A recently discovered flaw in WhatsApp could allow hackers to modify and send fake messages (Warning: source may be paywalled; alternative source). Researchers at the Israeli cybersecurity firm Check Point said the vulnerability gives a hacker the possibility "to intercept and manipulate messages sent by those in a group or private conversation" as well as "create and spread misinformation." The New York Times reports: WhatsApp acknowledged that it was possible for someone to manipulate the quote feature, but the company disagreed that it was a flaw. WhatsApp said the system was working as it had intended, because the trade-offs to prevent such a deception by verifying every message on the platform would create an enormous privacy risk or bog down the service. The company said it worked to find and remove anyone using a fake WhatsApp application to spoof the service. "We carefully reviewed this issue and it's the equivalent of altering an email," Carl Woog, a spokesman for WhatsApp, said in a statement. What Check Point discovered had nothing to do with the security of WhatsApp's so-called end-to-end encryption, which ensures only the sender and recipient can read messages, he said.

For now, the issue appears limited to a discussion among security experts. Both WhatsApp and Check Point Software said they had not seen regular users creating fake quote messages in chats. Check Point said it also discovered a way within group chats to send a message to a specific individual within the discussion. That individual is tricked into believing that the whole group saw the message and responds accordingly. WhatsApp played down the concerns raised by Check Point, saying most people know the person who they are messaging on the service. The company said 90 percent of all messages on the service are sent in one-on-one conversations, and the majority of groups are six people or less -- making it less likely that an unknown person can infiltrate a conversation to trick other users.

An anonymous reader quotes a report from Ars Technica: A vicious species of tick originating from Eastern Asia has invaded the U.S. and is rapidly sweeping the Eastern Seaboard, state and federal officials warn. The tick, the Asian longhorned tick (or Haemaphysalis longicornis), has the potential to transmit an assortment of nasty diseases to humans, including an emerging virus that kills up to 30 percent of victims. So far, the tick hasn't been found carrying any diseases in the U.S. It currently poses the largest threat to livestock, pets, and wild animals; the ticks can attack en masse and drain young animals of blood so quickly that they die -- an execution method called exsanguination.

Key to the tick's explosive spread and bloody blitzes is that its invasive populations tend to reproduce asexually, that is, without mating. Females drop up to 2,000 eggs over the course of two or three weeks, quickly giving rise to a ravenous army of clones. In one U.S. population studied so far, experts encountered a massive swarm of the ticks in a single paddock, totaling well into the thousands. They speculated that the population might have a ratio of about one male to 400 females. Yesterday, August 7, Maryland became the eighth state to report the presence of the tick. It followed a similar announcement last Friday, August 3, from Pennsylvania. Other affected states include New York, Arkansas, North Carolina, Virginia, and West Virginia.

harrymcc writes: Toymaker Anki, whose Cozmo robot has been a hit, has announced its next bot: Vector. Though it looks a lot like Cozmo, it packs far more computational power -- Cozmo relied on a phone app for smarts -- and utilizes deep-learning tech in the interest of giving Vector a subtler, more engaging personality. Over at Fast Company, Sean Captain has a deep dive into the software engineering that went into the effort. Vector is being powered by a quad-core Qualcomm Snapdragon 212 chip, and has cartoon eyes displayed on a 184 x 96-pixel screen. The robot actually scans its environment via a single 720p wide-angle camera mounted below the screen. "Cozmo springs to attention when you call its name, making twittering sounds, and lifting its bulldozer-like arms up and down," writes Captain. "If you ignore Cozmo, the bot gets more in your face, or makes loud, obnoxious snoring sounds."

While Vector can connect to the internet and display weather information, set timers, and speak answers to various questions, it's the social and visual intelligence that people may fall in love with the most. Vector is able to detect people and interact with them, even when faces aren't visible. Computer vision technical director Andrew Stein and his team "trained a convolutional neural network (CNN) -- a popular deep-learning AI technology that mimics the brains visual cortex," reports Captain. "Using the often blurry and distorted footage that Vector's camera captures as he moves around, Stein has been teaching the CNN to detect people from the back or the side, for instance, up to about 10 feet away."

