Mozilla

Mozilla Firefox Tweaks Referrer Policy To Shore Up User Privacy (zdnet.com) 24

Mozilla Firefox will soon include a revised Referrer Policy to tighten up queries and better protect user information. From a report: Firefox 87, due to ship on March 23, will cut back on path and query string information from referrer headers "to prevent sites from accidentally leaking sensitive user data." In a blog post on Monday, developer Dimi Lee and security infrastructure engineering manager Christoph Kerschbaumer said the latest browser version will include a "stricter, more privacy-preserving default Referrer Policy." Browsers send HTTP Referrer headers to websites to indicate which location has 'referred' a user to a website server. Full URLs of referring documents are often sent in the HTTP Referrer header with other subresource requests, and while this may contain innocent information used for purposes including analytics, private user data may also be included. Referrer policies aim to protect this data, but if no policy is set by a website, this often defaults to "no-referrer-when-downgrade," an element that Firefox says does trim down the referrer when navigating to a less secure resource, but still "sends the full URL including path and query information of the originating document as the referrer."
Facebook

US Supreme Court Rebuffs Facebook Appeal In User Tracking Lawsuit (reuters.com) 23

The U.S. Supreme Court on Monday turned away Facebook's bid to pare back a $15 billion class action lawsuit accusing the company of illegally tracking the activities of internet users even when they are logged out of the social media platform. Reuters reports: The justices declined to hear Facebook's appeal of a lower court ruling that revived the proposed nationwide litigation accusing the company of violating a federal law called the Wiretap Act by secretly tracking the visits of users to websites that use Facebook features such as the "like" button. The litigation also accuses the company of violating the privacy rights of its users under California law but Facebook's appeal to the Supreme Court involved only the Wiretap Act.

Four individuals filed the proposed nationwide class action lawsuit in California federal court seeking $15 billion in damages for Menlo Park, California-based Facebook's actions between April 2010 and September 2011. The company stopped its nonconsensual tracking after it was exposed by a researcher in 2011, court papers said. Facebook said it protects the privacy of its users and should not have to face liability over commonplace computer-to-computer communications. Facebook has more than 2.4 billion users worldwide, including more than 200 million in the United States.

The case centers on Facebook's use of features called "plug-ins" that third-parties often incorporate into their websites to track the browsing histories of users. Along with digital files called "cookies" that can help identify internet users, the plaintiffs accused Facebook of packaging this tracked data and selling it to advertisers for profit. Facebook said it uses the data it receives to tailor the content it shows its users and to improve ads on its service. [...] In its appeal to the Supreme Court, Facebook said it is not liable under the Wiretap Act because it is a party to the communications at issue by virtue of its plug-ins.

Transportation

Is Sergey Brin Building the World's Biggest, Climate-Friendly Aircraft? (sfgate.com) 85

Google co-founder Sergey Brin is the ninth-richest person in the world — and he loves airships. Now new details have emerged about Brin's secretive airship company, LTA Research and Exploration (which stands for "Lighter Than Air"). SFGate reports: Although back in 2017 the word on the street was that Brin intended the aircraft to serve at least in part as a luxurious "air yacht" for his family and friends, the LTA website states only humanitarian goals: "LTA airships will have the ability to complement — and even speed up — humanitarian disaster response and relief efforts, especially in remote areas that cannot be easily accessed by plane and boat due to limited or destroyed infrastructure." Unlike jet planes, airships have the ability to land or deliver goods almost anywhere.

In addition, the LTA site says that their airships are intended to serve as a zero emissions alternative to airplanes, used for both shipping goods and moving people. Climate change has made airships sound more appealing to scientists in recent years — while slower than airplanes, airships are faster than cargo ships and have fewer emissions than both boats and planes. In fact, airships produce 80% to 90% fewer emissions than conventional aircraft.

They're going to be huge — and they're not going to be cheap. "It's going to be massive on a grand scale," a source told the Guardian in 2017, estimating that Brin's airship would be about 650 feet long... A recent job description posted on the LTA website revealed the company's plans to build a 1.5-megawatt hydrogen fuel cell propulsion system.

