The Linkielist

Linking ideas with the world

The Linkielist

KFC will test lab-grown chicken nuggets made with a 3D bioprinter this fall in Russia

Posted on by
  • KFC announced on July 16 it would test chicken nuggets made with 3D bioprinting technology in Russia this fall.
  • The chain partnered with 3D Bioprinting Solutions to create a chicken nugget that will mimic the taste and appearance of its original nuggets at a fraction of the environmental cost.
  • The release will be the first time a major chain will sell a lab-grown meat product and may serve as a proof-of-concept for the much-hyped cell-based meat industry.
  • Visit Business Insider’s homepage for more stories.

KFC will test chicken nuggets made with 3D bioprinting technology in Moscow, Russia, this fall, the chain announced in a July 16 press release.

The chicken chain has partnered with 3D Bioprinting Solutions to create a chicken nugget made in a lab with chicken and plant cells using bioprinting. Bioprinting, which uses 3D-printing techniques to combine biological material, is used in medicine to create tissue and even organs.

The 3D-printed chicken nuggets will closely mimic the taste and appearance of KFC’s original chicken nuggets, according to the press release. KFC expects the production of 3D-printed nuggets to be more environmentally friendly than the production process of its traditional chicken nuggets. The fall release will mark the first debut of a lab-grown chicken nugget at a global fast-food chain like KFC.

Source: KFC will test lab-grown chicken nuggets made with a 3D bioprinter this fall in Russia

Russia tested satellite-to-satellite shooter, say UK and USA

Posted on by

The USA and UK have alleged that Russia last week trialled an in-orbit satellite-killer weapon.

US Space Force chief of operations General John Raymond put his name to a statement that says on July 15th Russia “injected a new object into orbit from Cosmos 2543”, a satellite that Moscow insists is a maintenance vehicle but which the USA believes is a weapons platform.

Cosmos 2543 sidled up to another Russian satellite before releasing the object that moved at around 700 km/h.

The UK’s Ministry of Defence popped up a Tweet about the incident:

The Outer Space Treaty prohibits the use of weapons in space, so if Moscow has conducted a weapons test it has been very naughty indeed. However it is widely believed that several nations posses missiles that could reach space to attack satellites.

Such attacks are important because satellite play a significant role assisting and directing terrestrial conflicts.

Moscow loves a show of force: in 2018 it revealed hypersonic warheads, a nuclear-powered submarine drone, cruise missiles with nearly unlimited range, and a ground-based laser weapon, but claimed none would be used for anything other than retaliation.

Whatever it was that Cosmos 2543 launched appears to have been rather less exotic

Source: Russia tested satellite-to-satellite shooter, say UK and USA • The Register

Google aims at Amazon and fires: List your products on Google Shopping for free

Posted on by

we’re advancing our plans to make it free for merchants to sell on Google. Beginning next week, search results on the Google Shopping tab will consist primarily of free listings, helping merchants better connect with consumers, regardless of whether they advertise on Google. With hundreds of millions of shopping searches on Google each day, we know that many retailers have the items people need in stock and ready to ship, but are less discoverable online.

For retailers, this change means free exposure to millions of people who come to Google every day for their shopping needs. For shoppers, it means more products from more stores, discoverable through the Google Shopping tab. For advertisers, this means paid campaigns can now be augmented with free listings. If you’re an existing user of Merchant Center and Shopping ads, you don’t have to do anything to take advantage of the free listings, and for new users of Merchant Center, we’ll continue working to streamline the onboarding process over the coming weeks and months.

These changes will take effect in the U.S. before the end of April, and we aim to expand this globally before the end of the year. Our help center has more details on how to participate in free product listings and Shopping ads.

We’re also kicking off a new partnership with PayPal to allow merchants to link their accounts. This will speed up our onboarding process and ensure we’re surfacing the highest quality results for our users. And we’re continuing to work closely with many of our existing partners that help merchants manage their products and inventory, including Shopify, WooCommerce, and BigCommerce, to make digital commerce more accessible for businesses of all sizes.

Source: List your products on Google Shopping for free – The Keyword

Copyright Claims Block Star Trek, Cartoon Network Comic-Con Panels video streams. Somehow they get to fix DMCA in 20 minutes – why doesn’t the  rest of the world?

Posted on by

It wouldn’t be a virtual event without a few technical difficulties. Though I can’t imagine the media giants showcasing at San Diego Comic-Con’s online event were worried about copyright violations affecting their panels. Considering, you know, they’re the ones that own the copyright.

Of course, that’s exactly what happened.

On Thursday, ViacomCBS livestreamed an hour-long panel for this year’s virtual SDCC to showcase properties in its ever-expansive Star Trek universe such as Picard, Discovery, and the upcoming Star Trek: Lower Decks. The stream briefly went dark, however, after YouTube’s copyright bots flagged the stream and replaced it with a warning that read: “Video unavailable: This video contains content from CBS CID, who has blocked it on copyright grounds.”

The hiccup occurred as the cast and producers of Discovery performed an “enhanced” read-through of the show’s season 2 finale accompanied by sound effects and on-screen storyboards. Evidently, the video sounded enough like the real deal to trigger YouTube’s software, even if it was obvious from looking at the stream that it wasn’t pirated content.

It only took about 20 minutes for the feed to be restored, but the irony of CBS’s own panel running afoul of its copyright (even accidentally) was too good for audiences to gloss over. As noted by io9’s Beth Elderkin, a later Cartoon Network panel livestream was similarly pulled offline over a copyright claim from its parent company, Turner Broadcasting.

Source: Copyright Claims Block Star Trek, Cartoon Network Comic-Con Panels

UNESCO launches worldwide online public consultation on the ethics of artificial intelligence

Posted on by

Today, UNESCO is launching a global online consultation on the ethics of artificial intelligence, to give everyone around the world the opportunity to participate in the work of its international group of experts on AI. This group has been charged with producing the first draft of a Recommendation on the Ethics of AI, to be submitted to UNESCO Member States for adoption in November 2021. If adopted, it will be the first global normative instrument to address the developments and applications of AI.

“It is crucial that as many people as possible take part in this consultation, so that voices from around the world can be heard during the drafting process for the first global normative instrument on the ethics of AI”, says Audrey Azoulay, Director-General of UNESCO.

