How AI Can Spot Exam Cheats and Raise Standards

Posted on by

AI is being deployed by those who set and mark exams to reduce fraud — which remains overall a small problem — and to create far greater efficiencies in preparation and marking, and to help improve teaching and studying. From a report, which may be paywalled: From traditional paper-based exam and textbook producers such as Pearson, to digital-native companies such as Coursera, online tools and artificial intelligence are being developed to reduce costs and enhance learning. For years, multiple-choice tests have allowed scanners to score results without human intervention. Now technology is coming directly into the exam hall. Coursera has patented a system to take images of students and verify their identity against scanned documents. There are plagiarism detectors that can scan essay answers and search the web — or the work of other students — to identify copying. Webcams can monitor exam locations to spot malpractice. Even when students are working, they provide clues that can be used to clamp down on cheats. They leave electronic “fingerprints” such as keyboard pressure, speed and even writing style. Emily Glassberg Sands, Cousera’s head of data science, says: “We can validate their keystroke signatures. It’s difficult to prepare for someone hell-bent on cheating, but we are trying every way possible.”

Source: How AI Can Spot Exam Cheats and Raise Standards – Slashdot

Spyware Company Leaves ‘Terabytes’ of Selfies, Text Messages, and Location Data Exposed Online

Posted on by

A company that sells surveillance software to parents and employers left “terabytes of data” including photos, audio recordings, text messages and web history, exposed in a poorly-protected Amazon S3 bucket.

Image: Shutterstock

This story is part of When Spies Come Home, a Motherboard series about powerful surveillance software ordinary people use to spy on their loved ones.

A company that markets cell phone spyware to parents and employers left the data of thousands of its customers—and the information of the people they were monitoring—unprotected online.

The data exposed included selfies, text messages, audio recordings, contacts, location, hashed passwords and logins, Facebook messages, among others, according to a security researcher who asked to remain anonymous for fear of legal repercussions.

Last week, the researcher found the data on an Amazon S3 bucket owned by Spyfone, one of many companies that sell software that is designed to intercept text messages, calls, emails, and track locations of a monitored device.

Source: Spyware Company Leaves ‘Terabytes’ of Selfies, Text Messages, and Location Data Exposed Online – Motherboard

Woman sentenced to more than 5 years for leaking info about Russia hacking attempts. Trump still on the loose.

Posted on by

A former government contractor who pleaded guilty to leaking U.S. secrets about Russia’s attempts to hack the 2016 presidential election was sentenced Thursday to five years and three months in prison.

It was the sentence that prosecutors had recommended — the longest ever for a federal crime involving leaks to the news media — in the plea deal for Reality Winner, the Georgia woman at the center of the case. Winner was also sentenced to three years of supervised release and no fine, except for a $100 special assessment fee.

The crime carried a maximum penalty of 10 years. U.S. District Court Judge J. Randal Hall in Augusta, Georgia, was not bound to follow the plea deal, but elected to give Winner the amount of time prosecutors requested.

Source: Reality Winner sentenced to more than 5 years for leaking info about Russia hacking attempts

How a hacker network turned stolen press releases into $100 million

Posted on by

At a Kiev nightclub in the spring of 2012, 24-year-old Ivan Turchynov made a fateful drunken boast to some fellow hackers. For years, Turchynov said, he’d been hacking unpublished press releases from business newswires and selling them, via Moscow-based middlemen, to stock traders for a cut of the sizable profits.

Oleksandr Ieremenko, one of the hackers at the club that night, had worked with Turchynov before and decided he wanted in on the scam. With his friend Vadym Iermolovych, he hacked Business Wire, stole Turchynov’s inside access to the site, and pushed the main Moscovite ringleader, known by the screen name eggPLC, to bring them in on the scheme. The hostile takeover meant Turchynov was forced to split his business. Now, there were three hackers in on the game.

Newswires like Business Wire are clearinghouses for corporate information, holding press releases, regulatory announcements, and other market-moving information under strict embargo before sending it out to the world. Over a period of at least five years, three US newswires were hacked using a variety of methods from SQL injections and phishing emails to data-stealing malware and illicitly acquired login credentials. Traders who were active on US stock exchanges drew up shopping lists of company press releases and told the hackers when to expect them to hit the newswires. The hackers would then upload the stolen press releases to foreign servers for the traders to access in exchange for 40 percent of their profits, paid to various offshore bank accounts. Through interviews with sources involved with both the scheme and the investigation, chat logs, and court documents, The Verge has traced the evolution of what law enforcement would later call one of the largest securities fraud cases in US history.

Source: How a hacker network turned stolen press releases into $100 million – The Verge

Android data slurping measured and monitored – scary amounts and loads of location tracking

Posted on by

Google’s passive collection of personal data from Android and iOS has been monitored and measured in a significant academic study.

The report confirms that Google is no respecter of the Chrome browser’s “incognito mode” aka “porn mode”, collecting Chrome data to add to your personal profile, as we pointed out earlier this year.

It also reveals how phone users are being tracked without realising it. How so? It’s here that the B2B parts of Google’s vast data collection network – its publisher and advertiser products – kick into life as soon the user engages with a phone. These parts of Google receive personal data from an Android even when the phone is static and not being used.

