Author name: Mike M.

Navigating the SEC Cybersecurity Ruling

Navigating / /

The latest SEC ruling on cybersecurity will almost certainly have an impact on risk management and post-incident disclosure, and CISOs will need to map this to their specific environments and tooling. I asked our cybersecurity analysts Andrew Green, Chris Ray, and Paul Stringfellow what they thought, and I amalgamated their perspectives.

What Is the Ruling?

The new SEC ruling requires disclosure following an incident at a publicly traded company. This should come as no surprise to any organization already dealing with data protection legislation, such as the GDPR in Europe or California’s CCPA. The final rule has two requirements for public companies:

  • Disclosure of material cybersecurity incidents within four business days after the company determines the incident is material.
  • Disclosure annually of information about the company’s cybersecurity risk management, strategy, and governance.

The first requirement is similar to what GDPR enforces, that breaches must be reported within a set time (72 hours for GDPR, 96 for SEC). To do this, you need to know when the breach happened, what was contained in the breach, who it impacted, and so on. And keep in mind that the 96 hours begins not when a breach is first discovered, but when it is determined to be material.

The second part of the SEC ruling relates to annual reporting of what risks a company has and how they are being addressed. This doesn’t create impossible hurdles—for example, it’s not a requirement to have a security expert on the board. However, it does confirm a level of expectation: companies need to be able to show how expertise has come into play and is acted on at board level.

What are Material Cybersecurity Incidents?

Given the reference to “material” incidents, the SEC ruling includes a discussion of what materiality means: simply put, if your business feels it’s important enough to take action on, then it’s important enough to disclose. This does beg the question of how the ruling might be gamed, but we don’t advise ignoring a breach just to avoid potential disclosure.

In terms of applicable security topics to help companies implement a solution to handle the ruling, this aligns with our research on proactive detection and response (XDR and NDR), as well as event collation and insights (SIEM) and automated response (SOAR). SIEM vendors, I reckon, would need very little effort to deliver on this, as they already focus on compliance with many standards. SIEM also links to operational areas, such as incident management.

What Needs to be Disclosed in the Annual Reporting?

The ruling doesn’t constrain how security is done, but it does need the mechanisms used to be reported. The final rule focuses on disclosing management’s role in assessing and managing material risks from cybersecurity threats, for example.

In research terms, this relates to topics such as data security posture management (DSPM), as well as other posture management areas. It also touches on governance, compliance, and risk management, which is hardly surprising. Yes, indeed, it would be beneficial to all if overlaps were reduced between top-down governance approaches and middle-out security tooling.

What Are the Real-World Impacts?

Overall, the SEC ruling looks to balance security feasibility with action—the goal is to reduce risk any which way, and if tools can replace skills (or vice versa), the SEC will not mind. While the ruling overlaps with GDPR in terms of requirements, it is aimed at different audiences. The SEC ruling’s aim is to enable a consistent view for investors, likely so they can feed into their own investment risk planning. It therefore feels less bureaucratic than GDPR and potentially easier to follow and enforce.

Not that public organizations have any choice, in either case. Given how hard the SEC came down following the SolarWinds attack, these aren’t regulations any CISO will want to ignore.

Navigating the SEC Cybersecurity Ruling Read More »

linus-torvalds-reiterates-his-tabs-versus-spaces-stance-with-a-kernel-trap

Linus Torvalds reiterates his tabs-versus-spaces stance with a kernel trap

Biz & IT, coding style, Linus Torvalds, Linux, Linux kernel, linux kernel mailing list, tab vs space, tabs versus spaces, Tech / /

Tabs Versus Space 2024: The Sabotage —

One does not simply suggest changing a kernel line to help out a parsing tool.

– Updated

Tab soda displayed on a grocery shelf

Enlarge / Cans of Tab diet soda on display in 2011. Tab was discontinued in 2020. There has never been a soda named “Spaces” that had a cult following.

Getty Images

Anybody can contribute to the Linux kernel, but any person’s commit suggestion can become the subject of the kernel’s master and namesake, Linus Torvalds. Torvalds is famously not overly committed to niceness, though he has been working on it since 2018. You can see glimpses of this newer, less curse-laden approach in how Torvalds recently addressed a commit with which he vehemently disagreed. It involves tabs.

The commit last week changed exactly one thing on one line, replacing a tab character with a space: “It helps Kconfig parsers to read file without error.” Torvalds responded with a commit of his own, as spotted by The Register, which would “add some hidden tabs on purpose.” Trying to smooth over a tabs-versus-spaces matter seemed to awaken Torvalds to the need to have tab-detecting failures be “more obvious.” Torvalds would have added more, he wrote, but didn’t “want to make things uglier than necessary. But it *mightbe necessary if it turns out we see more of this kind of silly tooling.”

If you’ve read this far and don’t understand what’s happening, please allow me, a failed CS minor, to offer a quick explanation: Tabs Versus Spaces will never be truly resolved, codified, or set right by standards, and the energy spent on the issue over time could, if harnessed, likely power one or more small nations. Still, the Linux kernel has its own coding style, and it directly cites “K&R,” or Kernighan & Ritchie, the authors of the coding bible The C Programming Language, which is a tabs book. If you are submitting kernel code, it had better use tabs (eight-character tabs, ideally, though that is tied in part to teletype and line-printer history).

By attempting to smooth over one tiny part of the kernel so that a parsing tool could see a space character as a delineating whitespace, Prasad Pandit inadvertently spurred a robust rebuttal:

It wasn’t clear what tool it was, but let’s make sure it gets fixed. Because if you can’t parse tabs as whitespace, you should not be parsing the kernel Kconfig files.

In fact, let’s make such breakage more obvious than some esoteric ftrace record size option. If you can’t parse tabs, you can’t have page sizes.

