Avast’s and AVG AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping

Web researcher David Eade found and reported CVE-2020-8987 to Avast: this is a trio of blunders that, when combined, can be exploited by a snooper to silently intercept and tamper with an AntiTrack user’s connections to even the most heavily secured websites.

This is because when using AntiTrack, your web connections are routed through the proxy software so that it can strip out tracking cookies and similar stuff, enhancing your privacy. However, when AntiTack connects to websites on your behalf, it does not verify it’s actually talking to the legit sites. Thus, a miscreant-in-the-middle, between AntiTrack and the website you wish to visit, can redirect your webpage requests to a malicious server that masquerades as the real deal, and harvest your logins or otherwise snoop on you, and you’d never know.

The flaws affect both the Avast and AVG versions of AntiTrack, and punters are advised to update their software as a fix for both tools has been released.

Eade has been tracking the bug since August last year.

“The consequences are hard to overstate. A remote attacker running a malicious proxy could capture their victim’s HTTPS traffic and record credentials for later re-use,” he said. “If a site needs two factor authentication (such as a one-time password), then the attacker can still hijack a live session by cloning session cookies after the victim logs in.”

Source: Avast’s AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping • The Register

FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more

In fact, the marketing database also contained some subscribers’ requests to block or unblock access to X-rated and gambling websites, unique ID numbers of stolen cellphones, and records of whichever site they were visiting before arriving at the Virgin Media website.

This is according to British infosec shop Turgensec, which discovered the poorly secured Virgin Media info silo and privately reported it to the broadband-and-TV-and-phone provider. The research team today said the extent of the data spill was more extensive, and personal, than Virgin Media’s official disclosure seemed to suggest.

Here, in full, is what Turgensec said it found in the data cache that was exposed from mid-April to this month:

* Full names, addresses, date of birth, phone numbers, alternative contact phone numbers and IP addresses – corresponding to both customers and “friends” referred to the service by customers.

* Requests to block or unblock various pornographic, gore related and gambling websites, corresponding to full names and addresses. IMEI numbers associated with stolen phones.

* Subscriptions to the different aspects of their services, including premium components.

* The device type owned by the user, where relevant.

* The “Referrer” header taken seemingly from a users browser, containing what would appear to be the previous website that the user visited before accessing Virgin Media.

* Form submissions by users from their website.

Those website block and unblock requests were a result of Britain’s ruling class pressuring ISPs to implement filters to prevent kids viewing adult-only material via their parents’ home internet connections. The filters were also supposed to stop Brits from seeing any particularly nasty unlawful content.

Virgin Media today stressed the database held about a thousand subscribers’ filter request inquiries.

Source: FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more • The Register

NASA declares Starliner mishap a “high visibility close call”

After pondering the totality of issues that arose during a December test flight of Boeing’s Starliner spacecraft this week, NASA chief of human spaceflight Doug Loverro said Friday that he decided to escalate the incident.

So he designated Starliner’s uncrewed mission, during which the spacecraft flew a shortened profile and did not attempt to dock with the International Space Station, as a “high visibility close call.” This relatively rare designation for NASA’s human spaceflight program falls short of “loss of mission” but is nonetheless fairly rare. It was last used by NASA after a spacewalk in 2013 when water began to dangerously pool in the helmet of astronaut Luca Parmitano.

Asked to explain during a conference call with reporters why he did this, Loverro said, “We could have lost a spacecraft twice during this mission.”

In this, Loverro referred to two software errors that occurred during the two-day flight. The first problem occurred when Starliner captured the wrong “mission elapsed time” from its Atlas V launch vehicle—it was supposed to pick up this time during the terminal phase of the countdown, but instead it grabbed data 11 hours off of the correct time. This led to a delayed push to reach orbit. The second error, caught and fixed just a few hours before the vehicle returned to Earth through the atmosphere, was due to a software mapping error that would have caused thrusters on Starliner’s service module to fire in the wrong manner.

NASA and Boeing officials held Friday’s teleconference to announce the conclusion of a report from an Independent Review Team established after December’s flight. These reviewers made 60 recommendations to NASA and Boeing for corrective actions that ranged from fixing these software issues to ferreting out others that may still exist in the spacecraft’s flight code. The investigative team is also still looking into an issue that led to multiple dropouts in communications between the ground and spacecraft during key moments of the flight.

Corrective action plan

By declaring the Starliner mishap a “close call,” Loverro also formally opened a process during which the space agency’s Safety Office will investigate the organization elements that may have led to the incident—likely focusing on why NASA did not detect the errors in Starliner’s flight software.

Loverro said no decisions are close to being made on when Starliner will return to flight or whether Boeing will have to fly another uncrewed demonstration test flight before NASA astronauts fly on Starliner. The next step, he said, is for Boeing to prepare a “corrective action plan” to implement the review team’s findings, and that will include a schedule. NASA will evaluate that plan and then it may be in a position to decide whether another test flight is needed.

