Yes, your old iPhone is slowing down: iOS hits brakes on CPUs as batteries wear out

Posted on by

It turns out Apple’s mobile operating system includes a throttling mechanism for devices with weary batteries, designed to limit CPU utilization in order to prevent peak power demands that the battery is no longer capable of providing. In other words, the OS secretly stalls the CPU on older iPhones to stop them rapidly draining their aging batteries to zero.When the CPU runs slower, though, so do the apps on the device, and some of the iPhone users who experienced this first hand have been wondering why.

Source: Yes, your old iPhone is slowing down: iOS hits brakes on CPUs as batteries wear out • The Register

Chinese Adups Backdoor Still Active on Many Android Devices

Posted on by

Back in mid-November 2016, US cyber-security firm Kryptowire revealed it discovered that firmware code created by a Chinese company called Adups was collecting vasts amount of user information and sending it to servers located in China.According to Kryptowire, the backdoor code was collecting SMS messages, call history, address books, app lists, phone hardware identifiers, but it was also capable of installing new apps or updating existing ones.
[…]
At the time, experts believed Adups shipped out the backdoored component to other phone vendors and the component eventually made its way inside over 700 million devices, most of which were low-budget Android phones, and in some cases, some Android Barnes & Noble NOOK tablets.

Following the revelations, many online stores reacted by refusing to sell phone models known to be vulnerable. With pressure from smartphone manufacturers and even the DHS, Adups eventually shipped out a version of the FOTA component without the backdoor and data collection code, even if in a presentation at the Black Hat 2017 security conference held in Las Vegas in August, Kryptowire researchers said that some devices were still sending data to the Adups servers.
[…]
But Malwarebytes says it found another Adups component doing bad things. Just like the previous Adups backdoor, this app is also unremovable, and users can’t disable it either.

This second component is found on phones under two names, such as com.adups.fota.sysoper or com.fw.upgrade.sysoper, which appear in the phone’s app list with the name UpgradeSys (FWUpgradeProvider.apk).

The good news is that this one does not collect user data, but instead only includes the ability “to install and/or update apps without a user’s knowledge or consent,” according to Nathan Collier, Senior Malware Intelligence Analyst.
[…]
The only way to remove the suspicious component is if users root their devices, something that many phone manufacturers recommend against, as it could open smartphones to even more dangerous threats

Source: Chinese Backdoor Still Active on Many Android Devices

Ghostery, uBlock, Privacy Badger lead the anti-tracking browser extensions

Posted on by

A group of researchers in France and Japan say RequestPolicyContinued and NoScript have the toughest policies, while Ghostery and uBlock Origin offer good blocking performance and a better user experience.

The study also gave a nod to the EFF’s Privacy Badger, which uses heuristics rather than block lists, but once trained is nearly as good as Ghostery or uBlock, demonstrating that its heuristics are reliable.

Source: Ghostery, uBlock lead the anti-track pack

Another AI attack, this time against ‘black box’ machine learning

Posted on by

Unlike adversarial models that attack AIs “from the inside”, attacks developed for black boxes could be used against closed system like autonomous cars, security (facial recognition, for example), or speech recognition (Alexa or Cortana).The tool, called Foolbox, is currently under review for presentation at next year’s International Conference on Learning Representations (kicking off at the end of April).Wieland Brendel, Jonas Rauber and Matthias Bethge of the Eberhard Karls University Tubingen, Germany explained at arXiv that Foolbox is a “decision-based” attack called a boundary attack which “starts from a large adversarial perturbation and then seeks to reduce the perturbation while staying adversarial”.

“Its basic operating principle – starting from a large perturbation and successively reducing it – inverts the logic of essentially all previous adversarial attacks. Besides being surprisingly simple, the boundary attack is also extremely flexible”, they wrote.

For example, “transfer-based attacks” have to be tested against the same training data as the models they’re attacking, and need “cumbersome substitute models”.

Gradient-based attacks, the paper claimed, also need detailed knowledge about the target model, while score-based attacks need access to the target model’s confidence scores.

The boundary attack, the paper said, only needs to see the final decision of a machine learning model – the class label it applies to an input, for example, or in a speech recognition model, the transcribed sentence.

