Modlishka allows for very easy fishing / MITM

Posted on by

You basically just put it on a local domain, point people there and it forwards the traffic up and down to the target website – so no templates, no warnings. It will also push through two factor authentication requests and answers.

Modlishka is a flexible and powerful reverse proxy, that will take your phishing campaigns to the next level (with minimal effort required from your side).

Enjoy 🙂

Features

Some of the most important ‘Modlishka’ features :

  • Support for majority of 2FA authentication schemes (by design).
  • No website templates (just point Modlishka to the target domain – in most cases, it will be handled automatically).
  • Full control of “cross” origin TLS traffic flow from your victims browsers.
  • Flexible and easily configurable phishing scenarios through configuration options.
  • Pattern based JavaScript payload injection.
  • Striping website from all encryption and security headers (back to 90’s MITM style).
  • User credential harvesting (with context based on URL parameter passed identifiers).
  • Can be extended with your ideas through plugins.
  • Stateless design. Can be scaled up easily for an arbitrary number of users – ex. through a DNS load balancer.
  • Web panel with a summary of collected credentials and user session impersonation (beta).
  • Written in Go.

https://github.com/drk1wi/Modlishka

In an email to ZDNet, Duszyński described Modlishka as a point-and-click and easy-to-automate system that requires minimal maintenance, unlike previous phishing toolkits used by other penetration testers.

“At the time when I started this project (which was in early 2018), my main goal was to write an easy to use tool, that would eliminate the need of preparing static webpage templates for every phishing campaign that I was carrying out,” the researcher told us.

“The approach of creating a universal and easy to automate reverse proxy, as a MITM actor, appeared to be the most natural direction. Despite some technical challenges, that emerged on this path, the overall result appeared to be really rewarding,” he added.

“The tool that I wrote is sort of a game changer, since it can be used as a ‘point and click’ proxy, that allows easy phishing campaign automation with full support of the 2FA (an exception to this is a U2F protocol based tokens – which is currently the only resilient second factor).

zdnet https://www.zdnet.com/article/new-tool-automates-phishing-attacks-that-bypass-2fa/

Y’know how you might look at someone and can’t help but wonder if they have a genetic disorder? We’ve taught AI to do the same

Posted on by

Artificial intelligence can potentially identify someone’s genetic disorders by inspecting a picture of their face, according to a paper published in Nature Medicine this week.

The tech relies on the fact some genetic conditions impact not just a person’s health, mental function, and behaviour, but sometimes are accompanied with distinct facial characteristics. For example, people with Down Syndrome are more likely to have angled eyes, a flatter nose and head, or abnormally shaped teeth. Other disorders like Noonan Syndrome are distinguished by having a wide forehead, a large gap between the eyes, or a small jaw. You get the idea.

An international group of researchers, led by US-based FDNA, turned to machine-learning software to study genetic mutations, and believe that machines can help doctors diagnose patients with genetic disorders using their headshots.

The team used 17,106 faces to train a convolutional neural network (CNN), commonly used in computer vision tasks, to screen for 216 genetic syndromes. The images were obtained from two sources: publicly available medical reference libraries, and snaps submitted by users of a smartphone app called Face2Gene, developed by FDNA.

Given an image, the system, dubbed DeepGestalt, studies a person’s face to make a note of the size and shape of their eyes, nose, and mouth. Next, the face is split into regions, and each piece is fed into the CNN. The pixels in each region of the face are represented as vectors and mapped to a set of features that are commonly associated with the genetic disorders learned by the neural network during its training process.

DeepGestalt then assigns a score per syndrome for each region, and collects these results to compile a list of its top 10 genetic disorder guesses from that submitted face.

deepgestalt

An example of how DeepGestalt works. First, the input image is analysed using landmarks and sectioned into different regions before the system spits out its top 10 predictions. Image credit: Nature and Gurovich et al.

The first answer is the genetic disorder DeepGestalt believes the patient is most likely affected by, all the way down to its tenth answer, which is the tenth most likely disorder.

When it was tested on two independent datasets, the system accurately guessed the correct genetic disorder among its top 10 suggestions around 90 per cent of the time. At first glance, the results seem promising. The paper also mentions DeepGestalt “outperformed clinicians in three initial experiments, two with the goal of distinguishing subjects with a target syndrome from other syndromes, and one of separating different genetic subtypes in Noonan Syndrome.”

There’s always a but

A closer look, though, reveals that the lofty claims involve training and testing the system on limited datasets – in other words, if you stray outside the software’s comfort zone, and show it unfamiliar faces, it probably won’t perform that well. The authors admit previous similar studies “have used small-scale data for training, typically up to 200 images, which are small for deep-learning models.” Although they use a total of more than 17,000 training images, when spread across 216 genetic syndromes, the training dataset for each one ends up being pretty small.

For example, the model that examined Noonan Syndrome was only trained on 278 images. The datasets DeepGestalt were tested against were similarly small. One only contained 502 patient images, and the other 392.

Source: Y’know how you might look at someone and can’t help but wonder if they have a genetic disorder? We’ve taught AI to do the same • The Register

Professor exposing unethical academic publishing is being sued by university in childish discrediting counterclaims of being unethical for showing unethical behaviour

Posted on by

The three authors, who describe themselves as leftists, spent 10 months writing 20 hoax papers they submitted to reputable journals in gender, race, sexuality, and related fields. Seven were accepted, four were published online, and three were in the process of being published when questions raised in October by a skeptical Wall Street Journal editorial writer forced them to halt their project.

One of their papers, about canine rape culture in dog parks in Portland, Ore., was initially recognized for excellence by the journal Gender, Place, and Culture, the authors reported.

