America's Securities and Exchange Commission "is considering broad changes to curb the frenetic trading of stocks based on social media activity," reports Reuters: The proposed overhaul would be the biggest change to Wall Street's rules since 2005 and would affect nearly every corner of the market, from commission-free brokerages to market makers and exchanges. The U.S. House Committee on Financial Services on Friday called for the SEC, along with other regulators, to do more to protect the markets from similar events....

The U.S. House Financial Services Committee on Friday urged Congress to adopt legislation mandating the SEC study how its rules need to change to address new technological developments, such as digital engagement practices and social media-driven market activity.

Russia's invasion of Ukraine is "the first full-scale battle in which traditional and cyberweapons have been used side by side," reports the New York Times. But the biggest surprise is that "many of the attacks were thwarted, or there was enough redundancy built into the Ukrainian networks that the efforts did little damage... more than two-thirds of them failed, echoing its poor performance on the physical battlefield."

Microsoft president Brad Smith says the ultimate result is Russia's attempted cyberatacks get underreported, according to the Times: [A study published by Microsoft Wednesday] indicated that Ukraine was well prepared to fend off cyberattacks, after having endured them for many years. That was at least in part because of a well-established system of warnings from private-sector companies, including Microsoft and Google, and preparations that included moving much of Ukraine's most important systems to the cloud, onto servers outside Ukraine....

In many instances, Russia coordinated its use of cyberweapons with conventional attacks, including taking down the computer network of a nuclear power plant before moving in its troops to take it over, Mr. Smith said. Microsoft officials declined to identify which plant Mr. Smith was referring to. While much of Russia's cyberactivity has focused on Ukraine, Microsoft has detected 128 network intrusions in 42 countries. Of the 29 percent of Russian attacks that have successfully penetrated a network, Microsoft concluded, only a quarter of those resulted in data being stolen. Outside Ukraine, Russia has concentrated its attacks on the United States, Poland and two aspiring members of NATO, Sweden and Finland...

But Microsoft, other technology companies and government officials have said that Russia has paired those infiltration attempts with a broad effort to deliver propaganda around the world. Microsoft tracked the growth in consumption of Russian propaganda in the United States in the first weeks of the year. It peaked at 82 percent right before the Feb. 24 invasion of Ukraine, with 60 million to 80 million monthly page views. That figure, Microsoft said, rivaled page views on the biggest traditional media sites in the United States. One example Mr. Smith cited was that of Russian propaganda inside Russia pushing its citizens to get vaccinated, while its English-language messaging spread anti-vaccine content. Microsoft also tracked the rise in Russian propaganda in Canada in the weeks before a trucker convoy protesting vaccine mandates tried to shut down Ottawa, and that in New Zealand before protests there against public health measures meant to fight the pandemic.
Russians successfully "sabotaged a satellite communications network called Viasat in the opening days of the war," notes the Washington Post, "with the damage spilling over into other European countries. But Ukraine, working with private tech companies, Western intelligence and its own expert software engineers, has quickly fixed most of the damage..."

"The close partnerships that have emerged between U.S. technology companies and Western cybersecurity agencies is one of the unheralded stories of the war...." "Cyber responses must rely on greater public and private collaboration," argues Brad Smith, Microsoft's president, in a new study... published Wednesday on Microsoft's "lessons learned" from cyber conflict in Ukraine. A White House cyber official explains the new cooperative approach this way: "Where companies see destructive attacks, that has driven partnerships with the intelligence community and other government agencies to see how best we can share information to protect infrastructure around the world." The tech world's sympathies lie with the underdog, Ukraine. That applies to giant firms such as Microsoft and Google....

Ukraine's cybersecurity defense benefited from an early start. U.S. Cyber Command experts went to Ukraine months before the war started, according to its commander, Gen. Paul Nakasone. Microsoft and Google became involved even earlier. Microsoft began monitoring Russian phishing attacks against Ukrainian military networks in early 2021, and through the rest of last year observed increasingly aggressive hacks by six different attackers linked to Russia's three intelligence services, the GRU, SVR and FSB, according to a Microsoft report released in April. Microsoft has spent a total of $239 million on financial and technical assistance to Ukraine, a company official said....

