The Linkielist

Linking ideas with the world

The Linkielist

This AI Can Automatically Animate New Flintstones Cartoons

Posted on by

Researchers have successfully trained artificial intelligence to generate new clips of the prehistoric animated series based on nothing but random text descriptions of what’s happening in a scene.

A team of researchers from the Allen Institute for Artificial Intelligence, and the University of Illinois Urbana-Champaign, trained an AI by feeding it over 25,000 three-second clips of the cartoon, which hasn’t seen any new episodes in over 50 years. Most AI experiments as of late have involved generating freaky images based on what was learned, but this time the researchers included detailed descriptions and annotations of what appeared, and what was happening, in every clip the AI ingested.

As a result, the new Flintstones animations generated by the Allen Institute’s AI aren’t just random collages of chopped up cartoons. Instead, the researchers are able to feed the AI a very specific description of a scene, and it outputs a short clip featuring the characters, props, and locations specified—most of the time.

The quality of the animations that are generated is awful at best; no one’s going to be fooled into thinking these are the Hanna-Barbera originals. But seeing an AI generate a cartoon, featuring iconic characters, all by itself, is a fascinating sneak peek at how some films and TV shows might be made one day.

Source: This AI Can Automatically Animate New Flintstones Cartoons

Properly random random number generator generated

Posted on by

From dice to modern electronic circuits, there have been many attempts to build better devices to generate random numbers. Randomness is fundamental to security and cryptographic systems and to safeguarding privacy. A key challenge with random-number generators is that it is hard to ensure that their outputs are unpredictable1,2,3. For a random-number generator based on a physical process, such as a noisy classical system or an elementary quantum measurement, a detailed model that describes the underlying physics is necessary to assert unpredictability. Imperfections in the model compromise the integrity of the device. However, it is possible to exploit the phenomenon of quantum non-locality with a loophole-free Bell test to build a random-number generator that can produce output that is unpredictable to any adversary that is limited only by general physical principles, such as special relativity1,2,3,4,5,6,7,8,9,10,11. With recent technological developments, it is now possible to carry out such a loophole-free Bell test12,13,14,22. Here we present certified randomness obtained from a photonic Bell experiment and extract 1,024 random bits that are uniformly distributed to within 10−12. These random bits could not have been predicted according to any physical theory that prohibits faster-than-light (superluminal) signalling and that allows independent measurement choices. To certify and quantify the randomness, we describe a protocol that is optimized for devices that are characterized by a low per-trial violation of Bell inequalities. Future random-number generators based on loophole-free Bell tests may have a role in increasing the security and trust of our cryptographic systems and infrastructure.

Source: Experimentally generated randomness certified by the impossibility of superluminal signals | Nature

Data exfiltrators send info over PCs’ power supply cables

Posted on by
If you want your computer to be really secure, disconnect its power cable.

So says Mordechai Guri and his team of side-channel sleuths at the Ben-Gurion University of the Negev.

The crew have penned a paper titled PowerHammer: Exfiltrating Data from Air-Gapped Computers through Power Lines that explains how attackers could install malware that regulates CPU utilisation and creates fluctuations in the current flow that could modulate and encode data. The variations would be “propagated through the power lines” to the outside world.

PowerHammer attack

Put the receiver near the user for highest speed, behind the panel for greatest secrecy

Depending on the attacker’s approach, data could be exfiltrated at between 10 and 1,000 bits-per-second. The higher speed would work if attackers can get at the cable connected to the computer’s power supply. The slower speed works if attackers can only access a building’s electrical services panel.

The PowerHammer malware spikes the CPU utilisation by choosing cores that aren’t currently in use by user operations (to make it less noticeable).

Guri and his pals use frequency shift keying to encode data onto the line.

After that, it’s pretty simple, because all the attacker needs is to decide where to put the receiver current clamp: near the target machine if you can get away with it, behind the switchboard if you have to.

Source: Data exfiltrators send info over PCs’ power supply cables • The Register

FDA approves AI-powered software to detect diabetic retinopathy

Posted on by

30.3 million Americans have diabetes according to a 2015 CDC study. An additional 84.1 million have prediabetes, which often leads to the full disease within five years. It’s important to detect diabetes early to avoid health complications like heart disease, stroke, amputation of extremities and vision loss. Technology increasingly plays an important role in early detection, too. In that vein, the US Food and Drug Administration (FDA) has just approved an AI-powered device that can be used by non-specialists to detect diabetic retinopathy in adults with diabetes.

Diabetic retinopathy occurs when the high levels of blood sugar in the bloodstream cause damage to your retina’s blood vessels. It’s the most common cause of vision loss, according to the FDA. The approval comes for a device called IDx-DR, a software program that uses an AI algorithm to analyze images of the eye that can be taken in a regular doctor’s office with a special camera, the Topcon NW400.

