Long-time Slashdot reader trolman scared this scathing editorial by security researcher Brian Krebs: If you are somehow under the impression that you -- the customer -- are in control over the security, privacy and integrity of your mobile phone service, think again. And you'd be forgiven if you assumed the major wireless carriers or federal regulators had their hands firmly on the wheel. No, a series of recent court cases and unfortunate developments highlight the sad reality that the wireless industry today has all but ceded control over this vital national resource to cybercriminals, scammers, corrupt employees and plain old corporate greed...

Incessantly annoying and fraudulent robocalls. Corrupt wireless company employees taking hundreds of thousands of dollars in bribes to unlock and hijack mobile phone service. Wireless providers selling real-time customer location data, despite repeated promises to the contrary. A noticeable uptick in SIM-swapping attacks that lead to multi-million dollar cyberheists...

Is there any hope that lawmakers or regulators will do anything about these persistent problems? Gigi Sohn, a distinguished fellow at the Georgetown Institute for Technology Law and Policy, said the answer -- at least in this administration -- is probably a big "no."

"The takeaway here is the complete and total abdication of any oversight of the mobile wireless industry," Sohn told KrebsOnSecurity. "Our enforcement agencies aren't doing anything on these topics right now, and we have a complete and total breakdown of oversight of these incredibly powerful and important companies."

"In the 3D content creation space, where are lot of professional 3D software costs anywhere from 2K to 8K Dollars a license, people have always hoped that the free, open source 3D software Blender would some day be up to the job of replacing expensive commercial 3D software packages," writes Slashdot reader dryriver: This never happened, not because Blender didn't have good 3D features technically, but rather because the Blender Foundation simply did not listen to thousands of 3D artists screaming for a "more standard UI design" in Blender. Blender's eccentric GUI with reversed left-click-right-click conventions, keyboard shortcuts that don't match commercial software and other nastiness just didn't work for a lot of people.

After years of screaming, Blender finally got a much better and more familiar UI design in release 2.80, which can be downloaded here. Version 2.80 has many powerful features, but the standout feature is that after nearly 10 years of asking, 3D artists finally get a better, more standard, more sensible User Interface. This effectively means that for the first time, Blender can compete directly with expensive commercial 3D software made by industry leaders like Autodesk, Maxon, NewTek and SideFX.

Why the Blender Foundation took nearly a decade to revise the software's UI is anybody's guess.

Artem S. Tashkinov writes: Researchers from security company Eclypsium have discovered that more than forty drivers from at least twenty different vendors -- including every major BIOS vendor, as well as hardware vendors like ASUS, Toshiba, NVIDIA, and Huawei -- include critical vulnerabilities allowing an escalation of privileges to full system level access.

Considering how widespread these drivers are, and the fact that they are digitally signed by Microsoft, they allow an attacker to more successfully penetrate target systems and networks, as well as remain hidden. Also while some of these drivers "are designed to update firmware, the driver is providing not only the necessary privileges, but also the mechanism to make changes" which means the attacker can gain a permanent foothold. Eclypsium has already notified Microsoft about the issues and at least NVIDIA has already released fixed drivers.

Long-time Slashdot reader freelunch reports that Google Voice "has announced via email that they are ending one of their most popular features -- sending transcripts of voice mails via text message. The cited reason is carrier message blocking."

From Google's email: It has come to our attention that certain carriers are blocking the delivery of these messages because they are automated and, at times, contain transcripts that resulted from unsolicited robocalls.

We can no longer ensure these messages will be delivered, so unfortunately we are turning down the feature. We have been slowly rolling out these changes and expect them to be fully deployed by 9 August 2019. No action is needed on your part.

However, the Get voicemail via email continues to be supported. As an alternative, the Google Voice iOS, Android and web apps can always be used to check voicemail and view transcripts.