Source: NASA declares Starliner mishap a “high visibility close call” | Ars Technica

The Truth About Bioplastic

Bioplastics date back more than 160 years, but they’ve seen a surge in interest and production in the past few decades. In 2018, the world produced 2.6 million tons of bioplastic, according to data from the Institute for Bioplastics and Biocomposites (IFBB). That’s a fraction of the 300 million tons of plastic produced, but IFBB also projects bioplastic production could grow 65 percent by 2023.

More bioplastic isn’t inherently bad. Done right, it could reduce plastic carbon emissions by up to 3.8 gigatons by 2050. But the done right part is the key, and so far, the world has shown little propensity to do that.

Bioplastic actually breaks into two categories: plastics made from plants and algae and plastic that biodegrades over time. The companies producing each of these types of plastic have in some ways banked on the hazy label bioplastic to make their plastic seem more environmentally friendly than regular old plastic made from oil.

“It has been controlled as a marketing arm, not a science one,” Taylor Weiss, an engineering working on algae-based plastics at the Arizona State University, told Earther. “Companies who say ‘this is biodegradable,’ just because it’s possible, it’s not likely.”

The most common form of bioplastic is PLA, a hard plastic that can replace the bottle, cups, and other vessels. It’s biodegradable and companies that sell PLA products often play that up from their names like Planet+ and Repurpose to their green branding. But what the companies don’t advertise as clearly is that while these cups are compostable, they need to go to the proper facilities.

“PLA is biodegradable but it’s biodegradable like wood,” Weiss said. “It will degrade over time but you’ll need industrial facilities.”

Flicking one into your recycling bin won’t get it there. Instead, it “can contaminate and disrupt the recycling stream if intermixed with petroleum-based plastics that are non-compostable,” according to the Environmental Protection Agency. And most municipalities simply don’t have a a curbside compostable plastic pickup. That means your compostable cup will usually end up in a landfill.

In fact, most of your recycling increasingly ends up in landfills owing to the fact that China banned many recyclable items it used to import and U.S. facilities don’t have the capacity to handle that. Once in a landfill, the PLA will breakdown, but like the plants it came from, it will emit greenhouse gases.

“If it’s a section of landfill with open recycling pits, it’s eventually going to become carbon dioxide [as it biodegrades],” Weiss said. “At worst, it could become methane, which is extremely more potent.”

Unlike plants, any benefits from its breakdown will not go back into the soil. Instead, its remnants will fester in a huge pile of garbage. Not exactly regenerative!

In addition, PLA is much like biofuels that can displace food production. The world population is projected to balloon to 9 billion by midcentury, and research has shown we’re going to need all the land we can get.

The algae- and bacteria-based bioplastics known as PHA offer a more effective avenue to reducing the forever-impacts of plastic, getting us closer to a circular economy. But it’s still more expensive to make that type of bioplastic and like PLA they require proper sorting and recycling.

There are a few fixes in the interim like improved bioplastic labeling that makes clear how likely it is to be composted, akin a program in the UK for regular plastics. The industry itself could also be better-regulated and municipalities could do a better job educating residents about what to do with bioplastics in the first place. And perhaps the best fix is to cut down on plastic use, bio-based or otherwise, all together.

“It’s this great big global complicated problem,” Weiss said. “People should be aware there are no silver bullets, there’s a quiver full of arrows.”

Source: The Truth About Bioplastic

Open Source Small Nuclear Reactors Designs

What would happen if everyone in the world had access to nuclear reactor blueprints? We’re about to find out. A mechanical engineer-turned-tech entrepreneur has plans to, well, empower people around the world to build their own 100-megawatt nuclear power reactors. That’s much larger than some of the modular reactors designed by nuclear startups, but still much smaller than operating nuclear power plants in the U.S.

The Energy Impact Center (EIC) is an energy nonprofit that engineer Bret Kugelmass founded in 2017. The organization’s goals are similar to other groups working toward carbon neutrality or negativity, except Kugelmass has decided “cheap nuclear” is the only avenue he wants to pursue. By doing that, he’s essentially operating a startup model, and for his technology to take hold, a new paradigm for nuclear power plants will have to be installed.

“Today, we offer reference plant schematics and a platform to compile ongoing design work. With the help of our partners and the National Labs, these drawings will evolve into a fully detailed, ready-to-build blueprint,” the project website says. It seems like EIC exists to feed new technology into the nuclear startup development pipeline, with the lampshade that nuclear is considered a cleaner power source in the carbon interregnum.

The details of Kugelmass’s plants are exciting. “This standardized pressurized water reactor (PWR) power plant is sized at 100MWe output to fit within project finance and timetable constraints,” he writes. “It is detailed enough for any utility to begin early site studies with +/- 20 [percent] cost predictability. It is abstract enough to allow for site-specific engineering details to be added, with a 50M dollar budget allocated per plant for such efforts.”

