Author name: Kelly Newman

microsoft-to-host-security-summit-after-crowdstrike-disaster

Microsoft to host security summit after CrowdStrike disaster

Crowdstrike, microsoft, Security, syndication, Windows / /

Bugging out —

Redmond wants to improve the resilience of Windows to buggy software.

–

Photo of a Windows BSOD

Microsoft is stepping up its plans to make Windows more resilient to buggy software after a botched CrowdStrike update took down millions of PCs and servers in a global IT outage.

The tech giant has in the past month intensified talks with partners about adapting the security procedures around its operating system to better withstand the kind of software error that crashed 8.5 million Windows devices on July 19.

Critics say that any changes by Microsoft would amount to a concession of shortcomings in Windows’ handling of third-party security software that could have been addressed sooner.

Yet they would also prove controversial among security vendors that would have to make radical changes to their products, and force many Microsoft customers to adapt their software.

Last month’s outages—which are estimated to have caused billions of dollars in damages after grounding thousands of flights and disrupting hospital appointments worldwide—heightened scrutiny from regulators and business leaders over the extent of access that third-party software vendors have to the core, or kernel, of Windows operating systems.

Microsoft will host a summit next month for government representatives and cyber security companies, including CrowdStrike, to “discuss concrete steps we will all take to improve security and resiliency for our joint customers,” Microsoft said on Friday.

The gathering will take place on September 10 at Microsoft’s headquarters near Seattle, it said in a blog post.

Bugs in the kernel can quickly crash an entire operating system, triggering the millions of “blue screens of death” that appeared around the globe after CrowdStrike’s faulty software update was sent out to clients’ devices.

Microsoft told the Financial Times it was considering several options to make its systems more stable and had not ruled out completely blocking access to the Windows kernel—an option some rivals fear would put their software at a disadvantage to the company’s internal security product, Microsoft Defender.

“All of the competitors are concerned that [Microsoft] will use this to prefer their own products over third-party alternatives,” said Ryan Kalember, head of cyber security strategy at Proofpoint.

Microsoft may also demand new testing procedures from cyber security vendors rather than adapting the Windows system itself.

Apple, which was not hit by the outages, blocks all third-party providers from accessing the kernel of its MacOS operating system, forcing them to operate in the more limited “user-mode.”

Microsoft has previously said it could not do the same, after coming to an understanding with the European Commission in 2009 that it would give third parties the same access to its systems as that for Microsoft Defender.

Some experts said, however, that this voluntary commitment to the EU had not tied Microsoft’s hands in the way it claimed, arguing that the company had always been free to make the changes now under consideration.

“These are technical decisions of Microsoft that were not part of [the arrangement],” said Thomas Graf, a partner at Cleary Gottlieb in Brussels who was involved in the case.

“The text [of the understanding] does not require them to give access to the kernel,” added AJ Grotto, a former senior director for cyber security policy at the White House.

Grotto said Microsoft shared some of the blame for the July disruption since the outages would not have been possible without its decision to allow access to the kernel.

Nevertheless, while it might boost a system’s resilience, blocking kernel access could also bring “real trade-offs” for the compatibility with other software that had made Windows so popular among business customers, Forrester analyst Allie Mellen said.

“That would be a fundamental shift for Microsoft’s philosophy and business model,” she added.

Operating exclusively outside the kernel may lower the risk of triggering mass outages but it was also “very limiting” for security vendors and could make their products “less effective” against hackers, Mellen added.

Operating within the kernel gave security companies more information about potential threats and enabled their defensive tools to activate before malware could take hold, she added.

An alternative option could be to replicate the model used by the open-source operating system Linux, which uses a filtering mechanism that creates a segregated environment within the kernel in which software, including cyber defense tools, can run.

But the complexity of overhauling how other security software works with Windows means that any changes will be hard for regulators to police and Microsoft will have strong incentives to favor its own products, rivals said.

It “sounds good on paper, but the devil is in the details,” said Matthew Prince, chief executive of digital services group Cloudflare.

© 2024 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

Microsoft to host security summit after CrowdStrike disaster Read More »

after-cybersecurity-lab-wouldn’t-use-av-software,-us-accuses-georgia-tech-of-fraud

After cybersecurity lab wouldn’t use AV software, US accuses Georgia Tech of fraud

Security / /
Photo of Georgia Tech

Georgia Tech

Dr. Emmanouil “Manos” Antonakakis runs a Georgia Tech cybersecurity lab and has attracted millions of dollars in the last few years from the US government for Department of Defense research projects like “Rhamnousia: Attributing Cyber Actors Through Tensor Decomposition and Novel Data Acquisition.”

The government yesterday sued Georgia Tech in federal court, singling out Antonakakis and claiming that neither he nor Georgia Tech followed basic (and required) security protocols for years, knew they were not in compliance with such protocols, and then submitted invoices for their DoD projects anyway. (Read the complaint.) The government claims this is fraud:

At bottom, DoD paid for military technology that Defendants stored in an environment that was not secure from unauthorized disclosure, and Defendants failed to even monitor for breaches so that they and DoD could be alerted if information was compromised. What DoD received for its funds was of diminished or no value, not the benefit of its bargain.

AV hate

Given the nature of his work for DoD, Antonakakis and his lab are required to abide by many sets of security rules, including those outlined in NIST Special Publication 800–171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.”

One of the rules says that machines storing or accessing such “controlled unclassified information” need to have endpoint antivirus software installed. But according to the US government, Antonakakis really, really doesn’t like putting AV detection software on his lab’s machines.

Georgia Tech admins asked him to comply with the requirement, but according to an internal 2019 email, Antonakakis “wasn’t receptive to such a suggestion.” In a follow-up email, Antonakakis himself said that “endpoint [antivirus] agent is a nonstarter.”

According to the government, “Other than Dr. Antonakakis’s opposition, there was nothing preventing the lab from running antivirus protection. Dr. Antonakakis simply did not want to run it.”

