SoylentNews

upstart writes:

Vendors knew all about it, but most customers were clueless:

For more than 25 years, a technology used for critical data and voice radio communications around the world has been shrouded in secrecy to prevent anyone from closely scrutinizing its security properties for vulnerabilities. But now it's finally getting a public airing thanks to a small group of researchers in the Netherlands who got their hands on its viscera and found serious flaws, including a deliberate backdoor.

The backdoor, known for years by vendors that sold the technology but not necessarily by customers, exists in an encryption algorithm baked into radios sold for commercial use in critical infrastructure. It's used to transmit encrypted data and commands in pipelines, railways, the electric grid, mass transit, and freight trains. It would allow someone to snoop on communications to learn how a system works, then potentially send commands to the radios that could trigger blackouts, halt gas pipeline flows, or reroute trains.

Researchers found a second vulnerability in a different part of the same radio technology that is used in more specialized systems sold exclusively to police forces, prison personnel, military, intelligence agencies, and emergency services, such as the C2000 communication system used by Dutch police, fire brigades, ambulance services, and Ministry of Defense for mission-critical voice and data communications. The flaw would let someone decrypt encrypted voice and data communications and send fraudulent messages to spread misinformation or redirect personnel and forces during critical times.

Three Dutch security analysts discovered the vulnerabilities—five in total—in a European radio standard called TETRA (Terrestrial Trunked Radio), which is used in radios made by Motorola, Damm, Hytera, and others. The standard has been used in radios since the '90s, but the flaws remained unknown because encryption algorithms used in TETRA were kept secret until now.

[...] The researchers say anyone using radio technologies should check with their manufacturer to determine if their devices are using TETRA and what fixes or mitigations are available.

Original Submission

hubie writes:

Robots and Rights: Confucianism Offers Alternative:

Philosophers and legal scholars have explored significant aspects of the moral and legal status of robots, with some advocating for giving robots rights. As robots assume more roles in the world, a new analysis reviewed research on robot rights, concluding that granting rights to robots is a bad idea. Instead, the article looks to Confucianism to offer an alternative.

[...] "People are worried about the risks of granting rights to robots," notes Tae Wan Kim, Associate Professor of Business Ethics at CMU's Tepper School of Business, who conducted the analysis. "Granting rights is not the only way to address the moral status of robots: Envisioning robots as rites bearers—not [as] rights bearers—could work better."

[...] Although many believe that respecting robots should lead to granting them rights, Kim argues for a different approach. Confucianism, an ancient Chinese belief system, focuses on the social value of achieving harmony; individuals are made distinctively human by their ability to conceive of interests not purely in terms of personal self-interest, but in terms that include a relational and a communal self. This, in turn, requires a unique perspective on rites, with people enhancing themselves morally by participating in proper rituals.

When considering robots, Kim suggests that the Confucian alternative of assigning rites—or what he calls role obligations—to robots is more appropriate than giving robots rights. The concept of rights is often adversarial and competitive, and potential conflict between humans and robots is concerning.

upstart writes:

ESA awards contract for demo of plane-tracking satellites:

The European Space Agency (ESA) has awarded a contract to a US company to create a technology demonstrator for a proposed aircraft monitoring system using low Earth orbit satellites.

Spire Global, headquartered in San Francisco, won the €16 million ($17.6 million) agreement for the EURIALO project, which aims to prove that a satellite-based system can monitor aircraft in flight for air traffic management purposes, without relying on any existing systems.

[...] The EURIALO project intends to demonstrate the viability of using satellites to track aircraft by determining in real time the aircraft position based on timing the arrival of radio signals detected by multiple satellites, a technique known as multilateration. The radio signals in this case will be standard telecoms radio signals already routinely broadcast by aircraft.

Current monitoring systems largely rely on self-reported positions of aircraft, which are typically obtained from satellite navigation systems. The objective of EURIALO is to provide a complementary tracking system that can feed location data to existing air navigation service providers for integration into their services.

Ultimately, this could help track planes in real time from takeoff to landing anywhere in the world and could more speedily locate aircraft in the event of an emergency. It isn't clear whether such a system would have helped in the infamous case of Malaysia Airlines flight 370, which went missing in 2014, as the aircraft's transponder was apparently switched off mid-flight, as was the Aircraft Communication Addressing and Reporting System (ACARS).

