Researchers find over 100 spying Tor nodes that attempt to compromise darknet sites

These nodes — ordinary nodes, not exit nodes — sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over.

The researchers used “honeypot” .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions’ existence. They didn’t advertise the honions’ existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits.

boingboing

Researchers find over 100 spying Tor nodes that attempt to compromise darknet sites

These nodes — ordinary nodes, not exit nodes — sorted through all the traffic that passed through them, looking for anything bound for a hidden service, which allowed them to discover hidden services that had not been advertised. These nodes then attacked the hidden services by making connections to them and trying common exploits against the server-software running on them, seeking to compromise and take them over.

The researchers used “honeypot” .onion servers to find the spying computers: these honeypots were .onion sites that the researchers set up in their own lab and then connected to repeatedly over the Tor network, thus seeding many Tor nodes with the information of the honions’ existence. They didn’t advertise the honions’ existence in any other way and there was nothing of interest at these sites, and so when the sites logged new connections, the researchers could infer that they were being contacted by a system that had spied on one of their Tor network circuits.

boingboing

Amazon randomly kills PriceZombie price comparison site

Unfortunately, it seems our service has to come to an untimely end. After being previously told we were in 100% compliance with the rules, our Amazon affiliate account was closed a few months ago. Amazon claimed we were violating their rules against showing product and price information that was more than 24 hours old. Obviously, this is something ALL price history trackers do, not just PriceZombie. Overnight, we lost over 90% of our income but we kept going, hoping to resolve any issues and return to compliance. However, our appeals to Amazon affiliate program administrators (associates@amazon.com) and even Jeff Bezos (jeff@amazon.com) were either ignored or answered incompletely

Source: Important Announcement – PriceZombie will be shutting down unless..

Wtf?

Amazon randomly destroys price tracking site PriceZombie

Unfortunately, it seems our service has to come to an untimely end. After being previously told we were in 100% compliance with the rules, our Amazon affiliate account was closed a few months ago. Amazon claimed we were violating their rules against showing product and price information that was more than 24 hours old. Obviously, this is something ALL price history trackers do, not just PriceZombie. Overnight, we lost over 90% of our income but we kept going, hoping to resolve any issues and return to compliance. However, our appeals to Amazon affiliate program administrators (associates@amazon.com) and even Jeff Bezos (jeff@amazon.com) were either ignored or answered incompletely

Source: Important Announcement – PriceZombie will be shutting down unless..

Wtf?

Dark Patterns make you do stuff you don’t want to on websites

Everyone has been there. So in 2010, London-based UX designer Harry Brignull decided he’d document it. Brignull’s website, darkpatterns.org, offers plenty of examples of deliberately confusing or deceptive user interfaces. These dark patterns trick unsuspecting users into a gamut of actions: setting up recurring payments, purchasing items surreptitiously added to a shopping cart, or spamming all contacts through prechecked forms on Facebook games.

Dark patterns aren’t limited to the Web, either. The Columbia House mail-order music club of the ’80s and ’90s famously charged users exorbitant rates for music they didn’t choose if they forgot to specify what they wanted. In fact, negative-option billing began as early as 1927, when a book club decided to bill members in advance and ship a book to anyone who didn’t specifically decline. Another common offline example? Some credit card statements boast a 0 percent balance transfer but don’t make it clear that the percentage will shoot up to a ridiculously high number unless a reader navigates a long agreement in tiny print.

“The way that companies implement the deceptive practices has gotten more sophisticated over time,” said UX designer Jeremy Rosenberg, a contributor to the Dark Patterns site. “Today, things are more likely to be presented as a benefit or obscured as a benefit even if they’re not.”

When you combine the interactive nature of the Web, increasingly savvy businesses, and the sheer amount of time users spend online, it’s a recipe for dark pattern disaster. And after gaining an awareness for this kind of deception, you’ll recognize it’s nearly ubiquitous.

Source: Dark Patterns are designed to trick you (and they’re all over the Web)

Tight-wad Apple repair techs swapped our damaged iGear with used kit – lawsuit

According to the complaint, the aggrieved customers say that their AppleCare service plans should allow them to have their devices replaced with new units. The class seeks to represent customers who purchased Apple hardware with the AppleCare replacement plan and then received replacement devices from Apple when their old devices broke.

The claim centers around the plaintiffs’ own definition of “new,” alleging that the only replacements they should have received under their AppleCare replacement plans were in fact brand new hardware, not units that were factory refurbished by Apple.

“The Apple Plans purport to provide consumers with devices that are ‘equivalent to new in performance and reliability.’ What that phrase means is ‘new,’ as refurbished devices can never be the equivalent to new in performance and reliability,” the filing reads.

