Using LimeGPS to spoof a fake location to any GPS device inside the room

Posted on by

This page details experiences using LimeSDR to simulate GPS.
Note, update (Aug 15, 2017) – The center frequency should be corrected below to 1575.42MHz. It would marginally work with the original 1545.42 but 1575.42 is rock solid gps sim performance.

These experiments were inspired by the excellent procedure written up here [1]. We want to use a similar process to target real devices, and have had luck with a qstarz 818XT bluetooth gps device, and a Galaxy S4 after using airplane mode, restart and patience. The coverage area is at least a room, even with -42db PAD attenuation. Here I am visiting Trinity College Cambridge with the qstarz and it’s app.

TrinityCollege s1r1.jpg

2 Setup

Software to git clone – https://github.com/osqzss/gps-sdr-sim
Follow the instructions on the github page for how to compile, it is a very easy procedure on Ubuntu with build-essential package installed.

$ gcc gpssim.c -lm -O3 -o gps-sdr-sim

Note there is a setting in gpssim.h for USER_MOTION_SIZE default 3000 max duration at 10MHz (300 seconds). You can increase that to 6000 or more to get longer default running times.
The default sample rate for gps-sdr-sim is 2.6e6, 16 bit I/Q data format. LimeSDR is known to work with 10e6, and 8 bit interleaved I/Q data format converted to complex float in the graph. That is too slow to generate in real time, depending on your cpu, so one strategy is to create an rf data file non-realtime and then transmit that with a simple gnuradio python script created in gnuradio-companion. The gps-fake-out project [2] links to a grc file, or it’s easy to create your own. That example project simultaneous transmits the rf data file and also collects rf data for later analysis with Matlab and SoftGNSS. I found it useful to replace the file sink with an fft display slightly offset, and 20e6 input rate.

The last puzzle piece needed are ephemeris data to feed gps-sdr-sim (required), RINEX v2 format ( read all about it here [3] – especially the file name format). There is a global network of International GNSS Service installations [4] providing up to date data, which may be accessed with anonymous ftp from the Goddard Space Flight Center

ftp -p cddis.gsfc.nasa.gov

Login anonymous ‘ftp’ and email for password. Use the merged GPS broadcast ephemeris file found in /pub/gps/data/daily/2017/brdc/. The filename convention is

'brdc' + <3 digit day of year> + '0.' +  <2 digit year> + 'n.Z'

‘n’ for gps (don’t get the ‘g’ files, that is glonass), and ‘Z’ for compressed. Day of year can be found with

$ date +%j

Get yesterdays – for example, today, Feb 28, 2017, I would get ‘brdc0580.17n.Z’, uncompress

$ uncompress brdc0580.17n.Z

Pick a place – All you need now is a location to go, Google maps is good for entering latitude,longitude and seeing where it goes, or pick a spot, right click and pick “Directions to here” and a little url hacking to get the coordinates, like 1.8605853,73.5213033 for a spot in the Maldives.

To do: use the gpssim with a user motion file instead of a static location, there is even support for Google Earth and SatGen software.

3 Execution

Get ready to host some large files, ranging from 5 to 20GB in size, if going with a larger USER_MOTION_SIZE full duration and/or trying 16 bit. Create the rf data file, using 10e6 samples per second in interleaved 8bit I/Q sample format, using the day of year 059 merged broadcast ephemeris file:

$ ./gps-sdr-sim -e brdc0590.17n -l 1.8605853,73.5213033,5 -t 2017/02/28,22:00:00 -o gpssim_10M.s8 -s 10e6 -b 8 -v
Using static location mode.
     9.313e-09    0.000e+00   -5.960e-08    0.000e+00
     9.011e+04    0.000e+00   -1.966e+05    0.000e+00
     1.86264514923e-09   1.77635683940e-15     319488      1938
    18
Start time = 2017/02/28,22:00:00 (1938:252000)
Duration = 600.0 [sec]
02   78.1   5.0  25142702.4   4.5
04  305.9  10.6  24630434.2   4.0
10  244.0  20.9  23656748.6   3.2
12  174.6  31.9  22801339.9   2.6
13   59.8  27.2  23001942.1   2.8
15   80.1  60.3  20615340.0   1.7
18  273.8  42.7  21969027.9   2.1
20    3.4  36.7  22141445.5   2.3
21  322.3  14.4  24860118.2   3.7
24  152.1  21.2  23574508.7   3.2
25  227.1  49.6  21537006.8   1.9
26  310.2   0.2  25799081.3   5.1
29    2.7  52.0  21259731.6   1.8
32  211.7   0.4  25733242.7   5.0
Time into run =  1.6

then get some coffee – it’s a slow single threaded process which is why we have to create a data file and then transmit it instead of realtime radio broadcast. When done make sure your gnuradio-companion graph is setup with the right source filename, data types, sink driver, antenna, etc. Anything miss-matched can cause it to frustratingly run but not work. Grc xmit only.jpg

 self.blocks_file_source_0 = blocks.file_source(gr.sizeof_char*1, "/home/chuck/src/gps-sdr-sim/gpssim_10M.s8", False)
 self.blocks_interleaved_char_to_complex_0 = blocks.interleaved_char_to_complex(False)
 self.osmosdr_sink_0 = osmosdr.sink( args="numchan=" + str(1) + " " + "device=soapy,lime=0" ) 
 self.osmosdr_sink_0.set_antenna("BAND1", 0)

Then click the run button or create top_block.py and run it on the command line and your gps simulated broadcast should be visible to devices a few inches away from the antenna. You can play with various gain settings in the sink block – looks like a setting of ‘0’ sets the power amp driver to -52 db attenuatin and a setting of 10 you get -42 db:

 [INFO] SoapyLMS7::setGain(Tx, 0, PAD, -42 dB)

4 Results

Now with emissions in progress try various devices and experience the wonders of rf, distance, position orientation, how you hold you hand, etc can all effect the SNR. It may take some trickery as many receivers have build in processes to speed up signal lock, such as obtaining their own ephemeris etc. For the smart phone Galaxy S4 I put it in airplane mode, restart, open GpsTEST app and altho it found many satellites very fast, it took a long time to actually get a fix. Just found the QStarz snr jumped considerably when a hand is placed slightly behind it.
Anyway, here’s the screenshots of simulating location in the Maldives created above, using the QStarz app:

Maldives Sats s1.jpg Maldives Map s1.jpg

Source: GPS Simulation – Myriad-RF Wiki

All new cell phone users in China must now have their face scanned, as do all US citizens entering or leaving the US (as well as all non-US citizens)

Posted on by

Customers in China who buy SIM cards or register new mobile-phone services must have their faces scanned under a new law that came into effect yesterday. China’s government says the new rule, which was passed into law back in September, will “protect the legitimate rights and interest of citizens in cyberspace.”

A controversial step: It can be seen as part of an ongoing push by China’s government to make sure that people use services on the internet under their real names, thus helping to reduce fraud and boost cybersecurity. On the other hand, it also looks like part of a drive to make sure every member of the population can be surveilled.

How do Chinese people feel about it? It’s hard to say for sure, given how strictly the press and social media are regulated, but there are hints of growing unease over the use of facial recognition technology within the country. From the outside, there has been a lot of concern over the role the technology will play in the controversial social credit system, and how it’s been used to suppress Uighur Muslims in the western region of Xinjiang.