Under the terms of the contract, Spire will develop a design for an operational satellite constellation then deploy and operate a demonstrator mission that proves the performance of the service. It will head up a consortium of other companies as part of the project, including European Satellite Services Provider (ESSP), which was founded by seven air navigation service providers and is based in Toulouse, France.

Original Submission

upstart writes:

Robots—and then humans—are going back to the lunar surface. Here's what they'll be doing:

We're going back to the moon. And back. And back. And back again.

It's been more than 50 years since humans last walked on the lunar surface, but starting this year, an array of missions from private companies and national space agencies plan to take us back, sending everything from small robotic probes to full-fledged human landers.

The ultimate goal? Getting humans living and working on the moon, and then using it as a way station for possible later missions into deep space.

More than a dozen robotic vehicles are scheduled to land on the moon in the 2020s.

[...] These private companies are backed by millions of dollars in government money, driven by NASA's desire to return humans to the moon as part of its Artemis program. NASA wants to expand commercial moon activity in the same way it has helped fund commercial activity in Earth orbit with companies such as SpaceX.

"The goal is we return to the moon, open up a lunar economy, and continue exploring to Mars," says Nujoud Merancy, chief of NASA's Exploration Mission Planning Office at the Johnson Space Center in Texa. The ultimate plan, Merancy says, is to foster a "permanent settlement on the moon."

Not all are convinced, especially when it comes to how companies will make money on lunar missions outside of funding from NASA. "What is the GDP of lunar activities?" says Sinead O'Sullivan, a former senior researcher at Harvard Business School's Institute for Strategy and Competitiveness. "Some commercial economy may evolve, but it's kind of hard to tell."

upstart writes:

Does Intel need the money?

Rumor mill: If you're considering buying an Intel CPU, it might be a good idea to splash out sooner rather than later as they could get a price hike. The claim comes from a new report that states Team Blue is increasing the price of all its Core lineup to help fund new fabs and restructure the company.

Rumors that Intel's Core line is set for a price raise come from German outlet PCGamesHardware. A reader contacted two German wholesalers who reportedly confirmed a letter revealing the hike.

According to the letter, all Core processors that are currently on sale or in production will become more expensive. That covers the Alder Lake (12xxx), Raptor Lake (13xxx), and Raptor Lake Refresh CPUs. It also includes the upcoming Meteor Lake processors that will be the first to drop the "i" and use the Core Ultra branding.

According to the letter, the price increases are related to current and future Intel factories that have to be refinanced. It also states that the company is restructuring.

[...] It was only in January when Intel implemented the last CPU price hike, an estimated 10% rise on the Alder Lake chips' MSRP. It seems quite soon for another rise, but it sounds like Intel could use the money.

Original Submission

upstart writes:

Ivanti rushes to patch zero-day used to breach Norway's government:

Hackers exploited a zero-day flaw in Ivanti's mobile endpoint management software to compromise a dozen Norwegian government agencies — and thousands of other organizations could also be at risk.

The Norwegian Security and Service Organization (DSS) said in a statement on Monday that a "data attack" had struck the IT platform used by 12 government ministries.

[...] The DSS said the attack was the result of a "previously unknown vulnerability in the software of one of our suppliers," but didn't share any further details. However, the Norwegian National Security Authority (NSM) later confirmed that hackers had leveraged the previously undiscovered flaw in Ivanti Endpoint Manager Mobile (EPMM; formerly MobileIron Core), to compromise Norwegian government agencies.

[...] Ivanti's EPMM allows authorized users and devices to access a corporate or government network. The vulnerability, tracked as CVE-2023-35078, is an authentication bypass flaw that affects all supported versions of Ivanti's EPMM software, along with older and unsupported releases. If exploited, the vulnerability allows anyone over the internet to remotely access the software — without needing credentials — to access users' personal information, such as names, phone numbers, and other mobile device details for users on a vulnerable system, as well as make changes to the impacted server.

