A cyber-espionage group has been observed targeting Indian targets with government and military-related lures in a broad campaign to infect victims with malware. From a report: Tracked under the name of SideCopy, this cyber-espionage group has been active since 2019, according to Seqrite, Quick Heal's threat intelligence team, which first documented its spear-phishing campaigns last September. But in a report published today, Cisco Talos, one of the networking giant's cybersecurity divisions, said the group did not retreat or stop its operations after having its attacks and tooling exposed last year.

The University of Oxford this week started vaccinations of a novel HIV vaccine candidate as part of a Phase I clinical trial in the UK. From a report: The goal of the trial, known as HIV-CORE 0052, is to evaluate the safety, tolerability, and immunogenicity of the HIVconsvX vaccine -- a mosaic vaccine targeting a broad range of HIV-1 variants, making it potentially applicable for HIV strains in any geographical region. Thirteen healthy, HIV-negative adults, aged 18-65 and who are considered not to be at high risk of infection, will initially receive one dose of the vaccine followed by a further booster dose at four weeks. The trial is part of the European Aids Vaccine Initiative (EAVI2020), an internationally collaborative research project funded by the European Commission under Horizon 2020 health programme for research and innovation.

Professor Tomas Hanke, Professor of Vaccine Immunology at the Jenner Institute, University of Oxford, and lead researcher on the trial, said: 'An effective HIV vaccine has been elusive for 40 years. This trial is the first in a series of evaluations of this novel vaccine strategy in both HIV-negative individuals for prevention and in people living with HIV for cure.' While most HIV vaccine candidates work by inducing antibodies generated by B-cells, HIVconsvX induces the immune system's potent, pathogen obliterating T cells, targeting them to highly conserved and therefore vulnerable regions of HIV -- an "Achilles heel" common to most HIV variants.

If you use an iPhone or Android phone, chances are the majority of your most-used apps were made by Apple and Google. From a report: That's the takeaway from a new Comscore study that ranks the popularity of preinstalled iOS and Android apps, such as Apple's Messages, alongside apps made by other developers. The results show that the majority of apps people use on their phones in the US come preinstalled by either Apple or Google. The first-of-its-kind report was commissioned by Facebook, one of Apple's loudest critics, and shared exclusively with The Verge. Preinstalled services dominate when it comes to basics like weather, photos, and clocks, according to the report, suggesting these categories will be difficult for other apps to compete in. Defaults don't win out exclusively, though: Apple Maps and Music don't appear on the iOS list at all, and Gmail makes the iOS list several entries below Apple Mail.

The timing, as Facebook likely intentioned, is apt: Apple and Google are increasingly under scrutiny for how they favor their own services over competitors like Spotify. US lawmakers are currently reviewing a new set of bills designed to curb the power of Big Tech, including legislation that could potentially bar Apple and Google from giving their services the upper hand against rivals. The pushback stems from how Apple and Google bundle their apps and services with their mobile operating systems in ways that some of their competitors think is unfair. The criticism is harsher against Apple, given that it more tightly controls the apps that come preinstalled on the iPhone and doesn't allow developers to circumvent its App Store.

According to the Financial Times, Croatian electric supercar startup Rimac Automobili is taking over Bugatti. Rimac will own a controlling 55% share in the new company, Bugatti-Rimac, with VW's Porsche owning the remaining 45%. TechCrunch reports: "Rimac and Bugatti are a perfect match in terms of what we each bring to the table," said founder and CEO of Rimac, Mate Rimac, in a statement. "As a young, agile and fast-paced automotive and technology company, we have established ourselves as an industry pioneer in electric technologies. With the Nevera, we have also proven that we can develop and manufacture outstanding hypercars, that are not only fast but also exciting and high-quality. Bugatti, with over a century of experience in engineering excellence, also possesses one of the most exceptional heritage of any car company in history." The company recently unveiled the Nevera, a hypercar powered by a 120kWh battery pack and four motors to achieve a staggering 1.4MW of power, which is about 1,914 horsepower. It can go from 0 to 60 mph in 1.85 seconds and has a top speed of 258 mph. The Nevera is expected to be the fastest sports car, a spot previously held by the Bugatti Chiron's.