Yes, tab-vs-space confusion is sadly a traditional Unix thing, and ‘make’ is famous for being broken in this regard. But no, that does not mean that it’s ok.

Torvalds’ hidden tabs appear in the fourth release candidate for Linux kernel 6.9, which Torvlads wrote had “nothing particularly unusual going on” the week of its release.

Disclosure: The author is a tab person insofar as he has any idea what he’s doing.

This post was updated at 6: 33 pm Eastern to fix some line-break issues in the Torvalds blockquote. The irony was duly noted. A better link regarding the Tabs Vs. Spaces debate was also swapped in.

Linus Torvalds reiterates his tabs-versus-spaces stance with a kernel trap Read More »

attackers-are-pummeling-networks-around-the-world-with-millions-of-login-attempts

Attackers are pummeling networks around the world with millions of login attempts

Biz & IT, credential compromise, Security, SSH, Talos, vpns / /

UNDER SIEGE —

Attacks coming from nearly 4,000 IP addresses take aim at VPNs, SSH and web apps.

–

Attackers are pummeling networks around the world with millions of login attempts

Matejmo | Getty Images

Cisco’s Talos security team is warning of a large-scale credential compromise campaign that’s indiscriminately assailing networks with login attempts aimed at gaining unauthorized access to VPN, SSH, and web application accounts.

The login attempts use both generic usernames and valid usernames targeted at specific organizations. Cisco included a list of more than 2,000 usernames and almost 100 passwords used in the attacks, along with nearly 4,000 IP addresses sending the login traffic. The IP addresses appear to originate from TOR exit nodes and other anonymizing tunnels and proxies. The attacks appear to be indiscriminate and opportunistic rather than aimed at a particular region or industry.

“Depending on the target environment, successful attacks of this type may lead to unauthorized network access, account lockouts, or denial-of-service conditions,” Talos researchers wrote Tuesday. “The traffic related to these attacks has increased with time and is likely to continue to rise.”

The attacks began no later than March 18.

Tuesday’s advisory comes three weeks after Cisco warned of a similar attack campaign. Cisco described that one as a password spray directed at remote access VPNs from Cisco and third-party providers connected to Cisco firewalls. This campaign appeared to be related to reconnaissance efforts, the company said.

The attacks included hundreds of thousands or millions of rejected authentication attempts. Cisco went on to say that users can intermittently receive an error message that states, “Unable to complete connection. Cisco Secure Desktop not installed on the client.” Login attempts resulting in the error fail to complete the VPN connection process. The report also reported “symptoms of hostscan token allocation failures.”

A Cisco representative said company researchers currently don’t have evidence to conclusively link the activity in both instances to the same threat actor but that there are technical overlaps in the way the attacks were carried out, as well as the infrastructure that was used.

Talos said Tuesday that services targeted in the campaign include, but aren’t limited to:

  • Cisco Secure Firewall VPN
  • Checkpoint VPN
  • Fortinet VPN
  • SonicWall VPN
  • RD Web Services
  • Mikrotik
  • Draytek
  • Ubiquiti.

Anonymization IPs appeared to belong to services, including:

  • TOR
  • VPN Gate
  • IPIDEA Proxy
  • BigMama Proxy
  • Space Proxies
  • Nexus Proxy
  • Proxy Rack.

Cisco has already added the list of IP addresses mentioned earlier to a block list for its VPN offerings. Organizations can add the addresses to block lists for any third-party VPNs they’re using. A full list of indications of compromise is here.

Cisco has also provided a list of recommendations for preventing the attacks from succeeding. The guidance includes:

  • Enabling detailed logging, ideally to a remote syslog server so that admins can recognize and correlate attacks across various network endpoints
  • Securing default remote access accounts by sinkholing them unless they use the DefaultRAGroup and DefaultWEBVPNGroup profiles
  • Blocking connection attempts from known malicious sources
  • Implement interface-level and control plane access control lists to filter out unauthorized public IP addresses and prevent them from initiating remote VPN sessions.
  • Use the shun command.

Additionally, remote access VPNs should use certificate-based authentication. Cisco lists further steps for hardening VPNs here.

Attackers are pummeling networks around the world with millions of login attempts Read More »

bogus-botox-poisoning-outbreak-spreads-to-9-states,-cdc-says

Bogus Botox poisoning outbreak spreads to 9 states, CDC says

botox, botulism, CDC, health, injection, outbreak, Science / /

botched shots —

All of the case have been in women, nine of whom were hospitalized.

–

A package of counterfeit Botox.

A package of counterfeit Botox.

At least 19 women across nine US states appear to have been poisoned by bogus injections of Botox, the Centers for Disease Control and Prevention reported late Monday.

Nine of the 19 cases—47 percent—were hospitalized and four—21 percent—were treated with botulinum anti-toxin. The CDC’s alert and outbreak investigation follows reports in recent days of botulism-like illnesses linked to shady injections in Tennessee, where officials reported four cases, and Illinois, where there were two. The CDC now reports that the list of affected states also includes: Colorado, Florida, Kentucky, Nebraska, New Jersey, New York, and Washington.

In a separate alert Tuesday, the Food and Drug Administration said that “unsafe, counterfeit” versions of Botox had been found in several states, and the toxic fakes were administered by unlicensed or untrained people and/or in non-medical or unlicensed settings, such as homes or spas. The counterfeit products appeared to have come from an unlicensed source, generally raising the risks that they’re “misbranded, adulterated, counterfeit, contaminated, improperly stored and transported, ineffective and/or unsafe,” the FDA said.

The CDC and the FDA listed the various symptoms that followed injections of the counterfeit Botox, which include: blurred or double vision, drooping eyelids, difficulty swallowing, dry mouth, slurred speech, constipation, incontinence, shortness of breath or difficulty breathing, weakness, and difficulty lifting one’s head. “These symptoms are similar to those seen when botulinum toxin spreads to other parts of the body,” the FDA wrote. Anyone experiencing those symptoms after an injection should go to the emergency room or contact a health care professional.