[...] In a statement to TechCrunch, Ivanti chief security officer Daniel Spicer said that after the company became aware of the vulnerability, it "immediately developed and released a patch and are actively engaging with customers to help them apply the fix," adding that "we are upholding our commitment to deliver and maintain secure products, while practicing responsible disclosure protocols."

However, Ivanti initially kept details of the flaw — which has been given a maximum vulnerability severity rating out 10 out of 10 — behind a paywall, and reportedly asked potentially impacted customers to sign a non-disclosure agreement before sharing details. At the time of writing, Ivanti's Knowledge Base article about the vulnerability still requires users to login before viewing. [Note: Now viewable. -Ed.]

[...] As noted by cybersecurity researcher Kevin Beaumont, the vast majority of impacted organizations — a list which includes numerous U.S. and U.K. government departments — have not yet patched.

Original Submission

Greetings, Soylentils!

I am told by those who know, that 75% of the posters here are still from the original group of people that formed the community when we left Slashdot and created Soylent News. So some of you may remember me (Audioguy, #25) from that time.

Newer people may not know me, as I tend to be pretty quiet most of the time. Mostly I just read the news articles, and quietly do bits of sysadmin work in the background to keep the site up.

Only when I feel the core values of our community project are in danger, or its very existence is threatened, do I come out very publicly, and at such times I can be QUITE vocal.

Now is such a time.

I am about to do something which would not only have been uncontroversial, but normal here until the last six months. In the present climate it will probably piss a few people off.

I am going to update the community on exactly what has been going on behind the scenes here.

"Arthur T Knackerbracket" writes:

Arthur T Knackerbracket has processed the following story:

Ozempic and Wegovy are brand names for the drug semaglutide. Many countries have approved Wegovy for weight loss in people who are obese or overweight and Ozempic for people with type 2 diabetes.

Drugs such as semaglutide mimic the actions of a hormone called glucagon-like peptide-1, or GLP-1. These so-called GLP-1 analogues have several effects, including slowing stomach emptying, acting on the brain to reduce appetite and boosting the release of insulin, which helps to regulate blood sugar levels.

[...] Wegovy leads to about a 15 per cent reduction in body weight over a year, when combined with exercise and eating healthily.

In fact, some people seem to feel that the GLP-1 analogues have caused them to become too gaunt, as reflected in the rise of the search terms “Ozempic face” and “Ozempic butt”. “Ozempic doesn’t do anything specific to the skin,” says Alexander Miras at Ulster University, UK. It is the weight loss that causes these apparent side effects, with similar outcomes often also occurring after weight loss surgery, he says.

Side effects can be mild, such as nausea, constipation and diarrhoea, which tend to occur as people get used to the drug. More worrying side effects include inflammation of the pancreas, although this is relatively rare.

Hair loss has been reported by some semaglutide users. This is also sometimes seen after significant weight loss from other causes, such as stomach surgery, says Miras.

[...] GLP-1 analogues – such as Ozempic and Wegovy – are being investigated by the European Medicines Agency (EMA) after recent reports that they may cause thoughts of suicide or self-harm. This was after Iceland’s health regulator received three such reports regarding semaglutide and another drug called liraglutide, which is an earlier GLP-1 analogue.

The EMA says it is analysing about 150 reports of possible cases of self-injury and suicidal thoughts. This doesn’t mean the medicines caused these effects, however, only that people reported these experiences after starting to take them. “More work is needed to determine if a causal link exists,” says Michael Schwartz at the University of Washington in Seattle.

Original Submission

upstart writes:

A sailor and his dog found after months stranded in the Pacific:

A stranded sailor and his dog have been rescued in the South Pacific Ocean after months at sea, rescuers told Australian media over the weekend.

The sailor, Tim Shaddock, 51, and Bella, the dog, departed from La Paz, Mexico, three months ago. A month into his journey, a storm struck his white catamaran, wiping out all electronics, according to 9News. He says he and Bella survived three months at sea eating raw fish and drinking rainwater.

They were rescued by a Mexican tuna trawler over the weekend, 9News reported.

"I have been through a very difficult ordeal at sea," Shaddock told the channel, adding that he had fishing and other survival gear with him.

