US Gov wants to spy on all drones all the time: they must be constantly connected to the internet to give Feds real-time location data

Posted on by

Drone enthusiasts are up in arms over rules proposed by the US Federal Aviation Administration (FAA) that would require their flying gizmos to provide real-time location data to the government via an internet connection.

The requirement, for drones weighing 0.55lb (0.25kg) or more, would ground an estimated 80 per cent of gadgets in the United States, and many would never be able to fly again because they couldn’t be retrofitted with the necessary equipment, say drone owners. Those that did buy new drones would need to buy a monthly data plan for their flying machines: something that would likely cost $35 or more a month, given extortionate US mobile rates.

There are also additional costs of running what would need to be new location databases of drones, which the FAA expects will be run by private companies but doesn’t exist yet, which drones owners would have to pay for through subscriptions. The cost of all this is prohibitive, for little real benefit, they argue.

If a device loses internet connectivity while flying, and can’t send its real-time info, it must land. It may be possible to pair a drone control unit with, say, a smartphone or a gateway with fixed-lined internet connectivity, so that the drone can relay its data to the Feds via these nodes. However, that’s not much use if you’re out in the middle of nowhere, or if you wander into a wireless not-spot.

Nearly 35,000 public comments have been received by the FAA, with the comment period closing later today. The vast majority of the comments are critical and most make the same broad point: that the rules are too strict, too costly and are unnecessary.

The world’s largest drone maker, DJI, is among those fighting the rule change, unsurprisingly enough. The manufacturer argues that while it agrees that every drone should have its own unique ID, the FAA proposal is “complex, expensive and intrusive.”

It would also undermine the industry own remote ID solution that doesn’t require a real-time data connection but utilizes the same radio signals used to control drones to broadcast ID information. It also flags that the proposed solution has privacy implications: people would be able to track months of someone’s previous drone usage.

Source: Drones must be constantly connected to the internet to give Feds real-time location data – new US govt proposal • The Register

Project Svalbard, Have I Been Pwned will not be sold after all

Posted on by

This is going to be a lengthy blog post so let me use this opening paragraph as a summary of where Project Svalbard is at: Have I Been Pwned is no longer being sold and I will continue running it independently. After 11 months of a very intensive process culminating in many months of exclusivity with a party I believed would ultimately be the purchaser of the service, unexpected changes to their business model made the deal infeasible. It wasn’t something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers. So that’s the tl;dr, let me now share as much as I can about what’s been happening since April 2019 and how the service will operate in the future.

Source: Troy Hunt: Project Svalbard, Have I Been Pwned and its Ongoing Independence

Watch Elon Musk’s Mars ferry prototype explode on the pad during liquid nitrogen test

Posted on by

The Starship SN1 prototype was undergoing pressure testing at the Musketeers’ factory at Boca Chica in Texas, USA, by filling its tanks with liquid nitrogen. The base of the rocket appears to have ruptured, sending the structure crashing to the ground, which you can see here:

SpaceX supremo Elon Musk himself seemed sanguine about the whole affair, taking to Twitter to say: “It’s fine, we’ll just buff it out. Where’s Flextape when you need it!?”

It’s entirely possible this was a scheduled test-to-destruction for the prototype which, when ready and in its final form, Elon wants to use for regular trips to Mars. Or it could be that someone was lax on their welding, leading to Friday’s explosion.

A second prototype, SN2, is already being built, Musk said, and will be stripped down to the bare minimum of hardware before being filled with water and then cryogenic fuel for pressure testing. Many more iterations are planned before Musk can fulfill his dream of using the Starship as a vehicle to set up a self-sustaining colony on Mars.

Source: Starship bloopers: Watch Elon Musk’s Mars ferry prototype explode on the pad during liquid nitrogen test • The Register

Chinese security firm says CIA hacked Chinese targets for the past 11 years

Posted on by

China’s largest cyber-security vendor has published today a report accusing the CIA of hacking Chinese companies and government agencies for more than 11 years.

The report, authored by Qihoo 360, claims the CIA hacked targets in China’s aviation industry, scientific research institutions, petroleum industry, Internet companies, and government agencies.

CIA hacking operations took place between September 2008 and June 2019, and most of the targets were located in Beijing, Guangdong, and Zhejiang, Qihoo researchers said.

cia-hacking.png
Image: Qihoo 360

Qihoo claims that a large part of the CIA’s hacking efforts focused on the civil aviation industry, both in China and in other countries.

The Chinese security firm claims the purpose of this campaign was “long-term and targeted intelligence-gathering” to track “real-time global flight status, passenger information, trade freight, and other related information.”

Report based on Vault 7 leaks

Qihoo says it linked the attacks to the CIA based on the malware used in the intrusions — namely Fluxwire [1, 2, 3] and Grasshopper [1, 2].

Both malware strains came to light in early 2017 when Wikileaks published the Vault 7 dump, a collection of documentation files detailing the CIA’s arsenal of cyber-weapons.

WikiLeaks claimed it received the files from a CIA insider and whistleblower, later identified as Joshua Schultz — currently under trial in the US.

Weeks after the WikiLeaks Vault 7 revelations, Symantec confirmed that Fluxwire was the Corentry malware that they had been tracking for years.

Source: Chinese security firm says CIA hacked Chinese targets for the past 11 years | ZDNet

This wearable device camouflages its wearer from thermal cameras no matter the weather

Posted on by

 

Researchers at the University of California San Diego developed a wearable technology that can hide its wearer from heat-detecting sensors such as night vision goggles, even when the ambient temperature changes–a feat that current state of the art technology cannot match. The technology can adapt to temperature changes in just a few minutes, while keeping the wearer comfortable.

