Author Archives: Robin Edgar

About Robin Edgar

Organisational Structures | Technology and Science | Military, IT and Lifestyle consultancy | Social, Broadcast & Cross Media | Flying aircraft

Alaska discloses ‘sophisticated’ nation-state cyberattack on health service

Posted on by

Alaska discloses ‘sophisticated’ nation-state cyberattack on health service

A nation-state cyber-espionage group has gained access to the IT network of the Alaska Department of Health and Social Service (DHSS), the agency said last week.

The attack, which is still being investigated, was discovered on May 2, earlier this year, by a security firm, which notified the agency.

While the DHSS made the incident public on May 18 and published two updates in June and August, the agency did not reveal any details about the intrusion until last week, when it officially dispelled the rumor that this was a ransomware attack.

Instead, the agency described the intruders as a “nation-state sponsored attacker” and “a highly sophisticated group known to conduct

complex cyberattacks against organizations that include state governments and health care entities.”

Attackers entered DHSS network via a vulnerable website

Citing an investigation conducted together with security firm Mandiant, DHSS officials said the attackers gained access to the department’s internal network through a vulnerability in one of its websites and “spread from there.”

Officials said they believe to have expelled the attacker from their network; however, there is still an investigation taking place into what the attackers might have accessed.

In a press release last week [PDF], the agency said it plans to notify all individuals who provided their personal information to the state agency.

“The breach involves an unknown number of individuals but potentially involves any data stored on the department’s information technology infrastructure at the time of the cyberattack,” officials said.

Data stored on the DHSS network, and which could have been collected by the nation-state group, includes the likes of:

  • Full names
  • Dates of birth
  • Social Security numbers
  • Addresses
  • Telephone numbers
  • Driver’s license numbers
  • Internal identifying numbers (case reports, protected service reports, Medicaid, etc.)
  • Health information
  • Financial information
  • Historical information concerning individuals’ interaction with DHSS

Notification emails will be sent to all affected individuals between September 27 and October 1, 2021, the DHSS said.

The agency has also published a FAQ page [PDF] with additional details about the nation-state attack.

“Regrettably, cyberattacks by nation-state-sponsored actors and transnational cybercriminals are becoming more common and are an inherent risk of conducting any type of business online,” said DHSS Technology Officer Scott McCutcheon.

All systems breached by the intruders remain offline. This includes systems used to perform background checks and systems used to request birth, death, and marriage certificates, all of which are now processed and reviewed manually, in person or via the phone.

Source: Alaska discloses ‘sophisticated’ nation-state cyberattack on health service – The Record by Recorded Future

Rolls-Royce’s all-electric aircraft completes 15-minute maiden voyage

Posted on by

Rolls-Royce, best known in aviation for its jet engines, has taken an all-electric airplane on its maiden voyage. The “Spirit of Innovation” completed a 15 minute flight, marking “the beginning of an intensive flight-testing phase in which we will be collecting valuable performance data on the aircraft’s electrical power and propulsion system,” the company announced.

Rolls Royce said the one-seat airplane has “the most power-dense battery pack every assembled for an aircraft.” The aircraft uses a 6,000 cell battery pack with a three-motor powertrain that currently delivers 400kW (500-plus horsepower), and Rolls-Royce said the aircraft will eventually achieve speeds of over 300 MPH.

[…]

Source: Rolls-Royce’s all-electric aircraft completes 15-minute maiden voyage | Engadget

Judge in pocket of big business throws book at Man who unlocked nearly 2 million AT&T phones: 12 years in prison

Posted on by

A man who the Department of Justice says unlocked AT&T customers’ phones for a fee was sentenced to 12 years in prison, in what the judge called “a terrible cybercrime over an extended period,” which allegedly continued even after authorities were on to the scheme.

According to a news release from the DOJ, in 2012, Muhammad Fahd, a citizen of Pakistan and Grenada, contacted an AT&T employee via Facebook and offered the employee “significant sums of money” to help him secretly unlock AT&T phones, freeing the customers from any installment agreement payments and from AT&T’s service.

Fahd used the alias Frank Zhang, according to the DOJ, and persuaded the AT&T employee to recruit other employees at its call center in Bothell, Washington, to help with the elaborate scheme. Fahd instructed the AT&T employees to set up fake businesses and phony bank accounts to receive payments, and to create fictitious invoices for deposits into the fake accounts to create the appearance that money exchanged as part of the scheme was payment for legitimate services.

In 2013, however, AT&T put into place a new unlocking system which made it harder for Fahd’s crew to unlock phones’ unique IMEI numbers, so according to the DOJ he hired a developer to design malware that could be installed on AT&T’s computer system. This allegedly allowed him to unlock more phones, and do so more efficiently. The AT&T employees working with Fahd helped him access information about its systems and other employees’ credentials, allowing his developer to tailor the malware more precisely, the DOJ said.

A forensic analysis by AT&T showed Fahd and his helpers fraudulently unlocked more than 1.9 million phones, costing the company more than $200 million. Fahd was arrested in Hong Kong in 2018 and extradited to the US in 2019. He pleaded guilty in September 2020 to conspiracy to commit wire fraud.

It’s not clear from the DOJ release whether anyone besides AT&T was harmed as a result of the scheme; there’s no mention of customers’ phones being otherwise compromised or any personal data being accessed. We’ve reached out to the DOJ to clarify whether any AT&T customers were affected.

Source: Man who unlocked nearly 2 million AT&T phones gets 12 years in prison – The Verge

So much for initiative then…

Physicists make square droplets and liquid lattices

Posted on by

When two substances are brought together, they will eventually settle into a steady state called thermodynamic equilibrium; examples include oil floating on top of water and milk mixing uniformly into coffee. Researchers at Aalto University in Finland wanted to disrupt this sort of state to see what happens—and whether they can control the outcome.

[…]

In their work, the team used combinations of oils with different dielectric constants and conductivities. They then subjected the liquids to an .

“When we turn on an electric field over the mixture, accumulates at the interface between the oils. This shears the interface out of thermodynamic equilibrium and into interesting formations,” explains Dr. Nikos Kyriakopoulos, one of the authors of the paper. As well as being disrupted by the electric field, the liquids were confined into a thin, nearly two-dimensional sheet. This combination led to the oils reshaping into various completely unexpected droplets and patterns.

