The Russian government says it has successfully tested a country-wide alternative to the global internet. Details of what the test involved were vague but, according to the Ministry of Communications, ordinary users did not notice any changes. The results will now be presented to President Putin. The BBC reports: The initiative involves restricting the points at which Russia's version of the net connects to its global counterpart, giving the government more control over what its citizens can access. "Sadly, the Russian direction of travel is just another step in the increasing breaking-up of the internet," said Prof Alan Woodward, a computer scientist at the University of Surrey. "That would effectively get ISPs [internet service providers] and telcos to configure the internet within their borders as a gigantic intranet, just like a large corporation does," explained Prof Woodward.

"The Russian government has run into technical challenges in the past when trying to increase online control, such as its largely unsuccessful efforts to block Russians from accessing encrypted messaging app Telegram," Justin Sherman, a cyber-security policy fellow at the New America think tank, told the BBC. "Without more information about this test though, it's hard to assess exactly how far Russia has progressed in the path towards an isolatable domestic internet. "And on the business front, it remains to be seen just how much domestic and foreign pushback Russia will get."

doug141 writes: At least 17 big drones, likely over the FAA limit of 55 pounds, are flying a grid search pattern over NE Colorado (Warning: source paywalled; alternative source), nightly between 7 and 10 p.m. at 40 MPH and about 300 feet. The FAA has no information and the USAF and DEA say the aircraft aren't theirs.

An anonymous reader quotes a report from ZDNet: A new set of SQLite vulnerabilities can allow attackers to remotely run malicious code inside Google Chrome, the world's most popular web browser. The vulnerabilities, five, in total, are named "Magellan 2.0," and were disclosed today by the Tencent Blade security team. All apps that use an SQLite database are vulnerable to Magellan 2.0; however, the danger of "remote exploitation" is smaller than the one in Chrome, where a feature called the WebSQL API exposes Chrome users to remote attacks, by default.

Just like the original Magellan vulnerabilities, these new variations are caused by improper input validation in SQL commands the SQLite database receives from a third-party. An attacker can craft an SQL operation that contains malicious code. When the SQLite database engine reads this SQLite operation, it can perform commands on behalf of the attacker. In a security advisory published today, the Tencent Blade team says the Magellan 2.0 flaws can lead to "remote code execution, leaking program memory or causing program crashes." All apps that use an SQLite database to store data are vulnerable, although, the vector for "remote attacks over the internet" is not exploitable by default. To be exploitable, the app must allow direct input of raw SQL commands, something that very few apps allow. Thankfully, Google patched all five Magellan 2.0 vulnerabilities in Google Chrome 79.0.3945.79, released two weeks ago.

The SQLite project also fixed the bugs in a series of patches on December 13, 2019; however, these fixes have not been included in a stable SQLite branch -- which remains v3.30.1, released on December 10.

Computer engineer George Hilliard says he has built an electronic business card running Linux. From his blog post: It is a complete, minimal ARM computer running my customized Linux firmware built with Buildroot. It has a USB port in the corner. If you plug it into a computer, it boots in about 6 seconds and shows up over USB as a flash drive and a virtual serial port that you can use to log into the card's shell. The flash drive has a README file, a copy of my resume, and some of my photography. The shell has several games and Unix classics such as fortune and rogue, a small 2048, and a small MicroPython interpreter.

All this is accomplished on a very small 8MB flash chip. The bootloader fits in 256KB, the kernel is 1.6MB, and the whole root filesystem is 2.4MB. So, there's plenty of space for the virtual flash drive. It also includes a writable home directory, on the off chance that anyone creates something they want to keep. This is also saved on the flash chip, which is properly wear leveled with UBI. The whole thing costs under $3. It's cheap enough to give away. If you get one from me, I'm probably trying to impress you. In a detailed write-up, Hilliard goes on to explain how he came up with the design and assembled all the components. Naturally, there were some problems that arose during the construction that he had to troubleshoot: "first, the USB port wasn't long enough to reliably make contact in many USB ports. Less critically, the flash footprint was wrong, which I worked around by bending the leads under the part by hand..."