Rimac's meteoric rise from bootstrapping in a garage in 2009 to building supercars with one of the most desirable and well-known car brands demonstrates how electric vehicles are beginning to take over the luxury and sports car market. It's not just about doing what's right for the environment -- it's about pioneering speed in the future of automobiles. Along with this announcement, Rimac said it would separate the development, production and supply of battery systems, drivetrains and other EV components into a new entity owned by Rimac Group called Rimac Technology, which will work independently with other global car manufacturers.

Microsoft has suspended its SQL Server on Windows Container beta "with immediate effect." The Register reports: The statement yesterday (early on a US public holiday) by Microsoft senior program manager Amit Khandelwal said: "Due to the existing ecosystem challenges and usage patterns we have decided to suspend the SQL Server on Windows Containers beta program for foreseeable future. Should the circumstances change, we will revisit the decision at appropriate time." Ecosystem challenges? Microsoft introduced Windows Server Containers in Windows Server 2016, enlisting the support of Docker so that developers could easily deploy containerised Windows applications in a similar manner to Linux. Windows containers are important to the company, used in its Application Guard security feature, which opens untrusted websites and Office documents in an isolated Hyper-V container. Containers were a key component of the abandoned Windows 10X.
[...]
The beta program for SQL Server on Windows containers began in 2017, said [Microsoft senior program manager Amit Khandelwal], which is a while back, and the fact that it has not hit general availability probably comes as no surprise to its relatively few users. That said, Microsoft has also decided to delete the Windows SQL Server images in the Docker Hub repository immediately, which did not go down well. "Could you please not delete those repos and images? That is going to break stuff. Folks have builds that depend on these images. At least give some warning rather than 'immediate effect,'" pleaded developer David Gardiner. Khandelwal replied saying that these container images were now three years old and "we do want any new users and customers downloading it." Since it was a beta, not supported in production, customers used it at their own risk.

In July 2019, Microsoft introduced an Early Adopters Program for SQL Server 2019 on Windows containers, the link for which leads appropriately to "Error 403 -- this web app is stopped." SQL Server running directly on Windows or in a Windows VM remains, of course, in rude health. Microsoft also recently introduced a preview of SQL Server for Azure Arc, supporting both Windows and Linux instances.

Dating app Bumble is opening up a restaurant in New York City where single folks can meet up for dates. Engadget reports: Bumble Brew is scheduled to open for breakfast service on July 24th. Lunch and dinner service will start at the Nolita spot in the coming weeks. Along with an 80-seat dining room, there will be a cocktail bar, patio dining and private dining space. The restaurant, which is decked out in the app's recognizable shade of yellow, can be used for events as well. It has an Italian-inspired menu with pickup and delivery options, and the music is primarily from female artists. The new venture builds on the Bumble Hive pop-up community spaces where people can hang out, eat and drink and meet others. Bumble Brew doesn't have a direct tie-in with the Bumble app, at least for now. Still, it's easy to imagine Bumble adding a reservation system that pops up when NYC users try to arrange a date.

The European Union has allocated $4.7 million in funding to upgrade Cerberus, a platform used by EU law enforcement agencies to crack passwords and access encrypted devices. From a report: Developed in 2019 for an initial cost of $2.7 million, Cerberus stands for Child Exploitation Response by Beating Encryption and Research to Unprotect Systems. The platform is a collection of finely tuned algorithms that utilize high-performance computers to crack passwords for devices seized during law enforcement investigations. Sources close to the project have told The Record this week that the new $4.7 million in funding will be used as part of a new project called Overclock, which aims to expand the Cerberus platform with new algorithms that can be used to crack passwords on a broader set of new devices. Once finished, EU law enforcement hopes to be able to expand their digital forensics capabilities in regards to extracting and recovering data from secure devices.