Long-time Slashdot reader Artem S. Tashkinov writes: A security researcher has published proof-of-concept (PoC) code for a vulnerability in the KDE software framework. A fix is not available at the time of writing. The bug was discovered by Dominik "zer0pwn" Penner and impacts the KDE Frameworks package 5.60.0 and below. The KDE Frameworks software library is at the base of the KDE desktop environment v4 and v5 (Plasma), currently included with a large number of Linux distributions.

The vulnerability occurs because of the way the KDesktopFile class (part of KDE Frameworks) handles .desktop or .directory files. It was discovered that malicious .desktop and .directory files could be created that could be used to run malicious code on a user's computer. When a user opens the KDE file viewer to access the directory where these files are stored, the malicious code contained within the .desktop or .directory files executes without user interaction — such as running the file.

Zero user interaction is required to trigger code execution — all you have to do is to browse a directory with a malicious file using any of KDE file system browsing applications like Dolphin.
When ZDNet contacted KDE for a comment Tuesday, their spokesperson provided this response.

"We would appreciate if people would contact security@kde.org before releasing an exploit into the public, rather than the other way around, so that we can decide on a timeline together."

Last year the city of San Diego installed 3,200 smart streetlights, each one monitoring 36 x 54 meters of pavement. They originally used the data to time traffic signals -- but now Slashdot reader Tekla Perry summarizes a report from IEEE Spectrum: Developers for the City of San Diego spent months training its smart streetlights to recognize and count bicycles from just about any angle. The system is now monitoring bicycle traffic, but a few issues remain--figuring out how to distinguish between bicycles being ridden--and those doing the riding, like on a bike rack or thrown in a pickup truck.

The software has a similar problem with pedestrian-counting: When a convertible comes into view, it is counted as both a car and a pedestrian--the visible driver.

America's lawmakers are scrutinizing the blanket protections in Section 230 of the Communications Decency Act, which lets online companies moderate their own sites without incurring legal liability for everything they host.

schwit1 shared this article from the New York Times: Last month, Senator Ted Cruz, Republican of Texas, said in a hearing about Google and censorship that the law was "a subsidy, a perk" for big tech that may need to be reconsidered. In an April interview, Speaker Nancy Pelosi of California called Section 230 a "gift" to tech companies "that could be removed."

"There is definitely more attention being paid to Section 230 than at any time in its history," said Jeff Kosseff, a cybersecurity law professor at the United States Naval Academy and the author of a book about the law, The Twenty-Six Words That Created the Internet .... Mr. Wyden, now a senator [and a co-author of the original bill], said the law had been written to provide "a sword and a shield" for internet companies. The shield is the liability protection for user content, but the sword was meant to allow companies to keep out "offensive materials." However, he said firms had not done enough to keep "slime" off their sites. In an interview with The New York Times, Mr. Wyden said he had recently told tech workers at a conference on content moderation that if "you don't use the sword, there are going to be people coming for your shield."

There is also a concern that the law's immunity is too sweeping. Websites trading in revenge pornography, hate speech or personal information to harass people online receive the same immunity as sites like Wikipedia. "It gives immunity to people who do not earn it and are not worthy of it," said Danielle Keats Citron, a law professor at Boston University who has written extensively about the statute. The first blow came last year with the signing of a law that creates an exception in Section 230 for websites that knowingly assist, facilitate or support sex trafficking. Critics of the new law said it opened the door to create other exceptions and would ultimately render Section 230 meaningless.
The article notes that while lawmakers from both parties are challenging the protections, "they disagree on why," with Republicans complaining that the law has only protected some free speech while still leaving conservative voices open to censorship on major platforms.

The Times also notes that when Wyden co-authored the original bill in 1996, Google didn't exist yet, and Mark Zuckerberg was 11 years old.

Earlier this week on the Linux kernel mailing list, Artem S. Tashkinov described a low-memory scenario where "the system will stall hard. You will barely be able to move the mouse pointer. Your disk LED will be flashing incessantly..."

