17 Scientists call for global moratorium on gene editing of embryos – where’s the fun in that?

The move is intended to send a clear signal to maverick researchers, and the scientific community more broadly, that any attempt to rewrite the DNA of sperm, eggs or embryos destined for live births is not acceptable.

Beyond a formal freeze on any such work, the experts want countries to register and declare any plans that scientists may put forward in the future, and have these discussed through an international body, potentially run by the World Health Organisation.

Alongside technical debates about the possible benefits of creating genetically modified babies, the scientists said no decisions should be made to go ahead without broad public support.

“What we want to see are wise and open decisions,” said Eric Lander, founding director of the Broad Institute of MIT and Harvard in Cambridge, Massachusetts. “We want to make sure that countries don’t do things secretly, that we declare what we’re thinking, discuss it openly, and be prepared for debate and disagreement.”

Lander, who co-chaired Barack Obama’s council of advisors on science and technology, calls for the moratorium with 16 other experts in the journal Nature. Emmanuelle Charpentier and Feng Zhang, who helped discover and develop the most common gene editing tool, Crispr, contributed to the article.

Source: Scientists call for global moratorium on gene editing of embryos | Science | The Guardian

Designer babies are a great idea, if I could I would definitely create my own! This sounds a bit like an anti-diversity policy to me. Go! Create!

MtGox bitcoin founder gets suspended sentence for data tampering

A Japanese court sentenced the former high-flying creator of the MtGox bitcoin exchange to a suspended jail sentence of two and a half years Friday after finding him guilty of data manipulation.

The Tokyo District Court convicted Mark Karpeles, a 33-year-old computer whizz from France, for tampering with computer data but acquitted him over charges of embezzling millions from client accounts.

The sentence was suspended for four years.

In a summary of the ruling, the court said Karpeles had “harmed the users’ trust greatly” by manipulating data and “abused his expertise as an IT engineer and his position and authority”.

Prosecutors had claimed that Karpeles had pocketed some 341 million yen ($3 million) of client’s money and splashed it on a lavish lifestyle. They called for him to serve 10 years behind bars.

However, in throwing out the embezzlement charges, the judge said there was no financial damage done to MtGox and ruled that Karpeles did not intend to cause any damage.

The judge cited an expert opinion that said owners of small and medium enterprises often borrow funds without proper accounting and ruled that the court assumed Karpeles intended to return the money.

Karpeles entered the courtroom wearing a dark suit and black shoes and he bowed politely to the judge. He was motionless after the verdict was read out.

After the sentencing, the judge asked if Karpeles understood the sentence. Karpeles responded simply: “Yes, I did.”

‘Cold wallet’

MtGox was shut down in 2014 after 850,000 bitcoins (worth half a billion dollars at that time) disappeared from its virtual vaults.

The scandal left a trail of angry investors, rocked the virtual currency community, and dented confidence in the security of .

At one point, MtGox claimed to be handling around 80 percent of all global bitcoin transactions.

During his trial, Karpeles apologised to customers for the company’s bankruptcy but denied both data falsification and embezzlement.

“I swear to God that I am innocent,” Karpeles, speaking in Japanese, told the three-judge panel hearing when his trial opened in 2017.Karpeles always claimed the bitcoins were lost due to an external “hacking attack” and later claimed to have found some 200,000 coins in a “cold wallet”—a storage device not connected to other computers.

“Most people will not believe what I say. The only solution I have is to actually find the real culprits,” he told reporters his trial hearing in July 2017.

Doubts about bitcoin

The acquittal on embezzlement came as a surprise as the vast majority of cases that come to trial in Japan end in a conviction.

Karpeles himself said in an interview with French business daily Les Echos on Wednesday that he had little chance of acquittal.

“All I can hope for is a light sentence which will mean I do not have to go back into detention and do forced work,” he said.

The Frenchman was first arrested in August 2015 and, in an echo of another high-profile case against former Nissan chief and compatriot Carlos Ghosn, was re-arrested several times on different charges.

Karpeles eventually won bail in July 2016—nearly a year after his arrest—paying 10 million yen to secure his freedom pending a trial, which began in July 2017.

During his time on bail, Karpeles has been active on social media—notably voicing doubts about bitcoin and replying to some media questions about conditions in Japanese detention centres.

However, he has largely avoided commenting on his case in detail.

In many ways, the rollercoaster ride of Karpeles has mirrored that of the bitcoin cryptocurrency that made him rich.

At its height in December 2017, the value of a single bitcoin was around $20,000.

It has since slumped and is now worth just under $4,000.

Read more at: https://phys.org/news/2019-03-mtgox-bitcoin-founder-sentence-tampering.html#jCp

Source: MtGox bitcoin founder gets suspended sentence for data tampering

US Air Force buys new  build 70s era vintage F-15EX fleet because F-35 is too expensive

The new-build F-15 was not part of the service’s original budget plans, but was added because the type has lower lifetime operating costs, the USAF acknowledges. The service is committed to buying 72 fighters per year, but cannot afford to purchase only F-35As because of that aircraft’s high operating costs – which average about $35,000 per hour.

“Our challenge was when you look at the force structure that we have there were four fourth-[generation] airplanes – F-16, F-15E, A-10 and F-15C – that we need to fly in [the] 2030s. The F-15C is not going to make it. It is old and it is not going to fly past the mid-20s,” USAF chief of staff General David Goldfein said in testimony to the US Senate Appropriations Committee on 13 March.

“We used the best cost estimate that we had at the time and looked at the various options. The most affordable options – as long as we keep the F-35 absolutely on track with our programme of record – was to look at an F-15 variant to replace the F-15C.”

As part of the Department of Defense’s fiscal year 2020 funding request, the USAF is initially requesting $1.1 billion for eight F-15EXs. The service plans to request 80 of the aircraft in total over the next five years, costing roughly $80 million each. The first F-15EXs are expected to be delivered in FY2022.

Source: US Air Force sees F-15EX as cheap and quick fix

Physicists reverse time using quantum computer

Researchers from the Moscow Institute of Physics and Technology teamed up with colleagues from the U.S. and Switzerland and returned the state of a quantum computer a fraction of a second into the past. They also calculated the probability that an electron in empty interstellar space will spontaneously travel back into its recent past. The study is published in Scientific Reports.

“This is one in a series of papers on the possibility of violating the . That law is closely related to the notion of the arrow of time that posits the one-way direction of time from the past to the future,” said the study’s lead author Gordey Lesovik, who heads the Laboratory of the Physics of Quantum Information Technology at MIPT.

“We began by describing a so-called local perpetual motion machine of the second kind. Then, in December, we published a paper that discusses the violation of the second law via a device called a Maxwell’s demon,” Lesovik said. “The most recent paper approaches the same problem from a third angle: We have artificially created a state that evolves in a direction opposite to that of the thermodynamic arrow of time.”