China issued a sweeping warning to its biggest companies, vowing to tighten oversight of data security and overseas listings just days after Didi's contentious decision to go public in the U.S. From a report: While the statement from China's State Council on Tuesday was thin on details, it suggests Beijing is preparing to intensify a crackdown on its corporate sector that has spanned everything from property debt and fintech to antitrust issues and now cybersecurity. Rules for overseas listings will be revised, the State Council said, while publicly-traded firms will be held accountable for keeping their data secure. China also said it will step up its regulatory oversight of companies trading in offshore markets. The move comes after the cyberspace regulator announced a probe into Didi, which controls almost the entire ride-hailing market in China, and pulled the company's app from stores.

The Department of Defense announced Tuesday it's calling off the $10 billion cloud contract that was the subject of a legal battle involving Amazon and Microsoft. From a report: The JEDI, or Joint Enterprise Defense Infrastructure, deal has become one of the most tangled contracts for the Department of Defense. In a press release Tuesday, the Pentagon said that "due to evolving requirements, increased cloud conversancy, and industry advances, the JEDI Cloud contract no longer meets its needs." But the fight over a cloud computing project does not appear to be completely over yet. The Pentagon said in the press release that it still needs enterprise-scale cloud capability and announced a new multi-vendor contract known as the Joint Warfighter Cloud Capability. The agency said it plans to solicit proposals from both Amazon and Microsoft for the contract, adding that they are the only cloud service providers that can meet its needs. But, it added, it will continue to do market research to see if others could also meet its specifications. [...] The lucrative JEDI contract was intended to modernize the Pentagon's IT operations for services rendered over as many as 10 years. Microsoft was awarded the cloud computing contract in 2019, beating out market leader Amazon Web Services.

schwit1 writes: Cathay Pacific is working with Airbus to introduce "reduced crew" long-haul flights with a sole pilot in the cockpit much of the time, industry sources told Reuters. The programme, known within Airbus as Project Connect, aims to certify its A350 jet for single-pilot operations during high-altitude cruise, starting in 2025 on Cathay passenger flights, the sources said. High hurdles remain on the path to international acceptance. Once cleared, longer flights would become possible with a pair of pilots alternating rest breaks, instead of the three or four currently needed to maintain at least two in the cockpit. That promises savings for airlines, amid uncertainty over the post-pandemic economics of intercontinental flying. But it is likely to encounter resistance from pilots already hit by mass layoffs, and safety concerns about aircraft automation.

The Yahoo brand, once an Internet name as iconic as Google, might be worth little to Gen Z-ers more familiar with TikTok and Instagram. But it still has value in Japan, where the once-illustrious marquee just sold for $1.6 billion. From a report: Z Holdings, a unit of Masayoshi Son's SoftBank Group Corp, agreed to buy the rights to the Yahoo name in Japan for 178.5 billion yen to replace an existing licensing agreement. The deal follows the sale of Verizon's media division, the bulk of which is the original U.S. version of the Yahoo web portal, to private equity firm Apollo Global for $5 billion. Yahoo! was one of Son's early big investments, who built a $100 million stake in one of the original web startups in the mid-90s. He subsequently formed the joint venture Yahoo! Japan, which over the years morphed into tech and e-commerce platform Z Holdings as Yahoo sold off its core assets.

Twitter no longer enjoys the liability protection against user-generated content in India, the government said in a court filing this week as tension escalates between the two over the South Asian nation's new IT rules. From a report: In a court filing on Monday, New Delhi said Twitter has lost its immunity in India after the American social network failed to comply with the new local IT rules, which were unveiled in February and went into effect in late May. Experts have said in recent weeks that the Indian court -- and not the Indian government -- holds the power to decide whether Twitter gets to keep its safe harbor protections in the world's second largest internet market.

Internet services enjoy what is broadly referred to as "safe harbor" protection that say that tech platforms won't be held liable for the things their users post or share online. If you insult someone on Twitter, for example, the company may be asked to take down your post (if the person you have insulted has approached the court and a takedown order has been issued) but it likely won't be held legally responsible for what you said or did. Without the protection, Twitter -- which according to mobile insight firm App Annie, has over 100 million users in India -- is on paper responsible for everything those users say on its platform.