"I'm afraid I have bad news for the people snickering at Linux here," wrote Chris Siebenmann, a sys-admin at the University of Toronto's CS lab. "If you're running without swap space, you can probably get any Unix to behave this way under memory pressure..." In the old days, this usually was not very much of an issue because system RAM was generally large compared to the size of programs and thus the amount of file-backed pages that were likely to be in memory. That's no longer the case today; modern large programs such as Firefox and its shared libraries can have significant amounts of file-backed code and data pages (in addition to their often large use of dynamically allocated memory, ie anonymous pages).
A production engineer (now on Facebook's Web Foundation team) wrote about experiencing similar issues years ago when another company had disabled swapping when they replaced or reinstalled machines -- leading to lots of pages from hosts that had to be dealt with. This week they wrote: I stand by my original position: have some swap. Not a lot. Just a little. Linux boxes just plain act weirdly without it. This is not permission to beat your machine silly in terms of memory allocation, either... If you allocate all of the RAM on the machine, you have screwed the kernel out of buffer cache it sorely needs. Back off.

Put another way, disk I/O that isn't brutally slow costs memory. Network I/O costs memory. All kinds of stuff costs memory. It's not JUST the RSS of your process. Other stuff you do needs space to operate. If you try to fill a 2 GB box with 2 GB of data, something's going to have a bad day! You have to leave room for the actual system to run or it's going to grind to a stop.

Google is launching a beta of its augmented reality walking directions feature for Google Maps, with a broader launch that will be available to all iOS and Android devices that have system-level support for AR. On iOS, that means ARKit-compatible devices, and on Android, that means any smartphones that support Google's ARcore, so long as "Street View" is also available where you are. TechCrunch reports: Originally revealed earlier this year, Google Maps' augmented reality feature has been available in an early alpha mode to both Google Pixel users and to Google Maps Local Guides, but starting today it'll be rolling out to everyone (this might take a couple of weeks depending on when you actually get pushed the update). We took a look at some of the features available with the early version in March, and it sounds like the version today should be pretty similar, including the ability to just tap on any location nearby in Maps, tap the "Directions" button and then navigating to "Walking," then tapping "Live View" which should appear near the bottom of the screen.

The Live View feature isn't designed with the idea that you'll hold up your phone continually as you walk -- instead, in provides quick, easy and super-useful orientation by showing you arrows and big, readable street markers overlaid on the real scene in front of you. That makes it much, much easier to orient yourself in unfamiliar settings, which is hugely beneficial when traveling in unfamiliar territory.

A victim of billionaire Jeffrey Epstein testified that she was forced to have sex with MIT professor Marvin Minsky, as revealed in a newly unsealed deposition. The Verge reports: Minsky, who died in 2016, was known as an associate of Epstein, but this is the first direct accusation implicating the AI pioneer in Epstein's broader sex trafficking network. The deposition also names Prince Andrew of Britain and former New Mexico governor Bill Richardson, among others. The accusation against Minsky was made by Virginia Giuffre, who was deposed in May 2016 as part of a broader defamation suit between her and an Epstein associate named Ghislaine Maxwell. In the deposition, Giuffre says she was directed to have sex with Minsky when he visited Epstein's compound in the U.S. Virgin Islands. As part of the defamation suit, Maxwell's counsel denied the allegations, calling them "salacious and improper." Representatives for Giuffre and Maxwell did not immediately respond to a request for comment.

A pivotal member of MIT's Artificial Intelligence Lab, Marvin Minsky pioneered the first generation of self-training algorithms, establishing the concept of artificial neural networks in his 1969 book Perceptrons. He also developed the first head-mounted display, a precursor to modern VR and augmented reality systems. Minsky was one of a number of prominent scientists with ties to Jeffrey Epstein, who often called himself a "science philanthropist" and donated to research projects and academic institutions. Minsky's affiliation with Epstein went particularly deep, including organizing a two-day symposium on artificial intelligence at Epstein's private island in 2002, as reported by Slate. In 2012, the Jeffrey Epstein Foundation issued a press release touting another conference organized by Minsky on the island in December 2011.
UPDATE (8/10/2019): Jeffrey Epstein "died by suicide early Saturday in his Lower Manhattan prison cell, three law enforcement officials told ABC News."