The photos are then uploaded to a server that runs IDx-DR, which can then tell the doctor if there is a more than mild level of diabetic retinopathy present. If not, it will advise a re-screen in 12 months. The device and software can be used by health care providers who don’t normally provide eye care services. The FDA warns that you shouldn’t be screened with the device if you have had laser treatment, eye surgery or injections, as well as those with other conditions, like persistent vision loss, blurred vision, floaters, previously diagnosed macular edema and more.

Source: FDA approves AI-powered software to detect diabetic retinopathy

After Millions of Trials, These Simulated Humans Learned to Do Perfect Backflips and Cartwheels

Posted on by

Using well-established machine learning techniques, researchers from University of California, Berkeley have taught simulated humanoids to perform over 25 natural motions, from somersaults and cartwheels through to high leg kicks and breakdancing. The technique could lead to more realistic video gameplay and more agile robots.

[…]

UC Berkeley graduate student Xue Bin “Jason” Peng, along with his colleagues, have combined two techniques—motion-capture technology and deep-reinforcement computer learning—to create something completely new: a system that teaches simulated humanoids how to perform complex physical tasks in a highly realistic manner. Learning from scratch, and with limited human intervention, the digital characters learned how to kick, jump, and flip their way to success. What’s more, they even learned how to interact with objects in their environment, such as barriers placed in their way or objects hurled directly at them.

[…]

The new system, dubbed DeepMimic, works a bit differently. Instead of pushing the simulated character towards a specific end goal, such as walking, DeepMimic uses motion-capture clips to “show” the AI what the end goal is supposed to look like. In experiments, Bin’s team took motion-capture data from more than 25 different physical skills, from running and throwing to jumping and backflips, to “define the desired style and appearance” of the skill, as Peng explained at the Berkeley Artificial Intelligence Research (BAIR) blog.

Results didn’t happen overnight. The virtual characters tripped, stumbled, and fell flat on their faces repeatedly until they finally got the movements right. It took about a month of simulated “practice” for each skill to develop, as the humanoids went through literally millions of trials trying to nail the perfect backflip or flying leg kick. But with each failure came an adjustment that took it closer to the desired goal.

Bots trained across a wide variety of skills.
GIF: Berkeley Artificial Intelligence Research

Using this technique, the researchers were able to produce agents who behaved in a highly realistic, natural manner. Impressively, the bots were also able to manage never-before-seen conditions, such as challenging terrain or obstacles. This was an added bonus of the reinforcement learning, and not something the researchers had to work on specifically.

“We present a conceptually simple [reinforcement learning] framework that enables simulated characters to learn highly dynamic and acrobatic skills from reference motion clips, which can be provided in the form of mocap data [i.e. motion capture] recorded from human subjects,” writes Peng. “Given a single demonstration of a skill, such as a spin-kick or a backflip, our character is able to learn a robust policy to imitate the skill in simulation. Our policies produce motions that are nearly indistinguishable from mocap,” adding that “We’re moving toward a virtual stuntman.”

Simulated dragon.
GIF: Berkeley Artificial Intelligence Research

Not to be outdone, the researchers used DeepMimic to create realistic movements from simulated lions, dinosaurs, and mythical beasts. They even created a virtual version of ATLAS, the humanoid robot voted most likely to destroy humanity. This platform could conceivably be used to produce more realistic computer animation, but also for virtual testing of robots.

Source: After Millions of Trials, These Simulated Humans Learned to Do Perfect Backflips and Cartwheels

Facebook admits: Apps were given users’ permission to go into their inboxes

Posted on by

Facebook has admitted that some apps had access to users’ private messages, thanks to a policy that allowed devs to request mailbox permissions.

The revelation came as current Facebook users found out whether they or their friends had used the “This Is Your Digital Life” app that allowed academic Aleksandr Kogan to collect data on users and their friends.

Users whose friends had been suckered in by the quiz were told that as a result, their public profile, Page likes, birthday and current city were “likely shared” with the app.

So far, so expected. But, the notification went on:

A small number of people who logged into “This Is Your Digital Life” also shared their own News Feed, timeline, posts and messages which may have included post and messages from you. They may also have shared your hometown.

That’s because, back in 2014 when the app was in use, developers using Facebook’s Graph API to get data off the platform could ask for read_mailbox permission, allowing them access to a person’s inbox.

That was just one of a series of extended permissions granted to devs under v1.0 of the Graph API, which was first introduced in 2010.

Following pressure from privacy activists – but much to the disappointment of developers – Facebook shut that tap off for most permissions in April 2015, although the changelog shows that read_mailbox wasn’t deprecated until 6 October 2015.

Facebook confirmed to The Register that this access had been requested by the app and that a small number of people had granted it permission.

“In 2014, Facebook’s platform policy allowed developers to request mailbox permissions but only if the person explicitly gave consent for this to happen,” a spokesborg told us.