Twenty-four renowned specialists with multidisciplinary expertise on the ethics of artificial intelligence have been tasked with producing a draft UNESCO Recommendation that takes into account the wide-ranging impacts of AI, including on the environment and the needs of the global south.

With this consultation, UNESCO is inviting civil society organizations, decision-makers, the general public, intergovernmental and non-governmental organizations, media representatives, the private sector, the scientific community and all other interested stakeholders to comment on the draft text before 31 July 2020.

UNESCO is convinced that that there is an urgent need for a global instrument on the ethics of AI to ensure that ethical, social and political issues can be adequately addressed both in times of peace and in extraordinary situations like the current global health crisis.

The UNESCO Recommendation is expected to define shared values and principles, and identify concrete policy measures on the ethics of AI. Its role will be to help Member States ensure that they uphold the fundamental rights of the UN Charter and of the Universal Declaration of Human Rights and that research, design, development, and deployment of AI systems take into account the well-being of humanity, the environment and sustainable development.

The final draft text will be presented for adoption by Member States during the 41st session of UNESCO’s General Conference in November 2021.

Source: UNESCO launches worldwide online public consultation on the ethics of artificial intelligence

BadPower Attack Can Trick Power Bricks into Starting a Fire

Posted on by

In a study published by Xuanwu Labs (which is owned by Chinese tech giant Tencent), researchers detailed the BadPower hack which works by manipulating the firmware inside fast charge power adapters.

Normally, when a phone is connected to a power brick with support for fast charging, the phone and the power adapter communicate with each other to determine the proper amount of electricity that can be sent to the phone without damaging the device—the more juice the power adapter can send, the faster it can charge the phone.

However, by hacking the fast charging firmware built into a power adapter, Xuanwu Labs demonstrated that bad actors could potentially manipulate the power brick into sending more electricity than a phone can handle, thereby overheating the phone, melting internal components, or as Xuanwu Labs discovered, setting the device on fire.

Here’s a photo captured by researchers at Xuanwu showing what a charging brick infected with BadPower can do to a connected device.
Here’s a photo captured by researchers at Xuanwu showing what a charging brick infected with BadPower can do to a connected device.
Photo: Xuanwu Labs (Other)

After confirming the results of the research, Xuanwu labs decided to test BadPower by loading it onto 35 different power bricks (out of 234 available models currently on sale) and discovered that 18 of those chargers (made by eight different vendors) were susceptible to the attack.

To make matters worse, if BadPower is used to hack a power brick, there would be no external signs or easy ways of detecting that the device had been tampered with. Fortunately, for now, it will require the bad actor to have physical access to the power adapter. The researchers at Xuanwu claimed hacking a power adapter was as simple as connecting it to a portable, custom-designed rig that can upload malicious code to the power brick in a just a few seconds. And in some cases, the researchers were able to upload BadPower just by connecting a power adapter to an infected phone or laptop.

Source: BadPower Attack Can Trick Power Bricks into Starting a Fire

Sloan Digital Sky Surver releases biggest 3D map of the universe

Posted on by

An international consortium has compiled the most comprehensive 3D map of the observable cosmos to date, significantly improving our understanding of cosmological history while raising new questions about the fundamental laws that govern the universe.

The updated map, made from data gathered by the Sloan Digital Sky Survey (SDSS), offers a detailed history of the cosmos, from the Big Bang and its early expansion phase through to the current era.

The latest phase of the project, called “extended Baryon Oscillation Spectroscopic Survey” (eBOSS), includes the positions and distances of more than 4 million galaxies and ultra-bright quasars surrounding supermassive black holes, according to a press release from EPFL, a Swiss research institute. The new results are showing how the universe evolved over an 11-billion-year period, filling an important gap in our knowledge.

“In 2012, I launched the eBOSS project with the idea of ​​producing the most complete 3D map of the Universe throughout the lifetime of the Universe, implementing for the first time celestial objects that indicate the distribution of matter in the distant Universe, galaxies that actively form stars and quasars,” Jean-Paul Kneib, a co-leader of the project and an EPFL astrophysicist, said in the press release. “It is a great pleasure to see the culmination of this work today.”

The eBOSS project has resulted in 23 new scientific papers (plus the new map), which were released today to the arXiv pre-print server.

Astrophysicists have previously chronicled the earliest days of the universe by calculating the abundance of elements created after the Big Bang and studying the Cosmic Microwave Background Radiation—the cooled remnant of the universe’s first light. Scientists also have a good handle on recent cosmological history, as informed by galactic maps and distance measurements. But “there’s a troublesome gap in the middle 11 billion years,” said Kyle Dawson, a cosmologist at the University of Utah and the principal investigator of eBoss, in an SDSS press release.

To gaze back at this 11-billion-year gap, the scientists honed in on galaxies and quasars, looking for patterns in how they’re distributed across the universe. These observations were then combined with data gathered during previous phases of SDSS, dating back to 1998.

“Taken together, detailed analyses of the eBOSS map and the earlier SDSS experiments have now provided the most accurate expansion history measurements over the widest-ever range of cosmic time,” Will Percival, an astrophysicist at the University of Waterloo and eBOSS’s Survey Scientist, said in the EPFL statement. “These studies allow us to connect all these measurements into a complete story of the expansion of the Universe.”

The updated map shows empty voids and filaments that defined the universe a mere 300,000 years after the Big Bang, which happened 13.8 billion years ago. By identifying ancient quasars—extremely bright galactic cores surrounding supermassive black holes—the researchers were able to map regions more than 11 billion years old. To map more recent periods, namely regions between 6 billion and 11 billion years old, the scientists tracked patterns in the distribution of galaxies, which subsequently enabled more accurate measurements of dark energy.

Source: New Map of the Universe Fills in Some ‘Troublesome’ Gaps

AI helps drone swarms navigate through crowded, unfamiliar spaces

Posted on by

Drone swarms frequently fly outside for a reason: it’s difficult for the robotic fliers to navigate in tight spaces without hitting each other. Caltech researchers may have a way for those drones to fly indoors, however. They’ve developed a machine learning algorithm, Global-to-Local Safe Autonomy Synthesis (GLAS), that lets swarms navigate crowded, unmapped environments. The system works by giving each drone a degree of independence that lets it adapt to a changing environment.

Instead of relying on existing maps or the routes of every other drone in the swarm, GLAS has each machine learning how to navigate a given space on its own even as it coordinates with others. This decentralized model both helps the drones improvise and makes scaling the swarm easier, as the computing is spread across many robots.