Impressively, the total cost of the card (not including his time) was $2.88 -- "cheap enough that I don't feel bad giving it away, as designed!"

As a way to help his 2020 presidential bid, presidential candidate Mike Bloomberg is pouring tens of millions of dollars into an unknown digital business called Hawkfish -- which Bloomberg himself founded during the spring. CNBC reports: Hawkfish will be the "primary digital agency and technology services provider for the campaign," Julie Wood, a Bloomberg campaign spokeswoman, told CNBC. She added that the firm "is now providing digital ad services, including content creation, ad placement and analytics" for their campaign. It will also help Democratic races across the country in future election cycles, she said. Bloomberg, a billionaire former three-term mayor of New York, started building the company early in 2019, before he decided to seek the Democratic presidential nomination, the campaign aide said. While the campaign declined to say how much Bloomberg has invested in the company, Bloomberg has said he will spend over $100 million on anti-Trump digital ads. His campaign has already spent at least $13 million on Facebook and Google spots.

Bloomberg, who was dedicated to denying President Donald Trump a second term before he entered the Democratic race, built Hawkfish with the intention of overpowering the formidable data operation assembled by the Republican National Committee and Trump's cash-flush campaign. Hawkfish appears to have been assembled in secret. It has no public website. A search of elections databases turned up no financial records connected to work for other Democratic causes. No other candidate in the 2020 race is known to have created a vendor designed to aide their bid. [...] Using research company Accurint, CNBC reporters went to a New York address that was associated with Hawkfish. At the address, 909 Third Avenue, an attendant at the front desk said no business named Hawkfish existed there. The Bloomberg campaign spokeswoman said the address, which is about a five-minute walk from Bloomberg's namesake company, was only used for receiving paperwork. The address is the same as Mike Bloomberg's longtime accountant, Geller & Company. Hawkfish's leadership ranks include longtime Facebook Chief Marketing Officer Gary Briggs, and Jeff Glueck, former CEO of location-tracking firm Foursquare.

Glueck hinted that other former Silicon Valley players were with the company, but didn't name names. "The Bloomberg campaign is posting Hawkfish jobs on its website, including graphic designer, copywriter, video editor and senior software engineer," adds CNBC.

Researchers from MIT have revealed the very first images of a human generated through a novel laser ultrasound imaging technique. Unlike conventional ultrasound, the new technique does not require any skin contact with the body, dramatically amplifying the range of uses for doctors in clinical environments. New Atlas reports: A new non-contact ultrasound method involving lasers has now been effectively demonstrated by a team of researchers from MIT. The challenge in developing the new method has been figuring out a way to use a laser to produce sound waves. Traditional ultrasound uses sound waves to penetrate a human body and bounce back off different tissues. Light, of course, cannot penetrate a human body as deeply as sound. The new method has found a laser, pulsing at a wavelength of 1,550 nanometers, can generate sound waves when it hits human skin. A second laser, tracking the same wavelength, can subsequently detect the reflected sound waves and generate a picture similar to that of a conventional ultrasound.

In the new study, the researchers demonstrate the successful development of this novel laser ultrasound technique, from initial tests on a gelatin mold resembling human skin, to excised animal tissue. The study ultimately demonstrates the method's efficacy in human volunteers, presenting the first non-contact laser ultrasound images of a human forearm. At this point the method does not deliver images at resolutions equal to conventional ultrasound techniques, however, the researchers suggest this is just the first developmental milestone to be crossed. The system can potentially be refined and improved to deliver finer tissue detail. The study has been published in the Nature journal Light: Science and Applications.

Last week, New York Governor Andrew Cuomo called for a state net neutrality law as part of his 2020 legislative agenda, joining states like California in proposing a law to ensure his state's internet users have access to a free and open internet. CNET reports: Cuomo's plan comes two years after the Federal Communications Commission repealed Obama-era net neutrality protections, which ensured that broadband companies couldn't block or slow down access to the internet or favor their own content or services over a competitor's. "A free and open internet is one of the great equalizers -- allowing every person the same access to information and helping protect freedom of speech," Cuomo said in a statement. He said his proposed legislation would ensure that "big corporations can't control what information we access or stymie smaller competitors."