Botox is a regulated drug containing purified, controlled doses of botulinum toxin, a neurotoxin made by Clostridium bacteria that causes muscle paralysis by blocking a neurotransmitter. It’s often injected into the face to reduce the appearance of wrinkles. The CDC reported that all 19 cases identified so far are in women between the ages of 25 and 59. Eighteen of the 19 specifically reported getting the injections for cosmetic purposes.

But harmful exposure to the toxin—such as from an infection, eating contaminated foods, or use of counterfeit Botox—can cause botulism or at least botulism-like illnesses. In severe cases, botulism can progress to descending, symmetric muscle weakness, full muscle paralysis, and can sometimes be fatal. The CDC reported that some of the people in the outbreak were hospitalized and treated with anti-toxin out of concern that the toxin had spread beyond the injection site. However, the agency noted that five people were specifically tested for botulism, and all tested negative.

In an email to Ars late last week, the CDC recommended that anyone interested in a Botox injection do so using “an FDA-approved product, administered by licensed providers and in licensed settings.” The agency added in its alert Monday: ” If in doubt, don’t get the injection.”

The FDA, meanwhile, provided detailed information on how to ensure your shot of Botox is the real thing. FDA-approved Botox is made by AbbVie, and authentic Botox products come in unit doses of 50, 100, and 200. The outside of the box should say “BOTOX® COSMETIC / onabotulinumtoxinA / for Injection” or “OnabotulinumtoxinA / BOTOX® / for injection,” and it should list the manufacturer as either “Allergan Aesthetics / An AbbVie Company” or “abbvie.” The active ingredient should be listed as “OnabotulinumtoxinA” on the box.

In contrast, some of the counterfeit versions the FDA has tracked down so far were sold in 150-unit doses (not made by AbbVie), only appear to have “Allergan” on the box (not the full manufacturer name), and the active ingredient is displayed as “Botulinum Toxin Type A” instead of  “OnabotulinumtoxinA.” The counterfeit versions also have had non-English language text on the outside of the box and displayed a lot number of C3709C3. Any one of these features is a sign that the product is counterfeit. Images of the counterfeit products from the FDA are below.

Bogus Botox poisoning outbreak spreads to 9 states, CDC says Read More »

studies-reveal-new-clues-to-how-tardigrades-can-survive-intense-radiation

Studies reveal new clues to how tardigrades can survive intense radiation

animals, Biology, Extremophiles, Genetics, proteins, Science, tardigrades / /

It’s in the genes —

Radiation damages their DNA; they’re just able to repair that damage very quickly.

–

SEM Micrograph of a tardigrade, commonly known as a water bear

Enlarge / SEM Micrograph of a tardigrade, more commonly known as a “water bear” or “moss piglet.”

Cultura RM Exclusive/Gregory S. Paulson/Getty Images

Since the 1960s, scientists have known that the tiny tardigrade can withstand very intense radiation blasts 1,000 times stronger than what most other animals could endure. According to a new paper published in the journal Current Biology, it’s not that such ionizing radiation doesn’t damage tardigrades’ DNA; rather, the tardigrades are able to rapidly repair any such damage. The findings complement those of a separate study published in January that also explored tardigrades’ response to radiation.

“These animals are mounting an incredible response to radiation, and that seems to be a secret to their extreme survival abilities,” said co-author Courtney Clark-Hachtel, who was a postdoc in Bob Goldstein’s lab at the University of North Carolina at Chapel Hill, which has been conducting research into tardigrades for 25 years. “What we are learning about how tardigrades overcome radiation stress can lead to new ideas about how we might try to protect other animals and microorganisms from damaging radiation.”

As reported previously, tardigrades are micro-animals that can survive in the harshest conditions: extreme pressure, extreme temperature, radiation, dehydration, starvation—even exposure to the vacuum of outer space. The creatures were first described by German zoologist Johann Goeze in 1773. They were dubbed tardigrada (“slow steppers” or “slow walkers”) four years later by Lazzaro Spallanzani, an Italian biologist. That’s because tardigrades tend to lumber along like a bear. Since they can survive almost anywhere, they can be found in lots of places: deep-sea trenches, salt and freshwater sediments, tropical rain forests, the Antarctic, mud volcanoes, sand dunes, beaches, and lichen and moss. (Another name for them is “moss piglets.”)

When their moist habitat dries up, however, tardigrades go into a state known as “tun”—a kind of suspended animation, which the animals can remain in for as long as 10 years. When water begins to flow again, water bears absorb it to rehydrate and return to life. They’re not technically members of the extremophile class of organisms since they don’t so much thrive in extreme conditions as endure; technically, they belong to the class of extremotolerant organisms. But their hardiness makes tardigrades a favorite research subject for scientists.

For instance, a 2017 study demonstrated that tardigrades use a special kind of disordered protein to literally suspend their cells in a glass-like matrix that prevents damage. The researchers dubbed this a “tardigrade-specific intrinsically disordered protein” (TDP). In other words, the cells become vitrified. The more TDP genes a tardigrade species has, the more quickly and efficiently it goes into the tun state.

In 2021, another team of Japanese scientists called this “vitrification” hypothesis into question, citing experimental data suggesting that the 2017 findings could be attributed to water retention of the proteins. The following year, researchers at the University of Tokyo identified the mechanism to explain how tardigrades can survive extreme dehydration: cytoplasmic-abundant heat soluble (CAHS) proteins that form a protective gel-like network of filaments to protect dried-out cells. When the tardigrade rehydrates, the filaments gradually recede, ensuring that the cell isn’t stressed or damaged as it regains water.