An additional tracking controller, Neural-Swarm, helps the drones compensate for aerodynamic interactions, such as the downwash from a robot flying overhead. It’s already more reliable than a “commercial” controller that doesn’t account for aerodynamics, with far smaller tracking errors.

This could be useful for drone light shows, of course, but it could also help with more vital operations. Search and rescue drones could safely comb areas in packs, while self-driving cars could keep traffic jams and collisions to a minimum. It may take a while before there are implementations outside of the lab, but don’t be surprised if flocks of drones become relatively commonplace.

Source: AI helps drone swarms navigate through crowded, unfamiliar spaces | Engadget

The Physical Traits that Define Men and Women in Literature

Posted on by

After slogging through that book, I began paying attention to similarly stereotyped descriptions of bodies in other books. Women are all soft thighs and red lips. Men, strong muscles and rough hands.

I was frustrated by this lazy writing. I want to read books that explore the full humanity of their characters, not stories that reduce both men and women to weak stereotypes of their gender.

Before getting too upset, I wanted to see if this approach to writing was as widespread as it seemed, or if I was succumbing to selective reading. Do authors really mention particular body parts

more for men than for women? Are women’s bodies described using different adjectives than those attributed to men?

[…]

It’s easy to dismiss or overlook the differences in the way men’s and women’s bodies are depicted because they can be subtle and hard to discern in one particular book—one or two extra mentions of “his bushy hair” may not register over 300 pages.

But when you zoom out and look at thousands of books, the patterns are clear.

In real life, women are obviously more dimensional than soft, sexual objects. Men are more complex than muscular lunkheads. We should expect that same nuance of the characters in the books we read.

Instead of focusing on her perfect hair and soft hips and wet eyes, tell me about her strong legs

that carry her through the world, or her capable hands that do her life’s work. Don’t reduce him to his muscular forearms and rough knuckles and chiseled jaw. I want to read about his silly smile for his family or his soft heart for animals.

 

Source: The Physical Traits that Define Men and Women in Literature

Firefox on Android: Camera remains active when phone is locked or the user switches apps after streaming

Posted on by

Mozilla says it’s working on fixing a bug in Firefox for Android that keeps the smartphone camera active even after users have moved the browser in the background or the phone screen was locked.

A Mozilla spokesperson told ZDNet in an email this week that a fix is expected for later this year in October.

The bug was first spotted and reported to Mozilla a year ago, in July 2019, by an employee of video delivery platform Appear TV.

The bug manifests when users chose to video stream from a website loaded in Firefox instead of a native app.

Mobile users often choose to stream from a mobile browser for privacy reasons, such as not wanting to install an intrusive app and grant it unfettered access to their smartphone’s data. Mobile browsers are better because they prevent websites from accessing smartphone data, keeping their data collection to a minimum.

The Appear TV developer noticed that Firefox video streams kept going, even in situations when they should have normally stopped.

While this raises issues with streams continuing to consume the user’s bandwidth, the bug was also deemed a major privacy issue as Firefox would continue to stream from the user’s device in situations where the user expected privacy by switching to another app or locking the device.

“From our analysis, a website is allowed to retain access to your camera or microphone whilst you’re using other apps, or even if the phone is locked,” a spokesperson for Traced, a privacy app, told ZDNet, after alerting us to the issue.

“While there are times you might want the microphone or video to keep working in the background, your camera should never record you when your phone is locked,” Traced added.

Source: Firefox on Android: Camera remains active when phone is locked or the user switches apps | ZDNet

Mozilla offers trusted VPN services – good timing!

Posted on by

Starting today, there’s a VPN on the market from a company you trust. The Mozilla VPN (Virtual Private Network) is now available on Windows and Android devices. This fast and easy-to-use VPN service is brought to you by Mozilla, the makers of Firefox, and a trusted name in online consumer security and privacy services.

See for yourself how the Mozilla VPN works:

 

The first thing you may notice when you install the Mozilla VPN is how fast your browsing experience is. That’s because the Mozilla VPN is based on modern and lean technology, the WireGuard protocol’s 4,000 lines of code, is a fraction in size of legacy protocols used by other VPN service providers.

You will also see an easy-to-use and simple interface for anyone who is new to VPN, or those who want to set it and get onto the web.

With no long-term contracts required, the Mozilla VPN is available for just $4.99 USD per month and will initially be available in the United States, Canada, the United Kingdom, Singapore, Malaysia, and New Zealand, with plans to expand to other countries this Fall.

Source: Mozilla Puts Its Trusted Stamp on VPN – The Mozilla Blog

Especially after 7 no logs VPN services just dumped millions of lines of logs with very very personal information in them

Seven ‘no log’ VPN providers accused of leaking – yup, you guessed it – 1.2TB of user logs onto the internet

Posted on by

A string of “zero logging” VPN providers have some explaining to do after more than a terabyte of user logs were found on their servers unprotected and facing the public internet.

This data, we are told, included in at least some cases clear-text passwords, personal information, and lists of websites visited, all for anyone to stumble upon.

It all came to light this week after Comparitech’s Bob Diachenko spotted 894GB of records in an unsecured Elasticsearch cluster that belonged to UFO VPN.

The silo contained streams of log entries as netizens connected to UFO’s service: this information included what appeared to be account passwords in plain text, VPN session secrets and tokens, IP addresses of users’ devices and the VPN servers they connected to, connection timestamps, location information, device characteristics and OS versions, and web domains from which ads were injected into the browsers of UFO’s free-tier users.

UFO stated in bold in its privacy policy: “We do not track user activities outside of our site, nor do we track the website browsing or connection activities of users who are using our Services.” Yet it appears it was at least logging connections to its service – and in a system anyone could access if they could find it.

More than 20 million entries were added a day to the logs, according to Comparitech, and UFO happens to boast on its website it has 20 million users. Diachenko said he alerted the provider to the misconfiguration on July 1, the day he found the unprotected database, and heard nothing back.

Oh, it gets worse

A few days later, on July 5, the data silo was separately discovered by Noam Rotem’s team at VPNmentor, and it became clear the security blunder went well beyond UFO. It appears seven Hong-Kong-based VPN providers – UFO VPN, FAST VPN, Free VPN, Super VPN, Flash VPN, Secure VPN, and Rabbit VPN – all share a common entity, which provides a white-labelled VPN service.