TechCrunch reports that one airship — named Pathfinder 1 — has already been built, and could be ready to launch from Silicon Valley as soon as this year.
Microsoft

Are Tech Companies Squandering 'the Good of All' for Extractive Behaviors? (oreilly.com) 67

"If I worked in tech antitrust policy, I would really want to understand why all the cases against Microsoft 20 years ago were such an unqualified failure." That's what venture capitalist Benedict Evans (formerly an Andreessen Horowitz partner), is asking regulators on Twitter.

"You won, yet achieved nothing, and then Microsoft's dominance went away anyway. Why?"

Long-time Slashdot reader theodp notes the thread of reminiscent reactions from Microsoft employees prompted this response on the blog of software developer Dave Winer "to lament the collateral damage of a winner-take-all mentality." "Microsoft could've played a senior role, and helped the rest of us add all kinds of editors and databases to the web, and at least try to bring across some of the GUI innovations of the 1980s. Instead all that was lost. Today, decades later, because of the chaos Microsoft brought us then, the editors on the web still suck. They are really inferior. Far less useful than the editors we had before the web.

"What if Microsoft had chilled and brought together the best minds from the PC era and asked some basic questions like how are we going to make the web better for everyone, at least as good as what we had before. What a time that would have been to do just that. But they acted like spoiled children."

But are we facing the same issues today? In The End of Silicon Valley as We Know It?, geek publishing icon/seed investor Tim O'Reilly checks in on tech's latter-day missed opportunities: The extractive behavior the tech giants exhibit has been the norm for modern capitalism since Milton Friedman set its objective function in 1970: "The social responsibility of business is to increase its profits"...

It's a sad time for Silicon Valley, because we are seeing not only the death of its youthful idealism but a missed opportunity. Paul Cohen, the former DARPA program manager for AI, made a powerful statement a few years ago at a meeting of the National Academy of Sciences that we both attended: "The opportunity of AI is to help humans model and manage complex interacting systems." That statement sums up so much of the potential that is squandered when firms like Google, Amazon, and Facebook fall prey to the Friedman doctrine rather than setting more ambitious goals for their algorithms.

I'm not talking about future breakthroughs in AI so much as I'm talking about the fundamental advances in market coordination that the internet gatekeepers have demonstrated. These powers can be used to better model and manage complex interacting systems for the good of all. Too often, though, they have been made subservient to the old extractive paradigm."

Social Networks

Stricter Rules for Internet Platforms? What are the Alternatives... (acm.org) 83

A law professor serving on the EFF's board of directors (and advisory boards for the Electronic Privacy Information Center and the Center for Democracy and Technology) offers this analysis of "the push for stricter rules for internet platforms," reviewing proposed changes to the liability-limiting Section 230 of the Communications Decency Act — and speculating about what the changes would accomplish: Short of repeal, several initiatives aim to change section 230. Eleven bills have been introduced in the Senate and nine in the House of Representatives to amend section 230 in various ways.... Some would widen the categories of harmful conduct for which section 230 immunity is unavailable. At present, section 230 does not apply to user-posted content that violates federal criminal law, infringes intellectual property rights, or facilitates sex trafficking. One proposal would add to this list violations of federal civil laws.

Some bills would condition section 230 immunity on compliance with certain conditions or make it unavailable if the platforms engage in behavioral advertising. Others would require platforms to spell out their content moderation policies with particularity in their terms of service (TOS) and would limit section 230 immunity to TOS violations. Still others would allow users whose content was taken down in "bad faith" to bring a lawsuit to challenge this and be awarded $5,000 if the challenge was successful. Some bills would impose due process requirements on platforms concerning removal of user-posted content. Other bills seek to regulate platform algorithms in the hope of stopping the spread of extremist content or in the hope of eliminating biases...

Neither legislation nor an FCC rule-making may be necessary to significantly curtail section 230 as a shield from liability. Conservative Justice Thomas has recently suggested a reinterpretation of section 230 that would support imposing liability on Internet platforms as "distributors" of harmful content... Section 230, after all, shields these services from liability as "speakers" and "publishers," but is silent about possible "distributor" liability. Endorsing this interpretation would be akin to adopting the notice-and-takedown rules that apply when platforms host user-uploaded files that infringe copyrights.