When it comes to withstanding ionizing radiation, a 2016 study identified a DNA damage suppressor protein dubbed “Dsup” that seemed to shield tardigrade genes implanted into human cells from radiation damage. However, according to Clark-Hatchel et al., it still wasn’t clear whether this kind of protective mechanism was sufficient to fully account for tardigrades’ ability to withstand extreme radiation. Other species of tardigrade seem to lack Dsup proteins, yet still have the same high radiation tolerance, which suggests there could be other factors at play.

A team of French researchers at the French National Museum of Natural History in Paris ran a series of experiments in which they zapped water bear specimens with powerful gamma rays that would be lethal to humans. They published their results earlier this year in the journal eLife. The French team found that gamma rays did actually damage the tardigrade DNA, much like they would damage human cells. Since the tardigrades survived, this suggested the tardigrades were able to quickly repair the damaged DNA.

Further experiments with three different species (including one that lacks Dsup proteins) revealed the tardigrades were producing very high amounts of DNA repair proteins. They also found a similar uptick of proteins unique to tardigrades, most notably tardigrade DNA damage response protein 1 (TDR1), which seems to protect DNA from radiation. “We found that TDR1 protein interacts with DNA and forms aggregates at high concentration suggesting it may condensate DNA and act by preserving chromosome organization until DNA repair is accomplished,” the authors wrote.

Clark-Hatchel et al. independently arrived at similar conclusions from their own experiments. Taken together, the two studies confirm that this extremely rapid up-regulation of many DNA repair genes in response to exposure to ionizing radiation should be sufficient to explain the creatures’ impressive resistance to that radiation. It’s possible that there is a “synergy between protective and repair mechanisms” when it comes to tardigrade tolerance of ionizing radiation.

That said, “Why tardigrades have evolved a strong IR tolerance is enigmatic given that it is unlikely that tardigrades were exposed to high doses of ionizing radiation in their evolutionary history,” Clark-Hatchel et al. wrote.  They thought there could be a link to the mechanisms that enable tardigrades to survive extreme dehydration, which can also result in damaged DNA. Revisiting data from desiccation experiments did not show nearly as strong an increase in DNA repair transcripts, but the authors suggest that the uptick could occur later in the process, upon rehydration—an intriguing topic for future research.

Current Biology, 2024. DOI: 10.1016/j.cub.2024.03.019  (About DOIs).

eLife, 2024. DOI: 10.7554/eLife.92621.1

Studies reveal new clues to how tardigrades can survive intense radiation Read More »

isps-can-charge-extra-for-fast-gaming-under-fcc’s-internet-rules,-critics-say

ISPs can charge extra for fast gaming under FCC’s Internet rules, critics say

fcc net neutrality, Policy / /

Fast lanes —

FCC plan rejected request to ban what agency calls “positive” discrimination.

–

Illustration of network data represented by curving lines flowing on a dark background.

Getty Images | Yuichiro Chino

Some net neutrality proponents are worried that soon-to-be-approved Federal Communications Commission rules will allow harmful fast lanes because the plan doesn’t explicitly ban “positive” discrimination.

FCC Chairwoman Jessica Rosenworcel’s proposed rules for Internet service providers would prohibit blocking, throttling, and paid prioritization. The rules mirror the ones imposed by the FCC during the Obama era and repealed during Trump’s presidency. But some advocates are criticizing a decision to let Internet service providers speed up certain types of applications as long as application providers don’t have to pay for special treatment.

Stanford Law Professor Barbara van Schewick, who has consistently argued for stricter net neutrality rules, wrote in a blog post on Thursday that “harmful 5G fast lanes are coming.”

“T-Mobile, AT&T and Verizon are all testing ways to create these 5G fast lanes for apps such as video conferencing, games, and video where the ISP chooses and controls what gets boosted,” van Schewick wrote. “They use a technical feature in 5G called network slicing, where part of their radio spectrum gets used as a special lane for the chosen app or apps, separated from the usual Internet traffic. The FCC’s draft order opens the door to these fast lanes, so long as the app provider isn’t charged for them.”

In an FCC filing yesterday, AT&T said that carriers will use network slicing “to better meet the needs of particular business applications and consumer preferences than they could over a best-efforts network that generally treats all traffic the same.”

Carriers could charge more for faster gaming

Van Schewick warns that carriers could charge consumers more for plans that speed up specific types of content. For example, a mobile operator could offer a basic plan alongside more expensive tiers that boost certain online games or a tier that boosts services like YouTube and TikTok.

Ericsson, a telecommunications vendor that sells equipment to carriers including AT&T, Verizon, and T-Mobile, has pushed for exactly this type of service. In a report on how network slicing can be used commercially, Ericsson said that “many gamers are willing to pay for enhanced gaming experiences” and would “pay up to $10.99 more for a guaranteed gaming experience on top of their 5G monthly subscription.”

Before the draft net neutrality order was released, van Schewick urged the FCC to “clarify that its proposed no-throttling rule prohibits ISPs from speeding up and slowing down applications and classes of applications.”

In a different filing last month, several advocacy groups similarly argued that the “no-throttling rule needs to ban selective speeding up, in addition to slowing down.” That filing was submitted by the American Civil Liberties Union, the Electronic Frontier Foundation, the Open Technology Institute at New America, Public Knowledge, Fight for the Future, and United Church of Christ Media Justice Ministry.

The request for a ban on selective speeding was denied in paragraph 492 of Rosenworcel’s draft rules, which are scheduled for an April 25 vote. The draft order argues that the FCC’s definition of “throttling” is expansive enough that an explicit ban on what the agency called positive discrimination isn’t needed:

With the no-throttling rule, we ban conduct that is not outright blocking, but inhibits the delivery of particular content, applications, or services, or particular classes of content, applications, or services. Likewise, we prohibit conduct that impairs or degrades lawful traffic to a non-harmful device or class of devices. We interpret this prohibition to include, for example, any conduct by a BIAS [Broadband Internet Access Service] provider that impairs, degrades, slows down, or renders effectively unusable particular content, services, applications, or devices, that is not reasonable network management. Our interpretation of “throttling” encompasses a wide variety of conduct that could impair or degrade an end user’s ability to access content of their choosing; thus, we decline commenters’ request to modify the rule to explicitly include positive and negative discrimination of content.

