Security researchers at IBM have found evidence that hackers have been working on creating malicious scripts they can deploy on commercial-grade "Layer 7" routers to steal payment card details. From a report: This discovery is a game-changer in what researchers call Magecart attacks, also known as web skimming. These are attacks where hackers plant malicious code on an online store that records and steals payment card details. Until now, Magecart-specific code was only delivered at the website level, hidden inside JavaScript or PHP files. However, this new discovery is an escalation of Magecart attacks to a new level, where the malicious code is injected at the router level, rather than being added by hackers on outdated websites.

Layer 7, or L7, routers are a type of commercial, heavy-duty router that's usually installed on large networks, such as hotels, malls, airports, casinos, government networks, public spaces, and others. They work like any other router, except with the added benefit of being able to manipulate traffic at the seventh layer (application level) of the OSI networking model -- meaning they can react to traffic based on more than just IP addresses, such as cookies, domain names, browser types, and more. In a report published today, researchers with the IBM X-Force Incident Response and Intelligence Services (IRIS) team said they found evidence that a well-known hacker group has been testing Magecart scripts to deploy on L7 routers.

A new movement of teenage climate activists -- most of whom are girls -- are getting dragged, doxed, hacked, and harassed online. Zahra Hirji, reporting for BuzzFeed News: On the morning of August 25, 11-year-old Lilly Platt tweeted a video clip of a Brazilian Amazon tribe speaking out against deforestation. Awareness of the Amazon wildfires was already at a fever pitch, and the tweet exploded. Then, within an hour, a swarm of troll accounts started flooding her mentions with porn. Shortly after the attack, her mom, Eleanor Platt, made an online plea for help: "Dear Friends of Lilly, this is Lillys mum she is being targeted by revolting trolls who are spamming her feed with pornography. There is only so much i can do to block this. Please if you see these posts report them." Over the course of the day, some of Lilly's nearly 10,000 followers did just that.

Young girls like Lilly, who has been striking in her hometown of Utrecht, Netherlands, every Friday for the last year, are overwhelmingly leading a growing global movement to draw attention to the climate crisis. They spurred an estimated 4 million people across seven continents to walk out of work and school on September 20 -- and they are getting attacked for it. They have faced a barrage of daily insults, seemingly coordinated attacks (like the one that targeted Lilly), creepy DMs, doxing, hacked accounts, and death threats. This is the new normal for young climate leaders online, according to BuzzFeed News interviews with nearly a dozen of the kids and their parents.

Personal attacks have always been a part of the climate denial playbook, even as fossil fuel companies secretly funded campaigns and researchers to question the scientific consensus on climate change. The most famous incident, 2009's Climategate, involved scientists getting their emails hacked and then facing death threats. And as the politics of climate change begins to mirror the broader dark trends of global politics, weaponized social media -- in the form of intimidation, memes, and disinformation -- has emerged as the dominant vehicle for climate denial. But the rise of a new climate movement means there's now a much more visible -- and especially vulnerable -- target: kids.