The activity has come to light thanks to research (PDF) by computer science professor Douglas Schmidt of Vanderbilt University, conducted for the nonprofit trade association Digital Content Next. It’s already been described by one privacy activist as “the most comprehensive report on Google’s data collection practices so far”.

[…]

Overall, the study discovered that Apple retrieves much less data than Google.

“The total number of calls to Apple servers from an iOS device was much lower, just 19 per cent the number of calls to Google servers from an Android device.

Moreover, there are no ad-related calls to Apple servers, which may stem from the fact that Apple’s business model is not as dependent on advertising as Google’s. Although Apple does obtain some user location data from iOS devices, the volume of data collected is much (16x) lower than what Google collects from Android,” the study noted.

Source: Android data slurping measured and monitored • The Register

The amount of location data slurped is scary – and it continues to slurp location in many different ways, even if wifi is turned off. It’s Big Brother in your pocket, with no opt out.

Bitcoin mining now apparently accounts for almost one percent of the world’s energy consumption

Posted on by

According to testimony provided by Princeton computer scientist Arvind Narayanan to the Senate Committee on Energy and Natural Resources, no matter what you do to make cryptocurrency mining harware greener, it’s a drop in the bucket compared to the overall network’s flabbergasting energy consumption. Instead, Narayanan told the committee, the only thing that really determines how much energy Bitcoin uses is its price. “If the price of a cryptocurrency goes up, more energy will be used in mining it; if it goes down, less energy will be used,” he told the committee. “Little else matters. In particular, the increasing energy efficiency of mining hardware has essentially no impact on energy consumption.”

In his testimony, Narayanan estimates that Bitcoin mining now uses about five gigawatts of electricity per day (in May, estimates of Bitcoin power consumption were about half of that). He adds that when you’ve got a computer racing with all its might to earn a free Bitcoin, it’s going to be running hot as hell, which means you’re probably using even more electricity to keep the computer cool so it doesn’t die and/or burn down your entire mining center, which probably makes the overall cost associated with mining even higher.

Source: Bitcoin mining now accounts for almost one percent of the world’s energy consumption | The Outline

Huawei reverses its stance, will no longer allow bootloader unlocking – will lose many customers

Posted on by

In order to deliver the best user experience and prevent users from experiencing possible issues that could arise from ROM flashing, including system failure, stuttering, worsened battery performance, and risk of data being compromised, Huawei will cease providing bootloader unlock codes for devices launched after May 25, 2018. For devices launched prior to the aforementioned date, the termination of the bootloader code application service will come into effect 60 days after today’s announcement. Moving forward, Huawei remains committed to providing quality services and experiences to its customers. Thank you for your continued support.

When you take into consideration that Huawei — for years — not only supported the ROM community but actively assisted in the unlocking of Huawei bootloaders, this whole switch-up doesn’t make much sense. But, that’s the official statement, so do with it what you will.

Original Article: For years now, the custom ROM development community has flocked to Huawei phones. One of the major reasons for this is because Huawei made it incredibly easy to unlock the bootloaders of its devices, even providing a dedicated support page for the process.

Source: Huawei reverses its stance, will no longer allow bootloader unlocking

Oi, clickbait cop bot, jam this in your neural net: Hot new AI threatens to DESTROY web journos

Posted on by

Artificial intelligent software has been trained to detect and flag up clickbait headlines.

And here at El Reg we say thank God Larry Wall for that. What the internet needs right now is software to highlight and expunge dodgy article titles about space alien immigrants, faked moon landings, and the like.

Machine-learning eggheads continue to push the boundaries of natural language processing, and have crafted a model that can, supposedly, detect how clickbait-y a headline really is.

The system uses a convolutional neural network that converts the words in a submitted article title into vectors. These numbers are fed into a long-short-term memory network that spits out a score based on the headline’s clickbait strength. About eight times out of ten it agreed with humans on whether a title was clickbaity or not, we’re told.

The trouble is, what exactly is a clickbait headline? It’s a tough question. The AI’s team – from the International Institute of Information Technology in Hyderabad, the Manipal Institute of Technology, and Birla Institute of Technology, in India – decided to rely on the venerable Merriam-Webster dictionary to define clickbait.

Source: Oi, clickbait cop bot, jam this in your neural net: Hot new AI threatens to DESTROY web journos • The Register

Facebook Wanted to Kill This Investigative People You May Know Tool

Posted on by

Last year, we launched an investigation into how Facebook’s People You May Know tool makes its creepily accurate recommendations. By November, we had it mostly figured out: Facebook has nearly limitless access to all the phone numbers, email addresses, home addresses, and social media handles most people on Earth have ever used. That, plus its deep mining of people’s messaging behavior on Android, means it can make surprisingly insightful observations about who you know in real life—even if it’s wrong about your desire to be “friends” with them on Facebook.