“According to our records only a very small number of people explicitly opted into sharing this information. The feature was turned off in 2015.”

Source: Facebook admits: Apps were given users’ permission to go into their inboxes • The Register

How to Check if Cambridge Analytica Had Your Facebook Data

Posted on by

Facebook launched a tool yesterday that you can use to find out whether you or your friends shared information with Cambridge Analytica, the Trump-affiliated company that harvested data from a Facebook app to support the then-candidate’s efforts in the 2016 presidential election.

If you were affected directly—and you have plenty of company, if so—you should have already received a little notification from Facebook. If you missed that in your News Feed (or you’ve already sworn off Facebook, but want to check and see if your information was compromised), Facebook also has a handy little Cambridge Analytica tool you can use.

The problem? While the tool can tell you if you or your friends shared your information via the spammy “This is Your Digital Life” app, it won’t tell you who among your friends was foolish enough to give up your information to a third party. You have lost your ability to publicly shame them, yell at them, or go over to where they live (or fire up a remote desktop session) to teach them how to … not do that ever again.

So, what can you do now?

Even though your past Facebook data might already be out there in the digital ether somewhere, you can now start locking down your information a bit more. Once you’re done checking the Cambridge Analytica tool, go here (Facebook’s Settings page). Click on Apps and Websites. Up until recently, Facebook had a setting (under “Apps Others Use”) that you could use to restrict the information that your friends could share about you to apps they were using. Now, you’ll see this message instead:

“These outdated settings have been removed because they applied to an older version of our platform that no longer exists.

To see or change the info you currently share with apps and websites, review the ones listed above, under ‘Logged in with Facebook.’”

Sounds ominous, right? Well, according to Facebook, these settings haven’t really done much of anything for years, anyway. As a Facebook spokesperson recently told Wired:

“These controls were built before we made significant changes to how developers build apps on Facebook. At the time, the Apps Others Use functionality allowed people to control what information could be shared to developers. We changed our systems years ago so that people could not share friends’ information with developers unless each friend also had explicitly granted permission to the developer.”

Instead, take a little time to review (again) the apps you’ve allowed to access your Facebook information. If you’re not using the app anymore, or if it sounds a little fishy, remove it—heck, remove as many apps as you can in one go.

Source: How to Check if Cambridge Analytica Had Your Facebook Data

3D-printed public housing unveiled in France

Posted on by

NANTES, France (Reuters) – Researchers have unveiled what they billed as the world’s first 3D-printed house to serve as a home in the French city of Nantes, with the first tenants due to move in by June.

Academics at the University of Nantes who led the project said it was the first house built in situ for human habitation using a robot 3D-printer.

The robot, known as BatiPrint3D, uses a special polymer material that should keep the building insulated effectively for a century.

It took BatiPrint3D around 18 days to complete its part of the work on the house – creating hollow walls that were subsequently filled with concrete for insulation.

“Is this the future? It’s a solution and a constructive principle that is interesting because we create the house directly on site and in addition thanks to the robot, we are able to create walls with complex shapes,” said Benoit Furet, a professor who worked on the project.

The 95 square meter (1000 square feet), five-room house will be allocated to a local family which qualifies for social housing, authorities said.

The Y-shaped home is equipped with multiple sensors that monitor air quality, humidity and temperature, as well as equipment to evaluate and analyze the thermal properties of the building.

Researchers believe this technology will enable tenants to save on energy costs.

Authorities in Nantes are planning further 3D-printed building projects, including a public reception building and a housing estate.

Source: 3D-printed public housing unveiled in France

CubeYou: Cambridge-like app collected data on millions from Facebook

Posted on by

Facebook is suspending a data analytics firm called CubeYou from the platform after CNBC notified the company that CubeYou was collecting information about users through quizzes.

CubeYou misleadingly labeled its quizzes “for non-profit academic research,” then shared user information with marketers. The scenario is eerily similar to how Cambridge Analytica received unauthorized access to data from as many as 87 million Facebook user accounts to target political marketing.

CubeYou, whose CEO denies any deception, sold data that had been collected by researchers working with the Psychometrics Lab at Cambridge University, similar to how Cambridge Analytica used information it obtained from other professors at the school for political marketing.

The CubeYou discovery suggests that collecting data from quizzes and using it for marketing purposes was far from an isolated incident. Moreover, the fact that CubeYou was able to mislabel the purpose of the quizzes — and that Facebook did nothing to stop it until CNBC pointed out the problem — suggests the platform has little control over this activity.

[…]

CubeYou boasts on its website that it uses census data and various web and social apps on Facebook and Twitter to collect personal information. CubeYou then contracts with advertising agencies that want to target certain types of Facebook users for ad campaigns.

CubeYou’s site says it has access to personally identifiable information (PII) such as first names, last names, emails, phone numbers, IP addresses, mobile IDs and browser fingerprints.

