Google

Google Doesn't Want Staff Debating Politics at Work Anymore (bloomberg.com) 301

Google posted new internal rules that discourage employees from debating politics, a shift away from the internet giant's famously open culture. From a report: The new "community guidelines" tell employees not to have "disruptive" conversations and warn workers that they'll be held responsible for whatever they say at the office. The company is also building a tool to let employees flag problematic posts and creating a team of moderators to monitor conversations, a Google spokeswoman said. "While sharing information and ideas with colleagues helps build community, disrupting the workday to have a raging debate over politics or the latest news story does not," the new policy states. "Our primary responsibility is to do the work we've each been hired to do." Google has long encouraged employees to question each other and push back against managers when they think they're making the wrong decision. Google's founders point to the open culture as instrumental to the success they've had revolutionizing the tech landscape over the last two decades.
Businesses

Amazon Has Ceded Control of Its Site. The Result: Thousands of Banned, Unsafe or Mislabeled Products (wsj.com) 131

Just like tech companies that have struggled to tackle misinformation on their platforms, Amazon has proven unable or unwilling to effectively police third-party sellers on its site. The Wall Street Journal: Many of the millions of people who shop on Amazon.com see it as if it were an American big-box store, a retailer with goods deemed safe enough for customers. In practice, Amazon has increasingly evolved like a flea market. It exercises limited oversight over items listed by millions of third-party sellers, many of them anonymous, many in China, some offering scant information. A Wall Street Journal investigation found 4,152 items for sale on Amazon.com's site that have been declared unsafe by federal agencies, are deceptively labeled or are banned by federal regulators -- items that big-box retailers' policies would bar from their shelves. Among those items, at least 2,000 listings for toys and medications lacked warnings about health risks to children.

The Journal identified at least 157 items for sale that Amazon had said it banned, including sleeping mats the Food and Drug Administration warns can suffocate infants. The Journal commissioned tests of 10 children's products it bought on Amazon, many promoted as "Amazon's Choice." Four failed tests based on federal safety standards, according to the testing company, including one with lead levels that exceeded federal limits. Of the 4,152 products the Journal identified, 46% were listed as shipping from Amazon warehouses. After the Journal brought the listings to Amazon's attention, 57% of the 4,152 listings had their wording altered or were taken down. Amazon said that it reviewed and addressed the listings the Journal provided and that company policies require all products to comply with laws and regulations.

Facebook

Members of Facebook's 'Crypto Mafia' Reportedly Getting Cold Feet About Libra Currency (gizmodo.com) 31

At least three of the 28 entities that have signed on for Facebook's planned Libra currency are now getting nervous about the project, according to a new report from the Financial Times. And Facebook is just as worried about being the only company currently with its "neck out," as regulators push back against the plan to create a new digital currency from thin air. From a report: The companies, which some have dubbed the "crypto mafia," include heavy hitters from Silicon Valley and Wall Street, like Uber, Spotify, Visa, and Mastercard. They're all partners in the Libra Association, a new organization based in Switzerland that is coming under scrutiny from governments around the world. The Chair of the U.S. Federal Reserve, EU antitrust regulators, the French Finance Minister, the Senate Banking Committee, the House Committee on Financial Services, and the Secretary of the U.S Treasury have all expressed doubts about Libra, so it's easy to see why some companies might be getting cold feet. But these companies aren't just worried about Libra's future as a digital currency. Their main concern seems to be that government regulators may want to look deeper into each company's primary business after they're done tearing Libra to shreds.
Media

Streaming Video Will Soon Look Like the Bad Old Days of TV (nytimes.com) 140

An anonymous Slashdot reader shares an opinion piece from The New York Times, written by Matthew Ball, former head of strategic planning for Amazon Studios. Here's an excerpt: The next 12 months will see several video services come to market, including Disney+, AT&T/WarnerMedia's HBO Max, Comcast/NBCUniversal's unnamed service, Apple TV+ and Quibi from the Hollywood executive Jeffrey Katzenberg. This increased competition will offer audiences even more high-quality series, the sorts of films that can no longer be found in theaters, interactive storytelling they've never seen before, and further improvements in navigation and advertising. Yet in this new multiplatform world, viewers will find they have to pay for a fistful of streaming subscriptions to watch all of their favorite programs -- and in the process, they'll again end up paying for lots of shows and movies they'll never care to watch. AT&T's WarnerMedia, for example, is bundling its TV channels, like TBS, HBO and TruTV, and film studios, including Warner Bros., DC Films and New Line, into its HBO Max service. Disney+ will have Marvel, Pixar and Lucasfilm, but also National Geographic, "The Simpsons" and Disney's offerings for children. And to navigate these many subscriptions, most households will want companies like Amazon or Apple to further bundle these services together into a single app -- just as they do with Dish or Xfinity. All of this bundling will eventually mean the return of a high monthly bill. Behind this bill is the cost of making high-quality programming. Although much has been said about how Netflix and Amazon have disrupted the video business, no media company has figured out how to make premium movies or TV shows significantly more cheaply. In fact, competition has driven production budgets even higher. Ultimately, these costs are paid by viewers (especially if they choose to watch without ads).

