Sci/Tech News for the World

You know that silly fear about Alexa recording everything and leaking it online ? It just happened
▻http://www.theregister.co.uk/2018/05/24/alexa_recording_couple

It’s time to break out your “Alexa, I Told You So” banners – because a Portland, Oregon, couple received a phone call from one of the husband’s employees earlier this month, telling them she had just received a recording of them talking privately in their home. “Unplug your Alexa devices right now,” the staffer told the couple, who did not wish to be fully identified, “you’re being hacked.” At first the couple thought it might be a hoax call. However, the employee – over a hundred miles away (...)

#Amazon #Alexa #Echo #domotique #écoutes #voix

Facial recognition software easily IDs white men, but error rates soar for black women
▻http://www.theregister.co.uk/2018/02/13/facial_recognition_software_is_better_at_white_men_than_black_women

Even with a representative data set to learn from, software gets worse the darker your skin Commercial AI is great at recognising the gender of white men, but not so good at doing the same job for black women. that’s the conclusion of a new study, “Gender Shades : Intersectional Accuracy Disparities in Commercial Gender Classification”, that’s compared gender classifiers developed by Microsoft, IBM and Chinese startup Face++ (also known as Megvii). The study found that all three services (...)

#Apple #Google #IBM #Microsoft #algorithme #Face++ #biométrie #facial #discrimination

##Face++

#Spectre et #Meltdown : deux grosses failles de sécurité sur les processeurs dans nos machines

Quasi toutes les machines à base de processeurs Intel (donc Mac et PC) sont affectés pour Meltdown, ainsi que les AMD et ARM pour Spectre.

Meltdown et Spectre : 7 questions pour comprendre les failles critiques sur les processeurs

▻https://www.numerama.com/tech/318576-meltdown-et-spectre-7-questions-pour-comprendre-les-failles-critiqu ?

Meltdown and Spectre
Bugs in modern computers leak passwords and sensitive
data

▻https://meltdownattack.com

Microsoft issues emergency Windows update for processor security bugs

▻https://www.theverge.com/2018/1/3/16846784/microsoft-processor-bug-windows-10-fix

Meltdown, Spectre : The password theft bugs at the heart of Intel CPUs

▻http://www.theregister.co.uk/2018/01/04/intel_amd_arm_cpu_vulnerability

Failles des processeurs : Intel, AMD et ARM prévenus par Google

▻https://www.generation-nt.com/faille-processeur-google-intel-amd-arm-mletdown-spectre-actualite-194

#bug #hardware #processor #processeur

Leaked : The UK’s secret blueprint with telcos for mass spying on internet, phones – and backdoors
▻http://www.theregister.co.uk/2017/05/04/uk_bulk_surveillance_powers_draft

Real-time full-blown snooping with breakable encryption The UK government has secretly drawn up more details of its new bulk surveillance powers – awarding itself the ability to monitor Brits’ live communications, and insert encryption backdoors by the backdoor. In its draft technical capability notices paper [PDF], all communications companies – including phone networks and ISPs – will be obliged to provide real-time access to the full content of any named individual within one working day, (...)

#MI5 #MI6 #backdoor #écoutes #surveillance #web

One of Biggest Icebergs Ever Recorded Expected to Break Off from Antarctica – gCaptain
▻https://gcaptain.com/one-of-biggest-icebergs-ever-recorded-expected-to-break-off-from-antarctic

https://i2.wp.com/gcaptain.com/wp-content/uploads/2017/01/Ice-rift.jpeg

A giant iceberg the size of Delaware is expected to break away from the Antarctic peninsula, so big it’s likely to be one of the biggest iceberg calving events ever recorded, scientists said Friday.

Researchers at the Swansea University’s College of Science in Wales have been watching the the rift in the Larsen C ice shelf for several years now. The researchers said today the long-running grew suddenly in December and there’s now just 20km of ice keeping the 5,000 sq km piece of ice from floating away.

https://i0.wp.com/gcaptain.com/wp-content/uploads/2017/01/Larsen-C-ice-shelf.jpeg

EU accuses Facebook of providing incorrect info on WhatsApp buy
▻http://www.theregister.co.uk/2016/12/20/eu_charges_facebook_with_misleading_information_during_whatsapp_takeo

Says ability to match FB IDs with WhatsApp ones was there in ’14 Facebook has been accused of providing incorrect information regarding its $22bn (£17.8bn) acquisition of WhatsApp to the European Commission. The commission today sent a Statement of Objections to Facebook alleging the company provided incorrect or misleading information during its investigation into the 2014 merger. It follows WhatsApp’s controversial privacy policy change in August, which said would share some users’ phone (...)