After the federal rules were repealed in late 2017, Cuomo was among several governors who issued an executive order barring state agencies from signing contracts with internet service providers that don't practice net neutrality. The law Cuomo is proposing would go beyond the executive order and apply to any internet service provider offering services in the state. Specifically, it would require internet service providers to disclose how they manage internet traffic and certify that they comply with New York's net neutrality rules. If companies break the rules, they could be fined by the state and also sued by consumers. The proposed New York state law would also outlaw so-called "zero-rating" -- a practice that lets broadband companies exclude usage of certain apps and services from customers' monthly data allotments, while other apps and services are counted.

Security researcher Ibrahim Balic said he has matched 17 million phone numbers to Twitter user accounts by exploiting a flaw in Twitter's Android app. TechCrunch reports: Ibrahim Balic found that it was possible to upload entire lists of generated phone numbers through Twitter's contacts upload feature. "If you upload your phone number, it fetches user data in return," he told TechCrunch. He said Twitter's contact upload feature doesn't accept lists of phone numbers in sequential format -- likely as a way to prevent this kind of matching. Instead, he generated more than two billion phone numbers, one after the other, then randomized the numbers, and uploaded them to Twitter through the Android app. (Balic said the bug did not exist in the web-based upload feature.)

Over a two-month period, Balic said he matched records from users in Israel, Turkey, Iran, Greece, Armenia, France and Germany, he said, but stopped after Twitter blocked the effort on December 20. Balic provided TechCrunch with a sample of the phone numbers he matched. Using the site's password reset feature, we verified his findings by comparing a random selection of usernames with the phone numbers that were provided. While he did not alert Twitter to the vulnerability, he took many of the phone numbers of high-profile Twitter users -- including politicians and officials -- to a WhatsApp group in an effort to warn users directly. A Twitter spokesperson told TechCrunch the company was working to "ensure this bug cannot be exploited again."

"Upon learning of this bug, we suspended the accounts used to inappropriately access people's personal information. Protecting the privacy and safety of the people who use Twitter is our number one priority and we remain focused on rapidly stopping spam and abuse originating from use of Twitter's APIs," the spokesperson said.

An anonymous reader quotes a report from CNBC: Former Uber CEO Travis Kalanick will step down from the board, effective Dec. 31, and a spokesperson said Tuesday he has sold all of his stock in the ride-hailing company he co-founded 10 years ago. It's unclear how much Kalanick's total stake is worth, but the latest public filings show it's about $2.5 billion. In a statement Tuesday, Uber said Kalanick, 43, is leaving to "focus on his new business and philanthropic endeavors." Kalanick is launching latest venture, CloudKitchens, which rents out space to restaurateurs for delivery-based businesses. Uber did not say who will fill Kalanick's board seat. An Uber spokesperson said the ride-hailing company has "strong director candidates to put forward at the appropriate time." "Uber has been a part of my life for the past 10 years," Kalanick said in the release. "At the close of the decade, and with the company now public, it seems like the right moment for me to focus on my current business and philanthropic pursuits. I'm proud of all that Uber has achieved, and I will continue to cheer for its future from the sidelines. I want to thank the board, Dara and the entire Uber team for everything they have done to further the Uber mission."

dryriver writes: We've all seen the DeepFake videos on Youtube, where a different actor's face from the original is digitally inserted into a film scene. Some of these DeepFakes are actually quite convincing. DeepFakes are currently computationally intensive, but may one day happen in realtime on hardware custom made to accelerate the process. Now to the question: Will this "digital face swapping" be a realtime feature in future TVs some day? Will people be able to say to their TV "I don't like this actor/actress. Replace him/her with _actorname_ please"? Or watch a 100 Million Dollar movie with their own face on an actor's body, essentially making the TV owner the star of the movie playing? Will this perhaps become so normal some day that people in the future look back at our era and say "In those days, you couldn't choose which actors to watch any given piece of content with. Technology wasn't as advanced as it is today back then."?

