×
AT&T

AT&T Will Issue $5 Reimbursements For 12-Hour Outage (cnn.com) 45

CNN reports: AT&T is reimbursing customers for the nearly 12-hour network outage on Thursday, the company announced in a news release. The mobile network will issue a $5 credit to "potentially impacted" AT&T Wireless customers, which it says is the "average cost of a full day of service."
The credit will be applied automatically "within 2 bill cycles," according to an announcement at the URL att.com/makeitright. "We recognize the frustration this outage has caused and know we let many of our customers down."

In a much smaller font, they note that the credit "does not apply to AT&T Business, AT&T Prepaid or Cricket.

More from CNN: AT&T had encountered sporadic service interruptions in the days leading up to the outage, including a temporary 911 outage in some parts of the southeast. While regional disruptions to wireless service happen occasionally, prolonged nationwide outages are rare. The Federal Communications Commission confirmed Thursday it was investigating the incident...

Several hours after service was restored, AT&T released an update stating the outage seemed to be the result of an internal issue, not a cybersecurity threat. "Based on our initial review, we believe that today's outage was caused by the application and execution of an incorrect process used as we were expanding our network," the company said.

On Saturday, AT&T reiterated it was taking steps "to prevent this from happening again in the future," but did not elaborate.

AI

Tinder Owner Inks Deal With OpenAI (techcrunch.com) 27

An anonymous reader quotes a report from TechCrunch: In a press release written with help from ChatGPT, Match Group announced an enterprise agreement with the AI chatbot's maker, OpenAI. The new agreement includes over 1,000 enterprise licenses for the dating app giant and home to Tinder, Match, OkCupid, Hinge and others. The AI tech will be used to help Match Group employees with work-related tasks, the company says, and come as part of Match's $20 million-plus bet on AI in 2024. [...] As for the news itself, Match Group says it will begin using the AI tech, and specifically ChatGPT-4, to aid with coding, design, analysis, build templates, and other daily tasks, including, as you can tell, communications. To keep its corporate data protected, only trained and licensed Match Group employees will have access to OpenAI's tools, it noted.

Before being able to use these tools, Match Group employees will also have to undergo mandatory training that focuses on responsible use, the technology's capabilities, as well as its limitations. The use will be guided by the company's existing privacy practices and AI principles, too. The company declined to share the cost of the agreement or how it will impact the tech giant's bottom line, but Match believes that the AI tools will make teams more productive. Match execs recently spoke of the company's plans for AI during the company's fourth-quarter earnings, noting that, this year, the app maker will use AI technology to both evolve its existing products and build new ones. The company's Shareholder letter explained how AI could help to improve various aspects of the dating app journey. For instance, it could help with profile creation, where Match is testing features like an AI-powered photo picker, and generative AI for help making bios. The company said that AI will also improve its matching abilities and post-match guidance, in areas like conversation starters, nudges, and offering date ideas.

Earth

The Sun Just Launched Three Huge Solar Flares in 24 Hours. (bostonglobe.com) 50

Three top-tier X-class solar flares launched off the sun between Wednesday and Thursday. The first two occurred seven hours apart, coming in at X1.9 and X1.6 magnitude respectively. The third, the most powerful of the current 11-year "solar cycle," ranked an impressive X6.3. From a report: Solar flares, or bursts of radiation, are ranked on a scale that goes from A, B and C to M and X, in increasing order of intensity. They usually originate from sunspots, or bruiselike discolorations on the surface of the sun. Sunspots are most common near the height of the 11-year solar cycle. The current cycle, number 25, is expected to reach its peak this year. The more sunspots, the more opportunities for solar flares.

Solar flares and accompanying coronal mass ejections, or CMEs, can influence "space weather" across the solar system, and even here on Earth. CMEs are slower shock waves of magnetic energy from the sun. Flares can reach Earth in minutes, but CMEs usually take at least a day. All three of the X-class solar flares disrupted shortwave radio communications on Earth. But the first two flares did not release a CME; the verdict is still out regarding whether the third flare did. High-frequency radio waves propagate by bouncing off electrons in Earth's ionosphere. That's a layer of Earth's atmosphere between 50 and 600 miles above the ground.

When a solar flare occurs, that radiation travels toward Earth at the speed of light. It can ionize additional particles in the lower ionosphere. Radio waves sent from devices below it then impact that extra-ionized layer and lose energy, and aren't able to be bent by ions at the top of the ionosphere. That means signals can't travel very far, and radio blackouts are possible. Three back-to-back radio blackouts occurred in response to the trio of flares, but primarily over the Pacific and Indian oceans. They were rated "R3" or greater on a 1 through 5 scale. According to the National Oceanic and Atmospheric Administration's Space Weather Prediction Center, that results in a "wide area blackout of [high frequency] radio communication, [and] loss of radio contact for about an hour on sunlit side of Earth." Low-frequency navigation signals, like those used on aircraft traveling overseas, can be degraded too.