The device, which is at the proof-of-concept stage, has a surface that quickly cools down or heats up to match ambient temperatures, camouflaging the wearer’s body heat. The surface can go from 10 to 38 degrees Celsius (50 to 100.5 degrees Fahrenheit) in less than a minute. Meanwhile, the inside remains at the same temperature as human skin, making it comfortable for the wearer. The wireless device can be embedded into fabric, such as an armband. A more advanced version could be worn as a jacket.

Source: This wearable device camouflages its wearer no matter the weather

Scientists Found Breathable Oxygen in Another Galaxy for the First Time

Posted on by

Astronomers have spotted molecular oxygen in a galaxy far far away, marking the first time that this important element has ever been detected outside of the Milky Way.

This momentous “first detection of extragalactic molecular oxygen,” as it is described in a recent study in The Astrophysical Journal, has big implications for understanding the crucial role of oxygen in the evolution of planets, stars, galaxies, and life.

Oxygen is the third most abundant element in the universe, after hydrogen and helium, and is one of the key ingredients for life here on Earth. Molecular oxygen is the most common free form of the element and consists of two oxygen atoms with the designation O2. It is the version of the gas that we humans, among many other organisms, need to breathe in order to live.

Yet despite its ubiquity and significance to habitability, scientists have struggled for decades to detect molecular oxygen in the wider cosmos.

Now, a team led by Junzhi Wang, an astronomer at the Shanghai Astronomical Observatory, reports the discovery of molecular oxygen in a dazzling galaxy called Markarian 231, located 581 million light years from the Milky Way.

The researchers were able to make this detection with ground-based radio observatories. “Deep observations” from the IRAM 30-meter telescope in Spain and the NOEMA interferometer in France revealed molecular oxygen emission “in an external galaxy for the first time,” Wang and his co-authors wrote.

Source: Scientists Found Breathable Oxygen in Another Galaxy for the First Time – VICE

Ring doorbells to change privacy settings after study showed it shared personal information with Facebook and Google

Posted on by

Ring, the Amazon-owned maker of smart-home doorbells and web-enabled security cameras, is changing its privacy settings two weeks after a study showed the company shares customers’ personal information with Facebook, Google and other parties without users’ consent.

The change will let Ring users block the company from sharing most, but not all, of their data. A company spokesperson said people will be able to opt out of those sharing agreements “where applicable.” The spokesperson declined to clarify what “where applicable” might mean.

Ring will announce and start rolling out the opt-out feature soon, the spokesperson told CBS MoneyWatch.

Source: Ring to change privacy settings after study showed it shared personal information with Facebook and Google – CBS News

Facebook Cuts Off Some Mobile tracking Ad Data With Advertising Partners, should have done this long long ago

Posted on by

Facebook is tightening its rules around the use of raw, device-level data used for measuring ad campaigns that Facebook shares with an elite group of advertising technology partners.

As first spotted by AdAge, the company recently tweaked the terms of service that apply to its “advanced mobile measurement partner” program, which advertisers tap into to track the performance of their ads on Facebook. Those mobile measurement partners (MMPs) were, until now, free to share the raw data they accessed from Facebook with advertisers. These metrics drilled down to the individual device level, which advertisers could then reportedly connect to any device IDs they might already have on tap.

Facebook reportedly began notifying affected partners on February 5 and all advertising partners must agree to the updated terms of the program before April 22, according to Tencent.

While Facebook didn’t deliver the device IDs themselves, passing granular insights like the way a given consumer shops or browses the web—and then giving an advertiser free rein to link that data to, well, just about anyone—smacks hard of something that could easily turn Cambridge Analytica-y if the wrong actors got their hands on the data. As AdAge put it:

The program had safeguards that bound advertisers to act responsibly, but there were always concerns that advertisers could misuse the data, according to people familiar with the program. Facebook says that it did not uncover any wrongdoing on the part of advertisers when it decided to update the measurement program. However, the program under its older configuration came with clear risks, according to marketing partners.

Source: Facebook Cuts Off Some Ad Data With Advertising Partners

Your banks’ APIs are a major target for credential stuffing attacks

Posted on by

Automating connections from 3rd party providers makes it easy to access your financial data because people re-use their logins and these logins have been repeatedly leaked online.

New data from security and content delivery company Akamai shows that one in every five attempts to gain unauthorized access to user accounts is now done through application programming interfaces (APIs) instead of user-facing login pages. This trend is even more pronounced in the financial services industry where the use of APIs is widespread and in part fueled by regulatory requirements.

According to a report released today, between December 2017 and November 2019, Akamai observed 85.4 billion credential abuse attacks against companies worldwide that use its services. Of those attacks, around 16.5 billion, or nearly 20%, targeted hostnames that were clearly identified as API endpoints. However, in the financial industry, the percentage of attacks that targeted APIs rose sharply between May and September 2019, at times reaching 75%.

“API usage and widespread adoption have enabled criminals to automate their attacks,” the company said in its report. “This is why the volume of credential stuffing incidents has continued to grow year over year, and why such attacks remain a steady and constant risk across all market segments.”

The credential stuffing problem

Credential stuffing, a type of brute-force attack where criminals use lists of leaked username and password combinations to gain access to accounts, has become a major problem in recent years. This is a consequence of the large number of data breaches over the past decade that have resulted in billions of stolen credentials being released publicly on the internet or sold on underground markets as commodities.

Knowing that users reuse passwords across various websites, attackers have used the credentials exposed in data breaches to build so-called combo lists. These lists of username and password combinations are then loaded into botnets or automated tools and are used to flood websites with login requests in an attempt to gain access.