But the rise of digital video is bringing back more than just bloated bundles and bills. Many companies are returning to TV's original business model: selling you anything and everything but the television show in front of you. For decades, all TV content was "free." Networks like ABC and CBS distributed their shows free of charge because they weren't really in the business of selling audiences 30 minutes of entertainment. Instead, they were selling advertisers eight or so minutes of the audience's attention. While most digital video services do charge their viewers, their real objective is to lock audiences into their ever-expanding ecosystem. Their TV network is the ad. Amazon, Apple and Roku, for example, use their networks to drive sales of their devices, software, services and other products. For YouTube and Facebook, original movies and shows are about increasing the number of ads they serve and the prices they charge for these ads.
"Even as the video industry reconstitutes with new players -- under old business models and familiar problems -- most people agree that TV has never been better," Ball writes in closing. "Consumers have more options, better shows and more diversity than ever before."

"But at the same time, weâ(TM)re entering a world in which our culture is programmed by vertically integrated trillion-dollar corporations," he adds. "This may help us escape high prices and ads in the short term, but eventually the bill will come due."
Medicine

Maglev Heart Could Keep Cardiac Patients Alive 49

Bivacor is working toward human trials of their artificial heart after the implant successfully kept a calf alive for 90-days, helping it stay healthy, energetic, and gain weight at a normal rate. It even jogged on a treadmill for 30-minute stretches. Artificial hearts have been discussed among cardiac surgeons and biomedical engineers for more than 50 years, but what makes Bivacor's artificial heart so unique is its use of a levitating disk, suspended in a magnetic field, that spins 2,000 times per minute to keep blood flowing. IEEE Spectrum reports: We had to overcome many technical challenges to make an artificial heart that's small, biocompatible, energy efficient, and durable. Consider that the human heart beats about 112,000 times a day, which adds up to 42 million times a year, and you'll understand the magnitude of the challenge. We've tested the Bivacor heart in 15 cows so far. While the need for animal testing is unfortunate, it's the only way to prove the device's safety and move forward to clinical trials in humans. These Corriente calves, which are relatively small, are the right size to serve as analogues for adult patients. We've also implanted the Bivacor heart in several sheep, which are more representative of patients with smaller bodies, including children. Our tests have shown that the heart holds up well: With its one moving part levitating in a magnetic field, there's no worry that friction and mechanical wear will cause the machine to give out. Our tests have also shown that the device can adapt to the user's cardiovascular requirements.

The Bivacor heart would fit in the palm of your hand -- it's about 650 grams, slightly heavier than an adult human heart. Its shell is made of titanium, a noncorroding material that almost never triggers an immune response. Patients will wear a 4-kg external controller pack that contains two rechargeable batteries (providing about 5 hours of operation each), although they can also plug in directly to a power outlet. Throughout our design process, we used 3D printers to make both titanium and plastic parts for our prototypes, allowing us to rapidly experiment with different geometries. For testing, we built a hardware simulation of the human circulatory system in our engineering office in Los Angeles; this mock-up allows us to validate a device's function thoroughly and repeatedly in a controlled environment, and reduces the need for animal testing.
Transportation

Electric Dump Truck Produces More Energy Than It Uses (hackaday.com) 99

The Elektro eDumper dump truck is being put to work at a mine in Switzerland where it's able to produce more power than it consumes. "The dump truck drives up a mountain with no load, and carries double the weight back down the mountain after getting loaded up with lime and marl to deliver to a cement plant," reports Hackaday. "Since electric vehicles can recover energy through regenerative braking, rather than wasting that energy as heat in a traditional braking system, the extra weight on the way down actually delivers more energy to the batteries than the truck used on the way up the mountain." From the report: The article claims that this is the largest electric vehicle in the world at 110 tons, and although we were not able to find anything larger except the occasional electric train, this is still an impressive feat of engineering that shows that electric vehicles have a lot more utility than novelties or simple passenger vehicles.
Security