Source: Tight-wad Apple repair techs swapped our damaged iGear with used kit – lawsuit

Spotify is now selling your information to advertisers

The popular streaming service is now the latest platform that is opening its data to targeted advertising. Everything from your age and gender, to the music genres you like to listen will be available to various third-party companies.

Spotify is calling it programmatic buying and has already enabled it. Advertisers will have access to the 70 million people that use Spotify’s free, ad-supported streaming across 59 countries. By viewing your song picks, these buyers will be able to look for specific users who might be the best matches for the products they’re selling.

Source: Spotify is now selling your information to advertisers

Maxthon web browser blabs about your PC all the way back to Beijing

Polish security consultancy Exatel warns [PDF] that Maxthon is phoning home information such as the computer’s operating system and version number, the screen resolution, the CPU type and speed, the amount of memory installed, the location of the browser’s executable, whether ad-block is running, and the start page URL.

Source: Maxthon web browser blabs about your PC all the way back to Beijing

Scientists move one step closer to creating an invisibility cloak

Scientists at Queen Mary University of London (QMUL) have made an object disappear by using a composite material with nano-size particles that can enhance specific properties on the object’s surface.

Researchers from QMUL’s School of Electronic Engineering and Computer Science, worked with UK industry to demonstrate for the first time a practical cloaking device that allows curved surfaces to appear flat to electromagnetic waves.
[…]
“Previous research has shown this technique working at one frequency. However, we can demonstrate that it works at a greater range of frequencies making it more useful for other engineering applications, such as nano-antennas and the aerospace industry.”

Source: Scientists move one step closer to creating an invisibility cloak

Empty your free 30GB OneDrive space today – before Microsoft deletes your files for you

Microsoft is cutting its free 15GB OneDrive cloud storage space down to 5GB, and eliminating the 15GB free camera roll for many users. Files will be deleted by Redmond until your account is under the free limit.

Clouds turn to rain to hide your tears

Source: Empty your free 30GB OneDrive space today – before Microsoft deletes your files for you

Goes to show – the cloud’s promises are not worth very much…

UK To Outsource RAF aggressor training

The current service is provided by Cobham Aviation with its Dassault Falcon 20s and Fleet Air Arm-operated BAE Systems Hawk T1s flown by 736 NAS from RNAS Culdrose in Cornwall and RNAS Yeovilton in Somerset. The unit’s Hawks will be retired in 2020.

A phased plan of introducing other capabilities will continue throughout the next decade, with the Royal Air Force’s 100 Sqn and its Hawk T1s to give up their current aggressor training role in 2027.

“We need to make sure it is replaced by a very open architecture [way of working], to simulate, network and integrate the training capabilities around us,” Murray says of the existing model.

The concept phase was co-run by DE&S and the Nightworx organisation for the initial industry engagement activity, when more than 10 companies showed interest. The scope of the current work on ASDOT has not been disclosed, but a competition will be launched during 2017, in order to meet the deadlines set by the armed services.

Source: FARNBOROUGH: MoD outlines scope of ASDOT aggressor project

I’ve been trying to convince people this is a good idea for some time, but for some reason they look at me like I’m mad!

Researchers blur the line between classical and quantum physics by connecting chaos and entanglement

Using a small quantum system consisting of three superconducting qubits, researchers at UC Santa Barbara and Google have uncovered a link between aspects of classical and quantum physics thought to be unrelated: classical chaos and quantum entanglement. Their findings suggest that it would be possible to use controllable quantum systems to investigate certain fundamental aspects of nature.

“It’s kind of surprising because chaos is this totally classical concept—there’s no idea of chaos in a quantum system,” Charles Neill, a researcher in the UCSB Department of Physics and lead author of a paper that appears in Nature Physics. “Similarly, there’s no concept of entanglement within classical systems. And yet it turns out that chaos and entanglement are really very strongly and clearly related.”
[…]
“There’s a very clear connection between entanglement and chaos in these two pictures,” said Neill. “And, it turns out that thermalization is the thing that connects chaos and entanglement. It turns out that they are actually the driving forces behind thermalization.

“What we realize is that in almost any quantum system, including on quantum computers, if you just let it evolve and you start to study what happens as a function of time, it’s going to thermalize,” added Neill, referring to the quantum-level equilibration. “And this really ties together the intuition between classical thermalization and chaos and how it occurs in quantum systems that entangle.”