Source: All new cell phone users in China must now have their face scanned – MIT Technology Review

Homeland Security wants to expand facial recognition checks for travelers arriving to and departing from the U.S. to also include citizens, which had previously been exempt from the mandatory checks.

In a filing, the department has proposed that all travelers, and not just foreign nationals or visitors, will have to complete a facial recognition check before they are allowed to enter the U.S., but also to leave the country.

Facial recognition for departing flights has increased in recent years as part of Homeland Security’s efforts to catch visitors and travelers who overstay their visas. The department, whose responsibility is to protect the border and control immigration, has a deadline of 2021 to roll out facial recognition scanners to the largest 20 airports in the United States, despite facing a rash of technical challenges.

But although there may not always be a clear way to opt-out of facial recognition at the airport, U.S. citizens and lawful permanent residents — also known as green card holders — have been exempt from these checks, the existing rules say.

Now, the proposed rule change to include citizens has drawn ire from one of the largest civil liberties groups in the country.

“Time and again, the government told the public and members of Congress that U.S. citizens would not be required to submit to this intrusive surveillance technology as a condition of traveling,” said Jay Stanley, a senior policy analyst at the American Civil Liberties Union .

“This new notice suggests that the government is reneging on what was already an insufficient promise,” he said.

“Travelers, including U.S. citizens, should not have to submit to invasive biometric scans simply as a condition of exercising their constitutional right to travel. The government’s insistence on hurtling forward with a large-scale deployment of this powerful surveillance technology raises profound privacy concerns,” he said.

Citing a data breach of close to 100,000 license plate and traveler images in June, as well as concerns about a lack of sufficient safeguards to protect the data, Stanley said the government “cannot be trusted” with this technology and that lawmakers should intervene.

Source: DHS wants to expand airport face recognition scans to include US citizens

Vulnerability in fully patched Android phones under active attack by bank thieves – watch out for permissions being asked from apps you have installed

Posted on by

A vulnerability in millions of fully patched Android phones is being actively exploited by malware that’s designed to drain the bank accounts of infected users, researchers said on Monday.

The vulnerability allows malicious apps to masquerade as legitimate apps that targets have already installed and come to trust, researchers from security firm Promon reported in a post. Running under the guise of trusted apps already installed, the malicious apps can then request permissions to carry out sensitive tasks, such as recording audio or video, taking photos, reading text messages or phishing login credentials. Targets who click yes to the request are then compromised.

Researchers with Lookout, a mobile security provider and a Promon partner, reported last week that they found 36 apps exploiting the spoofing vulnerability. The malicious apps included variants of the BankBot banking trojan. BankBot has been active since 2017, and apps from the malware family have been caught repeatedly infiltrating the Google Play Market.

The vulnerability is most serious in versions 6 through 10, which (according to Statista) account for about 80% of Android phones worldwide. Attacks against those versions allow malicious apps to ask for permissions while posing as legitimate apps. There’s no limit to the permissions these malicious apps can seek. Access to text messages, photos, the microphone, camera, and GPS are some of the permissions that are possible. A user’s only defense is to click “no” to the requests.

An affinity for multitasking

The vulnerability is found in a function known as TaskAffinity, a multitasking feature that allows apps to assume the identity of other apps or tasks running in the multitasking environment. Malicious apps can exploit this functionality by setting the TaskAffinity for one or more of its activities to match a package name of a trusted third-party app. By either combining the spoofed activity with an additional allowTaskReparenting activity or launching the malicious activity with an Intent.FLAG_ACTIVITY_NEW_TASK, the malicious apps will be placed inside and on top of the targeted task.

“Thus the malicious activity hijacks the target’s task,” Promon researchers wrote. “The next time the target app is launched from Launcher, the hijacked task will be brought to the front and the malicious activity will be visible. The malicious app then only needs to appear like the target app to successfully launch sophisticated attacks against the user. It is possible to hijack such a task before the target app has even been installed.”

Promon said Google has removed malicious apps from its Play Market, but, so far, the vulnerability appears to be unfixed in all versions of Android. Promon is calling the vulnerability “StrandHogg,” an old Norse term for the Viking tactic of raiding coastal areas to plunder and hold people for ransom. Neither Promon nor Lookout identified the names of the malicious apps. That omission makes it hard for people to know if they are or were infected.

[…]

Suspicious signs include:

  • An app or service that you’re already logged into is asking for a login.
  • Permission popups that don’t contain an app name.
  • Permissions asked from an app that shouldn’t require or need the permissions it asks for. For example, a calculator app asking for GPS permission.
  • Typos and mistakes in the user interface.
  • Buttons and links in the user interface that do nothing when clicked on.
  • Back button does not work as expected.

Source: Vulnerability in fully patched Android phones under active attack by bank thieves | Ars Technica

123Autoit – NonRoot trial – Apps on Google Play

Posted on by

***** No Root Required, ***** *****Please Look the Following***** ****However need to start a (Backend Service) Per every Boot ***** *****the Install package can be found at the following link***** http://123autoit.blogspot.tw/2016/08/123autoit-non-root-daemon-service.html Please update the backend service for Version 1.3 to use (Speed up mode) ***Daemon Script Install Video*** https://www.youtube.com/watch?v=awCz9A_FLk0 It is now supported both ARM and Intel Android Device If it is not support your phone or Install, setting , usage, any problem can reach me on E M A l L (kevinyiu82@gmail.com) or send me a hangout https://plus.google.com/+kevinyiu82 I am here to help Video Tutorial https://www.youtube.com/playlist?list=PLp0O8ko3Htr4YcZYXe2pyqG2lARTDqwoD Continue updating 123AutoIt (Automate repetitive tasks based on predefined logic) [BETA STAGE] Requirements -Android 5+ -best to run on safe mode -ram 1G + Features: match conditions trigger Taps, Swipes, pauses supported (Drag is still in beta stage, if experience any problem restart and try again using another mode) repeat number set to repeat actions accordingly validation at the point, to quick examine your check point placement add, select, edit and remove action from the logic different profile supported allow extra control to change the logic flow provide basic start and stop function (if more than one action within a page, then need to press a few more time to stop the process. +added extra options to disable auto rotate in screen capture (to handle for some device landscape screen capture problem) +added in app video tutorial + added FloatLayout to Control Panel + added Accumulated Count Click action + change name Counter Click to (Consecutive Counter Click) + Duplicate Image can’t show image bug fix +added setting storage location +added validation storage location +added magnifying glasses +added ads cache +added WiFi ON & OFF Action +softkeyboard input bug fix +UI minor adjustment +Update Edit Mode UI +Update Text Description +In Edit mode back press twice to get back full screen +fixed Recharge Button +Start up version check has been added +Edit mode z-index fixed +Fixed Repeat number can’t be saved issue(android 5.0+) +Fixed locale Issue +Added Same Page ? Times trigger Click Action +Added Action notificiation +Added Error notificiation +Added OCR checks Quick tips: -make sure your phone/tablet is fully charge and connected to a charger -fan the device, it sure produce a lot of heat -lower the backlight -turn on the developer mode to show the current click/swipe points -make sure turn off other background app except the app itself, and the targeted app. just to make app more stable ***Please notice, in some devices (such as Xiaomi) more action is needed for the application to work. such as allowing “pop up window” *** bug report: http://123autoit.blogspot.tw/2016/06/bug-report.html tutorial: http://123autoit.blogspot.tw/ ################################## OCR Using Open Source Tesseract library OpenCV Library ##################################

Source: 123Autoit – NonRoot trial – Apps on Google Play

For automating gaming clicks and anti-afk on Android

This ‘fix’ for economic theory changes everything from gambles to Ponzi schemes, because people adapt their risks wrt their wealth over time

Posted on by

Whether we decide to take out that insurance policy, buy Bitcoin, or switch jobs, many economic decisions boil down to a fundamental gamble about how to maximize our wealth over time. How we understand these decisions is the subject of a new perspective piece in Nature Physics that aims to correct a foundational mistake in economic theory.