What makes the future different from the past

Most laws of physics make no distinction between the future and the past. For example, let an equation describe the collision and rebound of two identical billiard balls. If a close-up of that event is recorded with a camera and played in reverse, it can still be represented by the same equation. Moreover, it is not possible to distinguish from the recording if it has been doctored. Both versions look plausible. It would appear that the billiard balls defy the intuitive sense of time.

However, imagine recording a cue ball breaking the pyramid, the billiard balls scattering in all directions. In that case, it is easy to distinguish the real-life scenario from reverse playback. What makes the latter look so absurd is our intuitive understanding of the second law of thermodynamics—an isolated system either remains static or evolves toward a state of chaos rather than order.

Most other laws of physics do not prevent rolling billiard balls from assembling into a pyramid, infused tea from flowing back into the tea bag, or a volcano from “erupting” in reverse. But these phenomena are not observed, because they would require an isolated system to assume a more ordered state without any outside intervention, which runs contrary to the second law. The nature of that law has not been explained in full detail, but researchers have made great headway in understanding the basic principles behind it.

Spontaneous time reversal

Quantum physicists from MIPT decided to check if time could spontaneously reverse itself at least for an individual particle and for a tiny fraction of a second. That is, instead of colliding billiard balls, they examined a solitary electron in empty interstellar space.

“Suppose the electron is localized when we begin observing it. This means that we’re pretty sure about its position in space. The laws of quantum mechanics prevent us from knowing it with absolute precision, but we can outline a small region where the electron is localized,” says study co-author Andrey Lebedev from MIPT and ETH Zurich.

The physicist explains that the evolution of the electron state is governed by Schrödinger’s equation. Although it makes no distinction between the future and the past, the region of space containing the electron will spread out very quickly. That is, the system tends to become more chaotic. The uncertainty of the electron’s position is growing. This is analogous to the increasing disorder in a large-scale system—such as a billiard table—due to the second law of thermodynamics.

The four stages of the actual experiment on a quantum computer mirror the stages of the thought experiment involving an electron in space and the imaginary analogy with billiard balls. Each of the three systems initially evolves from order …more

“However, Schrödinger’s equation is reversible,” adds Valerii Vinokur, a co-author of the paper, from the Argonne National Laboratory, U.S. “Mathematically, it means that under a certain transformation called complex conjugation, the equation will describe a ‘smeared’ electron localizing back into a small region of space over the same time period.” Although this phenomenon is not observed in nature, it could theoretically happen due to a random fluctuation in the cosmic microwave background permeating the universe.The team set out to calculate the probability to observe an electron “smeared out” over a fraction of a second spontaneously localizing into its recent past. It turned out that even across the entire lifetime of the universe—13.7 billion years—observing 10 billion freshly localized electrons every second, the reverse evolution of the particle’s state would only happen once. And even then, the electron would travel no more than a mere one ten-billionth of a second into the past.

Large-scale phenomena involving billiard balls and volcanoes obviously unfold on much greater timescales and feature an astounding number of and other particles. This explains why we do not observe old people growing younger or an ink blot separating from the paper.

Reversing time on demand

The researchers then attempted to reverse time in a four-stage experiment. Instead of an electron, they observed the state of a quantum computer made of two and later three basic elements called superconducting qubits.

  • Stage 1: Order. Each qubit is initialized in the ground state, denoted as zero. This highly ordered configuration corresponds to an electron localized in a small region, or a rack of billiard balls before the break.
  • Stage 2: Degradation. The order is lost. Just like the electron is smeared out over an increasingly large region of space, or the rack is broken on the pool table, the state of the qubits becomes an ever more complex changing pattern of zeros and ones. This is achieved by briefly launching the evolution program on the quantum computer. Actually, a similar degradation would occur by itself due to interactions with the environment. However, the controlled program of autonomous evolution will enable the last stage of the experiment.
  • Stage 3: Time reversal. A special program modifies the state of the quantum computer in such a way that it would then evolve “backwards,” from chaos toward order. This operation is akin to the random microwave background fluctuation in the case of the electron, but this time, it is deliberately induced. An obviously far-fetched analogy for the billiards example would be someone giving the table a perfectly calculated kick.
  • Stage 4: Regeneration. The evolution program from the second stage is launched again. Provided that the “kick” has been delivered successfully, the program does not result in more chaos but rather rewinds the state of the qubits back into the past, the way a smeared electron would be localized or the billiard balls would retrace their trajectories in reverse playback, eventually forming a triangle.

The researchers found that in 85 percent of the cases, the two-qubit quantum computer returned back into the initial state. When three qubits were involved, more errors happened, resulting in a roughly 50 percent success rate. According to the authors, these errors are due to imperfections in the actual quantum computer. As more sophisticated devices are designed, the error rate is expected to drop.

Interestingly, the time reversal algorithm itself could prove useful for making quantum computers more precise. “Our algorithm could be updated and used to test programs written for computers and eliminate noise and errors,” Lebedev explained.

Read more at: https://phys.org/news/2019-03-physicists-reverse-quantum.html#jCp

Source: Physicists reverse time using quantum computer

Nonprofit OpenAI looks at the bill to craft a Holy Grail AGI, gulps, spawns commercial arm to bag investors’ mega-bucks – the end of Open in OpenAI?

OpenAI, a leading machine-learning lab, has launched for-profit spin-off OpenAI LP – so it can put investors’ cash toward the expensive task of building artificial general intelligence.

The San-Francisco-headquartered organisation was founded in late 2015 as a nonprofit, with a mission to build, and encourage the development of, advanced neural network systems that are safe and beneficial to humanity.

It was backed by notable figures including killer-AI-fearing Elon Musk, who has since left the board, and Sam Altman, the former president of Silicon Valley VC firm Y Combinator. Altman stepped down from as YC president last week to focus more on OpenAI.

Altman is now CEO of OpenAI LP. Greg Brockman, co-founder and CTO, and Ilya Sutskever, co-founder and chief scientist, are also heading over to the commercial side and keeping their roles in the new organization. OpenAI LP stated it clearly it wants to “raise investment capital and attract employees with startup-like equity.”

There is still a nonprofit wing, imaginatively named OpenAI Nonprofit, though it is a much smaller entity considering most of its hundred or so employees have switched over to the commercial side, OpenAI LP, to reap the benefits its stock options.

“We’ve experienced firsthand that the most dramatic AI systems use the most computational power in addition to algorithmic innovations, and decided to scale much faster than we’d planned when starting OpenAI,” the lab’s management said in a statement this week. “We’ll need to invest billions of dollars in upcoming years into large-scale cloud compute, attracting and retaining talented people, and building AI supercomputers.”