In order to help conduct this investigation, we built a tool to keep track of the people Facebook thinks you know. Called the PYMK Inspector, it captures every recommendation made to a user for however long they want to run the tool. It’s how one of us discovered Facebook had linked us with an unknown relative. In January, after hiring a third party to do a security review of the tool, we released it publicly on Github for users who wanted to study their own People You May Know recommendations. Volunteers who downloaded the tool helped us explore whether you’ll show up in someone’s People You Know after you look at their profile. (Good news for Facebook stalkers: Our experiment found you won’t be recommended as a friend just based on looking at someone’s profile.)

Facebook wasn’t happy about the tool.

The day after we released it, a Facebook spokesperson reached out asking to chat about it, and then told us that the tool violated Facebook’s terms of service, because it asked users to give it their username and password so that it could sign in on their behalf. Facebook’s TOS states that, “You will not solicit login information or access an account belonging to someone else.” They said we would need to shut down the tool (which was impossible because it’s an open source tool) and delete any data we collected (which was also impossible because the information was stored on individual users’ computers; we weren’t collecting it centrally).

We argued that we weren’t seeking access to users’ accounts or collecting any information from them; we had just given users a tool to log into their own accounts on their own behalf, to collect information they wanted collected, which was then stored on their own computers. Facebook disagreed and escalated the conversation to their head of policy for Facebook’s Platform, who said they didn’t want users entering their Facebook credentials anywhere that wasn’t an official Facebook site—because anything else is bad security hygiene and could open users up to phishing attacks. She said we needed to take our tool off Github within a week.

Source: Facebook Wanted Us to Kill This Investigative Tool

It’s either legal to port-scan someone without consent or it’s not, fumes researcher: Halifax bank port scans you when you visit the page

Posted on by

Halifax Bank scans the machines of surfers that land on its login page whether or not they are customers, it has emerged.

Security researcher Paul Moore has made his objection to this practice – in which the British bank is not alone – clear, even though it is done for good reasons. The researcher claimed that performing port scans on visitors without permission is a violation of the UK’s Computer Misuse Act (CMA).

Halifax has disputed this, arguing that the port scans help it pick up evidence of malware infections on customers’ systems. The scans are legal, Halifax told Moore in response to a complaint he made on the topic last month.

If security researchers operate in a similar fashion, we almost always run into the Computer Misuse Act, even if their intent isn’t malicious. The CMA should be applied fairly…

When you visit the Halifax login page, even before you’ve logged in, JavaScript on the site, running in the browser, attempts to scan for open ports on your local computer to see if remote desktop or VNC services are running, and looks for some general remote access trojans (RATs) – backdoors, in other words. Crooks are known to abuse these remote services to snoop on victims’ banking sessions.

Moore said he wouldn’t have an issue if Halifax carried out the security checks on people’s computers after they had logged on. It’s the lack of consent and the scanning of any visitor that bothers him. “If they ran the script after you’ve logged in… they’d end up with the same end result, but they wouldn’t be scanning visitors, only customers,” Moore said.

Halifax told Moore: “We have to port scan your machine for security reasons.”

Having failed to either persuade Halifax Bank to change its practices or Action Fraud to act (thus far1), Moore last week launched a fundraising effort to privately prosecute Halifax Bank for allegedly breaching the Computer Misuse Act. This crowdfunding effort on GoFundMe aims to gather £15,000 (so far just £50 has been raised).

Halifax Bank’s “unauthorised” port scans are a clear violation of the CMA – and amounts to an action that security researchers are frequently criticised and/or convicted for, Moore argued. The CISO and part-time security researcher hopes his efforts in this matter might result in a clarification of the law.

“Ultimately, we can’t have it both ways,” Moore told El Reg. “It’s either legal to port scan someone without consent, or with consent but no malicious intent, or it’s illegal and Halifax need to change their deployment to only check customers, not visitors.”

The whole effort might smack of tilting at windmills, but Moore said he was acting on a point of principle.

“If security researchers operate in a similar fashion, we almost always run into the CMA, even if their intent isn’t malicious. The CMA should be applied fairly to both parties.”

Source: Bank on it: It’s either legal to port-scan someone without consent or it’s not, fumes researcher • The Register

Critical OpenEMR Flaws Left Medical Records Vulnerable

Posted on by

Security researchers have found more than 20 bugs in the world’s most popular open source software for managing medical records. Many of the vulnerabilities were classified as severe, leaving the personal information of an estimated 90 million patients exposed to bad actors.

OpenEMR is open source software that’s used by medical offices around the world to store records, handle schedules, and bill patients. According to researchers at Project Insecurity, it was also a bit of a security nightmare before a recent audit recommended a range of vital fixes.

The firm reached out to OpenEMR in July to discuss concerns it had about the software’s code. On Tuesday a report was released detailing the issues that included: “a portal authentication bypass, multiple instances of SQL injection, multiple instances of remote code execution, unauthenticated information disclosure, unrestricted file upload, CSRFs including a CSRF to RCE proof of concept, and unauthenticated administrative actions.”

Eighteen of the bugs were designated as having a “high” severity and could’ve been exploited by hackers with low-level access to systems running the software. Patches have been released to users and cloud customers.

OpenEMR’s project administrator Brady Miller told the BBC, “The OpenEMR community takes security seriously and considered this vulnerability report high priority since one of the reported vulnerabilities did not require authentication.”