Source: Small Nuclear Reactors | Nuclear Reactor Types and Designs

Utah has given all its camera feeds to an AI, turning it Into a Surveillance Panopticon

The state of Utah has given an artificial intelligence company real-time access to state traffic cameras, CCTV and “public safety” cameras, 911 emergency systems, location data for state-owned vehicles, and other sensitive data.

The company, called Banjo, says that it’s combining this data with information collected from social media, satellites, and other apps, and claims its algorithms “detect anomalies” in the real world.

The lofty goal of Banjo’s system is to alert law enforcement of crimes as they happen. It claims it does this while somehow stripping all personal data from the system, allowing it to help cops without putting anyone’s privacy at risk. As with other algorithmic crime systems, there is little public oversight or information about how, exactly, the system determines what is worth alerting cops to.

Source: This Small Company Is Turning Utah Into a Surveillance Panopticon – VICE

Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Clearview AI worked to build a national database of every mug shot taken in the United States during the past 15 years, according to an email obtained by OneZero through a public records request.

The email, sent by a representative for Clearview AI in August 2019, was in response to an inquiry from the Green Bay Police Department in Wisconsin, which had asked if there was a way to upload its own mug shots to Clearview AI’s app.

“We are… working to acquire all U.S. mugshots nationally from the last 15 years, so once we have that integrated in a few months’ time it might just be superfluous anyway,” wrote the Clearview AI employee, whose name was redacted.

Clearview AI is best known for scraping the public internet, including social media, for billions of images to power its facial recognition app, which was first reported on by the New York Times. Some of those images are pulled from online repositories of mug shots, like Rapsheets.org and Arrests.org, according to other emails obtained by OneZero. Acquiring a national mug shot database would make Clearview AI an even more powerful tool for police departments, which would be able to easily match a photograph of an individual against their criminal history.

Clearview AI did not immediately respond to a request for comment from OneZero. It is unclear whether the company ultimately succeeded in acquiring such a database.

Source: Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Clearview AI Let Celebs, Investors Use Facial Recognition App for fun

Creepy facial recognition firm Clearview AI—which claims to have built an extensive database from billions of photos scraped from the public web—allowed the rich and powerful to use its app as a personal plaything and spy tool, according to reporting from the New York Times on Thursday.

Clearview and its founder, Hoan Ton-That, claim that the database is only supposed to be used by law enforcement and “select security professionals” in the course of investigations. Prior reports from the Times revealed that hundreds of law enforcement agencies, including the Department of Justice and Immigration and Customs Enforcement, had used Clearview’s biometric tools, which is alarming enough, given the total lack of any U.S. laws regulating how face recognition can be used and its proven potential in mass surveillance of anyone from minorities to political targets. Clearview also pitched itself and its tools to white supremacist Paul Nehlen, then a candidate for Congress, saying it could provide “unconventional databases” for “extreme opposition research.”

But the Times has now found that Clearview’s app was “freely used in the wild by the company’s investors, clients and friends” in situations ranging from showing off at parties to, in the case of billionaire Gristedes founder John Catsimatidis, correctly identifying a man his daughter was on a date with. More alarmingly, Catsimatidis launched a trial run of Clearview’s potential as a surveillance tool at his chain of grocery stores.

Catsimatidis told the Times that a Gristedes in Manhattan had used Clearview to screen for “shoplifters or people who had held up other stores,” adding, “People were stealing our Häagen-Dazs. It was a big problem.” That dovetails with other reporting by BuzzFeed that found Clearview is developing security cameras designed to work with its face recognition tools and that corporations including Kohl’s, Macy’s, and the NBA had tested it.

Source: Clearview AI Let Celebs, Investors Use Facial Recognition App

DuckDuckGo Made a List of Jerks Tracking You Online

DuckDuckGo, a privacy-focused tech company, today launched something called Tracker Radar—an open-source, automatically generated and continually updated list that currently contains more than 5,000 domains that more than 1,700 companies use to track people online.

The idea behind Tracker Radar, first reported by CNET, is to share the data DuckDuckGo has collected to create a better set of tracker blockers. DuckDuckGo says that the majority of existing tracker data falls into two types: block lists and in-browser tracker identification. The issue is the former relies on crowd-sourcing and manual maintenance. The latter is difficult to scale and also can be potentially abused due to the fact it’s generating a list based on your actual browsing habits. Tracker Radar supposedly gets around some of these issues by looking at the most common cross-site trackers and including a host of information about their behavior, things like prevalence, fingerprinting, cookies, and privacy policies, among other considerations.

This can be weedsy, especially if the particulars of adtech make your eyeballs roll out of their sockets. The gist is, that creepy feeling you get when you see ads on social media for that product you googled the other day? All that is powered by the types of hidden trackers DuckDuckGo is trying to block. On top of shopping data, these trackers can also glean your search history, location data, along with a number of other metrics. That can then be used to infer data like age, ethnicity, and gender to create a profile that then gets shared with other companies looking to profit off you without your explicit consent.