The IT director for Antonakakis’ lab was allowed to use other “mitigating measures” instead, such as relying on the school’s firewall for additional security. The IT director said that he thought Georgia Tech ran antivirus scans from its network. However, this “assumption” turned out to be completely wrong; the school’s network “has never provided” antivirus protection and, even if it had, the lab used laptops that were regularly taken outside the network perimeter.

The school realized after some time that the lab was not in compliance with the DoD contract rules, so an administrator decided to “suspend invoicing” on the lab’s contracts so that the school would not be charged with filing false claims.

According to the government, “Within a few days of the invoicing for his contracts being suspended, Dr. Antonakakis relented on his years-long opposition to the installation of antivirus software in the Astrolavos Lab. Georgia Tech’s standard antivirus software was installed throughout the lab.”

But, says the government, the school never acknowledged that it had been out of compliance for some time and that it had filed numerous invoices while noncompliant. In the government’s telling, this is fraud.

After cybersecurity lab wouldn’t use AV software, US accuses Georgia Tech of fraud Read More »

microsoft-formally-deprecates-the-39-year-old-windows-control-panel

Microsoft formally deprecates the 39-year-old Windows Control Panel

Tech, windows 1.0, Windows 11, windows 11 24h2, windows 95, Windows NT / /

losing control —

The Settings app has taken over, but Control Panels aren’t going anywhere yet.

–

  • Here’s the Keyboard control panel from Windows NT 4.0.

    Andrew Cunningham

  • Aside from some updated Windows Vista-era icons, the design of the modern Keyboards panel is identical.

    Andrew Cunningham

  • The Mouse Pointers panel in Windows NT 4.

    Andrew Cunningham

  • Again, Windows 11 hews remarkably close to the old NT-era design.

    Andrew Cunningham

  • The Date & Time control panel from NT 4.

    Andrew Cunningham

  • Dig a couple of menus down, and you’ll find a version of Date & Time that still looks a lot like its NT counterpart.

    Andrew Cunningham

With an operating system as old as Windows, what Microsoft decides to remove is often just as (if not more) newsworthy as what it is trying to add. You may or may not care about new AI-themed MS Paint additions or the soon-to-be-reborn Recall feature, but you’ve almost certainly interacted with one of Windows’ Control Panel applets at some point in the last 39 years. And according to a note buried on Microsoft’s support site, those Control Panels’ days may be numbered (emphasis ours):

“The Control Panel is a feature that’s been part of Windows for a long time. It provides a centralized location to view and manipulate system settings and controls,” the support page explains. “Through a series of applets, you can adjust various options ranging from system time and date to hardware settings, network configurations, and more. The Control Panel is in the process of being deprecated in favor of the Settings app, which offers a more modern and streamlined experience.“

This won’t be news to anyone who has followed Windows’ development over the last decade. The Settings app was initially introduced in Windows 8 in 2012 as a touchscreen-friendly alternative for some of the Control Panel applets, but during the Windows 10 era it began picking up more and more Control Panel settings, and by the time Windows 11 rolled around it was full-featured enough to serve as a complete Control Panel replacement most of the time, with a handful of exceptions made for especially obscure changes (and those who simply prefer the Old Ways).

But while individual Control Panel applets have disappeared over the years—the Displays panel, the Add/Remove Programs screen, panels for deprecated features like Homegroups—Microsoft’s note suggests that the rest of the applets may disappear en masse in some future Windows update. That said, for now, there’s nothing that’s changing in Windows. Even the upcoming 24H2 update still has all the old Control Panels in it, and the gap between “deprecated” and “removed” can span years.

What’s incredible about some of the Control Panels at this point is how far back some of their designs go. You’re never more than a double-click away from some piece of UI that has been essentially exactly the same since 1996’s Windows NT 4.0, when Microsoft’s more-stable NT operating system was refreshed with the same user interface as Windows 95 (modern Windows versions descend from NT, and not 95 or 98). The Control Panel idea is even older, dating all the way back to Windows 1.0 in 1985.

Most of the current Control Panel designs and iconography settled down back in Windows Vista and Windows 7 in 2006 and 2009, which explains why so many of the panels still feature the rounded, glassy look that defines those versions of the operating system (check out the way the clock looks in our screenshots above). It’s one of the few areas of the operating system that hasn’t been spruced up for Windows 11, which is otherwise probably Microsoft’s most cohesive Windows design since 95 and NT 4.0; even old apps like Paint and Notepad have gotten facelifts, while other Windows 7-era holdovers like WordPad have been put out to pasture.

Microsoft formally deprecates the 39-year-old Windows Control Panel Read More »

us-sues-realpage,-claims-rental-pricing-algorithm-used-by-landlords-is-illegal

US sues RealPage, claims rental-pricing algorithm used by landlords is illegal

Policy, realpage / /

Rental-pricing software —

AG: Landlords use RealPage algorithm “to align their rents.”

–

US Attorney General Merrick Garland speaking at a news conference while standing behind a podium.

Enlarge / US Attorney General Merrick Garland speaks during a news conference in Washington, DC, on Friday, August 23, 2024.

Getty Images | Bloomberg

The United States today sued RealPage, alleging that the software maker distorts competition in rental housing by helping landlords collectively set prices.

“To ensure they secure the greatest value for their needs, renters rely on robust and fierce competition between landlords. RealPage distorts that competition,” said the lawsuit filed by the US government and eight state attorneys general. In a press release, the Justice Department said that “RealPage’s pricing algorithm violates antitrust laws.”

Attorney General Merrick Garland delivered remarks on the lawsuit. “When the Sherman Act was passed, an anticompetitive scheme might have looked like robber barons shaking hands at a secret meeting,” he said. “Today, it looks like landlords using mathematical algorithms to align their rents. But antitrust law does not become obsolete simply because competitors find new ways to unlawfully act in concert.”