However, once access is gained, extracting information from the affected services by crawling the customer pages requires some effort and customization, whereas requesting and extracting information through APIs is standardized and well suited for automation. After all, the very purpose of an API is to facilitate applications talking to each other and exchanging data automatically.

Source: APIs are becoming a major target for credential stuffing attacks

Apple has blocked Clearview AI’s iPhone app for violating its rules

Posted on by

An iPhone app built by controversial facial recognition startup Clearview AI has been blocked by Apple, effectively banning the app from use.

Apple confirmed to TechCrunch that the startup “violated” the terms of its enterprise developer program.

The app allows its users — which the company claims it serves only law enforcement officers — to use their phone camera or upload a photo to search its database of 3 billion photos. But BuzzFeed News revealed that the company — which claims to only cater to law enforcement users — also includes many private-sector users, including Macy’s, Walmart and Wells Fargo.

Clearview AI has been at the middle of a media — and legal — storm since its public debut in The New York Times last month. The company scrapes public photos from social media sites, drawing ire from the big tech giants that claim Clearview AI misused their services. But it’s also gained attention from hackers. On Wednesday, Clearview AI confirmed a data breach in which its client list was stolen.

Source: Apple has blocked Clearview AI’s iPhone app for violating its rules | TechCrunch

Clearview AI, Creepy Facial Recognition Company That Stole Your Pictures from Social Media, Says Entire Client List Was Stolen by Hackers

Posted on by

A facial-recognition company that contracts with powerful law-enforcement agencies just reported that an intruder stole its entire client list, according to a notification the company sent to its customers.

In the notification, which The Daily Beast reviewed, the startup Clearview AI disclosed to its customers that an intruder “gained unauthorized access” to its list of customers, to the number of user accounts those customers had set up, and to the number of searches its customers have conducted. The notification said the company’s servers were not breached and that there was “no compromise of Clearview’s systems or network.” The company also said it fixed the vulnerability and that the intruder did not obtain any law-enforcement agencies’ search histories.

Source: Clearview AI, Facial Recognition Company That Works With Law Enforcement, Says Entire Client List Was Stolen

SpaceX’s Starship SN1 prototype appears to burst during pressure test

Posted on by

SpaceX’s new Starship prototype appeared to burst during a pressure test late Friday (Feb. 28), rupturing under the glare of flood lights and mist at the company’s south Texas facility.

The Starship SN1 prototype, which SpaceX moved to a launchpad near its Boca Chica, Texas, assembly site earlier this week, blew apart during a liquid nitrogen pressure test according to a video captured by SPadre.com.

A separate video posted by NASASpaceflight.com member BocaChicaGal clearly shows the Starship SN1’s midsection buckle during the test, then shoot upward before crashing back to the ground.

Source: SpaceX’s Starship SN1 prototype appears to burst during pressure test | Space

Not a good moment for Elon Musk

Two private satellites just docked in space in historic first for orbital servicing

Posted on by
In a historic first for satellite operations, a commercial spacecraft “helper” has docked with a working communications satellite to provide life-extension services.

The companies involved in the meetup  — Northrop Grumman and Intelsat — hailed the operation, which took place Tuesday (Feb. 25), as the beginning of a new era that will see robotic spacecraft giving new life to older satellites that are low on fuel or require repairs.

Because launch costs constitute a large part of a satellite’s total price tag, the hope is that refurbishing aging satellites will eventually reduce the expense of services that satellites provide, such as telecommunications or weather monitoring.

Video: Watch Northrop Grumman’s MEV-1 dock with Intelsat 901!

In a historic first, Northrop Grumman’s privately built MEV-1 satellite servicing spacecraft captures the Intelsat 901 communications satellite on Feb. 25, 2020. MEV-1’s grappler (right) latched on to Intelsat’s engine nozzle at center.

The docking occurred Tuesday at 2:15 a.m. EST (0715 GMT). On one side of the meeting was a spacecraft called Mission Extension Vehicle-1 (MEV-1), overseen by Northrop Grumman and its subsidiary SpaceLogistics LLC; on the other was a telecommunications satellite, Intelsat’s IS-901, Northrop Grumman said in a statement.

This maneuver took place about 180 miles (290 kilometers) above geosynchronous orbit, which is at an altitude of 22,236 miles (35,786 km). That’s roughly 90 times higher than the International Space Station.

Intelsat IS-901 is low on fuel and was removed from service in December 2019 to prepare for this operation, according to the statement. Controllers raised the satellite’s orbit and awaited MEV-1’s arrival. Now that the pair have docked, MEV-1 will perform checkouts of IS-901, then push the satellite back to its normal orbit in late March, according to Northrop Grumman.

Source: Two private satellites just docked in space in historic first for orbital servicing | Space

World Chess Champion Plays Recklessly Online Using a Pseudonym

Posted on by

World Chess Champion Magnus Carlsen has been sneaking onto online chess sites using stupid pseudonyms and taunting his opponents by using pointless maneuvers with names like “the Bongcloud.” One YouTube commenter calls it “a revolution in the history of chess.”

Slate documents the antics in an article titled “DrDrunkenstein’s Reign of Terror.” “DrDrunkenstein” is one of many aliases Magnus Carlsen has played under during the past two years, when he went on a killing spree across the speed chess tournaments of the internet. Since winter 2017, Carlsen has taken to livestreaming his games on a variety of platforms, which has provided a surprisingly entertaining window into the mind of an all-time great.