According to author Ole Peters (London Mathematical Laboratory, Santa Fe Institute), people’s real-world behavior often “deviates starkly” from what standard would recommend.

Take the example of a simple coin toss: Most people would not gamble on a repeated coin toss where a heads would increase their by 50%, but a tails would decrease it by 40%.

“Would you accept the gamble and risk losing at the toss of a coin 40% of your house, car and life savings?” Peters asks, echoing a similar objection raised by Nicholas Bernoulli in 1713.

But early economists would have taken that gamble, at least in theory. In classical economics, the way to approach a decision is to consider all possible outcomes, then average across them. So the coin toss game seems worth playing because equal probability of a 50% gain and a 40% loss are no different from a 5% gain.

Why people don’t choose to play the game, seemingly ignoring the opportunity to gain a steady 5%, has been explained psychologically— people, in the parlance of the field, are “risk averse”. But according to Peters, these explanations don’t really get to the root of the problem, which is that the classical “solution” lacks a fundamental understanding of the individual’s unique trajectory over time.

Instead of averaging across parallel possibilities, Peters advocates an approach that models how an individual’s wealth evolves along a single path through time. In a disarmingly simple example, he randomly multiplies the player’s total wealth by either 150% or 60% depending on the coin toss. That player lives with the gain or loss of each round, carrying it with them to the next turn. As the play time increases, Peters’ model reveals an array of individual trajectories. They all follow unique paths. And in contrast to the classical conception, all paths eventually plummet downward. In other words, the approach reveals a fray of exponential losses where the classical conception would show a single exponential gain.

Encouragingly, people seem to intuitively grasp the difference between these two dynamics in empirical tests. The perspective piece describes an experiment conducted by a group of neuroscientists led by Oliver Hulme, at the Danish Research Center for Magnetic Resonance. Participants played a gambling game with real money. On one day, the game was set up to maximize their wealth under classical, additive dynamics. On a separate day, the game was set up under multiplicative dynamics.

“The crucial measure was whether participants would change their willingness to take risks between the two days,” explains the study’s lead author David Meder. “Such a change would be incompatible with classical theories, while Peters’ approach predicts exactly that.”

The results were striking: When the game’s dynamics changed, all of the subjects changed their willingness to take risks, and in doing so were able to approximate the optimal strategy for growing their individual wealth over time.

“The big news here is that we are much more adaptable than we thought we were,” Peters says. “Theseaspects of our behavior we thought were neurologically imprinted are actually quite flexible.”

“This theory is exciting because it offers an explanation for why particular risk-taking behaviors emerge, and how these behaviors should adapt to different circumstances. Based on this, we can derive novel predictions for what types of reward signals the brain should compute to optimize wealth over time” says Hulme.

Peters’ distinction between averaging possibilities and tracing individual trajectories can also inform a long list of economic puzzles— from the equity premium puzzle to measuring inequality to detecting Bernie Madoff’s Ponzi scheme.

“It may sound obvious to say that what matters to one’s wealth is how it evolves over time, not how it averages over many parallel states of the same individual,” writes Andrea Taroni in a companion Editorial in Nature Physics. “Yet that is the conceptual mistake we continue to make in our economic models.”

Source: This ‘fix’ for economic theory changes everything from gambles to Ponzi schemes

TrueDialog leaks tens of millions of US SMS messages and user data

Posted on by

Led by Noam Rotem and Ran Locar, vpnMentor’s research team discovered a breached database belonging to the American communications company, TrueDialog.

TrueDialog provides SMS texting solutions to companies in the USA and the database in question was linked to many aspects of their business. This was a huge discovery, with a massive amount of private data exposed, including tens of millions of SMS text messages.

Aside from private text messages, our team discovered millions of account usernames and passwords, PII data of TrueDialog users and their customers, and much more.

By not securing their database properly, TrueDialog compromised the security and privacy of millions of people across the USA.

[…]

Millions of email addresses, usernames, cleartext passwords, and base64 encoded passwords (which are easy to decrypt) were easily accessible within the database.

[…]

We were able to find tens of millions of entries from messages sent via TrueDialog and conversations hosted on the platform. The sensitive data contained in these SMS messages included, but was not limited to:

  • Full Names of recipients, TrueDialog account holders, & TrueDialog users
  • Content of messages
  • Email addresses
  • Phone numbers of recipients and users
  • Dates and times messages were sent
  • Status indicators on messages sent, like Read receipts, replies, etc.
  • TrueDialog account details

The data exposed was a mix of TrueDialog account holders, users, and tens of millions of American citizens.

[…]

There were hundreds of thousands of entries with details about users, including full names, phone numbers, addresses, emails and more.

Source: Report: Millions of Americans at Risk After Huge Data and SMS Leak

SMS Replacement is Exposing Users to Text, Call Interception Thanks to Sloppy Telecos

Posted on by

A standard used by phone carriers around the world can leave users open to all sorts of attacks, like text message and call interception, spoofed phone numbers, and leaking their coarse location, new research reveals.

The Rich Communication Services (RCS) standard is essentially the replacement for SMS. The news shows how even as carriers move onto more modern protocols for communication, phone network security continues to be an exposed area with multiple avenues for attack in some implementations of RCS.

“I’m surprised that large companies, like Vodafone, introduce a technology that exposes literally hundreds of millions of people, without asking them, without telling them,” Karsten Nohl from cybersecurity firm Security Research Labs (SRLabs) told Motherboard in a phone call.

SRLabs researchers Luca Melette and Sina Yazdanmehr will present their RCS findings at the upcoming Black Hat Europe conference in December, and discussed some of their work at security conference DeepSec on Friday.

RCS is a relatively new standard for carrier messaging and includes more features than SMS, such as photos, group chats, and file transfers. Back in 2015, Google announced it would be adopting RCS to move users away from SMS, and that it had acquired a company called Jibe Mobile to help with the transition. RCS essentially runs as an app on your phone that logs into a service with a username and password, Nohl explained.

SRLabs estimated RCS is already implemented by at least 100 mobile operators, with many of the deployments being in Europe. SRLabs said that all the major U.S. carriers—AT&T, T-Mobile, Sprint, and Verizon—were using RCS.

SRLabs didn’t find an issue in the RCS standard itself, but rather how it is being implemented by different telecos. Because some of the standard is undefined, there’s a good chance companies may deploy it in their own way and make mistakes.