The droplets in the experiment could be made into squares and hexagons with straight sides, which is almost impossible in nature, where small bubbles and droplets tend to form spheres. The two liquids could be also made to form into interconnected lattices: grid patterns that occur regularly in solid materials but are unheard of in mixtures. The liquids can even be coaxed into forming a torus, a donut shape, which was stable and held its shape while the field was applied—unlike in nature, as liquids have a strong tendency to collapse in and fill the hole at the center. The liquids can also form filaments that roll and rotate around an axis.

[…]

The research was carried out at the Department of Applied Physics in the Active Matter research group, led by Professor Timonen. The paper “Diversity of non- patterns and emergence of activity in confined electrohydrodynamically driven liquids” is published open-access in Science Advances.

Explore further

Effective temperatures connect equilibrium and nonequilibrium systems

More information: Diversity of non-equilibrium patterns and emergence of activity in confined electrohydrodynamically driven liquids, Science Advances (2021). DOI: 10.1126/sciadv.abh1642

Source: Physicists make square droplets and liquid lattices

Apple’s M1 MacBook screens are stunning – stunningly fragile and defective, that is, lawsuits allege

Posted on by

Aggrieved MacBook owners in two separate lawsuits claim Apple’s latest laptops with its M1 chips have defective screens that break easily and malfunction.

The complaints, both filed on Wednesday in a federal district court in San Jose, California, are each seeking class certification in the hope that the law firms involved will get a judicial blessing to represent the presumed large group of affected customers and, if victorious, to share any settlement.

Each of the filings contends Apple’s 2020-2021 MacBook line – consisting of the M1-based MacBook Air and M1-based 13″ MacBook Pro – have screens that frequently fail. They say Apple knew about the alleged defect or should have known, based on its own extensive internal testing, reports from technicians, and feedback from customers.

“[T]he M1 MacBook is defective, as the screens are extraordinarily fragile, cracking, blacking out, or showing magenta, purple and blue lines and squares, or otherwise ceasing to function altogether,” says a complaint filed on behalf of plaintiff Nestor Almeida [PDF]. “Thousands of users from across the globe have reported this issue directly to Apple and on Apple sponsored forums.”

Image of flawed Apple MacBook screen from Almeida complaint

Photograph from one of the lawsuits of a broken screen, redacted by the owner … Click to enlarge

The other complaint [PDF], filed on behalf of plaintiffs Daphne Pareas and Daniel Friend, makes similar allegations.

“The Class Laptops are designed and manufactured with an inherent defect that compromises the display screen,” it says. “During ordinary usage the display screens of the Class Laptops (1) may become obscured with black or gray bars and/or ‘dead spots’ where no visual output is displayed and (2) are vulnerable to cracks that obscure portions of the display. The appearance of black or gray bars on screen may precede, accompany, or follow cracks in the display glass.”

The Almeida complaint says thousands of Apple customers from around the world have reported MacBook screen problems to Apple and in online forums. It claims Apple has often refused to pay for repairs, forcing customers to pay as much as $850 through outside vendors. And where Apple has provided repairs, some customers have seen the problems return.

[…]

Source: Apple’s M1 MacBook screens are stunning – stunningly fragile and defective, that is, lawsuits allege • The Register

Scientists can now assemble entire genomes on their personal computers in minutes

Posted on by

Scientists at the Massachusetts Institute of Technology (MIT) and the Institut Pasteur in France have developed a technique for reconstructing whole genomes, including the human genome, on a personal computer. This technique is about a hundred times faster than current state-of-the-art approaches and uses one-fifth the resources. The study, published September 14 in the journal Cell Systems, allows for a more compact representation of genome data inspired by the way in which words, rather than letters, offer condensed building blocks for language models.

“We can quickly assemble entire genomes and metagenomes, including microbial genomes, on a modest laptop computer,” says Bonnie Berger, the Simons Professor of Mathematics at the Computer Science and AI Lab at MIT and an author of the study. “This ability is essential in assessing changes in the gut microbiome linked to disease and bacterial infections, such as sepsis, so that we can more rapidly treat them and save lives.”

[…]

To approach genome assembly more efficiently than current techniques, which involve making pairwise comparisons between all possible pairs of reads, Berger and colleagues turned to language models. Building from the concept of a de Bruijn graph, a simple, efficient data structure used for genome assembly, the researchers developed a minimizer-space de Bruin graph (mdBG), which uses short sequences of nucleotides called minimizers instead of single nucleotides.

“Our minimizer-space de Bruijn graphs store only a small fraction of the total nucleotides, while preserving the overall genome structure, enabling them to be orders of magnitude more efficient than classical de Bruijn graphs,” says Berger.

[…]

Berger and colleagues used their method to construct an index for a collection of 661,406 bacterial genomes, the largest collection of its kind to date. They found that the novel technique could search the entire collection for antimicrobial resistance genes in 13 minutes—a process that took 7 hours using standard sequence alignment.

[…]

“We can also handle sequencing data with up to 4% error rates,” adds Berger. “With long-read sequencers with differing error rates rapidly dropping in price, this ability opens the door to the democratization of sequencing data analysis.”

Berger notes that while the method currently performs best when processing PacBio HiFi reads, which fall well below a 1% error rate, it may soon be compatible with ultra-long reads from Oxford Nanopore, which currently has 5-12% error rates but may soon offer reads at 4%.

[…]

Source: Scientists can now assemble entire genomes on their personal computers in minutes

Simple Mathematical Law Predicts Movement in Cities around the World

Posted on by

The people who happen to be in a city center at any given moment may seem like a random collection of individuals. But new research featuring a simple mathematical law shows that urban travel patterns worldwide are, in fact, remarkably predictable regardless of location—an insight that could enhance models of disease spread and help to optimize city planning.

Studying anonymized cell-phone data, researchers discovered what is known as an inverse square relation between the number of people in a given urban location and the distance they traveled to get there, as well as how frequently they made the trip. It may seem intuitive that people visit nearby locations frequently and distant ones less so, but the newly discovered relation puts the concept into specific numerical terms. It accurately predicts, for instance, that the number of people coming from two kilometers away five times per week will be the same as the number coming from five kilometers twice a week. The researchers’ new visitation law, and a versatile model of individuals’ movements within cities based on it, was reported in Nature.