The Samsung conglomerate said it will invest more than $22 billion over the next three years to target such areas as artificial intelligence and auto-technology components, as it seeks out growth drivers beyond phones and memory chips. From a report: The bulk of the spending will be earmarked for Samsung Electronics, the conglomerate's crown jewel. The company is the world's No. 1 maker of smartphones, semiconductors and televisions and last year put more toward capital expenditures than any other publicly traded company. Samsung ïsaid it would invest heavily in four key areas through 2020. Auto tech, artificial intelligence and new fifth-generation, or 5G, cellular technology [Editor's note: the link may be paywalled; alternative source] -- all of which that fall under Samsung's umbrella -- will draw funding, as will its nascent drug companies specializing in contract manufacturing and biosimilar medications. Samsung, South Korea's largest business empire, spans 62 affiliates as diverse as life insurance and theme parks.

A new company called Audius, lead by entrepreneur and DJ Ranidu Lankage, has raised $5.5 million to build a blockchain-based alternative to Spotify or SoundCloud. "Users will pay for Audius tokens or earn them by listening to ads," reports TechCrunch. "Their wallet will then pay out a fraction of a cent per song to stream from decentralized storage across the network, with artists receiving roughly 85 percent -- compared to roughly 70 percent on the leading streaming apps. The rest goes to compensating whomever is hosting that song, as well as developers of listening software clients, one of which will be built by Audius." From the report: Audius plans to launch its open-sourced product in beta later this year. But it's already found some powerful investors that see SoundCloud as vulnerable to the cryptocurrency revolution. Audius has raised a $5.5 million Series A led by General Catalyst and Lightspeed, with participation from Kleiner Perkins, Pantera Capital, 122West and Ascolta Ventures. They're betting that Audius' token will grow in value, making the stockpile it keeps worth a fortune. It could then sell chunks of its tokens to earn revenue instead of charging artists directly. The big question will be whether Audius can use the token economy to crack the chicken-and-egg problem of getting its first creators and listeners on a platform that might be less functionally robust than its traditional competitors. There are a lot of moving parts to decentralize, but there are also plenty of disgruntled musicians out there waiting for something better.

An anonymous reader quotes a report from Tech Xplore: Engineers at Caltech have developed a new control algorithm that enables a single drone to herd an entire flock of birds away from the airspace of an airport. The algorithm is presented in a study in IEEE Transactions on Robotics. Herding relies on the ability to manage a flock as a single, contained entity -- keeping it together while shifting its direction of travel. Each bird in a flock reacts to changes in the behavior of the birds nearest to it. Effective herding requires an external threat -- in this case, the drone -- to position itself in such a way that it encourages birds along the edge of a flock to make course changes that then affect the birds nearest to them, who affect birds farther into the flock, and so on, until the entire flock changes course. The positioning has to be precise, however: if the external threat gets too zealous and rushes at the flock, the birds will panic and act individually, not collectively.

To teach the drone to herd autonomously, Soon-Jo Chung, an associate professor of aerospace, and his colleagues [...] studied and derived a mathematical model of flocking dynamics to describe how flocks build and maintain formations, how they respond to threats along the edge of the flock, and how they then communicate that threat through the flock. Their work improves on algorithms designed for herding sheep, which only needed to work in two dimensions, instead of three. Once they were able to generate a mathematical description of flocking behaviors, the researchers reverse engineered it to see exactly how approaching external threats would be responded to by flocks, and then used that information to create a new herding algorithm that produces ideal flight paths for incoming drones to move the flock away from a protected airspace without dispersing it. The team tested the algorithm on a flock of birds near a field in Korea and found that a single drone could keep a flock of dozens of birds out of a designated airspace. The effectiveness of the algorithm is only limited by the number and size of the incoming birds.

New York City Council passed regulations on ride-hail companies on Wednesday, capping the number of vehicles on the road for one year and requiring that drivers to be paid a minimum wage. From a report: Council Speaker Corey Johnson said earlier that the regulations are intended to protect drivers, fairly regulate the industry and reduce congestion. The year-long cap on new licenses for ride-hailing vehicles will take place while the Taxi and Limousine Commission (TLC) studies the effects of ride-hail service in the city. The cap would not apply to new wheelchair-accessible vehicles or new vehicles serving an area demonstrating need in a way that does not increase congestion. App-based ride services account for 80,000 vehicles in New York City, and provide 17 million rides per month, according to a study by The New School for the TLC. The surge in ridership coincided with increased resident frustration with the local subway system. With the move on Wednesday, New York City, the largest American market for Uber, has become the first major American city to restrict the number of ride-hail vehicles and to establish pay rules for drivers. In a statement issued moments ago, New York Mayor Bill de Blasio said," Our city is directly confronting a crisis that is driving working New Yorkers into poverty and our streets into gridlock. The unchecked growth of app-based for-hire vehicle companies has demanded action -- and now we have it."