Facebook, Twitter, and Alphabet's Google have privately warned the Hong Kong government that they could stop offering their services in the city if authorities proceed with planned changes to data-protection laws that could make them liable for the malicious sharing of individuals' information online. From a report: A letter sent by an industry group that includes the internet firms said companies are concerned that the planned rules to address doxing could put their staff at risk of criminal investigations or prosecutions related to what the firms' users post online. Doxing refers to the practice of putting people's personal information online so they can be harassed by others. Hong Kong's Constitutional and Mainland Affairs Bureau in May proposed amendments to the city's data-protection laws that it said were needed to combat doxing, a practice that was prevalent during 2019 protests in the city. The proposals call for punishments of up to 1 million Hong Kong dollars, the equivalent of about $128,800, and up to five years' imprisonment. "The only way to avoid these sanctions for technology companies would be to refrain from investing and offering the services in Hong Kong," said the previously unreported June 25 letter [PDF] from the Singapore-based Asia Internet Coalition, which was reviewed by The Wall Street Journal.

It's now being called "the single biggest global ransomware attack on record," with thousands of victims in at least 17 different countries breached with ransomware Friday, reports the Associated Press, citing new details provided by cybersecurity researchers.

An affiliate of the Russia-linked gang REvil deployed the ransomware "largely through firms that remotely manage IT infrastructure for multiple customers." A broad array of businesses and public agencies were hit by the latest attack, apparently on all continents, including in financial services, travel and leisure and the public sector — though few large companies, the cybersecurity firm Sophos reported... The Swedish grocery chain Coop said most of its 800 stores would be closed for a second day Sunday because their cash register software supplier was crippled. A Swedish pharmacy chain, gas station chain, the state railway and public broadcaster SVT were also hit. In Germany, an unnamed IT services company told authorities several thousand of its customers were compromised, the news agency dpa reported...

CEO Fred Voccola of the breached software company, Kaseya, estimated the victim number in the low thousands, mostly small businesses like "dental practices, architecture firms, plastic surgery centers, libraries, things like that." Voccola said in an interview that only between 50-60 of the company's 37,000 customers were compromised. But 70% were managed service providers who use the company's hacked VSA software to manage multiple customers. It automates the installation of software and security updates and manages backups and other vital tasks...

Dutch researchers said they alerted Miami-based Kaseya to the breach and said the criminals used a "zero day," the industry term for a previously unknown security hole in software. Voccola would not confirm that or offer details of the breach — except to say that it was not phishing. "The level of sophistication here was extraordinary," he said. When the cybersecurity firm Mandiant finishes its investigation, Voccola said he is confident it will show that the criminals didn't just violate Kaseya code in breaking into his network but also exploited vulnerabilities in third-party software...

Kaseya, which called on customers Friday to shut down their VSA servers immediately, said Sunday it hoped to have a patch in the next few days.
The attacks may have been timed to exploit America's three-day weekend celebrating the nation's founding, according to experts interviewed by the Associated Press. America's National Security advisor is now urging all who believed they were compromised to alert the FBI.

"The attack comes less than a month after Biden pressed Russian President Vladimir Putin to stop providing safe haven to REvil and other ransomware gangs whose unrelenting extortionary attacks the U.S. deems a national security threat."

UPDATE: Bleeping Computer notes the exploited vulnerability "had been previously disclosed to Kaseya by security researchers from the Dutch Institute for Vulnerability Disclosure (DIVD), and Kaseya was validating the patch before they rolled it out to customers."

In a statement today, DIVD posted that "During the last 48 hours, the number of Kaseya VSA instances that are reachable from the internet has dropped from over 2,200 to less than 140 in our last scan today... A good demonstration of how a cooperative network of security-minded organizations can be very effective during a nasty crisis."

"Make America weird again," quipped CNBC, describing Mark Zuckerberg's Instagram post today commemorating America's national Independence Day holiday MarketWatch explains: Yes, that's the Facebook Inc. chief executive wakeboarding while holding an American flag to the tune of John Denver's "Take Me Home, Country Roads."