An anonymous reader quotes a report from Motherboard: Europe's controversial privacy law, the General Data Protection Regulator -- better known as GDPR -- has been hailed by some as a solution to tech companies' pervasive data collection and tracking. What maybe no one saw coming is that GDPR can become another tool in the arsenal of enterprising and malicious social engineers, hackers, and people who want to dox and harass others. That's what Ph.D student and cybersecurity researcher James Pavur discovered when he and his fiance -- and co-author on their paper -- Casey Knerr made an unusual wager about using GDPR's right of access requests -- a mechanism that allows Europeans to ask any company about what data they have on themselves -- with the goal of extracting sensitive information.

Along with his fiance Knerr, who also works in the infosec industry -- and with her full consent -- Pavur devised a clever, yet very simple experiment. He started with just Knerr's full name, a couple of email addresses, phone numbers, and any other low-hanging fruit that he could find online. In other words, "the weakest possible form of attack," as he put it in his paper. Then, he sent requests to 75 companies, and then to another 75 using the new data -- such as home addresses -- he found through the first wave of requests using an email address designed to look like that of Knerr. Thanks to these requests, Pavur was able to get his fiance's Social Security Number, date of birth, mother's maiden name, passwords, previous home addresses, travel and hotel logs, high school grades, partial credit card numbers, and whether she had ever been a user of online dating services. "Pavur and Knerr said 25 percent of companies never responded. Two thirds of companies, including online data services, responded with enough information to reveal that Pavur's fiance had an account with them. Of those who responded, 25 percent provided sensitive data without properly verifying the identity of the sender.

Another 15 percent requested data that could have easily been forged, while 40 percent requested identifying information that would've been relatively hard to fake, according to the study.

Verizon is refusing to waive or reduce $880 of charges accidentally ran up from someone who borrowed a mobile hotspot from a small library. "The library has an 'unlimited' data plan for the hotspots, but Verizon says it has to pay the $880 to cover less than half a gigabyte of data usage that happened across the border with Canada," reports Ars Technica. From the report: Tully Free Library in Tully, New York, a town of fewer than 3,000 people, lends out three Verizon hotspots to a rural population that has limited Internet access. The library started the hotspot-lending program with a grant from the Central New York Library Resources Council, which paid the bill for two years. Crucially, the service plan with Verizon blocked international roaming so that library borrowers wouldn't rack up unintentional charges if they happened to cross the Canadian border. But when the grant ran out, Tully Free Library had to get a new contract and service plan, and the organization began paying the bill itself. The new plan seemed to be identical to the old one, but it enabled international roaming. "They never said to us, 'Do you want international roaming blocked?'" Tully Free Library Director Annabeth Hayes told Ars. "That wasn't something that occurred to me because it was blocked before." The person who borrowed the hotspot used it while driving through Canada for a few hours to take his brother to the airport. "He was only over the border for about four hours and he said he wasn't even using the hotspot," Hayes said. "It was just on in the car and apparently it was pinging a tower so that tower was incurring all these fees."

The bill from Verizon included an $880.30 charge for about 440MB of international data. "I ended up contacting their executive communications department, and the person there said she had to contact their legal team because our contract was under the government/educational department," Hayes said. "She contacted the legal team and they went back and forth and finally decided that no, we couldn't have our fee waived."

An anonymous reader quotes a report from TechCrunch: New research just presented at the Def Con security conference reveals how companies, startups and governments are inadvertently leaking their own files from the cloud. You may have heard of exposed S3 buckets -- those Amazon-hosted storage servers packed with customer data but often misconfigured and inadvertently set to "public" for anyone to access. But you may not have heard about exposed EBS snapshots, which poses as much, if not a greater, risk. These elastic block storage (EBS) snapshots are the "keys to the kingdom," said Ben Morris, a senior security analyst at cybersecurity firm Bishop Fox, in a call with TechCrunch ahead of his Def Con talk. EBS snapshots store all the data for cloud applications. "They have the secret keys to your applications and they have database access to your customers' information," he said.