On a cached version of its website from March 19, it also said it keeps age, gender, location, work and education, and family and relationship information. It also has likes, follows, shares, posts, likes to posts, comments to posts, check-ins and mentions of brands/celebrities in a post. Interactions with companies are tracked back to 2012 and are updated weekly, the site said.

Source: CubeYou Cambridge-like app collected data on millions from Facebook

$0.75 – about how much Cambridge Analytica paid per voter in bid to micro-target their minds, internal docs reveal

Posted on by

Cambridge Analytica bought psychological profiles on individual US voters, costing roughly 75 cents to $5 apiece, each crafted using personal information plundered from millions of Facebook accounts, according to revealed internal documents.

Over the course of the past two weeks, whistleblower Chris Wylie has made a series of claims against his former employer, Cambridge Analytica, and its parent organizations SCL Elections and SCL Group.

He has alleged CA drafted in university academic Dr Aleksander Kogan to help micro-target voters using their personal information harvested from Facebook, and that the Vote Leave campaign in the UK’s Brexit referendum “cheated” election spending limits by funneling money to Canadian political ad campaign biz AggregateIQ through a number of smaller groups.

Cambridge Analytica has denied using Facebook-sourced information in its work for Donald Trump’s US election campaign, and dubbed the allegations against it as “completely unfounded conspiracy theories.”

A set of internal CA files released Thursday by Britain’s House of Commons’ Digital, Culture, Media and Sport Select Committee includes contracts and email exchanges, plus micro-targeting strategies and case studies boasting of the organization’s influence in previous international campaigns.

Among them is a contract, dated June 4, 2014, revealing a deal struck between SCL Elections and Kogan’s biz Global Science Research, referred to as GS in the documents. It showed that Kogan was commissioned by SCL to build up psychological profiles of people, using data slurped from their Facebook accounts by a quiz app, and match them to voter records obtained by SCL.

The app was built by GS, installed by some 270,000 people, and was granted access to their social network accounts and those of their friends, up to 50 million of them. The information was sold to Cambridge Analytica by GS.

[…]

GS’s fee was a nominal £3.14, and up to $5 per person during the trial stage. The maximum payment would have been $150,000 for 30,000 records.

The price tag for the full sample was to be established after the trial, the document stated, but the total fee was not to exceed $0.75 per matched record. The total cost of the full sample stage would have been up to $1.5m for all two million matches. Wylie claimed roughly $1m was spent in the end.

[…]

Elsewhere in the cache are documents relating to the relationship between AggregateIQ and SCL.

One file laid out an AIQ contract to develop a platform called Ripon – which SCL and later CA is said to have used for micro-targeting political campaigns – in the run-up to the 2014 US mid-term elections. Although this document wasn’t signed, it indicated the first payment to AIQ was made on April 7, 2014: a handsome sum of $25,000 (CA$27,000, £18,000).

[…]

A separate contract showed the two companies had worked together before this. It is dated November 25, 2013, and set out a deal in wbhich AIQ would “assist” SCL by creating a constituent relationship management (CRM) system and help with the “acquisition of online data” for a political campaign in Trinidad and Tobago.

The payment for this work was $50,000, followed by three further installments of $50,000. The document is signed by AIQ cofounders: president Zackary Massingham, and chief operating officer Jeff Silvester. Project deliverables include data mapping, and use of behavioral datasets of qualified sources of data “that illustrate browsing activity, online behaviour and social contributions.”

A large section in the document, under the main heading for CRM deliverables, between sections labelled “reports” and “markup and CMS integration design / HTML markup,” is heavily redacted.

The document dump also revealed discussions between Rebekah Mercer, daughter of billionaire CA backer Robert Mercer, and Trump strategist Steve Bannon, about how to manage the involvement of UK-based Cambridge Analytica – a foreign company – with American elections and US election law, as well as praise for SCL from the UK’s Ministry of Defence.

Source: $0.75 – about how much Cambridge Analytica paid per voter in bid to micro-target their minds, internal docs reveal • The Register

Under Armour Data Breach: 150 Million MyFitnessPal Accounts Hacked

Posted on by

Under Armour Inc., joining a growing list of corporate victims of hacker attacks, said about 150 million user accounts tied to its MyFitnessPal nutrition-tracking app were breached earlier this year.

An unauthorized party stole data from the accounts in late February, Under Armour said on Thursday. It became aware of the breach earlier this week and took steps to alert users about the incident, the company said.

Shares of Under Armour fell as much as 4.6 percent to $15.59 in late trading following the announcement. The stock had been up 13 percent this year through Thursday’s close.

The data didn’t include payment-card information or government-issued identifiers, including Social Security numbers and driver’s license numbers. Still, user names, email addresses and password data were taken. And the sheer scope of the attack — affecting a user base that’s bigger than the population of Japan — would make it one of the larger breaches on record.