And they were all leaking data onto the internet from that unsecured Elasticsearch cluster, VPNmentor reported. Altogether, some 1.2TB of data was sitting out in the open, totaling 1,083,997,361 log entries, many featuring highly sensitive information, it is said.

This exposed cluster contained, we’re told, at least some records of websites visited, connection logs, people’s names, subscribers’ email and home addresses, plain-text passwords, Bitcoin and Paypal payment information, messages to support desks, device specifications, and account info.

“Each of these VPNs claims that their services are ‘no-log’ VPNs, which means that they don’t record any user activity on their respective apps,” Rotem’s team said. “However, we found multiple instances of internet activity logs on their shared server. This was in addition to the personally identifiable information, which included email addresses, clear text passwords, IP addresses, home addresses, phone models, device ID, and other technical details.”

Source: Seven ‘no log’ VPN providers accused of leaking – yup, you guessed it – 1.2TB of user logs onto the internet • The Register

Issue with Cloudflare’s DNS service and crappy router shuts down half the web. Again.

Posted on by

Scores of websites and services went down Friday afternoon due to problems with Cloudflare’s DNS service, sparking rampant speculation about the cause. After all, a global DDOS attack would totally fit the real-life apocalypse movie that 2020 is increasingly turning into.

The outage, which started shortly after 5 p.m. ET, brought down popular sites and services like Discord, Politico, Feedly, and League of Legends for roughly half an hour on Friday. Once connections were restored, Cloudflare issued an incident report stating that the issue “was not as a result of an attack” and that it “has been identified and a fix is being implemented.”

Turns out the real explanation’s nothing so nefarious. Evidently, half the internet briefly went dark because of a crappy router in Atlanta.

“It appears that a router in Atlanta had an error that caused bad routes across our backbone. That resulted in misrouted traffic to PoPs that connect to our backbone,” Cloudflare CEO Matthew Prince tweeted Friday. “We isolated the Atlanta router and shut down our backbone, routing traffic across transit providers instead. There was some congestion that caused slow performance on some links as the logging caught up. Everything is restored now and we’re looking into the root cause.”

According to the incident report, this issue with Cloudflare’s 1.1.1.1 DNS service impacted its data centers internationally, from Frankfurt to Paris and Schiphol, as well as several in major U.S. cities, including Los Angeles, Chicago, Seattle, Atlanta, and San Jose. Reports on Downdetector showed the outages appeared to be concentrated in the U.S. and northern Europe.

Source: Issue with Cloudflare’s DNS service shuts down half the web

Solar+battery in one device sets new efficiency standard

Posted on by

The drop in battery prices is enabling battery integration with renewable systems in two contexts. In one, the battery serves as a short-term power reservoir to smooth over short-term fluctuations in the output of renewable power. In the other, the battery holds the power for when renewable power production stops, as solar power does at night. This works great for off-grid use, but it adds some complications in the form of additional hardware to convert voltages and current.

But there’s actually an additional option, one that merges photovoltaic and battery hardware in a single, unified device that can have extensive storage capacity. The main drawback? The devices have either been unstable or have terrible efficiency. But an international team of researchers has put together a device that’s both stable and has efficiencies competitive with those of silicon panels.

Solar flow batteries

How do you integrate photovoltaic cells and batteries? At its simplest, you make one of the electrodes that pulls power out of the photovoltaic system into the electrode of a battery. Which sounds like a major “well, duh!” But integration is nowhere near that simple. Battery electrodes, after all, have to be compatible with the chemistry of the battery—for lithium-ion batteries, for example, the electrodes end up storing the ions themselves and so have to have a structure that allows that.

[…]

Previous records for a solar flow battery show the tradeoffs these devices have faced. The researchers used a measure of efficiency termed solar-to-output electricity efficiency, or SOEE. The most efficient solar flow devices had hit 14.1 percent but had short lifespans due to reactions between the battery and photovoltaic materials. More stable ones, which had lifespans exceeding 200 hours, only had SOEEs in the area of 5 to 6 percent.

The new material had an SOEE in the area of 21 percent—about the same as solar cells already on the market, and not too far off the efficiency of the photovoltaic hardware of the device on its own. And their performance was stable for over 400 charge/discharge cycles, which means for at least 500 hours. While they might eventually decay, there was no indication of that happening over the time they were tested. Both of those are very, very significant improvements.

Obviously, given that both batteries and photovoltaic cells can potentially last for decades, 500 hours shouldn’t be viewed as a definitive test—especially for a device that’s proposed to enable off-the-grid electrical production. But the demonstration that voltage matching provides such a large efficiency boost should allow researchers to identify a wider range of battery and photovoltaic chemistries that have improved efficiencies. That accomplished, researchers will then be able to search among those for stable configurations. Whether all of that is compatible with low cost and mass production will be the critical question. But, at this stage of the renewable energy revolution, having more options to explore can only be a good thing.

Source: Solar+battery in one device sets new efficiency standard | Ars Technica

United Arab Emirates’ Mars probe successfully launched and phones home

Posted on by

The United Arab Emirates has successfully launched a Mars probe.

The Emirates Mars Mission (EMM) aims to orbit the red planet with a probe named “Hope” that will gather data to help humanity build a proper Martian weather map, characterise the planet’s lower atmosphere and offer an explanation of why Mars is losing Hydrogen and Oxygen into space.

Early on Monday, Hope was launched atop from Japan’s Tanegashima Space Center atop a Mitsubishi Heavy Industries H-IIA rocket.

The mission appears to be in fine shape, as just a few hours after launch the probe was beaming back a signal.

Now comes the seven-month schlep to the Red Planet. On arrival Hope will conduct a 30-minute burn to slow itself from over 121,000 km/h to approximately 18,000 km/h. At the latter speed, Mars’ gravity should be sufficient to see the probe enter an orbit with a perigee that sometimes falls beneath 1,000km. Further operations will aim to settle the craft into its planned orbit for doing science, with a perigee and apogee of between 20,000km and 43,000km.

From that orbit Hope will use its infrared and ultraviolet spectrometers, plus a 4:3 visible-spectrum imager packing a 12-megapixel 12-bit monochrome CMOS array, to gather data on Mars’ atmosphere. The probe will contact Earth twice a week for sessions lasting between six and eight hours. Mission scientists expect around one terabyte of data to flow during those connection windows and have planned for the probe to operate for two years.