[...] Shaddock and Bella were spotted last week by a helicopter accompanying a tuna trawler, which was on its way back to Mexico, according to 9News. It was unclear when Shaddock first left Mexico, and where he and Bella were rescued.

[...] Shaddock said he avoided sunburn by sheltering under his boat's canopy, eating raw fish and drinking rainwater.

[...] Not only did Shaddock have to look after himself, but also his dog, which Tipton said, helped in the pair's survival.

"He had companionship. Once you've got enough food and water, then I think the dog has an advantage," Tipton said. "Your survival time is as long as you can keep collecting water, getting occasional food and doing things that help you stay positive," he added.

Finding Shaddock was like a "needle in a haystack" in the enormous Pacific Ocean, Tipton said, especially since the helicopter was not even actively looking for him.

"It was a combination of luck and the right behavior," he added.

Original Submission

Freeman writes:

https://arstechnica.com/tech-policy/2023/07/twitter-took-x-handle-from-longtime-user-and-only-offered-him-some-merch/

Elon Musk's decision to rebrand Twitter as "X" wouldn't be complete without a change to the company's official Twitter account. The @X handle was already taken by a user who registered it over 16 years ago, but that wasn't much of an obstacle—Twitter simply took over the username and offered its longtime owner some merchandise but no monetary compensation.

San Francisco-based photographer Gene X Hwang was @X on Twitter from March 2007 until yesterday. "They just took it essentially—kinda what I thought might happen," Hwang told The Telegraph. "They did send an email saying it is the property of 'x' essentially."

[...] Hwang was quoted as saying several years ago that he turned down offers as high as $40,000 because he didn't think they were legitimate. "I really didn't entertain any of them seriously," he said at the time.

[...] In January, a New York Times report said that "Twitter has considered selling user names to generate new revenue as its owner, Elon Musk, tries to resuscitate the company's business." Under Musk, Twitter has also gotten more aggressive about purging accounts that seem to be inactive.

Original Submission

upstart writes:

Ironically, despite America's Cold War fears of being nuked by the Soviet Union, the only government that ever nuked us (and nuked us quite a bit) was our own:

The Trinity test and the dozens of nuclear tests that followed were the result of the top secret Manhattan Project, the WWII era U.S. government program that focused on the development of the atomic bomb. [...] The newly published research focuses on "atmospheric tests," meaning tests that impacted the atmosphere, though the U.S. government has also extensively conducted underground nuclear weapons testing, blowing up an estimated 815 subterranean nukes between 1951 and 1998.

The new research on the Trinity and other above-ground nuclear tests uses a combination of data that wasn't previously available for other evaluations. [...] According to the findings of the new study, the Trinity test had a large impact on the total amount of nuclear fallout that has spread throughout the U.S. "Our results show the significant contribution of the Trinity fallout to the total deposition density across the contiguous U.S....and in New Mexico in particular." The report states that fallout from Trinity reached 46 states in just 10 days.

The report notes that of the 101 nuclear tests carried out during the time period studied, 94 of them created radioactive mushroom clouds that subsequently dispersed nuclear fallout across the country.

owl writes:

https://newart.press/p/photocopiers-terrified-the-publishing

"What Hath Xerox Wrought" asked a 1976 Time Magazine headline, the proceeding article prompted readers to imagine if: "some inventive and omnipotent god offered the nation a device that would greatly advance the spread of information."

There was a catch though: the promethean powers afforded by this "green-eyed deus ex machina" would also bring chaos: "In return, the deity required that the President resign, that stacks of sensitive Government and corporate secrets be made public."

The writer was of course referring to the Watergate scandal and Daniel Ellsberg's use of photocopiers to leak the Pentagon Papers to the press. The hypothetical was actually a reality. While the USSR kept strict control over the technology, highly regulating the machines until 1989, the free world was left to deal with the 'consequences' of freedom.

Downsides of this supposed double edge sword - cited in Time - would be encouraging waste and slothfulness, on top of stifling creativity and punching holes in copyright laws. This last issue was of particular concern to publishers and authors, one that had been growing for more than a decade because, as Malcolm McLaren would put it in 1993, "Gutenberg made everyone a reader, Xerox made everyone a publisher..."