OpenAI refers to this odd split between OpenAI LP and OpenAI Nonprofit as a “capped-profit” company. The initial round of investors, including LinkedIn cofounder Reid Hoffman and Khosla Ventures, are in line to receive 100 times the amount they’ve invested from OpenAI LP’s profits, if everything goes to plan. Any excess funds afterwards will be handed over to the non-profit side. In order to pay back these early investors, and then some, OpenAI LP will have to therefore find ways to generate fat profits from its technologies.

The reaction to the “capped-profit” model has raised eyebrows. Several machine-learning experts told The Register they were somewhat disappointed by OpenAI’s decision. It once stood out among other AI orgs for its nonprofit status, its focus on developing machine-learning know-how independent of profit and product incentives, and its dedication to open-source research.

Now, for some, it appears to be just another profit-driven Silicon Valley startup stocked with well-paid engineers and boffins.

Source: Nonprofit OpenAI looks at the bill to craft a Holy Grail AGI, gulps, spawns commercial arm to bag investors’ mega-bucks • The Register

Scientists have discovered a shape that blocks all sound–even your co-workers

A team of Boston University researchers recently stuck a loudspeaker into one end of a PVC pipe. They cranked it up loud. What did they hear? Nothing.

How was this possible? Did they block the other end of the pipe with noise canceling foams or a chunk of concrete? No, nothing of the sort. The pipe was actually left open save for a small, 3D-printed ring placed around the rim. That ring cut 94% of the sound blasting from the speaker, enough to make it inaudible to the human ear.

The mathematically designed, 3D-printed acoustic metamaterial is shaped in such a way that it sends incoming sounds back to where they came from. [Photo: Cydney Scott/Boston University]

Dubbed an “acoustic meta-material,” the ring was printed from a mathematically modeled design, shaped in such a way that it can catch certain frequencies passing through the air and reflect them back toward their source. Typical acoustic paneling works differently, absorbing sound and turning the vibrations into heat. But what’s particularly trippy is that this muffler is completely open. Air and light can travel through it–just sound cannot.

The implications for architecture and interior design are remarkable, because these metamaterials could be applied to the built environment in many different ways. For instance, they could be stacked to build soundproof yet transparent walls. Cubicles will never be the same.

The researchers also believe that HVAC systems could be fitted with these silencers, and drones could have their turbines muted with such rings. Even in MRI machines, which can be harrowingly loud for patients trapped in a small space, could be quieted. There’s really no limit to the possibilities, but it does sound like these silencers will need to be tailored to circumstance. “The idea is that we can now mathematically design an object that can blocks the sounds of anything,” says Boston University professor Xin Zhang, in a press release.

Source: Mathematically perfect rings could soundproof the world

Radio gaga: Techies fear EU directive to stop RF device tinkering will do more harm than good

EU plans to ban the sale of user-moddable radio frequency devices – like phones and routers – have provoked widespread condemnation from across the political bloc.

The controversy centres on Article 3(3)(i) of the EU Radio Equipment Directive, which was passed into law back in 2014.

However, an EU working group is now about to define precisely which devices will be subject to the directive – and academics, researchers, individual “makers” and software companies are worried that their activities and business models will be outlawed.

Article 3(3)(i) states that RF gear sold in the EU must support “certain features in order to ensure that software can only be loaded into the radio equipment where the compliance of the combination of the radio equipment and software has been demonstrated”.

If the law is implemented in its most potentially harmful form, no third-party firmware could be installed onto something like a home router, for example.

Hauke Mehrtens of the Free Software Foundation Europe (FSFE) told The Register: “If the EU forces Wi-Fi router manufacturers to prevent their customers from installing their own software onto their devices this will cause great harm to the OpenWrt project, wireless community networks, innovative startups, computer network researchers and European citizens. This would increase the electronic waste, make it impossible for the user to fix security vulnerabilities by himself or the help of the community and block research which could improve the internet in the EU.”

Source: Radio gaga: Techies fear EU directive to stop RF device tinkering will do more harm than good • The Register

Oh dear, does this not mean you don’t really own the stuff you buy?

Why Is Customer Service So Bad? Because It’s Profitable.

American consumers spend, on average, 13 hours per year in calling queue. According to a 2010 study by Mike Desmarais in the journal Cost Management, a third of complaining customers must make two or more calls to resolve their complaint. And that ignores the portion who simply give up out of exasperation after the first call. In fact, according to a 2017 survey by Customer Care Measurement and Consulting the Carey School of Business at the Arizona State University, over three quarters of complaining consumers were less than satisfied with their experience with the given company’s customer service department.

These accounts seem at odds with the pledges by many companies that they are committed to great customer service. Consider United Airlines, among the lowest ranked of major airlines on customer service, which claims to offer a “level of service to our customers that makes [United] a leader in the airline industry”. This is in line with surveys over time that indicate that consumers consistently perceive that customer service is generally bad and even possibly becoming worse. Despite promises companies make to treat people well, customers don’t seem to be buying it.

There’s some evidence that customer queues may be unavoidable at times. Caller complaints tend to arrive randomly, making it impossible to staff agents to handle unpredictable fluctuations in call volume. But our research suggests that some companies may actually find it profitable to create hassles for complaining customers, even if it were operationally costless not to.

Source: Why Is Customer Service So Bad? Because It’s Profitable.

Smart alarms left 3 million cars vulnerable to hackers who could turn off motors, unlock doors remotely

Two popular smart alarm systems for cars had major security flaws that allowed potential hackers to track the vehicles, unlock their doors and, in some cases, cut off the engine.

The vulnerabilities could be exploited with two simple steps, security researchers from Pen Test Partners, who discovered the flaw, said Friday.

The problems were found in alarm systems made by Viper and Pandora Car Alarm System, two of the largest smart car alarm makers in the world. The two brands have as many as 3 million customers between them and make high-end devices that can cost thousands. Like other smart devices, smart car alarms offer people convenience, allowing owners to find their cars from a distance and unlock their doors from their phones.

Pen Test Partners said it reached out to Viper and Pandora in late February and the companies fixed the security issues in less than a week. They had discovered the flaws last October.

Source: Smart alarms left 3 million cars vulnerable to hackers who could turn off motors – CNET

Freelance devs: Oh, you wanted the app to be secure? The job spec didn’t mention that

Freelance developers hired to implement password-based security systems do so about as effectively as computer science students, which is to say not very well at all.

Boffins at the University of Bonn in Germany set out to expand on research in 2017 and 2018 that found computer science students asked to implement a user registration system didn’t do so securely unless asked, and even then didn’t always get it right.

The scientists speculated that because the surveyed students knew they were taking part in a study, then they didn’t make security a priority. So they modified the experiment to test whether developers unaware that they were participating in a study did any better.

The eggheads – Alena Naiakshina, Anastasia Danilova, Eva Gerlitz, Emanuel von Zezschwitz, and Matthew Smith – describe their findings in a paper titled, “‘If you want, I can store the encrypted password.’ A Password-Storage Field Study with Freelance Developers.”