Source: Another AI attack, this time against ‘black box’ machine learning • The Register

Older Adults’ Forgetfulness Tied To non syncing Brain Rhythms In Sleep

Posted on by

During deep sleep, older people have less coordination between two brain waves that are important to saving new memories, a team reports in the journal Neuron.

To find out, Walker and a team of scientists had 20 young adults learn 120 pairs of words. “Then we put electrodes on their head and we had them sleep,” he says.

The electrodes let researchers monitor the electrical waves produced by the brain during deep sleep. They focused on the interaction between slow waves, which occur every second or so, and faster waves called sleep spindles, which occur more than 12 times a second.

The next morning the volunteers took a test to see how many word pairs they could still remember. And it turned out their performance was determined by how well their slow waves and spindles had synchronized during deep sleep.

Next, the team repeated the experiment with 32 people in their 60s and 70s. Their brain waves were less synchronized during deep sleep. They also remembered fewer word pairs the next morning.

And, just like with young people, performance on the memory test was determined by how well their brain waves kept the beat, says Randolph Helfrich, an author of the new study and a postdoctoral fellow at UC Berkeley.

The team also found a likely reason for the lack of coordination associated with aging: atrophy of an area of the brain involved in producing deep sleep. People with more atrophy had less rhythm in the brain, Walker says.

But the study also suggests that it’s possible to improve an impaired memory by re-synchronizing brain rhythms during sleep.

One way to do this would be by applying electrical or magnetic pulses through the scalp. “The idea is to boost those brain waves and bring them back together,” Helfrich says.

Walker already has plans to test this approach to synchronizing brain waves.

Source: Older Adults’ Forgetfulness Tied To Faulty Brain Rhythms In Sleep : Shots – Health News : NPR

Seagate’s lightbulb moment: Make read-write heads operate independently

Posted on by

Seagate is increasing IO performance in disk drives by separating read-write heads into two separate sets which can operate independently and in parallel.The heads are positioned at one end of actuator arms which rotate around a post at their other end to move the heads across the platter surfaces. Thus, with an eight-platter drive, each read-write head is positioned above the same cylindrical track on each platter and reads or writes to and from the same disk blocks on each platter’s surface.Seagate’s Multi Actuator technology divides these eight heads into two sets of four, and they can move independently of each other. An animated graphic here shows them in operation.

Source: Seagate’s lightbulb moment: Make read-write heads operate independently • The Register

KLM uses AI to answer questions on social media

Posted on by

olgens KLM worden wekelijks 30.000 gesprekken gevoerd door de 250 socialmediamedewerkers. De luchtvaartmaatschappij wordt wekelijks ruim 130.000 keer genoemd op social media. Gemiddeld bestaat een gesprek tussen KLM en een klant uit vijf tot zes vragen en antwoorden. De veelgestelde vragen die met behulp van kunstmatige intelligentie automatisch kunnen worden beantwoord, worden meestal aan het begin van het gesprek gesteld.

Source: KLM laat kunstmatige intelligentie direct vragen beantwoorden op social – Emerce

China’s big brother: how artificial intelligence is catching criminals and advancing health care

Posted on by

“Our machines can very easily recognise you among at least 2 billion people in a matter of seconds,” says chief executive and Yitu co-founder Zhu Long, “which would have been unbelievable just three years ago.” Yitu’s Dragonfly Eye generic portrait platform already has 1.8 billion photographs to work with: those logged in the national database and you, if you have visited China recently. Yitu will not say whether Hong Kong identity card holders have been logged in the government’s database, for which the company provides navigation software and algor­ithms, but 320 million of the photos have come from China’s borders, including ports and airports, where pictures are taken of everyone who enters and leaves the country.

According to Yitu, its platform is also in service with more than 20 provincial public security departments, and is used as part of more than 150 municipal public security systems across the country, and Dragonfly Eye has already proved its worth. On its very first day of operation on the Shanghai Metro, in January, the system identified a wanted man when he entered a station. After matching his face against the database, Dragonfly Eye sent his photo to a policeman, who made an arrest. In the following three months, 567 suspected lawbreakers were caught on the city’s underground network.
[…]
“Chinese authorities are collecting and centralising ever more information about hundreds of millions of ordinary people, identifying persons who deviate from what they determine to be ‘normal thought’ and then surveilling them,” says Sophie Richardson, China director at HRW. The activist calls on Beijing to cease the collection of big data “until China has meaningful privacy rights and an accountable police force”.