As for how people can actually take advantage of it, it’s a little more roundabout. The average joe mostly benefits by using… DuckDuckGo’s browser mobile apps for iOS and Android, or desktop browser extensions for Chrome, Firefox, and Safari.

As for developers, DuckDuckGo is encouraging them to create their own tracker block lists. The company is also suggesting researchers use Tracker Radar to help them study online tracking. You can find the data set here.

Source: DuckDuckGo Made a List of Jerks Tracking You Online

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Over the past few years, owners of cars with keyless start systems have learned to worry about so-called relay attacks, in which hackers exploit radio-enabled keys to steal vehicles without leaving a trace. Now it turns out that many millions of other cars that use chip-enabled mechanical keys are also vulnerable to high-tech theft. A few cryptographic flaws combined with a little old-fashioned hot-wiring—or even a well-placed screwdriver—lets hackers clone those keys and drive away in seconds.

Researchers from KU Leuven in Belgium and the University of Birmingham in the UK earlier this week revealed new vulnerabilities they found in the encryption systems used by immobilizers, the radio-enabled devices inside of cars that communicate at close range with a key fob to unlock the car’s ignition and allow it to start. Specifically, they found problems in how Toyota, Hyundai, and Kia implement a Texas Instruments encryption system called DST80. A hacker who swipes a relatively inexpensive Proxmark RFID reader/transmitter device near the key fob of any car with DST80 inside can gain enough information to derive its secret cryptographic value. That, in turn, would allow the attacker to use the same Proxmark device to impersonate the key inside the car, disabling the immobilizer and letting them start the engine.

The researchers say the affected car models include the Toyota Camry, Corolla, and RAV4; the Kia Optima, Soul, and Rio; and the Hyundai I10, I20, and I40. The full list of vehicles that the researchers found to have the cryptographic flaws in their immobilizers is below:

a chart of car models and makes
A list of the cars the researchers say are vulnerable to their immobilizer-disabling attack. Although the list includes the Tesla S, Tesla pushed out an update last year to address the vulnerability.

Courtesy of University of Birmingham and KU Leuven

Though the list also includes the Tesla S, the researchers reported the DST80 vulnerability to Tesla last year, and the company pushed out a firmware update that blocked the attack.

Toyota has confirmed that the cryptographic vulnerabilities the researchers found are real. But their technique likely isn’t as easy to pull off as the “relay” attacks that thieves have repeatedly used to steal luxury cars and SUVs. Those generally require only a pair of radio devices to extend the range of a key fob to open and start a victim’s car. You can pull them off from a fair distance, even through the walls of a building.

Source: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys | WIRED

More than one billion Android devices at risk of malware threats, no longer being updated

Based on Google data, two in five of Android users worldwide may no longer be receiving updates, and while these devices won’t immediately have problems, without security support there is an increased risk to the user.

Our latest tests have shown how such phones and tablets, including handsets still available to buy from online marketplaces such as Amazon, could be affected by a range of malware and other threats. This could result in personal data being stolen, getting spammed by ads or even signed up to a premium rate phone service.

[…]

Generally speaking, the older the phone, the greater the risk. With the Android versions released in the past five years (Android 5.0 to 10.0), Google put more effort into enhancing security and privacy to give the user greater protection, transparency and control over their data. But smartphones can still be an attractive target, and it’s important to be aware of the threat.

Based on Google’s own data from May 2019, 42.1% of Android active users worldwide are on version 6.0 or earlier: Marshmallow (2015), Lollipop (2014), KitKat (2013), Jellybean (2012), Ice Cream Sandwich (2011) and Gingerbread (2010).

According to the Android Security Bulletin, there were no security patches issued for the Android system in 2019 that targeted Android versions below 7.0 Nougat.

That means more than one billion phones and tablets may be active around the world that are no longer receiving security updates.

[…]

We tasked expert antivirus lab, AV Comparatives, to try to infect them with malware, and it managed it on every phone, including multiple infections on some.

As you can see in the above chart, all the Android phones we used in our test lacked the more modern security features introduced by Google to the latest Android 9.0 or 10.

Source: More than one billion Android devices at risk of malware threats – Which? News

Virgin broadband ISP spills 900,000 punters’ records into wrong hands from insecure database

Virgin Media, one of the UK’s biggest ISPs, on Thursday admitted it accidentally spilled 900,000 of its subscribers’ personal information onto the internet via a poorly secured database.

The cableco said it “incorrectly configured” a storage system so that at least one miscreant was able to access it and potentially siphon off customer records. The now-secured marketing database – containing names, home and email addresses, and phone numbers, and some dates of birth, plus other info – had been left open since mid-April 2019.

Crucially, the information “was accessed on at least one occasion but we do not know the extent of the access,” Virgin Media’s CEO Lutz Schüler said in a statement this evening. Said access, we speculate, could have been from an automated bot scanning the internet, or someone prowling around looking for open gear; at this stage, we don’t know.