Their paper is scheduled to be presented at the CHI Conference on Human Factors in Computing Systems Proceedings, which runs from May 4–9, 2019, in Glasgow, Scotland.

Posing as a client trying to build a social networking site, the researchers hired 43 developers for either €100 (~$112) or €200 (~$225) from Freelancer.com to help them create a portion of the fictitious project, the site’s registration system.

Ethics

The deception was approved by the university’s Research Ethics Board and study participants were told after the conclusion of the research that they could withdraw from the study if they wished. None did and only one declined to answer the post-job questionnaire.

The freelancers were hired to work in Java and took anywhere from one to five days to complete the assigned task. Those hired ranged from 22 to 68 years in age (median: 29; mean: 30.34) and 39 of the 43 reported being male. All but two said they’d been programming for at least two years and in Java for at least one year. Most were not fluent in English.

The study confirms previous findings that if you want security, you won’t get it by default; you have to ask for it. “Our sample shows that freelancers who believe they are creating code for a real company also seldom store passwords securely without prompting,” the paper says.

The boffins also found many of the freelancers misunderstood that encryption, hashing and encoding are different things. “We found a number of freelancers were reducing password storage security to a visual representation and thus using Base64 as their preferred method to ensure security,” the paper says. “Additionally, encryption and hashing were used as synonyms, which was often reflected by the freelancers’ programming code.”

Another finding consistent with the student research is that many freelancers (16 in this instance) submitted code copied from the internet.

Source: Freelance devs: Oh, you wanted the app to be secure? The job spec didn’t mention that • The Register

From hard drive to over-heard drive: Boffins convert spinning rust into eavesdropping mic, if you shout!

Eggheads at the University of Michigan in the US, and Zhejiang University in China, have found that hard disk drives (HDDs) can be turned into listening devices, using malicious firmware and signal processing calculations.

For a study titled “Hard Drive of Hearing: Disks that Eavesdrop with a Synthesized Microphone,” computer scientists Andrew Kwong, Wenyuan Xu, and Kevin Fu describe an acoustic side-channel that can be accessed by measuring how sound waves make hard disk parts vibrate.

“Our research demonstrates that the mechanical components in magnetic hard disk drives behave as microphones with sufficient precision to extract and parse human speech,” their paper, obtained by The Register ahead of its formal publication, stated. “These unintentional microphones sense speech with high enough fidelity for the Shazam service to recognize a song recorded through the hard drive.”

The team’s research work, scheduled to be presented in May at the 2019 IEEE Symposium on Security and Privacy, explores how it’s possible to alter HDD firmware to measure the offset of a disk drive’s read/write head from the center of the track it’s seeking.

The offset is referred to as the Positional Error Signal (PES) and hard drives monitor this signal to keep the read/write head in the optimal position for reading and writing data. PES measurements must be very fine because drive heads can only be off by a few nanometers before data errors arise. The sensitivity of the gear, however, means human speech is sufficient to move the needle, so to speak.

“These extremely precise measurements are sensitive to vibrations caused by the slightest fluctuations in air pressure, such as those induced by human vocalizations,” the paper explained.

Vibrations from HDD parts don’t yield particularly good sound, but with digital filtering techniques, human speech can be discerned, given the right conditions.

Flashing HDD firmware is a prerequisite for the snooping, the paper says, because the ATA protocol does not expose the PES. This could be accomplished through traditional attack techniques – binary exploitation, drive-by downloads, or phishing – or by intercepting HDDs somewhere in the supply chain and modifying them. The researchers point to the Grayfish malware attributed to the Equation Group as an example.

[…]

One limiting aspect of the described technique is that it requires a fairly loud conversation in the vicinity of the eavesdropping hard drive. To record comprehensible speech, the conversation had to reach 85 dBA, with 75 dBA being the low threshold for capturing muffled sound. To get Shazam to identify recordings captured through a hard drive, the source file had to be played at 90 dBA. Which is pretty loud. Like lawn mower or food blender loud.

The researchers acknowledge this is louder than most practical scenarios but they say they “expect that an attacker using state of the art filtering and voice recognition algorithms can substantially amplify the channel’s strength.”

While the growing popularity of solid state drives diminish the risk even further, there were still twice as many hard drives sold with PCs in 2017 as there were solid state drives, the researchers claimed.

[…]

They also note that their work may open future research possibilities, such as using a hard disk’s read/write head as a crude sounds generator to issue spoken commands to nearby connected speakers like Alexa, Google Home, and Siri.

Source: From hard drive to over-heard drive: Boffins convert spinning rust into eavesdropping mic • The Register

Iranian hackers ransack Citrix, make off with 6TB+ of emails, biz docs, internal secrets – they had to be told by the FBI that they were hacked at all

Citrix today warned its customers that foreign hackers romped through its internal company network and stole corporate secrets.

The enterprise software giant – which services businesses, the American military, and various US government agencies – said it was told by the FBI on Wednesday that miscreants had accessed Citrix’s IT systems and exfiltrated a significant amount of data.

According to infosec firm Resecurity, which had earlier alerted the Feds and Citrix to the cyber-intrusion, at least six terabytes of sensitive internal files were swiped from the US corporation by the Iranian-backed IRIDIUM hacker gang. The spies hit in December, and Monday this week, we’re told, lifting emails, blueprints, and other documents, after bypassing multi-factor login systems and slipping into Citrix’s VPNs.

Source: Iranian hackers ransack Citrix, make off with 6TB+ of emails, biz docs, internal secrets • The Register

Chelsea Manning jailed for refusing to testify on Wikileaks

Former Army intelligence analyst Chelsea Manning, who served years in prison for leaking one of the largest troves of classified documents in U.S. history, has been sent to jail for refusing to testify before a grand jury investigating Wikileaks.

U.S. District Judge Claude Hilton ordered Manning to jail for contempt of court Friday after a brief hearing in which Manning confirmed she has no intention of testifying. She told the judge she “will accept whatever you bring upon me.”

Manning has said she objects to the secrecy of the grand jury process, and that she already revealed everything she knows at her court-martial.

The judge said she will remain jailed until she testifies or until the grand jury concludes its work.

[…]

Manning anticipated being jailed. In a statement before Friday’s hearing, she said she invoked her First, Fourth and Sixth amendment protections when she appeared before the grand jury in Alexandria on Wednesday. She said she already answered every substantive question during her 2013 court-martial, and is prepared to face the consequences of refusing to answer again.

“In solidarity with many activists facing the odds, I will stand by my principles. I will exhaust every legal remedy available,” she said.

Manning served seven years of a 35-year military sentence for leaking a trove of military and diplomatic documents to the anti-secrecy website before then-President Barack Obama commuted her sentence.