Source: Researchers blur the line between classical and quantum physics by connecting chaos and entanglement

Drowning Dalek commands Siri in voice-rec hack attack

In a proof-of-concept video the boffins place a phone in an empty conference room three metres (10 feet) from a speaker. Commands are issued that sound to like a drowning dalek to Vulture South’s ears. That garbling makes the commands difficult for humans to understand but passable for Siri and her ilk.

The attackers activate airplane mode (a denial of service attack), and open website xkcd.com which they write in the paper could be substituted for a phishing or malware download site.

Source: Drowning Dalek commands Siri in voice-rec hack attack

Massive open-access database on human cultures created

D-PLACE – the Database of Places, Language, Culture and Environment – is an expandable, open access database that brings together a dispersed body of information on the language, geography, culture and environment of more than 1,400 human societies. It comprises information mainly on pre-industrial societies that were described by ethnographers in the 19th and early 20th centuries.

The team’s paper on D-PLACE is published today in the journal PLOS ONE.

“Human cultural diversity is expressed in numerous ways: from the foods we eat and the houses we build, to our religious practices and political organization, to who we marry and the types of games we teach our children,” said Kathryn Kirby, a postdoctoral fellow in the Departments of Ecology & Evolutionary Biology and Geography at the University of Toronto and lead author of the study. “Cultural practices vary across space and time, but the factors and processes that drive cultural change and shape patterns of diversity remain largely unknown.

Source: Massive open-access database on human cultures created

D-place.org

These ultra-thin solar cells can be bent around a pencil

The cells are fabricated onto a flexible substrate that is just a micrometer thick — one-half to one-quarter the thickness of other “thin” solar cells and hundreds of times thinner than conventional cells. A human hair, by comparison, is about 100 micrometers.

The team at the Gwangju Institute of Science and Technology in South Korea managed to reduce the thickness by directly attaching the cells to the substrate without the use of an adhesive.

They were stamped onto the substrate and then cold welded, a process that binds two materials together through pressure, not heat.

The scientists tested the cells and discovered they can almost be folded in half — wrapped around a radius as small as 1.4 millimeters.

Source: These ultra-thin solar cells can be bent around a pencil

Russian leader Putin signs controversial ‘Big Brother’ law

the new legislation — which Edward Snowden has called “Russia’s new Big Brother law” — is not only severe against those involved in “international terrorism,” its financing, and its non-denunciation. Law enforcement agencies will also be granted access to any user’s messages without any judicial oversight.

Several key provisions will directly affect the internet and telecom industry. In particular, telecom operators and internet resources will need to store the recordings of all phone calls and the content of all text messages for a period of six months. They will be required to cooperate with the Federal Security Service (FSB) to make their users’ communications fully accessible to this organization.

Source: Russian leader Putin signs controversial ‘Big Brother’ law

Wendy’s Says More Than 1,000 Restaurants Affected by Hack

Wendy’s said hackers were able to steal customers’ credit and debit card information at 1,025 of its U.S. restaurants, far more than it originally thought.

The hamburger chain said Thursday hackers were able to obtain card numbers, names, expiration dates and codes on the card, beginning in late fall. Some customers’ cards were used to make fraudulent purchases at other stores.

Wendy’s Co. urged customers to check their accounts for any fraudulent purchases.

The Dublin, Ohio, company first announced it was investigating a possible hack in January. In May, it said malware was found in fewer than 300 restaurants. About a month later, it said two types of malware were found and the number of restaurants affected was “considerably higher.”

There are more than 5,700 Wendy’s restaurants in the U.S.

Customers can see which locations were affected through the Wendy’s website . The company said it is offering free one-year credit monitoring to people who paid with a card at any of those restaurants.

Source: Wendy’s Says More Than 1,000 Restaurants Affected by Hack

Hundreds of Genes Spring Back to Life in the Days After Death

In the first of the two studies, the researchers sought to determine which genes out of about a thousand might still be functioning in zebrafish and mice in the immediate days following death. To their surprise, the researchers found that hundreds of genes sprung back to life. Not only that, the activity of some of these genes actually increased. Most of these genes eventually gave up after about 24 hours, but some remained active for as much as four days after death. That’s surprising, to say the least.

The majority of these zombie genes were not random in terms of function. Each of them play an important role when an animal experiences some kind of trauma or illness. For example, some genes that were ramped up are responsible for stimulating inflammation and the immune system as well as for countering stress. Some genetic activity, like a gene that’s responsible for embryonic development, baffled the scientists. Noble suspects that this gene becomes active because the cellular environment in dead bodies must somehow resemble those found in embryos.

UK Police Accessed Civilian Data 1283 times for Fun and Profit, New Report Says

More than 800 UK police staff inappropriately accessed personal information between June 2011 and December 2015, according to a report from activist group Big Brother Watch.