Thanks to Slashdot reader Beeftopia for sharing the article, which ultimately concludes: - Notice-and-takedown regimes have long been problematic because false or mistaken notices are common and platforms often quickly take-down challenged content, even if it is lawful, to avoid liability...

- For the most part, these platforms promote free speech interests of their users in a responsible way. Startup and small nonprofit platforms would be adversely affected by some of the proposed changes insofar as the changes would enable more lawsuits against platforms for third-party content. Fighting lawsuits is costly, even if one wins on the merits.

- Much of the fuel for the proposed changes to section 230 has come from conservative politicians who are no longer in control of the Senate.

- The next Congress will have a lot of work to do. Section 230 reform is unlikely to be a high priority in the near term. Yet, some adjustments to that law seem quite likely over time because platforms are widely viewed as having too much power over users' speech and are not transparent or consistent about their policies and practices.

The Military

Vint Cerf vs. Martin Hellman: How Should We Assess the Risks of Nuclear War? (thebulletin.org) 43

The Bulletin of the Atomic Scientists published a discussion between a 77-year-old "father of the internet" and a 75-year-old "father of public key cryptography". Long before Vinton Cerf and Martin Hellman changed the world with their inventions, they were young assistant professors at Stanford University who became fast friends... More than 50 years and two technological revolutions later, the friendship between Vint and Marty — as they know each other — endures. This is despite, or perhaps because of, their sometimes different views. You see, while they do not always agree, they both enjoy a good intellectual debate, especially when the humans they sought to bring together with their inventions face existential threats.

Not long after giving the world public key cryptography, Hellman switched his focus from encryption to efforts that might avoid nuclear war. "What's the point of developing new algorithms if there's not likely to be anybody around in 50-100 years?" Hellman recalls thinking at the time... On a recent private phone call with each other, the two friends discussed the National Academies of Sciences, Engineering, and Medicine's project seeking to answer the question, "Should the U.S. use quantitative methods to assess the risks of nuclear war and nuclear terrorism?"

While both agree that the US needs to understand the risk of nuclear war, they disagree about whether a quantitative analysis is necessary.

"Quantitative estimates run either the real or perceived risk of being twisted to support whatever conclusion is desired," Cerf argues — while sharing instead an analogy he believes illustrates the risks of the 13,410 nuclear weapons currently in the world (91% divided between Russia and the U.S.)

But Hellman counters that "When the risk is highly uncertain, how do you determine who's right?" He ultimately suggests quantifying the risks would make society more fully aware of the stakes.

"I hope you will agree with either my quantitative approach or Vint's qualitative approach," Hellman concludes, "both of which conclude that the risk of a nuclear war is unacceptably high and risk reduction measures are urgently needed." But for those who accept neither approach, Hellman adds two questions:
  • What evidence supports the belief that the risk of nuclear deterrence failing is currently at an acceptable level?
  • Can we responsibly bet humanity's existence on a strategy for which the risk of failure is totally unknown?

If you were on the call — what would you say?


Transportation

Can VW's Electric Cars Compete With Tesla's? (nytimes.com) 221

The New York Times reports: Not long ago Volkswagen was a global pariah after pleading guilty to the biggest emissions fraud in automotive history. Now it is the toast of the stock market, with its shares worth twice as much as they were a year ago.

What happened?

Ironically, Volkswagen's misdeeds helped pave the way for its reversal of fortune... The financial commitment Volkswagen made then, when sales of electric vehicles were minimal, is paying off now as the company rolls out a line of vehicles developed from the ground up to run on batteries, with more interior space and more appeal than adaptations of gasoline vehicles... Investors have noticed, lighting up online stock forums with chatter about Volkswagen and rewarding other established carmakers, like General Motors and Ford Motor, that are pivoting to electric propulsion. Shares of Tesla, on the other hand, have slipped. Tesla is still the most valuable car company in the world by a wide margin, but investors are no longer as certain that Tesla will have the fast-growing electric car market to itself...