RealPage’s commercial revenue management software “enable[s] landlords to sidestep vigorous competition to win renters’ business,” the lawsuit alleged. “Landlords, who would otherwise be competing with each other, submit on a daily basis their competitively sensitive information to RealPage. This nonpublic, material, and granular rental data includes, among other information, a landlord’s rental prices from executed leases, lease terms, and future occupancy. RealPage collects a broad swath of such data from competing landlords, combines it, and feeds it to an algorithm.”

Using that sensitive data, “RealPage provides daily, near real-time pricing ‘recommendations’ back to competing landlords,” the US said. The US alleges that these “are more than just ‘recommendations'” and that “RealPage monitors compliance by landlords to its recommendations.”

AG: Landlords “outsource their pricing decisions”

The US asked for a court order declaring “that RealPage has acted unlawfully to restrain trade in conventional multifamily rental housing markets across the United States.” The requested order would prohibit RealPage from continuing its allegedly anticompetitive practices and provide “relief necessary and appropriate to restore competitive conditions in the markets affected by RealPage’s unlawful conduct.”

RealPage recently argued that its software “benefits both housing providers and residents,” and “makes price recommendations in all directions—up, down, or no change—to align with property-specific objectives of the housing providers using the software.” Landlords don’t have to follow the recommendations, the company says.

The US said RealPage takes a more direct role in setting prices. RealPage “reviews and weighs in on landlords’ other policies, including trying to—and often succeeding in—ending renter-friendly concessions (like a free month’s rent or waived fees) to attract or retain renters,” the lawsuit said. Garland alleged that “a large number of landlords effectively agree to outsource their pricing decisions to RealPage by using an ‘auto accept’ setting, which effectively permits RealPage to determine the price a renter will pay.”

The RealPage algorithm “can serve as a mechanism for communication,” Diana Moss, director of competition policy at the Progressive Policy Institute, a public policy think tank, was quoted as saying by The New York Times. “That is as approachable and actionable under US antitrust as any form of communication we’ve seen in past cases in the non-digital era.”

The lawsuit was filed in US District Court for the Middle District of North Carolina. Six landlords in North Carolina provided information to the Justice Department. The states joining the lawsuit are North Carolina, California, Colorado, Connecticut, Minnesota, Oregon, Tennessee, and Washington.

Software eliminates “guessing game” on prices

Garland said the investigation preceding the lawsuit took nearly two years. The lawsuit quoted landlords describing how they use RealPage:

One landlord observed that RealPage’s software “can eliminate the guessing game” for landlords’ pricing decisions. Discussing a different RealPage product, another landlord said: “I always liked this product because your algorithm uses proprietary data from other subscribers to suggest rents and term. That’s classic price fixing.” A third landlord explained, “Our very first goal we came out with immediately out of the gate is that we will not be the reason any particular sub-market takes a rate dive. So for us our strategy was to hold steady and to keep an eye on the communities around us and our competitors.”

The lawsuit said that “RealPage frequently tells prospective and current clients that a ‘rising tide raises all ships.’ A RealPage revenue management vice president explained that this phrase means that ‘there is greater good in everybody succeeding versus essentially trying to compete against one another in a way that actually keeps the industry down.'”

The US and states allege that RealPage violated Section 1 of the Sherman Act by unlawfully sharing information for use in competitors’ pricing, and by entering into vertical agreements with landlords to align pricing. RealPage is further accused of violating Section 2 of the Sherman Act through monopolization of the commercial revenue management software market.

RealPage, which is also facing a ban on its software in San Francisco, said the lawsuit is “devoid of merit and will do nothing to make housing more affordable.”

“We are disappointed that, after multiple years of education and cooperation on the antitrust matters concerning RealPage, the DOJ has chosen this moment to pursue a lawsuit that seeks to scapegoat pro-competitive technology that has been used responsibly for years,” RealPage said.

The White House issued a statement saying it has no comment on the lawsuit against RealPage, but that the Biden-Harris administration “continues to support fair and vigorous enforcement of the antitrust laws to prevent illegal collusion.”

US sues RealPage, claims rental-pricing algorithm used by landlords is illegal Read More »

fda-green-lights-fall-covid-19-boosters

FDA green-lights fall COVID-19 boosters

Comirnaty, COVID-19, health, moderna, mRNA, Pfizer, Spikevax, vaccines / /

Shoot me up —

Updated mRNA vaccines from Pfizer and Moderna are ready to roll.

–

FDA green-lights fall COVID-19 boosters

Getty Images

As the COVID-19 case count continues to tick upward, the US Food and Drug Administration has approved an updated vaccine for use ahead of the northern hemisphere winter. The emergency use authorization covers updated mRNA vaccines from both Pfizer and Moderna.

The booster shots will target the JN.1 and KP.2 strains of SARS-CoV-2, both of which are omicron variants. Last year’s booster keyed on omicron subvariant XBB.1.5, which has long since lost the evolutionary arms race.

Both Spikevax (Moderna) and Comirnaty (Pfizer) vaccines have been updated. While the vaccine is targeted toward those 12 and over, parents of children aged six months through 11 years are also eligible for the updated vaccines under the FDA’s emergency use authorization.

“Vaccination continues to be the cornerstone of COVID-19 prevention,” said Peter Marks, director of the FDA’s Center for Biologics Evaluation and Research. “These updated vaccines meet the agency’s rigorous, scientific standards for safety, effectiveness, and manufacturing quality. Given waning immunity of the population from previous exposure to the virus and from prior vaccination, we strongly encourage those who are eligible to consider receiving an updated COVID-19 vaccine to provide better protection against currently circulating variants.”

Updated vaccines will hit hospitals and pharmacies soon, as Moderna and Pfizer are ready to ship vaccines. Once injected, the boosters will take a couple of weeks to hit peak protection, and they will offer that level of protection for a few months after the shot. Keep that in mind as you think about timing your booster for maximum efficacy.