The Courts

Snapchat Isn't Liable For Connecting 12-Year-Old To Convicted Sex Offenders (arstechnica.com) 59

An anonymous reader quotes a report from Ars Technica: A judge has dismissed (PDF) a complaint from a parent and guardian of a girl, now 15, who was sexually assaulted when she was 12 years old after Snapchat recommended that she connect with convicted sex offenders. According to the court filing, the abuse that the girl, C.O., experienced on Snapchat happened soon after she signed up for the app in 2019. Through its "Quick Add" feature, Snapchat "directed her" to connect with "a registered sex offender using the profile name JASONMORGAN5660." After a little more than a week on the app, C.O. was bombarded with inappropriate images and subjected to sextortion and threats before the adult user pressured her to meet up, then raped her. Cops arrested the adult user the next day, resulting in his incarceration, but his Snapchat account remained active for three years despite reports of harassment, the complaint alleged.

Two years later, at 14, C.O. connected with another convicted sex offender on Snapchat, a former police officer who offered to give C.O. a ride to school and then sexually assaulted her. The second offender is also currently incarcerated, the judge's opinion noted. The lawsuit painted a picture of Snapchat's ongoing neglect of minors it knows are being targeted by sexual predators. Prior to C.O.'s attacks, both adult users sent and requested sexually explicit photos, seemingly without the app detecting any child sexual abuse materials exchanged on the platform. C.O. had previously reported other adult accounts sending her photos of male genitals, but Snapchat allegedly "did nothing to block these individuals from sending her inappropriate photographs."

Among other complaints, C.O.'s lawsuit alleged that Snapchat's algorithm for its "Quick Add" feature was the problem. It allegedly recklessly works to detect when adult accounts are seeking to connect with young girls and, by design, sends more young girls their way -- continually directing sexual predators toward vulnerable targets. Snapchat is allegedly aware of these abuses and, therefore, should be held liable for harm caused to C.O., the lawsuit argued. Although C.O.'s case raised difficult questions, Judge Barbara Bellis ultimately agreed with Snapchat that Section 230 of the Communications Decency Act barred all claims and shielded Snap because "the allegations of this case fall squarely within the ambit of the immunity afforded to" platforms publishing third-party content. According to Bellis, C.O.'s family had "clearly alleged" that Snap had failed to design its recommendations systems to block young girls from receiving messages from sexual predators. Specifically, Section 230 immunity shields Snap from liability in this case because Bellis considered the messages exchanged to be third-party content. Snapchat designing its recommendation systems to deliver content is a protected activity, Bellis ruled.
Despite a seemingly conflicting ruling in Los Angeles that found that "Section 230 didn't protect Snapchat from liability for allegedly connecting teens with drug dealers," Bellis didn't appear to consider it persuasive. She did, however, critique Section 230's broad application, suggesting courts are limited without legislative changes, despite the morally challenging nature of some cases.
AI

The Justice Department Gets a Chief AI Officer 12

Princeton professor and technology law researcher Jonathan Mayer has been appointed as the Justice Department's first chief AI officer. The Verge reports: Attorney General Merrick Garland said in a statement that appointing an AI officer was important for the department to "keep pace with rapidly evolving scientific and technological developments." One of Mayer's responsibilities will be to build a team of technical and policy experts around cybersecurity and AI. Mayer will also serve as the department's chief science and technology advisor and help recruit tech talent.

Mayer held technology roles in government before his new Justice Department gig, according to his bio in Princeton's Center for Information Technology Policy. He served as an adviser on technology law and policy to Vice President Kamala Harris when she was still in the Senate. Mayer was also the chief technologist in the enforcement office of the Federal Communications Commission.
AT&T

AT&T Restores Service After Massive, Nationwide Outage (cnn.com) 55

An anonymous reader quotes a report from CNN Business: AT&T's network went down for many of its customers across the United States Thursday morning, leaving customers unable to place calls, text or access the internet. By a little after 3 pm ET, roughly 11 hours after reports of the outage first emerged, the company said that it had restored service to all impacted customers. "We have restored wireless service to all our affected customers. We sincerely apologize to them," AT&T said in a statement. The company added that it is "taking steps to ensure our customers do not experience this again in the future."

The Federal Communications Commission confirmed Thursday afternoon that it is investigating the outage. The White House says federal agencies are in touch with AT&T about network outages but that it doesn't have all the answers yet on what exactly led to the interruptions. Although Verizon and T-Mobile customers reported some network outages, too, they appeared far less widespread. T-Mobile and Verizon said their networks were unaffected by AT&T's service outage and customers reporting outages may have been unable to reach customers who use AT&T.

