuit over the company’s unauthorized use of facial recognition, a new court filing shows.

The filing represents a revised settlement that increases the total payout by $100 million and comes after a federal judge balked at the original proposal on the grounds it did not adequately punish Facebook.

The settlement covers any Facebook user in Illinois whose picture appeared on the site after 2011. According to the new document, those users can each expect to receive between $200 and $400 depending on how many people file a claim.

The case represents one of the biggest payouts for privacy violations to date, and contrasts sharply with other settlements such as that for the notorious data breach at Equifax—for which victims are expected to received almost nothing.

The Facebook lawsuit came about as a result of a unique state law in Illinois, which obliges companies to get permission before using facial recognition technology on their customers.

The law has ensnared not just Facebook, but also the likes of Google and photo service Shutterfly. The companies had insisted in court that the law did not apply to their activities, and lobbied the Illinois legislature to rule they were exempt, but these efforts fell short.

The final Facebook settlement is likely to be approved later this year, meaning Illinois residents will be poised to collect a payout in 2021.

The judge overseeing the settlement rejected the initial proposal in June on the grounds that the Illinois law provides penalties of $5,000, meaning Facebook could have been obliged to pay $47 billion—an amount far exceeding what the company agreed to pay under the settlement.

“We are focused on settling as it is in the best interest of our community and our shareholders to move past this matter,” said a Facebook spokesperson.

Edelson PC, the law firm representing the plaintiffs, declined to comment on the revised deal.

Source: Facebook adds $100 million to facial recognition settlement | Fortune

Amazon Met With Startups About Investing, Then Launched Competing Products

Posted on by

When Amazon.com’s venture-capital fund invested in DefinedCrowd, it gained access to the technology startup’s finances and other confidential information. Nearly four years later, in April, Amazon’s cloud-computing unit launched an artificial-intelligence product that does almost exactly what DefinedCrowd does, said DefinedCrowd founder and Chief Executive Daniela Braga. The new offering from Amazon Web Services, called A2I, competes directly “with one of our bread-and-butter foundational products” that collects and labels data, said Ms. Braga. After seeing the A2I announcement, Ms. Braga limited the Amazon fundâ(TM)s access to her company’s data and diluted its stake by 90% by raising more capital. Ms. Braga is one of more than two dozen entrepreneurs, investors and deal advisers interviewed by The Wall Street Journal who said Amazon appeared to use the investment and deal-making process to help develop competing products.

In some cases, Amazon’s decision to launch a competing product devastated the business in which it invested. In other cases, it met with startups about potential takeovers, sought to understand how their technology works, then declined to invest and later introduced similar Amazon-branded products, according to some of the entrepreneurs and investors. An Amazon spokesman said the company doesn’t use confidential information that companies share with it to build competing products. Dealing with Amazon is often a double-edged sword for entrepreneurs. Amazon’s size and presence in many industries, including cloud-computing, electronic devices and logistics, can make it beneficial to work with. But revealing too much information could expose companies to competitive risks.

Source: Amazon Met With Startups About Investing, Then Launched Competing Products – Slashdot

I have been talking about the vast market powers of the monopolists and exactly this case with Amazon since early 2019

Instacart Customers’ Data Is Being Sold Online, but Instacart has it’s fingers in it’s ears, pretends nothing is wrong

Posted on by

The personal information of what could be hundreds of thousands of Instacart customers is being sold on the dark web. This data includes names, the last four digits of credit card numbers, and order histories, and appears to have affected customers who used the grocery delivery service as recently as yesterday.

As of Wednesday, sellers in two dark web stores were offering information from what appeared to be 278,531 accounts, although some of those may be duplicates or not genuine. As of April, Instacart had “millions of customers across the US and Canada,” according to a company spokesperson.

The company denied there had been a breach of its data.

“We are not aware of any data breach at this time. We take data protection and privacy very seriously,” an Instacart spokesperson told BuzzFeed News. “Outside of the Instacart platform, attackers may target individuals using phishing or credential stuffing techniques. In instances where we believe a customer’s account may have been compromised through an external phishing scam outside of the Instacart platform or other action, we proactively communicate to our customers to auto-force them to update their password.”

The source of the information, which also included email addresses and shopping data, was unknown, but appeared to have been uploaded from at least June until today.

“It’s looking recent and totally legit,” Nick Espinosa, the head of cybersecurity firm Security Fanatics, told BuzzFeed News after reviewing the accounts being sold.

Two women whose personal information was for sale confirmed they were Instacart customers, that their last order date and amount matched what appeared on the dark web, and that the credit card information belonged to them.