FDA green-lights fall COVID-19 boosters Read More »

ex-bank-ceo-gets-24-years-after-falling-for-crypto-scam,-causing-bank-collapse

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse

crypto scam, Cryptocurrency, pig butchering, Policy / /

Breaking the bank —

Former bank CEO ignored warnings that he was being scammed while tanking bank.

–

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse

A federal judge sentenced a 53-year-old Kansas man to more than 24 years in prison after the former bank CEO abused his trusted position to embezzle $47 million after falling for a cryptocurrency scam that he believed would make him wildly rich.

In a press release, the US Attorney’s Office said that Shan Hanes was driven by “greed” when directing bank employees to transfer millions in funds to a sketchy crypto wallet managed by still-unknown third parties behind the so-called “pig butchering” scheme.

Hanes was first targeted by scammers in late 2022, apparently when he got a message from an unidentified co-conspirator on WhatsApp, prosecutors said. After blowing through his own funds seeking promised profits, Hanes stole tens of thousands from a local church, then a local investor club, and finally his daughter’s college fund, NBC News reported. Then when all those wells dried up, he started stealing bank funds—all in the false hopes that sending more and more money to the scammers would somehow “unlock the supposed returns” on his crypto investments.

In total, Hanes made 11 wire transfers using bank funds between May 2023 and July 2023. But instead of getting rich quick, Hanes never realized any profits at all, the US Attorney’s Office said.

He pleaded guilty to one count of embezzlement by a bank officer after he singlehandedly caused the collapse of Heartland Tri-State Bank (HTSB) in Elkhart, Kansas, the press release said.

Because the bank was insured by the Federal Deposit Insurance Corporation (FDIC), the FDIC “absorbed the $47.1 million loss” after “Hanes’ fraudulent actions caused HTSB to fail and the bank investors to lose $9 million,” the US Attorney’s Office said. On top of those losses, Hanes’ fraudulent actions caused “catastrophic losses to bank customers who relied on the bank for the safekeeping of their savings,” the press release confirmed.

According to NBC News, Hanes missed at least one opportunity to realize that he was being scammed. After he asked for a $12 million loan from a neighbor, Brian Mitchell, his neighbor detected the scam and refused to lend the money.

“I said, ‘You’re in a scam, walk away,'” Mitchell told NBC News.

But Hanes didn’t walk away. Going the other direction, he directed bank employees to wire millions more to scammers after he got the warning from Mitchell. It wasn’t until Mitchell heard from a bank employee that Hanes had wired money out of the bank that Mitchell insisted on speaking to the bank’s board.

Days later, Hanes was fired, NBC News reported. But even then, Hanes never believed he was being scammed, reportedly telling Mitchell that he was still scheming to find a way to recover his make-believe profits right up to the moment he was arrested.

“He said … ‘If I just had another two months, I could get the money back,'” Mitchell told NBC News.

Law enforcement and government officials have warned that pig-butchering scams are growing increasingly common, urging people to “think twice” to avoid being victimized. Last year, the US Department of the Treasury’s Financial Crimes Enforcement Network issued an alert, which explained in detail how the scams commonly work and laid out red flags to watch out for.

Victims may never fully recover losses, DOJ says

A Kansas FBI agent, Stephen Cyrus, said in the press release that as CEO, Hanes violated “the trust and confidence of the community of Elkhart” by embezzling the funds.

Mitchell described Hanes’ deceptions and manipulations as “pure evil,” while Cyrus said that it was Hanes’ “job” and “the bank’s job” to “protect its customers and identify fraudulent scams—not to participate in them.”

In a court filing at sentencing, Hanes’ lawyer, John Stang, chalked up his client’s misdeeds to “bad choices,” reminding the court that Hanes had been deceived, too, by “an extremely well-run cryptocurrency scam.”

“He was the pig that was butchered,” Stang wrote. “Mr. Hanes’s vulnerability to the Pig Butcher scheme caused him to make some very bad decisions, for which he is truly sorry for causing damage to the bank and loss to the Stockholders.”

Hanes faced a maximum penalty of 30 years. While Judge John Broomes ordered him to serve less time than that, his sentence of more than 24 years is 29 months longer than prosecutors had requested, NBC News reported.

Right now, it’s unclear how or when victims will be repaid for losses. Broomes ordered “that restitution be finalized at a separate hearing within the next 90 days,” the US Attorney’s Office said.

In the community, people are still struggling to recover, Mitchell told NBC News, noting that some people lost up to 80 percent of their retirement savings. For at least one woman, retirement is impossible now, Mitchell said, and for another local woman, it has become difficult to pay for her 93-year-old mother’s nursing home.

US Attorney Kate E. Brubacher said that it’s hard to say when or if victims will be made whole again.

“Hanes is a liar and a master manipulator” who squandered away “tens of millions of dollars in cryptocurrency” while orchestrating “schemes to cover his tracks concerning the losses at the bank,” Brubacher said. “Many victims will never fully recoup losses to their life savings and retirement funds, but at least we at the Department of Justice can see that Hanes is held criminally responsible for his actions.”

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse Read More »

“we-run-a-business”—why-microsoft’s-indiana-jones-will-be-on-ps5

“We run a business”—why Microsoft’s Indiana Jones will be on PS5

gaming, Indiana Jones, Phil Spencer, xbox / /

PS5 Starfield when? —

Spencer: “There’s going to be more change in how… games are built and distributed.”

–

So I'm not stuck on Xbox, eh?

Enlarge / So I’m not stuck on Xbox, eh?

Bethesda

Bethesda’s Indiana Jones and The Great Circle is the latest game from a Microsoft subsidiary that will make its way to the PlayStation 5. The game will hit Sony’s console in the spring of 2025, Microsoft announced yesterday, months after a planned December launch on Xbox Series S/X and Windows.