The hoax was dubbed “Sokal Squared,” after a similar stunt pulled in 1996 by Alan Sokal, then a physicist at New York University.

After their ruse was revealed, the three authors described their project in an October article in the webzine Areo, which Pluckrose edits. Their goal, they wrote, was to “to study, understand, and expose the reality of grievance studies, which is corrupting academic research.” They contend that scholarship that tends to social grievances now dominates some fields, where students and others are bullied into adhering to scholars’ worldviews, while lax publishing standards allow the publication of clearly ludicrous articles if the topic is politically fashionable.

[…]

In November the investigating committee reported that the dog-park article contained knowingly fabricated data and thus constituted research misconduct. The review board also determined that the hoax project met the definition for human-subjects research because it involved interacting with journal editors and reviewers. Any research involving human subjects (even duped journal editors, apparently) needs IRB approval first, according to university policy.

“Your efforts to conduct human-subjects research at PSU without a submitted nor approved protocol is a clear violation of the policies of your employer,” McLellan wrote in an email to Boghossian.

The decision to move ahead with disciplinary action came after a group of faculty members published a letter in the student newspaper decrying the hoax as “lies peddled to journals, masquerading as articles.” These “lies” are designed “not to critique, educate, or inspire change in flawed systems,” they wrote, “but rather to humiliate entire fields while the authors gin up publicity for themselves without having made any scholarly contributions whatsoever.” Such behavior, they wrote, hurts the reputations of the university as well as honest scholars who work there. “Worse yet, it jeopardizes the students’ reputations, as their degrees in the process may become devalued.”

[…]

Meanwhile, within the first 24 hours of news leaking about the proceedings against him, more than 100 scholars had written letters defending Boghossian, according to his media site, which posted some of them.

Steven Pinker, a professor of psychology at Harvard University, was among the high-profile scholars who defended him. “Criticism and open debate are the lifeblood of academia; they are what differentiate universities from organs of dogma and propaganda,” Pinker wrote. “If scholars feel they have been subject to unfair criticism, they should explain why they think the critic is wrong. It should be beneath them to try to punish and silence him.”

Richard Dawkins, an evolutionary biologist, author, and professor emeritus at the University of Oxford, had this to say: “If the members of your committee of inquiry object to the very idea of satire as a form of creative expression, they should come out honestly and say so. But to pretend that this is a matter of publishing false data is so obviously ridiculous that one cannot help suspecting an ulterior motive.”

Sokal, who is now at University College London, wrote that Boghossian’s hoax had served the public interest and that the university would become a “laughingstock” in academe as well as the public sphere if it insisted that duping editors constituted research on human subjects.

One of Boghossian’s co-author, Lindsay, urged him in the video they posted to emphasize that the project amounted to an audit of certain sectors of academic research. “People inside the system aren’t allowed to question the system? What kind of Orwellian stuff is that?” Lindsay asked.

Source: Proceedings Start Against ‘Sokal Squared’ Hoax Professor – The Chronicle of Higher Education

Pots and kettles? I think it’s just the American way of getting back at someone who has made you blush – destroy at all costs!

T-Mobile, Sprint, and AT&T Are Selling Customers’ Real-Time Location Data, And It’s Falling Into the Wrong Hands

Posted on by

Nervously, I gave a bounty hunter a phone number. He had offered to geolocate a phone for me, using a shady, overlooked service intended not for the cops, but for private individuals and businesses. Armed with just the number and a few hundred dollars, he said he could find the current location of most phones in the United States.

The bounty hunter sent the number to his own contact, who would track the phone. The contact responded with a screenshot of Google Maps, containing a blue circle indicating the phone’s current location, approximate to a few hundred metres.

Queens, New York. More specifically, the screenshot showed a location in a particular neighborhood—just a couple of blocks from where the target was. The hunter had found the phone (the target gave their consent to Motherboard to be tracked via their T-Mobile phone.)

The bounty hunter did this all without deploying a hacking tool or having any previous knowledge of the phone’s whereabouts. Instead, the tracking tool relies on real-time location data sold to bounty hunters that ultimately originated from the telcos themselves, including T-Mobile, AT&T, and Sprint, a Motherboard investigation has found. These surveillance capabilities are sometimes sold through word-of-mouth networks.

Whereas it’s common knowledge that law enforcement agencies can track phones with a warrant to service providers, IMSI catchers, or until recently via other companies that sell location data such as one called Securus, at least one company, called Microbilt, is selling phone geolocation services with little oversight to a spread of different private industries, ranging from car salesmen and property managers to bail bondsmen and bounty hunters, according to sources familiar with the company’s products and company documents obtained by Motherboard. Compounding that already highly questionable business practice, this spying capability is also being resold to others on the black market who are not licensed by the company to use it, including me, seemingly without Microbilt’s knowledge.

Source: T-Mobile, Sprint, and AT&T Are Selling Customers’ Real-Time Location Data, And It’s Falling Into the Wrong Hands

Welcome to 2019: Your Exchange server can be pwned by an email (and other bugs need fixing)

Posted on by

Among the 49 bug fixes were patches for remote code execution flaws in DHCP (CVE-2019-0547) and an Exchange memory corruption flaw (CVE-2019-0586) that Trend Micro ZDI researcher Dustin Childs warns is particularly dangerous as it can be exploited simply by sending an email to a vulnerable server.

“That’s a bit of a problem, as receiving emails is a big part of what Exchange is meant to do,” Childs explained.

“Microsoft lists this as Important in severity, but taking over an Exchange server by simply sending it an email puts this in the Critical category to me. If you use Exchange, definitely put this high on your test and deploy list.”