Google, a part of Alphabet, has also helped Ukraine fend off threats. Back in 2014, prompted by Russia's use of DDOS ("distributed denial-of-service") malware in its seizure of Crimea and eastern Ukraine, Google began what it called "Project Shield." Software protected news sites, human rights groups and election sites against crippling DDOS floods of junk internet messages. Today, Project Shield is used by 200 sites in Ukraine and 2,300 others in 140 countries around the world, according to Jared Cohen, the chief executive of Google's Jigsaw unit.

Engineers at the European Space Agency (ESA) are getting ready for a Windows 98 upgrade on an orbiter circling Mars. The Verge reports: The Mars Express spacecraft has been operating for more than 19 years, and the Mars Advanced Radar for Subsurface and Ionospheric Sounding (MARSIS) instrument onboard has been using software built using Windows 98. Thankfully for humanity and the Red Planet's sake, the ESA isn't upgrading its systems to Windows ME. The MARSIS instrument on ESA's Mars Express was key to the discovery of a huge underground aquifer of liquid water on the Red Planet in 2018. This major new software upgrade "will allow it to see beneath the surfaces of Mars and its moon Phobos in more detail than ever before," according to the ESA. The agency originally launched the Mars Express into space in 2003 as its first mission to the Red Planet, and it has spent nearly two decades exploring the planet's surface.

MARSIS uses low-frequency radio waves that bounce off the surface of Mars to search for water and study the Red Planet's atmosphere. The instrument's 130-foot antenna is capable of searching around three miles below the surface of Mars, and the software upgrades will enhance the signal reception and onboard data processing to improve the quality of data that's sent back to Earth. "We faced a number of challenges to improve the performance of MARSIS," explains Carlo Nenna, a software engineer at Enginium who is helping ESA with the upgrade. "Not least because the MARSIS software was originally designed over 20 years ago, using a development environment based on Microsoft Windows 98!"

An anonymous reader quotes a report from Interesting Engineering: Seattle-based Zap Energy is using a lesser-known approach to nuclear fusion to build modular, garage-sized reactors. They are cheaper and don't require the large, incredibly powerful magnets used in traditional fusion experiments. Ultimately, they may also provide a quicker route to achieving commercially viable nuclear fusion, a press statement reveals.

Nuclear fusion has the potential to remove our reliance on fossil fuels by providing a practically limitless energy source that produces power in a similar way to the Sun and the stars. Fusion experiments, such as Europe's ITER, typically rely on large donut-shaped tokamak reactors using extremely powerful magnets to control the plasma generated during the fusion reaction. Zap Energy has developed a different approach with its Z-pinch technology. The company uses an electromagnetic field instead of the expensive magnetic coils and shielding materials used in tokamaks. This, they say, pins the plasma inside a relatively small space and "pinches" it until it becomes hot and dense enough for the required reaction to take place.

Z-pinch technology was first thought up in the 1950s, but until recently, instability problems meant that research had been largely focused on the more stable tokamak technology. In 2019, a group of researchers from the University of Washington proposed the use of sheared axial flow to smooth the plasma streams, preventing distortions that previously led to instability. One of the authors of that study, Uri Shumlak, co-founded Zap Energy in 2017 in a bid to leverage the sheared axial flow technique to make Z-pinch technology commercially viable. Just last week, Zap Energy reached a key milestone by creating the first plasmas inside its prototype reactor, called the FuZE-Q. The Zap Energy team also just closed a $160-million Series C funding round, which will help it to further develop its Z-pinch technology and hopefully bring it to the market. The company says its reactors could be small enough to fit inside a garage, meaning it could give both micro nuclear reactor and nuclear fusion firms a run for their money.

Apple is "likely" to announce its long-rumored mixed-reality headset as soon as January 2023, Apple analyst Ming-Chi Kuo has reiterated. MacRumors reports: In a detailed post on Medium, Kuo explained that Apple's headset will be a "game-changer" for the augmented-reality and virtual-reality market. Describing some of the headset's functionality, Kuo said that while Apple has repeatedly touted its focus on AR, the headset will "offer an excellent immersive experience" and a "video see-thru" mode. The headset is expected to boost demand for immersive gaming and multimedia entertainment experiences.

Kuo said that the device is "the most complicated product Apple has ever designed," leading Apple to use components from many of its existing suppliers. Kuo also believes that Apple will be an industry leader in the headset space, has "significant competitive advantages," and does not need to join the Metaverse Standards Forum. Notably, Kuo thinks that rivals will race to imitate Apple's headset once it launches, "leading the headset hardware industry to the next stage of rapid growth."