In an interview with YouTube channel Xbox On, Microsoft’s Phil Spencer expanded on that decision, implying that multiplatform releases for Microsoft gaming properties were important to the Xbox division’s bottom line. “We run a business,” he said, “It’s definitely true inside of Microsoft the bar is high for us in terms of the delivery that we have to give back to the company, because we get a level of support from the company that’s just amazing in what we’re able to go do.”

Phil Spencer’s comments come about three minutes into this interview.

Amid massive layoffs that have hit Xbox and other gaming companies in recent months, Spencer noted that there’s “a lot of pressure on the [game] industry” these days. “[The industry] has been growing for a long, long time and now people are looking for ways to grow,” he said. “And I think that us, as fans, as players of games, we just have to anticipate there’s going to be more change in how some of the traditional ways that games were built and distributed [ars] going to change… for all of us.”

“It’s just going to be a strategy that works for us”

Although Microsoft released four former Xbox exclusives on other platforms months ago, Spencer suggested that there hasn’t been any commensurate dip in total Xbox usage. “What I see when I look is our franchises are getting stronger; our Xbox console players are as high this year as they’ve ever been,” he said.

“So I look at it, and I say, ‘Okay, our player numbers are going up for the console platform, our franchises are as strong as they’ve ever been… So I look at this [as] ‘How can we make our games as strong as possible?'” our platform continues to grow both on console on PC and on cloud and I think it’s just going to be a strategy that works for us.”

Indiana Jones.” height=”360″ src=”https://cdn.arstechnica.net/wp-content/uploads/2024/02/xboxmulti-640×360.jpg” width=”640″>

Enlarge / Microsoft’s last four multiplatform game releases were a bit smaller than Indiana Jones.

Microsoft

Microsoft has long prioritized maintaining a healthy number of overall Xbox players over selling more raw consoles than competitors like Sony. Still, the continuing cratering of sales revenue from Xbox hardware likely contributes heavily to Microsoft’s decision to release its games on competing platforms.

A big-budget, big-name Bethesda release like Indiana Jones could act as more of an Xbox system seller than the four older, smaller games that Microsoft recently let go multiplatform. Then again, The Great Circle‘s multiple months of Xbox exclusivity—which include the 2024 holiday buying season—could still provide a bit of a relative advantage for Microsoft’s consoles.

Indiana Jones and The Great Circle‘s PS5 availability may come as a particular surprise to readers who remember Spencer saying in February that neither The Great Circle nor Starfield were a part of the company’s current multiplatform plans. But a careful parsing of Spencer’s words at the time shows that he only promised those titles were not among the four multiplatform titles they were announcing at that time.

Back then, Spencer said that those four multiplatform releases didn’t represent “a change to our fundamental exclusive strategy.” But he added that there was a desire to “use what some of the other platforms have right now to help grow our franchises” to help “the long-term health of Xbox.”

“[I have] a fundamental belief that over the next five or ten years… games that are exclusive to one piece of hardware are going to be a smaller and smaller part of the game industry,” Spencer said in February.

“We run a business”—why Microsoft’s Indiana Jones will be on PS5 Read More »

telco-fined-$1m-for-transmitting-biden-deepfake-without-verifying-caller-id

Telco fined $1M for transmitting Biden deepfake without verifying Caller ID

biden deepfake, fake biden robocall, Policy / /

Biden deepfake robocall —

Lingo Telecom signed calls with A-Level attestations despite not verifying them.

–

President Biden walking outdoors while holding a cell phone to his ear with one hand and holding another phone in his other hand.

Enlarge / President Joe Biden leaving the White House on August 16, 2024, in Washington, DC.

Getty Images | Anna Moneymaker

A phone company agreed to pay a $1 million fine for transmitting spoofed robocalls in which a deepfake of President Joe Biden’s voice urged New Hampshire residents not to vote. Lingo Telecom, which is based in Texas, agreed to a settlement with the Federal Communications Commission, the agency announced today.

Lingo Telecom “will pay a $1 million civil penalty and implement a historic compliance plan—the first of its kind secured by the FCC—that will require strict adherence to the FCC’s STIR/SHAKEN Caller ID authentication rules,” the FCC said. The settlement includes “requirements that the company abide by ‘Know Your Customer’ (KYC) and ‘Know Your Upstream Provider’ (KYUP) principles” that focus on vetting call traffic to ensure it is trustworthy, and “requirements that the company more thoroughly verify the accuracy of the information provided by its customers and upstream providers.”

The calls made before New Hampshire’s presidential primary in January were orchestrated by Steve Kramer, a Democratic consultant who was working for a candidate running against Biden. Kramer was indicted on charges of voter suppression and impersonation of a candidate, and the FCC proposed a $6 million fine for Kramer. The calls inaccurately displayed a phone number associated with a prominent New Hampshire political operative.

The FCC originally proposed a $2 million fine for Lingo Telecom before settling for the $1 million penalty in a consent decree issued today. The consent decree resolves the FCC investigation into Lingo Telecom’s apparent violations of rules related to the STIR/SHAKEN Caller ID authentication system.

Telco didn’t verify calls

Lingo Telecom completed 3,978 calls to potential New Hampshire voters on January 21, 2024, on behalf of a customer called Life Corporation. Lingo Telecom signed those calls with A-Level attestations, which indicate that the phone company “is responsible for the origination of the call onto the IP-based service provider voice network, has a direct authenticated relationship with the customer and can identify the customer, and has established a verified association with the telephone number used for the call.”

Lingo Telecom did not actually verify the calls, the consent decree said:

Lingo Telecom explained that its policy was to assign A-level attestations to a customer’s traffic when the Company directly assigned Direct Inward Dialing (DID) numbers to a customer like Life Corporation. If one of these customers, like Life Corporation, also purchased Company Session Initiation Protocol (SIP) trunks that permits the customer to use numbers assigned by other carriers, Lingo Telecom allowed them to “receive an A-level attestation for traffic associated with… non-Lingo provisioned telephone numbers if the customer certified that it ‘will identify its customer and has a verified association with the telephone number used for the call.'”