Lichess.org is a free, ad-less web platform for chess players, a favorite in the online chess community… Carlsen appeared incognito as “DannyTheDonkey” and won, donating his small prize money back to the website. Carlsen’s first showing as DrDrunkenstein was in Lichess’ second Titled Arena the following month… Carlsen streamed the games on Twitch, where he lived up to his username, pounding Coronas while bantering in Norwegian with his friends. Chess fans were astonished. There’s something hypnotizing about watching a guy known as “the Mozart of chess” — a player who is quantifiably better than Bobby Fischer — taking a big gulp of beer, announcing his position as “completely winning,” then singing along to Dr. Dre saying “motherfuck the police” while coasting into another quick checkmate…

In an interview with a Norwegian newspaper in October, Carlsen admits he quit drinking for his health. “I wouldn’t say I was an alcoholic exactly,” he said, “but I found out this year, if I’m going to travel and play a lot… I need to prioritize differently….” On the eve of his world championship defense, Carlsen appeared in the next tournament as “manwithavan,” playing a large chunk of his games on a phone from a minivan, where the touch screen presented a massive handicap. He again earned the adoration of spectators, this time for riskily walking his king into the center of the board against one of the most dangerous players in the tournament. He came in third… As DrNykterstein, he alternated between two ways of wasting his early, important opening moves. Sometimes, he’d take his queen on a four-move tour of the board before swapping her home square with the king’s, letting his opponent develop their pieces while he showboated… Other times, he’d fidget his knights back and forth from their starting squares, offering his challenger a six-move time advantage. In this tournament he filled with gags, he came in first again…

One of the sweetest benefits of watching these matches is enjoying Carlsen’s dry, self-deprecating sense of humor — something no chess prodigy has any right to have.
In December, Magnus also reached the #1 spot, beating seven million other players, on a fantasy football table.

Source: World Chess Champion Plays Recklessly Online Using a Pseudonym – Slashdot

Your car records a lot of things you don’t know about – including you.

Posted on by

Tesla chief executive Elon Musk calls this function Sentry Mode. I also call it Chaperone Mode and Snitch Mode. I’ve been writing recently about how we don’t drive cars, we drive computers. But this experience opened my eyes.

I love that my car recorded a hit-and-run on my behalf. Yet I’m scared we’re not ready for the ways cameras pointed inside and outside vehicles will change the open road — just like the cameras we’re adding to doorbells are changing our neighborhoods.

It’s not just crashes that will be different. Once governments, companies and parents get their hands on car video, it could become evidence, an insurance liability and even a form of control. Just imagine how it will change teenage romance. It could be the end of the idea that cars are private spaces to peace out and get away — an American symbol of independence.

“You are not alone in your car anymore,” says Andrew Guthrie Ferguson, a visiting professor at the American University Washington College of Law and the author of “The Rise of Big Data Policing.”

The moment my car was struck, it sent an alert to my phone and the car speakers began blaring ghoulish classical music, a touch of Musk’s famous bravado. The car saved four videos of the incident, each from a different angle, to a memory stick I installed near the cup holder. (Sentry Mode is an opt-in feature.) You can watch my car lurch when the bus strikes it, spot the ID number on the bus and see its driver’s face passing by moments before.

This isn’t just a Tesla phenomenon. Since 2016, some Cadillacs have let you store recordings from four outward-facing cameras, both as the car is moving and when it’s parked. Chevrolet offers a so-called Valet Mode to record potentially naughty parking attendants. Sold with Corvettes, they call this camera feature a “baby monitor for your baby.”

Now there are even face-monitoring cameras in certain General Motors, BMW and Volvo vehicles to make sure you’re not drowsy, drunk or distracted. Most keep a running log of where you’re looking.

Your older car’s camera may not be saving hours of footage, but chances are it keeps at least a few seconds of camera, speed, steering and other data on a hidden “black box” that activates in a crash. And I’m pretty sure your next car would make even 007 jealous; I’ve already seen automakers brag about adding 16 cameras and sensors to 2020 models.

The benefits of this technology are clear. The video clips from my car made a pretty compelling case for the city to pay for my repairs without even getting my insurance involved. Lots of Tesla owners proudly share crazy footage on YouTube. It’s been successfully used to put criminals behind bars.

But it’s not just the bad guys my car records. I’ve got clips of countless people’s behinds scooching by in tight parking lots, because Sentry Mode activates any time something gets close. It’s also recording my family: With another function called Dash Cam that records the road, Tesla has saved hours and hours of my travels — the good driving and the not-so-good alike.

We’ve been down this road before with connected cameras. Amazon’s Ring doorbells and Nest cams also seemed like a good idea, until hackers, stalkers and police tried to get their hands on the video feed. (Amazon founder and chief executive Jeff Bezos owns The Washington Post.) Applied to a car, the questions multiply: Can you just peer in on your teen driver — or spouse? Do I have to share my footage with the authorities? Should my car be allowed to kick me off the road if it thinks I’m sleepy? How long until insurance companies offer “discounts” for direct video access? And is any of this actually making cars safer or less expensive to own?

Your data can and will be used against you. Can we do anything to make our cars remain private spaces?

[…]

design choices may well determine our future privacy. It’s important to remember: Automakers can change how their cameras work with as little as a software update. Sentry mode arrived out of thin air last year on cars made as early as 2017.

We can learn from smart doorbells and home security devices where surveillance goes wrong.

The problems start with what gets recorded. Home security cameras have so normalized surveillance that they let people watch and listen in on family and neighbors. Today, Tesla’s Sentry Mode and Dash Cam only record video, not audio. The cars have microphones inside, but right now they seem to just be used for voice commands and other car functions — avoiding eavesdropping on potentially intimate car conversations.