Source: China’s big brother: how artificial intelligence is catching criminals and advancing health care | Post Magazine | South China Morning Post

AI helps find planets in other solar systems

Posted on by

The neural network is trained on 15,000 signals from the Kepler dataset that have been previously verified as planets or non-planets. A smaller test set with new, unseen data was fed to the neural network and it correctly identified true planets from false positives to an accuracy of about 96 per cent.The researchers then applied this model to weaker signals from 670 star systems, where scientists had already found multiple known planets to try and find any that might have been missed.Vanderburg said the got lots of false positives of planets, but also more potential real ones too. “It’s like sifting through rocks to find jewels. If you have a finer sieve then you will catch more rocks but you might catch more jewels, as well,” he said.

Source: Sigh. It’s not quite Star Trek’s Data, but it’ll do: AI helps boffins clock second Solar System • The Register

Tripwire detects hacks companies haven’t told us about by creating accounts with unique emails on thousands of servers. If the email account is accessed, the site has been breached. No-one knows or cares that there has been a breach in vast majority of cases.

Posted on by

a prototype tool created by researchers from the University of California San Diego (UCSD) aims to bring greater transparency to such breaches. The system, called Tripwire, detects websites that were hacked, as is detailed in this study.

Here’s here how it works: To detect breaches, the researchers created a bot that automatically registered accounts on thousands of websites. Each of those accounts shared a password with a unique associated email address. Working with a “major email provider,” the researchers were then notified if there was a successful login on any of the email accounts. Since the email accounts were created for the study, any login was assumed to be the result of a security breach on the website associated with that account.

“While Tripwire can’t catch every data breach, it essentially has no false positives—everything it detects definitely corresponds to a data breach,” Joe DeBlasio, a Ph.D student of Jacobs School of Engineering at UCSD and an author on the research paper, told Gizmodo. “Tripwire triggering means that an attacker had access to data that wasn’t shared publicly.”

As part of the study, the researchers monitored over 2,300 sites from January 2015 through February of this year, and found that 19 of the sites (or one percent) had been compromised. The study notes that the system found “both plaintext and hashed-password breaches”—if your password is hashed, it is indecipherable to a hacker. Arguably the most damning finding of the study was that, at the time it was published, all but one of the compromised websites failed to notify their users that they had suffered a breach. Only one site told researchers they would force a password reset.

Source: Researchers Made a Clever Tool to Detect Hacks Companies Haven’t Told Users About

Windows 10 Password Manager Keeper allows sites to steal any password.

Posted on by

A Google security researcher has found and helped patch a severe vulnerability in Keeper, a password manager application that Microsoft has been bundling with some Windows 10 distributions this year.”I’ve heard of Keeper, I remember filing a bug a while ago about how they were injecting privileged UI into pages,” said Tavis Ormandy, the Google security researcher who discovered the recent vulnerability.”I checked and, they’re doing the same thing again with this version,” the expert added, referring to the Keeper app bundled with some Windows 10 versions.”I think I’m being generous considering this a new issue that qualifies for a ninety day disclosure, as I literally just changed the selectors and the same attack works. Nevertheless, this is a complete compromise of Keeper security, allowing any website to steal any password,” Ormandy added.To prove his point, the expert also created a demo page where Keeper users can see the vulnerability in action.

Source: Windows 10 Bundles a Password Manager. Password Manager Bundles a Security Flaw

“Suspicious” event routes traffic for big-name sites through Russia

Posted on by

According to a blog post published Wednesday by Internet monitoring service BGPMon, the hijack lasted a total of six minutes and affected 80 separate address blocks. It started at 4:43 UTC and continued for three minutes. A second hijacking occurred at 7:07 UTC and also lasted three minutes. Meanwhile, a second monitoring service, Qrator Labs, said the event lasted for two hours, although the number of hijacked address blocks varied from 40 to 80 during that time.