Source: Welcome to 2019: Your Exchange server can be pwned by an email (and other bugs need fixing) • The Register

Millions of Americans Are Wrong About Having a Food Allergy: about 1/2 who think they have don’t, but have never seen a doc about it

Posted on by

Millions of Americans might be mistaken about their self-professed food allergy, suggests a new survey. It found that while nearly 20 percent of people said they had a food allergy, only half as many people reported the sort of symptoms you’d expect from eating something you’re allergic to.

Researchers surveyed more than 40,000 adults via the phone and internet between October 2015 to September 2016. The volunteers were asked if they had any food allergies and about what symptoms they typically had. They were also asked if they had ever been formally tested and diagnosed with a food allergy by a doctor.

All told, 19 percent of the nationally representative group reported having a food allergy. But only 10.8 percent said they had symptoms consistent with an allergic reaction to food, such as hives, swelling of the lips or throat, and chest pain. The main culprits behind these allergies were shellfish, milk, and tree nuts. Those who didn’t have a convincing food allergy instead reported symptoms like stomach cramps, a stuffy nose, or nausea.

The findings, published Friday in JAMA Network Open, roughly match up to estimates from other studies, including those that confirmed a person’s food allergy with testing or medical records. In terms of the U.S. population, the study estimates, there are about 26 million adult Americans with a food allergy—and there are likely nearly as many Americans who wrongly say they have one. But that doesn’t mean huge swaths of people are pretending to have food allergies; it’s just that we could be a little confused about the terminology.

True allergies, as they’re known, happen when the immune system overreacts very quickly and in a specific way to a foreign substance harmless to us, whether it’s food or a piece of clothing. The antibodies usually responsible for an allergic reaction are called immunoglobulin E, or IgE. When doctors test for allergies, it’s IgE antibodies they’re looking for. But people can react badly to food for other reasons outside of this process.

Lactose intolerance is probably the best known example of this, and it happens because many adults are less able to break down lactose, the sugar commonly found in dairy products, into simpler sugars. Another genetic condition, celiac disease, makes people unable to digest gluten. Some people also seem to have delayed immune reactions to food without IgE in the picture, though we’re less sure about how commonly this happens and how to accurately diagnose it. Many doctors, for instance, criticize tests that promise to find these so-called food sensitivities with ease.

It’s likely then, the researchers say, that people might be mixing up a food intolerance or sensitivity with a food allergy.

What’s also concerning is that many people with likely food allergies in their survey have seemingly never talked to a doctor about it. Only half of the group said they had an official diagnosis from a physician. And while many of us develop food allergies early on in childhood, just about half reported finding out about their allergy as adults.

Source: Millions of Americans Are Wrong About Having a Food Allergy, Study Suggests

Sony appears to be blocking Kodi on its recent Android TVs

Posted on by

For the unfamiliar, Kodi is an open source, cross-platform streaming and media player solution that allows you to access and play local, network, and remote content. The UI has been extensively optimized over the last 15 years since the XBMC days to provide one of the best big-screen experiences out there, and it’s been one of the most popular HTPC media playback applications for years.

The official Kodi project Twitter account pointed out Sony’s deficiency a couple of days ago, but reports on the Kodi forums of issues installing and running the app from the Play Store go even further back to last year. A handful of affected enthusiasts believe they have discovered the cause of the problem: Sony seems to be blocking the package ID for the app from being installed/run. Supporting this theory is the fact that recompiling the app from scratch with a different ID allows it to work.

Humorously enough, Samsung’s official US Twitter account has jumped on Sony’s snafu to encourage users to switch brands — unfortunately overlooking the fact that Samsung’s TVs don’t run Android TV, and can’t use the Android Kodi app without an external device. Even so, anything that increases the pressure against Sony for this consumer-unfriendly move is a good thing.

Source: Sony appears to be blocking Kodi on its recent Android TVs

Snips – a private, offline voice assistant

Posted on by

Snips is the first Voice Platform where you can build an Voice Assistant that is Private by Design.

Source: Snips — Using Voice to Make Technology Disappear

Which means, unlike Alexa or Google Home, your voice data doesn’t get listened to by the cloud, doesn’t get saved by strangers targetting advertising at you and works when the Cloud ™ goes down.

The homepage

If you don’t want to put together all the bits and bobs (Raspberry Pi, mic, speaker, etc) you can get the Seeed Voice Interaction Development Kit for $115 and satellites (which relay commands to your base kit) for $85,-

The Snips makers page is the starting point to join and see projects

They have an app store with loads of intents pre programmed for you to install

This is a pretty good github page of awesome snips

An example including how to install from base on how to do a multiplication table game

Another example on how to integrate Sonos

The forum

And a telegram page

the Facebook page

It also integrates with home assistant

From Edgar BV Wiki

NSA to release a free reverse engineering tool GHIDRA

Posted on by

The US National Security Agency will release a free reverse engineering tool at the upcoming RSA security conference that will be held at the start of March, in San Francisco.

The software’s name is GHIDRA and in technical terms, is a disassembler, a piece of software that breaks down executable files into assembly code that can then be analyzed by humans.

The NSA developed GHIDRA at the start of the 2000s, and for the past few years, it’s been sharing it with other US government agencies that have cyber teams who need to look at the inner workings of malware strains or suspicious software.

GHIDRA’s existence was never a state secret, but the rest of the world learned about it in March 2017 when WikiLeaks published Vault7, a collection of internal documentation files that were allegedly stolen from the CIA’s internal network. Those documents showed that the CIA was one of the agencies that had access to the tool.

According to these documents, GHIDRA is coded in Java, has a graphical user interface (GUI), and works on Windows, Mac, and Linux.