Source: Critical OpenEMR Flaws Left Medical Records Vulnerable

Facebook: We’re not asking for financial data, we’re just partnering with banks

Posted on by

Facebook is pushing back against a report in Monday’s Wall Street Journal that the company is asking major banks to provide private financial data.

The social media giant has reportedly had talks with JPMorgan Chase, Wells Fargo, Citigroup, and US Bancorp to discuss proposed features including fraud alerts and checking account balances via Messenger.

Elisabeth Diana, a Facebook spokeswoman, told Ars that while the WSJ reported that Facebook has “asked” banks “to share detailed financial information about their customers, including card transactions and checking-account balances,” this isn’t quite right.

“Like many online companies with commerce businesses, we partner with banks and credit card companies to offer services like customer chat or account management,” she said in a statement on behalf of the social media giant. “Account linking enables people to receive real-time updates in Facebook Messenger where people can keep track of their transaction data like account balances, receipts, and shipping updates. The idea is that messaging with a bank can be better than waiting on hold over the phone—and it’s completely opt-in. We’re not using this information beyond enabling these types of experiences—not for advertising or anything else.”

Diana further explained that account linking is already live with PayPal, Citi in Singapore, and American Express in the United States.

“We’re not shoring up financial data,” she added.

In recent months, Facebook has been scrutinized for its approach to user privacy.

Late last month, Facebook CFO David Wehner said, “We are also giving people who use our services more choices around data privacy, which may have an impact on our revenue growth.”

Source: Facebook: We’re not asking for financial data, we’re just partnering with banks | Ars Technica

But should you opt in, your financial data just happens to then belong to Facebook to do with as they please…

The cashless society is a con – and big finance is behind it

Posted on by

All over the western world banks are shutting down cash machines and branches. They are trying to push you into using their digital payments and digital banking infrastructure. Just like Google wants everyone to access and navigate the broader internet via its privately controlled search portal, so financial institutions want everyone to access and navigate the broader economy through their systems.

Another aim is to cut costs in order to boost profits. Branches require staff. Replacing them with standardised self-service apps allows the senior managers of financial institutions to directly control and monitor interactions with customers.

Banks, of course, tell us a different story about why they do this. I recently got a letter from my bank telling me that they are shutting down local branches because “customers are turning to digital”, and they are thus “responding to changing customer preferences”. I am one of the customers they are referring to, but I never asked them to shut down the branches.

There is a feedback loop going on here. In closing down their branches, or withdrawing their cash machines, they make it harder for me to use those services. I am much more likely to “choose” a digital option if the banks deliberately make it harder for me to choose a non-digital option.

In behavioural economics this is referred to as “nudging”. If a powerful institution wants to make people choose a certain thing, the best strategy is to make it difficult to choose the alternative.

[…]

Financial institutions, likewise, are trying to nudge us towards a cashless society and digital banking. The true motive is corporate profit. Payments companies such as Visa and Mastercard want to increase the volume of digital payments services they sell, while banks want to cut costs. The nudge requires two parts. First, they must increase the inconvenience of cash, ATMs and branches. Second, they must vigorously promote the alternative. They seek to make people “learn” that they want digital, and then “choose” it.

We can learn from the Marxist philosopher Antonio Gramsci in this regard. His concept of hegemony referred to the way in which powerful parties condition the cultural and economic environment in such a way that their interests begin to be perceived as natural and inevitable by the general public. Nobody was on the streets shouting for digital payment 20 years ago, but increasingly it seems obvious and “natural” that it should take over. That belief does not come from nowhere. It is the direct result of a hegemonic project on the part of financial institutions.

We can also learn from Louis Althusser’s concept of interpellation. The basic idea is that you can get people to internalise beliefs by addressing them as if they already had those beliefs. Twenty years ago nobody believed that cash was “inconvenient”, but every time I walk into London Underground I see adverts that address me as if I was a person who finds cash inconvenient. The objective is to reverse-engineer a belief within me that it is inconvenient, and that cashlessness is in my interests. But a cashless society is not in your interest. It is in the interest of banks and payments companies. Their job is to make you believe that it is in your interest too, and they are succeeding in doing that.

The recent Visa chaos, during which millions of people who have become dependent on digital payment suddenly found themselves stranded when the monopolistic payment network crashed, was a temporary setback. Digital systems may be “convenient”, but they often come with central points of failure. Cash, on the other hand, does not crash. It does not rely on external data centres, and is not subject to remote control or remote monitoring. The cash system allows for an unmonitored “off the grid” space. This is also the reason why financial institutions and financial technology companies want to get rid of it. Cash transactions are outside the net that such institutions cast to harvest fees and data.

A cashless society brings dangers. People without bank accounts will find themselves further marginalised, disenfranchised from the cash infrastructure that previously supported them. There are also poorly understood psychological implications about cash encouraging self-control while paying by card or a mobile phone can encourage spending. And a cashless society has major surveillance implications.