While BGP rerouting events are often the result of human error rather than malicious intent, BGPMon researchers said several things made Wednesday’s incident “suspicious.” First, the rerouted traffic belonged to some of the most sensitive companies, which—besides Google, Facebook, Apple, and Microsoft—also included Twitch, NTT Communications, and Riot Games. Besides the cherrypicked targets, hijacked IP addresses were broken up into smaller, more specific blocks than those announced by affected companies, an indication the rerouting was “intentional.”

Source: “Suspicious” event routes traffic for big-name sites through Russia | Ars Technica

Looking through walls, now easier than ever • The Register

Posted on by

In a paper published on Thursday in the journal Optica, Duke professors Daniel Marks and David R. Smith, and postdoctoral researcher Okan Yurduseven describe a method for through-wall imaging (TWI) that compensates for the varied distortion produced by different wall materials, to allow details to be captured more accurately.

Source: Looking through walls, now easier than ever • The Register

How to Track a Cellphone Without GPS—or Consent

Posted on by

Using only data that can be legally collected by an app developer without the consent of a cellphone’s owner, researchers have been able to produce a privacy attack that can accurately pinpoint a user’s location and trajectory without accessing the device’s Global Position System—GPS. And while the ramifications of this ability falling into the wrong hands are distressing, the way in which they pulled it off is nothing short of genius.
[…]
In fact, all you really need is your phone’s internal compass, an air pressure reading, a few free-to-download maps, and a weather report.

Your cellphone comes equipped with an amazing array of compact sensors that are more or less collecting information about your environment at all time. An accelerometer can tell how fast you’re moving; a magnetometer can detect your orientation in relation to true north; and a barometer can measure the air pressure in your surrounding environment. You phone also freely offers up a slew of non-sensory data such as your device’s IP address, timezone, and network status (whether you’re connected to Wi-Fi or a cellular network.)

All of this data can be accessed by any app you download without the type of permissions required to access your contact lists, photos, or GPS. Combined with publicly available information, such as weather reports, airport specification databases, and transport timetables, this data is enough to accurately pinpoint your location—regardless of whether you’re walking, traveling by plane, train, or automobile.
[…]
To track a user, you first need to determine what kind of activity they’re performing. It’s easy enough to tell if a person is walking versus riding in a car, speed being the discriminant factor; but also, when you’re walking you tend to move in one direction, while your phone is held in a variety of different positions. In a car, you make sudden stops (when you brake) and specific types of turns—around 90 degrees—that can be detected using your phone’s magnetometer. People who travel by plane will rapidly change time zones; the air pressure on a plane also changes erratically, which can be detected by a cellphone’s barometer. When you ride a train, you tend to accelerate in a direction that doesn’t significantly change. In other words, determining your mode of travel is relatively simple.

The fact that your cellphone offers up your time zone as well as the last IP address you were connected to really narrows things down—geolocating IP addresses is very easy to do and can at least reveal the last city you were in—but to determine your exact location, with GPS-like precision, a wealth of publicly-available data is needed. To estimate your elevation—i.e., how far you are above sea level—PinMe gathers air pressure data provided freely by the Weather Channel and compares it to the reading on your cellphone’s barometer. Google Maps and open-source data offered by US Geological Survey Maps also provide comprehensive data regarding changes in elevation across the Earth’s surface. And we’re talking about minor differences in elevation from one street corner to the next.

Upon detecting a user’s activity (flying, walking, etc.) the PinMe app uses one of four algorithms to begin estimating a user’s location, narrowing down the possibilities until its error rate drops to zero, according to the peer-reviewed research. Let’s say, the app decides you’re traveling by car. It knows your elevation, it knows your timezone, and if you haven’t left the city you’re in since you last connected to Wi-Fi, you’re pretty much borked.

With access to publicly available maps and weather reports, and a phone’s barometer and magnetometer (which provides a heading), it’s only a matter of turns. When PinMe detected one of the researchers driving in Philadelphia during a test-run, for example, the researcher only had to make 12 turns before the app knew exactly where they were in the city. With each turn, the number of possible locations of the vehicles dwindles. “[A]s the number of turns increases, PinMe collects more information about the user’s environment, and as a result it is more likely to find a unique driving path on the map,” the researchers wrote.