“Everybody seems to get it wrong right now, but in different ways,” Nohl said. SRLabs took a sample of SIM cards from a variety of carriers and checked for RCS-related domains, and then looked into particular security issues with each. SRLabs didn’t say which issues impacted which particular telecos.

Some of those issues include how devices receive RCS configuration files. In one instance, a server provides the configuration file for the right device by identifying them by their IP address. But because they also use that IP address, “Any app that you install on your phone, even if you give it no permissions whatsoever, it can request this file. So now every app can get your username and password to all your text messages and all your voice calls. That’s unexpected,” Nohl said.

Source: SMS Replacement is Exposing Users to Text, Call Interception Thanks to Sloppy Telecos – VICE

Fresh efforts at Google to understand why an AI system says yes or no launches Explainable AI product

Posted on by

Google has announced a new Explainable AI feature for its cloud platform, which provides more information about the features that cause an AI prediction to come up with its results.

Artificial neural networks, which are used by many of today’s machine learning and AI systems, are modelled to some extent on biological brains. One of the challenges with these systems is that as they have become larger and more complex, it has also become harder to see the exact reasons for specific predictions. Google’s white paper on the subject refers to “loss of debuggability and transparency”.

The uncertainty this introduces has serious consequences. It can disguise spurious correlations, where the system picks on an irrelevant or unintended feature in the training data. It also makes it hard to fix AI bias, where predictions are made based on features that are ethically unacceptable.

AI Explainability has not been invented by Google but is widely researched. The challenge is how to present the workings of an AI system in a form which is easily intelligible.

Google has come up with a set of three tools under this heading of “AI Explainability” that may help. The first and perhaps most important is AI Explanations, which lists features detected by the AI along with an attribution score showing how much each feature affected the prediction. In an example from the docs, a neural network predicts the duration of a bike ride based on weather data and previous ride information. The tool shows factors like temperature, day of week and start time, scored to show their influence on the prediction.

Scored attributions shows by the AI Explainability tool

Scored attributions shown by the AI Explainability tool

In the case of images, an overlay shows which parts of the picture were the main factors in the classification of the image content.

There is also a What-If tool that lets you test model performance if you manipulate individual attributes, and a continuous evaluation tool that feeds sample results to human reviewers on a schedule to assist monitoring of results.

AI Explainability is useful for evaluating almost any model and near-essential for detecting bias, which Google considers part of its approach to responsible AI.

Source: Explain yourself, mister: Fresh efforts at Google to understand why an AI system says yes or no • The Register

Internet Society CEO: Most people don’t care about the .org sell-off. Grabbing money at the expense of non-profits is fine by everyone we didn’t consult or listen to their opinion.

Posted on by

El Reg has quizzed Andrew Sullivan, the president and CEO of the Internet Society (ISOC), about his organistion’s decision to sell the non-profit .org registry to private equity outfit Ethos Capital.

We have previously covered the controversy over the proposed sale, the continued failure of ISOC and DNS overseer ICANN to answer detailed questions, and efforts by both to push the deal forward even while opposition to it grows.

Your correspondant asked Sullivan whether he expected the amount of criticism from the internet community that has erupted in recent days.

“I did expect some people to be unhappy with the decision, I expected some pushback,” he told The Register, adding: “But the level of pushback has been very strong.”

He was aware, he says, that people would not like two key aspects of the decision: the move from a non-profit model to a for-profit one; and the lack of consultation. He had explanations ready for both: “The registry business is still a business, and this represented a really big opportunity, and one that is good for PIR [Public Interest Registry].”

As for the lack of consultation: “We didn’t go looking for this. If we had done that [consulted publicly about the sale .org], the opportunity would have been lost. If we had done it in public, it would have created a lot of uncertainty without any benefit.”

Overblown

But when we pressed him on the fact that the concerns seem much deeper and broader than that – one ISOC Chapter has accused the organization of “severely harming” its reputation “by even contemplating this transaction” – he rejected the idea.

“I think claims that there has been an outpouring of support against the sale are overblown. If you look there is a relatively small number of people complaining. We may be overstating the feeling; most people haven’t noticed. Most people don’t care one way or another.”

It’s hard to simultaneously argue that there was no need for consultation and then claim that the lack of responses indicates implicit approval, we note. More importantly, though, what about the 10 million registrants of .org, the vast majority of which are unlikely to hear about the sale at all and who likely bought their .org domain precisely because it represented a non-profit ethos?

Source: Internet Society CEO: Most people don’t care about the .org sell-off – and nothing short of a court order will stop it • The Register

MarioNETte: with only a few pictures a human behind a webcam can “drive” the picture to copy facial expressions realistically

Posted on by

When there is a mismatch between the target identity and the driver identity, face reenactment suffers severe degradation in the quality of the result, especially in a few-shot setting. The identity preservation problem, where the model loses the detailed information of the target leading to a defective output, is the most common failure mode. The problem has several potential sources such as the identity of the driver leaking due to the identity mismatch, or dealing with unseen large poses. To overcome such problems, we introduce components that address the mentioned problem: image attention block, target feature alignment, and landmark transformer. Through attending and warping the relevant features, the proposed architecture, called MarioNETte, produces high-quality reenactments of unseen identities in a few-shot setting. In addition, the landmark transformer dramatically alleviates the identity preservation problem by isolating the expression geometry through landmark disentanglement. Comprehensive experiments are performed to verify that the proposed framework can generate highly realistic faces, outperforming all other baselines, even under a significant mismatch of facial characteristics between the target and the driver.

Source: MarioNETte: Few-shot Face Reenactment Preserving Identity of Unseen Targets

Arvix paper: MarioNETte: Few-shot Face Reenactment Preserving Identity of Unseen Targets

Bose customers beg for firmware ceasefire after headphones fall victim to another crap update which kills noise cancelling

Posted on by

Owners of Bose QuietComfort 35 headphones are still trying to get the company to either fix or roll back a firmware update that removed noise-cancelling functions from their over-ear gear.

The problems date back to July and some owners seem to have managed to get Bose to exchange their cans for the company’s shiny new 700 headphones.

We were contacted by a reader who was first given a set of version II headphones when his V1 set were borked. When the updated firmware borked them as well, he declined the offer of a replacement set and was given a pair of 700s. Firmware version 4.5.2 was fingered as the main culprit.

Like all Bose gear, the cans don’t come cheap – they’ll set you back £259.95 to be precise, or £349.95 for a pair of limited edition white 700s.

Pissed-off punters have filled a deafening 182 pages of Bose’s support forums with complaints.

One has even set up a Change.org petition to beg for a pause on firmware updates until a fix is found.

The main complaint is that Bose seems to be deaf to the problem and the easiest solution – to roll everyone back to the previous firmware and restore noise cancelling.

As of Thursday, Bose was claiming that new firmware is coming soon to solve the problem, a long five-month wait for angry customers.

We’ve contacted Bose’s UK PR again but don’t expect to hear back. The company kept very quiet when firmware updates stopped their TV soundbars making any sound.

We asked if the replacement policy was open to all customers worldwide – our contact is in Europe.