tearmeapart writes (edited to add more details): Cloudflare is opening up its security and speed-focused mobile VPN service called WARP and WARP Plus to the general public. WARP is a mobile app for Android and Apple to establish a VPN to CloudFlare's huge global network. Cloudflare is promising:
1. No user-identifiable log data to disk;
2. No selling browsing data;
3. No need to provide any personal information
4. Regularly get audited. This is the second time Cloudflare is launching Warp. The VPN builds on Cloudflare's existing mobile app 1.1.1.1, which encrypts domain name system connections. But Warp goes beyond this protection to encrypt the whole journey from your device to a web server and back -- even if the website itself still isn't offering HTTPS web encryption. And all of this happens quickly, without draining your battery, and without complicated setup. In an interview with Wired, Cloudflare CEO Matthew Prince said: Yeah, what we thought was going to be easy back in April turned out to be a lot harder than we expected. We had been testing this primarily in San Francisco and Austin and London, which is where the teams that were working on this are based. But as soon as users started to get anywhere that didn't have a fairly reliable internet connection, just all hell broke loose. The report adds: In describing the hurdles Cloudflare faced getting Warp off the ground, John Graham-Cumming, the company's chief technology officer, and Dane Knecht, its head of product strategy, note that many of the challenges came from dealing with interoperability issues between mobile device models, operating system versions, and different mobile network and Wi-Fi configurations around the world. For example, Warp is built on a newer secure communication protocol for VPNs known as WireGuard, which isn't ubiquitous yet and therefore isn't always natively supported by devices. The team also faced challenges dealing with web protocols and standards that are implemented inconsistently across different wireless carriers and internet service providers around the world. Cloudflare's 1.1.1.1 focuses on encrypting DNS connections specifically, but Warp aims to encompass everything in one protected tunnel. Keeping everything together as data traverses the labyrinth of servers that make up the internet, including Cloudflare's own massive network, was tough. Warp is free to use without any bandwidth caps or limitations. But Warp Plus, which is being offered through a monthly subscription fee, offers a "faster version of Warp that you can optionally pay for. The fee for Warp Plus varies by region and is designed to approximate what a McDonald's Big Mac would cost in the region. On iOS, the Warp Plus pricing as of the publication of this post is still being adjusted on a regional basis, but that should settle out in the next couple days. Warp Plus uses Cloudflare's virtual private backbone, known as Argo, to achieve higher speeds and ensure your connection is encrypted across the long haul of the Internet. We charge for it because it costs us more to provide," the company said in the blog post.

An anonymous reader writes: Drone attacks, including the recent swarm strike in Saudi Arabia, are increasing, and so is the Pentagon's interest in killing them. This week, the Pentagon notified Congress of its purchase of a microwave weapon system designed to knock down swarms of enemy drones with pulses of energy. The purchase comes with an intent to deploy the PHASER system overseas for a year-long assessment, making it the first directed energy defense weapon to ever be fielded. The U.S. Air Force spent $16.28 million for one prototype PHASER high power microwave system for a "field assessment for purposes of experimentation" in an unspecified location outside the U.S. The test is "expected to be completed by Dec. 20, 2020," making the overseas deployment "against real-world or simulated hostile vignettes" imminent.

There are several directed energy weapons that the Air Force is buying to test their effectiveness in the field, and officials say some will be on the frontlines in tense areas of the globe where enemy drones are becoming a threat, includes North Korea, Africa, the Ukraine and -- most recently -- the Middle East. "At the moment we have awarded multiple DE systems for use in our field assessment overseas and are working to support multiple bases and areas of responsibility," says Michael Jirjis, who is lead on the PHASER experiment, told Popular Mechanics. "We can't say which specific locations at this time."

Android Go has made smartphones more accessible by focusing on lower-cost devices, but it's frequently pokey and sometimes insecure -- not a great introduction to modern mobile tech. Google is aware of this, though, and it's tackling those issues head-on with its newly unveiled Android 10 Go edition. From a report: The scaled-back version of Android 10 puts a strong focus on speed, with faster and more memory-efficient app switching as well as launching that's 10 percent faster than in Android 9 Go. It should be more reliable, too. For some, data protection may be the real star of the show. Android 10 Go edition includes a new Adiantum encryption system that should secure data without affecting performance or requiring special hardware. You won't have to worry that your sensitive info is vulnerable simply because you bought an entry-level device.

An anonymous reader shares a report: Don't you absolutely hate how dense and confusing privacy policies are? Considering they're full of gotchas and intentionally obscure legalese, it's no surprise that hardly anyone bothers to even read them -- we've simply accepted we're giving up our data, and with it, our sense of privacy. But thanks to this new policy-reading AI, things won't have to be this way for much longer. Guard is a recurrent neural network-based app that reads and analyzes privacy terms, so you don't have to. While it can't yet examine policies on request, the AI has rated the privacy terms of a slew of popular services like Netflix, Instagram, Twitter, and Tinder.

What's particularly nifty about Guard is that it not only gives an overall score, but also breaks down the main threats included in privacy policies. It also lists the total number of threats, and looks at past privacy scandals a service has been involved in. Like I already said, Guard has only analyzed the privacy policies of a small batch of popular services, but you can easily suggest new apps for consideration. The app was built by developer Javi Rameerez, who created the software as part of his thesis on AI and natural language processing.