Original Submission

upstart writes:

Adverts said Onavo Protect user data would be kept a secret – just didn't say from whom:

On Wednesday, Australia's Federal Court ordered two Meta subsidiaries to pay $14 million after an over two and a half year legal battle instigated by the country's competition regulator found the pair misled users on the data collection of a now defunct VPN app.

[...] Israel-based web analytics company Onavo, maker of free downloadable software application Onavo Protect, was acquired by Facebook in 2013. The narrative from Onavo at the time was that privacy was king. Meanwhile Facebook promised the company would be a separate brand.

But by 2018, researchers were onto the tall tale and found Onavo Protect sent user data to Facebook even when turned off – a situation that was outlined and permitted through its terms and conditions.

According to the ACCC [Australian Competition and Consumer Commission], information collected and aggregated included "users' internet and app activity, such as records of every app they accessed and the number of seconds each day they spent using those apps" for Facebook's commercial benefit.

[...] On Wednesday, the Australian court said that Onavo Inc. and Facebook Israel promoted the VPN during 2016 and 2017 without sufficiently disclosing that data would be used outside of the app.

"If an Australian user of Onavo Protect had a Facebook account, Meta was also able to combine that user's Onavo Protect Data with information that Meta maintained about the user's Facebook account, using an algorithm," wrote Judge Wendy Abraham.

She further noted that internal Meta documents referred to Onavo Protect as a "business intelligence tool," providing "a sample of users who we are able to know nearly everything they are doing on their mobile device." The data was then used for advertising, marketing and improvement of products, services and strategies.

According to the Australian court, the terms and conditions disclosing data use were not sufficient enough to counter advertisements to the contrary. Court documents state that both Facebook Israel and Onavo admit that ads and statements were likely to mislead or deceive.

[...] Abraham said in court documents the fine "carries with it a sufficient sting to ensure that the penalty amount is not such as to be regarded by the parties or others as simply an acceptable cost of doing business."

Original Submission

"Arthur T Knackerbracket" writes:

Arthur T Knackerbracket has processed the following story:

A recently disclosed bug in many of AMD's newer consumer, workstation, and server processors can cause the chips to leak data at a rate of up to 30 kilobytes per core per second, writes Tavis Ormandy, a member of Google's Project Zero security team. Executed properly, the so-called "Zenbleed" vulnerability (CVE-2023-20593) could give attackers access to encryption keys and root and user passwords, along with other sensitive data from any system using a CPU based on AMD's Zen 2 architecture.

[...] The bad news is that the exploit doesn't require physical hardware access and can be triggered by loading JavaScript on a malicious website (according to networking company Cloudflare). The good news is that, at least for now, there don't seem to be any cases of this bug being exploited in the wild yet, though this could change quickly now that the vulnerability has been disclosed, and the bug requires precise timing to exploit.

"AMD is not aware of any known exploit of the described vulnerability outside the research environment," the company told Tom's Hardware. Cloudflare also says there is "no evidence of the bug being exploited" on its servers.

Since the vulnerability is in the hardware, a firmware update from AMD is the best way to fully fix it; Ormandy says it is also fixable via a software update, but it "may have some performance cost." The bug affects all processors based on AMD's Zen 2 architecture, including several Ryzen desktop and laptop processors, EPYC 7002-series chips for servers, and Threadripper 3000- and 3000 Pro WX-series CPUs for workstations.

The article mentions that the firmware update for EPYC 7002 is already out, but updates for consumer-market chips may not be available until December.

Original Submission

owl writes:

https://vivaldi.com/blog/googles-new-dangerous-web-environment-integrity-spec/

Google seems to love creating specifications that are terrible for the open web and it feels like they find a way to create a new one every few months. This time, we have come across some controversy caused by a new Web Environment Integrity spec that Google seems to be working on.

​At this time, I could not find any official message from Google about this spec, so it is possible that it is just the work of some misguided engineer at the company that has no backing from higher up, but it seems to be work that has gone on for more than a year, and the resulting spec is so toxic to the open Web that at this point, Google needs to at least give some explanation as to how it could go so far.

Original Submission