Lingo Telecom told the FCC that it relied on the certification provided by Life Corporation, which had been a customer of Lingo Telecom for 16 years. “Lingo Telecom took no additional steps beyond those recited above to independently ascertain whether the customers of Life Corporation could legitimately use the telephone number that appeared as the calling party for the New Hampshire presidential primary calls,” the FCC said.

The consent decree states that, going forward, “Lingo Telecom may only apply an A-level attestation to a call if Lingo Telecom itself has provided the Caller Identity to the calling party associated with the Call.” The consent decree’s “Know Your Customer” provisions require Lingo Telecom to obtain more detailed information from customers, while the “Know Your Upstream Provider” provisions require it to obtain more detailed information from other telcos that it transmits calls for.

Lingo Telecom is also barred from accepting “payment in the form of cryptocurrency, gift cards, or cash to transmit or originate calls.” The consent decree is scheduled to be in effect for three years but can be extended by 12 months for each instance of noncompliance.

Telco fined $1M for transmitting Biden deepfake without verifying Caller ID Read More »

novel-technique-allows-malicious-apps-to-escape-ios-and-android-guardrails

Novel technique allows malicious apps to escape iOS and Android guardrails

android, Biz & IT, iOS, malicious apps, malware, phishing, Security / /

NOW YOU KNOW —

Web-based apps escape iOS “Walled Garden” and Android side-loading protections.

–

An image illustrating a phone infected with malware

Getty Images

Phishers are using a novel technique to trick iOS and Android users into installing malicious apps that bypass safety guardrails built by both Apple and Google to prevent unauthorized apps.

Both mobile operating systems employ mechanisms designed to help users steer clear of apps that steal their personal information, passwords, or other sensitive data. iOS bars the installation of all apps other than those available in its App Store, an approach widely known as the Walled Garden. Android, meanwhile, is set by default to allow only apps available in Google Play. Sideloading—or the installation of apps from other markets—must be manually allowed, something Google warns against.

When native apps aren’t

Phishing campaigns making the rounds over the past nine months are using previously unseen ways to workaround these protections. The objective is to trick targets into installing a malicious app that masquerades as an official one from the targets’ bank. Once installed, the malicious app steals account credentials and sends them to the attacker in real time over Telegram.

“This technique is noteworthy because it installs a phishing application from a third-party website without the user having to allow third-party app installation,” Jakub Osmani, an analyst with security firm ESET, wrote Tuesday. “For iOS users, such an action might break any ‘walled garden’ assumptions about security. On Android, this could result in the silent installation of a special kind of APK, which on further inspection even appears to be installed from the Google Play store.”

The novel method involves enticing targets to install a special type of app known as a Progressive Web App. These apps rely solely on Web standards to render functionalities that have the feel and behavior of a native app, without the restrictions that come with them. The reliance on Web standards means PWAs, as they’re abbreviated, will in theory work on any platform running a standards-compliant browser, making them work equally well on iOS and Android. Once installed, users can add PWAs to their home screen, giving them a striking similarity to native apps.

While PWAs can apply to both iOS and Android, Osmani’s post uses PWA to apply to iOS apps and WebAPK to Android apps.

Installed phishing PWA (left) and real banking app (right).

Enlarge / Installed phishing PWA (left) and real banking app (right).

ESET

Comparison between an installed phishing WebAPK (left) and real banking app (right).

Enlarge / Comparison between an installed phishing WebAPK (left) and real banking app (right).

ESET

The attack begins with a message sent either by text message, automated call, or through a malicious ad on Facebook or Instagram. When targets click on the link in the scam message, they open a page that looks similar to the App Store or Google Play.

Example of a malicious advertisement used in these campaigns.

Example of a malicious advertisement used in these campaigns.

ESET

Phishing landing page imitating Google Play.

Phishing landing page imitating Google Play.

ESET

ESET’s Osmani continued:

From here victims are asked to install a “new version” of the banking application; an example of this can be seen in Figure 2. Depending on the campaign, clicking on the install/update button launches the installation of a malicious application from the website, directly on the victim’s phone, either in the form of a WebAPK (for Android users only), or as a PWA for iOS and Android users (if the campaign is not WebAPK based). This crucial installation step bypasses traditional browser warnings of “installing unknown apps”: this is the default behavior of Chrome’s WebAPK technology, which is abused by the attackers.

Example copycat installation page.

Example copycat installation page.

ESET

The process is a little different for iOS users, as an animated pop-up instructs victims how to add the phishing PWA to their home screen (see Figure 3). The pop-up copies the look of native iOS prompts. In the end, even iOS users are not warned about adding a potentially harmful app to their phone.

Figure 3 iOS pop-up instructions after clicking

Figure 3 iOS pop-up instructions after clicking “Install” (credit: Michal Bláha)

ESET

After installation, victims are prompted to submit their Internet banking credentials to access their account via the new mobile banking app. All submitted information is sent to the attackers’ C&C servers.

The technique is made all the more effective because application information associated with the WebAPKs will show they were installed from Google Play and have been assigned no system privileges.

WebAPK info menu—notice the

WebAPK info menu—notice the “No Permissions” at the top and “App details in store” section at the bottom.

ESET

So far, ESET is aware of the technique being used against customers of banks mostly in Czechia and less so in Hungary and Georgia. The attacks used two distinct command-and-control infrastructures, an indication that two different threat groups are using the technique.

“We expect more copycat applications to be created and distributed, since after installation it is difficult to separate the legitimate apps from the phishing ones,” Osmani said.