Because: America.

In fairness, Zuckerberg did have reason to celebrate, as the Federal Trade Commission's antitrust case against Facebook was shot down (at least temporarily) last Monday, and a similar suit by [a coalition of 48] state attorneys general was dismissed outright. Facebook's valuation shot above the $1 trillion mark for the first time following the dismissals, and its shares rose about 4% on the week.
"If the plaintiffs had prevailed in the antitrust lawsuits, Facebook might have been required to divest Instagram and WhatsApp," notes CNBC."

Instead, he's using it to post a picture of himself flying an American flag on a $12,000 electronic surfboard.

"A federal judge on Wednesday blocked for the time being a new Florida law that sought to punish large social media businesses like Facebook and Twitter if they remove content or ban politicians," reports the Associated Press: U.S. District Judge Robert Hinkle granted a preliminary injunction stopping the new law from being enforced. The law — which was supposed to take effect on Thursday — enabled the state to fine large social media companies $250,000 a day if they remove an account of a statewide political candidate, and $25,000 a day if they remove an account of someone running for a local office. The legislation was challenged in federal court in Tallahassee by NetChoice, a lobbying firm that represents Twitter, Facebook and other online companies, and the Computer and Communications Industry Association. Both said the new law was unconstitutional and violated federal law.

The plaintiffs were likely to prevail on their claim that the new law violated the First Amendment if the case went to trial, the judge said.

Hinkle said the new law was aimed at only large social media businesses, not smaller ones that provide the same services, and made exceptions for Disney and their apps by including that theme park owners wouldn't be subject to the law.
The judge also argued that the law "compels providers to host speech that violates their standards."

An anonymous reader quotes a report from Ars Technica: Google has given the boot to nine Android apps downloaded more than 5.8 million times from the company's Play marketplace after researchers said these apps used a sneaky way to steal users' Facebook login credentials. In a bid to win users' trust and lower their guard, the apps provided fully functioning services for photo editing and framing, exercise and training, horoscopes, and removal of junk files from Android devices, according to a post published by security firm Dr. Web. All of the identified apps offered users an option to disable in-app ads by logging into their Facebook accounts. Users who chose the option saw a genuine Facebook login form containing fields for entering usernames and passwords.

Then, as Dr. Web researchers wrote: "These trojans used a special mechanism to trick their victims. After receiving the necessary settings from one of the C&C servers upon launch, they loaded the legitimate Facebook web page https://www.facebook.com/login... into WebView. Next, they loaded JavaScript received from the C&C server into the same WebView. This script was directly used to hijack the entered login credentials. After that, this JavaScript, using the methods provided through the JavascriptInterface annotation, passed stolen login and password to the trojan applications, which then transferred the data to the attackers' C&C server. After the victim logged into their account, the trojans also stole cookies from the current authorization session. Those cookies were also sent to cybercriminals. Analysis of the malicious programs showed that they all received settings for stealing logins and passwords of Facebook accounts. However, the attackers could have easily changed the trojans' settings and commanded them to load the web page of another legitimate service. They could have even used a completely fake login form located on a phishing site. Thus, the trojans could have been used to steal logins and passwords from any service."

The majority of the downloads were for an app called PIP Photo, which was accessed more than 5.8 million times. The app with the next greatest reach was Processing Photo, with more than 500,000 downloads. The remaining apps were: Rubbish Cleaner: more than 100,000 downloads; Inwell Fitness: more than 100,000 downloads; Horoscope Daily: more than 100,000 downloads; App Lock Keep: more than 50,000 downloads; Lockit Master: more than 5,000 downloads; Horoscope Pi: 1,000 downloads; and App Lock Manager: 10 downloads. A search of Google Play shows that all apps have been removed from Play.

An anonymous reader quotes a report from TechCrunch: Twitter has a history of sharing feature and design ideas it's considering at very early stages of development. Earlier this month, for example, it showed off concepts around a potential "unmention" feature that would let users untag themselves from others' tweets. Today, the company is sharing a few more of its design explorations that would allow users to better control who can see their tweets and who ends up in their replies.