Source: Under Armour Data Breach: 150 Million MyFitnessPal Accounts Hacked | Fortune

Cambridge Analytica’s daddy biz SCL had ‘routine access’ to UK secrets

Posted on by

Cambridge Analytica’s parent biz had “routine access to UK secret information” as part of training it offered to the UK’s psyops group, according to documents released today.

A letter, published as part of a cache handed over to MPs by whisteblower Chris Wylie, details work that Strategic Communications Laboratories (SCL) carried out for the 15 (UK) Psychological Operations Group.

Dated 11 January 2012, it said that the group – which has since been subsumed into the unit 77 Brigade – received training from SCL, first as part of a commission and then on a continued basis without additional cost to the Ministry of Defence.

The author’s name is redacted, but it stated that SCL were a “UK List ‘X’ accredited company cleared to routine access to UK secret information”.

It said that five training staff from SCL provided the group with measurement of effect training over the course of two weeks, with students including Defence Science and Technology Ltd scientists, deploying military officers and senior soldiers.

It said that, because of SCL’s clearance, the final part of the package “was a classified case study from current operations in Helmand, Afghanistan”.

The author commented: “Such contemporary realism added enormous value to the course.”

The letter went on to say that, since delivery, SCL has continued to support the group “without additional charge to the MoD”, which involved “further testing of the trained product on operations in Libya and Afghanistan”.

Finally, the document’s author offered their recommendation for the service provided by SCL.

It said that, although the MoD is “officially disbarred from offering commercial endorsement”, the author would have “no hesitation in inviting SCL to tender for further contracts of this nature”.

They added: “Indeed it is my personal view that there are very few, if any, other commercial organisations that can deliver proven training and education of this very specialist nature.”

Source: Cambridge Analytica’s daddy biz had ‘routine access’ to UK secrets • The Register

Grindr’s API Surrendered Location Data to a Third-Party Website—Even After Users Opted Out

Posted on by

A website that allowed Gindr’s gay-dating app users to see who blocked them on the service says that by using the company’s API it was able to view unread messages, email addresses, deleted photos, and—perhaps most troubling—location data, according to a report published Wednesday.

The website, C*ckblocked, boasts of being the “first and only way to see who blocked you on Grindr.” The website’s owner, Trever Faden, told NBC that, by using Grindr’s API, he was able to access a wealth of personal information, including the location data of users—even for those who had opted to hide their locations.

“One could, without too much difficulty or even a huge amount of technological skill, easily pinpoint a user’s exact location,” Faden told NBC. But before he could access this information, Grindr users first had to supply C*ckblocked with their usernames and passwords, meaning that they voluntarily surrendered access to their accounts.

Grindr said that, once notified by Faden, it moved quickly to resolve the issue. The API that allowed C*ckblocked to function was patched on March 23rd, according to the website.

Source: Grindr’s API Surrendered Location Data to a Third-Party Website—Even After Users Opted Out

SpyParty – A Subtle Game About Human Behavior

Posted on by

SpyParty is a tense competitive spy game set at a high society party. It’s about subtle behavior, perception, and deception, instead of guns, car chases, and explosions. One player is the Spy, trying to accomplish missions while blending into the crowd. The other player is the Sniper, who has one bullet with which to find and terminate the Spy!

Source: SpyParty – A Subtle Game About Human Behavior

Mozilla launches Facebook container extension

Posted on by

This extension helps you control more of your web activity from Facebook by isolating your identity into a separate container. This makes it harder for Facebook to track your activity on other websites via third-party cookies.

Rather than stop using a service you find valuable and miss out on those adorable photos of your nephew, we think you should have tools to limit what data others can collect about you. That includes us: Mozilla does not collect data from your use of the Facebook Container extension. We only know the number of times the extension is installed or removed.

When you install this extension it will delete your Facebook cookies and log you out of Facebook. The next time you visit Facebook it will open in a new blue-colored browser tab (aka “container tab”). In that tab you can login to Facebook and use it like you normally would. If you click on a non-Facebook link or navigate to a non-Facebook website in the URL bar, these pages will load outside of the container.

Source: Facebook Container Extension: Take control of how you’re being tracked | The Firefox Frontier

The Interstitium Is Important, But Don’t Call It An Organ (Yet)

Posted on by

In brief: It’s called the interstitium, or a layer of fluid-filled pockets hemmed in by collagen and it can be found all over our bodies, from skin to muscles to our digestive system. The interstitium likely acts as a kind of shock absorber for the rest of our interior bits and bobs and the workings of the fluid itself could help explain everything from tumor growth to how cells move within our bodies. The authors stop short of saying “new organ,” but the word is certainly on everyone’s lips.

Is it just me, or are you feeling a bit of deja vu?