GHIDRA can also analyze binaries for all major operating systems, such as Windows, Mac, Linux, Android, and iOS, and a modular architecture allows users to add packages in case they need extra features.

According to GHIDRA’s description in the RSA conference session intro, the tool “includes all the features expected in high-end commercial tools, with new and expanded functionality NSA uniquely developed.”

US government workers to whom ZDNet has spoken today said the tool is well-known and liked, and generally used by operators in defensive roles, who normally analyze malware found on government networks.

Some people who know and used the tool and have shared opinions on social media, such as HackerNews, Reddit, and Twitter, have compared GHIDRA with IDA, a well-known reverse engineering tool -but also very expensive, with licenses priced in the range of thousands of dollars.

Most users say that GHIDRA is slower and buggier than IDA, but by open-sourcing it, the NSA will benefit from free maintenance from the open source community, allowing GHIDRA to quickly catch up and maybe surpass IDA.

The news of the NSA open-sourcing one of its internal tools should not surprise you. The NSA has open-sourced all sorts of tools over the past few years, with the most successful of them being Apache NiFi, a project for automating large data transfers between web apps, and which has become a favorite on the cloud computing scene.

In total, the NSA has open-sourced 32 projects as part of its Technology Transfer Program (TTP) so far and has most recently even opened an official GitHub account.

GHIDRA will be demoed at the RSA conference on March 5 and is expected to be released soon after on the agency’s Code page and GitHub account.

Source: NSA to release a free reverse engineering tool | ZDNet

A mathematical approach for understanding intra-plant communication

Posted on by

A team of researchers at the Gran Sasso Science Institute (GSSI) and Istituto Italiano di Technologia (IIT) have devised a mathematical approach for understanding intra-plant communication. In their paper, pre-published on bioRxiv, they propose a fully coupled system of non-linear, non-autonomous discontinuous and ordinary differential equations that can accurately describe the adapting behavior and growth of a single plant, by analyzing the main stimuli affecting plant behavior.

Recent studies have found that rather than being passive organisms, can actually exhibit complex behaviors in response to environmental stimuli, for instance, adapting their resource allocation, foraging strategies, and growth rates according to their surrounding environment. How plants process and manage this network of stimuli, however, is a complex biological question that remains unanswered.

Researchers have proposed several mathematical models to achieve a better understanding of plant behavior. Nonetheless, none of these models can effectively and clearly portray the complexity of the stimulus-signal-behavior chain in the context of a plant’s internal communication network.

Read more at: https://phys.org/news/2019-01-mathematical-approach-intra-plant.html#jCp

Source: A mathematical approach for understanding intra-plant communication

Can’t unlock an Android phone? No problem, just take a Skype call: App allows passcode bypass

Posted on by

A newly disclosed vulnerability in Skype for Android could be exploited by miscreants to bypass an Android phone’s passcode screen to view photos, contacts, and even launch browser windows.

Bug-hunter Florian Kunushevci today told The Register the security flaw, which has been reported to Microsoft, allows the person in possession of someone’s phone to receive a Skype call, answer it without unlocking the handset, and then view photos, look up contacts, send a message, and open the browser by tapping links in a sent message, all without ever unlocking the phone. This is handy for thieves, pranksters, prying partners, and so on. Here’s a video demonstrating the bypass…

Kunushevci, a 19-year-old bug researcher from Kosovo, said he was an everyday user of the Skype for Android app when he noticed that something appeared to be amiss with the way the VoIP app accessed files on the handset. Curious, he decided to put his white hat on, and take a closer look.

Source: Can’t unlock an Android phone? No problem, just take a Skype call: App allows passcode bypass • The Register

Researcher Distributes Tool That Enables Mass-Hijacking of Google Chromecast Devices

Posted on by

Uploaded to Github on Thursday, a tool called Crashcast enables the almost instantaneous takeover all of Chromecast streaming devices left accessible online by mistake. This same misconfiguration issue was taken advantage of by the hacker duo Hacker Giraffe and j3ws3r earlier this week to broadcast a message in support of the YouTube star Felix Kjellberg, more widely known as PewDiePie, to thousands of Chromecast owners.

The prank was intended to draw attention, the hacker said, to the fact that thousands of Chromecast devices globally have been left exposed unnecessarily.

Hacker Giraffe, who not too long ago pulled a similar prank using internet-connected printers, said on Thursday that the backlash caused by the Chromecast high jinks led them to give up hacking. The fear of getting caught and prosecuted, the hacker wrote on Pastebin, was causing “all kinds of fears and panic attacks.”

“I just wanted to inform people of their vulnerable devices while supporting a YouTuber I liked. I never meant any harm, nor did I ever have any ill intentions,” they added.

But now a tool which accomplishes the same feat is accessible to virtually anyone, thanks to Amir Khashayar Mohammadi, a security and freelance researcher. Mohammadi tells Gizmodo, however, that the tool he’s released is merely a proof-of-concept uploaded to further research into the problem, and is not intended for people to use maliciously.

Crashcast shown preparing to broadcast a YouTube video to 176,642 Chromecast devices.

Luckily, the problem is a fairly benign one. The tool doesn’t allow for remote code execution, so forcing the device to play random YouTube videos is about all that can be accomplished. “You’re not necessarily hacking anything here,” says Mohammadi, who blogs and publishes papers on the website Spuz.me. “All you’re doing is issuing a cURL command which in this case tells the Chromecast to view a video.”

“There is no authentication or bypass, you’re actually doing what the Chromecast is intended to do, except the reason this works is because they’re all being exposed to the internet,” he continued, adding: “I mean honestly, why would anyone leave their Chromecast on the internet? It makes no sense. You’re literally asking for it.”