#Facebook #WhatsApp #données

#Anopticon

Anopticon è un progetto di schedatura delle telecamere di videosorveglianza negli spazi pubblici, portato avanti per mezzo della collaborazione di una community di utenti su internet.

Il nome del progetto deriva dall’Anopticon di Umberto Eco, che a sua volta è l’opposto del Panopticon, il carcere immaginato dal filosofo Jeremy Bentham nel 1791. Nell’ambito del progetto al rovesciamento immaginato da Eco (fare in modo che il sorvegliante sia l’unico a poter essere visto senza vedere chi lo osserva), si aggiunge il concetto che inoltre i detenuti guardano, e dunque «sorvegliano» a loro volta, il sorvegliante. Un altro riferimento è al Grande Fratello di George Orwell.

Nel concreto il progetto, attraverso la collaborazione dei propri utenti, ha raccolto la mappatura e la schedatura delle telecamere di videosorveglianza negli spazi pubblici cittadini, allo scopo di definire l’area videosorvegliata della città e di segnalare alle autorità competenti le violazioni della privacy e le telecamere illegali o non segnalate secondo la legge.

Sono state mappate le telecamere delle città di Venezia, Padova, Foggia, Urbino, Solero (provincia di Alessandria), Alessandria, Pisa, Genova, Mestrino, Cassano d’Adda, Bari, Verona, Vico Equense e Roma e ne è stata pubblicata in rete la mappa interattiva (#Big_Brother_viewer). Sul sito è attivo un blog sulla videosorveglianza chiamato #Anoptiblog.

Il progetto si occupa inoltre della censura su siti come Facebook e YouTube e ha prodotto motori di ricerca per la censura su questi due siti (YouTube Hot Crawler, o YTHC e Facebook Hot Crawler) e analisi in tempo reale della censura, con sua mappatura (YouTube Word Counter). Ha pubblicato in rete una lista di video censurati su YouTube.

▻https://it.wikipedia.org/wiki/Anopticon_(progetto)
#vidéosurveillance #cartographie #visualisation #espace_public #Italie #Venise #Padoue #Gênes #Rome

Researcher develops worm to fight Mirai botnet

Researcher Scott Tenaglia found a stack buffer overflow vulnerability in the Mirai code which could be used to crash bots and shut down Mirai attacks.

▻http://www.theregister.co.uk/2016/10/28/mirai_botnet_hack_back

Now, a GitHub user going by Leo Linsky has forked a repo created by researcher Jerry Gamblin to create an anti-worm “nematode” that could help to patch vulnerable devices used in the Mirai DDoS attacks. (the code is unfortunately no longer available)

▻http://www.theregister.co.uk/2016/10/31/this_antiworm_patch_bot_could_silence_epic_mirai_ddos_attack_army

A Nematode is a controlled worm that can be used for beneficial purposes, such as self-healing networks.

The worm goes further and can be used to break into woefully insecure internet-of-things devices and change the default Telnet credentials within.

Doing so would lock Mirai and other malware users out of the devices, along with legitimate administrators.

“This is a purely academic research project intended to show a proof of concept anti-worm worm, or nematode, for the types of vulnerabilities exploited by Mirai,” Linsky says.

"The idea is to show that devices can be patched by a worm that deletes itself after changing the password to something device- specific or random.

Unleashing the nematode would breach computer crime laws in the US, UK, and Australia, and likely in many other countries where unauthorised use and modification of computer equipment is an offense.

More on Mirai

►https://seenthis.net/messages/531503

#Mirai #DDoS #malware

Chinese hacker shows how every every 4G/LTE call can be intercepted

▻http://www.theregister.co.uk/2016/10/23/every_lte_call_text_can_be_intercepted_blacked_out_hacker_finds

Ruxcon Hacker Wanqiao Zhang of Chinese security house Qihoo 360 has blown holes in 4G LTE networks by detailing how to intercept and make calls, send text messages and even force phones offline.