Volkswagen also benefited from a report issued this month by analysts at UBS, the Swiss bank, which rated it as the traditional carmaker best positioned to compete with Tesla because it already has the ability to mass-produce electric cars economically... With 665,000 employees and sales of 9.3 million vehicles last year, Volkswagen is the second-largest carmaker in the world after Toyota. It can spread the cost of developing new technologies over millions of vehicles and undercut Tesla on price. By 2025, Volkswagen will be able to produce electric vehicles for less than it costs to build a gasoline or diesel car, UBS analysts wrote in this month's report.

They cautioned that Tesla retains a significant lead in battery technology and autonomous driving software.

Sales of electric VW cars tripled last year, to 230,000 vehicles, the article points out — noting that that's just the beginning. This week VW also announced plans to employ 10,000 software engineers to work on new technologies including autonomous driving, becoming the second-biggest software company in all of Europe.

"The diesel scandal remains a financial burden. The company disclosed in its annual report this week that potential liabilities from lawsuits, such as one by shareholders claiming the company misled them, could cost 4.2 billion euros, or $5 billion. That is in addition to the tens of billions of euros Volkswagen has already paid in fines and settlements since 2017 after admitting that it programmed diesel cars to produce lower emissions in testing conditions than in normal use."

But "Investors this week were focusing on Volkswagen's future rather than its past..."
Facebook

Facebook May Actually Be In a 'Stronger Position' After Apple's iOS 14 Privacy Changes (cnbc.com) 31

An anonymous reader quotes a report from CNBC: Facebook CEO Mark Zuckerberg on Thursday said he is confident the social media company "will be able to manage through" Apple's upcoming planned privacy update to iOS 14, which will make it easier for iPhone and iPad users to block companies from tracking their activity to target ads. "We'll be in a good position," Zuckerberg said Thursday afternoon in Josh Constine's PressClub Clubhouse room. Apple's upcoming privacy changes will inform users about device ID tracking and ask them if they want to allow it. The tracking is based on a unique device identifier on every iPhone and iPad called the IDFA. Companies that sell mobile advertisements use this ID to help target ads and estimate their effectiveness. Apple has said that the change will roll out early this spring.

Zuckerberg explained that the change could benefit Facebook if more businesses decide to sell goods directly through Facebook and Instagram. "It's possible that we may even be in a stronger position if Apple's changes encourage more businesses to conduct more commerce on our platforms by making it harder for them to use their data in order to find the customers that would want to use their products outside of our platforms," Zuckerberg said. Zuckerberg on Thursday said that already Facebook has 1 million active shops on its services and 250 million people using shops actively. "Compared to the early conversations we had about how people would use this across Facebook and Instagram and our product, I think this is something that's well on track to be something that's going to be increasingly important to people," Zuckerberg said.

Printer

Windows 10 Updates Are Causing Even More Printer Problems Than First Thought (betanews.com) 70

Following reports that a recent update to Windows 10 was causing blue screens as well as problems with printing, Microsoft issued a new series of updates to address the issues. But it seems that the problems caused by this month's Patch Tuesday updates are actually worse than first thought. BetaNews reports: Users with certain brands of printer experienced APC_INDEX_MISMATCH errors and blue screens, but now Microsoft has issued a warning that there may be additional problems with elements missing from print outs, or even entirely blank pages being output. The problematic updates are KB5000802, KB5000808, KB5000809 and KB5000822. In the support documentation for these four updates, Microsoft acknowledges the APC_INDEX_MISMATCH error problems and BSoDs, and directs people to install the relevant patches for their system. But the company now also acknowledges that there are more problems with the original updates than first appeared to be the case.

For each of these four updates Microsoft issues the same warning: "After installing updates released March 9, 2021 or March 15, 2021, you might get unexpected results when printing from some apps..." There is currently no fix, and Microsoft is not even able to offer a workaround right now. Instead, the company simply says: "We are working on a resolution and estimate a solution will be available in the coming days."