Hope’s scientific payload is modest compared to NASA’s MAVEN or India’s Mangalyaan, but the mission is significant as it is the first interplanetary effort mounted by an Arab nation. As such it is the source of considerable pride.

Source: United Arab Emirates’ Mars probe successfully launched and phones home

Replacing lithium with sodium in batteries

Posted on by

An international team of scientists from NUST MISIS, Russian Academy of Science and the Helmholtz-Zentrum Dresden-Rossendorf has found that instead of lithium (Li), sodium (Na) “stacked” in a special way can be used for battery production. Sodium batteries would be significantly cheaper and equivalently or even more capacious than existing lithium batteries. The results of the study are published in the journal Nano Energy.

[…]

The most promising replacement for lithium is sodium (Na), since a two-layer arrangement of sodium atoms in bigraphen sandwich demonstrates anode capacity comparable to the capacity of a conventional graphite anode in Li-ion batteries—about 335 mA*h/g against 372 mA*h/g for lithium. However, sodium is much more common than lithium, and therefore cheaper and more easily obtained.

A special way of stacking atoms is actually placing them one above the other. This structure is created by transferring atoms from a piece of metal to the space between two sheets of graphene under high voltage, which simulates the process of charging a battery. In the end, it looks like a sandwich consisting of a layer of carbon, two layers of alkali metal, and another layer of carbon.

[…]

Zakhar Popov, senior researcher at NUST MISIS Laboratory of Inorganic Nanomaterials and RAS, says, “Our simulation shows that lithium atoms bind much more strongly to graphene, but increasing the number of layers of leads to less stability. The opposite trend is observed in the case of sodium—as the number of layers of sodium increases, the stability of such structures increases, so we hope that such materials will be obtained in the experiment.”

The next step of the research team is to create an experimental sample and study it in the laboratory. This will be handled in Max Planck Institute for Solid State Research, Stuttgart, Germany. If successful, it could lead to a new generation of Na batteries that will be significantly cheaper and equivalently or even more capacious than Li-ion batteries.

Source: Replacing lithium with sodium in batteries

FYI Russia is totally hacking the West’s labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies. So is China and Iran.

Posted on by

Russian hackers at the state’s FSB spy agency have been caught breaking into Western institutions working on potential vaccines for the COVID-19 coronavirus in hope of stealing said research. That’s according to the British National Cyber Security Centre and America’s NSA today.

The Kremlin-backed APT29 crew, also known by a variety of other names such as Cozy Bear, Iron Hemlock, or The Dukes, depending on which threat intel company you’re talking to that week, is believed by most reputable analysts to be a wholly owned subsidiary of the FSB, modern-day successor to the infamous Soviet KGB.

NCSC ops director Paul Chichester said in a statement: “We condemn these despicable attacks against those doing vital work to combat the coronavirus pandemic.”

Foreign Secretary Dominic Raab added: “It is completely unacceptable that the Russian Intelligence Services are targeting those working to combat the coronavirus pandemic. While others pursue their selfish interests with reckless behaviour, the UK and its allies are getting on with the hard work of finding a vaccine and protecting global health.”

NCSC and its international chums say they are 95 per cent confident that the attacks they investigated came from Russia. By abusing publicly known vulnerabilities, including those in Citrix and popular VPN products, the Russians were able to gain access to targeted networks. Once inside they deploy a custom malware named WellMess or WellMail, it’s claimed.

“WellMess is a lightweight malware designed to execute arbitrary shell commands, upload and download files. The malware supports HTTP, TLS and DNS communications methods,” said NCSC in its advisory [PDF complete with IOCs and detection rules].

WellMail uses SMTP port 25 to communicate, runs commands or scripts, and uploads its findings to a hard-coded command and control server using TLS encryption. Both pieces of malware are written in Go, the open source language devised by Google. The report neatly summarizes the situation:

Throughout 2020, APT29 has targeted various organisations involved in COVID-19 vaccine development in Canada, the United States and the United Kingdom, highly likely with the intention of stealing information and intellectual property relating to the development and testing of COVID-19 vaccines.

Intriguingly, NCSC – along with the US CISA and Canada’s Communications Security Establishment – also said APT29 was deploying a custom malware it named SoreFang against products from Chinese enterprise networking biz Sangfor. However, it cautioned that Sangfor was already a target for other malicious folk before APT29 got wind of it and so not all attacks against Sangfor kit were necessarily proof of state-level espionage.

Today’s attribution follows on from warnings back in May that nameless-but-nefarious bods were targeting those same coronavirus research institutions. In light of today’s news, it could be argued that that public shot across the FSB’s bows didn’t do much to stop the digital attacks.

“This also demonstrates that Iron Hemlock (aka APT29, Cozy Bear) is a very capable threat actor that conducts low visibility operations over an extended period, since at least 2018 in this case, while attracting minimal publicity,” Rafe Pilling, a researcher at infosec biz Secureworks, told The Register.

“Every time we see this group emerge in public they are using novel malware and tradecraft. A strong focus on operational security prompts constant change, a stark contrast to some of their comrades in other parts of government and the military.”

He added that it’s not just Russia doing the hacking, although Vladimir Putin’s nation is at the forefront of today’s report: “The NCSC report emphasises that the global interest in COVID-19 is driving an intelligence collection agenda for Russia, as well as nations like Iran, that has previously been identified targeting COVID-19 related research,” he opined.

“The organizations developing vaccines and treatments for the virus are being heavily targeted by Russian, Iranian, and Chinese actors seeking a leg up on their own research.”

Meanwhile, Mandiant Threat Intelligence’s John Hultquist said in a statement that APT29 tended to stay below the radar and steal data, making today’s attribution all the more eye-catching for espionage watchers.

“Despite involvement in several high-profile incidents, APT29 rarely receives the same attention as other Russian actors because they tend to quietly focus on intelligence collection,” he explained. “Whereas GRU actors have brazenly leaked documents and carried out destructive attacks, APT29 digs in for the long term, siphoning intelligence away from its target.”