From a report: In recent years Hollywood and other entertainment sources have focused their enforcement efforts on pirate streaming sites and services. According to several reports, streaming sites get more traffic than their P2P counterparts, with the latter being almost exclusively BitTorrent related. While the rise of online streaming sites can't be denied, a new research report from anti-piracy outfit Irdeto shows that P2P remains very relevant. In fact, it's still the dominant piracy tool in many countries. Irdeto researched site traffic data provided by an unnamed web analytics partner. The sample covers web traffic to 962 piracy sites in 19 countries where P2P was most used. This makes it possible to see how P2P site visits compare to those of pirate streaming sites.

Caroline O'Donovan, reporting for BuzzFeed News: To convince workers to join the unstable and unreliable world of freelance work, startups and platforms often promise freedom and flexibility. But on the digital freelance platform Upwork, company software tracks hundreds of freelancers while they work by saving screenshots, measuring the frequency of their clicks and keystrokes, and even sometimes taking webcam photos of the workers. Upwork, which hosts "millions" of coding and design gigs, guarantees payment for freelancers, even if the clients who hired them refuse to pay. But in order to get the money, freelancers have to agree in advance to use Upwork's digital Work Diary, which counts keystrokes to measure how "productive" they are and takes screenshots of their computer screens to determine whether they're actually doing the work they say they're doing.

Upwork's tracker isn't automatically turned on for all gigs on the platform. Some freelancers like it because it guarantees payment, but others find it unnerving. [...] Upwork maintains that freelancers don't have to use the time tracker if it makes them uncomfortable. [...] But while Work Diary may be opt-in on its surface, Microsoft Research's Mary Gray said freelancers may not feel like they really have a choice.

Larger cable providers once again take a beating for perceived value -- even when it comes to bundled plans. ConsumerReports: Unhappy with your pay-TV company? You're not alone. Dissatisfaction with the perceived value of pay-TV service was once again high among the 176,000 members who participated in Consumer Reports' latest telecommunications survey. When we asked for feedback on their experiences with pay TV, home internet, home telephone service, and bundled plans, they shared their displeasure. In fact, most of the larger cable companies -- Optimum (Cablevision), Comcast, and Spectrum (Charter, Time Warner Cable, Bright House Networks) -- earned low scores in multiple categories, settling into the bottom half of the 25 providers in CR's new telecom service ratings.

Only 38 percent of pay-TV subscribers were highly satisfied with their service, meaning they were "very" or "completely" happy with the offerings. Armstrong, a smaller cable company that operates in Kentucky, Maryland, New York, Ohio, Pennsylvania, and West Virginia, earned the second-place slot behind Google Fiber, in part due to favorable scores for technical support, reliability, and customer service. Verizon and the two satellite-TV companies -- AT&T's DirecTV and Dish Network -- also rated better than Cox Communications, Comcast, Spectrum, and Optimum.

Top-rated EPB, a municipal broadband service run as a public utility in Chattanooga, Tenn., was one of the few bright spots for internet service. It was the only company to receive a top mark for value. It also got top marks for speed and reliability. Google Fiber was a close second in the ratings, the only other company to get a favorable mark for value.

Nearly three-quarters of the survey respondents who have a bundled plan -- TV, internet, and phone -- said they got a special promotional price when they signed up. And 45 percent were still enjoying that rate when they answered our survey.

Researchers at Trustwave on Wednesday released a new open-source tool called Social Mapper, which uses facial recognition to track subjects across social media networks. Designed for security researchers performing social engineering attacks, the system automatically locates profiles on Facebook, Instagram, Twitter, LinkedIn, and other networks based on a name and picture. Unlike tools such as Geofeedia that require access to certain APIs, Social Mapper performs automated manual searches in an instrumented browser window. The Verge: Those searches can already be performed manually, but the automated process means it can be performed far faster and for many people at once. "Performing intelligence gathering online is a time-consuming process," Trustwave explained in a post this morning. "What if it could be automated and done on a mass scale with hundreds or thousands of individuals?"

Virtual reality is a modern-day beacon of escapism -- a way to fully immerse yourself in other worlds -- and it's seeing unprecedented applications. The market, no surprise, is exploding, with some industry groups estimating a $60 billion global market by 2022. As business booms, however, people who are using the tech are reporting a growing number of physical side effects -- like VR arm, but worse: eye strain, dizziness, headaches, nausea, and even dissociative experiences. From a report: VR companies recommend that people take frequent breaks and moderate their VR time when they're first starting out. "As you become accustomed to the virtual reality experience, you can begin increasing the amount of time you use Daydream View," reads one line of the health and safety information included with Google's VR platform. But what happens when it's your job to build these escapist technologies? The potential health risks for everyday consumers are compounded for those who make VR products for a living.