Source: Chelsea Manning jailed for refusing to testify on Wikileaks

Researchers are training image-generating AI with fewer labels by letting the model infer the labels

Generative AI models have a propensity for learning complex data distributions, which is why they’re great at producing human-like speech and convincing images of burgers and faces. But training these models requires lots of labeled data, and depending on the task at hand, the necessary corpora are sometimes in short supply.

The solution might lie in an approach proposed by researchers at Google and ETH Zurich. In a paper published on the preprint server Arxiv.org (“High-Fidelity Image Generation With Fewer Labels“), they describe a “semantic extractor” that can pull out features from training data, along with methods of inferring labels for an entire training set from a small subset of labeled images. These self- and semi-supervised techniques together, they say, can outperform state-of-the-art methods on popular benchmarks like ImageNet.

“In a nutshell, instead of providing hand-annotated ground truth labels for real images to the discriminator, we … provide inferred ones,” the paper’s authors explained.

In one of several unsupervised methods the researchers posit, they first extract a feature representation — a set of techniques for automatically discovering the representations needed for raw data classification — on a target training dataset using the aforementioned feature extractor. They then perform cluster analysis — i.e., grouping the representations in such a way that those in the same group share more in common than those in other groups. And lastly, they train a GAN — a two-part neural network consisting of generators that produce samples and discriminators that attempt to distinguish between the generated samples and real-world samples — by inferring labels.

Source: Researchers are training image-generating AI with fewer labels | VentureBeat

Google launches TensorFlow Lite 1.0 for mobile and embedded devices

Google today introduced TensorFlow Lite 1.0, its framework for developers deploying AI models on mobile and IoT devices. Improvements include selective registration and quantization during and after training for faster, smaller models. Quantization has led to 4 times compression of some models.

“We are going to fully support it. We’re not going to break things and make sure we guarantee its compatibility. I think a lot of people who deploy this on phones want those guarantees,” TensorFlow engineering director Rajat Monga told VentureBeat in a phone interview.

Lite begins with training AI models on TensorFlow, then is converted to create Lite models for operating on mobile devices. Lite was first introduced at the I/O developer conference in May 2017 and in developer preview later that year.

The TensorFlow Lite team at Google also shared its roadmap for the future today, designed to shrink and speed up AI models for edge deployment, including things like model acceleration, especially for Android developers using neural nets, as well as a Keras-based connecting pruning kit and additional quantization enhancements.

Other changes on the way:

  • Support for control flow, which is essential to the operation of models like recurrent neural networks
  • CPU performance optimization with Lite models, potentially involving partnerships with other companies
  • Expand coverage of GPU delegate operations and finalize the API to make it generally available

A TensorFlow 2.0 model converter to make Lite models will be made available for developers to better understand how things wrong in the conversion process and how to fix it.

TensorFlow Lite is deployed by more than two billion devices today, TensorFlow Lite engineer Raziel Alvarez said onstage at the TensorFlow Dev Summit being held at Google offices in Sunnyvale, California.

TensorFlow Lite increasingly makes TensorFlow Mobile obsolete, except for users who want to utilize it for training, but a solution is in the works, Alvarez said.

Source: Google launches TensorFlow Lite 1.0 for mobile and embedded devices | VentureBeat

Leaked Documents Show the U.S. Government Tracking Journalists and Immigration Advocates Through a Secret Database, having them detained at borders

One photojournalist said she was pulled into secondary inspections three times and asked questions about who she saw and photographed in Tijuana shelters. Another photojournalist said she spent 13 hours detained by Mexican authorities when she tried to cross the border into Mexico City. Eventually, she was denied entry into Mexico and sent back to the U.S.

These American photojournalists and attorneys said they suspected the U.S. government was monitoring them closely but until now, they couldn’t prove it.

Now, documents leaked to NBC 7 Investigates show their fears weren’t baseless. In fact, their own government had listed their names in a secret database of targets, where agents collected information on them. Some had alerts placed on their passports, keeping at least three photojournalists and an attorney from entering Mexico to work.

The documents were provided to NBC 7 by a Homeland Security source on the condition of anonymity, given the sensitive nature of what they were divulging.

The source said the documents or screenshots show a SharePoint application that was used by agents from Customs and Border Protection (CBP) Immigration and Customs Enforcement (ICE), the U.S. Border Patrol, Homeland Security Investigations and some agents from the San Diego sector of the Federal Bureau of Investigations (FBI).

The intelligence gathering efforts were done under the umbrella of “Operation Secure Line,” the operation designated to monitor the migrant caravan, according to the source.

The documents list people who officials think should be targeted for screening at the border.

The individuals listed include ten journalists, seven of whom are U.S. citizens, a U.S. attorney, and 47 people from the U.S. and other countries, labeled as organizers, instigators or their roles “unknown.” The target list includes advocates from organizations like Border Angels and Pueblo Sin Fronteras.

To view the documents, click here or the link below.

PHOTOS: Leaked Documents Show Government Tracking Journalists, Immigration AdvocatesPHOTOS: Leaked Documents Show Government Tracking Journalists, Immigration Advocates

NBC 7 Investigates is blurring the names and photos of individuals who haven’t given us permission to publish their information.

[…]

In addition to flagging the individuals for secondary screenings, the Homeland Security source told NBC 7 that the agents also created dossiers on each person listed.

“We are a criminal investigation agency, we’re not an intelligence agency,” the Homeland Security source told NBC 7 Investigates. “We can’t create dossiers on people and they’re creating dossiers. This is an abuse of the Border Search Authority.”

One dossier, shared with NBC 7, was on Nicole Ramos, the Refugee Director and attorney for Al Otro Lado, a law center for migrants and refugees in Tijuana, Mexico. The dossier included personal details on Ramos, including specific details about the car she drives, her mother’s name, and her work and travel history.

After sharing the documents with Ramos, she said Al Otro Lado is seeking more information on why she and other attorneys at the law center have been targeted by border officials.

“The document appears to prove what we have assumed for some time, which is that we are on a law enforcement list designed to retaliate against human rights defenders who work with asylum seekers and who are critical of CBP practices that violate the rights of asylum seekers,” Ramos told NBC 7 by email.

In addition to the dossier on Ramos, a list of other dossier files created was shared with NBC 7. Two of the dossier files were labeled with the names of journalists but no further details were available. Those journalists were also listed as targets for secondary screenings.

Customs and Border Protection has the authority to pull anyone into secondary screenings, but the documents show the agency is increasingly targeting journalists, attorneys, and immigration advocates. Former counterterrorism officials say the agency should not be targeting individuals based on their profession.