The team tested their work against Frequency Division Duplexing (FDD) LTE networks, which are more popular than Time Division Duplexing (TDD) LTE and are used in Britain, the US, and Australia. The competing TDD-LTE design is more common in Asian countries and in regions where population densities are higher.

[...]

Zhang uses Ravishankar Borgaonkar, and Altaf Shaik’s IMSI catcher with a femtocell to pull off the over-the-air meddling. A series of radio resource control protocol messages using the international mobile subscriber identity (IMSI) numbers captured in the IMSI catcher can be used to trigger a denial of service, place calls and send texts, or intercept communications.

Zhang modified code from the alpha-grade open-source Open LTE project to track network availability updates in the area, which is critical to successfully pulling off the attacks.

She says phone manufacturers should ignore base station redirection commands and instead use automatic searchers to find the best available. This would prevent attackers from forcing LTE devices to connect to malicious stations.

#IMSI #IMSI_Catcher
#4G #LTE
#snooping

ISP Orange accidentally DDoSed French government site

Google.fr, Wikipedia.fr, OVH and other domains were accidentally added to the list of banned sites qualified by the Ministry of Interior as promoting Terrorism.
The result is that anyone visiting sites on these domains were redirected to a page from interior.gouv.fr

The banned websites were accused of providing instructions for carrying out terror attacks or celebrating acts of terrorism.

(which isn’t entirely false actually)

https://pbs.twimg.com/media/Cu9K2xMWgAAPhgC.jpg

Une erreur bloque l’accès à Google pour les clients d’Orange
▻http://www.lemonde.fr/pixels/article/2016/10/17/une-erreur-bloque-l-acces-a-google-pour-les-clients-d-orange_5014900_4408996

#DDoS

Yahoo ! spymasters ! patent ! biometric ! online ! ad ! tracking ! IRL !
▻http://www.theregister.co.uk/2016/10/09/yahoo_billboard

Slow walkers, traffic jams, signs of success. Privacy sell-out Yahoo ! has filed patents for roadside billboards outfitted with biometric spy cameras and microphones to collect data from passers-by. The NSA’s bed warmer described a billboard that contained video and audio collection capabilities, and even retina scans and speech recognition to determine what viewers are looking at or discussing. The P0wnage Palace reckons billboards with rotating advertisements are a relic, and should be (...)

#Yahoo ! #smartphone #géolocalisation #publicité #profiling

##Yahoo_! ##publicité

Top facial recognition algo joins the dots and sees pretend people
▻http://www.theregister.co.uk/2016/08/25/voila_jones_we_can_make_your_facial_recognition_see_a_man_who_isnt_th

He wasn’t there again today, I do wish he would go away How much like a face does an image have to be, to trick the standard Voila-Jones facial recognition algorithm ? Not very much, it turns out. Two researchers from the University of California, Berkeley, have spoofed the algorithm into recognising a handful of dots, barely recognisable as an image, as a human face. Another image, more dense but still random, fooled the algorithm 97 per cent of the time even after it had been printed, (...)

#algorithme #CCTV #facial #surveillance

How many zero-day vulns is Uncle Sam sitting on ? Not as many as you think, apparently
▻http://www.theregister.co.uk/2016/08/05/how_many_zeroday_vulns_is_us_govt_sitting_on

While some fear the US government is hoarding a vast pool of zero-day security vulnerabilities, the reality is that it probably holds just a few dozen, according to a study by Columbia University. In a presentation at the DEF CON hacking conference in Las Vegas today, Jason Healey, senior research scholar in the university’s faculty of international and public affairs, detailed his students’ attempts to ascertain the number of critical bugs stockpiled in secret by the US. By keeping details (...)

#NSA #hacking #surveillance

Your ’intimate personal massager’ - cough - is spying on you
▻http://www.theregister.co.uk/2016/08/07/your_sec_toy_is_spying_on_you_hackers_crack_our_plastic_pals

Bluetooth hack lets Australian researchers reveal your deepest desires DEF CON has a lot of odd talks, but the successful hacking of a vibrator by two Australian researchers drew a big crowd. The two-person team of Goldfisk and Follower got hold of the schematics for the We Vibe 4 Plus, a U-shaped vibrator that can be controlled via Bluetooth using a remote control or a smartphone app. The wireless functions mean the device’s makers had to report its details with the United States the (...)