Google has announced it has released a data set containing 3,000 deepfake videos it has created. From a report: Google hopes the release of the videos will allow researchers to develop ways to combat malicious deepfakes, giving them, news organizations, and the public ways to identify "synthetic" videos -- that is videos manipulated by or entirely created using computers. Deepfakes at first came onto the scene in 2017 and were mainly used in crude, falsified porn videos. The technology originally allowed for people with limited computer skills to easily paste the face of, for example, an actress onto a porn star's body. But since then the quality of deepfake videos has rapidly advanced. Matter of fact, it's now possible to deepfake entire bodies, not just an individual's head. While deepfake technology has legitimate commercial purposes, many fear it will also lead to a new era of fake news and propaganda where no one will be able to tell if the video they are seeing actually, in fact, ever happened.

According to leaked documents revealed by the Guardian, TikTok instructs its moderators to censor videos that mention Tiananmen Square, Tibetan independence, or the banned religious group Falun Gong. "The documents [...] lay out how ByteDance, the Beijing-headquartered technology company that owns TikTok, is advancing Chinese foreign policy aims abroad through the app," writes Alex Hern for the Guardian. From the report: The guidelines divide banned material into two categories: some content is marked as a "violation," which sees it deleted from the site entirely, and can lead to a user being banned from the service. But lesser infringements are marked as "visible to self," which leaves the content up but limits its distribution through TikTok's algorithmically-curated feed. This latter enforcement technique means that it can be unclear to users whether they have posted infringing content, or if their post simply has not been deemed compelling enough to be shared widely by the notoriously unpredictable algorithm.

The bulk of the guidelines covering China are contained in a section governing "hate speech and religion." In every case, they are placed in a context designed to make the rules seem general purpose, rather than specific exceptions. A ban on criticism of China's socialist system, for instance, comes under a general ban of "criticism/attack towards policies, social rules of any country, such as constitutional monarchy, monarchy, parliamentary system, separation of powers, socialism system, etc." Another ban covers "demonization or distortion of local or other countries' history such as May 1998 riots of Indonesia, Cambodian genocide, Tiananmen Square incidents."

A more general purpose rule bans "highly controversial topics, such as separatism, religion sects conflicts, conflicts between ethnic groups, for instance exaggerating the Islamic sects conflicts, inciting the independence of Northern Ireland, Republic of Chechnya, Tibet and Taiwan and exaggerating the ethnic conflict between black and white." All the above violations result in posts being marked "visible to self." But posts promoting Falun Gong are marked as a "violation," since the organization is categorized as a "group promoting suicide," alongside the Aum cult that used sarin to launch terrorist attacks on the Tokyo Metro in 1995 and "Momo group," a hoax conspiracy that went viral earlier this year. ByteDance said in a statement that the version of the documents that the Guardian obtained was retired in May, and that the current guidelines do not reference specific countries or issues.

dryriver shares a report from Reuters: Nuclear power is losing ground to renewables in terms of both cost and capacity as its reactors are increasingly seen as less economical and slower to reverse carbon emissions, an industry report said. In mid-2019, new wind and solar generators competed efficiently against even existing nuclear power plants in cost terms, and grew generating capacity faster than any other power type, the annual World Nuclear Industry Status Report (WNISR) showed. "Stabilizing the climate is urgent, nuclear power is slow," said Mycle Schneider, lead author of the report. "It meets no technical or operational need that low-carbon competitors cannot meet better, cheaper and faster."

The report estimates that since 2009 the average construction time for reactors worldwide was just under 10 years, well above the estimate given by industry body the World Nuclear Association (WNA) of between 5 and 8.5 years. The extra time that nuclear plants take to build has major implications for climate goals, as existing fossil-fueled plants continue to emit CO2 while awaiting substitution. "To protect the climate, we must abate the most carbon at the least cost and in the least time," Schneider said. The WNA said in an emailed statement that studies have shown that nuclear energy has a proven track record in providing new generation faster than other low-carbon options, and added that in many countries nuclear generation provides on average more low-carbon power per year than solar or wind. It said that reactor construction times can be as short as four years when several reactors are built in sequence. According to the report, the cost of generating solar power ranges from $36 to $44 per MWh, while onshore wind power comes in at $29-$56 per MWh. Nuclear energy costs between $112 and $189.