Well, maybe it’s just me, but that’s because I’ve been in this situation before. You see, just over a year ago, researchers announced that they’d discovered a different “new” organ — the mesentery. That particular collection of bodily tissue is a fan-shaped fold that helps hold our guts in place. It had been known about for centuries, but only recently discovered to be large and important enough to justify calling it an organ. It was to be the body’s 79th, but that number is entirely arbitrary.

As we discovered here at Discover, the definition of an organ is hardly settled (and we’re aware of what a church organ is, thankyouverymuch). As became apparent during the whole mesentery craze, there’s no real definition for what an organ actually is. And the human body doesn’t have 79 organs, or 80 organs, or 1,000 organs, because that number can change drastically depending on the definition. And you can bet scientists debate what an organ actually is.

“It’s a silly number,” said Paul Neumann, a professor of medicine at Dalhousie University in Canada and member of the Federative International Programme for Anatomical Terminology, in a Discover article from last year. “If a bone is an organ, there’s 206 organs right there. No two anatomists will agree on a list of organs in the body”

Calling the interstitium a new organ, then, is a bit of a stretch. It’s there, it’s certainly important, but we need a better idea of what an organ is before we can start labeling things as such.

There is a definition of sorts, but it’s got more wiggle room than your large intestine. An organ is composed of two or more tissues, is self-contained and performs a specific function, according to most definitions you get by Googling “what is an organ?” But there’s no governing body that explicitly determines what an organ is, and there’s no official definition. Things like skin, nipples, eyeballs, mesenteries and more have crossed into organ-dom and back throughout history as anatomists debated the definition.

Source: The Interstitium Is Important, But Don’t Call It An Organ (Yet)

Wylie: It’s possible that the Facebook app is listening to you

Posted on by

During an appearance before a committee of U.K. lawmakers today, Cambridge Analytica whistleblower Christopher Wylie breathed new life into longstanding rumors that the Facebook app listens to its users in order to target advertisements.Damian Collins, a member of parliament who chaired the committee, asked whether the Facebook app might listen to what users are discussing and use it to prioritize certain ads.

But, Wylie said in a meandering reply, it’s possible that Facebook and other smartphone apps are listening in for reasons other than speech recognition. Specifically, he said, they might be trying to ascertain what type of environment a user is in in order to “improve the contextual value of the advertising itself.”

“There’s audio that could be useful just in terms of, are you in an office environment, are you outside, are you watching TV, what are you doing right now?” Wylie said, without elaborating on how that information could help target ads.

Facebook has long denied that its app analyzes audio in order to customize ads. But users have often reported mentioning a product that they’ve never expressed an interest in online — and then being inundated with online ads for it. Reddit users, in particular, spend time collecting what they purport to be evidence that Facebook is listening to users in a particular way, such as “micro-samples” of a few seconds rather than full-on continuous natural language processing.

Source: Wylie: It’s possible that the Facebook app is listening to you | The Outline

Dutch government pretends to think about referendum result against big brother unlimited surveillance, ignores it completely.

Posted on by

Basically not only will they allow a huge amount of different agencies to tap your internet and phone and store it without any judicary procedures, checks or balances, they will also allow these agencies to share the data with whoever they want, including foreign agencies. Surprisingly the Dutch people voted against these far reaching breaches of privacy, so the government said they thought about it and would edit the law in six tiny places which completely miss the point and the problems people have with their privacy being destroyed.

Source: Kabinet scherpt Wet op de inlichtingen- en veiligheidsdiensten 2017 aan | Nieuwsbericht | Defensie.nl

Trustwave Global IT Security Report Summarised

Posted on by

Hackers have moved away from simple point-of-sale (POS) terminal attacks to more refined assaults on corporations’ head offices.

An annual report from security firm Trustwave out today highlighted increased sophistication of web app hacking and social engineering tactics on the part of miscreants.

Half of the incidents investigated involved corporate and internal networks (up from 43 per cent in 2016) followed by e-commerce environments at 30 per cent. Incidents affecting POS systems decreased by more than a third to 20 per cent of the total. This is reflective of increased attack sophistication, honing in on larger service providers and franchise head offices and less on smaller high-volume targets in previous years.

In corporate network environments, phishing and social engineering at 55 per cent was the leading method of compromise followed by malicious insiders at 13 per cent and remote access at 9 per cent. “CEO fraud”, a social engineering scam encouraging executives to authorise fraudulent money transactions, continues to increase, Trustwave added.

Targeted web attacks are becoming prevalent and much more sophisticated. Many breach incidents show signs of careful planning by cybercriminals probing for weak packages and tools to exploit. Cross-site scripting (XSS) was involved in 40 per cent of attack attempts, followed by SQL Injection (SQLi) at 24 per cent, Path Traversal at 7 per cent, Local File Inclusion (LFI) at 4 per cent, and Distributed Denial of Service (DDoS) at 3 per cent.