Transportation

China Restricts Tesla Vehicles Over National Security Concerns (wsj.com) 71

hackingbear writes: The Wall Street Journal reports that China's government is restricting the use of Tesla's vehicles by military staff and employees of key state-owned companies (Source paywalled; alternative source), citing concerns that the data collected by the cars could be a source of national security leaks. "The move follows a government security review of Tesla's vehicles, which Chinese officials said raised concerns because the cars' cameras can constantly record images, the people said, as well as obtain various data such as when, how and where the cars are being used, and the contact list of mobile phones that are synced to the cars," reports The Wall Street Journal. "The government is concerned that some data could be sent back to the U.S., the people said."

The move appears to be a retaliation against U.S. restrictions on the use of communications equipment made by a slate of Chinese companies including Huawei, the Chinese tech giant that Washington has labeled a national security threat over fears it could spy for Beijing -- allegations which Huawei denies and which base more on overheating US-China rivalry than actual evidences.

AT&T

AT&T Lies About California Net Neutrality Law, Claiming It Bans 'Free Data' (arstechnica.com) 91

An anonymous reader quotes a report from Ars Technica: AT&T lied about California's net neutrality law yesterday when it claimed the law requires AT&T to stop providing "free data" to mobile customers. In reality, the California law allows AT&T to continue zero-rating HBO Max, its own video service, as long as it exempts all competing video services from data caps without charging the other video providers. But instead of zero-rating all video without collecting payments from its competitors in the online-video business, AT&T decided it would rather not exempt anything at all.

"Unfortunately, under the California law we are now prohibited from providing certain data features to consumers free of charge," AT&T claimed in its announcement that it is ending the "zero-rating" program that exempts some content from data caps. "Given that the Internet does not recognize state borders, the new law not only ends our ability to offer California customers such free data services but also similarly impacts our customers in states beyond California," the AT&T announcement also said. Going forward, AT&T will no longer exempt the AT&T-owned HBO Max from its mobile data caps and will stop the "sponsored data" program in which it charges other companies for similar exemptions from AT&T's data caps. But this is a business decision, not purely a legal one: as we already stated, AT&T could exempt all video streaming services including HBO Max from its mobile data caps without violating the California law as long as AT&T stops charging rival video companies for the same data-cap exemptions.

Facebook

Facebook Is Building An Instagram For Kids Under The Age Of 13 (buzzfeednews.com) 30

Executives at Instagram are planning to build a version of the popular photo-sharing app that can be used by children under the age of 13, BuzzFeed News reported this week, citing an internal company post. From the report: "I'm excited to announce that going forward, we have identified youth work as a priority for Instagram and have added it to our H1 priority list," Vishal Shah, Instagram's vice president of product, wrote on an employee message board on Thursday. "We will be building a new youth pillar within the Community Product Group to focus on two things: (a) accelerating our integrity and privacy work to ensure the safest possible experience for teens and (b) building a version of Instagram that allows people under the age of 13 to safely use Instagram for the first time."
Facebook

Instagram, WhatsApp, and Facebook Messenger Are Down for Many (theverge.com) 30

Instagram, WhatsApp, and Facebook Messenger are down for many right now. From a report: More than 123,000 users have reported issues with Instagram on DownDetector. More than 23,000 users have reported issues with WhatsApp on DownDetector, too, and the service is down for one Verge staffer's family, who is based in Europe. Facebook Messenger seems to be affected as well, with more than 5,000 reports of problems on DownDetector. When navigating to Instagram's website, I saw a white page with the message "5xx Server Error." And when I redownloaded Instagram to my phone and tried to log in, I hit an error there, too.
Twitter

Twitter Asks: When Should We Cut Off Rule-Breaking World Leaders? (reuters.com) 263

Twitter said on this week it will seek public input on when and how it should ban world leaders, saying it was reviewing policy and considering whether the leaders should be held to the same rules as other users. From a report: Social media platforms including Twitter and Facebook have been under scrutiny for the way they handle accounts of politicians and government officials, particularly following their ban on former U.S. President Donald Trump's account for inciting violence after the Jan. 6 riot at the Capitol. Twitter said it would release a survey on March 19 to find out whether users think politicians should be subject to the usual Twitter rules and what enforcement action should be taken if they break them. The survey will close on April 12 at 5 p.m PT.
Communications