"Over the past decade, the WNISR estimates levelized costs -- which compare the total lifetime cost of building and running a plant to lifetime output -- for utility-scale solar have dropped by 88% and for wind by 69%," reports Reuters. "For nuclear, they have increased by 23%, it said."

An anonymous reader quotes a report from The Wall Street Journal: Many parents of both boys and girls have witnessed striking differences in the way their kids use technology, with their sons generally gravitating to video games and their daughters often spending more of their screen time scrolling through social media. Emerging research indicates that brain differences between males and females help account for the split. According to a 2017 survey conducted by Pew Research Center, 41% of teenage boys said they spend too much time playing video games while only 11% of girls said they do. Marc Potenza, a psychiatry professor at Yale University, teamed up with researchers at universities in China to find out why. Using functional MRIs, which measure brain activity by detecting changes in blood flow, the team studied neural responses in young male and female gamers, particularly in the parts of the brain associated with reward processing and craving -- a motivating factor in addiction. When the men and women were shown photos of people playing video games, those parts of the men's brains showed higher levels of activation than those parts of the women's brains. Brain regions that have been implicated in drug-addiction studies also were shown to be more highly activated in the men after gaming. The researchers said the results suggest men could be more biologically prone than women to developing internet gaming disorder.

But girls and women aren't free from problems when it comes to digital media. Data from Pew shows that, in general, women use social platforms such as Facebook, Instagram and Pinterest far more than men. Many girls and women are drawn to those photo-sharing sites because they like to form bonds and find similarities, says Rosanna Guadagno, a social psychologist at Stanford University. Even if women only use those sites more than men because that is where their friends are, many experts and parents say they have found that girls appear to have a greater fear of missing out, which compels them to keep up with what their friends are posting. Some recent studies show that girls feel the ill effects of too much social media use, such as depression and anxiety, more than boys do.

Microsoft's Yusuf Mehdi tweeted today that Microsoft is now being used on over 900 million devices, and that the Redmond company added more new Windows 10 devices in the last 12 months than ever before. Engadget reports: That's a massive number, and as Thurrott points out, if Microsoft maintains this pace, Windows 10 could reach 1 billion devices by early 2020. That's especially impressive considering that it just announced 800 million devices in March.

The latest phone in the Xiaomi Mi Mix series is the Mi Mix Alpha, a $2,800 smartphone with a "surround screen" that wraps entirely around the device to the point where it meets the camera module on the other side. "The effect is of a phone that's almost completely made of screen, with status icons like network signal and battery charge level displayed on the side," reports The Verge reports. "Pressure-sensitive volume buttons are also shown on the side of the phone. Xiaomi is claiming more than 180 percent screen-to-body ratio, a stat that no longer makes any sense to cite at all." From the report: The Mix Alpha uses Samsung's new 108-megapixel camera sensor, which was co-developed with Xiaomi. As with other recent high-resolution Samsung sensors, pixels are combined into 2x2 squares for better light sensitivity in low light, which in this case will produce 27-megapixel images. There's also no need for a selfie camera -- you just turn the phone around and use the rear portion of the display as a viewfinder for the 108-megapixel shooter.

As for the phone's more traditional specs, there's a Qualcomm Snapdragon 855+ processor, 5G connectivity, 12GB of RAM, 512GB of storage, 40W wired fast-charging, and a 4,050mAh battery. That last spec would perhaps suggest that Xiaomi doesn't imagine you having the whole screen turned on all the time. Xiaomi describes the Mix Alpha as a "concept smartphone" and isn't going to be mass-producing it any time soon. The phone will go into small-scale production this year and go on sale in December for 19,999 yuan, or about $2,800. The original Mi Mix was also given the "concept" label and released in small quantities, with the Mi Mix 2 following a year later as a more mainstream device.