In a separate email to subscribers, shared with El Reg by dozens of readers, the telco expanded: “The database was used to manage information about our existing and potential customers in relation to some of our marketing activities. This included: contact details (such as name, home and email address and phone numbers), technical and product information, including any requests you may have made to us using forms on our website. In a very small number of cases, it included date of birth.”

The storage box, we understand, not only contained Virgin Media broadband and fixed-line subscriber records – some 15 per cent of that total customer base – but also info on some cellular users. If a punter referred a friend to Virgin Media, that pal’s details may be in the silo, too.

Source: Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punters’ records into wrong hands from insecure database • The Register

Enable MFA: 1.2 million Azure Active Directory (Office 365) accounts compromised every month, reckons Microsoft

Microsoft reckons 0.5 per cent of Azure Active Directory accounts as used by Office 365 are compromised every month.

The Window giant’s director of identity security, Alex Weinert, and IT identity and access program manager Lee Walker revealed the figures at the RSA conference last month in San Francisco.

“About a half of a per cent of the enterprise accounts on our system will be compromised every month, which is a really high number. If you have an organisation of 10,000 users, 50 will be compromised each month,” said Weinert.

It is an astonishing and disturbing figure. Account compromise means that a malicious actor or script has some access to internal resources, though the degree of compromise is not stated. The goal could be as simple as sending out spam or, more seriously, stealing secrets and trying to escalate access.

Password spray attacks account for 40% of compromised accounts

Password spray attacks account for 40% of compromised accounts

How do these attacks happen? About 40 per cent are what Microsoft calls password spray attacks. Attackers use a database of usernames and try logging in with statistically probable passwords, such as “123” or “p@ssw0rd”. Most fail but some succeed. A further 40 per cent are password replay attacks, where attackers mine data breaches on the assumption that many people reuse passwords and enterprise passwords in non-enterprise environments. That leaves 20 per cent for other kinds of attacks like phishing.

The key point, though, is that if an account is compromised, said Weinert, “there’s a 99.9 per cent chance that it did not have MFA [Multi Factor Authentication]”. MFA is where at least one additional identifier is required when logging in, such as a code on an authenticator application or a text message to a mobile phone. It is also possible (and preferable) to use FIDO2 security keys, a feature now in preview for Azure AD. Even just disabling legacy authentication helps, with a 67 per cent reduction in the likelihood of compromise.

Source: Enable that MF-ing MFA: 1.2 million Azure Active Directory accounts compromised every month, reckons Microsoft • The Register

Unfixable vulnerability in Intel CSME allows crypto key stealing and local access to files

An error in chipset read-only memory (ROM) could allow attackers to compromise platform encryption keys and steal sensitive information.

Intel has thanked Positive Technologies experts for their discovery of a vulnerability in Intel CSME. Most Intel chipsets released in the last five years contain the vulnerability in question.

By exploiting vulnerability CVE-2019-0090, a local attacker could extract the chipset key stored on the PCH microchip and obtain access to data encrypted with the key. Worse still, it is impossible to detect such a key breach. With the chipset key, attackers can decrypt data stored on a target computer and even forge its Enhanced Privacy ID (EPID) attestation, or in other words, pass off an attacker computer as the victim’s computer. EPID is used in DRM, financial transactions, and attestation of IoT devices.

One of the researchers, Mark Ermolov, Lead Specialist of OS and Hardware Security at Positive Technologies, explained: “The vulnerability resembles an error recently identified in the BootROM of Apple mobile platforms, but affects only Intel systems. Both vulnerabilities allow extracting users’ encrypted data. Here, attackers can obtain the key in many different ways. For example, they can extract it from a lost or stolen laptop in order to decrypt confidential data. Unscrupulous suppliers, contractors, or even employees with physical access to the computer can get hold of the key. In some cases, attackers can intercept the key remotely, provided they have gained local access to a target PC as part of a multistage attack, or if the manufacturer allows remote firmware updates of internal devices, such as Intel Integrated Sensor Hub.”

The vulnerability potentially allows compromising common data protection technologies that rely on hardware keys for encryption, such as DRM, firmware TPM, and Intel Identity Protection. For example, attackers can exploit the vulnerability on their own computers to bypass content DRM and make illegal copies. In ROM, this vulnerability also allows for arbitrary code execution at the zero level of privilege of Intel CSME. No firmware updates can fix the vulnerability.

Intel recommends that users of Intel CSME, Intel SPS, Intel TXE, Intel DAL, and Intel AMT contact their device or motherboard manufacturer for microchip or BIOS updates to address the vulnerability. Check the Intel website for the latest recommendations on mitigation of vulnerability CVE-2019-0090.

Since it is impossible to fully fix the vulnerability by modifying the chipset ROM, Positive Technologies experts recommend disabling Intel CSME based encryption of data storage devices or considering migration to tenth-generation or later Intel CPUs. In this context, retrospective detection of infrastructure compromise with the help of traffic analysis systems such as PT Network Attack Discovery becomes just as important.