Source: Source: Leaked Documents Show the U.S. Government Tracking Journalists and Immigration Advocates Through a Secret Database – NBC 7 San Diego

When 2FA means sweet FA privacy: Facebook admits it slurps mobe numbers for more than just profile security

This time, the Silicon Valley giant has been caught red-handed using people’s cellphone numbers, provided exclusively for two-factor authentication, for targeted advertising and search – after it previously insinuated it wouldn’t do that.

Folks handing over their mobile numbers to protect their accounts from takeovers and hijackings thought the contact detail would be used for just that: security. Instead, Facebook is using the numbers to link netizens to other people, and target them with online ads.

For example, if someone you know – let’s call her Sarah – has given her number to Facebook for two-factor authentication purposes, and you allow the Facebook app to access your smartphone’s contacts book, and it sees Sarah’s number in there, it will offer to connect you two up, even though Sarah thought her number was being used for security only, and not for search. This is not a particularly healthy scenario, for instance, if you and Sarah are no longer, or never were, friends in real life, and yet Facebook wants to wire you up anyway.

Following online outcry over the weekend, a Facebook spokesperson told us today: “We appreciate the feedback we’ve received about these settings, and will take it into account.”

Source: When 2FA means sweet FA privacy: Facebook admits it slurps mobe numbers for more than just profile security • The Register

Anyone surprised much?

Welding glass to metal breakthrough could transform manufacturing

Scientists from Heriot-Watt University have welded glass and metal together using an ultrafast laser system, in a breakthrough for the manufacturing industry.

Various optical materials such as quartz, borosilicate glass and even sapphire were all successfully welded to metals like aluminium, titanium and using the Heriot-Watt laser system, which provides very short, picosecond pulses of infrared light in tracks along the materials to fuse them together.

The new process could transform the and have direct applications in the aerospace, defence, optical technology and even healthcare fields.

Professor Duncan Hand, director of the five-university EPSRC Centre for Innovative Manufacturing in Laser-based Production Processes based at Heriot-Watt, said: “Traditionally it has been very difficult to weld together dissimilar materials like glass and metal due to their different thermal properties—the and highly different thermal expansions involved cause the glass to shatter.

“Being able to weld glass and metals together will be a huge step forward in manufacturing and design flexibility.

“At the moment, equipment and products that involve and metal are often held together by adhesives, which are messy to apply and parts can gradually creep, or move. Outgassing is also an issue—organic chemicals from the adhesive can be gradually released and can lead to reduced product lifetime.

“The process relies on the incredibly short pulses from the laser. These pulses last only a few picoseconds—a picosecond to a second is like a second compared to 30,000 years.

“The parts to be welded are placed in close contact, and the laser is focused through the optical material to provide a very small and highly intense spot at the interface between the two —we achieved megawatt peak power over an area just a few microns across.

“This creates a microplasma, like a tiny ball of lightning, inside the material, surrounded by a highly-confined melt region.

“We tested the welds at -50C to 90C and the welds remained intact, so we know they are robust enough to cope with extreme conditions.”

Read more at: https://phys.org/news/2019-03-welding-breakthrough.html#jCp

Source: Welding breakthrough could transform manufacturing

SPOILER alert, literally: Intel CPUs afflicted with simple data-spewing spec-exec vulnerability

Further demonstrating the computational risks of looking into the future, boffins have found another way to abuse speculative execution in Intel CPUs to steal secrets and other data from running applications.

This security shortcoming can be potentially exploited by malicious JavaScript within a web browser tab, or malware running on a system, or rogue logged-in users, to extract passwords, keys, and other data from memory. An attacker therefore requires some kind of foothold in your machine in order to pull this off. The vulnerability, it appears, cannot be easily fixed or mitigated without significant redesign work at the silicon level.

Speculative execution, the practice of allowing processors to perform future work that may or may not be needed while they await the completion of other computations, is what enabled the Spectre vulnerabilities revealed early last year.

In a research paper distributed this month through pre-print service ArXiv, “SPOILER: Speculative Load Hazards Boost Rowhammer and Cache Attacks,” computer scientists at Worcester Polytechnic Institute in the US, and the University of Lübeck in Germany, describe a new way to abuse the performance boost.

The researchers – Saad Islam, Ahmad Moghimi, Ida Bruhns, Moritz Krebbel, Berk Gulmezoglu, Thomas Eisenbarth and Berk Sunar – have found that “a weakness in the address speculation of Intel’s proprietary implementation of the memory subsystem” reveals memory layout data, making other attacks like Rowhammer much easier to carry out.

The researchers also examined Arm and AMD processor cores, but found they did not exhibit similar behavior.

“We have discovered a novel microarchitectural leakage which reveals critical information about physical page mappings to user space processes,” the researchers explain.

“The leakage can be exploited by a limited set of instructions, which is visible in all Intel generations starting from the 1st generation of Intel Core processors, independent of the OS and also works from within virtual machines and sandboxed environments.”

 

Source: SPOILER alert, literally: Intel CPUs afflicted with simple data-spewing spec-exec vulnerability • The Register

Apples’ Shazam for iOS Sheds 3rd Party SDKs. Keeps pumping your data through on Android.

Shazam, the song identification app Apple bought for $400M, recently released an update to its iOS app that got rid of all 3rd party SDKs the app was using except for one.

The SDKs that were removed include ad networks, analytics trackers, and even open-source utilities. Why, you ask? Because all of those SDKs leak usage data to 3rd parties one way or another, something Apple really really dislikes.

Here are all the SDKs that were uninstalled in the latest update:

AdMob
Bolts
DoubleClick
FB Ads
FB Analytics
FB Login
InMobi
IAS
Moat
MoPub

Right now, the app only has one 3rd party SDK installed and that’s HockeyApp. Microsoft’s version of TestFlight. It’s unclear why it’s still there, but we don’t expect it to stick around for too long.

Looking across Apple’s entire app portfolio it’s very uncommon to see 3rd party SDKs at all. Exceptions exist. One such example is Apple’s Support app which has the Adobe Analytics SDK installed.

Things Are Different on Android

Since Shazam is also available for Android we expected to see the same behavior. A mass uninstall of 3rd party SDKs. At first glance it seems to be the case, but not exactly.

Here are all the SDKs that were uninstalled in the last update:

AdColony
AdMob
Amazon Ads
Ads
FB Analytics
Gimbal
Google IMA
MoPub

Here are all the SDKs that are still installed in Shazam for Android:

Bolts
FB Analytics
Butter Knife
Crashlytics
Fabric
Firebase
Google Maps
OKHttp
Otto

On Android, Apple seems to be ok with leaking usage data to both Facebook through the Facebook Login SDK and Google through Fabric and Google Maps, indicating Apple hasn’t built out its internal set of tools for Android.

It’s also worth noting that HockeyApp was removed from Shazam from Android more than a year ago.

Want to see which SDKs apps have installed? Check out Explorer, the most comprehensive SDK Intelligence platform for iOS and Android apps.