In November 2019, Tim Berners-Lee and the Web Foundation launched the Contract for the Web, a set of rules designed to address the challenges facing digital communication and participation -- from threats to online privacy and security to connectivity and digital inclusion. The multi-stakeholder effort outlines nine principles for governments, companies and citizens designed to safeguard the future of the Web. The Wikimedia Foundation has not yet signed on to the Contract and it has offered an explanation. From a blog post: The Wikimedia Foundation participated in the Core Group and the Working Group on Principle 6, "Developing technologies that support the best in humanity and challenge the worst," which aims to support positive technology that puts people first. The Contract aligns with our goal to foster a web where everyone can find and access knowledge freely. We deeply support the principles of the Contract for the Web. At Wikimedia, we are committed to fostering a digital information sphere that is accessible for everyone, that offers strong privacy protections, that supports free expression and open collaboration, and safeguards the web from bad actors that seek to monopolize and use it for harm. All of these principles align closely with the commitments underlined in the Contract for the Web.

We chose not to sign the Contract at this time because we still have open questions about how the Contract will be implemented to maximize its impact. In particular, we are exploring how each signatory will be held accountable to these commitments. We are especially interested in seeing concrete steps towards enforcement mechanisms that ensure big technology companies that endorse the Contract will change their attitudes and current practices that violate the principles in the Contract. The world's biggest challenges, from the global climate crisis to disinformation online, can only be solved if we work together and ensure that everyone is doing their part. Active reporting, transparency, and clear indicators for progress are critical to ensuring the implementation of the Contract for the Web. However, it will take clear, direct, and enforceable systems to ensure we're all contributing to a better internet for everyone.

An anonymous reader quotes a report from Gizmodo: A 22-year-old boss backed by a gangster cabal of "internet buddies" has been thwarted and convicted in their attempt to blackmail Apple, the UK's National Crime Agency reports. In 2017, London-based Kerem Albayrak made Apple an offer they couldn't refuse: deliver $100,000 in iTunes gift cards or $75,000 in cryptocurrency or kiss 319 million iCloud accounts goodbye. On Friday, a court sentenced him to a two year suspended jail term.

On March 12th, 2017, Albayrak, don of hacker syndicate the "Turkish Crime Family," sent Apple Security and several media outlets a YouTube video showing him apparently logging in to two victims' iCloud accounts. The NCA reports that Albayrak had threatened to factory reset the accounts and sell the database vis-a-vis his "internet buddies," boasting to outlets that he'd had access to 300 million accounts (a figure which was later increased to 559 million). They gave Apple until April 7th to fill their demands, Apple Insider has reported. One week and zero gift cards later, they upped their demands and reportedly sent ZDNet a set of 54 sample accounts. ZDNet confirmed their authenticity, though the plot thickened: at least one account had been compromised years prior. Apple and UK authorities ultimately found that the Turkish Crime Family had not, in fact, successfully compromised the network, and concluded that the data came from an unrelated breach of largely defunct third-party services. Albayrak pleaded guilty to one count of blackmail and two counts of unauthorized acts with intent to impair the operation of or prevent/hinder access to a computer. He was handed a two year suspended jail term, 300 hours of unpaid labor, and six months of "electronic curfew" (an ankle bracelet).

Uber is joining forces with California-based aerospace company Joby Aviation to launch urban air-taxi services in select locations by 2023. The Verge reports: Joby is the brainchild of inventor JoeBen Bevirt, who started the company in 2009. The company operated in relative obscurity until 2018, when Joby announced it had raised a surprising $100 million from a variety of investors, including the venture capital arms of Intel, Toyota, and JetBlue. The money helped finance development of the company's air taxi prototype, which has been conducting test flights at Joby's private airfield in Northern California.