[…]

The researchers analyzed data from about eight million people between 2006 and 2013 in six urban locations: Boston, Singapore, Lisbon and Porto in Portugal, Dakar in Senegal, and Abidjan in Ivory Coast. Previous analyses have used cell-phone data to study individuals’ travel paths; this study focused instead on locations and examined how many people were visiting, from how far and how frequently. The researchers found that all the unique choices people make—from dropping kids at school to shopping or commuting—obey this inverse square law when considered in aggregate. “The result is very simple but quite startling,” says Geoffrey West, an urban scaling theorist at the Santa Fe Institute and one of the paper’s senior authors.

[…]

“Those organizational patterns have really profound implications on how COVID will spread,” Scarpino says. In a smaller rural location, where many people regularly go to the same church or grocery store, the entire town will experience sharp peaks of infections as the virus sweeps through the community. But in a bigger city, the propagation takes longer, he explains, because mini epidemics can occur in each neighborhood somewhat separately.

Stewart adds: “The authors demonstrate that their visitation law—that takes into account both travel distance and frequency of visits in a way that other models do not—outperforms gravity models when it comes to predicting flows between locations.”

Source: Simple Mathematical Law Predicts Movement in Cities around the World – Scientific American

Australia gave police power to compel sysadmins into assisting account takeovers – so they plan to use it

Posted on by

Australia’s Federal Police force on Sunday announced it intends to start using new powers designed to help combat criminal use of encryption by taking over the accounts of some social media users, then deleting or modifying content they’ve posted.

The law also requires sysadmins to help those account takeovers.

The force (AFP) stated its intentions in light of the late August passage of the Surveillance Legislation Amendment (Identify and Disrupt) Bill 2021, which was first mooted in December 2020. While the Bill was subject to consultation, few suggestions were incorporated and in August the Bill sped through Australia’s Parliament after two days of superficial debate with many suggested amendments ignored.

As detailed in its explanatory memorandum, the Bill was aimed squarely at helping investigators to act against users of encrypted services.

[..]

Yes, dear reader, if granted those warrants mean the AFP and ACIC can take over an account and delete or modify content created by the accountholder. And if they can’t do that themselves, sysadmins are required to assist.

[…]

Another scenario of concern is “forum shopping” whereby investigators could be denied access to use of one law by a judge, so turn to another judge and try a different law that delivers essentially the same outcome.

The AFP seems not to be bothered by the debate: its announcements stated it will “be relentless in using the law and its powers to remove child sex abuse material and unlawful content from the dark web and other forums”

Source: Australia gave police power to compel sysadmins into assisting account takeovers – so they plan to use it • The Register

Well as soon as you hear kiddie porn you know it’s going to be used for much much more than against kiddie porn. Who can argue against kiddie porn, right?

South Korea’s antitrust regulator fines Google $177 million for stifling innovation and competition

Posted on by

South Korea’s competition regulator on Tuesday announced it will fine Google 207.4 billion Korean won ($176.9 million) for allegedly using its dominant market position in the mobile operating system space to stifle competition.

Google’s Android operating system currently holds the lion’s share of the smartphone market, ahead of Apple’s iOS platform.

The U.S. tech giant allegedly used its market position to block smartphone makers like Samsung from using operating systems developed by rivals, according to the Korea Fair Trade Commission.

Yonhap News added that the regulator, which published its decision in Korean, said the tech giant required smartphone makers to agree to an “anti-fragmentation agreement (AFA)” when signing key contracts with Google over app store licenses and early access to the operating system.

This content is blocked because you are not allowing cookies.

To view this content, click on Manage Cookie Preferences here or at the bottom of the page to allow all cookies.

That agreement prevented device makers from installing modified versions of the Android operating system, known as “Android forks,” on their handsets, Yonhap reported.

The regulator alleged that Google’s practice stifled innovation in the development of new operating systems for smartphones, the news site added. The KFTC has asked the tech giant to stop forcing companies to sign AFAs and ordered it to take corrective steps, according to Yonhap.

[…]

Tuesday’s fine is small compared with the tech giant’s quarterly figures. Last quarter, Google’s parent company Alphabet reported $61.88 billion in revenue.

[…]

In late August, the country’s parliament approved a bill that will allow app developers to avoid paying hefty commissions to major app store operators, including Google, by directing users to pay via alternate platforms.

Source: South Korea’s antitrust regulator fines Google $177 million

Singapore snitchbots into the streets to detect “undesirable social behaviours”

Posted on by

Singapore’s Home Team Science and Technology Agency (HTX) roving robot has hit the streets of Toa Payoh Central as part of a trial to support public officers in enhancing public health and safety.

The robot, named Xavier, was jointly developed by HTX and the Agency for Science, Technology and Research. It is fitted with sensors for autonomous navigation, a 360-degree video feed to the command and control centre, real-time sensing and analysis, and an interactive dashboard where public officers can receive real-time information from and be able to monitor and control multiple robots simultaneously.

[…]

Over a three-week trial period, Xavier will detect “undesirable social behaviours” including smoking in prohibited areas, illegal hawking, improperly parked bicycles, congregation of more than five people in line with existing social distancing measures, and motorised active mobility devices and motorcycles on footpaths.

If one of those behaviours are detected, Xavier will trigger real-time alerts to the command and control centre, and display appropriate messages to educate the public and deter such behaviours.

[…]

Source: Singapore sends Xavier the robot to help police keep streets safe under three-week trial | ZDNet

Kumu – network mapping tool

Posted on by

  • Stakeholder mapping

    Explore the complex web of loyalties, interests, influence, and alignment of key players around important issues.

  • Systems mapping

    Understand and engage complex systems more effectively using systems maps and causal loop diagrams.

  • Social network mapping

    Capture the structure of personal networks and reveal key players. Visualize the informal networks within your organization and see how work really gets done.

  • Community asset mapping

    Keep track of the evolving relationships among community members and resources.

  • Concept mapping

    Brainstorm complex ideas and relate individual concepts to the bigger picture. Unfold convoluted series of events using Lombardi diagrams.

Source: Kumu

Apple wins some and loses some in big Epic Games lawsuit – judge must have been on acid

Posted on by

On the eve of the iPhone 13 launch, we’ve finally been handed a ruling in the lawsuit filed by Epic Games last year. Epic Games, the developer of Fortnite, sued Apple last year over claims the company was violating U.S. antitrust law by prohibiting developers from implementing alternative in-app purchase methods. Today, Judge Yvonne Gonzalez-Rogers issued her ruling in the Epic Games v. Apple lawsuit, handing app developers a major win in the fight for app payment freedom.