Source: Shazam for iOS Sheds 3rd Party SDKs | App store Insights from Appfigures

Facebook receives personal health data from apps, even if you don’t have a FB account

Facebook receives highly personal information from apps that track your health and help you find a new home, testing by The Wall Street Journal found. Facebook can receive this data from certain apps even if the user does not have a Facebook account, according to the Journal.

Facebook has already been in hot water concerning issues of consent and user data.

Most recently, a TechCrunch report revealed in January that Facebook paid users as young as teenagers to install an app that would allow the company to collect all phone and web activity. Following the report, Apple revoked some developer privileges from Facebook, saying Facebook violated its terms by distributing the app through a program meant only for employees to test apps prior to release.

The new report said Facebook is able to receive data from a variety of apps. Of more than 70 popular apps tested by the Journal, they found at least 11 apps that sent potentially sensitive information to Facebook.

The apps included the period-tracking app Flo Period & Ovulation Tracker, which reportedly shared with Facebook when users were having their periods or when they indicated they were trying to get pregnant. Real estate app Realtor reportedly sent Facebook the listing information viewed by users, and the top heart-rate app on Apple’s iOS, Instant Heart Rate: HR Monitor, sent users’ heart rates to the company, the Journal’s testing found.

The apps reportedly send the data using Facebook’s software-development kit, or SDK, which help developers integrate certain features into their apps. Facebook’s SDK includes an analytics service that helps app developers understand its users’ trends. The Journal said developers who sent sensitive information to Facebook used “custom app events” to send data like ovulation times and homes that users had marked as favorites on some apps.

A Facebook spokesperson told CNBC, “Sharing information across apps on your iPhone or Android device is how mobile advertising works and is industry standard practice. The issue is how apps use information for online advertising. We require app developers to be clear with their users about the information they are sharing with us, and we prohibit app developers from sending us sensitive data. We also take steps to detect and remove data that should not be shared with us.”

Source: Facebook receives personal health data from apps: WSJ

W3C approves WebAuthn as the web standard for password-free logins using FIDO2

The World Wide Web Consortium (W3C) today declared that the Web Authentication API (WebAuthn) is now an official web standard. First announced by the W3C and the FIDO Alliance in November 2015, WebAuthn is now an open standard for password-free logins on the web. It is supported by W3C contributors, including Airbnb, Alibaba, Apple, Google, IBM, Intel, Microsoft, Mozilla, PayPal, SoftBank, Tencent, and Yubico.

The specification lets users log into online accounts using biometrics, mobile devices, and/or FIDO security keys. WebAuthn is supported by Android and Windows 10. On the browser side, Google Chrome, Mozilla Firefox, and Microsoft Edge all added support last year. Apple has supported WebAuthn in preview versions of Safari since December.

Killing the password

“Now is the time for web services and businesses to adopt WebAuthn to move beyond vulnerable passwords and help web users improve the security of their online experiences,” W3C CEO Jeff Jaffe said in a statement. “W3C’s Recommendation establishes web-wide interoperability guidance, setting consistent expectations for web users and the sites they visit. W3C is working to implement this best practice on its own site.”

Although the W3C hasn’t adopted its own creation yet, WebAuthn is already implemented on sites such as Dropbox, Facebook, GitHub, Salesforce, Stripe, and Twitter. Now that WebAuthn is an official standard, the hope is that other sites will jump on board as well, leading to more password-free logins across the web.

But it’s not just the web. The FIDO Alliance wants to kill the password everywhere, a goal it has been working on for years and will likely still be working on for years to come.

FIDO2

W3C’s WebAuthn recommendation is a core component of the FIDO Alliance’s FIDO2 set of specifications. FIDO2 is a standard that supports public key cryptography and multifactor authentication — specifically, the Universal Authentication Framework (UAF) and Universal Second Factor (U2F) protocols. To help spur adoption, the FIDO Alliance provides testing tools and a certification program.

FIDO2 attempts to address traditional authentication issues in four ways:

  • Security: FIDO2 cryptographic login credentials are unique across every website; biometrics or other secrets like passwords never leave the user’s device and are never stored on a server. This security model eliminates the risks of phishing, all forms of password theft, and replay attacks.
  • Convenience: Users log in with simple methods such as fingerprint readers, cameras, FIDO security keys, or their personal mobile device.
  • Privacy: Because FIDO keys are unique for each internet site, they cannot be used to track users across sites.
  • Scalability: Websites can enable FIDO2 via an API call across all supported browsers and platforms on billions of devices consumers use every day.

“The Web Authentication component of FIDO2 is now an official web standard from W3C, an important achievement that represents many years of industry collaboration to develop a practical solution for phishing-resistant authentication on the web,” FIDO Alliance executive director Brett McDowell said in a statement. “With this milestone, we’re moving into the next phase of our shared mission to deliver simpler, stronger authentication to everyone using the internet today, and for years to come.”

Source: W3C approves WebAuthn as the web standard for password-free logins

Missing Out On Deep Sleep Causes Alzheimer’s Plaques to Build Up

Getting enough deep sleep might be the key to preventing dementia. In a series of recent experiments on mice, researchers discovered that deep sleep helps the brain clear out potentially toxic waste. The discovery reinforces how critical quality sleep is for brain health and suggests sleep therapies might curb the advance of memory-robbing ailments, like Alzheimer’s disease.

Alzheimer’s disease is a major problem for the patients, their families and society,” said Maiken Nedergaard, a neurologist at the University of Rochester Medical Center in New York, who led the new research. “Understanding how sleep can improve clearance of amyloid could have major impact on treatment.”

Clearing The Clutter

Cerebrospinal fluid churns through a system of brain tunnels piped in the spaces between brain cells and blood vessels. Scientists call it the glymphatic system. This system circulates nutrients like glucose, the brain’s primary energy source, and washes away potentially toxic waste.

And it may be the reason why animals even need sleep. The system takes out the brain’s trash when we’re asleep, and it shuts down when we’re awake. Nedergaard and her team were curious if the system works best and clears more waste — like Alzheimer’s causing beta amyloid plaque — when animals are in deep sleep.

To find out, the researchers used six different anesthetics to put mice into deep sleep. Then they tracked cerebrospinal fluid as it flowed into the brain. As the mice slept, the researchers watched the rodents’ brain activity on an electroencephalograph, or EEG, and recorded the animals’ blood pressures and heart and respiratory rates.

Rest And Restore

Mice anesthetized with a combination of two drugs, ketamine and xylazine, showed the strongest deep sleep brain waves and these brain waves predicted CSF flow into the brain, the researchers found. Their findings imply that the glymphatic system is indeed more active during the deepest sleep.