Tesla also hasn’t activated a potentially invasive source of video: a camera pointed inside the car, right next to the rear view mirror. But, again, it’s not entirely clear why. CEO Musk tweeted it’s there to be used as part of a future ride-sharing program, implying it’s not used in other ways. Already some Tesla owners are champing at the bit to have it activated for Sentry Mode to see, for example, what a burglar is stealing. I could imagine others demanding live access for a “teen driving” mode.

(Tesla has shied away from perhaps the most sensible use for that inner camera: activating it to monitor whether drivers are paying attention while using its Autopilot driver assistance system, something GM does with its so-called SuperCruise system.)

In other ways, Tesla is already recording gobs. Living in a dense city, my Sentry Mode starts recording between five and seven times per day — capturing lots of people, the vast majority of whom are not committing any crime. (This actually drains the car’s precious battery; some owners estimate it sips about a mile’s worth of the car’s 322 mile potential range for every hour it runs.) Same with the Dash Cam that runs while I’m on the road: it’s recording not just my driving but all the other cars and people on the road, too.

The recordings stick around on a memory card until you delete them or the card fills up, and it writes over the old footage.

[…]

Chevrolet potentially ran afoul of eavesdropping laws when it debuted Valet Mode in 2015, because it was recording audio inside the cabin of the car without disclosure. (Now they’ve cut the audio and added a warning message to the infotainment system.) When it’s on, Tesla’s Sentry Mode activates a warning sign on its large dashboard screen with a pulsing version of the red circle some might remember from the evil HAL-9000 computer in “2001: A Space Odyssey.”

My biggest concern is who can access all that video footage. Connected security cameras let anybody with your password peer in from afar, through an app or the Web.

[…]

Teslas, like most new cars, come with their own independent cellular connections. And Tesla, by default, uploads clips from its customer cars’ external cameras. A privacy control in the car menus says Tesla uses the footage “to learn how to recognize things like lane lines, street signs and traffic light positions.”

[…]

Video from security cameras is already routine in criminal prosecutions. In the case of Ring cameras, the police can make a request of a homeowner, who is free to say no. But courts have also issued warrants to Amazon to hand over the video data it stores on its computers, and it had to comply.

It’s an open question whether police could just seize the video recordings saved on a drive in your car, says Ferguson, the law professor.

“They could probably go through a judge and get a probable cause warrant, if they believe there was a crime,” he says. “It’s a barrier, but is not that high of a barrier. Your car is going to snitch on you.”

Source: My car was in a hit-and-run. Then I learned it recorded the whole thing.

Some Farmers are Harvesting Metals From Plants

Posted on by

Some of Earth’s plants have fallen in love with metal. With roots that act practically like magnets, these organisms — about 700 are known — flourish in metal-rich soils that make hundreds of thousands of other plant species flee or die….

The plants not only collect the soil’s minerals into their bodies but seem to hoard them to “ridiculous” levels, said Alan Baker, a visiting botany professor at the University of Melbourne who has researched the relationship between plants and their soils since the 1970s. This vegetation could be the world’s most efficient, solar-powered mineral smelters. What if, as a partial substitute to traditional, energy-intensive and environmentally costly mining and smelting, the world harvested nickel plants…?

On a plot of land rented from a rural village on the Malaysian side of the island of Borneo, Dr. Baker and an international team of colleagues have proved it at small scale. Every six to 12 months, a farmer shaves off one foot of growth from these nickel-hyper-accumulating plants and either burns or squeezes the metal out. After a short purification, farmers could hold in their hands roughly 500 pounds of nickel citrate, potentially worth thousands of dollars on international markets. Now, as the team scales up to the world’s largest trial at nearly 50 acres, their target audience is industry. In a decade, the researchers hope that a sizable portion of insatiable consumer demand for base metals and rare minerals could be filled by the same kind of farming that produces the world’s coconuts and coffee… [T]he technology has the additional value of enabling areas with toxic soils to be made productive…

Now, after decades behind the lock and key of patents, Dr. Baker said, “the brakes are off the system.”
Long-time Slashdot reader necro81 adds “This process, called phytomining, cannot supplant the scale of traditional mining, but could make a dent in the world’s demand for nickel, cobalt, and zinc.

Source: Some Clever Farmers are Harvesting Metals From Plants – Slashdot

Powerful antibiotic discovered using machine learning for first time

Posted on by

A powerful antibiotic that kills some of the most dangerous drug-resistant bacteria in the world has been discovered using artificial intelligence.

The drug works in a different way to existing antibacterials and is the first of its kind to be found by setting AI loose on vast digital libraries of pharmaceutical compounds.

[…]

“I think this is one of the more powerful antibiotics that has been discovered to date,” added James Collins, a bioengineer on the team at MIT. “It has remarkable activity against a broad range of antibiotic-resistant pathogens.”

[…]

To find new antibiotics, the researchers first trained a “deep learning” algorithm to identify the sorts of molecules that kill bacteria. To do this, they fed the program information on the atomic and molecular features of nearly 2,500 drugs and natural compounds, and how well or not the substance blocked the growth of the bug E coli.

Once the algorithm had learned what molecular features made for good antibiotics, the scientists set it working on a library of more than 6,000 compounds under investigation for treating various human diseases. Rather than looking for any potential antimicrobials, the algorithm focused on compounds that looked effective but unlike existing antibiotics. This boosted the chances that the drugs would work in radical new ways that bugs had yet to develop resistance to.