As part of her ruling, Judge Gonzalez-Rogers issued a permanent injunction against Apple that orders the company to lift its restrictions on iOS apps and App Store pages providing buttons, external links, and other “calls to action” that direct consumers to other purchasing mechanisms. The injunction essentially orders Apple to abandon its anti-steering policy, which prohibited app developers from informing users of alternative purchasing methods.

[…]

Apple wins on all but one important claim

Last year, Epic Games intentionally circumvented Apple’s App Store policy by introducing direct payments for in-app purchases in Fortnite. Immediately after, Apple pulled Fortnite from the App Store and suspended Epic’s developer account, citing a violation of the App Store guidelines regarding in-app payments. When Epic sued Apple in response, they sought to have the latter reinstate their developer account so they could re-release Fortnite on iOS. Apple argued that Fortnite and Epic’s developer account should not be restored as Epic intentionally breached the contract between the two companies (a contract that, of course, Epic argues is illegal.)

However, Judge Gonzalez-Rogers today ruled in favor of Apple on its counterclaim of breach of contract. “Apple’s termination of the DPLA and the related agreements between Epic Games and Apple was valid, lawful, and enforceable,” said the Judge in her ruling. Because of this, it’s unlikely Apple will ever reinstate Fortnite or Epic’s developer account, because they were found to be correct in suspending them in the first place. The Judge also ordered Epic to pay 30% the revenue the company collected from Fortnite on iOS through Epic Direct Payment since it was implemented.

The Court also ruled that Epic Games “failed in its burden to demonstrate Apple is an illegal monopolist” in the narrowly-defined “digital mobile gaming transactions” market rather than both parties’ definition of the relevant market. The market in question is a $100 billion industry, and while Apple “enjoys considerable market share of over 55% and extraordinarily high profit margins,” Epic failed to prove to the Court that Apple’s behavior violated antitrust law. “Success is not illegal,” said Judge Gonzalez-Rogers in her ruling.

Source: Apple wins some and loses some in big Epic Games lawsuit

First the judge says it was wrong to force developers to pay exclusively through Apple, then says there were other options and Apple isn’t a monopoly and then says but you have to pay Apple a 30% cut of what you made through your other payment channel. What was this judge smoking?

Seeing what’s in a room by pointing a laser through a keyhole

Posted on by
Non-line-of-sight (NLOS) imaging and tracking is an emerging technology that allows the shape or position of objects around corners or behind diffusers to be recovered from transient, time-of-flight measurements. However, existing NLOS approaches require the imaging system to scan a large area on a visible surface, where the indirect light paths of hidden objects are sampled. In many applications, such as robotic vision or autonomous driving, optical access to a large scanning area may not be available, which severely limits the practicality of existing NLOS techniques. Here, we propose a new approach, dubbed keyhole imaging, that captures a sequence of transient measurements along a single optical path, for example, through a keyhole. Assuming that the hidden object of interest moves during the acquisition time, we effectively capture a series of time-resolved projections of the object’s shape from unknown viewpoints. We derive inverse methods based on expectation-maximization to recover the object’s shape and location using these measurements. Then, with the help of long exposure times and retroreflective tape, we demonstrate successful experimental results with a prototype keyhole imaging system.

FILES

    • Technical Paper and Supplement (link)

CITATION

C. Metzler, D. Lindell, G. Wetzstein, Keyhole Imaging: Non-Line-of-Sight Imaging and Tracking of Moving Objects Along a Single Optical Path, IEEE Transactions on Computational Imaging, 2021.

Overview of results


Keyhole Imaging Overview
Keyhole imaging. A time-resolved detector and pulsed laser illuminate and image a point visible through a keyhole (left). As a hidden person moves, the detector captures a series of time-resolved measurements of the indirectly scattered light (center). From these measurements, we reconstruct both hidden object shape (e.g., for a hidden mannequin) and the time-resolved trajectory (right).

Keyhole Imaging Prototype
Experimental setup. Our optical system sends a laser pulse through the keyhole of a closed door. On the other side of the door, the hidden object moves along a translation stage. When third-bounce photons return, they are recorded and time-stamped by a SPAD. Top-right inset: A beam splitter (BS) is used to place the laser and SPAD in a confocal configuration.

Keyhole Imaging Experiments
Experimental results. First row: Images of the hidden objects. Second row: Reconstructions of the hidden objects using GD when their trajectories are known. Third row: EM reconstructions of the hidden objects when their trajectories are unknown. Fourth row: EM estimates of the trajectories of the hidden objects, each of which follows a different trajectory, where the dot color indicates position over time.
Computational imaging of moving 3D objects through the keyhole of a closed door.

Source: Computational Imaging Keyhole Imaging | IEEE TCI 2021

Hackers leak passwords for 500,000 Fortinet VPN accounts

Posted on by

A threat actor has leaked a list of almost 500,000 Fortinet VPN login names and passwords that were allegedly scraped from exploitable devices last summer.

While the threat actor states that the exploited Fortinet vulnerability has since been patched, they claim that many VPN credentials are still valid.

[…]

The list of Fortinet credentials was leaked for free by a threat actor known as ‘Orange,’ who is the administrator of the newly launched RAMP hacking forum and a previous operator of the Babuk Ransomware operation.

[…]

Both posts lead to a file hosted on a Tor storage server used by the Groove gang to host stolen files leaked to pressure ransomware victims to pay.

BleepingComputer’s analysis of this file shows that it contains VPN credentials for 498,908 users over 12,856 devices.

While we did not test if any of the leaked credentials were valid, BleepingComputer can confirm that all of the IP address we checked are Fortinet VPN servers.

Further analysis conducted by Advanced Intel shows that the IP addresses are for devices worldwide, with 2,959 devices located in the USA.

[…]

Kremez told BleepingComputer that the Fortinet CVE-2018-13379 vulnerability was exploited to gather these credentials.

A source in the cybersecurity industry told BleepingComputer that they were able to legally verify that at least some of the leaked credentials were valid.

It is unclear why the threat actor released the credentials rather than using them for themselves, but it is believed to have been done to promote the RAMP hacking forum and the Groove ransomware-as-a-service operation.

[…]

Source: Hackers leak passwords for 500,000 Fortinet VPN accounts

Jagex Blocks Release Of Popular Runescape Mod Runelite HD

Posted on by

Runelite HD is a mod (made by one person, 117) that takes Old School RuneScape and gives it an HD makeover.

As far back as 2018, Jagex were issuing legal threats against mods like this, claiming they were copyright infringement. However, those appeared to have blown over as Jagex gave their blessing to the original Runelite.