Mark Zuckerberg's intense focus on the metaverse has replaced securing elections as the Meta CEO's top concern, four Meta employees with knowledge of the situation told The New York Times. From a report: Zuckerberg has been public with his desire to transform Meta -- formerly known as Facebook -- into a metaverse company, ploughing billions of dollars into developing metaverse technology.

The New York Times reports Meta's core election team has shrunk significantly since 2020. With the US midterms approaching, a reduced election team at Meta could mean less enforcement against misinformation. Whereas it used to comprise over 300 people, now 60 people spend their time focused on election security and some additional employees divide their time between elections and other projects, sources told The Times.

Most internet users trying to get past China's Great Firewall search for a cyber tunnel that will take them outside censorship restrictions to the wider web. From a report: But Vincent Brussee is looking for a way in, so he can better glimpse what life is like under the Communist Party. An analyst with the Mercator Institute for China Studies in Berlin, Brussee frequently scours the Chinese internet for data. His main focus is information that will help him understand China's burgeoning social credit system. But in the last few years, he's noticed that his usual sources have become more unreliable and access tougher to gain.

Some government websites fail to load, appearing to block users from specific geographic locations. Other platforms require a Chinese phone number tied to official identification. Files that were available three years ago have started to disappear as Brussee and many like him, including academics and journalists, are finding it increasingly frustrating to penetrate China's cyber world from the outside. "It's making it more difficult to simply understand where China is headed," Brussee said. "A lot of the work we are doing is digging for little scraps of information."

Since its initial release over a decade ago (and even following Microsoft's 2014 acquisition of developer Mojang), Minecraft has let players create private servers where they're in full control of what behaviors (and players) are allowed. Next week, though, Microsoft is set to roll out a new update that lets it ban a Minecraft player from all online play, including private servers and those hosted on Microsoft's subscription-based Realms plan. From a report: Earlier this week, Microsoft launched a pre-release version of Update 1.19.1 for the Java Edition of Minecraft, which will go live for everyone on Tuesday, June 28. That update will add the ability to report users who abuse the game's chat system and allow for "reported players [to be] be banned from online play and Realms after moderator review." On a recently updated "Why Have I been Banned from Minecraft?" help page, Microsoft notes that banned players will also get a message when they "sign into Minecraft on any platform (non-Java Edition) [aka "Bedrock"]." That message will clarify that "banned players are not allowed to play on servers, join Realms, host or join multiplayer games, or use the marketplace. They are also not allowed to access Minecraft Earth. Xbox players will no longer have access to their worlds [emphasis added]."

A popular product on the Harmony network was exploited for over $100 million in cryptocurrencies in what is one of the biggest crypto hacks in recent weeks. From a report: "The Harmony team has identified a theft occurring this morning on the Horizon bridge amounting to approx. $100MM," the network's developers said in a tweet. "We have begun working with national authorities and forensic specialists to identify the culprit and retrieve the stolen funds. The Federal Bureau of Investigation (FBI), the domestic intelligence and legal enforcement agency of the U.S., and cybersecurity firms have joined the search for the attacker, they said in a subsequent tweet. Harmony's native ONE token slumped on news of the exploit, taking its decline in the past 24 hours to more than 12%.

Software maker Zendesk agreed to be acquired by a group of buyout firms led by Hellman & Friedman and Permira for about $9.5 billion. From a report: The all-cash transaction offers shareholders $77.50 a share, a premium of 34% over Zendesk's closing stock price on Thursday, the company said in a statement on Friday. The stock jumped about 29% to $74.75 on the news. Including debt, the deal is valued at about $10.2 billion. The announcement comes after Zendesk said earlier this month that it would remain independent after failing to find a potential buyer. The San Francisco-based company said June 9 that it would no longer seek to sell itself after a strategic review that reached out to 16 potential strategic partners and 10 financial sponsors. Ultimately, "no actionable proposals were submitted," Zendesk said in a statement, and final bidders cited "adverse market conditions and financing difficulties at the end of the process."