Unlike the dozens of other companies that are currently building electric vertical take-off and landing (eVTOL) aircraft, Joby has kept much of its project under wraps. The few renderings that are out there show a plane-drone hybrid with 12 rotors and room in the cabin for four passengers, though a spokesperson previously cautioned that what Joby is working on now is "entirely new." The company has yet to provide any recent photographs or images of its prototype aircraft. [...] Uber says that it has signed a multiyear commercial contract with Joby to "launch a fast, reliable, clean and affordable urban air taxi service in select markets." Neither company disclosed the terms of the deal, nor would they comment on whether there was any money exchanged. The report notes that Joby "will supply and operate the electric air taxies, and Uber will provide air traffic control help, landing pad construction, connections to ground transportation, and, of course, its ride-share network reconfigured to allow customers to hail flying cars rather than regular, terrestrial ones."

Researchers at the Swiss Federal Institute of Lausanne (EPFL) have come up with a new concept for capturing CO2 from truck exhausts which could reduce emissions by up to 90 percent. Engadget reports: In a paper published in the journal Frontiers in Energy Research, the researchers propose capturing carbon dioxide from a truck's exhaust pipe and turning it liquid, which is stored in a tank on the vehicle's roof. This liquid carbon dioxide can then be delivered to a service station where it can be reused in various ways, including being turned into conventional fuel.

The carbon dioxide capture works by first cooling the gases which are emitted from the exhaust pipe. Special absorbent materials developed at EPFL could separate the carbon dioxide from other gases like nitrogen and oxygen. When it is full, the absorbent material is then heated to extract the carbon dioxide, and heat from the vehicle's engine is used to compress the carbon dioxide and turn it into liquid. That liquid can then be stored in a box attached to the vehicle's roof until it can be deposited at a service station when the truck refuels. The system is more appropriate for large vehicles like trucks or buses than for cars as it is rather bulky, requiring a 2-meter-long capsule and weighing 7 percent of the total payload of a truck. However, the researchers calculate that 90 percent of carbon dioxide emissions could be recycled in this way.

schwit1 writes: [ProPublica] outlines in detail the causes behind the crash in 2017 of the USS McCain and an oil-tanker that killed ten sailors and injured many others. It is a horror story of a bankrupt Navy upper management that seemed more in love with cool computer software and automation than making sure the Navy's ships and its crews can function efficiently and effectively in any situation. Moreover, the story suggests that this same upper management made lower level officers the scapegoats for its bad decisions, while skating free with no consequences. And worst of all, that same overly complex computer navigation system remains in place, with only superficial patches imposed in both its software and its user instructions.

This story however is hardly unique. It reflects the general and systemic failures of almost any project coming out of the upper managements of the entire federal government for the past three decades, a pattern of failure that partly explains why Donald Trump was elected, and why he is hated so thoroughly by so many in that federal workforce. He more than anyone in decades has been demanding from them quality work, and firing them when they fail to provide it.

A New York judge ruled on Monday that a state law designed to control how much time ride-hailing drivers can spend looking for passengers was "arbitrary and capricious." Engadget reports: Had the law gone into effect, it would have limited the amount of time Uber and Lyft drivers could spend searching for passengers in Manhattan south of 96th Street to 31 percent of their overall drive time, down from 41 percent. When it passed the rule this summer, the city's Taxi and Limousine Commission said it was an attempt to reduce traffic congestion in New York's busiest borough where cars driven by Uber and Lyft contractors, along with yellow cabs, can make up as much of 50 percent of traffic.

When Uber challenged the law in September, it said it would threaten the livelihood and flexibility of drivers. In advance of the law going into effect in February 2020, both Uber and Lyft had limited access to their apps, locking local drivers out at certain times and areas of the city. In his ruling, New York State Supreme Court judge Lyle Frank criticized the city for its 31 percent target, saying it provided "scant rationale" for it.