Jonathan Stokes, the first author of the study, said it took a matter of hours for the algorithm to assess the compounds and come up with some promising antibiotics. One, which the researchers named “halicin” after Hal, the astronaut-bothering AI in the film 2001: A Space Odyssey, looked particularly potent.

Writing in the journal Cell, the researchers describe how they treated numerous drug-resistant infections with halicin, a compound that was originally developed to treat diabetes, but which fell by the wayside before it reached the clinic.

Tests on bacteria collected from patients showed that halicin killed Mycobacterium tuberculosis, the bug that causes TB, and strains of Enterobacteriaceae that are resistant to carbapenems, a group of antibiotics that are considered the last resort for such infections. Halicin also cleared C difficile and multidrug-resistant Acinetobacter baumannii infections in mice.

To hunt for more new drugs, the team next turned to a massive digital database of about 1.5bn compounds. They set the algorithm working on 107m of these. Three days later, the program returned a shortlist of 23 potential antibiotics, of which two appear to be particularly potent. The scientists now intend to search more of the database.

Stokes said it would have been impossible to screen all 107m compounds by the conventional route of obtaining or making the substances and then testing them in the lab. “Being able to perform these experiments in the computer dramatically reduces the time and cost to look at these compounds,” he said.

Barzilay now wants to use the algorithm to find antibiotics that are more selective in the bacteria they kill. This would mean that taking the antibiotic kills only the bugs causing an infection, and not all the healthy bacteria that live in the gut. More ambitiously, the scientists aim to use the algorithm to design potent new antibiotics from scratch.

Source: Powerful antibiotic discovered using machine learning for first time | Society | The Guardian

People Are Killing Puppy Clones That Don’t Come Out ‘Perfect’ – wait you can clone your puppy?!

Posted on by

This is a hugely holier than thou article written by a strident anti-abortionist, but it’s quite interesting in that a) you can clone your puppy commercially and b) it’s absolutely not a perfected science.

You have five days after your pet dies to extract its genetic material for cloning, according to the Seoul-based Sooam Biotech Research Foundation, which offers dog and cat cloning services. The company recommends wrapping the deceased in wet blankets and throwing them into the fridge before you send the package. From there, scientists will harvest tissue and eggs, usually from slaughterhouses, then transfer them into surrogate mothers via in vitro fertilization.

It can take dozens of artificial inseminations into a mother animal’s womb to get a single egg to gestation. When that mother finally does give birth — there are scores of these surrogate mothers whose only job is to be filled with needles until they conceive, and then do it again — what’s born might be a genetic copy of the original, but it isn’t a perfect copy.

When I picked up Onruang’s pups and examined them head to hock — they weighed maybe three pounds a piece — I saw surprising amounts of subtle variations in markings and size.

[…]

When an animal is cloned, the donor — the mother carrying the clone — contributes extremely low levels of mitochondrial DNA. “That’s the variation which can account for differing color patterns and other unknowns,” says Doug Antczak, a veterinary scientist at Cornell University who specializes in horse genetics.

What’s eventually passed to the cloned pet buyer is a reasonable facsimile, something good enough to the naked eye that they’ll say: “That’s my dog!” And here’s where the scale of this production might — or should — give pause.

Many clones are born with defects and genetic disorders, and since those imperfections aren’t what their buyer is spending tens of thousands of dollars on, they end up discarded.

[…]

if that cloned dog does make it through the gauntlet — but is missing the spot over its eye that a deceased pet had, for instance — it still faces a swift death via euthanasia, just another pile of genetic material to harvest.

“There’s too many mistakes, too many stillbirths, deformities, and mutations,” warns Chris Cauble, a Glendale, California, veterinarian whose mobile service offers tissue collection for cloning pets.

Source: People Are Killing Puppy Clones That Don’t Come Out ‘Perfect’

All that Samsung users found on UK website after weird Find my Mobile push notification was… other people’s details

Posted on by

In the early hours of this morning, a very large number of Samsung devices around the world received a push notification from the vendor’s Find my Mobile app. That notification simply read “1/1”.

[…]

A handful of Reg staffers also received the notification, which caused surprise and concern at Vulture Central – not least because Find my Mobile is disabled on two of those devices.

A pre-installed default Samsung OEM app regarded by some as bloatware, Find my Mobile cannot be fully uninstalled if you don’t plan to format the entire phone with a new third-party ROM – which is a profoundly technical process, and, with modern Samsung devices, requires the user to unlock the bootloader.

[…]

Ominously, some Register readers who received the unwanted notification immediately assumed the worst and went into their accounts to change their Samsung passwords only to be confronted by other people’s personal data on the Samsung UK website.

One told us that after seeing other people’s names, addresses and phone numbers displayed in his Samsung Account after logging in using his own details, he phoned the Samsung helpdesk. Our reader said: “When I explained to [the call centre worker] what I saw, he said, ‘Yes, we’ve had a few reports of that this morning’.”

Mark showed us screenshots he had taken, showing himself logged in and someone else’s details being displayed as if they were associated with his account.

Source: All that Samsung users found on UK website after weird Find my Mobile push notification was… other people’s details • The Register

Details of 10.6 million Vegas MGM hotel guests posted on a hacking forum

Posted on by

The personal details of more than 10.6 million users who stayed at MGM Resorts hotels have been published on a hacking forum this week.

Besides details for regular tourists and travelers, included in the leaked files are also personal and contact details for celebrities, tech CEOs, reporters, government officials, and employees at some of the world’s largest tech companies.

ZDNet verified the authenticity of the data today, together with a security researcher from Under the Breach, a soon-to-be-launched data breach monitoring service.

A spokesperson for MGM Resorts confirmed the incident via email.