Source: Researcher Distributes Tool That Enables Mass-Hijacking of Google Chromecast Devices

Scientists Have ‘Hacked Photosynthesis’ In Search Of More Productive Crops: 40% bigger, growing faster

Posted on by

There’s a big molecule, a protein, inside the leaves of most plants. It’s called Rubisco, which is short for an actual chemical name that’s very long and hard to remember.

Amanda Cavanagh, a biologist and post-doctoral researcher at the University of Illinois, calls herself a big fan of Rubisco. “It’s probably the most abundant protein in the world,” she says. It’s also super-important.

Scientist Amanda Cavanagh snap freezes plant samples with liquid nitrogen to study how the metabolism differs between unmodified plants and plants engineered with alternate pathways for photorespiration.

Claire Benjamin/RIPE Project

Rubisco has one job. It picks up carbon dioxide from the air, and it uses the carbon to make sugar molecules. It gets the energy to do this from the sun. This is photosynthesis, the process by which plants use sunlight to make food, a foundation of life on Earth. Yay for Rubisco!

“But it has what we like to call one fatal flaw,” Cavanagh continues. Unfortunately, Rubisco isn’t picky enough about what it grabs from the air. It also picks up oxygen. “When it does that, it makes a toxic compound, so the plant has to detoxify it.”

Plants have a whole complicated chemical assembly line to carry out this detoxification, and the process uses up a lot of energy. This means the plant has less energy for making leaves, or food for us. (There is a family of plants, including corn and sugar cane, that developed another type of workaround for Rubisco, and those plants are much more productive.)

Cavanagh and her colleagues in a research program called Realizing Increased Photosynthetic Efficiency (RIPE), which is based at the University of Illinois, have spent the last five years trying to fix Rubisco’s problem. “We’re sort of hacking photosynthesis,” she says.

They experimented with tobacco plants, just because tobacco is easy to work with. They inserted some new genes into these plants, which shut down the existing detoxification assembly line and set up a new one that’s way more efficient. And they created super tobacco plants. “They grew faster, and they grew up to 40 percent bigger” than normal tobacco plants, Cavanagh says. These measurements were done both in greenhouses and open-air field plots.

Source: Scientists Have ‘Hacked Photosynthesis’ In Search Of More Productive Crops : The Salt : NPR

Once considered outlandish, the idea that plants help their relatives is taking root

Posted on by

For people, and many other animals, family matters. Consider how many jobs go to relatives. Or how an ant will ruthlessly attack intruder ants but rescue injured, closely related nestmates. There are good evolutionary reasons to aid relatives, after all. Now, it seems, family feelings may stir in plants as well.

A Canadian biologist planted the seed of the idea more than a decade ago, but many plant biologists regarded it as heretical—plants lack the nervous systems that enable animals to recognize kin, so how can they know their relatives? But with a series of recent findings, the notion that plants really do care for their most genetically close peers—in a quiet, plant-y way—is taking root. Some species constrain how far their roots spread, others change how many flowers they produce, and a few tilt or shift their leaves to minimize shading of neighboring plants, favoring related individuals.

“We need to recognize that plants not only sense whether it’s light or dark or if they’ve been touched, but also whom they are interacting with,” says Susan Dudley, a plant evolutionary ecologist at McMaster University in Hamilton, Canada, whose early plant kin recognition studies sparked the interest of many scientists.

Beyond broadening views of plant behavior, the new work may have a practical side. In September 2018, a team in China reported that rice planted with kin grows better, a finding that suggested family ties can be exploited to improve crop yields. “It seems anytime anyone looks for it, they find a kin effect,” says AndrĂŠ Kessler, a chemical ecologist at Cornell University.

Source: Once considered outlandish, the idea that plants help their relatives is taking root | Science | AAAS

German Politicians Hit With Unprecedented Leak of Private Information

Posted on by

On Thursday, authorities in Germany were made aware of an enormous leak of personal information belonging to artists, media figures, and politicians—including Chancellor Angela Merkel. The hack is being called the “biggest data dump” in German history and appears to contain a treasure trove of information that could be used for identity theft.

Early reports and tweets identified the source of the leak as a now-suspended Twitter account with the handle “@_0rbit” and username “G0d.” According to multiple reports, the account began posting the data in December, Advent-calender-style. The astounding collection of stolen information reportedly includes email addresses, documents, private correspondence, credit card information, passwords, family information, and even photocopies of personal ID cards. The victims included the members of virtually every political party in German Parliament, TV journalists, musicians, and YouTube stars.

While the Twitter account and an associated Blogspot have been removed, the information was still relatively easy to track down. One security researcher on Twitter noted that this dump was incredibly labor intensive with hundreds of mirror links ensuring the information would be difficult to take down. At least one link that Gizmodo viewed on Imgur disappeared a few minutes later.

[…]

One good thing that could come out of this mess is, politicians have begun to call for stronger data protection and security measures in Germany. Britta Haßelmann, the parliamentary executive director of the Greens, released a statement asking for proactive measures that include “a renunciation of state-run security with vulnerabilities, end-to-end encryption and the strengthening of independent supervisory structures.”

Source: German Politicians Hit With Unprecedented Leak of Private Information

And suddenly they sit up and notice when it affects them personally

Ethereum Plans To Cut Its Absurd Energy Consumption By 99 Percent

Posted on by

Ethereum mining consumes a quarter to half of what Bitcoin mining does, but that still means that for most of 2018 it was using roughly as much electricity as Iceland. Indeed, the typical Ethereum transaction gobbles more power than an average U.S. household uses in a day. “That’s just a huge waste of resources, even if you don’t believe that pollution and carbon dioxide are an issue. There are real consumers — real people — whose need for electricity is being displaced by this stuff,” says Vitalik Buterin, the 24-year-old Russian-Canadian computer scientist who invented Ethereum when he was just 18.