A possible computer virus attack has knocked out Mac Pro workstations for many film and TV editors across Los Angeles. According to Variety, the issue -- which is causing the workstations to refuse to reboot -- is widespread among users of Mac Pro computers running older versions of Apple's operating system as well as Avid's Media Composer software. From the report: Avid said in a statement that it was aware of the issue: "Avid is aware of the reboot issue affecting Apple Mac Pro devices running some Avid products, which arose late yesterday. This issue is top priority for our engineering and support teams, who have been working diligently to determine and resolve the root cause. As we learn more, we will immediately publish information -- directly to our customers and via our community forums and social media platforms -- in order to resolve this issue for all affected customers and prevent any further issues."

"A lot of L.A. post shops and people out on shows having their Macs slowly crash," reported video post-production consultant Matt Penn on Twitter. Freelance film editor Marcus Pun reposted a message from a popular Avid Facebook user group, advising users not to turn off their workstations. Other users reported that multiple computers at their company were affected by the issue, with social media chatter indicating that a number of different companies, and even major shows like "Modern Family," were affected by the issue. UPDATE: The issue appears to be caused by a Google Chrome update gone haywire.

dryriver shares a report from Reuters: German prosecutors have accused Volkswagen's CEO of holding back market-moving information on rigged emissions tests four years ago, raising the prospect of fresh upheaval at the carmaker just as it tries to reinvent itself as a champion of clean driving. Prosecutors in the city of Braunschweig said on Tuesday they would press criminal charges of stock market manipulation against Volkswagen CEO Herbert Diess, as well as non-executive Chairman Hans Dieter Poetsch and former CEO Martin Winterkorn. The charges show how the German company, which in September 2015 admitted using illegal software to cheat U.S. diesel engine tests, is struggling to move on from a scandal which has cost it more than $30 billion in vehicle refits, fines and provisions. In a statement issued after an emergency meeting, the (VW supervisory) board's executive committee said it "cannot see that there was any deliberate attempt not to inform the capital market." The former U.S. regulator who helped bring Volkswagen's cheating to light dismissed the company's arguments. "The excuse that top managers knew nothing is very weak," Alberto Ayala, who served at the California Air Resources Board (CARB) until 2017, told German news magazine Spiegel. Separately on Tuesday, German prosecutors hit rival carmaker Daimler with an 870 million euro fine for breaking diesel emissions rules. The Stuttgart-based maker of Mercedes-Benz cars said it would not appeal.

An anonymous reader quotes a report from Motherboard: Eighty Google contract workers in Pittsburgh employed by HCL America voted Tuesday to unionize with the United Steel Workers (USW). They will organize under the name Pittsburgh Association of Tech Professionals (PATP). The vote to unionize passed, with 49 voting in favor of unionization and 24 voting against unionization. Damon Di Cicco, organizer with the United Steelworkers, said that PATP was formed with support from the Department for Professional Employees (DPE), a semi-autonomous branch of the AFL-CIO, representing more than four million professional, technical, and other highly skilled workers. The vote to unionize is historic for white collar tech workers, and could spur others in the industry to take similar action.

The idea, said Di Cicco, was to create an umbrella organization to facilitate organizing in the tech sector, and eventually to help tech locals coordinate and cooperate amongst themselves. Di Cicco said the formation of PATP happened separately, but simultaneously, with the push to unionize by HCL workers. Now, the group has its first victory. The vote comes despite attempts by HCL to prevent its employees from unionizing. Emails shared with Motherboard show that Jeremy Carlson, HCL America's deputy general manager of operations sent at least a half-dozen emails to contractors in the two week period before the vote. Many of them urged employees not to unionize.

Adam Neumann, the charismatic entrepreneur who led WeWork to become one of the world's most valuable startups, is stepping down as chief executive officer, after a plan to take the company public hit a wall. From a report: Members of WeWork's board have been pressuring Neumann in recent days to step aside, taking a new role as non-executive chairman. The move is designed to salvage an initial public offering, which had been met with immediate scorn from public investors. A litany of apparent conflicts of interest and Neumann's propensity to burn through capital were chief concerns. Two senior WeWork executives, Sebastian Gunningham and Artie Minson, will become co-CEOs. WeWork's parent company, We Co., intends to push ahead with the IPO, but some people briefed on the deliberations said it's unlikely to take place next month as planned. The new CEOs said in a statement that they will be "evaluating the optimal timing for an IPO."