Source: Positive Technologies: Unfixable vulnerability in Intel chipsets threatens users and content rightsholders

Apple pays piffling $500m to settle their performance decreases in old devices

Apple – which banked $55bn profit in its 2019 fiscal year – is willing to pay up to $500m to settle US claims that the company secretly slowed certain iPhone models to preserve battery life, according to a proposed class action settlement.

That’s about 18x more than the i-thing maker agreed to pay a month ago to settle a related legal claim in France.

On December 20, 2017, Apple revealed that it had implemented performance management code in iOS 10.2.1 and iOS 11.2 to prevent sudden shutdowns that could occur when age-diminished batteries failed to meet the requirements of apps demanding peak power from iPhone processors.

Source: Apple checks under the couch for $500m in spare change, offers it to make power-throttling gripes disappear • The Register

Hydro-Quebec To Commercialize Glass Battery Co-Developed By John Goodenough

A rapid-charging and non-flammable battery developed in part by 2019 Nobel Prize winner John Goodenough has been licensed for development by the Canadian electric utility Hydro-Quebec. The utility says it hopes to have the technology ready for one or more commercial partners in two years. Hydro-Quebec, according to Karim Zaghib, general director of the utility’s Center of Excellence in Transportation Electrification and Energy Storage, has been commercializing patents with Goodenough’s parent institution, the University of Texas at Austin, for the past 25 years.

As Spectrum reported in 2017, Goodenough and Maria Helena Braga, professor of engineering at the University of Porto in Portugal, developed a solid-state lithium rechargeable that used a glass doped with alkali metals as the battery’s electrolyte. (The electrolyte is the material between cathode and anode and is often a liquid in today’s batteries, which typically means it’s also flammable and potentially vulnerable to battery fires.) Braga said her and Goodenough’s battery is high capacity, charges in “minutes rather than hours,” performs well in both hot and cold weather, and that its solid-state electrolyte is not flammable. Hydro-Quebec’s Gen 3 battery “can be glass or ceramic, but it is not a [lithium] polymer,” Zaghib said of the Goodenough/Braga battery’s electrolyte. “So with Daimler (which is also working with Hydro-Quebec to develop a second-gen lithium solid-state battery), it’s an organic compound, and with John Goodenough, it’s an inorganic compound. The inorganic compound has higher ionic conductivity compared to the polymer.”

“That means the ions shuttle back and forth more readily between cathode and anode, which could potentially improve a battery’s capacity, charging speed, or other performance metrics,” adds IEEE Spectrum.

We interviewed John B. Goodenough soon after his solid-state battery was announced. You can read his responses to your questions here.

Source: Hydro-Quebec To Commercialize Glass Battery Co-Developed By John Goodenough – Slashdot

Browser Tool Erases People From Live Webcam Feeds in Real Time

Jason Mayes apparently likes to do things the hard way: He’s developed an AI-powered tool for browsers that can erase people from live webcam feeds in real-time but leave everything else in the shot.

Mayes is a Google web engineer who developed his Disappearing-People tool using Javascript and TensorFlow, which is Google’s free, open source software library that allows the terrifying potential of artificial intelligence and deep learning to be applied to less terrifying applications. In this case, the neural network works to determine what the static background imagery of a video is in order to develop a clean plate—a version without any humans moving around in the frame—without necessarily requiring the feed to be free of people to start with.

The neural network used in this instance is trained to recognize people, and using that knowledge it can not only generate a clean image of a webcam feed’s background, but it can then actively erase people as they walk into frame and move around, in real-time, while allowing live footage of everything else happening in the background to remain.

Mayes has created test versions of the tool that you can access and try yourself in a browser through his personal GitHub repository. The results aren’t 100 percent perfect just yet (you can still see quite a few artifacts popping up here and there in the sample video he shared where he walks into frame), but as the neural network powering this tool continues to improve, so will the results.

Source: Browser Tool Erases People From Live Webcam Feeds in Real Time

EU Commission to staff: Switch to Signal messaging app

The European Commission has told its staff to start using Signal, an end-to-end-encrypted messaging app, in a push to increase the security of its communications.

The instruction appeared on internal messaging boards in early February, notifying employees that “Signal has been selected as the recommended application for public instant messaging.”

The app is favored by privacy activists because of its end-to-end encryption and open-source technology.

“It’s like Facebook’s WhatsApp and Apple’s iMessage but it’s based on an encryption protocol that’s very innovative,” said Bart Preneel, cryptography expert at the University of Leuven. “Because it’s open-source, you can check what’s happening under the hood,” he added.

[…]

Privacy experts consider that Signal’s security is superior to other apps’. “We can’t read your messages or see your calls,” its website reads, “and no one else can either.”

[…]

The use of Signal was mainly recommended for communications between staff and people outside the institution. The move to use the application shows that the Commission is working on improving its security policies.

Promoting the app, however, could antagonize the law enforcement community.