Source: The cashless society is a con – and big finance is behind it | Brett Scott | Opinion | The Guardian

Anti DRM software programmer Arrested For Cracking Denuvo Anti-Piracy Tech

Posted on by

Denuvo’s notorious anti-piracy tech used to be seen as uncrackable. It held up against hackers’ best efforts for years, contorting itself into obtuse new shapes every time anybody broke through. In 2016, a Bulgarian hacker calling himself Voksi came along with a breakthrough that revitalized the whole Denuvo cracking scene. He’s been a pillar of it ever since. Now he’s in deep trouble.

In a post today on CrackWatch, a subreddit dedicated to removing DRM and other copy protection software from games, Voksi explained the sudden outage of the website of his hacker group, REVOLT. Yesterday, he got arrested, and the police raided his house.

“It finally happened,” Voksi wrote. “I can’t say it wasn’t expected. Denuvo filed a case against me to the Bulgarian authorities. Police came yesterday and took the server PC and my personal PC. I had to go to the police afterwards and explain myself.”

In a statement sent to Kotaku, Denuvo said that Voksi’s arrest came about through the dual efforts of Denuvo parent company Irdeto and the Bulgarian Cybercrime Unit. “The swift action of the Bulgarian police on this matter shows the power of collaboration between law enforcement and technology providers and that piracy is a serious offence that will be acted upon,” said Irdeto VP of cybersecurity services Mark Mulready.

Denuvo’s statement also included a quote from the Bulgarian Cybercrime Unit, which said: “We can confirm that a 21-year-old man was arrested on Tuesday on suspicion of offenses related to cybercrime and that computing equipment was confiscated. Our investigations are ongoing.”

Source: Renowned Hacker Arrested For Cracking Denuvo Anti-Piracy Tech

It’s a bit bizarre when the guys making locks start arresting the guys making keys. DRM is a bad idea anyway, but arresting people for breaking it shows you’d rather sweep your problems under a rug than fixing them. If you arrest enough people, pretty soon you will find there are a lot more problems in your software. This has been proven time and again and won’t change now.

Maybe the authorities should arrest the Denuvo people on charges of installing unwanted software along with your game on your PC.

Work less, get more: New Zealand firm’s four-day week an ‘unmitigated success’

Posted on by

The New Zealand company behind a landmark trial of a four-day working week has concluded it an unmitigated success, with 78% of employees feeling they were able to successfully manage their work-life balance, an increase of 24 percentage points.

Two-hundred-and-forty staff at Perpetual Guardian, a company which manages trusts, wills and estate planning, trialled a four-day working week over March and April, working four, eight-hour days but getting paid for five.

Academics studied the trial before, during and after its implementation, collecting qualitative and quantitative data.

Perpetual Guardian founder Andrew Barnes came up with the idea in an attempt to give his employees better work-life balance, and help them focus on the business while in the office on company time, and manage life and home commitments on their extra day off.

Jarrod Haar, professor of human resource management at Auckland University of Technology, found job and life satisfaction increased on all levels across the home and work front, with employees performing better in their jobs and enjoying them more than before the experiment.

Work-life balance, which reflected how well respondents felt they could successfully manage their work and non-work roles, increased by 24 percentage points.

In November last year just over half (54%) of staff felt they could effectively balance their work and home commitments, while after the trial this number jumped to 78%.

Staff stress levels decreased by 7 percentage points across the board as a result of the trial, while stimulation, commitment and a sense of empowerment at work all improved significantly, with overall life satisfaction increasing by 5 percentage points.

Source: Work less, get more: New Zealand firm’s four-day week an ‘unmitigated success’ | World news | The Guardian

Windows 10 now uses machine learning to stop updates installing when a PC is in use

Posted on by

One of the more frustrating aspects of Windows 10 is the operating system’s ability to start installing updates when you’re in the middle of using it. While Microsoft has tried to address this aggressive approach to updates with features to snooze installation, Windows 10 users continue to complain that updates reboot devices when they’re in use.

Reacting to this feedback, Microsoft says it’s aware of the issues. “We heard you, and to alleviate this pain, if you have an update pending we’ve updated our reboot logic to use a new system that is more adaptive and proactive,” explains Microsoft’s Windows Insider chief Dona Sarkar. Microsoft says it has trained a “predictive model” that will accurately predict when the best time to restart the device is thanks to machine learning. “We will not only check if you are currently using your device before we restart, but we will also try to predict if you had just left the device to grab a cup of coffee and return shortly after,” says Sarkar.

Microsoft has been testing this new model internally, and says it has seen “promising results.”

Source: Windows 10 now uses machine learning to stop updates installing when a PC is in use – The Verge

Yet another great reason to not use Windows 10

Kremlin hackers ‘jumped air-gapped networks’ to pwn US power utilities

Posted on by

The US Department of Homeland Security is once again accusing Russian government hackers of penetrating America’s critical infrastructure.

Uncle Sam’s finest reckon Moscow’s agents managed to infiltrate computers networks within US electric utilities – to the point where the miscreants could have virtually pressed the off switch in control rooms, yanked the plug on the Yanks, and plunged America into darkness.

The hackers, dubbed Dragonfly and Energetic Bear, struck in the spring of 2016, and continued throughout 2017 and into 2018, even invading air-gapped networks, it is claimed.