ISPs can charge extra for fast gaming under FCC’s Internet rules, critics say Read More »

so-much-for-free-speech-on-x;-musk-confirms-new-users-must-soon-pay-to-post

So much for free speech on X; Musk confirms new users must soon pay to post

ai bots, elon musk, Policy, spam accounts, spam bots, Twitter, X / /

100 pennies for your thoughts? —

The fee, likely $1, is aimed at stopping “relentless” bots, Musk said.

–

So much for free speech on X; Musk confirms new users must soon pay to post

Elon Musk confirmed Monday that X (formerly Twitter) plans to start charging new users to post on the platform, TechCrunch reported.

“Unfortunately, a small fee for new user write access is the only way to curb the relentless onslaught of bots,” Musk wrote on X.

In October, X confirmed that it was testing whether users would pay a small annual fee to access the platform by suddenly charging new users in New Zealand and the Philippines $1. Paying the fee enabled new users in those countries to post, reply, like, and bookmark X posts.

That test was deemed the “Not-A-Bot” program, and it’s unclear how successful it was at stopping bots. But X deciding to expand the program seems to suggest that the test must have had some success.

Musk has not yet clarified when X’s “small fee” might be required for new users, only confirming in a later post that any new users who avoid paying the fee will be able to post after three months. Ars created new accounts on the web and in the app, and neither signup required any fees yet.

Although Musk’s posts only mention paying for “write access,” it seems likely that the other features limited by the “Not-A-Bot” program will also be limited during those three months for any users who do not pay the fee, too. An X account called @x_alerts_ noticed on Sunday that X was updating its web app text that was seemingly enabling the “Not-A-Bot” program.

“Changes have been detected in the texts of the X web app!” @x_alerts_ wrote, noting that the altered text seemed to limit not just posting and replying, but also liking and bookmarking X posts.

“It looks like this text has been in the app, but they recently changed it, so not sure whether it’s an indication of launch or not!” the user wrote.

Back when X launched the “Not-A-Bot” program, Musk claimed that charging a $1 annual fee would make it “1000X harder to manipulate the platform.” In a help center post, X said that the “test was developed to bolster our already significant efforts to reduce spam, manipulation of our platform, and bot activity.”

Earlier this month, X warned users it was widely purging spam accounts, TechCrunch noted. X Support confirmed that follower counts would likely be impacted during that purge, because “we’re casting a wide net to ensure X remains secure and free of bots.”

But that attempt to purge bots apparently did not work as well as X hoped. This week, Musk confirmed that X is still struggling with “AI (and troll farms)” that he said are easily able to pass X’s “are you a bot” tests.

It’s hard to keep up with X’s inconsistent messaging on its bot problem since Musk took over. Last summer, Musk told attendees of The Wall Street Journal’s CEO Council that the platform had “eliminated at least 90 percent of scams,” claiming there had been a “dramatic improvement” in the platform’s ability to “detect and remove troll armies.”

At that time, experts told The Journal that solving X’s bot problem was nearly impossible because spammers’ tactics were always evolving and bots had begun using generative AI to avoid detection.

Musk’s plan to charge a fee to overcome bots won’t work, experts told WSJ, because anyone determined to spam X can just find credit cards and buy disposable phones on the dark web. And any bad actor who can’t find what they need on the dark web could theoretically just wait three months to launch scams or spread harmful content like disinformation or propaganda. This leads some critics to wonder what the point of charging the small fee really is.

When the “Not-A-Bot” program launched, X Support directly disputed critics’ claims that the program was simply testing whether charging small fees might expand X’s revenue to help Musk get the platform out of debt.

“This new test was developed to bolster our already successful efforts to reduce spam, manipulation of our platform, and bot activity, while balancing platform accessibility with the small fee amount,” X Support wrote on X. “It is not a profit driver.”

It seems likely that Musk is simply trying everything he can think of to reduce bots on the platform, even though it’s widely known that charging a subscription fee has failed to stop bots from overrunning other online platforms (just ask frustrated fans of World of Warcraft). Musk, who famously overpaid for Twitter and has been climbing out of debt since, has claimed since before the Twitter deal closed that his goal was to eliminate bots on the platform.

“We will defeat the spam bots or die trying!” Musk tweeted back in 2022, when a tweet was still a tweet and everyone could depend on accessing Twitter for free.

So much for free speech on X; Musk confirms new users must soon pay to post Read More »

second-biggest-black-hole-in-the-milky-way-found

Second-biggest black hole in the Milky Way found

astronomy, astrophysics, black holes, Gaia, Science, stars / /
A dark background with a bright point at the end of a curved path, and a small red circle.

Enlarge / The star’s orbit, shown here in light, is influenced by the far more massive black hole, indicated by the red orbit.

As far as black holes go, there are two categories: supermassive ones that live at the center of the galaxies (and we’re unsure about how they got there) and stellar mass ones that formed through the supernovae that end the lives of massive stars.

Prior to the advent of gravitational wave detectors, the heaviest stellar-mass black hole we knew about was only a bit more than a dozen times the mass of the Sun. And this makes sense, given that the violence of the supernova explosions that form these black holes ensures that only a fraction of the dying star’s mass gets transferred into its dark offspring. But then the gravitational wave data started flowing in, and we discovered there were lots of heavier black holes, with masses dozens of times that of the Sun. But we could only find them when they smacked into another black hole.