Buterin plans to finally start undoing his brainchild’s energy waste in 2019. This year Buterin, the Ethereum Foundation he cofounded, and the broader open-source movement advancing the cryptocurrency all plan to field-test a long-promised overhaul of Ethereum’s code. If these developers are right, by the end of 2019 Ethereum’s new code could complete transactions using just 1 percent of the energy consumed today.

Source: Ethereum Plans To Cut Its Absurd Energy Consumption By 99 Percent – Slashdot

Lawsuit Accuses Weather Channel App of Misleading Users and Profiting From Their Location Data – anyone surprised much?

Posted on by

More than a couple weather apps have recently come under fire for their handling of user data, either by collecting too much or allegedly tracking users without their permission. Now, the maker of yet another popular weather app is being accused by the city attorney of Los Angeles of deceiving millions of users and profiting from their location data.

The lawsuit was filed Thursday, according to the New York Times, which has been reporting on the app’s alleged misdeeds. As part of a larger investigation last month into the practice of companies tracking user location data for profit, the Times reported that the Weather Channel app—part of the Weather Company, which was acquired by IBM in 2015—didn’t “explicitly disclose that the company had also analyzed the data for hedge funds.” While the app did disclose how some user data would be used in its privacy policy and privacy settings, it did not alert users in a prompt used to gain access to their location data.

“For years, TWC has deceptively used its Weather Channel App to amass its users’ private, personal geolocation data—tracking minute details about its users’ locations throughout the day and night, all the while leading users to believe that their data will only be used to provide them with ‘personalized local weather data, alerts and forecasts,’” the lawsuit states. “TWC has then profited from that data, using it and monetizing it for purposes entirely unrelated to weather or the Weather Channel App.”

Source: Lawsuit Accuses Weather Channel App of Misleading Users and Profiting From Their Location Data

Your Cash Is No Good Here. Literally. – So how to pay if you don’t like plastic: which helps the banks but not your spending patterns

Posted on by

As more retailers—including Drybar and Sweetgreen—ban paper money, it’s making things awkward for customers without plastic. [paywalled]

Source: Your Cash Is No Good Here. Literally. – WSJ

 

Oh dear, not accepting money – when the pain signals in your brain are not set off by clicking a bank pass, but are when you have to pay cash. Don’t be fooled people: cash is central to what money is – for the whole economy, but also for you as a person. See what happens when people with trillions start chucking it about (because what does that amount really mean, anyway!?) or the personal debt people spending on credit build up.

AI learns to Navigate the Web, fill in forms – without a human built training set

Posted on by

Learning in environments with large state and action spaces, and sparse rewards, can hinder a Reinforcement Learning (RL) agent’s learning through trial-and-error. For instance, following natural language instructions on the Web (such as booking a flight ticket) leads to RL settings where input vocabulary and number of actionable elements on a page can grow very large. Even though recent approaches improve the success rate on relatively simple environments with the help of human demonstrations to guide the exploration, they still fail in environments where the set of possible instructions can reach millions. We approach the aforementioned problems from a different perspective and propose guided RL approaches that can generate unbounded amount of experience for an agent to learn from. Instead of learning from a complicated instruction with a large vocabulary, we decompose it into multiple sub-instructions and schedule a curriculum in which an agent is tasked with a gradually increasing subset of these relatively easier sub-instructions. In addition, when the expert demonstrations are not available, we propose a novel meta-learning framework that generates new instruction following tasks and trains the agent more effectively. We train DQN, deep reinforcement learning agent, with Q-value function approximated with a novel QWeb neural network architecture on these smaller, synthetic instructions. We evaluate the ability of our agent to generalize to new instructions on World of Bits benchmark, on forms with up to 100 elements, supporting 14 million possible instructions. The QWeb agent outperforms the baseline without using any human demonstration achieving 100% success rate on several difficult environments.

Source: [1812.09195] Learning to Navigate the Web

AI Automatically Sorts Cancer Cells to determine most effective treatment

Posted on by
A team of researchers in Japan have devised an artificial intelligence (AI) system that can identify different types of cancer cells using microscopy images. Their method can also be used to determine whether the cancer cells are sensitive to radiotherapy. The researchers reported their findings in the journal Cancer Research. In cancer patients, there can be tremendous variation in the types of cancer cells in a single tumor. Identifying the specific cell types present in tumors can be very useful when choosing the most effective treatment. However, making accurate assessments of cell types is time consuming and often hampered by human error and the limits of human sight. To overcome these challenges, scientists led by Professor Hideshi Ishii of Osaka University, Japan, have developed an AI system that can identify different types of cancer cells from microscopy images, achieving higher accuracy than human judgement. The system is based on a convolutional neural network, a form of AI modeled on the human visual system. “We first trained our system on 8,000 images of cells obtained from a phase-contrast microscope,” said corresponding author Ishii. “We then tested [the AI system’s] accuracy on another 2,000 images and showed that it had learned the features that distinguish mouse cancer cells from human ones, and radioresistant cancer cells from radiosensitive ones.” The researchers noted that the automation and high accuracy of their system could be very useful for determining exactly which cells are present in a tumor or circulating in the body. Knowing whether or not radioresistant cells are present is vital when deciding whether radiotherapy would be effective. Furthermore, the same procedure can be applied post-treatment to assess patient outcomes. In the future, the team hopes to train the system on more cancer cell types, with the eventual goal of establishing a universal system that can automatically identify and distinguish all variants of cancer cells. The article can be found at: Toratani et al. (2018) A Convolutional Neural Network Uses Microscopic Images to Differentiate between Mouse and Human Cell Lines and Their Radioresistant Clones. Read more from Asian Scientist Magazine at: https://www.asianscientist.com/2018/12/in-the-lab/artificial-intelligence-microscopy-cancer-cell-radiotherapy/

Source: AI Automatically Sorts Cancer Cells | Asian Scientist Magazine | Science, technology and medical news updates from Asia

This Roomba can create its own Doom levels

Posted on by

Game developer and designer Rich Whitehouse gave the world an unusual present this Christmas Eve. It’s called Doomba, and it uses the popular Roomba vacuuming robots to create levels for Doom, the classic first-person shooter.