Mozilla Leads Push for FCC To Reinstate Net Neutrality (cnbc.com) 78

Tech companies led by Mozilla are urging the Federal Communications Commission to swiftly reinstate net neutrality rules stripped away under the Trump administration. From a report: In a letter to FCC Acting Chairwoman Jessica Rosenworcel Friday, ADT, Dropbox, Eventbrite, Reddit, Vimeo and Wikimedia joined Mozilla, the maker of the Firefox web browser, in calling net neutrality "critical for preserving the internet as a free and open medium that promotes innovation and spurs economic growth." [...] In a blog post Friday, Mozilla Chief Legal Officer Amy Keating said the pandemic has made the need for net neutrality rules even more clear.

"In a moment where classrooms and offices have moved online by necessity, it is critically important to have rules paired with strong government oversight and enforcement to protect families and businesses from predatory practices," Keating said. "In California, residents will have the benefit of these fundamental safeguards as a result of a recent court decision that will allow the state to enforce its state net neutrality law. However, we believe that users nationwide deserve the same ability to control their own online experiences."

Chrome

Chrome Brings Live-Captioning To Any Web Audio Source (arstechnica.com) 16

An anonymous reader quotes a report from Ars Technica: Google is officially bringing its "Live Caption" technology to any website with the new version of Chrome. The feature, which debuted on Pixel phones and should be available on most Android 10+ devices, lets you easily apply Google's speech-to-text technology to any audio source, making it simple to get closed-captioning on audio that's lacking in the accessibility department. Starting today, Google is beginning to roll out the feature to Chrome 89 and up on desktop PCs.

You can enable the feature from the Chrome settings by going to "Advanced" and "Accessibility" and then turning on "Live Caption." Live captions appear on webpages as a gray box that fills with text as the video or audio plays. You can drag the box around so it never gets in the way, and you can even pick between two sizes. Live Caption will attempt to work with every audio source on the web; you can temporarily close the box each time you load a page, but there's no way to enable it on some websites and disable it on others. Google says all the processing happens locally on your device and won't end up on the Internet.
For now, Google says Live Caption "currently supports English and is available globally on the latest release of Chrome on Windows, Mac and Linux devices and will be coming soon to ChromeOS."
Transportation

Surveillance Company Wants To Sell Over 15 Billion Car Locations To the US Military (vice.com) 62

An anonymous reader quotes a report from Motherboard: A surveillance contractor that has previously sold services to the U.S. military is advertising a product that it says can locate the real-time locations of specific cars in nearly any country on Earth. It says it does this by using data collected and sent by the cars and their components themselves, according to a document obtained by Motherboard. "Ulysses can provide our clients with the ability to remotely geolocate vehicles in nearly every country except for North Korea and Cuba on a near real time basis," the document, written by contractor The Ulysses Group, reads. "Currently, we can access over 15 billion vehicle locations around the world every month," the document adds.

Although the company told Motherboard it has not sold the product to the U.S. government at this time, the news highlights the scale and reach of car-tracking technology, and the fact that car location data is of interest not just to insurance companies and the finance sector, but to government contractors who explicitly say they want to source the data for intelligence and surveillance purposes. [...] Included in the document is a map showing apparent vehicle locations spread across Russia, Ukraine, and Turkey, including along the border with Syria. A section of text next to the map says Ulysses' data access lets clients analyze targets "whether you want to geo-locate one vehicle or 25,000,000 as shown here." An image on the company's LinkedIn page appears to show data related to Bulgaria. [...] The document does not explain exactly how Ulysses sources its data, be that directly from automakers or OEMs, or via an aggregator company. But there are plenty of companies that could be contributing.
Andrew Lewis, president of The Ulysses Group, told Motherboard in an email that "any proprietary promotional material we may have produced is aspirational and developed based on publicly available information about modern telematics equipment." Lewis added: "We do not have any contracts with the government or any of its agencies related to our work in the field and we have never received any funding whatsoever from the government related to telematics."
Google