Now, thanks to the Gaia mission, we have observational evidence of the largest black hole in the Milky Way outside of the supermassive one, with a mass 33 times that of the Sun. And, in galactic terms, it’s right next door at about 2,000 light-years distant, meaning it will be relatively easy to learn more.

Mapping the stars

Although stellar-mass black holes are several times the mass of the Sun, they aren’t really all that heavy in the grand scheme of things. The sorts of stars that tend to leave black holes behind also tend to lead violent existences, spewing a lot of themselves into space before dying. And the supernova that forms the black hole obviously expels a lot of the star’s mass, rather than feeding it into the black hole. It had been thought that these processes set limits on how big a stellar mass black hole could be when it forms.

The discovery of larger black holes through gravitational wave detectors suggested that this wasn’t true. While there are ways for black holes to get bigger after they form—excessive feeding, mergers—it wasn’t clear that these events occurred often enough to explain the frequency of heavy black holes that we were seeing. And detecting them via gravitational waves doesn’t tell us anything about the history of how they got that large.

Which is why the discovery of Gaia BH3 (which is what the research team is using to avoid having to retype Gaia DR3 4318465066420528000 all the time) is so intriguing. The black hole is sitting calmly in a binary system, not doing anything in particular. But we know it’s there due to its gravitational influence.

Gaia is an ESA mission to map the location and movement of many of the Milky Way’s brighter stars by imaging them multiple times from different perspectives. It also gathers basic data on the stars’ light, allowing us to estimate things like age and composition. And, in addition to their movement across the galaxy, Gaia can measure their movement relative to Earth, a method that is useful for the detection of orbital interactions, such as the presence of companion stars or exoplanets.

The Gaia team was busy preparing for the fourth release of the data from the spacecraft and were running validation tests on the software used to detect binary star systems when they stumbled across Gaia BH3. While normally they’d publish its discovery at the same time as the data release, they consider the new object too important to wait: “We took the exceptional step of the publication of this paper based on preliminary data ahead of the official DR4 due to the unique nature of the discovery, which we believe should not be kept from the scientific community until the next release.”

Finding the invisible

Every star in our galaxy is in motion relative to every other. They orbit the center of our galaxy and may have a history that has imparted additional momentum—gravitational interactions with neighbors, having been part of a smaller galaxy that was consumed by the Milky Way, and so on. But that motion only changes on very long time scales. By contrast, any star in an orbit experiences regular changes in its motion in addition to its overall travel through the galaxy. As part of processing its data, the Gaia team attempts to identify both overall motion and any indications that a star is orbiting as part of a binary system.

The star that is orbiting Gaia BH3 is similar in mass to the Sun but shows the sort of periodic wobbles that indicate it’s in a mutual orbit with a companion. The companion itself, however, was completely invisible, which means it is almost certainly a black hole (the Gaia data had already been used to identify black holes this way). And, based on the mass and orbital motion of the visible star, it’s possible to estimate the mass of the invisible companion.

The estimate ended up being 32 solar masses, which is significantly larger than anything else identified in the Gaia dataset. So, the Gaia team wanted to confirm this wasn’t a software issue and used Earth-based telescopes to observe the same system. Three different observatories confirmed it was there, and the resulting mass estimates were slightly larger than those derived from the Gaia data alone: just under 33 solar masses.

Assuming it’s a single object and not two black holes orbiting each other closely, that makes it the largest non-supermassive black hole known in the Milky Way. And it places it in the mass range that had been difficult to explain via formations in supernovae.

Second-biggest black hole in the Milky Way found Read More »

ev-fast-charging-comes-to-condos-and-apartments

EV fast-charging comes to condos and apartments

ADS-TEC, Cars, dc charging, EV charging / /

30 min and go —

A battery-buffered DC charger is an alternative to a bank of shared AC chargers.

–

A woman plugs a Rivian SUV into a fast charger.

Enlarge / The Marina Palms condo development in Miami recently added an ADS-TEC ChargeBox DC fast charger for its residents.

ADS-TEC

Right now, the electric vehicle ownership experience is optimized for the owner who lives in a single-family home. A level 2 home AC charger costs a few hundred dollars, and with a garage or carport, an EV that gets plugged in each night is an EV that starts each day with a 100 percent charged battery pack. Plenty of Ars readers have told us that a 120 V outlet even works for their needs, although perhaps better for Chevy Bolt-sized batteries rather than a Hummer EV.

However, about a third of Americans live in large multifamily developments, often in cities that stand to benefit the most from a switch to electrification. And electrifying the parking lots of existing developments is often easier said than done. Some developments will allow individuals to install their own dedicated charger, and newly built developments may even have planned ahead and put conduits in place already.

For many others, the parking spaces will be owned by the condo association or co-op, complicating the idea of giving each EV driver their own plug. Here, shared solutions make more sense, perhaps starting with one or two shared level 2 chargers as a pilot—often this won’t even require extra work to the electrical panel. Costs are a little higher than for a home level 2 charger—between $7,500–$15,000 per charger, perhaps.

But for larger developments, scaling up level 2 chargers can quickly become prohibitively expensive. Older buildings may well need their electrical infrastructure to be upgraded, and running copper wiring across parking lots starts to add up fast.

Faced with the install costs for a dozen 2 chargers, a battery-buffered DC fast charger starts to look like an attractive alternative. These use an existing electrical feed to trickle-charge a lithium-ion battery pack that can then DC fast-charge an EV, rather than requiring hundreds of kilowatts. Instead of taking 6–10 hours to recharge with AC power, about 30 minutes is usually sufficient to return most EVs to 80 percent state of charge with a DC fast charger.

A condo building in Miami, the Marina Palms, recently made just this decision after a boom in the number of residents with EVs created a need for more charging capacity than its six existing level 2 chargers could offer. It went with a ChargeBox from ADS-TEC Energy, which is capable of charging at up to 320 kW.