Back in 2015 Fireeye observed APT29 deploying a Twitter-dependent malware strain it called Hammertoss, while last year Eset spotted the same hackers quietly targeting EU nations’ foreign offices and embassies. It seems the state-backed threat is never all that far away

Source: FYI Russia is totally hacking the West’s labs in search of COVID-19 vaccine files, say UK, US, Canada cyber-spies • The Register

Secret Trump order gives CIA more powers to launch cyberattacks with less oversight

Posted on by

The Central Intelligence Agency has conducted a series of covert cyber operations against Iran and other targets since winning a secret victory in 2018 when President Trump signed what amounts to a sweeping authorization for such activities, according to former U.S. officials with direct knowledge of the matter.

The secret authorization, known as a presidential finding, gives the spy agency more freedom in both the kinds of operations it conducts and who it targets, undoing many restrictions that had been in place under prior administrations. The finding allows the CIA to more easily authorize its own covert cyber operations, rather than requiring the agency to get approval from the White House.

Unlike previous presidential findings that have focused on a specific foreign policy objective or outcome — such as preventing Iran from becoming a nuclear power — this directive, driven by the National Security Council and crafted by the CIA, focuses more broadly on a capability: covert action in cyberspace.

The “very aggressive” finding “gave the agency very specific authorities to really take the fight offensively to a handful of adversarial countries,” said a former U.S. government official. These countries include Russia, China, Iran and North Korea — which are mentioned directly in the document — but the finding potentially applies to others as well, according to another former official. “The White House wanted a vehicle to strike back,” said the second former official. “And this was the way to do it.”

President Trump and the CIA. (Photo illustration: Yahoo News; photos: AP(3), Getty Images)
President Trump and the CIA. (Photo illustration: Yahoo News; photos: AP(3), Getty Images)

The CIA’s new powers are not about hacking to collect intelligence. Instead, they open the way for the agency to launch offensive cyber operations with the aim of producing disruption — like cutting off electricity or compromising an intelligence operation by dumping documents online — as well as destruction, similar to the U.S.-Israeli 2009 Stuxnet attack, which destroyed centrifuges that Iran used to enrich uranium gas for its nuclear program.

The finding has made it easier for the CIA to damage adversaries’ critical infrastructure, such as petrochemical plants, and to engage in the kind of hack-and-dump operations that Russian hackers and WikiLeaks popularized, in which tranches of stolen documents or data are leaked to journalists or posted on the internet. It has also freed the agency to conduct disruptive operations against organizations that were largely off limits previously, such as banks and other financial institutions.

Another key change with the finding is it lessened the evidentiary requirements that limited the CIA’s ability to conduct covert cyber operations against entities like media organizations, charities, religious institutions or businesses believed to be working on behalf of adversaries’ foreign intelligence services, as well as individuals affiliated with these organizations, according to former officials.

“Before, you would need years of signals and dozens of pages of intelligence to show that this thing is a de facto arm of the government,” a former official told Yahoo News. Now, “as long as you can show that it vaguely looks like the charity is working on behalf of that government, then you’re good.”

The CIA has wasted no time in exercising the new freedoms won under Trump. Since the finding was signed two years ago, the agency has carried out at least a dozen operations that were on its wish list, according to this former official. “This has been a combination of destructive things — stuff is on fire and exploding — and also public dissemination of data: leaking or things that look like leaking.”

Some CIA officials greeted the new finding as a needed reform that allows the agency to act more nimbly. “People were doing backflips in the hallways [when it was signed],” said another former U.S. official.

But critics, including some former U.S. officials, see a potentially dangerous attenuation of intelligence oversight, which could have unintended consequences and even put people’s lives at risk, according to former officials.

The involvement of U.S. intelligence agencies in hack-and-dump activities also raises uncomfortable comparisons for some former officials. “Our government is basically turning into f****ing WikiLeaks, [using] secure communications on the dark web with dissidents, hacking and dumping,” said one such former official.

The CIA declined to comment or respond to an extensive list of questions from Yahoo News. The National Security Council did not respond to multiple written requests for comment.

[…]

Source: Secret Trump order gives CIA more powers to launch cyberattacks

Zoom fixed a vanity URL issue that could have led to phishing attacks

Posted on by

Zoom says it has fixed a security issue that would have let hackers manipulate organizations’ custom URLs for the service and send legitimate-seeming meeting invitations. If a victim accepted the invitation and attended the meeting, the phony caller may have been able to inject malware into their device or carry out a phishing attack.

Hackers could have taken advantage of the exploit in two ways. One involved changing a vanity URL (i.e. http://[whatever].zoom.com) to include a direct link to a phony meeting. The other centered around targeting an organization’s own Zoom web interface, and urging a victim to enter their meeting ID into a malicious vanity URL instead. A video shared by Zoom and Check Point Research, which helped identify and resolve the issue, shows how the exploit worked.

Zoom’s popularity exploded amid the COVID-19 pandemic as people were looking to chat with friends, family and co-workers via video call. In December, around 10 million people participated in Zoom meetings each day, but by April, that figure had shot up exponentially to 300 million. It just launched a lineup of video-calling devices targeted at people who are working from home.

With the increased attention on Zoom came more focus on its security and privacy issues. The company has been trying to fix some of its vulnerabilities in recent months, having announced a 90-day plan in April to beef up security. Among the measures it undertook were the formation of a security council and the rollout of a patch packed with security updates.

Zoom also announced it would incorporate end-to-end encryption (E2EE) on video calls for greater security. At first, it was only going to enable E2EE for paying customers, before it relented and said it’d offer it to all users.

Source: Zoom fixed a vanity URL issue that could have led to phishing attacks | Engadget

Twitter says hack of key staff led to celebrity, politician, biz account hijack mega-spree

Posted on by

Twitter has offered its initial analysis of the Wednesday mass hijacking of prominent twits’ accounts – and suggested it all kicked off after its staff fell for social engineering.

Judging from leaked screenshots of Twitter’s internal systems circulating online and seen by El Reg, it appears one or more miscreants were able to gain direct or indirect access to an administration panel used by Twitter employees to configure accounts, by tricking or coercing the social network’s staff.

From there, the crooks were, at least in some cases, seemingly able to change the registered email addresses of celebrities, corporations, crypto-coin exchanges, publications, and politicians’ accounts – think Apple, Uber, Bill Gates, Elon Musk, Joe Biden, and so on – to an inbox they controlled, requested password resets, and logged in to tweet Bitcoin scams to millions of followers. The miscreants may have been able to disable multi-factor authentication from the inside, too.

According to Vice, hackers boasted they had a paid mole inside Twitter who did all the dirty work for them. The social network’s spokespeople said it was still investigating exactly how it all went down.