Microsoft is preparing to send reminders to Windows 8.1 users that support will end on January 10th 2023. The software giant will start sending notifications to existing Windows 8.1 devices next month, as a first reminder leading up to the January 2023 support cutoff. From a report: The notifications will be similar to ones Microsoft has used in the past to remind Windows 7 users about end of support dates. Microsoft originally sunset Windows 8 support in 2016, but the Windows 8.1 update will cease support fully in January 2023. Microsoft will not be offering an Extended Security Update (ESU) program for Windows 8.1, so businesses won't be able to pay for additional security patches and will have to upgrade or accept the risk of running software without security updates.

Intel has told lawmakers and officials that it is delaying indefinitely the groundbreaking ceremony for a planned multibillion-dollar chip-manufacturing facility in Ohio, signaling frustration over uncertainty in Congress about legislation that would provide support for the U.S. chip industry. From a report: The ceremony had been tentatively scheduled for July 22. Intel informed the office of Ohio Gov. Mike DeWine and members of Ohio's congressional delegation on Wednesday that it was delaying the groundbreaking "due in part to uncertainty around" the chips-related legislation, known as the Bipartisan Innovation Act, according to an email reviewed by The Wall Street Journal.

Intel still plans to build the facility and hasn't pushed back the start of construction, said Intel spokesman Will Moss. Intel, which announced the plant plans in January, said it intended to invest at least $20 billion in the Ohio facility, with construction expected to begin in late 2022 and production to start in 2025. The company said in its announcement that spending on the Ohio project could reach around $100 billion over the next decade, but that the expansion depends in part on progress on the U.S. chips legislation.

An anonymous reader quotes a report from BleepingComputer: The National Security Agency (NSA) and cybersecurity partner agencies issued an advisory today recommending system administrators to use PowerShell to prevent and detect malicious activity on Windows machines. PowerShell is frequently used in cyberattacks, leveraged mostly in the post-exploitation stage, but the security capabilities embedded in Microsoft's automation and configuration tool can also benefit defenders in their forensics efforts, improve incident response, and to automate repetitive tasks. The NSA and cyber security centers in the U.S. (CISA), New Zealand (NZ NCSC), and the U.K. (NCSC-UK) have created a set of recommendations for using PowerShell to mitigate cyber threats instead of removing or disabling it, which would lower defensive capabilities.

Reducing the risk of threat actors abusing PowerShell requires leveraging capabilities in the framework such as PowerShell remoting, which does not expose plain-text credentials when executing commands remotely on Windows hosts. Administrators should be aware that enabling this feature on private networks automatically adds a new rule in Windows Firewall that permits all connections. Customizing Windows Firewall to allow connections only from trusted endpoints and networks helps reduce an attacker's chance for successful lateral movement. For remote connections, the agencies advise using the Secure Shell protocol (SSH), supported in PowerShell 7, to add the convenience and security of public-key authentication:

- remote connections don't need HTTPS with SSL certificates
- no need for Trusted Hosts, as required when remoting over WinRM outside a domain
- secure remote management over SSH without a password for all commands and connections
- PowerShell remoting between Windows and Linux hosts

Another recommendation is to reduce PowerShell operations with the help of AppLocker or Windows Defender Application Control (WDAC) to set the tool to function in Constrained Language Mode (CLM), thus denying operations outside the policies defined by the administrator. Recording PowerShell activity and monitoring the logs are two recommendations that could help administrators find signs of potential abuse. The NSA and its partners propose turning on features like Deep Script Block Logging (DSBL), Module Logging, and Over-the-Shoulder transcription (OTS). The first two enable building a comprehensive database of logs that can be used to look for suspicious or malicious PowerShell activity, including hidden action and the commands and scripts used in the process. With OTS, administrators get records of every PowerShell input or output, which could help determine an attacker's intentions in the environment. The full document, titled "Keeping PowerShell: Security Measures to Use and Embrace" is available here (PDF).

An anonymous reader quotes a report from TechCrunch: Another strike against use of Google Analytics in Europe: The Italian data protection authority has found a local web publisher's use of the popular analytics tool to be non-compliant with EU data protection rules owing to user data being transferred to the U.S. -- a country that lacks an equivalent legal framework to protect the info from being accessed by US spooks. The Garante found the web publisher's use of Google Analytics resulted in the collection of many types of user data, including device IP address, browser information, OS, screen resolution, language selection, plus the date and time of the site visit, which were transferred to the U.S. without adequate supplementary measures being applied to raise the level of protection to the necessary EU legal standard.