Microsoft is staffing up a new 'Data Dignity' team in the Office of the Chief Technology Officer. The team is researching ways to give users more control of their personal data, possibly even one day enabling them to buy and sell it to third-party entities. From a report: Microsoft has run afoul of privacy mavens, especially as a result of its collection of data in the name of telemetry with Windows 10, and more recently, for using human contractors to transcribe Skype conversations. An initiative like Data Dignity could further the company's quest to make itself look like a champion of users' privacy (at least in theory). I knew Microsoft had been investigating ways to give users more control of their own data after I unearthed some information about the company's "Project Bali" earlier this year.

Bali, a Microsoft Research incubation project that seemingly was in private testing as of January, is a "new personal data bank which puts users in control of all data collected about them." The idea is to give usrs a way to store, visualize, manage, control, share and monetize the data, according to the "About" page for the project, which Microsoft has since hidden. This week, The New York Times ran an interactive feature about Jaron Lanier that is focused on data privacy. Lanier is a virtual-reality pioneer and a chief scientist at Microsoft.

Google has won a long-standing battle with the European Union (EU), after the European Court of Justice (ECJ) ruled the company can limit the scope of the "right-to-be-forgotten" (RTBF) regulation to searches made within the EU. From a report: Today's announcement was largely expected, given that an adviser to the EU's top court backed Google's case in January. (ECJ judges typically follow the advice given by the advocate general.) But now it's official, meaning Google and others will only have to delist search results from search engines inside the EU's perimeters. "The Court concludes that, currently, there is no obligation under EU law for a search engine operator who grants a request for de-referencing made by a data subject, as the case may be, following an injunction from a supervisory or judicial authority of a Member State, to carry out such a de-referencing on all the versions of its search engine,â the ECJ said in a press release.

Facebook is buying CTRL-labs, a NY-based startup building an armband that translates movement and the wearer's neural impulses into digital input signals. TechCrunch reports: Bloomberg pegs the deal between $500 million and $1 billion. A source close to the matter tells TechCrunch the same. The acquisition, which has not yet closed, will bring the startup into the company's Facebook Reality Labs division. CTRL-labs' CEO and co-founder Thomas Reardon, a veteran technologist whose accolades include founding the team at Microsoft that built Internet Explorer, will be joining Facebook, while CTRL-labs' employees will have the option to do the same, we are told.

Facebook has talked a lot about working on a non-invasive brain input device that can make things like text entry possible just by thinking. So far, most of the company's progress on that project appears to be taking the form of university research that they've funded. With this acquisition, the company appears to be working more closely with technology that could one day be productized. CTRL-labs' technology isn't focused on text-entry as much as it is muscle movement, and hand movements specifically. The startup's progress was most recently distilled in a developer kit that paired multiple types of sensors together to accurately determine the wearer's hand position. The wrist-worn device offered developers an alternative to camera-based or glove-based hand-tracking solutions. The company has previously talked about AR and VR input as a clear use case for the kit.

Hackers widely believed to work for North Korea's hermit government have developed a new strain of malware that steals data used at automatic teller machines in India, researchers from Kaspersky Lab said on Monday. Ars Technica reports: One piece of malware, dubbed ATMDtrack by researchers with the Moscow-based security firm, has been targeting Indian ATMs since last Summer. It allows its operators to read and store data associated with cards that are inserted into infected ATMs. As researchers with the Moscow-based security firm investigated further, they found that the ATM malware was part of a larger remote-access trojan that carries out traditional espionage activities. Dubbed "Dtrack," it was used as recently as this month to target financial institutions and research centers.

Dtrack payloads were carefully encrypted with utilities known as packers, which made it hard for researchers to forensically analyze the malware. As the researchers analyzed the memory of infected devices, they found that that both ATMDtrack and Dtrack shared unique code sequences. When company researchers peeled away the layers of encryption and began analyzing the final payload, they saw pieces of code that were first used in a 2013 attack that wiped the hard drives of South Korean banks and broadcasters. The campaign, known as DarkSeoul, was eventually tied to Lazarus Group, the main hacking arm of the North Korean government.