Google's Privacy Push Draws US Antitrust Scrutiny (reuters.com) 28

Google's plan to block a popular web tracking tool called "cookies" is a source of concern for U.S. Justice Department investigators who have been asking advertising industry executives whether the move by the search giant will hobble its smaller rivals, Reuters reported Thursday, citing sources. From the report: Alphabet's Google a year ago announced it would ban some cookies in its Chrome browser to increase user privacy. Over the last two months, Google released more details, leading online ads rivals to complain about losing the data-gathering tool. The questions from Justice Department investigators have touched on how Chrome policies, including those related to cookies, affect the ad and news industries, four people said. Investigators are asking whether Google is using Chrome, which has 60% global market share, to reduce competition by preventing rival ad companies from tracking users through cookies while leaving loopholes for it to gather data with cookies, analytics tools and other sources, the sources added. The latest conversations, which have not been previously reported, are a sign that officials are tracking Google's projects in the global online ad market where it and No. 2 Facebook control about 54% of revenue. The ad inquiry may not lead to legal action. Executives from more than a dozen companies from an array of sectors have spoken with Justice Department investigators, one of the sources said. The government has been investigating Google's search and advertising business since mid-2019, and last October it sued Google for allegedly using anticompetitive tactics to maintain the dominance of its search engine. It has continued to probe Google's ad practices.
IOS

iOS Developers Targeted With New XcodeSpy macOS Malware (therecord.media) 7

Security researchers have uncovered a new type of macOS malware that has been used in the wild to attack iOS software developers through trojanized Xcode projects. From a report: Named XcodeSpy, the malware consists of a malicious Run Script that was added to a legitimate Xcode project named TabBarInteraction. Security firm SentinelOne, which analyzed the malware in a report published today and shared with The Record, said the malicious script ran every time the Xcode project was built, installing a LaunchAgent for reboot persistence and then downloading a second payload, a macOS backdoor named EggShell. "The backdoor has functionality for recording the victim's microphone, camera and keyboard, as well as the ability to upload and download files," said Phil Stokes, macOS malware researcher at SentinelOne.

While the XcodeSpy server infrastructure that controlled the LaunchAgent was down, Stokes said they were able to discover several instances of the EggShell backdoor uploaded on the VirusTotal web-based malware scanner. Stokes said SentinelOne first learned of this malware following a tip from an anonymous researcher, who found an instance of the EggShell backdoor on the network of a US-based company. "The victim reported that they are repeatedly targeted by North Korean APT actors and the infection came to light as part of their regular threat hunting activities," Stokes said, but the researcher told The Record they were not able to definitively link the malware to a nation-state operation beyond a reasonable doubt.

Facebook

Facebook is Making a Bracelet That Lets You Control Computers With Your Brain (technologyreview.com) 51

Facebook says it has created a wristband that translates motor signals from your brain so you can move a digital object just by thinking about it. From a report: The wristband, which looks like a clunky iPod on a strap, uses sensors to detect movements you intend to make. It uses electromyography (EMG) to interpret electrical activity from motor nerves as they send information from the brain to the hand. The company says the device, as yet unnamed, would let you navigate augmented-reality menus by just thinking about moving your finger to scroll. A quick refresher on augmented reality: It overlays information on your view of the real world, whether it's data, maps, or other images.

The most successful experiment in augmented reality was Pokemon Go, which took the world by storm in 2016 as players crisscrossed neighborhoods in search of elusive Pokemon characters. That initial promise has faded over the intervening years, however, as companies have struggled to translate the technology into something appealing, light, and usable. Google Glass and Snap Spectacles bombed, for example: people simply did not want to use them. Facebook thinks its wristband is more user friendly. Does it work the way Facebook claims? Too soon to tell. The product is still in research and development at the company's internal Facebook Reality Labs, and I didn't get to have a go. No word yet on when it will be released or how much it will cost, either. Years in the making: Facebook acquired startup CTRL-labs in September 2019 for between $500 million and $1 billion. CTRL had been working on its own wrist-based EMG device, and its head, Thomas Reardon, now leads Facebook's AR/VR research team. At the press preview, Reardon said the device was "not mind control." He added, "This is coming from the part of the brain that controls motor information, not thought."

Slashdot Top Deals