Twitter is banning animated PNG image files (APNGs) from its platform, after an attack on the Epilepsy Foundation's Twitter account sent out similar animated images that could potentially cause seizures in photosensitive people. The Verge reports: Twitter discovered a bug that allowed users to bypass its autoplay settings, and allow several animated images in a single tweet using the APNG file format. "We want everyone to have a safe experience on Twitter," the company says in a tweet from the Twitter Accessibility handle. "APNGs were fun, but they don't respect autoplay settings, so we're removing the ability to add them to Tweets. This is for the safety of people with sensitivity to motion and flashing imagery, including those with epilepsy."

Tweets with existing APNG images won't be deleted from the platform, but only GIFs will be able to animate images moving forward. According to Yahoo, Twitter has further clarified that APNG files were not used to target the Epilepsy Foundation, but the bug meant such files could have been used to do so in the future had Twitter not moved to squash it. The attacks on the Epilepsy Foundation's Twitter handle occurred last month -- National Epilepsy Awareness Month -- with trolls using its hashtags and Twitter handle to post animated images with strobing light effects. It's not clear how many people may have been affected by the attack, but the foundation said it's cooperating with law enforcement officials and has filed criminal complaints against accounts believed to have been involved.

An anonymous reader quotes a report from Ars Technica: Federal regulators that want to let T-Mobile complete its acquisition of rival wireless carrier Sprint are pushing back on a collective effort by some states to block the deal. The $26 billion transaction was subject to federal approval by both the Department of Justice and the Federal Communications Commission. The agencies both blessed the deal, with the DOJ reaching a settlement in July and the FCC granting a green light in October. The deal also requires approval by regulators in several states, however. While about a dozen have in some way approved the deal or signaled support for the federal settlements, attorneys general representing 13 states and the District of Columbia filed suit to block the merger.

The FCC and DOJ on Friday submitted a filing [400-page PDF] in that case arguing that the deal is in the best interest of the U.S., and any nationwide injunction holding up the merger would block "substantial, long-term, and procompetitive benefits for American consumers." The argument, in large part, boils down to: trust us, we're the experts. "Both the Antitrust Division and the FCC have significant experience and expertise in analyzing these types of transactions and do so from a nationwide perspective," the agencies write. "Thus, their conclusions that the merger as remedied is in the public interest deserve appropriate weight in this remedy inquiry by this honorable court."

An anonymous reader quotes a report from ZDNet: California has said it will now allow companies to test light-duty autonomous delivery vehicles on the state's public roads. The State of California's Department of Motor Vehicles (DMV) announced the new regulations last week, which allows companies with a permit to operate autonomous delivery vehicles that weigh up to 10,001 pounds (4.54 tons).

"This weight category includes "autonomous passenger cars, mid-sized pickup trucks and cargo vans carrying goods such as pizza or groceries", the DMV said. The new rules still excludes testing autonomous vehicles that weigh more than 10,001 pounds. "The adoption of these regulations means Californians soon could receive deliveries from an autonomous vehicle provided the company fulfills the requirements," DMV Director Steve Gordon said. "As always, public safety is our primary focus." Companies will need to ensure their driverless delivery trucks are equipped with a "communication link between the vehicle and a remote operator and the ability to display or transfer vehicle owner or operator information in the event of a collision."

Also, these vehicles must be certified to industry standards for helping defend against and response to "cyberattacks, unauthorized intrusions or false vehicle control commands."

A former Jet2 IT contractor with a grudge has been jailed for a cyber-attack on the company. From a report: Scott Burns, 27, of Queen Street in Morley, Leeds, was jailed for 10 months for his actions, which cost the company $214,000. The attack shut down Jet2's computer network for 12 hours in January 2018. Burns wanted revenge for the firm's treatment of him following an incident at a 2017 "Benidorm roadshow," Leeds Crown Court heard. Details about happened at the event in Benidorm were not outlined in court. The court heard only fast-thinking by one employee at the Leeds-based airline stopped Burns' actions being a "complete disaster" for Jet2. Burns pleaded guilty to eight counts under the Computer Misuse Act at a previous hearing. Judge Andrew Stubbs QC told Burns: "You intended to cause as much damage to Jet2's computer system as you could. "This went far beyond being mischievous. This was a revenge attack for a perceived slight you had suffered."