Morris built a tool using Amazon's own internal search feature to query and scrape publicly exposed EBS snapshots, then attach it, make a copy and list the contents of the volume on his system. It took him two months to build up a database of exposed data and just a few hundred dollars spent on Amazon cloud resources. Once he validates each snapshot, he deletes the data. Morris found dozens of snapshots exposed publicly in one region alone, he said, including application keys, critical user or administrative credentials, source code and more. He found several major companies, including healthcare providers and tech companies. He also found VPN configurations, which he said could allow him to tunnel into a corporate network. Morris said he did not use any credentials or sensitive data, as it would be unlawful.

In March the National Security Agency released an internal malware research tool for free to the public, a first for the secretive agency. Six months later, by most indications, the release is an even bigger event than the NSA thought. From a report: Some aspects of researching malware have long required expensive software. The release of Ghidra, the NSA tool, has profoundly changed the field, opening it up to students, part-timers and hobbyists who otherwise couldn't afford to participate. It's been a good six months for Ghidra. The software has been downloaded more than 500,000 times from GitHub. "We had a bet on how many downloads it would be," Brian Knighton, senior researcher at the NSA, told Axios. "We were off by quite a factor."

Ghidra also netted the NSA two nominations for "Pwnie" awards at the typically NSA-adverse DEF CON hacker conference this week. The NSA was also pleasantly surprised with the number of outside developers modifying code and creating new features for the now open-source program. The toolkit is popular enough that the NSA now offers touring classes on Ghidra for colleges and universities.

An anonymous reader shares a report: Sudden shrieks of radio waves from deep space keep slamming into radio telescopes on Earth, spattering those instruments' detectors with confusing data. And now, astronomers are using artificial intelligence to pinpoint the source of the shrieks, in the hope of explaining what's sending them to Earth from -- researchers suspect -- billions of light-years across space. Usually, these weird, unexplained signals are detected only after the fact, when astronomers notice out-of-place spikes in their data -- sometimes years after the incident. The signals have complex, mysterious structures, patterns of peaks and valleys in radio waves that play out in just milliseconds. That's not the sort of signal astronomers expect to come from a simple explosion, or any other one of the standard events known to scatter spikes of electromagnetic energy across space.

Astronomers call these strange signals fast radio bursts (FRBs). Ever since the first one was uncovered in 2007, using data recorded in 2001, there's been an ongoing effort to pin down their source. But FRBs arrive at random times and places, and existing human technology and observation methods aren't well-primed to spot these signals. Now, in a paper published in the journal Monthly Notices of the Royal Astronomical Society, a team of astronomers wrote that they managed to detect five FRBs in real time using a single radio telescope. Wael Farah, a doctoral student at Swinburne University of Technology in Melbourne, Australia, developed a machine-learning system that recognized the signatures of FRBs as they arrived at the University of Sydney's Molonglo Radio Observatory, near Canberra.

A draft executive order from the White House could put the Federal Communications Commission in charge of shaping how Facebook, Twitter and other large tech companies curate what appears on their websites, CNN reported Friday, citing multiple people familiar with the matter. From the report: The draft order, a summary of which was obtained by CNN, calls for the FCC to develop new regulations clarifying how and when the law protects social media websites when they decide to remove or suppress content on their platforms. Although still in its early stages and subject to change, the Trump administration's draft order also calls for the Federal Trade Commission to take those new policies into account when it investigates or files lawsuits against misbehaving companies. If put into effect, the order would reflect a significant escalation by President Trump in his frequent attacks against social media companies over an alleged but unproven systemic bias against conservatives by technology platforms. And it could lead to a significant reinterpretation of a law that, its authors have insisted, was meant to give tech companies broad freedom to handle content as they see fit.