Security Researchers Find Several Bugs In Nest Security Cameras (vice.com) 6

An anonymous reader quotes a report from Motherboard: Hackers could have logged into your Nest Cam IQ Indoor and watch whatever was happening in your home by taking advantage of a vulnerability found by security researchers. The hackers could have also prevented you from using the camera, or use access to it to break into your home network. Researchers Lilith Wyatt and Claudio Bozzato of Cisco Talos discovered the vulnerabilities and disclosed them publicly on August 19. The two found eight vulnerabilities that are based in the Nest implementation of the Weave protocol. The Weave protocol is designed specifically for communications among Internet of Things or IoT devices.

Nest has provided a firmware update that the company says will fix the vulnerabilities. The vulnerabilities apply to version 4620002 of the Nest Cam IQ indoor device. You can check the version of your camera on the Nest app. Nest says that the updates will happen automatically if your camera is connected to the internet. "We've fixed the disclosed bugs and started rolling them out to all Nest Camera IQs," Google said in a statement to ZDNet. "The devices will update automatically so there's no action required from users."

Youtube

YouTube Pressured To Ban Chinese State Media Ads That Spread Misinformation About Protesters 29

YouTube is being pressured to remove ads from China Central Television, a state media channel that's allegedly spreading misinformation about protesters in Hong Kong. The Verge reports: Users on Twitter and Reddit have posted a number of screenshots of the ads, many of which paint the Hong Kong protests as an illegitimate product of foreign influence. The users accuse YouTube and parent company Google of enabling an "infestation of ads" that "tries to sow political discord." As a result, many supporters of the protests are demanding that Google stop CCTV from running ads on YouTube. "Google, why are you helping China [government] to undermine freedom of [Hong Kong citizens] with your platform," Chu Ka-cheong, an engineer based in Hong Kong, tweeted.

YouTube hasn't addressed the advertisements on its own platform yet. Google's ad policies don't directly address state media branches like CCTV, although Google has rules for political advertisements and prohibits content that misrepresents the product or organization an advertisement is talking about. Still, it's unclear whether CCTV's ads violate Google's policies. A representative for YouTube did not respond to The Verge's request for comment by the time of publish. CCTV's main YouTube channel has just over 560,000 subscribers.
After being criticized for running promoted tweets by China's largest state agency, Twitter announced it will no longer accept advertising from state media operations, like China Central Television.

Although Facebook did not announce any policy changes following the discovery of several accounts and pages spreading misinformation about the protesters, the company is "committed to continually improving to stay ahead," according to Nathaniel Gleicher, Facebook's head of cybersecurity policy.
The Almighty Buck

Apple Advises Owners of Its New Credit Card To Keep It Away From Leather, Denim (bbc.co.uk) 153

AmiMoJo shares a report from the BBC: Apple has advised owners of its new credit card to keep it away from leather and denim. Keeping the card in a leather wallet or in the pocket of a pair of jeans could cause "permanent discolouration." The Apple Card is a relatively plain matte white credit card made of titanium, which was designed to stand out against other credit cards. But people have poked fun at the company after reading that the card could be so easily damaged. Apple has published a guide advising customers how to "safely store and carry" their Apple Card. The guide warns that storing the card with other credit cards can scratch and damage it. Here's how Apple recommends you safely store and carry your titanium Apple Card:
- Store your titanium Apple Card in a wallet, pocket, or bag made of soft materials.
- Place your card in a slot in your wallet or billfold without touching another credit card. If two credit cards are placed in the same slot your card could become scratched.
- Don't place or store your titanium Apple Card card near magnets. If your card is placed close to a magnetic latch on a purse or bag, the magnetic strip can become demagnetized.
- Don't place your titanium Apple Card in a pocket or bag that contains loose change, keys, or other potentially abrasive objects.
Security

Valve Says Turning Away Researcher Reporting Steam Vulnerability Was a Mistake (arstechnica.com) 27

An anonymous reader quotes a report from Ars Technica: In an attempt to quell a controversy that has raised the ire of white-hat hackers, the maker of the Steam online game platform said on Thursday it made a mistake when it turned away a researcher who recently reported two separate vulnerabilities. In its statement, Valve Corporation references HackerOne, the reporting service that helps thousands of companies receive and respond to vulnerabilities in their software or hardware. Valve's new HackerOne program rules specifically provide that "any case that allows malware or compromised software to perform a privilege escalation through Steam, without providing administrative credentials or confirming a UAC dialog, is in scope. Any unauthorized modification of the privileged Steam Client Service is also in scope."