The first of the new ideas builds on work that began last year with the release of a feature that allows an original poster to choose who's allowed to reply to their tweet. Today, users can choose to limit replies to only people mentioned in the tweet, only people they follow, or they can leave it defaulted to "everyone." But even though this allows users to limit who can respond, everyone can see the tweet itself. And they can like, retweet or quote tweet the post. With the proposed Trusted Friends feature, users could tweet to a group of their own choosing. This could be a way to use Twitter with real-life friends, or some other small network of people you know more personally. Perhaps you could post a tweet that only your New York friends could see when you wanted to let them know you were in town. Or maybe you could post only to those who share your love of a particular TV show, sporting event or hobby. Twitter says the benefit of this private, "friends only" format is that it could save people from the workarounds they're currently using -- like juggling multiple alt accounts or toggling between public to protected tweets.

Another new feature under consideration is Reply Language Prompts. This feature would allow Twitter users to choose phrases they don't want to see in their replies. When someone is writing back to the original poster, these words and phrases would be highlighted and a prompt would explain why the original poster doesn't want to see that sort of language. For instance, users could configure prompts to appear if someone is using profanity in their reply. The feature wouldn't stop the poster from tweeting their reply -- it's more a gentle nudge that asks them to be more considerate. The third, and perhaps most complicated, feature is something Twitter is calling "Facets." This is an early idea about tweeting from different personas from one account. The feature would make sense for those who often tweet about different aspects of their lives, including their work life, their side hustles, their personal life or family, their passions and more. Unlike Trusted Friends, which would let you restrict some tweets to a more personal network, Facets would give other users the ability to choose whether they wanted to follow all your tweets, or only those about the "facet" they're interested in. This way, you could follow someone's tweets about tech, but ignore their stream of reactions they post when watching their favorite team play. Or you could follow your friend's personal tweets, but ignore their work-related content. And so on.

Legislators in Norway have passed new regulations requiring influencers and advertisers to label retouched photos in a bid to fight unrealistic beauty standards. Motherboard reports: The new regulations were passed as an amendment to the nation's Marketing Act via a landslide 72 to 15 vote on June 2. The King of Norway will later decide when it will go into effect. Under the recently-passed rules, advertisements where a body's shape, size, or skin has been retouched -- even through a filter before a photo is taken -- will need a standardized label designed by the Norwegian Ministry of Children and Family Affairs. Examples of manipulations requiring labeling include enlarged lips, narrowed waists, and exaggerated muscles, but it's not clear if the same will apply to adjustments of lighting or saturation.

The law also covers images from influencers and celebrities if they "receive any payment or other benefit" in relation to the post, including on social media platforms Facebook, Instagram, Snapchat, TikTok, and Twitter. Any violations are punishable with escalating fines and, in extreme cases, even imprisonment. The move comes amidst continued public debate in Norway surrounding "kroppspress" (literally "body pressure"), which very roughly translates to beauty standards. In its proposal to the Norwegian parliament, the Ministry of Children and Family cites studies that found what it calls "body pressure," or beauty standards, to be pervasive and a contributing factor to low self-esteem in young people. The ministry conceded, however, that the requirement could be difficult to enforce because it's not always easy to determine if a photo has been edited. It also noted that an unintended consequence of the law could be that influencers feel more pressure to undergo cosmetic surgery "in order to live up to beauty ideals."

Instagram doesn't see itself as a platform where people go to share photos anymore. From a report: That's the main takeaway from a series of recent comments made by the head of the company, Adam Mosseri. "We're no longer a photo-sharing app or a square photo-sharing app," Mosseri said in a video he posted to his social media accounts this week. According to Mosseri, the main reason for that is that people come to Instagram "to be entertained," and it's not the only app that offers that in what is a crowded marketplace. "Let's be honest, there's some really serious competition right now," Mosseri said. "TikTok is huge, YouTube is even bigger and there are a lot of other upstarts as well." To stay competitive, Mosseri said Instagram has to embrace that aspect of itself, "and that means change." One way the app will change is with Instagram handing out more recommendations