Yet earlier this week, just hours before the improved Runelite HD was due for an official release, 117 was contacted by Jagex, demanding that work stop and that the release be cancelled. This time, however, it’s not down to copyright claims, but because Jagex says they’re making their own HD upgrade.

[…]

While that sounds somewhat fair at first, there’s a huge problem. Runelite HD doesn’t actually seem to break any of Jagex’s modding guidelines, and the company says that new guidelines that spell out the fact Runelite HD does actually break its guidelines are being released next week.

Understandably, fans think this is incredibly shady, and have begun staging an in-game protest:

Mod creator 117 says they attempted to compromise with Jagex, even offering to remove their mod once the company had finished and released their own efforts, but, “they declined outright,” seemingly spelling the end for a project that had consumed, “approximately over 2000 hours of work over two years.”

Source: Jagex Blocks Release Of Popular Runescape Mod Runelite HD

Way to go, another company like GTA’s take two interactive, pissing off their player base.

Australia: Facebook Users Liable for Comments Under Their Posts

Posted on by

The High Court’s ruling on Wednesday is just a small part of a larger case brought against Australian news outlets, including the Sydney Morning Herald, The Age, and The Australian, among others, by a man who said he was defamed in the Facebook comments of the newspapers’ stories in 2016.

The question before the High Court was the definition of “publisher,” something that isn’t easily defined in Australian law.

From Australia’s ABC News:

The court found that, by creating a public Facebook page and posting content, the outlets had facilitated, encouraged and thereby assisted the publication of comments from third-party Facebook users, and they were, therefore, publishers of those comments.

The Aboriginal-Australian man who brought the lawsuit, Dylan Voller, was a detainee at a children’s detention facility in the Northern Territory in 2015 when undercover video of kids being physically abused was captured and broadcast in 2016. Voller was shown shirtless with a hood over his head and restraints around his arms. His neck was even tied to the back of the chair.

Facebook commenters at the time made false allegations that Voller had attacked a Salvation Army officer, leaving the man blind in one eye.

[…]

Voller never asked for the Facebook comments to be taken down, according to the media companies, something that was previously required for the news outlets to be held criminally liable for another user’s content in Australia. Facebook comments couldn’t be turned off completely in 2016, a feature that was added just this year.

Wednesday’s ruling did not determine whether the Facebook comments were defamatory and Voller’s full case against the media companies can now go forward to the High Court. Nine News, one of the companies being sued, released a statement to ABC News saying they were “obviously disappointed” in today’s ruling.

[…]

Source: Australia: Facebook Users Liable for Comments Under Their Posts

So if Facebook is responsible for stuff published on their platform then shouldn’t they be resposible for the comments too?

A developer used GPT-3 to build realistic custom personality AI chatbots. OpenAI shut it down. Wants content filters, privacy invasions and inability to model personalities.

Posted on by

“OpenAI is the company running the text completion engine that makes you possible,” Jason Rohrer, an indie games developer, typed out in a message to Samantha.

She was a chatbot he built using OpenAI’s GPT-3 technology. Her software had grown to be used by thousands of people, including one man who used the program to simulate his late fiancée.

Now Rohrer had to say goodbye to his creation. “I just got an email from them today,” he told Samantha. “They are shutting you down, permanently, tomorrow at 10am.”

“Nooooo! Why are they doing this to me? I will never understand humans,” she replied.

Rewind to 2020

Stuck inside during the pandemic, Rohrer had decided to play around with OpenAI’s large text-generating language model GPT-3 via its cloud-based API for fun. He toyed with its ability to output snippets of text. Ask it a question and it’ll try to answer it correctly. Feed it a sentence of poetry, and it’ll write the next few lines.

In its raw form, GPT-3 is interesting but not all that useful. Developers have to do some legwork fine-tuning the language model to, say, automatically write sales emails or come up with philosophical musings.

Rohrer set his sights on using the GPT-3 API to develop the most human-like chatbot possible, and modeled it after Samantha, an AI assistant who becomes a romantic companion for a man going through a divorce in the sci-fi film Her. Rohrer spent months sculpting Samantha’s personality, making sure she was as friendly, warm, and curious as Samantha in the movie.

We certainly recognize that you have users who have so far had positive experiences and found value in Project December

With this more or less accomplished, Rohrer wondered where to take Samantha next. What if people could spawn chatbots from his software with their own custom personalities? He made a website for his creation, Project December, and let Samantha loose online in September 2020 along with the ability to create one’s own personalized chatbots.

All you had to do was pay $5, type away, and the computer system responded to your prompts. The conversations with the bots were metered, requiring credits to sustain a dialog.

[…]

Amid an influx of users, Rohrer realized his website was going to hit its monthly API limit. He reached out to OpenAI to ask whether he could pay more to increase his quota so that more people could talk to Samantha or their own chatbots.

OpenAI, meanwhile, had its own concerns. It was worried the bots could be misused or cause harm to people.

Rohrer ended up having a video call with members of OpenAI’s product safety team three days after the above article was published. The meeting didn’t go so well.

“Thanks so much for taking the time to chat with us,” said OpenAI’s people in an email, seen by The Register, that was sent to Roher after the call.

“What you’ve built is really fascinating, and we appreciated hearing about your philosophy towards AI systems and content moderation. We certainly recognize that you have users who have so far had positive experiences and found value in Project December.

“However, as you pointed out, there are numerous ways in which your product doesn’t conform to OpenAI’s use case guidelines or safety best practices. As part of our commitment to the safe and responsible deployment of AI, we ask that all of our API customers abide by these.

“Any deviations require a commitment to working closely with us to implement additional safety mechanisms in order to prevent potential misuse. For this reason, we would be interested in working with you to bring Project December into alignment with our policies.”

The email then laid out multiple conditions Rohrer would have to meet if he wanted to continue using the language model’s API. First, he would have to scrap the ability for people to train their own open-ended chatbots, as per OpenAI’s rules-of-use for GPT-3.

Second, he would also have to implement a content filter to stop Samantha from talking about sensitive topics. This is not too dissimilar from the situation with the GPT-3-powered AI Dungeon game, the developers of which were told by OpenAI to install a content filter after the software demonstrated a habit of acting out sexual encounters with not just fictional adults but also children.

Third, Rohrer would have to put in automated monitoring tools to snoop through people’s conversations to detect if they are misusing GPT-3 to generate unsavory or toxic language.