Protections applied by Google were not sufficient to address the risk, it added, echoing the conclusion of several other EU DPAs who have also found use of Google Analytics violates the bloc's data protection rules over the data export issue. Italy's DPA has given the publisher in question (a company called Caffeina Media Srl) 90 days to fix the compliance violation. But the decision has wider significance as it has also warned other local websites that are using Google Analytics to take note and check their own compliance, writing in a press release [translated from Italian with machine translation]: "[T]he Authority draws the attention of all Italian managers of websites, public and private, to the illegality of transfers made to the United States through GA [Google Analytics], also in consideration of the numerous reports and questions that are being received by the Office, and invites all data controllers to verify the compliance of the methods of use of cookies and other tracking tools used on its websites, with particular attention to Google Analytics and other similar services, with the legislation on the protection of personal data." A Google spokesperson issued the following statement: "People want the websites they visit to be well designed, easy to use, and respectful of their privacy. Google Analytics helps publishers understand how well their sites and apps are working for their visitors -- but not by identifying individuals or tracking them across the web. These organizations, not Google, control what data is collected with these tools, and how it is used. Google helps by providing a range of safeguards, controls and resources for compliance."

Google is reviewing the Italian DPA's decision, according to the spokesperson.

The group responsible for developing and updating the PCI Express standard, the PCI-SIG, aims to update that standard roughly every three years. From a report: Version 6.0 was released earlier this year, and the group has announced that PCIe version 7.0 is currently on track to be finalized sometime in 2025. Like all new PCI Express versions, its goal is to double the available bandwidth of its predecessor, which in PCIe 7.0's case means that a single PCIe 7.0 lane will be able to transmit at speeds of up to 32GB per second. That's a doubling of the 16GB per second promised by PCIe 6.0, but it's even more striking when compared to PCIe 4.0, the version of the standard used in high-end GPUs and SSDs today. A single PCIe 4.0 lane provides bandwidth of about 4GB per second, and you need eight of those lanes to offer the same speeds as a single PCIe 7.0 lane.

Increasing speeds opens the door to ever-faster GPUs and storage devices, but bandwidth gains this large would also make it possible to do the same amount of work with fewer PCIe lanes. Today's SSDs normally use four lanes of PCIe bandwidth, and GPUs normally use 16 lanes. You could use the same number of lanes to support more SSDs and GPUs while still providing big increases in bandwidth compared to today's accessories, something that could be especially useful in servers.

At its re:Mars conference, Amazon today announced the launch of CodeWhisperer, an AI pair programming tool similar to GitHub's Copilot that can autocomplete entire functions based on only a comment or a few keystrokes. From a report: The company trained the system, which currently supports Java, JavaScript and Python, on billions of lines of publicly available open-source code and its own codebase, as well as publicly available documentation and code on public forums. It's now available in preview as part of the AWS IDE Toolkit, which means developers can immediately use it right inside their preferred IDEs, including Visual Studio Code, IntelliJ IDEA, PyCharm, WebStorm and Amazon's own AWS Cloud 9. Support for the AWS Lambda Console is also coming soon. Ahead of today's announcement, Vasi Philomin, Amazon's VP in charge of its AI services, stressed that the company didn't simply create this in order to offer a copy of Copilot. He noted that with CodeGuru, its AI code reviewer and performance profiler, and DevOps Guru, its tool for finding operation issues, the company laid the groundwork for today's launch quite a few years ago.

Google is still useful for many, but the harder question is why its results feel more sterile than they did five years ago. From a report: SEO expert Marie Haynes's theory is that this is the result of Google trying to crack down on misinformation and low-quality content -- especially around consequential search topics. In 2017, the company started talking publicly about a Search initiative called EAT, which stands for "expertise, authoritativeness, and trustworthiness." The company has rolled out numerous quality rater guidelines, which help judge content to determine authenticity. One such effort, titled Your Money or Your Life, applies rigorous standards to any pages that show up when users search for medical or financial information.

"Take crypto," Haynes explained. "It's an area with a lot of fraud, so unless a site has a big presence around the web and Google gets the sense they're known for expertise on that topic, it'll be difficult to get them to rank." What this means, though, is that Google's results on any topic deemed sensitive enough will likely be from established sources. Medical queries are far more likely to return WebMD or Mayo Clinic pages, instead of personal testimonials. This, Haynes said, is especially challenging for people looking for homeopathic or alternative-medicine remedies.