Source: How to Track a Cellphone Without GPS—or Consent

Google Taught an AI to Make Sense of the Human Genome

Posted on by

This week, Google released a tool called DeepVariant that uses deep learning to piece together a person’s genome and more accurately identify mutations in a DNA sequence.Built on the back of the same technology that allows Google to identify whether a photo is of a cat or dog, DeepVariant solves an important problem in the world of DNA analysis. Modern DNA sequencers perform what’s known as high-throughput sequencing, returning not one long read out of a full DNA sequence but short snippets that overlap. Those snippets are then compared against another genome to help piece it together and identify variations. But the technology is error-prone, and it can be difficult for scientists to distinguish between those errors and small mutations. And small mutation matter. They could provide significant insight into, say, the root cause of a disease. Distinguishing which base pairs are the result of error and which are for real is called “variant calling.”

Source: Google Taught an AI to Make Sense of the Human Genome

Apparent Google update glitch disconnects student Chromebooks in schools across the U.S. – GeekWire

Posted on by

Tens of thousands, perhaps millions, of Google Chromebooks, widely prized by schools due to their low cost and ease of configuration, were reported to be offline for several hours on Tuesday. The apparent cause? A seemingly botched WiFi policy update pushed out by Google that caused many Chromebooks to forget their approved network connection, leaving students disconnected.

Source: Apparent Google update glitch disconnects student Chromebooks in schools across the U.S. – GeekWire

Ouch – the dangers of cloud!

China Has Launched the World’s First All-Electric Cargo Ship

Posted on by

Constructed by Guangzhou Shipyard International Company Ltd, it can travel 80 kilometers (approximately 50 miles) after being charged for 2 hours. As noted by Clean Technica, 2 hours is roughly the amount of time it would take to unload the ship’s cargo while docked.Other stats for China’s cargo ship include being 70.5 meters (230 feet) in length, a battery capacity of 2,400 kWh, and a travel speed of 12.8 kilometers per hour (8 mph). It’s definitely not the fastest electric vehicle we’ve seen hit the water, but it’s designed for transporting numerous objects rather than speed.

Source: China Has Launched the World’s First All-Electric Cargo Ship

Coinbase warns of potential outages

Posted on by

Over the course of this year we have invested significant resources to increase trading capacity on our platform and maintain availability of our service. We have increased the size of our support team by 640% and launched phone support in September. We have also invested heavily in our infrastructure and have increased the number of transactions we are processing during peak hours by over 40x.There may be downtime which can impact your ability to tradeDespite the sizable and ongoing increases in our technical infrastructure and engineering staff, we wanted to remind customers that access to Coinbase services may become degraded or unavailable during times of significant volatility or volume. This could result in the inability to buy or sell for periods of time. Despite ongoing increases in our support capacity, our customer support response times may be delayed, especially for requests that do not involve immediate risks to customer account security.

Source: Please invest responsibly — an important message from the Coinbase team

HP laptops found to have hidden keylogger – BBC News

Posted on by

Hidden software that can record every letter typed on a computer keyboard has been discovered pre-installed on hundreds of HP laptop models.Security researcher Michael Myng found the keylogging code in software drivers preinstalled on HP laptops to make the keyboard work.HP said more than 460 models of laptop were affected by the “potential security vulnerability”.It has issued a software patch for its customers to remove the keylogger.The issue affects laptops in the EliteBook, ProBook, Pavilion and Envy ranges, among others. HP has issued a full list of affected devices, dating back to 2012.

Source: HP laptops found to have hidden keylogger – BBC News

Airgapping via PLC

Posted on by

CyberX demonstrated how to inject specially-crafted ladder logic code into a Siemens S7-1200 PLC. The code uses memory copy operations to generate frequency-modulated RF signals slightly below the AM band (340kHz-420kHz), with the modulation representing encoded data.The emitted RF signals are a byproduct of repeatedly writing to PLC memory in a specific way.Once transmitted the signal can be picked up by a nearby antenna before been decoded using a low-cost Software-Defined Radio (SDR) and a PC. “The receiving equipment can be located just outside the facility or even mounted on a drone flying overhead,” according to CyberX.