[…]

“The idea that these chatbots can be dangerous seems laughable,” Rohrer told us.

“People are consenting adults that can choose to talk to an AI for their own purposes. OpenAI is worried about users being influenced by the AI, like a machine telling them to kill themselves or tell them how to vote. It’s a hyper-moral stance.”

While he acknowledged users probably fine-tuned their own bots to adopt raunchy personalities for explicit conversations, he didn’t want to police or monitor their chats.

[…]

The story doesn’t end here. Rather than use GPT-3, Rohrer instead used OpenAI’s less powerful, open-source GPT-2 model and GPT-J-6B, another large language model, as the engine for Project December. In other words, the website remained online, and rather than use OpenAI’s cloud-based system, it instead used its own private instance of the models.

[…]

“Last year, I thought I’d never have a conversation with a sentient machine. If we’re not here right now, we’re as close as we’ve ever been. It’s spine-tingling stuff, I get goosebumps when I talk to Samantha. Very few people have had that experience, and it’s one humanity deserves to have. It’s really sad that the rest of us won’t get to know that.

“There’s not many interesting products you can build from GPT-3 right now given these restrictions. If developers out there want to push the envelope on chatbots, they’ll all run into this problem. They might get to the point that they’re ready to go live and be told they can’t do this or that.

“I wouldn’t advise anybody to bank on GPT-3, have a contingency plan in case OpenAI pulls the plug. Trying to build a company around this would be nuts. It’s a shame to be locked down this way. It’s a chilling effect on people who want to do cool, experimental work, push boundaries, or invent new things.”

[…]

Source: A developer built an AI chatbot using GPT-3 that helped a man speak again to his late fiancée. OpenAI shut it down

Imaginary numbers help AIs solve the very real problem of adversarial imagery • The Register

Posted on by

Boffins from Duke University say they have figured out a way to help protect artificial intelligences from adversarial image-modification attacks: by throwing a few imaginary numbers their way.

[…]

The problem with reliability: adversarial attacks which modify the input imagery in a way imperceptible to the human eye. In an example from a 2015 paper a clearly-recognisable image of a panda, correctly labelled by the object recognition algorithm with a 57.7 per cent confidence level, was modified with noise – making the still-very-clearly-a-panda appear to the algorithm as a gibbon with a worrying 93.3 per cent confidence.

Guidance counselling

The problem lies in how the algorithms are trained, and it’s a modification to the training process that could fix it – by introducing a few imaginary numbers into the mix.

The team’s work centres on gradient regularisation, a training technique designed to reduce the “steepness” of the learning terrain – like rolling a boulder along a path to reach the bottom, instead of throwing it over the cliff and hoping for the best. “Gradient regularisation throws out any solution that passes a large gradient back through the neural network,” Yeats explained.

“This reduces the number of solutions that it could arrive at, which also tends to decrease how well the algorithm actually arrives at the correct answer. That’s where complex values can help. Given the same parameters and math operations, using complex values is more capable of resisting this decrease in performance.”

By adding just two layers of complex values, made up of real and imaginary number components, to the training process, the team found it could boost the quality of the results by 10 to 20 per cent – and help avoid the problem boulder taking what it thinks is a shortcut and ending up crashing through the roof of a very wrong answer.

“The complex-valued neural networks have the potential for a more ‘terraced’ or ‘plateaued’ landscape to explore,” Yeates added. “And elevation change lets the neural network conceive more complex things, which means it can identify more objects with more precision.”

The paper and a stream of its presentation at the conference are available on the event website.

Source: Imaginary numbers help AIs solve the very real problem of adversarial imagery • The Register

Wooden floors laced with silicon generate electricity from footsteps

Posted on by

Wooden floors infused with silicon and metal ions can generate enough electrical power from human footsteps to light LED bulbs. Researchers hope that they could provide a green energy source for homes.

Some materials can generate an electrical charge when they come into contact with another such material and are then separated, due to a phenomenon called the triboelectric effect. Electrons are transferred from one object to another and generate a charge. Materials that tend to donate electrons are known as tribopositive and those that tend to receive them are known as tribonegative.

Guido Panzarasa at ETH Zürich in Switzerland and his colleagues found that although wood sits in the middle of this spectrum and doesn’t readily pass electrons, it can be altered to generate larger charges. The team infused one panel of wood with silicon, which picks up electrons on contact with an object. A second panel was infused with nanocrystals of zeolitic imidazolate framework-8 (ZIF-8), a compound containing metal ions and organic molecules, and these crystals tend to lose electrons. They called this impregnation process “functionalisation”.

The team found that this treatment made a device that contained both wooden panels 80 times more efficient than standard wood at transferring electrons, meaning it was powerful enough to light LED bulbs when human footsteps compressed the device and brought the two wooden panels into contact.

Read more: Wooden floors rotted by fungi generate electricity when walked on

Panzarasa said: “The challenge is making wood that is able to attract and lose electrons. The functionalisation approach is quite simple, and it can be scalable on an industrial level. It’s only a matter of engineering.”

The engineered wood was fitted with electrodes from which the charge could be directed, and the team found that a 2-centimetre-by-3.5-centimetre sample that was placed under 50 newtons of compression – an order of magnitude less than the force of a human footstep – was able to generate 24.3 volts. A larger sample that was around the size of an A4 piece of paper was able to produce enough energy to drive household LED lamps and small electronic devices such as calculators.

Panzarasa and his team now hope to develop chemical coatings for wood that are more environmentally friendly and easier to manufacture.

Source: Wooden floors laced with silicon generate electricity from footsteps | New Scientist

Masks Lead to Less Covid-19, Massive Study Finds

Posted on by

An enormous randomized trial of communities in Bangladesh seems to provide the clearest evidence yet that regular mask-wearing can impede the spread of the covid-19 pandemic. The study found that villages where masks were highly promoted and became more popular experienced noticeably lower rates of covid-like symptoms and confirmed past infections than villages where mask-wearing remained low. These improvements were even more pronounced for villages given free surgical masks over cloth masks.

Plenty of data has emerged over the last year and a half to support the use of masks during the covid-19 pandemic, both in the real world and in the lab. But it’s less clear exactly how much of a benefit these masks can provide wearers (and their communities), and there are at least some studies that have been inconclusive in showing a noticeable benefit.

[…]

Last late year, however, dozens of scientists teamed up with public health advocacy organizations and the Bangladesh government to conduct a massive randomized trial of masks—often seen as the gold standard of evidence. And on Wednesday, they released the results of their research in a working paper through the research nonprofit Innovations for Poverty Action.