Novel technique allows malicious apps to escape iOS and Android guardrails Read More »

google-can’t-defend-shady-chrome-data-hoarding-as-“browser-agnostic,”-court-says

Google can’t defend shady Chrome data hoarding as “browser agnostic,” court says

chrome browser, data privacy, Google, google chrome, Online Privacy, Policy / /
Google can’t defend shady Chrome data hoarding as “browser agnostic,” court says

Chrome users who declined to sync their Google accounts with their browsing data secured a big privacy win this week after previously losing a proposed class action claiming that Google secretly collected personal data without consent from over 100 million Chrome users who opted out of syncing.

On Tuesday, the 9th US Circuit Court of Appeals reversed the prior court’s finding that Google had properly gained consent for the contested data collection.

The appeals court said that the US district court had erred in ruling that Google’s general privacy policies secured consent for the data collection. The district court failed to consider conflicts with Google’s Chrome Privacy Notice (CPN), which said that users’ “choice not to sync Chrome with their Google accounts meant that certain personal information would not be collected and used by Google,” the appeals court ruled.

Rather than analyzing the CPN, it appears that the US district court completely bought into Google’s argument that the CPN didn’t apply because the data collection at issue was “browser agnostic” and occurred whether a user was browsing with Chrome or not. But the appeals court—by a 3–0 vote—did not.

In his opinion, Circuit Judge Milan Smith wrote that the “district court should have reviewed the terms of Google’s various disclosures and decided whether a reasonable user reading them would think that he or she was consenting to the data collection.”

“By focusing on ‘browser agnosticism’ instead of conducting the reasonable person inquiry, the district court failed to apply the correct standard,” Smith wrote. “Viewed in the light most favorable to Plaintiffs, browser agnosticism is irrelevant because nothing in Google’s disclosures is tied to what other browsers do.”

Smith seemed to suggest that the US district court wasted time holding a “7.5-hour evidentiary hearing which included expert testimony about ‘whether the data collection at issue'” was “browser-agnostic.”

“Rather than trying to determine how a reasonable user would understand Google’s various privacy policies,” the district court improperly “made the case turn on a technical distinction unfamiliar to most ‘reasonable'” users, Smith wrote.

Now, the case has been remanded to the district court where Google will face a trial over the alleged failure to get consent for the data collection. If the class action is certified, Google risks owing currently unknown damages to any Chrome users who opted out of syncing between 2016 and 2024.

According to Smith, the key focus of the trial will be weighing the CPN terms and determining “what a ‘reasonable user’ of a service would understand they were consenting to, not what a technical expert would.”

The same privacy policy last year triggered a Google settlement with Chrome users whose data was collected despite using “Incognito” mode.

Matthew Wessler, a lawyer for Chrome users suing, told Ars that “we are pleased with the Ninth Circuit’s decision” and “look forward to taking this case on behalf of Chrome users to trial.”

A Google spokesperson, José Castañeda, told Ars that Google disputes the decision.

“We disagree with this ruling and are confident the facts of the case are on our side,” Castañeda told Ars. “Chrome Sync helps people use Chrome seamlessly across their different devices and has clear privacy controls.”

Google can’t defend shady Chrome data hoarding as “browser agnostic,” court says Read More »

ars-technica-content-is-now-available-in-openai-services

Ars Technica content is now available in OpenAI services

AI, ars technica, Biz & IT, chatgpt, chatgtp, Conde Nast, machine learning, openai, SearchGPT, wired / /

Adventures in capitalism —

Condé Nast joins other publishers in allowing OpenAI to access its content.

–

The OpenAI and Conde Nast logos on a gradient background.

Ars Technica

On Tuesday, OpenAI announced a partnership with Ars Technica parent company Condé Nast to display content from prominent publications within its AI products, including ChatGPT and a new SearchGPT prototype. It also allows OpenAI to use Condé content to train future AI language models. The deal covers well-known Condé brands such as Vogue, The New Yorker, GQ, Wired, Ars Technica, and others. Financial details were not disclosed.

One immediate effect of the deal will be that users of ChatGPT or SearchGPT will now be able to see information from Condé Nast publications pulled from those assistants’ live views of the web. For example, a user could ask ChatGPT, “What’s the latest Ars Technica article about Space?” and ChatGPT can browse the web and pull up the result, attribute it, and summarize it for users while also linking to the site.

In the longer term, the deal also means that OpenAI can openly and officially utilize Condé Nast articles to train future AI language models, which includes successors to GPT-4o. In this case, “training” means feeding content into an AI model’s neural network so the AI model can better process conceptual relationships.

AI training is an expensive and computationally intense process that happens rarely, usually prior to the launch of a major new AI model, although a secondary process called “fine-tuning” can continue over time. Having access to high-quality training data, such as vetted journalism, improves AI language models’ ability to provide accurate answers to user questions.

It’s worth noting that Condé Nast internal policy still forbids its publications from using text created by generative AI, which is consistent with its AI rules before the deal.

Not waiting on fair use

With the deal, Condé Nast joins a growing list of publishers partnering with OpenAI, including Associated Press, Axel Springer, The Atlantic, and others. Some publications, such as The New York Times, have chosen to sue OpenAI over content use, and there’s reason to think they could win.

In an internal email to Condé Nast staff, CEO Roger Lynch framed the multi-year partnership as a strategic move to expand the reach of the company’s content, adapt to changing audience behaviors, and ensure proper compensation and attribution for using the company’s IP. “This partnership recognizes that the exceptional content produced by Condé Nast and our many titles cannot be replaced,” Lynch wrote in the email, “and is a step toward making sure our technology-enabled future is one that is created responsibly.”

The move also brings additional revenue to Condé Nast, Lynch added, at a time when “many technology companies eroded publishers’ ability to monetize content, most recently with traditional search.” The deal will allow Condé to “continue to protect and invest in our journalism and creative endeavors,” Lynch wrote.