“That was one of the biggest appeals, that we didn’t have to work with the electrical infrastructure of our development or grow it or whatever, just to get this charger installed. I think we have 200 kW in the power grid on that side, and we’re using 100 kW. The other way [with multiple level 2 chargers] we would be using a minimum of 140 kW, if not the whole thing, and then we have no buffer for something else we might be doing like—for instance a car lift or that type of thing,” explained George Barriere, general manager for the Marina Palms.

If the costs are comparable, there’s another benefit to picking a DC fast charger in place of a bank of AC plugs—it takes up less room. “We didn’t use anything from our inventory of parking, which is the biggest problem for condos—lack of parking. So, we would have to have 20 parking spaces for 20 level 2 chargers in order to service the same number of vehicles that we’re doing with two parking spaces [with a single level 3 charger],” Barriere told me.

“Our deployment at the Marina Palms Yacht Club and Residences serves as a model for other large condominium and apartment complexes in Miami and elsewhere in the US,” said Thomas Seidel, CEO of ADS-TEC. “The lack of charging infrastructure is still a deterrent in driver adoption of EVs. ADS-TEC Energy is solving this problem with our solution. We look forward to rolling out additional installations across the US this year. The advantages we provide will be a huge step for the US in building a strong and reliable charging infrastructure.”

EV fast-charging comes to condos and apartments Read More »

the-lines-between-streaming-and-cable-continue-to-blur

The lines between streaming and cable continue to blur

ads, cable, Disney, Disney Plus, netflix, streaming, Tech / /

Here we go again —

Disney+ to offer 24/7 channels to play Star Wars content, commercials.

–

O.B., aka Ouroboros, in Marvel's <em>Loki</em> show, which streams on Disney+.” src=”https://cdn.arstechnica.net/wp-content/uploads/2024/04/ARC-201-10072_R-1200×800-5b2df79-800×533.jpg”></img><figcaption> <p><a data-height=Enlarge / O.B., aka Ouroboros, in Marvel’s Loki show, which streams on Disney+.

Despite promises of new and improved TV and movie viewing experiences, streaming services remain focused on growing revenue and app usage. As a result of that focus, streaming companies are mimicking the industry they sought to replace—cable.

On Monday, The Information reported that Disney plans to add “a series” of channels to the Disney+ app. Those channels would still be streamed and require a Disney+ subscription to access. But they would work very much like traditional TV channels, featuring set programming that runs 24/7 with commercials. Disney hasn’t commented on the report.

Disney is exploring adding channels to Disney+ with “programming in specific genres, including either Star Wars or Marvel-branded shows,” The Information said, citing anonymous “people involved in the planning.” It’s unknown when the Disney+ channels are expected to launch.

The report comes as streaming services continue trying to find ways to capitalize off cable companies’ customer base. NBCUniversal’s Peacock streaming service already offers subscribers over 50 always-on live channels. Hulu and Paramount+ offer live TV with cable channels. Streaming platforms are also eager to license content normally delegated to traditional TV channels, including old shows like Suits, the 2023 streaming record-setter, and live sporting events like WWE Raw.

Channel surfing 2.0

If you’ve followed the streaming industry lately, you won’t be surprised to hear that ad dollars are reportedly behind the push for live channels. Disney+, like many streaming services, aims to be profitable by the end of Disney’s 2024 fiscal year and extract as much revenue from each subscriber as possible (including by using tactics like password crackdowns) to fuel profits.

The news follows similar moves by Disney, including adding Hulu to the Disney+ app, as well as plans to add ESPN to Disney+, too, according to The Information. Disney is also attempting to launch a joint sports-streaming app with Fox and Warner Bros. Discovery (WBD). It’s not hard to imagine Disney one day (assuming the app ever debuts) making the sports app’s content accessible through Disney+.

“The idea is to make Disney+ a service that has something for everyone, anytime,” The Information reported.

That sounds an awful lot like cable, which spent years growing customers’ monthly bills by adding more channels and bundles aimed at specific interests, like children’s entertainment, sports, and lifestyle. The ability to hop from on-demand Disney kids’ movies to on-demand sitcoms on Hulu to live programming centered on (the seemingly endless piles of) Marvel and Star Wars content feels a lot like channel surfing. It wasn’t too long ago when channel surfing was viewed as a time-suck.

Netflix has also reportedly considered ways to unite other streaming platforms with Netflix in order to extend the amount of time spent on Netflix. In late 2022, Netflix “explored creating a store within its app for users to subscribe to and watch other streaming services, all without leaving the Netflix app,” The Information said, citing an unnamed person “who was involved in those exploratory discussions.” Netflix reportedly decided not to move ahead with the plans for now but still could. It hasn’t commented on The Information’s report.

As we saw with Netflix’s password crackdown and streaming’s shift to ads, streaming companies tend to copy each other’s strategies for revenue growth. And live channels could be something more streaming companies get involved in, as WBD and Amazon, as examples, already have (albeit separate from their flagship, on-demand streaming apps, which differs from what Disney+’s live channel reportedly will reportedly be like).

Disney, notably, is no stranger to the business of online live channels, having 21 similar offerings within the ABC.com app, including a channel for ABC News and another for General Hospital.

Subscription-based streaming services may even have an easier time competing for ad dollars than free, ad-supported TV (FAST) streaming channels, such as those on Tubi and Pluto TV. Susan Schiekofer, chief digital investment officer for GroupM, the top US ad-buying company, told The Information that advertisers might feel more comfortable allotting dollars to ad-supported channels that are tied to users who have already spent money on a subscription.

Streaming services initially were a way to get only the content you wanted on demand and commercial-free. But the report about Disney+ and Netflix are just two examples of growing interest in reinvigorating the strategies of linear TV. Instead of jumping from network to network within cable, there’s interest in getting people to jump from one streaming service to another within one platform—with plenty of commercials along the way.