Twitter’s support account spelled out its side of the story so far this evening:

The Twitter accounts of both The Register and your humble hack’s brother Anthony Sharwood are verified by the avian network. Both were unable to tweet once Twitter discovered the incident and both received no direct communication from Twitter about the status of our accounts nor any details of whether the incident posed a risk to personal data.

But not all functionality was removed. Sharwood the younger said he was able to send direct messages during the incident. “I sent a guy a DM to apologise that I couldn’t respond to a tweet,” he said.

Indeed, The Register‘s own verified account couldn’t tweet, but could send direct messages as well as retweet and like other tweets.

[…]

The hijackers used their ill-gotten access to post tweets in which celebrities promised to double users’ Bitcoin balances as an act of philanthropy – and more than $100,000 in cryptocurrency was transferred by hopefuls with no sign of any payback. That’s probably a better result than putting incendiary remarks in the mouth of a world leader with millions of followers, though. Or more-than-usually incendiary in the case of a certain US President

Source: Twitter says hack of key staff led to celebrity, politician, biz account hijack mega-spree • The Register

Company that contributes majority of LibreOffice code complains ecosystem is ‘beyond utterly broken’ – no financial model for FOSS

Posted on by

The companies that do most to develop and evolve the LibreOffice productivity suite, both for desktop and cloud, say the project’s business model is “beyond utterly broken” and that The Document Foundation (TDF), the charity that hosts the project, has to change its approach.

The matter is a subject of intense debate within the board of the foundation, set up in 2010 to oversee LibreOffice, a fork of Oracle’s OpenOffice. It touches on a question that crops up repeatedly in various contexts: as usage of open-source software continues to grow, what is the right business model to fund its development?

The TDF’s manifesto promises “to eliminate the digital divide in society by giving everyone access to office productivity tools free of charge.” The document adds that “we encourage corporate participation” but there is nothing about providing an incentive for such companies.

Michael Meeks, managing director at Cambridge-based Collabora, the company that contributes most full-time developers to LibreOffice, has set out the situation in (opinionated) detail here and here.

Meeks is an open-source veteran, having worked on GNOME, OpenOffice, and other prominent projects. Everything was fine at LibreOffice to begin with, and he calls 2012-2014 “the flourishing years.”

Alongside Collabora, there were 15 developers from SUSE, five from Red Hat, one from Canonical, seven from the city of Munich (part of its embrace of open source), and some 40 others from various companies. Many of those have now dropped out, or reduced their commitment, leaving around 40 paid developers in total – of whom Collabora provides 25 and CIB, a Munich-based specialist in document management, seven.

Meeks believes “LibreOffice is at serious risk,” though the matter is complex. TDF has around €1.5m in the bank, Meeks said, but something that may surprise outsiders is that the foundation cannot and does not use that money to employ developers.

Thorsten Behrens, IT lead for LibreOffice at CIB, told The Register: “The TDF is a charity; it’s not in the business of developing software and actually cannot, because that would put it in competition with the commercial ecosystem,” as well as threatening its charitable status.

Most donations go to TDF so if the commercial providers of developers reduce their commitment, TDF remains but the development effort diminishes.

This also means that contributing to LibreOffice by paying for support is currently more effective than donating money to TDF.

Could LibreOffice succeed without paid-for developers?

Behrens pointed to Apache OpenOffice as an example of why this does not work. “It is limping,” he said. “Every two years they release a new version, but everyone who cares moved on to LibreOffice. OpenOffice is the best argument that we have that we need a commercial ecosystem. If we don’t have that, we will end up like them.”

[…]

Source: Company that contributes majority of LibreOffice code complains ecosystem is ‘beyond utterly broken’ • The Register

In 2017 I spoke about this – it’s a tough nut to crack, because there are open source fanatics – who just happen to be paid to develop and promote open source – who keep holding onto a definition of “open source” developed in the 70s. Open source projects are much more complex than they were then, have a much larger user base and require much more coordination from people who aren’t being paid (by a university or foundation) to develop them.

E.U. Court Invalidates Data-Sharing Agreement With U.S.

Posted on by

The European Union’s top court ruled Thursday that an agreement that allows big tech companies to transfer data to the United States is invalid, and that national regulators need to take tougher action to protect the privacy of users’ data.

The ruling does not mean an immediate halt to all data transfers outside the EU, as there is another legal mechanism that some companies can use. But it means that the scrutiny over data transfers will be ramped up and that the EU and U.S. may have to find a new system that guarantees that Europeans’ data is afforded the same privacy protection in the U.S. as it is in the EU.

The case began after former U.S. National Security Agency contractor Edward Snowden revealed in 2013 that the American government was snooping on people’s online data and communications. The revelations included detail on how Facebook gave U.S. security agencies access to the personal data of Europeans.

Austrian activist and law student Max Schrems that year filed a complaint against Facebook, which has its EU base in Ireland, arguing that personal data should not be sent to the U.S., as many companies do, because the data protection is not as strong as in Europe. The EU has some of the toughest data privacy rules under a system known as GDPR.

Source: E.U. Court Invalidates Data-Sharing Agreement With U.S. | Time

Big tech’s reckoning starts with an antitrust committee

Posted on by

On July 27th, the CEOs of Apple, Facebook, Amazon and Google — the “GAFA” companies — will testify in front of the House Judiciary Antitrust Subcommittee. Getting those four people into the same room — even virtually — on the same day is something of a feat and it speaks to how seriously these companies are taking the committee’s long-standing investigation into their practices.

In June last year, the House Judiciary Committee launched a bipartisan investigation into competition in “digital markets.” It said that a “small number of dominant, unregulated platforms,” hold “extraordinary power” over e-commerce, online communication and digital information. It added that this power has a stifling effect on competition and entrepreneurship in both the US and the wider world.

Each CEO will need to explain how their monolithic platforms, like Facebook’s social network, Google’s advertising business and Apple’s App Store, do not violate antitrust law. “Antitrust” is shorthand for the rules around businesses stifling competition in a free and fair market. That includes blocking powerful companies from buying up, copying or pricing out their rivals to the detriment of competition. Regulators are now turning their beady eye toward what ‘big tech’ has been up to for all of these years.