OpenAI COO Brad Lightcap said in a statement, “We’re committed to working with Condé Nast and other news publishers to ensure that as AI plays a larger role in news discovery and delivery, it maintains accuracy, integrity, and respect for quality reporting.”

Ars Technica content is now available in OpenAI services Read More »

disney-cancels-the-acolyte-after-one-season

Disney cancels The Acolyte after one season

culture, Disney Plus, Entertainment, Lucasfilm, star wars, streaming television, The Acolyte / /

haters gonna hate —

Star Wars series was admittedly uneven, but didn’t deserve the online hate it received.

–

Asian man in white robe with one hand extended in front of him

Enlarge / We have doubts that any amount of Force powers will bring the show back.

YouTube/Disney+

In news that will delight some and disappoint others, Disney has canceled Star Wars series The Acolyte after just one season, Deadline Hollywood reports. The eight-episode series got off to a fairly strong start, with mostly positive reviews and solid ratings, albeit lower than prior Star Wars series. But it couldn’t maintain and build upon that early momentum, and given the production costs, it’s not especially surprising that Disney pulled the plug.

The Acolyte arguably wrapped up its major narrative arc pretty neatly in the season finale, but it also took pains to set the stage for a possible sophomore season. In this streaming age, no series is ever guaranteed renewal. Still, it would have been nice to see what showrunner Leslye Headland had planned; when given the chance, many shows hit their stride on those second-season outings.

(Spoilers for the series below. We’ll give you another heads-up when we get to major spoilers.)

As I’ve written previously, The Acolyte is set at the end of the High Republic Era, about a century before the events of The Phantom Menace. In this period, the Jedi aren’t the underdog rebels battling the evil Galactic Empire. They are at the height of their power and represent the dominant mainstream institution—not necessarily a benevolent one, depending on one’s perspective. That’s a significant departure from most Star Wars media and perhaps one reason why the show was so divisive among fans. (The show had its issues, but I dismiss the profoundly unserious lamentations of those who objected to the female-centric storyline and presence of people of color by dubbing it “The Wokelyte” and launching a review-bombing campaign.)

The Acolyte opened on the planet Ueda, where a mysterious masked woman wielding daggers attacked the Jedi Master Indara (Carrie-Anne Moss) and killed her. The assassin was quickly identified as Osha Aniseya (Amandla Stenberg), a former padawan now working as a meknek, making repairs on spaceships. Osha was arrested by her former classmate, Yord Fandar (Charlie Barnett), but claimed she was innocent. Her twin sister, Mae, died in a fire on their home planet of Brendok when they were both young. Osha concluded that Mae was still alive and had killed Indara. Osha’s former Jedi master, Sol (Lee Jung-jae), believed her, and subsequent events proved Osha right.

Mae’s targets were not random. She was out to kill the four Jedi she blamed for the fire on Brendok: Indara, Sol, Torbin (Dean-Charles Chapman), and a Jedi Wookiee named Kelnacca (Joonas Suotamo). The quartet had arrived on Brendok to demand they be allowed to test the twins as potential Jedi.

The twins had been raised by a coven of “Force witches” there, led by Mother Aniseya (Jodie Turner-Smith), who believed the Jedi were misusing the Force. While Mae was keen to follow in their mother’s footsteps, Osha wanted to train with the Jedi. When the fire broke out, both Mae and Osha believed the other twin had been killed along with the rest of the coven. How the fire really started, and the identity of Mae’s mysterious Master who trained her in the dark side of the Force, were the primary mysteries that played out over the course of the season.

(WARNING: Major spoilers below. Stop reading now if you haven’t finished watching the series.)

Lightsabers and wuxia

wuxia-inspired fight scenes.” height=”320″ src=”https://cdn.arstechnica.net/wp-content/uploads/2024/06/acolyte-olega-640×320.jpg” width=”640″>

Enlarge / The camera moved on a single axis for the wuxia-inspired fight scenes.

Lucasfilm/Disney+

From the start, The Acolyte was a bit of a departure from a typical Star Wars series, weaving in elements from wuxia films and detective stories while remaining true to the established Star Wars aesthetic and design. That alone made it an intriguing effort, with fresh characters and new takes on classic Star Wars lore. And the martial arts-inspired fight choreography was clever and fun to watch—especially in the shocking, action-packed fifth episode (“Night”).

But there were some obvious shortcomings as well, most notably the clunky dialogue—although that’s kind of a long-standing attribute of the Star Wars franchise. (Alec Guinness notoriously hated his dialogue as Obi-Wan Kenobi in A New Hope.) The pacing lagged at times, and there was a surprisingly high body count among the central characters.

A high body count: All of these Jedi are dead.

Enlarge / A high body count: All of these Jedi are dead.

Lucasfilm/Disney+

That alone might have made a second season challenging. I mean, they killed off Moss’ Jedi master in the first 10 minutes (although she reappeared in flashbacks), with Torbin and Kelnacca meeting the same fate over the next few episodes. By the time the final credits rolled, almost all the Jedi lead characters were dead. And senior leader Vernestra (Rebecca Henderson) opted to blame the murders on Sol (RIP) rather than Mae’s master, who turned out to be Vernestra’s former apprentice, Qimir (a scene-stealing Manny Jacinto)—now apprentice to Sith lord Darth Plagueis. (This was strongly implied in the finale and subsequently confirmed by Headland.)

Ultimately, however, it all came down to the ratings. Per Deadline, The Acolyte garnered 11.1 million views over its first five days (and 488 million minutes viewed)—not bad, but below Ahsoka‘s 14 million views over the same period. But those numbers declined sharply over the ensuing weeks, with the finale earning the dubious distinction of posting the lowest minutes viewed (335 million) for any Star Wars series finale. That simply didn’t meet Disney’s threshold for renewal, so we won’t get to learn more about the Qimir/Darth Plagueis connection.

Disney cancels The Acolyte after one season Read More »