What was exposed

According to our analysis, the MGM data dump that was shared today contains personal details for 10,683,188 former hotel guests.

Included in the leaked files are personal details such as full names, home addresses, phone numbers, emails, and dates of birth.

Source: Exclusive: Details of 10.6 million MGM hotel guests posted on a hacking forum | ZDNet

Google users in UK to lose EU data protection, get US non-protection

Posted on by

The shift, prompted by Britain’s exit from the EU, will leave the sensitive personal information of tens of millions with less protection and within easier reach of British law enforcement.

The change was described to Reuters by three people familiar with its plans. Google intends to require its British users to acknowledge new terms of service including the new jurisdiction.

Ireland, where Google and other U.S. tech companies have their European headquarters, is staying in the EU, which has one of the world’s most aggressive data protection rules, the General Data Protection Regulation.

Google has decided to move its British users out of Irish jurisdiction because it is unclear whether Britain will follow GDPR or adopt other rules that could affect the handling of user data, the people said.

If British Google users have their data kept in Ireland, it would be more difficult for British authorities to recover it in criminal investigations.

The recent Cloud Act in the United States, however, is expected to make it easier for British authorities to obtain data from U.S. companies. Britain and the United States are also on track to negotiate a broader trade agreement.

Beyond that, the United States has among the weakest privacy protections of any major economy, with no broad law despite years of advocacy by consumer protection groups.

A Google spokesman declined to comment ahead of a public announcement.

Source: Exclusive: Google users in UK to lose EU data protection – sources – Reuters

Firm Tracking Purchase, Transaction Histories of Millions Not Really Anonymizing Them

Posted on by

The nation’s largest financial data broker, Yodlee, holds extensive and supposedly anonymized banking and credit card transaction histories on millions of Americans. Internal documents obtained by Motherboard, however, appear to indicate that Yodlee clients could potentially de-anonymize those records by simply downloading a giant text file and poking around in it for a while.

According to Motherboard, the 2019 document explains how Yodlee obtains transaction data from partners like banks and credit card companies and what data is collected. That includes a unique identifier associated with the bank or credit card holder, amounts of transactions, dates of sale, which business the transaction was processed at, and bits of metadata, Motherboard wrote; it also includes data relating to purchases involving multiple retailers, such as a restaurant order through a delivery app. The document states that Yodlee is giving clients access to this data in the form of a large text file rather than a Yodlee-run interface.

The document also shows how Yodlee performs “data cleaning” on that text file, which means obfuscating patterns like “account numbers, phone numbers, and SSNs by redacting them with the letters “XXX,” Motherboard wrote. It also scrubs some payroll and financial transfer data, as well as the names of the banking and credit card companies involved.

But this process leaves the unique identifiers, which are shared across each entry associated with a particular account, intact. Research has repeatedly shown that taking supposedly anonymized data and reverse-engineering it to identify individuals within can be a trivial undertaking, even when no information is shared across records.

Experts told Motherboard that anyone with malicious intent would just need to verify a purchase was made by a specific individual and they might gain access to all other transactions using the same identifier.

With location and time data on just three to four purchases, an “attacker can unmask the person with a very high probability,” Rutgers University associate professor Vivek Singh told the site. “With this unmasking, the attacker would have access to all the other transactions made by that individual.”

Imperial College of London assistant professor Yves-Alexandre de Montjoye, who worked with Singh on a 2015 study that identified shoppers from metadata, wrote to Motherboard this process appeared to leave the data only “pseudonymized” and that “someone with access to the dataset and some information about you, e.g. shops you’ve been buying from and when, might be able to identify you.”

Yodlee and its owner, Envestnet, is facing serious heat from Congress. Democratic Senators Ron Wyden and Sherrod Brown, as well as Representative Anna Eshoo, recently sent a letter to the Federal Trade Commission asking for it to investigate whether the sale of this kind of financial data violates federal law.

“Envestnet claims that consumers’ privacy is protected because it anonymizes their personal financial data,” the congresspeople wrote. “But for years researchers have been able to re-identify the individuals to whom the purportedly anonymized data belongs with just three or four pieces of information.”

Source: Report: Firm Tracking Purchase, Transaction Histories of Millions Maybe Not Really Anonymizing Them

It’s very hard to get anonymity right.

Forcing us to get consent before selling browser histories violates our free speech, US ISPs claim

Posted on by

The US state of Maine is violating internet broadband providers’ free speech by forcing them to ask for their customers’ permission to sell their browser history, according to a new lawsuit.

The case was brought this month by four telco industry groups in response to a new state-level law aimed at providing Maine residents with privacy protections killed at the federal level by the FCC just days before they were due to take effect.

ACA Connects, CTIA, NCTA and USTelecom are collectively suing [PDF] Maine’s attorney general Aaron Frey, and the chair and commissioners of Maine’s Public Utilities Commission claiming that the statute, passed in June 2019, “imposes unprecedented and unduly burdensome restrictions on ISPs’, and only ISPs’, protected speech.”

How so? Because it includes “restrictions on how ISPs communicate with their own customers that are not remotely tailored to protecting consumer privacy.” The lawsuit even explains that there is a “proper way to protect consumer privacy” – and that’s the way the FCC does it, through “technology-neutral, uniform regulation.” Although that regulation is actually the lack of regulation.

If you’re still having a hard time understanding how requiring companies to get their customers’ permission before they sell their personal data infringes the First Amendment, the lawsuit has more details.