Whitehouse is a 20-year veteran of the game industry, with credits on titles such as the original Prey and Star Wars Jedi Knight 2: Jedi Outcast. Along the way, he also built a tool called Neosis, which helps game developers and designers move digital assets between different platforms. The Doomba module works on similar principles; it just takes the digital maps created by the Roomba’s own internal software and converts them into Doom levels.

So what’s your Roomba doing creating maps of the inside of your house? Many of iRobot’s modern robotic vacuums rely on VSLAM, also known as visual simultaneous localization and mapping. Rather than wandering around like slow-moving ping-pong balls, modern Roomba devices methodically sweep back and forth in long passes like they’re mowing your lawn. That makes them much more efficient than previous models.

To do the work, some Roombas use a creepy little electronic eyeball to create detailed maps of your home. Doomba takes that map and makes it into a level of Hell.

As Whitehouse explains, it was fairly short work to turn his creation toward evil.

“I soon realized that there was a clear opportunity to serve the Dark Lord by conceiving a plethora of unholy algorithms in service to one of the finest works ever created in his name,” Whitehouse writes on his personal blog. “Simultaneously, I would be able to unleash a truly terrible pun to plague humankind. Now, the fruit of my labor is born. I bring forth DOOMBA, a half-goat, half-script creature, with native binary backing for the expensive parts, to be offered in place of my firstborn on this fine Christmas Eve.”

Source: This Roomba can create its own Doom levels – Polygon

In Blow to Amazon and Walmart, India Bans a Key Part of Their Business Strategy

Posted on by

The Indian government sent a strong screw you to Amazon and the Walmart-owned Flipkart on Wednesday, banning e-commerce companies from selling products from companies that they have an equity interest in or “entering into exclusive agreements with sellers,” CNBC reported.

India already bans e-commerce sites from selling products directly, per the New York Times, which has led to them acquiring stakes in affiliate companies that serve much the same purpose at arm’s length. At issue is the power of e-commerce companies to make bulk purchases of goods that they then sell to “select sellers, such as their affiliates or other companies with which they have agreements,” CNBC wrote. The strategy allows giants like Amazon to offer products at low prices that smaller competitors often find hard to match.

In a statement to CNBC, India’s commerce ministry said the new rules would go into effect on Feb. 1, 2019, adding the new rules specify that: “An entity having equity participation by e-commerce marketplace entity or its group companies, or having control on its inventory by e-commerce marketplace entity or its group companies, will not be permitted to sell its products on the platform run by such marketplace entity.”

The move could mean Amazon would be forced “to stop competing with independent sellers and end its offerings of proprietary products like its Echo smart speakers in India, its top emerging market,” the Times wrote. It’s also a blow to Walmart, which bought a 77 percent stake in Flipkart for $16 billion this year, and may be forced to stop selling products produced by companies it owns. As the paper noted, both companies’ competitive strategies rely on highly efficient supply chains and pressuring retailers to comply with their requirements, so this is not a good sign for their Indian ambitions.

The Times wrote that the decision appears to have been motivated by concerns from India’s prime minister, right-wing populist culture warrior Narendra Modi, that his party is losing ground ahead of upcoming elections:

Prime Minister Narendra Modi of India initially courted foreign companies to invest more in the country after his 2014 election victory, but his administration has turned protectionist as his party’s re-election prospects have dimmed in recent months. Mr. Modi has increasingly sought to bolster Indian firms and curb foreign ones through new policies, including one that requires foreign companies like Visa, Mastercard and American Express to store all data about Indians on computers inside the country. The government has also declared its intention to impose tough new rules on the technology industry.

According to CNBC, beneficiaries of the move will likely include owners of small businesses like farms and corner stores, the latter of which “dominate Indian retailing,” who believe that U.S.-based tech giants are trying to undermine their economic position. The site added that the Confederation of All India Traders issued a statement saying that tech giants will no longer to be able to commit “malpractices, predatory pricing policies and deep discounting.”

However, the law was vaguely written and contains some sections that appear to contradict each other, lawyer Salman Waris of New Delhi’s TechLegis told the Times, which means that its ultimate impact remains unclear. The paper also noted that Amazon is well-known for navigating Indian law to remain in compliance without losing its ability to steer markets, though Walmart’s decision to acquire Flipkart has already been questioned by analysts as a potentially unwise financial move.

Source: In Blow to Amazon and Walmart, India Bans a Key Part of Their Business Strategy

It is way beyond time to start breaking up the monopolies and 0.00000001%ers. Way to go, India!

Mapping All of the Trees with Machine Learning

Posted on by

Much fuss has been made over city trees in recent years. Urban trees reduce crime and help stormwater management (yay!). Cities and towns across the U.S. are losing 36 million trees a year (boo!). But, hold up—climate change is accelerating the growth of urban trees in metropolises worldwide (boo/yay?). Urban trees are under such scrutiny right now that the U.N. even had a World Forum on Urban Forests a few weeks ago to discuss the planning, design and management of urban forests and green infrastructure.