One poor punter on the forum is from Brazil and pointed out it was a long trip to his nearest Bose service centre – in Mexico.

Source: Bose customers beg for firmware ceasefire after headphones fall victim to another crap update • The Register

Princesses make terrible passwords – quite possible Disney+ hacks related to this being your password.

Posted on by

If you used the same password for an account that was previously breached as you did for your Disney+ password, a bad actor could gain access. Furthermore, hackers with stolen datasets at their fingertips could easily filter on key terms to find the Disney fans. Just look how many times the 12 Disney princesses showed up in breached datasets, according to haveibeenpwned.com:

Then there are these terms that a dedicated Disney fan might choose in a moment of weakness:

Friends, it’s a whole new world out there. Data breaches happen, with data files swapped and sold in the dark corners of the web. No one knows how far it goes. That’s why good password habits are more important than ever, and you can’t let it go. Picking unique passwords for each account is one of the the bare necessities of online life. It’s OK to admit that you need help, because when it comes to remembering passwords, who among us can snap our fingers and say “remember me.”

Source: Princesses make terrible passwords | The Firefox Frontier

Job loss predictions over rising minimum wages haven’t come true – Axios

Posted on by

Eighteen states rang in 2019 with minimum wage increases — some that will ultimately rise as high as $15 an hour — and so far, opponents’ dire predictions of job losses have not come true.

What it means: The data paint a clear picture: Higher minimum wage requirements haven’t reduced hiring in low-wage industries or overall.

State of play: Opponents have long argued that raising the minimum wage will cause workers to lose their jobs and prompt fast food chains (and other stores) to raise prices.

But job losses and price hikes haven’t been pronounced in the aftermath of a recent wave of city and state wage-boost laws.

  • And more economists are arguing that the link between minimum wage hikes and job losses was more hype than science.

What we’re hearing: “The minimum wage increase is not showing the detrimental effects people once would’ve predicted,” Diane Swonk, chief economist at international accounting firm Grant Thornton, tells Axios.

  • “A lot of what we’re seeing in politics is old economic ideology, not what economics is telling us today.”

[…]

Axios used Bureau of Labor Statistics data to compare job growth rates in four states with low minimum wages vs. eight states with high minimum wages:

  • Since 2016, when California became the first state to pass the $15 minimum wage law, all 12 states have seen growth in restaurant, bar and hotel jobs.
  • Three of the four states with job growth higher than the U.S. median have passed laws that will raise the state minimum wage to at least $13.50.
  • Three of the five states with the slowest job growth rates did not have a state minimum wage above the federal minimum of $7.25 an hour.
  • An outlier was Massachusetts, which had the slowest job growth in the sector and currently has the highest state minimum wage: $12 an hour.

The big picture: A number of peer-reviewed academic studies have found little to no impact on hiring as states and municipalities have raised the minimum wage.

  • Rather, such increases are likely to have increased hiring in the strong U.S. economy, Bill Spriggs, chief economist at labor union AFL-CIO, tells Axios.

Source: Job loss predictions over rising minimum wages haven’t come true – Axios

We are absolutely, definitively, completely and utterly out of IPv4 addresses, warns RIPE

Posted on by

It happened four years ago. And again two years ago. And last year. But this time, on November 25, 2019, we have finally, finally, finally run out of IPv4 addresses.

That’s according to RIPE, Europe’s regional internet registry, which announced on Monday “we made our final /22 IPv4 allocation from the last remaining addresses in our available pool. We have now run out of IPv4 addresses.”

That’s not to be confused with the time in April 2018 when RIPE announced it had allocated its last /8 block. Or six years earlier than that when RIPE said it has run out of IPv4 addresses. Because this time, it really has run out. No more IPv4 addresses ever.

Well, except for those that it “will continue to recover… from organizations that have gone out of business or are closed, or from networks that return addresses they no longer need.” There is a waiting list for that however.

What the hell is going on? Do we have IPv4 addresses or not?

Well, yes and no. We are all using them as we speak. And engineers will continue to figure out ways of making what we have work for them. And blocks continue to crop up when old businesses die and sell them off. And then there’s the growing grey market in IPv4 sales.

Source: We are absolutely, definitively, completely and utterly out of IPv4 addresses, warns RIPE • The Register

Elon Musk Explains Why Tesla’s Cybertruck Windows Smashed During Presentation

Posted on by

When Elon Musk unveiled the Tesla Cybertruck last week, things didn’t go according to plan when lead designer Franz von Holzhausen tested the durability of the Cybertruck’s “armor glass.” He managed to smash two of the vehicle’s windows onstage with a metal ball, soon after smacking the door with a sledgehammer (unlike the glass, it was fine). We have now learned that, according to Musk, it was this sledgehammer impact that damaged the glass, which is why the windows subsequently smashed when hit by the ball. The Verge reports: This seems plausible, especially as Musk also shared a slow motion video of von Holzhausen performing the same exact test before the event, with the ball bouncing harmlessly off the window. The combined impacts likely weakened the glass, setting the stage for the eventual smash. (Though why the back window broke as well isn’t clear: the passenger door didn’t get whomped by the sledgehammer.) At any rate, the smashed glass was just one moment in an event which gave viewers plenty to talk about without the on-stage mishaps. The divisive design and impressive specs of the Cybertruck have caught the world’s attention, and since the unveiling Musk has been drip-feeding bits of information on Twitter to keep people engaged.

Source: Elon Musk Explains Why Tesla’s Cybertruck Windows Smashed During Presentation – Slashdot

.org being sold off to richest people in world and ex-ceo in massive moneygrab, harming non-profits in the process.

Posted on by

This past weekend, the board of the organization that is selling the rights to .org, and which will likely make $1bn or more from the sale, the Internet Society, met. On both the Saturday and Sunday, the proposed sale was a key topic of conversation. It has just to provide any details on what was discussed or decided.

The same cannot be said for those opposed to the deal.

One of the earliest indicators that the deal was going to meet a very different response from the internet community than the Internet Society (ISOC) expected came in the form of an article written by one person who has set up and run their own registry.

Co-founder of the .eco top-level domain Jacob Malthouse wrote an impassioned plea online that began, “I woke up this morning feeling a profound sense of loss.” An environmental campaigner as well as a former staffer of ICANN, Malthouse compared the sale of the .org registry to the paving over of forests.

The proudly non-profit .org registry, that had for years sold its domains for just $1 to non-profits in developing countries, is “our Yosemite,” Malthouse opined, referring to America’s world-famous national park. In selling it to a for-profit private equity firm, he argued, “we’ve lost more than a digital Yosemite. We’ve lost our principles. We can do better. The millions of nonprofits who rely on .org deserve better.”

That sentiment was quickly echoed in the broader internet industry community, which, even in the era of Twitter, Facebook and Instagram, continues to rely on mailing lists as its main form of communication.

Both ICANN and ISOC are member-based organizations and, theoretically at least, give as an equal voice to ordinary netizens as to the corporations that make billions a year from the sale and resale of internet addresses.

[…]

As we reported last week, the situation is especially fraught due to two additional factors. The first is that the offer to sell the rights to .org only came about because ICANN had approved the lifting of longstanding price caps on .org domains just months earlier.