This seemingly Hollywood screenplay emerged on Monday in the pages of the Wall Street Journal (paywalled) which spoke to Homeland Security officials on the record.

The Energetic Bear aka Dragonfly crew – fingered in 2014 by Crowdstrike and Symantec – was inside “hundreds” of power grid control rooms by last year, it is claimed. Indeed, since 2014, power companies have been warned by Homeland Security to be on the look out for state-backed snoops – with technical details on intrusions published here.

The Russians hacked into the utilities’ equipment vendors and suppliers by spear-phishing staff for their login credentials or installing malware on their machines via boobytrapped webpages, it is alleged.

The miscreants then leveraged their position within these vendors to infiltrate the utilities and squeeze into the isolated air-gapped networks in control rooms, it is further alleged. The hacker crew also swiped confidential internal information and blueprints to learn how American power plants and the grid system work.

We’re told, and can well believe, that the equipment makers and suppliers have special access into the utilities’ networks in order to provide remote around-the-clock support and patch deployment – access that, it seems, turned into a handy conduit for Kremlin spies.

The attacks are believed to be ongoing, and some utilities may not yet be aware they’ve been pwned, we were warned. It is feared the stolen information, as well as these early intrusions, could be part of a much larger looming assault.

“They got to the point where they could have thrown switches,” Jonathan Homer, chief of industrial control system analysis for Homeland Security, told the paper.

Source: No big deal… Kremlin hackers ‘jumped air-gapped networks’ to pwn US power utilities • The Register

UK snooping ‘unlawful for more than decade’ – but seemingly (and amazingly) responsible

Posted on by

The system that allowed spy agency GCHQ access to vast amounts of personal data from telecoms companies was unlawful for more than a decade, a surveillance watchdog has ruled.

The Investigatory Powers Tribunal said that successive foreign secretaries had delegated powers without oversight.

But it added there was no evidence GCHQ had misused the system.

Privacy International criticised the “cavalier manner” in which personal data was shared.

The group brought the legal challenge and solicitor Millie Graham Wood said it was “proof positive” that the system set up to protect personal data was flawed.

“The foreign secretary was supposed to protect access to our data by personally authorising what is necessary and proportionate for telecommunications companies to provide to the agencies.

“The way that these directions were drafted risked nullifying that safeguard by delegating that power to GCHQ – a violation that went undetected by the system of commissioners for years and was seemingly consented to by all of the telecommunications companies affected.”

Under security rules introduced after the attacks on 11 September 2001, the UK’s foreign secretary had the power to direct GCHQ to obtain data from telecoms companies, with little oversight of what they were subsequently asking for.

Carte blanche

The Investigatory Powers Tribunal (IPT) – set up to investigate complaints about how personal data is handled by public bodies – ruled that most of the directions given between 2001 and 2012 had been unlawful.

The tribunal was critical of the way the government handed on requests to GCHQ, partly because phone and internet providers “would not be in any position to question the scope of the requirement” because they “would have no knowledge of the limited basis upon which the direction had been made”.

“In form, the general direction was a carte blanche. In practice, it was not treated as such and there is no evidence that GCHQ ever sought to obtain communications data which fell outside the scope of data which had been sought in the submission to the foreign secretary,” the IPT ruled.

It added that a series of improvements had been made and were in force “from at least 2014” that ensured “great care” was now taken to ensure the foreign secretary approved any changes to the information being demanded from telecoms companies.

Source: UK snooping ‘unlawful for more than decade’ – BBC News

Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M

Posted on by

Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses.

According to a lawsuit filed last month in the Western District of Virginia, the first heist took place in late May 2016, after an employee at The National Bank of Blacksburg fell victim to a targeted phishing email.

The email allowed the intruders to install malware on the victim’s PC and to compromise a second computer at the bank that had access to the STAR Network, a system run by financial industry giant First Data that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards.

Armed with this access, the bank says, hackers were able to disable and alter anti-theft and anti-fraud protections, such as 4-digit personal identification numbers (PINs), daily withdrawal limits, daily debit card usage limits, and fraud score protections.

National Bank said the first breach began Saturday, May 28, 2016 and continued through the following Monday. Normally, the bank would be open on a Monday, but that particular Monday was Memorial Day, a federal holiday in the United States. The hackers used hundreds of ATMs across North America to dispense funds from customer accounts. All told, the perpetrators stole more than $569,000 in that incident.

[…]

But just eight months later — in January 2017 according to the lawsuit — hackers broke in to the bank’s systems once more, again gaining access to the financial institution’s systems via a phishing email.

[…]

Prior to executing the second heist, the hackers used the bank’s Navigator system to fraudulently credit more than $2 million to various National Bank accounts. As with the first incident, the intruders executed their heist on a weekend. Between Jan. 7 and 9, 2017, the hackers modified or removed critical security controls and withdrew the fraudulent credits using hundreds of ATMs.

All the while, the intruders used the bank’s systems to actively monitor customer accounts from which the funds were being withdrawn. At the conclusion of the 2017 heist, the hackers used their access to delete evidence of fraudulent debits from customer accounts. The bank’s total reported loss from that breach was $1,833,984.