There's a strange irony to all of this. For years, researchers, technologists, politicians, and journalists have agonized and cautioned against the wildness of the internet and its penchant for amplifying conspiracy theories, divisive subject matter, and flat-out false information. Many people, myself included, have argued for platforms to surface quality, authoritative information above all else, even at the expense of profit. And it's possible that Google has, in some sense, listened (albeit after far too much inaction) and, maybe, partly succeeded in showing higher-quality results in a number of contentious categories. But instead of ushering in an era of perfect information, the changes might be behind the complainers' sense that Google Search has stopped delivering interesting results.

Security researchers at Lookout recently tied a previously unattributed Android mobile spyware, dubbed Hermit, to Italian software house RCS Lab. Now, Google threat researchers have confirmed much of Lookout's findings, and are notifying Android users whose devices were compromised by the spyware. From a report: Hermit is a commercial spyware known to be used by governments, with victims in Kazakhstan and Italy, according to Lookout and Google. Lookout says it's also seen the spyware deployed in northern Syria. The spyware uses various modules, which it downloads from its command and control servers as they are needed, to collect call logs, record ambient audio, redirect phone calls and collect photos, messages, emails, and the device's precise location from a victim's device. Lookout said in its analysis that Hermit, which works on all Android versions, also tries to root an infected Android device, granting the spyware even deeper access to the victim's data. Lookout said that targeted victims are sent a malicious link by text message and tricked into downloading and installing the malicious app -- which masquerades as a legitimate branded telco or messaging app -- from outside of the app store.

Monica Alleven writes via Fierce Wireless: So much for the "win-win-win" scenario that Dish Network envisioned for the 12 GHz band. Dish and fellow MVDDS licensee RS Access have argued that the 12 GHz band can be used by both satellite players like SpaceX's Starlink and by companies like Dish that want to use it for 5G, all for the public's benefit. SpaceX on Tuesday submitted its own analysis (PDF) of the effect of terrestrial mobile deployment on non-geostationary orbit fixed satellite service (NGSO FSS) downlink operations. The upshot: The SpaceX study shows terrestrial mobile service would cause harmful interference to SpaceX's Starlink terminals in the 12.2-12.7 GHz band more than 77% of the time, resulting in full outages 74% of the time.

Although entities like RS Access note that SpaceX has access to plenty of other spectrum to accomplish its broadband mission, SpaceX insists that the 12 GHz band has become one of the most important and intensely used spectrum bands for Americans who depend on satellite services. In fact, SpaceX said it depends on the 12 GHz band for the workhorse frequencies in critical downlink services to serve Americans "in every corner of the nation." [...] SpaceX would like the FCC to drop the 12 GHz proceeding, but Dish and RS Access have been urging the FCC for years to change the rules so that their MVDDS licenses can be used for two-way 5G services. In response to SpaceX's submission, the 5G for 12 GHz Coalition, issued the following statement: "We understand that SpaceX has -- after 18 months and both a robust comment and reply period -- just filed its own in-house technical submission to the 12 GHz proceeding. Our engineers and technical experts are reviewing the filing in depth and remain committed to working in good faith with the FCC and stakeholders to ensure that the American public is able to reap the immense benefits of 5G services in this band."

Russia has levied dozens of cyber espionage campaigns in 42 countries since it invaded Ukraine in February, according to a new Microsoft report. From a report: The report says those efforts have targeted entities across six continents and primarily focused on NATO allies and groups supporting Ukraine. "The Russian invasion relies in part on a cyber strategy that includes at least three distinct and sometimes coordinated efforts -- destructive cyberattacks within Ukraine, network penetration and espionage outside Ukraine and cyber influence operations targeting people around the world," Microsoft President Brad Smith said in the report. The tech giant previously detailed Russian cyber operations against Ukraine itself during the invasion in April. Sixty-three percent of the observed Russian activity in the 42 countries beyond Ukraine targeted NATO members, according to the new report. The United States has been Russia's top target, but the company also noted a large amount of activity in Poland -- which borders Ukraine and has provided significant military and humanitarian assistance to the country -- as well as the Baltic states.