The price of .org domains has been limited to an increase of 10 per cent per year since it was first handed over to the non-profit PIR in 2003. The request to remove those price caps entirely received an extraordinary response – more than 3,200 comments in a process that rarely elicits more than 50 – and a stark 98 per cent of those comments were opposed to the idea.

Approved

And yet ICANN approved the change, along with a 10-year contract extension, in an unannounced staff decision that some called a “sham” and others claimed was a sign that the organization was subject to regulatory capture.

Then came the news that ISOC had decided to sell the registry to Ethos Capital, an unknown private equity firm that had been established only months earlier.

That is where the second factor comes in. It quickly became apparent that Ethos Capital was likely the brainchild of a former CEO of ICANN, Fadi Chehade, who had been largely responsible for pushing free-market economics into the internet registry market and now appeared to be using that knowledge to profit from one of its oldest institutions.

[…]

who is funding the purchase of .org? – has been a key one. And in response to repeat questions from his community, the CEO of ISOC Andrew Sullivan provided an answer on a closed ISOC members mailing list.

The response shocked as many people as the initial sale announcement: the bulk of the money would come from the investment vehicles of renowned US Republican billionaires: Perot Holdings, tied to former presidential candidate Ross Perot; FMR LLC, closely associated with the Johnson family, one of the Republican Party’s biggest backers; and Solamere Capital, tied to Republican senator Mitt Romney.

Everything must go

To some, the fact that the .org registry was being sold to the richest men in the United States who would then profit from non-profit organizations was doubly insulting.

After its board meeting ended on Sunday, ISOC published an information website about the sale on a separate website: Key Points About.org.

The site contains two pieces of information that has not previously been shared with The Register and the community: the connection between former ICANN CEO Chehade and Ethos Capital, and a support quote from ISOC president, former ICANN chair and revered internet figure Vint Cerf.

[…]

Asked on the ISOC members list about the risks of .org domain holders facing domains as much as $60 a year, Cerf surprised many when he responded: “Hard to imagine that $60/year would be a deal breaker for even small non-profits.”

Trust and wealth

That comment prompted Malthouse to point out that $60 is the equivalent of two weeks’ wages in sub-Sahara Africa, where a large number of non-profits rely on their internet presence for awareness of their efforts.

[…]

A coalition of 27 high-profile non-profits, including the Electronic Frontier Foundation (EFF), National Council of Nonprofits, YMCA, Free Software Foundation (FSF), Girls Scouts of the USA, Internet Archive, and Wikimedia Foundation, have signed a letter to ICANN urging it to stop the sale and launched a petition site that, at the time of writing, has over 7,000 supporters,

The letter warns that the sale could “do significant harm to the global NGO sector,” and that Ethos Capital “has not earned the trust of the NGO community.”

While the idea of “trust” may seem unusual in the context of internet addresses, it also underscores the growing anger being directed at those on the boards of both ICANN and ISOC that the internet community feels are supposed to protect ordinary users from the profit-making imperatives of large corporations and corporate raiders.

Source: As pressure builds over .org sell-off, internet governance orgs fall back into familiar pattern: Silence • The Register

NextCry Ransomware Targets NextCloud Linux Servers and Remains Undetected Features

Posted on by

The ransom note that NextCry victims receive reads ““READ_FOR_DECRYPT”, and demands 0.025 BTC for a victim’s files to be unlocked.

One NextCloud user, xact64, shared his experience with the malware on a Bleeping Computer forum in an effort to find a way to decrypt personal files which had been instantaneously locked in a NextCry attack: “I realized immediately that my server got hacked and those files got encrypted. “The first thing I did was pull the server to limit the damage that was being done (only 50% of my files got encrypted).” He added, “I have my own Linux server (an old thin client I gave a second life) with NGINX reverse-proxy”.

This statement provides insight into how hackers may have been able to access his system. On October 24, NextCloud disclosed a remote code execution vulnerability (CVE-2019-11043) which has been exploited to compromise servers with the default Nextcloud NGINX configuration.

NextCloud recommends that administrators upgrade their PHP packages and NGINX configuration file to the latest version to protect against NextCry attacks.

Source: NextCry Ransomware Targets NextCloud Linux Servers and Remains Undetected Features

Bad news: ‘Unblockable’ web trackers emerge. Good news: Firefox with uBlock Origin can stop it. Chrome, not so much

Posted on by

Developers working on open-source ad-blocker uBlock Origin have uncovered a mechanism for tracking web browsers around the internet that defies today’s blocking techniques.

A method to block this so-called unblockable tracker has been developed by the team, though it only works in Firefox, leaving Chrome and possibly other browsers susceptible. This fix is now available to uBlock Origin users.

The tracker relies on DNS queries to get past browser defenses, so some form of domain-name look-up filtering could thwart this snooping. As far as netizens armed with just their browser and a regular old content-blocker plugin are concerned, this tracker can sneak by unnoticed. It can be potentially used by advertising and analytics networks to fingerprint netizens as they browse through the web, and silently build up profiles of their interests and keep count of pages they visit.

And, interestingly enough, it’s seemingly a result of an arms race between browser makers and ad-tech outfits as they battle over first and third-party cookies.

[…]

Many marketers, keen on maintaining their tracking and data collection capabilities, have turned to a technique called DNS delegation or DNS aliasing. It involves having a website publisher delegate a subdomain that the third-party analytics provider can use and aliasing it to an external server using a CNAME DNS record. The website and its external trackers thus seem to the browser to be coming from the same domain and are allowed to operate.

As Eulerian explains on its website, “The collection taking place under the name of the advertiser, and not under a third party, neither the ad blockers nor the browsers, interrupt the calls of tags.”

But wait, there’s more

Another marketing analytics biz, Wizaly, also advocates this technique to bypass Apple’s ITP 2.2 privacy protections.

As does Adobe, which explains on its website that one of the advantages of CNAME records for data collection is they “[allow] you to track visitors between a main landing domain and other domains in browsers that do not accept third-party cookies.”

In a conversation with The Register, Aeris said Criteo, an ad retargeting biz, appears to have deployed the technique to their customers recently, which suggests it will become more pervasive. Aeris added that DNS delegation clearly violates Europe’s GDPR, which “clearly states that ‘user-centric tracking’ requires consent, especially in the case of a third-party service usage.”

A recent statement from the Hamburg Commissioner for Data Protection and Freedom of Information in Germany notes that Google Analytics and similar services can only be used with consent.

“This exploit has been around for a long time, but is particularly useful now because if you can pretend to be a first-party cookie, then you avoid getting blocked by ad blockers, and the major browsers – Chrome, Safari, and Firefox,” said Augustine Fou, a cybersecurity and ad fraud researcher who advises companies about online marketing, in an email to The Register.

“This is an exploit, not an ‘oopsies,’ because it is a hidden and deliberate action to make a third-party cookie appear to be first-party to skirt privacy regulations and consumer choice. This is yet another example of the ‘badtech industrial complex’ protecting its river of gold.”

[…]

Two days ago, uBlock Origin developer Raymond Hill deployed a fix for Firefox users in uBlock Origin v1.24.1b0. Firefox supports an API to resolve the hostname of a DNS record, which can unmask CNAME shenanigans, thereby allowing developers to craft blocking behavior accordingly.