The statement and the policy change from Valve came two days after security researcher Vasily Kravets, an independent researcher from Moscow, received an email telling him that Valve's security team would no longer receive his vulnerability reports through the HackerOne bug-reporting service. Valve turned Kravets away after he reported a steam vulnerability that allowed hackers who already had a toe-hold on a vulnerable computer to burrow into privileged parts of an operating system. Valve initially told Kravets such vulnerabilities were out of scope and gave no indication that the one Vasily reported would be fixed. The company later publicly denied that the issue was a vulnerability by incorrectly claiming that the exploit required hackers to have physical access to a vulnerable computer. The company went so far as to dispute the vulnerability in the advisory issued by the National Institute of Standards and Technology.

Businesses

VMware Buys Carbon Black and Pivotal, Valued Together at $4.8 billion (cnbc.com) 12

Software company VMware on Thursday said it's acquiring Carbon Black at an enterprise value of $2.1 billion and Pivotal at an enterprise value of $2.7 billion. The deals are expected to close by the end of January 2020. From a report: These are VMware's largest acquisitions yet. The deals build on VMware's strength helping companies run their software in their own data centers. They could help VMware compete better in the security market and hybrid-cloud infrastructure operations. VMware isn't talking about cost synergies that could come out of buying two other enterprise-focused companies. However, CEO Pat Gelsinger told CNBC the companies will be operating profitably under VMware next year. Gelsinger said that by year two, Carbon Black and Pivotal will have contributed more than $1 billion in revenue incrementally, which will mean VMware will have more than $3 billion in hybrid cloud and software-as-a-service revenue.

Carbon Black was founded in 2002 and debuted on the Nasdaq under the symbol "CBLK" in May 2018. The company provides anti-malware and endpoint protection products that can see into many of a company's devices and tell if they have been hacked. [...] Pivotal and VMware go way back: The company was created from assets spun out of VMware and Dell (VMware's controlling owner) in 2013. Its products help companies build and deploy their software across different server infrastructure, including public clouds. Competitors include IBM, Oracle and SAP, among others, as well as cloud providers such as Amazon and Microsoft. Pivotal's customers include Boeing, Citi, Ford and Home Depot, according to its website.

Communications

The FCC Has No Idea How Many People Don't Have Broadband Access (arstechnica.com) 72

A new broadband mapping system is starting to show just how inaccurate the Federal Communications Commission's connectivity data is. From a report: In Missouri and Virginia, up to 38 percent of rural homes and businesses that the FCC counts as having broadband access actually do not, the new research found. That's more than 445,000 unconnected homes and businesses that the FCC would call "served" with its current system. Given that the new research covered just two states with a combined population of 14.6 million (or 4.5% of the 327.2 million people nationwide), it's likely that millions of homes nationwide have been wrongly counted as served by broadband. A full accounting of how the current data exaggerates access could further undercut FCC Chairman Ajit Pai's claims that repealing net neutrality rules and other consumer protection measures have dramatically expanded broadband access. His claims were already unconvincing for other reasons. The new research was conducted by CostQuest Associates, a consulting firm working for USTelecom, an industry lobby group that represents AT&T, Verizon, CenturyLink, Frontier, and other fiber and DSL broadband providers. USTelecom submitted a summary of the findings to the FCC on Tuesday. The two-state pilot was intended to determine the feasibility of creating a more accurate broadband map for the whole US.
Communications

Phone Companies, State Attorneys General Announce Broad Campaign To Fight Robocalls (washingtonpost.com) 40