Source: Instacart Customers’ Data Is Being Sold Online

Amazon’s auditing of Alexa Skills is so good, these boffins got all 200+ rule-breaking apps past the reviewers

Posted on by

Amazon claims it reviews the software created by third-party developers for its Alexa voice assistant platform, yet US academics were able to create more than 200 policy-violating Alexa Skills and get them certified.

In a paper [PDF] presented at the US Federal Trade Commission’s PrivacyCon 2020 event this week, Clemson University researchers Long Cheng, Christin Wilson, Song Liao, Jeffrey Alan Young, Daniel Dong, and Hongxin Hu describe the ineffectiveness of Amazon’s Skills approval process.

The researchers have also set up a website to present their findings.

Like Android and iOS apps, Alexa Skills have to be submitted for review before they’re available to be used with Amazon’s Alexa service. Also like Android and iOS, the Amazon’s review process sometimes misses rule-breaking code.

In the researchers’ test, sometimes was every time: The e-commerce giant’s review system granted approval for every one of 234 rule-flouting Skills submitted over a 12-month period.

“Surprisingly, the certification process is not implemented in a proper and effective manner, as opposed to what is claimed that ‘policy-violating skills will be rejected or suspended,'” the paper says. “Second, vulnerable skills exist in Amazon’s skills store, and thus users (children, in particular) are at risk when using [voice assistant] services.”

Amazon disputes some of the findings and suggests that the way the research was done skewed the results by removing rule-breaking Skills after certification, but before other systems like post-certification audits might have caught the offending voice assistant code.

The devil is in the details

Alexa hardware has been hijacked by security researchers for eavesdropping and the software on these devices poses similar security risks, but the research paper concerns itself specifically with content in Alexa Skills that violates Amazon’s rules.

Alexa content prohibitions include limitations on activities like collecting information from children, collecting health information, sexually explicit content, descriptions of graphic violence, self-harm instructions, references to Nazis or hate symbols, hate speech, the promotion drugs, terrorism, or other illegal activities, and so on.

Getting around these rules involved tactics like adding a counter to Skill code, so the app only starts spewing hate speech after several sessions. The paper cites a range of problems with the way Amazon reviews Skills, including inconsistencies where rejected content gets accepted after resubmission, vetting tools that can’t recognize cloned code submitted by multiple developer accounts, excessive trust in developers, and negligence in spotting data harvesting even when the violations are made obvious.

Amazon also does not require developers to re-certify their Skills if the backend code – run on developers’ servers – changes. It’s thus possible for Skills to turn malicious if the developer alters the backend code or an attacker compromises a well-intentioned developer’s server.

As part of the project, the researchers also examined 825 published Skills for kids that either had a privacy policy or a negative review. Among these, 52 had policy violations. Negative comments by users mention unexpected advertisements, inappropriate language, and efforts to collect personal information.

Source: Amazon’s auditing of Alexa Skills is so good, these boffins got all 200+ rule-breaking apps past the reviewers • The Register

The Record Industry Is Going After Parody Songs Written By an Algorithm

Posted on by

Georgia Tech researcher Mark Riedl didn’t expect that his machine learning model “Weird A.I. Yankovic,” which generates new rhyming lyrics for existing songs would cause any trouble. But it did.

On May 15, Reidl posted an AI-generated lyric video featuring the instrumental to Michael Jackson’s “Beat It.” It was taken down on July 14, Reidl tweeted, after Twitter received a Digital Millennium Copyright Act takedown notice for copyright infringement from the International Federation of the Phonographic Industry, which represents major and independent record companies.

“I am fairly convinced that my videos fall under fair use,” Riedl told Motherboard of his AI creation, which is obviously inspired by Weird Al’s parodies. Riedl said his other AI-generated lyric videos posted to Twitter have not been taken down.

Riedl has contested the takedown with Twitter but has not received a response. Twitter also did not respond to Motherboard’s request for comment.

The incident raises the question of what role machine learning plays when it comes to the already nuanced and complicated rules of fair use, which allows for the use of a copyrighted work in certain circumstances, including educational uses and as part of a “transformative” work. Fair use also protects parody in some circumstances.

Riedl, whose research focuses on the study of artificial intelligence and storytelling for entertainment, says the model was created as a personal project and outside his role at Georgia Tech. “Weird A.I. Yankovic generates alternative lyrics that match the rhyme and syllables schemes of existing songs. These alternative lyrics can then be sung to the original tune,” Riedl said. “Rhymes are chosen, and two neural networks, GPT-2 and XLNET, are then used to generate each line, word by word.”

Source: The Record Industry Is Going After Parody Songs Written By an Algorithm

Oddly enough, game publishers seem to be able to contest DMCA on YouTube in 20 minutes when they are at a convention. It’s like it’s not being applied fairly at all…