The lines between streaming and cable continue to blur Read More »

youtube-puts-third-party-clients-on-notice:-show-ads-or-get-blocked

YouTube puts third-party clients on notice: Show ads or get blocked

Google, Tech / /

Blocking the ad blockers —

Google would really like it if everyone just paid for YouTube Premium instead.

–

YouTube app icon on a TV screen.

Getty Images | Chris McGrath

YouTube is putting third-party ad-blocking apps on notice. An ominous post on the official YouTube Community Help forum titled “Enforcement on Third Party Apps” says the company is “strengthening our enforcement on third-party apps that violate YouTube’s Terms of Service, specifically ad-blocking apps.” Google would really like it if you all paid for YouTube Premium.

YouTube has been coming down on third-party apps, which often enable YouTube ad blocking. The company shut down one of the most popular third-party apps, “YouTube Vanced,” in 2022. Vanced was open source, though, so new alternatives sprung up almost immediately. Vanced takes the official YouTube Android client and installs a duplicate, alternative version with a bunch of patches. It turns on all the YouTube Premium features like ad-blocking, background playback, and downloading without paying for the Premium sub. It also adds features the official app doesn’t have, like additional themes and accessibility features, “repeat” and “dislike” buttons, and the ability to turn off addictive “suggestions” that appear all over the app.

Another popular option is “NewPipe,” a from-scratch YouTube player that follows the open source ethos and is available on the FOSS-only store F-Droid. NewPipe wants a lightweight client without the proprietary code and million permissions that YouTube needs, but it also blocks ads.

Rather than going after the projects, Google says it’s going to start disrupting users who are using these apps. The post writes, “Viewers who are using these third-party apps may experience buffering issues or see the error ‘The following content is not available on this app’ when trying to watch a video.” The company continues: “We want to emphasize that our terms don’t allow third-party apps to turn off ads because that prevents the creator from being rewarded for viewership, and Ads on YouTube help support creators and let billions of people around the world use the streaming service.”

If you remember back to when Google aggressively fought to keep third-party YouTube apps off of Windows Phone, the company seemed to take a similar stance against all third-party YouTube clients, even if they wanted to integrate ads. Today Google says that’s no longer the case, and it would allow third-party YouTube clients provided “they follow our API Services Terms of Service.” We don’t know of any apps that are actually taking Google up on that offer, though.

YouTube puts third-party clients on notice: Show ads or get blocked Read More »

change-healthcare-faces-another-ransomware-threat—and-it-looks-credible

Change Healthcare faces another ransomware threat—and it looks credible

Biz & IT, Security / /
Medical Data Breach text write on keyboard isolated on laptop background

For months, Change Healthcare has faced an immensely messy ransomware debacle that has left hundreds of pharmacies and medical practices across the United States unable to process claims. Now, thanks to an apparent dispute within the ransomware criminal ecosystem, it may have just become far messier still.

In March, the ransomware group AlphV, which had claimed credit for encrypting Change Healthcare’s network and threatened to leak reams of the company’s sensitive health care data, received a $22 million payment—evidence, publicly captured on bitcoin’s blockchain, that Change Healthcare had very likely caved to its tormentors’ ransom demand, though the company has yet to confirm that it paid. But in a new definition of a worst-case ransomware, a different ransomware group claims to be holding Change Healthcare’s stolen data and is demanding a payment of their own.

Since Monday, RansomHub, a relatively new ransomware group, has posted to its dark-web site that it has 4 terabytes of Change Healthcare’s stolen data, which it threatened to sell to the “highest bidder” if Change Healthcare didn’t pay an unspecified ransom. RansomHub tells WIRED it is not affiliated with AlphV and “can’t say” how much it’s demanding as a ransom payment.

RansomHub initially declined to publish or provide WIRED any sample data from that stolen trove to prove its claim. But on Friday, a representative for the group sent WIRED several screenshots of what appeared to be patient records and a data-sharing contract for United Healthcare, which owns Change Healthcare, and Emdeon, which acquired Change Healthcare in 2014 and later took its name.

While WIRED could not fully confirm RansomHub’s claims, the samples suggest that this second extortion attempt against Change Healthcare may be more than an empty threat. “For anyone doubting that we have the data, and to anyone speculating the criticality and the sensitivity of the data, the images should be enough to show the magnitude and importance of the situation and clear the unrealistic and childish theories,” the RansomHub contact tells WIRED in an email.

Change Healthcare didn’t immediately respond to WIRED’s request for comment on RansomHub’s extortion demand.

Brett Callow, a ransomware analyst with security firm Emsisoft, says he believes AlphV did not originally publish any data from the incident, and the origin of RansomHub’s data is unclear. “I obviously don’t know whether the data is real—it could have been pulled from elsewhere—but nor do I see anything that indicates it may not be authentic,” he says of the data shared by RansomHub.

Jon DiMaggio, chief security strategist at threat intelligence firm Analyst1, says he believes RansomHub is “telling the truth and does have Change HealthCare’s data,” after reviewing the information sent to WIRED. While RansomHub is a new ransomware threat actor, DiMaggio says, they are quickly “gaining momentum.”

If RansomHub’s claims are real, it will mean that Change Healthcare’s already catastrophic ransomware ordeal has become a kind of cautionary tale about the dangers of trusting ransomware groups to follow through on their promises, even after a ransom is paid. In March, someone who goes by the name “notchy” posted to a Russian cybercriminal forum that AlphV had pocketed that $22 million payment and disappeared without sharing a commission with the “affiliate” hackers who typically partner with ransomware groups and often penetrate victims’ networks on their behalf.

Change Healthcare faces another ransomware threat—and it looks credible Read More »