Twelve of the country's largest telephone companies on Thursday pledged to implement new technology to spot and block robocalls, part of an agreement brokered between the industry and 51 attorneys general to combat the growing telecom scourge. From a report: The new effort to be announced in Washington commits a wide array of companies in the absence of regulation to improving their defenses and aiding law enforcement in its investigations into illegal spam calls, which rang Americans' phones an estimated 4.7 billion times in July alone. Under the agreement, the 12 carriers have agreed to implement call-blocking technology, make anti-robocall tools available for free to consumers and deploy a new system that would label calls as real or spam. Known by its acronym, STIR/SHAKEN, the technology takes aim at a practice known as spoofing, where fraudsters mask their identities by using phone numbers that resemble those that they're trying to contact in a bid to get victims to pick up and surrender their personal information. Signing the pledge are larger mobile carriers, such as AT&T, Comcast, Sprint, T-Mobile and Verizon, which already have said they would implement such robocall protections and in some cases have started testing them around the country. Other carriers adopting the pledge include Bandwidth, CenturyLink, Charter, Consolidated, Frontier, U.S. Cellular and Windstream.
Android

Android Ditches Desserts as Q Becomes 10 (bbc.com) 117

The next version of the Android operating system (OS) will not be named after a dessert or sweet treat, ending a tradition that started in 2009. From a report: Following the pattern, the name of the new version would have started with Q. But Google said it had ditched the naming scheme because it made it difficult for consumers to know which version of the OS was the latest. The new edition, which will be released later this year, will be called Android 10. Previous versions of the mobile operating system have been nicknamed Jellybean, Kitkat and Lollipop.
The Internet

The Planet Needs a New Internet (gizmodo.com) 201

An anonymous reader shares a report: When climate change comes for our coffee and our wine, we'll moan about it on Twitter, read about it on our favorite websites, and watch diverting videos on YouTube to fill the icy hole in our hearts. We'll do all this until the websites go dark and the networks go down because eventually, climate change will come for our internet, too. That is, unless we can get the web ready for the coming storms. Huge changes will be needed because right now, the internet is unsustainable. On the one hand, rising sea levels threaten to swamp the cables and stations that transmit the web to our homes; rising temperatures could make it more costly to run the data centers handling ever-increasing web traffic; wildfires could burn it all down. On the other, all of those data centers, computers, smartphones, and other internet-connected devices take a prodigious amount of energy to build and to run, thus contributing to global warming and hastening our collective demise.

To save the internet and ourselves, we'll need to harden and relocate the infrastructure we've built, find cleaner ways to power the web, and reimagine how we interact with the digital world. Ultimately, we need to recognize that our tremendous consumption of online content isnâ(TM)t free of consequences -- if we're not paying, the planet is. You probably don't think about it when you're liking a photo or reading an article, but everything you do online is underpinned by a globe-spanning labyrinth of physical infrastructure. There are the data centers hosting the web and managing enormous flows of information on the daily. There are the fiber cables transmitting data to into our homes and offices, and even across oceans. There are cell towers sending and receiving countless calls and texts on the daily.

Music

Spotify Triples Free-Trial Period on Premium Service (variety.com) 13

Spotify today extended the free-trial period for its Premium service from one month to three, tripling the amount of time listeners can take full advantage of the streaming giant's offerings without paying for them. From a report: According to the announcement, the offer is "always-on/not limited time," and will roll out across Spotify Premium plans globally: Individual and Student (where available) starting today, as well as Family (where available) and Duo (where available) in the coming months. The announcement notes that the free trial is open only to users who haven't already tried Premium (and is "not available on Headspace, non-recurring products and most carrier billing (except for individual in JP, AU, DE, CH and Student in JP)."
Google

Google Chrome Proposes 'Privacy Sandbox' To Reform Advertising Evils 56

Google's Chrome team proposed a "privacy sandbox" Thursday that's designed to give us the best of both worlds: ads that publishers can target toward our interests but that don't infringe our privacy. From a report: It's a major development in an area where Chrome, the dominant browser, has lagged competitors. Browsers already include security sandboxes, restrictions designed to confine malware to limit its possible damage. Google's proposed privacy sandbox would similarly restrict tracking technology, according to proposal details Google published.

The privacy sandbox is "a secure environment for personalization that also protects user privacy," said Justin Schuh, a director of Chrome Engineering focused on security matters, in a privacy sandbox blog post. "Our goal is to create a set of standards that is more consistent with users' expectations of privacy." For example, Chrome would restrict some private data to the browser -- an approach rival Brave Software has taken with its privacy-focused rival web browser. And it could restrict sharing personal data until it's shared across a large group of people using technologies called differential privacy and federated learning.
Iphone

Chicago Tribune Claims iPhone Radiofrequency Radiation Levels Measured Higher Than Legal Safety Limit In Tests (macrumors.com) 74

An anonymous reader quotes a report from MacRumors: The Chicago Tribune recently launched an investigation into the radiofrequency radiation levels output by popular smartphones, and found that some of Apple's iPhones are allegedly emitting radiofrequency radiation that exceeds safety limits. According to the newspaper, it contracted an accredited lab to test several smartphones according to federal guidelines. iPhones were secured below clear liquid formulated to simulate human tissue while probes measured the radiofrequency radiation the liquid absorbed.