Hundreds of schoolchildren have been drafted in to make Amazon's Alexa devices in China as part of a controversial and often illegal attempt to meet production targets, documents seen by the Guardian reveal. From a report: Interviews with workers and leaked documents from Amazon's supplier Foxconn show that many of the children have been required to work nights and overtime to produce the smart-speaker devices, in breach of Chinese labour laws. According to the documents, the teenagers -- drafted in from schools and technical colleges in and around the central southern city of Hengyang -- are classified as "interns," and their teachers are paid by the factory to accompany them. Teachers are asked to encourage uncooperative pupils to accept overtime work on top of regular shifts. Some of the pupils making Amazon's Alexa-enabled Echo and Echo Dot devices along with Kindles have been required to work for more than two months to supplement staffing levels at the factory during peak production periods, researchers found. More than 1,000 pupils are employed, aged from 16 to 18.

Vulnerabilities have been uncovered in the authentication process of biometrics technology that could allow bad actors to bypass various facial recognition applications -- including Apple's FaceID. But there is a catch. Doing so requires the victim to be out cold. From a report: Researchers on Wednesday during Black Hat USA 2019 demonstrated an attack that allowed them to bypass a victim's FaceID and log into their phone simply by putting a pair of modified glasses on their face. By merely placing tape carefully over the lenses of a pair glasses and placing them on the victim's face the researchers demonstrated how they could bypass Apple's FaceID in a specific scenario. The attack itself is difficult, given the bad actor would need to figure out how to put the glasses on an unconscious victim without waking them up.

To launch the attack, researchers with Tencent tapped into a feature behind biometrics called "liveness" detection, which is part of the biometric authentication process that sifts through "real" versus "fake" features on people. It works by detecting background noise, response distortion or focus blur. One such biometrics tool that utilizes liveness detection is FaceID, which is designed and utilized by Apple for the iPhone and iPad Pro. "With the leakage of biometric data and the enhancement of AI fraud ability, liveness detection has become the Achilles' heel of biometric authentication security as it is to verify if the biometric being captured is an actual measurement from the authorized live person who is present at the time of capture," researchers said during the Black Hat USA 2019 session.

Robocall-blocking apps promise to rid your life of spoofed and spam phone calls. But are they as trustworthy as they claim to be? From a report: One security researcher said many of these apps can violate your privacy as soon as they are opened. Dan Hastings, a senior security consultant cybersecurity firm NCC Group, analyzed some of the most popular robocall-blocking apps -- including TrapCall, Truecaller, and Hiya -- and found egregious privacy violations. [...] Many of these apps, said Hastings, send user or device data to third-party data analytics companies -- often to monetize your information -- without your explicit consent, instead burying the details in their privacy policies. One app, TrapCall, sent users' phone numbers to a third-party analytics firm, AppsFlyer, without telling users -- either in the app nor in the privacy policy. He also found Truecaller and Hiya uploaded device data -- device type, model and software version, among other things -- before a user could accept their privacy policies.

An anonymous reader shares a report: For all its indignities, air travel is also surprisingly democratic -- people of all stripes and shades crammed together into a small metal tube and lofted into the sky. Some of them have service animals, some of which are a hair more exotic than a vested dog. This has caused some spirited debates. But on Thursday, the U.S. Department of Transportation issued its final guidance on the subject and added miniature horses to the list of service animals that can fly in any cabin. You may have some questions. Yes, miniature horses make great -- if rare -- service animals for those with emotional and physical disabilities. Standing 2-3 feet tall, weighing around 100 pounds, and often living 35 years or longer, they're not unlike large dogs in their comforting presence and ability to perform complex tasks. And yes, airlines have historically balked at the idea of seating a horse in Economy Plus. The DoT's statement notes that air carriers "have asked us to declare that a wide variety of species (e.g., birds...and animals with hooves or horns) constitute 'unusual service animals' that may be categorically banned." But with trained miniature horses officially recognized in the Americans with Disabilities Act as legitimate service animals, the agency has decided they must be able to fly. The declaration isn't a law per se, but it indicates that they'll punish U.S. airlines that violate it.