Officials in Brussels, Washington and other capitals have been putting strong pressure on Facebook and Apple to allow government agencies to access to encrypted messages; if these agencies refuse, legal requirements could be introduced that force firms to do just that.

American, British and Australian officials have published an open letter to Facebook CEO Mark Zuckerberg in October, asking that he call off plans to encrypt the company’s messaging service. Dutch Minister for Justice and Security Ferd Grappehaus told POLITICO last April that the EU needs to look into legislation allowing governments to access encrypted data.

Cybersecurity officials have dismissed calls to weaken encryption for decades, arguing that it would put the confidentiality of communications at risk across the board.

Source: EU Commission to staff: Switch to Signal messaging app – POLITICO

Finally, an organisation showing some sense!

Scientists Find The First-Ever Animal That Doesn’t Need Oxygen to Survive

Scientists have just discovered that a jellyfish-like parasite doesn’t have a mitochondrial genome – the first multicellular organism known to have this absence. That means it doesn’t breathe; in fact, it lives its life completely free of oxygen dependency.

This discovery isn’t just changing our understanding of how life can work here on Earth – it could also have implications for the search for extraterrestrial life.

[…]

Exactly how it survives is still something of a mystery. It could be leeching adenosine triphosphate from its host, but that’s yet to be determined.

[…]

The research has been published in PNAS.

Source: Scientists Find The First-Ever Animal That Doesn’t Need Oxygen to Survive

After blowing $100m to snoop on Americans’ phone call logs for four years, what did the NSA get? Just one lead

The controversial surveillance program that gave the NSA access to the phone call records of millions of Americans has cost US taxpayers $100m – and resulted in just one useful lead over four years.

That’s the upshot of a report [PDF] from the US government’s freshly revived Privacy and Civil Liberties Oversight Board (PCLOB). The panel dug into the super-snoops’ so-called Section 215 program, which is due to be renewed next month.

Those findings reflect concerns expressed by lawmakers back in November when at a Congressional hearing, the NSA was unable to give a single example of how the spy program had been useful in the fight against terrorism. At the time, Senator Dianne Feinstein (D-CA) stated bluntly: “If you can’t give us any indication of specific value, there is no reason for us to reauthorize it.”

That value appears to have been, in total, 15 intelligence reports at an overall cost of $100m between 2015 and 2019. Of the 15 reports that mentioned what the PCLOB now calls the “call detail records (CDR) program,” just two of them provided “unique information.” In other words, for the other 13 reports, use of the program reinforced what Uncle Sam’s g-men already knew. In 2018 alone, the government collected more than 434 million records covering 19 million different phone numbers.

What of those two reports? According to the PCLOB overview: “Based on one report, FBI vetted an individual, but, after vetting, determined that no further action was warranted. The second report provided unique information about a telephone number, previously known to US authorities, which led to the opening of a foreign intelligence investigation.”

Source: After blowing $100m to snoop on Americans’ phone call logs for four years, what did the NSA get? Just one lead • The Register

Wi-Fi of more than a billion PCs, phones, gadgets can be snooped on. But you’re using HTTPS, SSH, VPNs… right?

A billion-plus computers, phones, and other devices are said to suffer a chip-level security vulnerability that can be exploited by nearby miscreants to snoop on victims’ encrypted Wi-Fi traffic.

The flaw [PDF] was branded KrØØk by the bods at Euro infosec outfit ESET who discovered it. The design blunder is otherwise known as CVE-2019-15126, and is related to 2017’s KRACK technique for spying on Wi-Fi networks.

An eavesdropper doesn’t have to be logged into the target device’s wireless network to exploit KrØØk. If successful, the miscreant can take repeated snapshots of the device’s wireless traffic as if it were on an open and insecure Wi-Fi. These snapshots may contain things like URLs of requested websites, personal information in transit, and so on.

It’s not something to be totally freaking out over: someone exploiting this has to be physically near you, and you may notice your Wi-Fi being disrupted. But it’s worth knowing about.

Source: Wi-Fi of more than a billion PCs, phones, gadgets can be snooped on. But you’re using HTTPS, SSH, VPNs… right? • The Register

Dutch package post will raise prices during gift season and Black Friday

PostNL will raise prices during SinterKlaas, Christmas and Black Friday. They claim that the package post infrastructure is not sufficient to cope with this raise in demand at those periods and so someone – the webshops, the consumers – have to pay for this spike.

PostNL increased turnover with 32m to 471m in the last quarter, with a 10% increase in volume. Doesn’t this mean that the extra capacity should be paid for using regular pricing?

Source: Pakketten PostNL met Sint en kerst extra duur – Emerce

Facebook’s privacy tools are riddled with missing data

Facebook wants you to think it’s consistently increasing transparency about how the company stores and uses your data. But the company still isn’t revealing everything to its users, according to an investigation by Privacy International.

The obvious holes in Facebook’s privacy data exports paint a picture of a company that aims to placate users’ concerns without actually doing anything to change its practices.