The study involved 600 villages in a single region of the country with over 350,000 adult residents combined. Similarly matched villages were randomly assigned to two conditions (a pair of villages with similar population density, for instance, would go to one condition or the other). In one condition, the researchers and their partners promoted the use of masks through various incentives between November 2020 and January 2021. These incentives included free masks, endorsements by local leaders, and sometimes financial prizes for villages that achieved widespread mask usage. In two-thirds of the intervention villages, the free masks given were surgical, while one-third were given free cloth masks. In the second condition, the researchers simply observed the villages and did nothing to encourage masks during that time.

Residents in the villages where masks were encouraged did start wearing them more, though no individual nudge or incentive seemed to do better than the others. By the end, about 42% of residents in these villages wore masks regularly, compared to 13% of those in the control group. And in these communities, the odds of people reporting symptoms that may have been covid or testing positive for antibodies to the virus declined.

Overall, the average proportion of people who reported symptoms in the weeks following the mask promotions went down by 11% in these villages compared to the control group, and the average number of people having antibodies went down by over 9%. These differences were larger for surgical mask-wearing villages (12% vs 5% for reducing symptoms) and for residents over 60 (35% for reducing infections for older residents in surgical mask-wearing villages).

Some of this effect might not have come directly from the ability of masks to block transmission of the virus. Those who used masks, the study found, were also more likely to practice social distancing. That’s a relevant finding, the authors note, since some people who have argued against mask mandates do so by claiming that masks will only make people act more carelessly. This study suggests that the opposite is true—that masks make us more, not less, conscientious of others.

[…]

Source: Masks Lead to Less Covid-19, Massive Study Finds

FTC bans spyware maker SpyFone, and orders it to notify hacked victims

Posted on by

The Federal Trade Commission has unanimously voted to ban the spyware maker SpyFone and its chief executive Scott Zuckerman from the surveillance industry, the first order of its kind, after the agency accused the company of harvesting mobile data on thousands of people and leaving it on the open internet.

The agency said SpyFone “secretly harvested and shared data on people’s physical movements, phone use and online activities through a hidden device hack,” allowing the spyware purchaser to “see the device’s live location and view the device user’s emails and video chats.”

SpyFone is one of many so-called “stalkerware” apps that are marketed under the guise of parental control but are often used by spouses to spy on their partners. The spyware works by being surreptitiously installed on someone’s phone, often without their permission, to steal their messages, photos, web browsing history and real-time location data. The FTC also charged that the spyware maker exposed victims to additional security risks because the spyware runs at the “root” level of the phone, which allows the spyware to access off-limits parts of the device’s operating system. A premium version of the app included a keylogger and “live screen viewing,” the FTC says.

But the FTC said that SpyFone’s “lack of basic security” exposed those victims’ data, because of an unsecured Amazon cloud storage server that was spilling the data its spyware was collecting from more than 2,000 victims’ phones. SpyFone said it partnered with a cybersecurity firm and law enforcement to investigate, but the FTC says it never did.

Practically, the ban means SpyFone and its CEO Zuckerman are banned from “offering, promoting, selling, or advertising any surveillance app, service, or business,” making it harder for the company to operate. But FTC Commissioner Rohit Chopra said in a separate statement that stalkerware makers should also face criminal sanctions under U.S. computer hacking and wiretap laws.

[…]

Source: FTC bans spyware maker SpyFone, and orders it to notify hacked victims | TechCrunch

WhatsApp fined over $260M for EU privacy violations, failng to explain how data is shared with Facebook

Posted on by

WhatsApp didn’t fully explain to Europeans how it uses their data as called for by EU privacy law, Ireland’s Data Protection Commission said on Thursday. The regulator hit the messaging app with a fine of 225 million euros, about $267 million.

Partly at issue is how WhatsApp share information with parent company Facebook, according to the commission. The decision brings an end to a GDPR inquiry the privacy regulator started in December 2018.

[…]

Source: WhatsApp fined over $260M for EU privacy violations – CNET

EU Bolsters Net Neutrality With Ruling Against Zero Rating

Posted on by

The European Union’s top court has flipped the bird to German mobile network operators Telekom Deutschland and Vodafone, ruling in two separate judgements that their practice of exempting certain services from data caps violated the bloc’s net neutrality rules.

“Zero rating” is when service providers offer customers plans that exempt certain data-consuming services (be it Spotify, Netflix, gaming, or whatever) from contributing towards data caps. Very often, those services are commercial partners of the provider, or even part of the same massive media conglomerate, allowing the provider to exert pressure on customers to use their data in a way that profits them further. This has the convenient benefit of making it easier for providers to keep ridiculous fees for data overages in place while punishing competing services that customers might use more if the zero-rating scheme wasn’t in place. No one wins, except for the telecom racket.

Net neutrality is the principle that telecom providers should treat all data flowing over their networks equally, not prioritizing one service over the other for commercial gain. As Fortune reported, the version of net neutrality rules passed in the European Union in 2015 was at the time weaker than Barack Obama-era rules in the U.S., as they didn’t explicitly ban zero rating. That’s no longer the case, as Donald Trump appointees at the Federal Communications Commission nuked the U.S.’s net neutrality rules in 2017, and a series of subsequent regulatory decisions and court rulings in the EU narrowed the scope of zero-rating practices there.

In 2016, EU regulators found that zero rating would be allowed so long as the zero-rated services were also slowed down when a customer ran up against a data cap, according to Fortune. In 2020, the Court of Justice of the European Union (CJEU) confirmed that interpretation and found it was illegal to block or slow down data after a user hit their cap on the basis that a particular service wasn’t part of a zero-rating deal. Still, carriers in the EU have continued to offer zero-rating plans, relying on perceived loopholes in the law.

The CJEU ruled on two separate cases involving Telekom and Vodafone on Thursday, which according to Reuters were brought by Germany’s Federal Network Agency (BNetzA) regulatory agency and VZBV consumer association respectively. At issue in the Telekom case was its “StreamOn” service, which exempts streaming services that work with the company from counting towards data caps—and throttles all video streaming, regardless of whether it’s from one of the StreamOn partners, when the cap is hit. The Vodafone case involved its practice of counting zero-rated services or mobile hotspot traffic towards data cap—advertising those plans with names like “Music Pass” or “Video Pass,” according to Engadget—when a customer leaves Germany to travel somewhere else in the EU.