It “(1) requires ISPs to secure ‘opt-in’ consent from their customers before using information that is not sensitive in nature or even personally identifying; (2) imposes an opt-out consent obligation on using data that are by definition not customer personal information; (3) limits ISPs from advertising or marketing non-communications-related services to their customers; and (4) prohibits ISPs from offering price discounts, rewards in loyalty programs, or other cost saving benefits in exchange for a customer’s consent to use their personal information.”

All of this results in an “excessive burden” on ISPs, they claim, especially because not everyone else had to do the same. The new statute includes “no restrictions at all on the use, disclosure, or sale of customer personal information, whether sensitive or not, by the many other entities in the Internet ecosystem or traditional brick-and-mortar retailers,” the lawsuit complains.

Discrimination!

This is discrimination, they argue. “Maine cannot discriminate against a subset of companies that collect and use consumer data by attempting to regulate just that subset and not others, especially given the absence of any legislative findings or other evidentiary support that would justify targeting ISPs alone.”

We’ll leave the idea that customers are suffering by not receiving marketing materials from companies that ISPs sell their data to alone for now and focus on the core issue: that if Google and Facebook are allowed to sell their users’ personal data then ISPs feel they should be allowed to as well.

Which is a fair point, although profoundly depressing in a broader context. The basic argument appears to be that we should only provide the minimum protections that are available. Nothing above minimum is legal.

If you look at what the statute actually does, it was clearly written in users’ own interests. It prevents companies from refusing to serve customers that do not agree to allow it to collect and sell their personal data and it requires ISPs to take “reasonable measures” to protect that data. Those companies are still allowed to use the data to market their own products; just not to sell it to others to sell theirs.

But because the ISPs successfully managed to get the FCC to kill off its own rules on similar protections, it argues that the scrapping of rules is the legal precedent here. “The Statute is preempted by federal law because it directly conflicts with and deliberately thwarts federal determinations about the proper way to protect consumer privacy,” the lawsuit argues.

The solution of course is federal privacy protections. But despite overwhelming public support for just such a law, the same ISPs and telcos fighting this law in Maine, have flooded Washington DC with lobbying money and campaign contributions to make sure that it doesn’t progress through Congress. And if this Maine challenge is successful, next in the ISPs’ sites will be California’s new privacy laws.

Source: Forcing us to get consent before selling browser histories violates our free speech, US ISPs claim • The Register

A new use for McDonald’s used cooking oil: 3D printing

Posted on by
Simpson had bought a 3D printer for the lab in 2017. He hoped to use it to build custom parts that kept organisms alive inside of the NMR spectrometer for his research.
But the commercial resin he needed for high-quality light projection 3D printing (where light is used to form a solid) of those parts was expensive.
This could be America’s smallest restaurant
The dominant material for light projection printing is liquid plastic, which can cost upward of $500 a liter, according to Simpson.
Simpson closely analyzed the resin and spotted a connection. The molecules making up the commercial plastic resin were similar to fats found in ordinary cooking oil.
“The thought came to us. Could we use cooking oil and turn it into resin for 3D printing?” Simpson said.

Only one restaurant responded — McDonald’s

What came next was the hardest part of the two-year experiment for Simpson and his team of 10 students — getting a large sample batch of used cooking oil.
“We reached out to all of the fast-food restaurants around us. They all said no,” said Simpson.
Except for McDonald’s (MCD).
In the summer of 2017, the students went to a McDonald’s location near the campus in Toronto, Ontario, that had agreed to give them 10 liters of waste oil.

Back in the lab, the oil was filtered to take out chunks of food particles.
[…]
The team successfully printed a high-quality butterfly with details as minute as 100 micrometers in size.
A 3D printed butterbly made from McDonald's waste cooking oil.

A 3D printed butterbly made from McDonald’s waste cooking oil.
“We did analysis on the butterfly. It felt rubbery to touch, with a waxy surface that repelled water,” said Simpson. He described the butterfly as “structurally stable.” It didn’t break apart and held up at room temperature. “We thought you could possibly 3D print anything you like with the oil,” he said.
The experiment yielded a commercially viable resin that Simpson estimates could be sourced as cheaply as 30 cents a liter of waste oil.
Simpson was equally excited about another benefit of the butterfly the team had created.”The butterfly is essentially made from fat, which means it is biodegradable,” he said.
To test this, he buried a sample butterfly in soil and found that 20% of it disappeared in a two-week period.
“The concept of sustainability has been underplayed in 3D printing,” said Tim Greene, a research director for global research firm IDC who specializes in the 3D printing market. “The melted plastic currently being used as resin is not so great for the environment.”

Source: A new use for McDonald’s used cooking oil: 3D printing – CNN

Vodafone: Yes, we slurp data on customers’ network setups, but we do it for their own good. No, you can’t opt out.

Posted on by

Seeking to improve its pisspoor customer service rating, UK telecoms giant Vodafone has clarified just how much information it slurps from customer networks. You might want to rename those servers, m’kay?

The updates are rather extensive and were noted by customers after a headsup-type email arrived from the telco.

One offending paragraph gives Vodafone an awful lot of information about what a customer might be running on their own network:

For providing end user support and optimizing your WiFi experience we are collecting information about connected devices (MAC address, Serial Number, user given host names and WiFi connection quality) as well as information about the the WiFi networks (MAC addresses and identifiers, radio statistics).

More accurately, it gives a third party that information. Airties A.S. is the company responsible for hosting information that Vodafone’s support drones might use for diagnostics.

With Vodafone topping the broadband and landline complaint tables, according to the most recent Ofcom data (PDF), the company would naturally want to increase the chances of successfully resolving a customer’s problem. However, there is no way to opt out.

Source: Vodafone: Yes, we slurp data on customers’ network setups, but we do it for their own good • The Register