Data lists are incomplete — The most pressing issue with Facebook’s downloadable privacy data is that it’s incomplete. Privacy International’s investigation tested the “Ads and Business” section on Facebook’s “Download Your Information” page, which purports to tell users which advertisers have been targeting them with ads.

The investigation found that the list of advertisers actually changes over time, seemingly at random. This essentially makes it impossible for users to develop a full understanding of which advertisers are using their data. In this sense, Facebook’s claims of transparency are inaccurate and misleading.

‘Off-Facebook’ data is misleading — Facebook’s most recent act of “transparency” is its “Off-Facebook Activity” tool, which allows users to “see and control the data that other apps and websites share with Facebook.” But the reports generated by this tool offer extremely limited detail. Some data is marked with a cryptic “CUSTOM” label, while even the best-labeled data gives no context surrounding the reason it’s included in the list.

Nothing to see here — Facebook’s supposed attempts at increased transparency do very little to actually help users understand what the company is doing with their personal data. These tools come off as nothing more than a ploy to take pressure off the company. Meanwhile, the company continues to quietly pay off massive lawsuits over actual user privacy issues.

Facebook doesn’t care about your privacy — it cares about making money. Users would do well to remember that.

Source: Report: Facebook’s privacy tools are riddled with missing data

Turkey’s Killer Drone Swarm Poses Syria Air Challenge to Putin

The retaliation for the killing last week of 33 Turkish soldiers by Syrian forces involved an unprecedented number of drones in coordinated action, said the senior official in Turkey with direct knowledge of President Recep Tayyip Erdogan’s Syria policy. It was the first time a country had commanded the air space over such a large area using drone swarms, according to the official.

The series of strikes since Thursday by dozens of the remotely-controlled aircraft targeted Syrian bases and chemical warfare depots, the Turkish military said. But Turkey also located and destroyed some Syrian missile-defense systems, raising questions about the effectiveness of the Russian-made equipment intended to deter such air attacks.

“That’s something only Israel had been recorded publicly to have done until now,” Charles Lister, director of the Extremism and Counterterrorism Program at the Middle East Institute, said on Twitter, in reference to video footage taken by a Turkish drone allegedly showing the destruction of a Syrian army air-defense system. Turkey was waging an “air campaign run entirely by armed drones backed up” by heavy rocket artillery, he said.

The tactic threatens to bring NATO member Turkey into direct confrontation with Russia, adding to strains in relations between Erdogan and Russian President Vladimir Putin as they prepare to meet this week in an effort to ease tensions over Syria. The two leaders have worked together to try to end the Syrian civil war, despite backing opposing sides, but have repeatedly stumbled over who should control the northwestern Syrian province of Idlib that borders Turkey.

[…]

Turkey deployed an array of electronic jammers in Syria before it launched the drone strikes as part of its “Spring Shield” campaign.

Ankara appeared eager to show off its aerial firepower. The Defense Ministry posted a series of videos on Twitter showing Syrian tanks and artillery being destroyed in apparent drone attacks.

Source: Turkey’s Killer Drone Swarm Poses Syria Air Challenge to Putin

US Gov wants to spy on all drones all the time: they must be constantly connected to the internet to give Feds real-time location data

Drone enthusiasts are up in arms over rules proposed by the US Federal Aviation Administration (FAA) that would require their flying gizmos to provide real-time location data to the government via an internet connection.

The requirement, for drones weighing 0.55lb (0.25kg) or more, would ground an estimated 80 per cent of gadgets in the United States, and many would never be able to fly again because they couldn’t be retrofitted with the necessary equipment, say drone owners. Those that did buy new drones would need to buy a monthly data plan for their flying machines: something that would likely cost $35 or more a month, given extortionate US mobile rates.

There are also additional costs of running what would need to be new location databases of drones, which the FAA expects will be run by private companies but doesn’t exist yet, which drones owners would have to pay for through subscriptions. The cost of all this is prohibitive, for little real benefit, they argue.

If a device loses internet connectivity while flying, and can’t send its real-time info, it must land. It may be possible to pair a drone control unit with, say, a smartphone or a gateway with fixed-lined internet connectivity, so that the drone can relay its data to the Feds via these nodes. However, that’s not much use if you’re out in the middle of nowhere, or if you wander into a wireless not-spot.

Nearly 35,000 public comments have been received by the FAA, with the comment period closing later today. The vast majority of the comments are critical and most make the same broad point: that the rules are too strict, too costly and are unnecessary.

The world’s largest drone maker, DJI, is among those fighting the rule change, unsurprisingly enough. The manufacturer argues that while it agrees that every drone should have its own unique ID, the FAA proposal is “complex, expensive and intrusive.”

It would also undermine the industry own remote ID solution that doesn’t require a real-time data connection but utilizes the same radio signals used to control drones to broadcast ID information. It also flags that the proposed solution has privacy implications: people would be able to track months of someone’s previous drone usage.

Source: Drones must be constantly connected to the internet to give Feds real-time location data – new US govt proposal • The Register