When the researchers analyzed the mice’s vital signs, they were surprised to find the animals anesthetized with the deep sleep drug combo of ketamine and xylazine also had the lowest heart rates, Nedergaard and her team report Wednesday in the journal Science Advances. The discovery means “low heart rate, which is a characteristic of athletes, is also a potent enhancer of glymphatic flow,” Nedergaard said. The results may explain why exercise buffers against poor memory.

The findings also have implications for people undergoing surgery. General anesthesia as well as long-term sedation in the intensive care unit is associated with delirium and difficulty with memory, especially in the elderly.

But most importantly, the research shows quality sleep is vital for brain health. “Focusing on sleep in the early stages of dementia might be able to slow progression of the disease,” Nedergaard said.

Source: Missing Out On Deep Sleep Causes Alzheimer’s Plaques to Build Up – D-brief

Massive Database Leak Gives Us a Window into China’s Digital Surveillance State

Earlier this month, security researcher Victor Gevers found and disclosed an exposed database live-tracking the locations of about 2.6 million residents of Xinjiang, China, offering a window into what a digital surveillance state looks like in the 21st century.

Xinjiang is China’s largest province, and home to China’s Uighurs, a Turkic minority group. Here, the Chinese government has implemented a testbed police state where an estimated 1 million individuals from these minority groups have been arbitrarily detained. Among the detainees are academics, writers, engineers, and relatives of Uighurs in exile. Many Uighurs abroad worry for their missing family members, who they haven’t heard from for several months and, in some cases, over a year.

Although relatively little news gets out of Xinjiang to the rest of the world, we’ve known for over a year that China has been testing facial-recognition tracking and alert systems across Xinjiang and mandating the collection of biometric data—including DNA samples, voice samples, fingerprints, and iris scans—from all residents between the ages of 12 and 65. Reports from the province in 2016 indicated that Xinjiang residents can be questioned over the use of mobile and Internet tools; just having WhatsApp or Skype installed on your phone is classified as “subversive behavior.” Since 2017, the authorities have instructed all Xinjiang mobile phone users to install a spyware app in order to “prevent [them] from accessing terrorist information.”

The prevailing evidence of mass detention centers and newly-erected surveillance systems shows that China has been pouring billions of dollars into physical and digital means of pervasive surveillance in Xinjiang and other regions. But it’s often unclear to what extent these projects operate as real, functional high-tech surveillance, and how much they are primarily intended as a sort of “security theater”: a public display of oppression and control to intimidate and silence dissent.

Now, this security leak shows just how extensively China is tracking its Xinjiang residents: how parts of that system work, and what parts don’t. It demonstrates that the surveillance is real, even as it raises questions about the competence of its operators.

A Brief Window into China’s Digital Police State

Earlier this month, Gevers discovered an insecure MongoDB database filled with records tracking the location and personal information of 2.6 million people located in the Xinjiang Uyghur Autonomous Region. The records include individuals’ national ID number, ethnicity, nationality, phone number, date of birth, home address, employer, and photos.

Over a period of 24 hours, 6.7 million individual GPS coordinates were streamed to and collected by the database, linking individuals to various public camera streams and identification checkpoints associated with location tags such as “hotel,” “mosque,” and “police station.” The GPS coordinates were all located within Xinjiang.

This database is owned by the company SenseNets, a private AI company advertising facial recognition and crowd analysis technologies.

A couple of days later, Gevers reported a second open database tracking the movement of millions of cars and pedestrians. Violations like jaywalking, speeding, and going through a red-light are detected, trigger the camera to take a photo, and ping a WeChat API, presumably to try and tie the event to an identity.

Database Exposed to Anyone with an Internet Connection for Half a Year

China may have a working surveillance program in Xinjiang, but it’s a shockingly insecure security state. Anyone with an Internet connection had access to this massive honeypot of information.

Gevers also found evidence that these servers were previously accessed by other known global entities such as a Bitcoin ransomware actor, who had left behind entries in the database. To top it off, this server was also vulnerable to several known exploits.

In addition to this particular surveillance database, a Chinese cybersecurity firm revealed that at least 468 MongoDB servers had been exposed to the public Internet after Gevers and other security researchers started reporting them. Among these instances: databases containing detailed information about remote access consoles owned by China General Nuclear Power Group, and GPS coordinates of bike rentals.

A Model Surveillance State for China

China, like many other state actors, may simply be willing to tolerate sloppy engineering if its private contractors can reasonably claim to be delivering the goods. Last year, the government spent an extra $3 billion on security-related construction in Xinjiang, and the New York Times reported that China’s police planned to spend an additional $30 billion on surveillance in the future. Even poorly-executed surveillance is massively expensive, and Beijing is no doubt telling the people of Xinjiang that these investments are being made in the name of their own security. But the truth, revealed only through security failures and careful security research, tells a different story: China’s leaders seem to care little for the privacy, or the freedom, of millions of its citizens.

Source: Massive Database Leak Gives Us a Window into China’s Digital Surveillance State | Electronic Frontier Foundation

Scientists turn CO2 ‘back into coal’ in breakthrough carbon capture experiment

The research team led by RMIT University in Melbourne, Australia, developed a new technique using a liquid metal electrolysis method which efficiently converts CO2 from a gas into solid particles of carbon.

Published in the journal Nature Communications, the authors say their technology offers an alternative pathway for “safely and permanently” removing CO2 from the atmosphere.

Current carbon capture techniques involve turning the gas into a liquid and injecting it underground, but its use is not widespread due to issues around economic viability, and environmental concerns about leaks from the storage site.

The new technique results in solid flakes of carbon, similar to coal, which may be easier to store safely.

To convert CO2, the researchers designed a liquid metal catalyst with specific surface properties that made it extremely efficient at conducting electricity while chemically activating the surface.

The carbon dioxide is dissolved in a beaker filled with an electrolyte liquid along with a small amount of the liquid metal, which is then charged with an electrical current.

The CO2 slowly converts into solid flakes, which are naturally detached from the liquid metal surface, allowing for continuous production.

RMIT researcher Dr Torben Daeneke said: “While we can’t literally turn back time, turning carbon dioxide back into coal and burying it back in the ground is a bit like rewinding the emissions clock.”

“To date, CO2 has only been converted into a solid at extremely high temperatures, making it industrially unviable.

“By using liquid metals as a catalyst, we’ve shown it’s possible to turn the gas back into carbon at room temperature, in a process that’s efficient and scalable.

“While more research needs to be done, it’s a crucial first step to delivering solid storage of carbon.”

Lead author, Dr Dorna Esrafilzadeh said the carbon produced by the technique could also be used as an electrode.

“A side benefit of the process is that the carbon can hold electrical charge, becoming a supercapacitor, so it could potentially be used as a component in future vehicles,” she said.

“The process also produces synthetic fuel as a by-product, which could also have industrial applications.”

Source: Scientists turn CO2 ‘back into coal’ in breakthrough carbon capture experiment | The Independent