“uBO is now equipped to deal with third-party disguised as first-party as far as Firefox’s browser.dns allows it,” Hill wrote, adding that he assumes this can’t be fixed in Chrome at the moment because Chrome doesn’t have an equivalent DNS resolution API.

Aeris said, “For Chrome, there is no DNS API available, and so no easy way to detect this,” adding that Chrome under Manifest v3, a pending revision of Google’s extension platform, will break uBO. Hill, uBO’s creator, recently confirmed to The Register that’s still the case.

Even if Chrome were to implement a DNS resolution API, Google has made it clear it wants to maintain the ability to track people on the web and place cookies, for the sake of its ad business.

Apple’s answer to marketer angst over being denied analytic data by Safari has been to propose a privacy-preserving ad click attribution scheme that allows 64 different ad campaign identifiers – so marketers can see which worked.

Google’s alternative proposal, part of its “Privacy Sandbox” initiative, calls for an identifier field capable of storing 64 bits of data – considerably more than the integer 64.

As the Electronic Frontier Foundation has pointed out, this enables a range of numbers up to 18 quintillion, allowing advertisers to create unique IDs for every ad impression they serve, information that could then be associated with individual users.

Source: Bad news: ‘Unblockable’ web trackers emerge. Good news: Firefox with uBlock Origin can stop it. Chrome, not so much • The Register

Extraterrestrial ribose and other sugars found in primitive meteorites

Posted on by

Ribose is an essential sugar for present life as a building block of RNA, which could have both stored information and catalyzed reactions in primitive life on Earth. Meteorites contain a number of organic compounds including components of proteins and nucleic acids. Among the constituent molecular classes of proteins and nucleic acids (i.e., amino acids, nucleobases, phosphate, and ribose/deoxyribose), the presence of ribose and deoxyribose in space remains unclear. Here we provide evidence of extraterrestrial ribose and other bioessential sugars in primitive meteorites. Meteorites were carriers of prebiotic organic molecules to the early Earth; thus, the detection of extraterrestrial sugars in meteorites implies the possibility that extraterrestrial sugars may have contributed to forming functional biopolymers like RNA.

Source: Extraterrestrial ribose and other sugars in primitive meteorites | PNAS

1.2 Billion Records Found Exposed Online in a Single Server, contain social media profiles

Posted on by

In October, dark web researcher Vinny Troia found one such trove sitting exposed and easily accessible on an unsecured server, comprising 4 terabytes of personal information—about 1.2 billion records in all.

While the collection is impressive for its sheer volume, the data doesn’t include sensitive information like passwords, credit card numbers, or Social Security numbers. It does, though, contain profiles of hundreds of millions of people that include home and cell phone numbers, associated social media profiles like Facebook, Twitter, LinkedIn, and Github, work histories seemingly scraped from LinkedIn, almost 50 million unique phone numbers, and 622 million unique email addresses.

“It’s bad that someone had this whole thing wide open,” Troia says. “This is the first time I’ve seen all these social media profiles collected and merged with user profile information into a single database on this scale. From the perspective of an attacker, if the goal is to impersonate people or hijack their accounts, you have names, phone numbers, and associated account URLs. That’s a lot of information in one place to get you started.”

Source: 1.2 Billion Records Found Exposed Online in a Single Server  | WIRED

Sacha Baron Cohen gave the greatest speech on why social networks need to be kept in check, biggest propaganda machines in history

Posted on by

Cohen gave the speech yesterday, at an awards gala for the Anti-Defamation League (ADL), where he was the recipient of ADL’s International Leadership Award.

While accepting his award, Cohen touched on the role companies like Facebook, Google, and Twitter have played in spreading lies and hate speech online, calling the sites “the greatest propaganda machine in history.”

Cohen’s speech, in video format is embedded above. Below is a short summary of his main talking points. A full transcript, courtesy of the ADL, is embedded below the summary:

  • Cohen called Facebook, YouTube and Google, Twitter and others — the biggest propaganda machine in history.
  • He coined the term “Silicon Six” to describe the six US billionaires that control this machine — naming Zuckerberg at Facebook, Sundar Pichai at Google, Larry Page and Sergey Brin at Alphabet, Susan Wojcicki at YouTube, and Jack Dorsey at Twitter.
  • The actor ripped Zuckerberg for defending holocaust deniers.
  • He ripped Zuckerberg for his platform facilitating Russia’s interference in US elections.
  • He ripped Zuckerberg for facilitating the Myanmar genocide.
  • Said if another genocide takes place, Zuckerberg needs to go to jail.
  • Cohen ripped Facebook for allowing political ads. Said if Facebook existed in the 1930s they would have allowed Hitler to post “post 30-second ads on his ‘solution’ to the ‘Jewish problem’.”
  • Cohen likened the Christchurch massacre video to “a snuff film broadcast by social media.”
  • He said social media sites are today’s largest publishers, and should have to abide to the same standards that newspapers, radio, and TV stations abide.
  • He agreed that social media should function based on government-mandated rules, and not by internal policies set by billionaires more focused on protecting share prices than human life. He called “for regulation and legislation to curb the greed of these high-tech robber barons.”

Source: Sacha Baron Cohen gave the greatest speech on why social networks need to be kept in check | ZDNet

Monero Wallet downloads compromised for 35 minutes

Posted on by

Security Warning: CLI binaries available on getmonero.org may have been compromised at some point during the last 24h.
byu/binaryFate inMonero

Some users noticed the hash of the binaries they downloaded did not match the expected one: https://github.com/monero-project/monero/issues/6151
It appears the box has been indeed compromised and different CLI binaries served for 35 minutes. Downloads are now served from a safe fallback source.

Always check the integrity of the binaries you download!

If you downloaded binaries in the last 24h, and did not check the integrity of the files, do it immediately. If the hashes do not match, do NOT run what you downloaded. If you have already run them, transfer the funds out of all wallets that you opened with the (probably malicious) executables immediately, using a safe version of the Monero wallet (the one online as we speak is safe — but check the hashes).

More information will be posted as several people are currently investigating to get to the bottom of this.

Correct hashes are available here (check the signature): https://web.getmonero.org/downloads/hashes.txt

Police can keep Amazon Ring camera video forever, and share with whomever they’d like, company tells senator

Posted on by

More than 600 police forces across the country have entered into partnerships with the camera giant allowing them to quickly request and download video captured by Ring’s motion-detecting, internet-connected cameras inside and around Americans’ homes.

The company says the videos can be a critical tool in helping law enforcement investigate crimes such as trespassing, burglary and package theft. But some lawmakers and privacy advocates say the systems could also empower more widespread police surveillance, fuel racial profiling and spark new neighborhood fears.

In September, following a report about Ring’s police partnerships in The Washington Post, Sen. Edward Markey, D-Mass., wrote to Amazon asking for details about how it protected the privacy and civil liberties of people caught on camera. Since that report, the number of law enforcement agencies working with Ring has increased nearly 50%.

In two responses from Amazon’s vice president of public policy, Brian Huseman, the company said it placed few restrictions on how police used or shared the videos offered up by homeowners. (Amazon CEO Jeff Bezos also owns The Washington Post.)