Source: Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M — Krebs on Security

Bluetooth security: Flaw could allow nearby attacker to grab your private data

Posted on by

A cryptographic bug in many Bluetooth firmware and operating system drivers could allow an attacker within about 30 meters to capture and decrypt data shared between Bluetooth-paired devices.

The flaw was found by Lior Neumann and Eli Biham of the Israel Institute of Technology, and flagged today by Carnegie Mellon University CERT. The flaw, which is tracked as CVE-2018-5383, has been confirmed to affect Apple, Broadcom, Intel, and Qualcomm hardware, and some Android handsets. It affects Bluetooth’s Secure Simple Pairing and Low Energy Secure Connections. Fortunately for macOS users, Apple released a patch for the flaw in July.

As the CERT notification explains, the vulnerability is caused by some vendors’ Bluetooth implementations not properly validating the cryptographic key exchange when Bluetooth devices are pairing. The flaw slipped into the Bluetooth key exchange implementation which uses the elliptic-curve Diffie-Hellman (ECDH) key exchange to establish a secure connection over an insecure channel.

This may allow a nearby but remote attacker to inject a a bogus public key to determine the session key during the public-private key exchange. They could then conduct a man-in-the-middle attack and “passively intercept and decrypt all device messages, and/or forge and inject malicious messages”.

Source: Bluetooth security: Flaw could allow nearby attacker to grab your private data | ZDNet

On Highway Noise Barriers, the Science Is Mixed. Are There Alternatives?

Posted on by

Engineers and acousticians have known for years that the sound barriers bracketing America’s urban and suburban highways are only marginally useful, and that a variety of better technologies could be developed.

The problem: Nobody has an incentive to get them on the road.

“Walls are not a very effective solution,” said Robert Bernhard, vice president for research at the University of Notre Dame and an expert on noise control. Because the federal government pays for noise walls — and only noise walls — as part of highway expansion projects, he said, there is little incentive for researchers to keep testing and perfecting the alternatives.

Sound moves in not-so-mysterious ways, meaning that typical sound barriers have only limited effectiveness.

Visual: Wisconsin DOT

[…]

Even with the sound reduction, however, roadside residents are unlikely to hear crickets chirping. A dishwasher running in the next room is 50 dB, as are the ambient sounds of a laid-back city. The noise criteria aim to allow people to talk over their backyard picnic table, or shout at someone several feet away. “It’s not a situation where meeting the standard makes for a great backyard environment,” Bernhard said.

Of course, some of our ability to process sound is psychological: If people can see the tops of trucks over the wall they say it’s noisier, something people in the field call “psycho-coustics,” explained Bruce Rymer, a senior engineer at the California Department of Transportation. Just by ensuring a wall breaks that line of sight, “we achieve a reduction of 5 decibels,” said Mariano Berrios, environmental programs coordinator at FDOT.

But because noise travels in waves, not straight lines, sounds can and do go over the walls. This is why even with barriers standing 16 feet, homes several blocks away can hear the highway. Part of the sound wave is absorbed, part is reflected away from the wall, and part is transmitted through, Berrios explained. “Most of it goes above the barrier and gets diffracted, and gets to the receiver,” — that is, to a resident’s ears — he said.

This is especially problematic during certain weather conditions. When the consulting firm Bowlby & Associates, in Franklin, Tennessee, measured sounds around a highway in a yet-to-be-published study, they found that residents hundreds of feet from the highway could hear sounds some 5 decibels louder if the wind was blowing towards them, said Darlene D. Reiter, the firm’s president.

Weather, however, isn’t taken into account by the regulations. The noise model “assumes neutral conditions — no wind and no temperature effects — when in reality that happens only occasionally,” Reiter said. In the early morning, if the ground is cool but the air warms up, for instance, sound that would normally be pushed up is refracted downward, causing homes some 500 or 1,000 feet from the road to hear it loudly.

Source: On Highway Noise Barriers, the Science Is Mixed. Are There Alternatives?

Fur, Feathers, Hair, and Scales May Have the Same Ancient Origin

Posted on by

New research shows that the processes involved in hair, fur, and feather growth are remarkably similar to the way scales grow on fish—a finding that points to a single, ancient origin of these protective coverings.

When our very early ancestors transitioned from sea to land some 385 million years ago, they brought their armor-like scales along with them. But instead of wasting away like worthless vestigial organs, these scales retailed their utility at the genetic level, providing a springboard for adaptive skin-borne characteristics. Over time, scales turned into feathers, fur, and hair.

We know this from the archaeological record, but as a new research published this week in the science journal eLife shows, we also know this because the molecular processes required to grow hair, fur, and feathers are remarkably similar to the ones involved in the development of fish scales.

Source: Fur, Feathers, Hair, and Scales May Have the Same Ancient Origin

AI can untangle the jumble of neurons packed in brain scans

Posted on by

AI can help neurologists automatically map the connections between different neurons in brain scans, a tedious task that can take hundreds and thousands of hours.

In a paper published in Nature Methods, AI researchers from Google collaborated with scientists from the Max Planck Institute of Neurobiology to inspect the brain of a Zebra Finch, a small Australian bird renowned for its singing.