Several iPhones measured over the legal safety limits in the tests, but the worst performer was the iPhone 7. Its radiofrequency radiation exposure was over the legal limit and more than double what Apple reported to federal regulators. The iPhone X was slightly over limits in some tests, as was the iPhone 8, while the 8 Plus stayed within the legal range. iPhones were tested twice after Apple provided feedback on the testing method. The modified test "added steps intended to activate sensors designed to reduce the phones' power." In these modified tests, where a reporter held the iPhone to activate the sensors in question, the iPhone 8 was under the 5mm limit, but the iPhone 7 models were not. Apple disputed the results found by The Chicago Tribune and said that the lab did not test the iPhones in the same way that Apple does, though Apple would not specify what was done wrong in the testing. Apple also said the modified testing had been done wrong.
The investigation also found smartphones from Samsung, Motorola, and Vivo also demonstrated radiofrequency radiation levels that exceed FCC guidelines. However, it's worth noting that testing was done in a way to simulate the worst possible exposure conditions.

The FCC said that it will be conducting its own tests over the next couple of months. "We take seriously any claims on non-compliance with the RF (radiofrequency) exposure standards and will be obtaining and testing the subject phones for compliance with FCC rules," agency spokesman Neil Grace said.
AI

Amazon, Microsoft Are 'Putting World At Risk of Killer AI,' Says Study (ibtimes.com) 95

oxide7 shares a report from International Business Times: Amazon, Microsoft and Intel are among leading tech companies putting the world at risk through killer robot development, according to a report that surveyed major players from the sector about their stance on lethal autonomous weapons. Dutch NGO Pax ranked 50 companies by three criteria: whether they were developing technology that could be relevant to deadly AI, whether they were working on related military projects, and if they had committed to abstaining from contributing in the future.

Google, which last year published guiding principles eschewing AI for use in weapons systems, was among seven companies found to be engaging in "best practice" in the analysis that spanned 12 countries, as was Japan's Softbank, best known for its humanoid Pepper robot. Twenty-two companies were of "medium concern," while 21 fell into a "high concern" category, notably Amazon and Microsoft who are both bidding for a $10 billion Pentagon contract to provide the cloud infrastructure for the U.S. military. Others in the "high concern" group include Palantir, a company with roots in a CIA-backed venture capital organization that was awarded an $800 million contract to develop an AI system "that can help soldiers analyze a combat zone in real time." The report noted that Microsoft employees had also voiced their opposition to a U.S. Army contract for an augmented reality headset, HoloLens, that aims at "increasing lethality" on the battlefield.
Stuart Russel, a computer science professor at the University of California, argued it was essential to take the next step in the form of an international ban on lethal AI, that could be summarized as "machines that can decide to kill humans shall not be developed, deployed, or used."
Ruby

Backdoor Code Found In 11 Ruby Libraries (zdnet.com) 36

Maintainers of the RubyGems package repository have yanked 18 malicious versions of 11 Ruby libraries that contained a backdoor mechanism and were caught inserting code that launched hidden cryptocurrency mining operations inside other people's Ruby projects. ZDNet reports: The malicious code was first discovered yesterday inside four versions of rest-client, an extremely popular Ruby library. According to an analysis by Jan Dintel, a Dutch Ruby developer, the malicious code found in rest-client would collect and send the URL and environment variables of a compromised system to a remote server in Ukraine. "Depending on your set-up this can include credentials of services that you use e.g. database, payment service provider," Dintel said.

The code also contained a backdoor mechanism that allowed the attacker to send a cookie file back to a compromised project, and allow the attacker to execute malicious commands. A subsequent investigation by the RubyGems staff discovered that this mechanism was being abused to insert cryptocurrency mining code. RubyGems staff also uncovered similar code in 10 other projects. All the libraries, except rest-client, were created by taking another fully functional library, adding the malicious code, and then re-uploading it on RubyGems under a new name. All in all, all the 18 malicious library versions only managed to amass 3,584 downloads before being removed from RubyGems.

Slashdot Top Deals