Police in those communities can use Ring software to request up to 12 hours of video from anyone within half a square mile of a suspected crime scene, covering a 45-day time span, Huseman said. Police are required to include a case number for the crime they are investigating, but not any other details or evidence related to the crime or their request.

Markey said in a statement that Ring’s policies showed the company had failed to enact basic safeguards to protect Americans’ privacy.

“Connected doorbells are well on their way to becoming a mainstay of American households, and the lack of privacy and civil rights protections for innocent residents is nothing short of chilling,” he said.

“If you’re an adult walking your dog or a child playing on the sidewalk, you shouldn’t have to worry that Ring’s products are amassing footage of you and that law enforcement may hold that footage indefinitely or share that footage with any third parties.”

Ring, which Amazon bought last year for more than $800 million, did not immediately respond to requests for comment.

Source: Police can keep Ring camera video forever, and share with whomever they’d like, company tells senator – Stripes

Why tech companies need to hire philosophers

Posted on by

I have spent the better half of the last two years trying to convince companies like Google, Facebook, Microsoft, DeepMind, and OpenAI that they need to hire philosophers.

My colleagues and I—a small collective of academics that make up a program called Transformations of the Human at the Los Angeles-based think tank called the Berggruen Institute—think that the research carried out by these companies has been disrupting the very concept of the human that we—in the West particularly—have taken for granted for almost half a millennium.

It’s not only that, though. These companies have helped create realities that we can no longer navigate with the old understanding of what it means to be human.

We need new ones—for ourselves, so that we are able to navigate and regulate the new worlds we live in, but also for the engineers who create tech products, tools, and platforms, so that they can live up to the philosophical stakes of their work.

To make that possible, we need philosophers and artists working alongside computer and software engineers.

[…]

I realized that fields like AI and microbiome research or synthetic biology not only undermine the historic way we think of the human—they also allow for new possibilities for understanding the world.

It suddenly dawned on me that I could look at each one of these fields, not just AI and the microbiome, but also synthetic biology, biogeochemistry, and others, as if they were a kind of philosophical laboratory for re-articulating our reality.

[…]

We are living in an era of a major, most far-reaching philosophical event: A radical re-articulation of what it is to be human and of the relation between humans, nature, and technology.

Yet at present, no one really formally talks about this philosophical quality of tech. Hence, no one attends to it, with the inevitable consequence that the sweeping re-articulation of the human unfolds around us in a haphazard, entirely unconscientious way.

Shouldn’t we try to change this?

When I shared my enthusiasm with my colleagues in academia, I found that what was exciting to me was an unbearable provocation for many others.

My suggestion that the question concerning the human has migrated into the fields of the natural sciences and engineering—that is, into fields not concerned with the traditional study of the human and humanity at all—were received as threat to academics in the arts. If humans are no longer more than nature or machines, then what are the arts even good for?

[…]

Today, we have philosophy and art teams at Element AI, Facebook, and Google, and also at AI labs at MIT, Berkeley, and Stanford. Our researchers are in regular conversation with DeepMind, OpenAI, and Microsoft.

[…]

What we need now is a completely new model for an educational institution, one that can produce a new kind of practitioner.

We need a workforce that thinks differently, and that can understand engineering, from AI to microbiome research to synthetic biology to geoengineering and many other fields—as philosophical and artistic practices that ceaselessly re-invent the human.

Almost every month, you’ll likely read about another billion-dollar endowment for a new tech school. On the one hand, there’s nothing wrong with this—I agree we always need better, smarter, tech.

On the other hand, these tech schools tend to reproduce the old division of labor between the faculty of arts and the faculties of science and engineering. That is, they tend to understand tech as just tech and not as the philosophical and artistic field that it is.

What we need are not so much tech schools, as institutions that combine philosophy, art, and technology into one integrated curriculum.

Source: Why tech companies need to hire philosophers — Quartz

I completely agree with Mr Tobias Rees

This article is absolutely worth reading in full.

Android Users: Check Now to See If a Rogue App Can Control Your Phone’s Camera

Posted on by

According to an investigation by Checkmarx security researchers, some Android devices may have an unpatched security flaw that an app could use to record you without your knowledge using your device’s camera and mic.

No attacks that exploit the bug have been reported so far, thankfully. Still, the Checkmarx researchers were able to successfully create and execute commands that could remotely record phone calls; capture photos, video, and audio; access GPS metadata from photos; and even check whether the phone was facing down—meaning hackers may one day create their own clever attacks for devices running an unpatched version of a device’s default camera apps.

Google and Samsung released patches for impacted smartphones earlier this year, but Checkmarx’s report suggests that many other Android smartphones may still be affected. Fortunately, there are ways you can check if your device has been patched.

Check for the bug on Pixel phones

Pay attention to the “Last Updated” date
Pay attention to the “Last Updated” date
Screenshot: Brendan Hesse

Pixel users can check for the patch easily: simply open your device’s settings then go to Apps & Notifications > See All Apps > Camera > Advanced > App details to open the app’s Google Play Store page. If the app has been updated since July 2019, you’re in the clear.

Check for the bug on other Android devices (manually)

If you’re not sure whether your smartphone’s manufacturer has issued an update for your phone’s camera app that fixes this bug, one way to find out is to try exploiting the bug yourself (which comes care of Ars Technica).

You’ll need:

  • A PC (this will work on Windows, Mac, and Linux).
  • Your Android device.
  • A USB cable to connect them.

Once you have those materials, here’s what you need to do:

  1. First, you’ll need to install and configure ADB tools on your PC. All the necessary files and instructions for installing ADB for your PC’s OS can be found on the XDA Developer Forums.
  2. After ADB is installed and configured, plug your Android phone into your PC with the USB cable. Next, we’re going to try to use codes to force the phone to take videos and photos without accessing the phone’s camera app.
  3. Open your PC’s command terminal. On Windows: Press “Windows Key+R,” then type “cmd” and hit “run.” On Mac: Press “Command+Space” to open the Finder, then type “Terminal” and double click the Terminal icon to run.
  4. In the command prompt window, run the following commands one at a time:

adb
shell am start-activity
-ncom.google.android.GoogleCamera/com.android.camera.CameraActivity
—ezextra_turn_screen_on true -a android.media.action.VIDEO_CAMERA
—ezandroid.intent.extra.USE_FRONT_CAMERA true

Then:

adb
shell am start-activity
-ncom.google.android.GoogleCamera/com.android.camera.CameraActivity
—ezextra_turn_screen_on true -a android.media.action.STILL_IMAGE_CAMERA
—ez android.intent.extra.USE_FRONT_CAMERA true
—eiandroid.intent.extra.TIMER_DURATION_SECONDS 3

Open your phone’s camera app and go to your photo/video library to check if the commands worked. If you find a new photo or video, then the bug is present on your device.

If you haven’t updated your device’s camera app in awhile, try checking for updates via the Google Play Store. Once you’ve installed anything that’s available for your phone’s default camera app, try the above ADB commands again. If they still work, you should report the issue to your device’s manufacturer as soon as possible. In addition, stay away from unknown camera, video, or audio recording apps, since this is the most likely method for hackers to slip malicious code onto your device and take a few photos.

Source: Android Users: Check Now to See If a Rogue App Can Control Your Phone’s Camera