Last year also witnessed a marked increase, up 9.5 per cent, in compromises at businesses that deliver IT services including web-hosting providers, POS integrators and help-desk providers. A breach of just one provider opens the gates to a multitude of new targets. In 2016 service provider compromises did not even register in the statistics.

Although down from the previous year, payment card data at 40 per cent still reigns supreme in terms of data types targeted in a breach. Surprisingly, incidents targeting hard cash was on the rise at 11 per cent mostly due to fraudulent ATM transaction breaches enabled by compromise of account management systems at financial institutions.

North America still led in data breaches investigated by Trustwave at 43 per cent followed by the Asia Pacific region at 30 per cent, Europe, Middle East and Africa (EMEA) at 23 per cent and Latin America at 4 per cent. The retail sector suffered the most breach incidences at 16.7 per cent followed by the finance and insurance industry at 13.1 per cent and hospitality at 11.9 per cent.

Trustwave gathered and analysed real-world data from hundreds of breach investigations the company conducted in 2017 across 21 countries. This data was added to billions of security and compliance events logged each day across the global network of Trustwave operations centres, along with data from tens of millions of network vulnerability scans, thousands of web application security scans, tens of millions of web transactions, penetration tests and more.

All the web applications tested displayed at least one vulnerability with 11 as the median number detected per application. The majority (85.9 per cent) of web application vulnerabilities involved session management allowing an attacker to eavesdrop on a user session to seize sensitive information.

Source: Gosh, these ‘hacker’ nerds are only getting more sophisticated • The Register

Facebook Blames a ‘Bug’ for Not Deleting Your Seemingly Deleted Videos

Posted on by

Did you ever record a video on Facebook to post directly to your friend’s wall, only to discard the take and film a new version? You may have thought those embarrassing draft versions were deleted, but Facebook kept a copy. The company is blaming it on a “bug” and swears that it’s going to delete those discarded videos now. They pinkie promise this time.

Last week, New York’s Select All broke the story that social network was keeping the seemingly deleted old videos. The continued existence of the draft videos was discovered when several users downloaded their personal Facebook archives—and found numerous videos they never published. Today, Select All got a statement from Facebook blaming the whole thing on a “bug.” From Facebook via New York:

We investigated a report that some people were seeing their old draft videos when they accessed their information from our Download Your Information tool. We discovered a bug that prevented draft videos from being deleted. We are deleting them and apologize for the inconvenience. We appreciate New York Magazine for bringing the issue to our attention.

It was revealed last month that the data-harvesting firm (and apparent bribery consultants) Cambridge Analytica had acquired the information of about 50 million Facebook users and abused that data to help President Trump get elected. Specifically, the company was exploiting the anger of voters through highly-targeted advertising. And in the wake of the ensuing scandal, people have been learning all kinds of crazy things about Facebook.

Facebook users have been downloading some of the data that the social media behemoth keeps on them and it’s not pretty. For example, Facebook has kept detailed call logs from users with Android phones. The company says that Android users had to opt-in for the feature, but that’s a bullshit cop-out when you take a look at what the screen for “opting in” actually looks like.

Source: Facebook Blames a ‘Bug’ for Not Deleting Your Seemingly Deleted Videos

T-Mobile Austria stores passwords as plain text

Posted on by

A customer was questioning if rumors that T-Mobile Austria was storing customer passwords in plain text, leaving the credentials like sitting ducks for hackers. Whoever was manning T-Mobile Austria’s Twitter account confirmed that this was the case, but that there was no need to worry because “our security is amazingly good.”

That line is going to bite T-Mobile Austria in the backside, if or when they next get hacked. To be fair, it’s late at night in Europe and the Twitter account was probably being handled by an overworked social media worker, but it’s not a good look. Especially when people started digging further and found various security shortcomings. The whole thread is a mind job.

But that doesn’t excuse the plain-text password storage.

Source: T-Mobile Austria stores passwords as plain text, Outlook gets message crypto, and more • The Register

‘Big Brother’ in India Requires Fingerprint Scans for Food, Phones and Finances

Posted on by

NEW DELHI — Seeking to build an identification system of unprecedented scope, India is scanning the fingerprints, eyes and faces of its 1.3 billion residents and connecting the data to everything from welfare benefits to mobile phones.

Civil libertarians are horrified, viewing the program, called Aadhaar, as Orwell’s Big Brother brought to life. To the government, it’s more like “big brother,” a term of endearment used by many Indians to address a stranger when asking for help.

For other countries, the technology could provide a model for how to track their residents. And for India’s top court, the ID system presents unique legal issues that will define what the constitutional right to privacy means in the digital age.

To Adita Jha, Aadhaar was simply a hassle. The 30-year-old environmental consultant in Delhi waited in line three times to sit in front of a computer that photographed her face, captured her fingerprints and snapped images of her irises. Three times, the data failed to upload. The fourth attempt finally worked, and she has now been added to the 1.1 billion Indians already included in the program.