When VR bigwig Jeremy Bailenson founded Stanford University's Virtual Human Interaction Lab, in 2003, two items were even more important than the VR equipment he was using: "We had to keep a bucket in the lab and a mop nearby," Bailenson says. Today, he institutes a strict 20-minute limit on headset time for people in his lab. These health effects produce unique challenges for VR developers. "We have to understand not just the good but also the downsides of this technology. There a lot of questions we need to answer," Bailenson says. "The whole point of VR is it takes you out of your space, but you can't be doing that for many hours a day."

[...] Suddenly rotating around a virtual environment using handled controllers or quickly looking left and right in the VR space without any concomitant physical movement in the real world tend to physically affect Jonathan Yomayuza, VR technical director at the Emblematic Group, a creative firm based in Southern California. [...] The feeling Yomayuza describes is common among people who work with or use VR.

New submitter Woodmeister shares a report: While looking for ways to attack the new WPA3 security standard, Hashcat developer Jens "Atom" Steube found a simpler way to capture and crack access credentials protecting WPA and WPA2 wireless networks. The attacker needs to capture a single EAPOL frame after requesting it from the access point, extract the PMKID from it by dumping the recieved frame to a file, convert the captured data to a hash format accepted by Hashcat, and run Hashcat to crack it. Once that's done, the attacker has the Pre-Shared Key (PSK), i.e. the password, of the wireless network. Depending on the length and complexity of the password and the power of the cracking rig, that last step could take hours or days. "The main difference from existing attacks is that in this attack, capture of a full EAPOL 4-way handshake is not required. The new attack is performed on the RSN IE (Robust Security Network Information Element) of a single EAPOL frame," Steube explained. This makes the attack much easier to pull off, as the attacker doesn't depend on another user and on being in range of both the user and the access point at the exact moment when the user connects to the wireless network and the handshake takes place.

Rakhim Davletkaliyev, a software developer, writer and podcaster, recently launched two new podcasts. One of the things he was asked by people following the launches was "but how do I subscribe, it's not on iTunes/Google Podcasts?" He writes: Podcasts are simply RSS feeds with links to media files (usually mp3s). A podcast is basically a URL. And podcast clients are special browsers. They check that URL regularly and download new episodes if the content of the URL changes (new link added). That's it, no magic, no special membership or anything else required. The technology is pretty "stupid" in a good way.

Ever since tech companies started waging war against RSS, podcast distribution became visually RSS-free. What do you do to subscribe? Easy, just search in the app! For the majority of iOS users that app is Apple Podcasts, and recently Google made their own "default client" for Android -- Google Podcasts. It looks like podcast clients are similar to web browsers and just provide a way to consume content, but the underlying listings make them very different. Corresponding services are actually isolated catalogs. When you perform a search on Apple Podcasts, you aren't searching for podcasts. You are searching for Apple-approved podcasts. And if the thing you're looking for is not there, then... well, you get nothing.

Most Podcast clients still accept RSS. Apple Podcasts, iTunes, PocketCasts, OverCast, PodcastAddict. Google Play Music doesn't say anything explicitly, but you can just put RSS URL into the search field and it works. For now. I won't be surprised if these apps gradually and silently remove this feature.

This week's Black Hat event will highlight job-related stress and mental health issues in the cyber workforce. From a report: The thousands of cybersecurity professionals gathering at Black Hat, a massive conference held in the blistering heat of Las Vegas every summer, are encountering a different type of session this year. A new "community" track is offering talks on a range of workplace issues facing defenders battling to protect the world from a hacking onslaught. With titles like "Mental Health Hacks: Fighting Burnout, Depression and Suicide in the Hacker Community" and "Holding on for Tonight: Addiction in Infosec," several of the sessions will address pressures on security teams and the negative impact these can have on workers' wellbeing.

"A lot of people in this space feel strongly about wanting to protect their users," says Jamie Tomasello of Duo Security, who is one of the speakers. "Where this becomes challenging is when people are under sustained high stress. That increases the risk of depression and mental illness." The impact on cyber defenders' lives is deeply concerning, as are the broader implications for security. In spite of a push for greater automation, many tasks in cyber defense are still labor intensive. Workers experiencing mental health issues are more likely to make mistakes and to have performance issues that require colleagues to pick up the slack, increasing the likelihood they will make errors too.