The report says some police staff used their access to a growing trove of police data, which includes personal information on civilians, for entertainment and personal and financial gain.

ot only was some information not needed for official police work, according to the report, but was shared with third parties outside the police, including some organized crime groups, 877 times.

In total, 2,315 incidents of inappropriate access or distribution of data were reported.

The majority of incidents, 1,283, ended up with no disciplinary action taking place, while 297 ended in a resignation or dismissal, 258 resulted in a written or verbal warning, and 70 led to a criminal conviction or caution.

Former Lottery Security Director hacked random-number generator to rig lotteries, investigators say

For several years, Eddie Tipton, the former security director of the US Multi-State Lottery Association, installed software code that allowed him to predict winning numbers on specific days of the year, investigators allege. The random-number generators had been erased, but new forensic evidence has revealed how the hack was apparently done.

[…]

The number generator had apparently been hacked to produce predictable numbers on three days of the year, after the machine had gone through a security audit.

All six prizes linked to Tipton were drawn between 2005 and 2011 on either 23 November or 29 December.

Investigators were able to recreate the draws and produce “the very same ‘winning numbers’ from the program that was supposed to produce random numbers,” said the Iowa Division of Criminal Investigation agent Don Smith.

Evidence mounting that DNA matching is more of an art than a science due partly to proprietary algorhythms

Dror and Hampikian gave the DNA evidence to 17 lab technicians for examination, withholding context about the case to ensure unbiased results. All of the techs were experienced, with an average of nine years in the field. Dror and Hampikian asked them to determine whether the mixture included DNA from the defendant. In 2011, the results of the experiment were made public: Only one of the 17 lab technicians concurred that the defendant could not be excluded as a contributor. Twelve told Dror and Hampikian that the DNA was exclusionary, and four said that it was inconclusive. In other words, had any one of those 16 scientists been responsible for the original DNA analysis, the rape trial could have played out in a radically different way. Toward the end of the study, Dror and Hampikian quote the early DNA-testing pioneer Peter Gill, who once noted, “If you show 10 colleagues a mixture, you will probably end up with 10 different answers” as to the identity of the contributor. (The study findings are now at the center of the defendant’s motion for a new trial.)

[…]

The case against Anderson started when police matched biological matter found under Kumra’s fingernails to Anderson’s DNA in a database. Anderson was held in jail for five months before his lawyer was able to produce records showing that Anderson had been in detox at a local hospital at the time of the killing; it turned out that the same paramedics who responded to the distress call from Kumra’s mansion had treated Anderson earlier that night, and inadvertently transferred his DNA to the crime scene via an oxygen-monitoring device placed on Kumra’s hand

[…]

DNA transfer—the migration of cells from person to person, and between people and objects—is inevitable when we touch, speak, do the laundry. A 1996 study showed that sperm cells from a single stain on one item of clothing made their way onto every other item of clothing in the washer. And because we all shed different amounts of cells, the strongest DNA profile on an object doesn’t always correspond to the person who most recently touched it. I could pick up a knife at 10 in the morning, but an analyst testing the handle that day might find a stronger and more complete DNA profile from my wife, who was using it four nights earlier. Or the analyst might find a profile of someone who never touched the knife at all. One recent study asked participants to shake hands with a partner for two minutes and then hold a knife; when the DNA on the knives was analyzed, the partner was identified as a contributor in 85 percent of cases, and in 20 percent as the main or sole contributor.

[…]

In 2011, Legal Aid requested a hearing to question whether the software met the Frye standard of acceptance by the larger scientific community. To Goldthwaite and her team, it seemed at least plausible that a relatively untested tool, especially in analyzing very small and degraded samples (the FST, like TrueAllele, is sometimes used to analyze low-copy-number evidence), could be turning up allele matches where there were none, or missing others that might have led technicians to an entirely different conclusion. And because the source code was kept secret, jurors couldn’t know the actual likelihood of a false match.

At the hearing, bolstered by a range of expert testimony, Goldthwaite and her colleagues argued that the FST, far from being established science, was an unknown quantity. (The medical examiner’s office refused to provide Legal Aid with the details of its code; in the end, the team was compelled to reverse-engineer the algorithm to show its flaws.)

[…]

In 2012, shortly after Legal Aid filed its challenge to the FST, two developers in the Netherlands, Hinda Haned and Jeroen de Jong, released LRmix Studio, free and open-source DNA-profiling software—the code is publicly available for other users to explore and improve.

Erin Murphy, of NYU, has argued that if probabilistic DNA typing is to be widely accepted by the legal community—and she believes that one day it should be—it will need to move in this direction: toward transparency.