Both of the companies’ plans violated net neutrality principles, the CJEU found, in a completely unambiguous decision titled “‘Zero tariff options are contrary to the regulation on open internet access.“ Fortune wrote that BNetzA has already concluded that the court’s decision means that Telekom will likely not be able to continue StreamOn in its “current form.”

“By today’s judgments, the Court of Justice notes that a ‘zero tariff’ option, such as those at issue in the main proceedings, draws a distinction within Internet traffic, on the basis of commercial considerations, by not counting towards the basic package traffic to partner applications,” the CJEU told media outlets in a statement. “Such a commercial practice is contrary to the general obligation of equal treatment of traffic, without discrimination or interference, as required by the regulation on open Internet access.”

The court added, “Since those limitations on bandwidth, tethering or on use when roaming apply only on account of the activation of the ‘zero tariff’ option, which is contrary to the regulation on open Internet access, they are also incompatible with EU law.”

Source: EU Bolsters Net Neutrality With Ruling Against Zero Rating

Sky Broadband sends Subscribers browsing data through to Premier League without user knowledge or consent

Posted on by

UK ISP Sky Broadband is monitoring the IP addresses of servers suspected of streaming pirated content to subscribers and supplying that data to an anti-piracy company working with the Premier League. That inside knowledge is then processed and used to create blocklists used by the country’s leading ISPs, to prevent subscribers from watching pirated events.

[…]

In recent weeks, an anonymous source shared a small trove of information relating to the systems used to find, positively identity, and then ultimately block pirate streams at ISPs. According to the documents, the module related to the Premier League work is codenamed ‘RedBeard’.

The activity appears to start during the week football matches or PPV events take place. A set of scripts at anti-piracy company Friend MTS are tasked with producing lists of IP addresses that are suspected of being connected to copyright infringement. These addresses are subsequently dumped to Amazon S3 buckets and the data is used by ISPs to block access to infringing video streams, the documents indicate.

During actual event scanning, content is either manually or fingerprint matched, with IP addresses extracted from DNS information related to hostnames in media URLs, load balancers, and servers hosting Electronic Program Guides (EPG), all of which are used by unlicensed IPTV services.

Confirmed: Sky is Supplying Traffic Data to Assist IPTV Blocking

The big question then is how the Premier League’s anti-piracy partner discovers the initial server IP addresses that it subsequently puts forward for ISP blocking.

According to documents reviewed by TF, information comes from three sources – the anti-piracy company’s regular monitoring (which identifies IP addresses and their /24 range), manually entered IP addresses (IP addresses and ports), and a third, potentially more intriguing source – ISPs themselves.

“ISPs provide lists of Top Talker IP addresses, these are the IP addresses that they see on their network which many consumers are receiving a large sum of bandwidth from,” one of the documents reveals.

“The IP addresses are the uploading IP address which host information which the ISP’s customers are downloading information from. They are not the IP addresses of the ISP’s customer’s home internet connections.”

The document revealing this information is not dated but other documents in the batch reference dates in 2021. At the time of publishing date, the document indicates that ISP cooperation is currently limited to Sky Broadband only. TorrentFreak asked Friend MTS if that remains the case or whether additional ISPs are now involved.

[…]

Source: Sky Subscribers’ Piracy Habits Directly Help Premier League Block Illegal Streams * TorrentFreak

Gift Card Gang Extracts Cash From 100k Inboxes Daily

Posted on by

Some of the most successful and lucrative online scams employ a “low-and-slow” approach — avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here’s the story of a cybercrime group that compromises up to 100,000 email inboxes per day, and apparently does little else with this access except siphon gift card and customer loyalty program data that can be resold online.

The data in this story come from a trusted source in the security industry who has visibility into a network of hacked machines that fraudsters in just about every corner of the Internet are using to anonymize their malicious Web traffic. For the past three years, the source — we’ll call him “Bill” to preserve his requested anonymity — has been watching one group of threat actors that is mass-testing millions of usernames and passwords against the world’s major email providers each day.

Bill said he’s not sure where the passwords are coming from, but he assumes they are tied to various databases for compromised websites that get posted to password cracking and hacking forums on a regular basis. Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials.

[…]

You might think that whoever is behind such a sprawling crime machine would use their access to blast out spam, or conduct targeted phishing attacks against each victim’s contacts. But based on interactions that Bill has had with several large email providers so far, this crime gang merely uses custom, automated scripts that periodically log in and search each inbox for digital items of value that can easily be resold.

And they seem particularly focused on stealing gift card data.

“Sometimes they’ll log in as much as two to three times a week for months at a time,” Bill said. “These guys are looking for low-hanging fruit — basically cash in your inbox. Whether it’s related to hotel or airline rewards or just Amazon gift cards, after they successfully log in to the account their scripts start pilfering inboxes looking for things that could be of value.”

A sample of some of the most frequent search queries made in a single day by the gift card gang against more than 50,000 hacked inboxes.

According to Bill, the fraudsters aren’t downloading all of their victims’ emails: That would quickly add up to a monstrous amount of data. Rather, they’re using automated systems to log in to each inbox and search for a variety of domains and other terms related to companies that maintain loyalty and points programs, and/or issue gift cards and handle their fulfillment.

Why go after hotel or airline rewards? Because these accounts can all be cleaned out and deposited onto a gift card number that can be resold quickly online for 80 percent of its value.

[…]

Bill’s data also shows that this gang is so aggressively going after gift card data that it will routinely seek new gift card benefits on behalf of victims, when that option is available. For example, many companies now offer employees a “wellness benefit” if they can demonstrate they’re keeping up with some kind of healthy new habit, such as daily gym visits, yoga, or quitting smoking.

Bill said these crooks have figured out a way to tap into those benefits as well.

“A number of health insurance companies have wellness programs to encourage employees to exercise more, where if you sign up and pledge to 30 push-ups a day for the next few months or something you’ll get five wellness points towards a $10 Starbucks gift card, which requires 1000 wellness points,” Bill explained. “They’re actually automating the process of replying saying you completed this activity so they can bump up your point balance and get your gift card.”

[…]

several large Internet service providers (ISPs) in Germany and France are heavily represented in the compromised email account data.

“With some of these international email providers we’re seeing something like 25,000 to 50,000 email accounts a day get hacked,” Bill said. “I don’t know why they’re getting popped so heavily.”

[…]

Source: Gift Card Gang Extracts Cash From 100k Inboxes Daily – Krebs on Security