#hacking

Simply not credible: The extraordinary verdict against the body that hopes to run the internet
▻http://www.theregister.co.uk/2016/08/03/extraordinary_verdict_against_icann/?mt=1470300257409

In an extraordinary judgment, the organization that hopes to take over running the top level of the internet later this year has been slammed by an independent review as at best incompetent and at worst deliberately mendacious.

The decision by ICANN’s Independent Review Panel (IRP) over the organization’s decision to refuse “community” status for three applications covering business suffixes has exposed a level of double-dealing that many suspected occurred in the non-profit organization but has been difficult to prove.

The ICANN Board Governance Committee (BGC) in particular comes under fire for having repeatedly failed to carry out its duties.

Despite serious allegations being made against ICANN’s staff and the “independent” evaluator it had selected – the Economist Intelligence Unit (EIU) – the panel found that the BGC did not carry out any investigation. Instead it had relied solely on material supplied by ICANN’s legal team – the very people at the center of the complaints.

“The BGC failed to address any of these assertions,” the judgment reads. Later: “The BGC admittedly did not examine whether the EIU or ICANN staff engaged in unjustified discrimination or failed to fulfill transparency obligations.”

ICANN hopes to take over functioning of the top level of the internet from the US government in October this year, after which it will be solely responsible for deciding how the internet’s numbering and naming systems are carried out.

A key concern with that move is that ICANN is not sufficiently transparent or accountable. Despite two years of efforts to restructure the organization to make it more accountable, come October the ICANN board will retain complete control over the organization’s decisions and its staff will remain accountable only to the board.

As such, the failure of the board to even look at allegations of staff misbehavior is alarming, given the enormous powers the organization will soon assume.

Les marchands vs Internet : Stop us if you’ve heard this one before : Telcos try to kill net neutrality - The telecom industry is evolving, but dominated by giants - Voici qui ne me semble pas bon, j’attends des versions françaises pour être certain...
▻http://www.theregister.co.uk/2016/07/29/telcos_file_to_overturn_net_neutrality
▻https://en.wikipedia.org/wiki/Telecommunications_industry
#internet #telecom #fai #marchands

Le refus de toute transition, même purement cosmétique, de la « fonction #IANA » (en pratique, une partie du contrôle de la racine du #DNS), à un organisme privé, fait désormais partie de la plate-forme électorale officielle de Trump :

▻http://domainincite.com/20761-cruzs-icann-paranoia-is-now-official-republican-policy
▻http://www.theregister.co.uk/2016/07/19/blocking_iana_transition_republican_policy

#gouvernance_Internet

C’est beau de voir le Parti Républicain défendre l’État (le leur...) contre une boîte privée :-)

Facebook ‘glitch’ that deleted the Philando Castile shooting vid : It was the police – sources
▻http://www.theregister.co.uk/2016/07/08/castile_shooting_police_deletion

Footage vanished on command, not by a tech gremlin The deadly shooting of 32-year-old Philando Castile by a cop during a routine traffic stop in Minnesota on Wednesday just got murkier. Multiple sources have told The Register that police removed video footage of Castile’s death from Facebook, potentially tampering with evidence. Castile, his girlfriend Diamond Reynolds, and her four-year-old daughter were pulled over by police in the Falcon Heights suburb of Minneapolis for a broken tail (...)

#Facebook #censure

“Get ready for Google’s proprietary Android. It’s coming. Google will kick away AOSP for faster upgrades”
▻http://www.theregister.co.uk/2016/06/08/google_is_taking_android_proprietary_heres_how #Android #logiciel_libre #Google

The writing has been on the wall since at least 2013 when Jean-Baptiste Quéru left the #AOSP

Panama Papers hack: Unpatched WordPress, Drupal bugs to blame?
▻http://www.theregister.co.uk/2016/04/07/panama_papers_unpatched_wordpress_drupal

“The lesson of course is patch, patch, PATCH. WordPress has made big strides in this area by allowing for automated security updates and one-click plugin updates. Drupal, however, still requires you to manually install updates, and updating the core Drupal software requires additional efforts that result in people putting off updates for months.”

#Panama_Papers_Wordpress_Drupal_faille_sécurité_clevermarks