Although the contents of their craniums are small, Zebra Finches aren’t birdbrains, their connectome* is densely packed with neurons. To study the connections, scientists study a slice of the brain using an electron microscope. It requires high resolution to make out all the different neurites, the nerve cells extending from neurons.

The neural circuits then have to be reconstructed by tracing out the cells. There are several methods that help neurologists flesh these out, but the error rates are high and it still requires human expertise to look over the maps. It’s a painstaking chore, a cubic millimetre of brain tissue can generate over 1,000 terabytes of data.

“A recent estimate put the amount of human labor needed to reconstruct a 1003-µm3 volume at more than 100,000 h, even with an optimized pipeline,” according to the paper.

Now, AI researchers have developed a new method using a recurrent convolutional neural network known as a “flood-filling network”. It’s essentially an algorithm that finds the edges of a neuron path and fleshes out the space in between to build up a map of the different connections.

Here’s a video showing how they work.

“The algorithm is seeded at a specific pixel location and then iteratively “fills” a region using a recurrent convolutional neural network that predicts which pixels are part of the same object as the seed,” said Viren Jain and Michal Januszewski, co-authors of the paper and AI researchers at Google.

The flood-filling network was trained using supervised learning on a small region of a Zebra Finch brain complete with annotations. It’s difficult to measure the accuracy of the network, and instead the researchers use a “expected run length” (ERL) metric that measures how far it can trace out a neuron before making a mistake.

Flood-filling networks have a longer ERL than other deep learning methods that have also been tested on the same dataset. The algorithms were better than humans at identifying dendritic spines, tiny threads jutting off dendrites that help transmit electrical signals to cells. But the level of recall, a property measuring the completeness of the map, was much lower than data collected by a professional neurologist.

Another significant disadvantage of this approach is the high computational cost. “For example, a single pass of the fully convolutional FFN over a full volume is an order of magnitude more computationally expensive than the more traditional 3D convolution-pooling architecture in the baseline approach we used for comparison,” the researchers said.

Source: AI can untangle the jumble of neurons packed in brain scans • The Register

The SIM Hijackers: how hackers take your phone number and then all of your accounts

Posted on by

In the buzzing underground market for stolen social media and gaming handles, a short, unique username can go for between $500 and $5,000, according to people involved in the trade and a review of listings on a popular marketplace. Several hackers involved in the market claimed that the Instagram account @t, for example, recently sold for around $40,000 worth of Bitcoin.

By hijacking Rachel’s phone number, the hackers were able to seize not only Rachel’s Instagram, but her Amazon, Ebay, Paypal, Netflix, and Hulu accounts too. None of the security measures Rachel took to secure some of those accounts, including two-factor authentication, mattered once the hackers took control of her phone number.

In February, T-Mobile sent a mass text warning customers of an “industry-wide” threat. Criminals, the company said, are increasingly utilizing a technique called “port out scam” to target and steal people’s phone numbers. The scam, also known as SIM swapping or SIM hijacking, is simple but tremendously effective.

First, criminals call a cell phone carrier’s tech support number pretending to be their target. They explain to the company’s employee that they “lost” their SIM card, requesting their phone number be transferred, or ported, to a new SIM card that the hackers themselves already own. With a bit of social engineering—perhaps by providing the victim’s Social Security Number or home address (which is often available from one of the many data breaches that have happened in the last few years)—the criminals convince the employee that they really are who they claim to be, at which point the employee ports the phone number to the new SIM card.

Game over.

“With someone’s phone number,” a hacker who does SIM swapping told me, “you can get into every account they own within minutes and they can’t do anything about it.”

Source: The SIM Hijackers – Motherboard

Top Voting Machine Vendor Admits It Installed Remote-Access Software on Systems Sold to States

Posted on by

Remote-access software and modems on election equipment ‘is the worst decision for security short of leaving ballot boxes on a Moscow street corner.’

The nation’s top voting machine maker has admitted in a letter to a federal lawmaker that the company installed remote-access software on election-management systems it sold over a period of six years, raising questions about the security of those systems and the integrity of elections that were conducted with them.

In a letter sent to Sen. Ron Wyden (D-OR) in April and obtained recently by Motherboard, Election Systems and Software acknowledged that it had “provided pcAnywhere remote connection software … to a small number of customers between 2000 and 2006,” which was installed on the election-management system ES&S sold them.

The statement contradicts what the company told me and fact checkers for a story I wrote for the New York Times in February. At that time, a spokesperson said ES&S had never installed pcAnywhere on any election system it sold. “None of the employees, … including long-tenured employees, has any knowledge that our voting systems have ever been sold with remote-access software,” the spokesperson said.

ES&S did not respond on Monday to questions from Motherboard, and it’s not clear why the company changed its response between February and April. Lawmakers, however, have subpoena powers that can compel a company to hand over documents or provide sworn testimony on a matter lawmakers are investigating, and a statement made to lawmakers that is later proven false can have greater consequence for a company than one made to reporters.

Source: Top Voting Machine Vendor Admits It Installed Remote-Access Software on Systems Sold to States – Motherboard

That is incredible poor, especially with all the talk of hackable voting machines.