“Both Democrats and Republicans do seem to believe that there’s something wrong with how these big tech companies are operating.” Joel Mitnick is an antitrust lawyer at Cadwalader in New York who began his career as a trial lawyer at the Federal Trade Commission. He says that lawmakers suspect that there’s “something abusive going on terms of their market power.” He added that there’s a belief that these companies are blocking, or excluding, competitors.

As well as these hearings, it’s likely that Google is going to face a separate antitrust lawsuit that’ll be filed towards the end of 2020.  The Wall Street Journal said a cadre of attorneys general want to scrutinize Google’s online advertising business. Apple looks like it’ll be next on the block, with a Politico report from last month saying that Apple’s “easy ride” from lawmakers is coming to an end. It contends that Apple’s control of the app store, and how it treats competing apps from rival developers within its ecosystem, is under quiet scrutiny.

News of a potential US probe into Apple came roughly a week after the European Union began its own investigation. EU officials are investigating whether Apple’s control of the app store “violate EU competition rules,” because you can only buy system apps from the App Store. The fact that apps that offer in-app purchases can only do so through Apple’s system, earning the latter 30 percent commission, is also under scrutiny.

The ultimate goal of any antitrust investigation is to promote competition that will, it’s hoped, benefit the consumer. Critics believe that Apple’s control of the App Store stifles competition and, by extension, is ultimately harmful to consumers. They believe that Apple is essentially creating a market that forces people to use Apple’s own products and services.

The obvious example is the App Store, which is the only way for developers to get their software onto people’s iOS, iPad OS and Watch OS devices. But look at HomePod, the Apple speaker that can only directly access Apple Music. If you want to play from Spotify or other services, you’ll have to use your phone to cast to the speaker. In late June, however, Apple said that it would open HomePod up to third-party services in the coming months as it opens up its products.

Mitnick explained that rather than simply examining companies through the lens of being a “monopolist,” you need to look at “market power.” Apple has historically eschewed being the biggest player in town in favor of catering to a smaller, premium segment of the market. And in consumer technology, there is a wide variety of cheaper products available from its bigger, albeit potentially less profitable, rivals.

But that’s not the case with the iOS ecosystem.  In the US, StatCounter says that iOS has around 58 percent of the market compared to Android’s 41 percent. iPad OS, the tablet-friendly version of iOS, is even more dominant in the US, with StatCounter reporting close to 65 percent of the market. It’s not a monopoly, but Apple appears to be the dominant player in the US.

And, says Mitnick, when a company gets that big “they lose the right to be so exclusionary,” essentially that with great power comes an obligation to be even more scrupulous. After all, if officials can demonstrate in a court that the App Store rules are boxing out developers and stifling competition, they could insist on radical changes. Or, they could decide that buying an Android phone offers enough of an alternative, and that Apple isn’t doing anything wrong.

Apple’s counter-argument to this is that it has done plenty to create a level playing field for its rivals. It charges just a $99 flat fee to any app developer and only asks for a 30-percent cut of any qualifying transaction. (That includes digital goods within the app or subscriptions, although that fee falls to 15 percent in subsequent years.) So long as apps don’t contravene Apple’s own rules, or break the law then developers have carte blanche to do whatever they want. And, right now, the arrangement benefits iPhone/iPad/Watch users who can count on secure apps that have been vetted by Apple.

[…]

Source: Big tech’s reckoning starts with an antitrust committee | Engadget

Let’s be clear – a 30% cut AND a flat fee is a mafia type ripoff only monopolies and the taxman can pull off.

I spoke about this in Zagreb in 2019 and it’s fun to see it all happening.

So kind of SAP NetWeaver to hand out admin accounts to anyone who can reach it. You’ll want to patch this

Posted on by

Dubbed RECON, aka Remotely Exploitable Code On NetWeaver, by its discoverers, security shop Onapsis, the bug in SAP’s NetWeaver AS JAVA (LM Configuration Wizard) allows a remote unathenticated hacker to take over a vulnerable NetWeaver-based system by creating admin accounts without any authorization.

The bug, CVE-2020-6287, is a lack of proper authentication in NetWeaver. This lets unauthorized users create new admin accounts via HTTP, granting miscreants full access: it’s rated 10 out of 10 in terms of severity. The vulnerable Java component is used throughout much of SAP’s product line, so it would be a good idea to check for updates on any SAP code running on your network.

To exploit the flaw, a hacker just needs to be able to reach the software over the network, or the internet if it is public facing.

[…]

Onapsis said it reported the flaw to SAP on May 27. The bug was confirmed later that day and, on June 8, was issued a CVSS score of 10. The flaw was kept under wraps until July 14, when SAP could put out a patch (support note 2934135) as part of its scheduled monthly security update cycle.

Source: So kind of SAP NetWeaver to hand out admin accounts to anyone who can reach it. You’ll want to patch this • The Register

Google faces lawsuit over tracking in apps even when users opted out

Posted on by

Google records what people are doing on hundreds of thousands of mobile apps even when they follow the company’s recommended settings for stopping such monitoring, a lawsuit seeking class action status alleged on Tuesday.

The data privacy lawsuit is the second filed in as many months against Google by the law firm Boies Schiller Flexner on behalf a handful of individual consumers.

[…]

The new complaint in a U.S. district court in San Jose accuses Google of violating federal wiretap law and California privacy law by logging what users are looking at in news, ride-hailing and other types of apps despite them having turned off “Web & App Activity” tracking in their Google account settings.

The lawsuit alleges the data collection happens through Google’s Firebase, a set of software popular among app makers for storing data, delivering notifications and ads, and tracking glitches and clicks. Firebase typically operates inside apps invisibly to consumers.

“Even when consumers follow Google’s own instructions and turn off ‘Web & App Activity’ tracking on their ‘Privacy Controls,’ Google nevertheless continues to intercept consumers’ app usage and app browsing communications and personal information,” the lawsuit contends.

Google uses some Firebase data to improve its products and personalize ads and other content for consumers, according to the lawsuit.

Reuters reported in March that U.S. antitrust investigators are looking into whether Google has unlawfully stifled competition in advertising and other businesses by effectively making Firebase unavoidable.

In its case last month, Boies Schiller Flexner accused Google of surreptitiously recording Chrome browser users’ activity even when they activated what Google calls Incognito mode. Google said it would fight the claim.

Source: Google faces lawsuit over tracking in apps even when users opted out – Reuters

The days of “Do No Evil” are long past