Source: Why bother cracking PCs? Spot o’ malware on PLCs… Done. Industrial control network pwned • The Register

AI in storytelling: Machines as cocreators

Posted on by

Sunspring debuted at the SCI-FI LONDON film festival in 2016. Set in a dystopian world with mass unemployment, the movie attracted many fans, with one viewer describing it as amusing but strange. But the most notable aspect of the film involves its creation: an artificial-intelligence (AI) bot wrote Sunspring’s screenplay.

ome researchers have already used machine learning to identify emotional arcs in stories. One method, developed at the University of Vermont, involved having computers scan text—video scripts or book content—to construct arcs.

We decided to go a step further. Working as part of a broader collaboration between MIT’s Lab for Social Machines and McKinsey’s Consumer Tech and Media team, we developed machine-learning models that rely on deep neural networks to “watch” small slices of video—movies, TV, and short online features—and estimate their positive or negative emotional content by the second.

These models consider all aspects of a video—not just the plot, characters, and dialogue but also more subtle touches, like a close-up of a person’s face or a snippet of music that plays during a car-chase scene. When the content of each slice is considered in total, the story’s emotional arc emerges.

Source: AI in storytelling: Machines as cocreators | McKinsey & Company

New battery boffinry could ‘triple range’ of electric vehicles • The Register

Posted on by

A new battery designed at the University of Waterloo in Ontario could triple the range of electric vehicles, a new paper has claimed.

The development, described by the article An In Vivo Formed Solid Electrolyte Surface Layer Enables Stable Plating of Li Metal (PDF) in energy journal Joule, is due to an improvement in the protection of lithium electrodes inside conventional lithium-ion batteries.

Researchers estimated that this improvement could increase the normal range of an electric vehicle battery from 200km to 600km.

The problem that comes with high-performance lithium batteries is the formation of branch-like structures by the electrolyte on the metal surface. These structures corrode and therefore reduce the effectiveness of the cell.

This can eventually lead to a short circuit if the branch breaks through the separator which keeps the two sides of the cell apart, causing a fire or explosion.

The research team was able to solve the problem by adding a compound containing phosphorus and sulphur to the electrolyte liquid in the battery. As the battery operates, this compound reacts with the lithium and creates a protective membrane on the electrodes. The membrane significantly slows the reaction which forms the branches, meaning that the battery can remain more efficient and operate safely for longer periods than were previously achievable.

Source: New battery boffinry could ‘triple range’ of electric vehicles • The Register

New Ruski hacker clan exposed: They’re called MoneyTaker, and they’re gonna take your money • The Register

Posted on by

The group has conducted more than 20 successful attacks on financial institutions and legal firms in the USA, UK and Russia in the last two months alone, according to Russian incident response firm Group-IB. MoneyTaker has primarily targeted card processing systems, including the AWS CBR (Russian Interbank System) and purportedly SWIFT (US).In addition to banks, MoneyTaker has attacked law firms and financial software vendors. In total, Group-IB has confirmed 20 companies as MoneyTaker victims, with 16 attacks on US organisations, three on Russian banks and one against a Brit IT company.By constantly changing their tools and tactics to bypass antivirus and traditional security solutions, and most importantly carefully eliminating their traces after completing operations, the group has largely gone unnoticed. “MoneyTaker uses publicly available tools, which makes the attribution and investigation process a non-trivial exercise,” said Dmitry Volkov, Group-IB co-founder and head of intelligence. “In addition, incidents occur in different regions worldwide and at least one of the US banks targeted had documents successfully exfiltrated from their networks, twice.”

Source: New Ruski hacker clan exposed: They’re called MoneyTaker, and they’re gonna take your money • The Register

Email tracking now extends to your acquantances: 1 in 5!

Posted on by

According to OMC’s data, a full 19 percent of all “conversational” email is now tracked. That’s one in five of the emails you get from your friends. And you probably never noticed.“Surprisingly, while there is a vast literature on web tracking, email tracking has seen little research,” noted an October 2017 paper published by three Princeton computer scientists. All of this means that billions of emails are sent every day to millions of people who have never consented in any way to be tracked, but are being tracked nonetheless. And Seroussi believes that some, at least, are in serious danger as a result.

Source: You Give Up a Lot of Privacy Just Opening Emails. Here’s How to Stop It | WIRED