[…]

The poor must scan their fingerprints at the ration shop to get their government allocations of rice. Retirees must do the same to get their pensions. Middle-school students cannot enter the water department’s annual painting contest until they submit their identification.

In some cities, newborns cannot leave the hospital until their parents sign them up. Even leprosy patients, whose illness damages their fingers and eyes, have been told they must pass fingerprint or iris scans to get their benefits.

The Modi government has also ordered Indians to link their IDs to their cellphone and bank accounts. States have added their own twists, like using the data to map where people live. Some employers use the ID for background checks on job applicants.

[…]

Although the system’s core fingerprint, iris and face database appears to have remained secure, at least 210 government websites have leaked other personal data — such as name, birth date, address, parents’ names, bank account number and Aadhaar number — for millions of Indians. Some of that data is still available with a simple Google search.

As Aadhaar has become mandatory for government benefits, parts of rural India have struggled with the internet connections necessary to make Aadhaar work. After a lifetime of manual labor, many Indians also have no readable prints, making authentication difficult. One recent study found that 20 percent of the households in Jharkand state had failed to get their food rations under Aadhaar-based verification — five times the failure rate of ration cards.

Source: ‘Big Brother’ in India Requires Fingerprint Scans for Food, Phones and Finances – The New York Times

NUC, NUC! Who’s there? Intel, warning you to kill a buggy keyboard app

Posted on by

Intel has made much of its NUC and Compute Stick mini-PCs as a way to place computers to out-of-the-way places like digital signage.

Such locations aren’t the kind of spots where keyboards and pointing devices can be found, so Intel sweetened the deal by giving the world an Android and iOS app called the “Intel Remote Keyboard” to let you mimic a keyboard and mouse from afar.

But now Chipzilla’s canned the app.

The reason is three nasty bugs that let attackers “inject keystrokes as a local user”, “inject keystrokes into another remote keyboard session” and “execute arbitrary code as a privileged user.” The bugs are CVE-2018-3641, CVE-2018-3645 and CVE-2018-3638 respectively.

Rather than patch the app, Intel’s killed it and “recommends that users of the Intel® Remote Keyboard uninstall it at their earliest convenience.”

The app’s already gone from the Play and App Stores (but Google’s cached pages about it for Android and iOS in case you fancy a look).

The Android version of the app’s been downloaded at least 500,000 times, so this is going to inconvenience plenty of people … at least until they get RDP working on Windows boxes and VNC running under Linux. The greater impact may be on Intel’s reputation for security, which has already taken a belting thanks to the Meltdown/Spectre mess.

Source: NUC, NUC! Who’s there? Intel, warning you to kill a buggy keyboard app • The Register

Center Of The Milky Way Has Thousands Of Black Holes, Study Shows

Posted on by

The supermassive black hole lurking at the center of our galaxy appears to have a lot of company, according to a new study that suggests the monster is surrounded by about 10,000 other black holes.

For decades, scientists have thought that black holes should sink to the center of galaxies and accumulate there, says Chuck Hailey, an astrophysicist at Columbia University. But scientists had no proof that these exotic objects had actually gathered together in the center of the Milky Way.

“This is just kind of astonishing that you could have a prediction for such a large number of objects and not find any evidence for them,” Hailey says.

He and his colleagues recently went hunting for black holes, using observations of the galactic center made by a NASA telescope called the Chandra X-ray Observatory.

Isolated black holes are almost impossible to detect, but black holes that have a companion — an orbiting star — interact with that star in ways that allow the pair to be spotted by telltale X-ray emissions. The team searched for those signals in a region stretching about three light-years out from our galaxy’s central supermassive black hole.

“So we’re looking at the very, very, very center of our galaxy. It’s a place that’s filled with a huge amount of gas and dust, and it’s jammed with a huge number of stars,” Hailey says.

What they found there: a dozen black holes paired up with stars, according to a report in the journal Nature.

Finding so many in such a small region is significant, because until now scientists have found evidence of only about five dozen black holes throughout the entire galaxy, says Hailey, who points out that our galaxy is 100,000 light-years across. (For reference, one light-year is just under 5.88 trillion miles.)

What’s more, the very center of our galaxy surely has far more than these dozen black holes that were just detected. The researchers used what’s known about black holes to extrapolate from what they saw to what they couldn’t see. Their calculations show that there must be several hundred more black holes paired with stars in the galactic center, and about 10,000 isolated black holes.

“I think this is a really intriguing result,” says Fiona Harrison, an astrophysicist at Caltech. She cautions that there are a lot of uncertainties and the team has found just a small number of X-ray sources, “but they have the right distribution and the right characteristics to be a tracer of this otherwise completely hidden population.”

Source: Center Of The Milky Way Has Thousands Of Black Holes, Study Shows : The Two-Way : NPR