The Descartes Labs tree canopy layer around the Baltimore Beltway. Treeless main roads radiate from the dense pavement of the city to leafy suburbs.

All this fuss is not without good reason. Trees are great! They make oxygen for breathing, suck up CO₂, provide shade, reduce noise pollution, and just look at them — they’re beautiful!

[…]

So Descartes Labs built a machine learning model to identify tree canopy using a combination of lidar, aerial imagery and satellite imagery. Here’s the area surrounding the Boston Common, for example. We clearly see that the Public Garden, Common and Commonwealth Avenue all have lots of trees. But we also see some other fun artifacts. The trees in front of the CVS in Downtown Crossing, for instance, might seem inconsequential to a passer-by, but they’re one of the biggest concentrations of trees in the neighborhood.

[…]

The classifier can be run over any location in the world where we have approximately 1-meter resolution imagery. When using NAIP imagery, for instance, the resolution of the tree canopy map is as high as 60cm. Drone imagery would obviously yield an even higher resolution.

Washington, D.C. tree canopy created with NAIP source imagery shown at different scales—all the way down to individual “TREES!” on The Ellipse.

The ability to map tree canopy at a such a high resolution in areas that can’t be easily reached on foot would be helpful for utility companies to pinpoint encroachment issues—or for municipalities to find possible trouble spots beyond their official tree census (if they even have one). But by zooming out to a city level, patterns in the tree canopy show off urban greenspace quirks. For example, unexpected tree deserts can be identified and neighborhoods that would most benefit from a surge of saplings revealed.

Source: Mapping All of the Trees with Machine Learning – Tim Wallace – Medium

The Amazon Alexa Eavesdropping Nightmare Came True: Creepy Recordings sent to random stranger

Posted on by

An Amazon user in Germany recently requested data about his personal activities and inadvertently gained access to 1,700 audio recordings of someone he didn’t know.

Germany’s c’t magazine reports that in August the Amazon user—exercising his rights under the EU’s General Data Protection Regulation—requested his own data that Amazon has stored. Two months later, Amazon sent him a downloadable 100Mb zip file.

Some of the files reportedly related to his Amazon searches. But according to the report there were also hundreds of Wav files and a PDF cataloging transcripts of Alexa’s interpretations of voice commands. According to c’t magazine, this was peculiar to this user because he doesn’t own any Alexa devices and had never used the service. He also didn’t recognize the voices in the files.

The user reported the matter to Amazon and asked for information. He reportedly didn’t receive a response, but soon found that the link to the data was dead. However, he had already saved the files, and he shared his experience with c’t magazine out of concern that the person whose privacy had been compromised was not told about the mistake.

C’t magazine listened to many of the files and was able “to piece together a detailed picture of the customer concerned and his personal habits.” It found that he used Alexa in various places, has an Echo at home, and has a Fire device on his TV. They noticed that a woman was around at times. They listened to him in the shower.

We were able to navigate around a complete stranger’s private life without his knowledge, and the immoral, almost voyeuristic nature of what we were doing got our hair standing on end. The alarms, Spotify commands, and public transport inquiries included in the data revealed a lot about the victims’ personal habits, their jobs, and their taste in music. Using these files, it was fairly easy to identify the person involved and his female companion. Weather queries, first names, and even someone’s last name enabled us to quickly zero in on his circle of friends. Public data from Facebook and Twitter rounded out the picture.

Using the information they gathered from the recordings, the magazine contacted the victim of the data leak. He “was audibly shocked,” and confirmed it was him in the recordings and that the outlet had figured out the identity of his girlfriend. He said Amazon did not contact him.

Days later, both the victim and the receiver of the files were called by Amazon to discuss the incident. Both were reportedly called three days after c’t magazine contacted Amazon about the matter. An Amazon representative reportedly told them that one of their staff members had made a one-time error.

When asked for comment on the matter, Amazon sent Gizmodo the same statement it had shared with Reuters. “This was an unfortunate case of human error and an isolated incident. We have resolved the issue with the two customers involved and have taken steps to further improve our processes. We were also in touch on a precautionary basis with the relevant regulatory authorities.”

Amazon did not answer Gizmodo’s questions about how a human error led to this privacy infringement, or whether the company had initially contacted the victim to inform them their sensitive information was shared with a stranger.

Source: The Amazon Alexa Eavesdropping Nightmare Came True

Breakthrough ultrasound treatment to reverse dementia moves to human trials

Posted on by

An extraordinarily promising new technique using ultrasound to clear the toxic protein clumps thought to cause dementia and Alzheimer’s disease is moving to the first phase of human trials next year. The innovative treatment has proven successful across several animal tests and presents an exciting, drug-free way to potentially battle dementia.

The ultrasound treatment was first developed back in 2015 at the University of Queensland. The initial research was working to find a way to use ultrasound to temporarily open the blood-brain barrier with the goal of helping dementia-battling antibodies better reach their target in the brain. However, early experiments with mice surprisingly revealed the targeted ultrasound waves worked to clear toxic amyloid protein plaques from the brain without any additional therapeutic drugs.

“The ultrasound waves oscillate tremendously quickly, activating microglial cells that digest and remove the amyloid plaques that destroy brain synapses,” explained JĂźrgen GĂśtz, one of the researchers on the project back in 2015. “The word ‘breakthrough’ is often mis-used, but in this case I think this really does fundamentally change our understanding of how to treat this disease, and I foresee a great future for this approach.”

Source: Breakthrough ultrasound treatment to reverse dementia moves to human trials