Thursday morning, more than 74,000 AT&T customers reported outages on digital-service tracking site DownDetector, with service disruptions beginning around 4 am ET. That's not a comprehensive number: It tracks only self-reported outages. Reports had been rising steadily throughout the morning but leveled off in the 9 am ET hour. By 12:30 pm ET, the DownDetector data showed some 25,000 AT&T customers still reporting outages. By 2 pm ET, fewer than 5,000 customers were still reporting issues. Earlier Thursday, AT&T acknowledged that it had a widespread outage but did not provide a reason for the system failure. By late morning, AT&T said most of its network was back online, and it confirmed Thursday afternoon that service was fully restored.
According to an anonymous industry source, the issue for the outage appears to be related to how cellular services hand off calls from one network to the next, a process known as peering. They said there's no indication that it was the result of a cyberattack or other malicious activity.

The FCC confirmed that it is investigating the incident. "We are aware of the reported wireless outages, and our Public Safety and Homeland Security Bureau is actively investigating," the FCC said in a statement posted on X. "We are in touch with AT&T and public safety authorities, including FirstNet, as well as other providers."
Science

Varda Space, Rocket Lab Nail First-of-Its-Kind Spacecraft Landing in Utah (techcrunch.com) 24

A spacecraft containing pharmaceutical drugs that were grown on orbit has finally returned to Earth today after more than eight months in space. From a report: Varda Space Industries' in-space manufacturing capsule, called Winnebago-1, landed in the Utah desert at around 4:40 p.m. EST. Inside the capsule are crystals of the drug ritonavir, which is used to treat HIV/AIDS. It marks a successful conclusion of Varda's first experimental mission to grow pharmaceuticals on orbit, as well as the first time a commercial company has landed a spacecraft on U.S. soil, ever. The capsule will now be sent back to Varda's facilities in Los Angeles for analysis, and the vials of ritonavir will be shipped to a research company called Improved Pharma for post-flight characterization, Varda said in a statement. The company will also be sharing all the data collected through the mission with the Air Force and NASA, per existing agreements with those agencies.

The first-of-its-kind reentry and landing is also a major win for Rocket Lab, which partnered with Varda on the mission. Rocket Lab hosted Varda's manufacturing capsule inside its Photon satellite bus; through the course of the mission, Photon provided power, communications, attitude control and other essential operations. At the mission's conclusion, the bus executed a series of maneuvers and de-orbit burns that put the miniature drug lab on the proper reentry trajectory. The final engine burn was executed shortly after 4 p.m. EST. Photon burned up in the atmosphere as planned while the capsule, protected by a heat shield and with the aid of a parachute, continued to land.

Medicine

FDA Warns Against Using Smartwatches and Smart Rings To Measure Blood Sugar (cnn.com) 50

In a warning issued Wednesday, the FDA said it has not authorized or approved any smartwatch or smart ring to measure blood glucose levels. The use of these devices can lead to inaccurate measurements and errors in managing diabetes that can be life-threatening, the agency said. From a report: These unauthorized devices are different from smartwatch apps that display data from FDA-approved continuous glucose monitoring devices that pierce the skin. The FDA did not name specific brands but said the sellers of these unauthorized smartwatches and smart rings advertise using âoenon-invasive techniquesâ to measure blood glucose without requiring people to prick their fingers or pierce their skin. However, these devices do not directly test blood glucose levels, the agency said, urging consumers to avoid buying them for that purpose.

The agency also advised health care providers to discuss the risk of using unauthorized blood glucose measuring devices with their patients and to help them select an appropriate authorized device for their needs. âoeThe agency is working to ensure that manufacturers, distributors, and sellers do not illegally market unauthorized smartwatches or smart rings that claim to measure blood glucose levels,â the FDA said in the statement. âoeIf your medical care depends on accurate blood glucose measurements, talk to your health care provider about an appropriate FDA-authorized device for your needs." .

Encryption

Apple Rolls Out iMessage Upgrade To Withstand Decryption By Quantum Computers (yahoo.com) 42

Apple is rolling out an upgrade to its iMessage texting platform to defend against future encryption-breaking technologies. From a report: The new protocol, known as PQ3, is another sign that U.S. tech firms are bracing for a potential future breakthrough in quantum computing that could make current methods of protecting users' communications obsolete. "More than simply replacing an existing algorithm with a new one, we rebuilt the iMessage cryptographic protocol from the ground up," an Apple blog post published on Wednesday reads. "It will fully replace the existing protocol within all supported conversations this year."

The Cupertino, California-based iPhone maker says its encryption algorithms are state-of-the-art and that it has found no evidence so far of a successful attack on them. Still, government officials and scientists are concerned that the advent of quantum computers, advanced machines that tap in to the properties of subatomic particles, could suddenly and dramatically weaken those protections. Late last year, a Reuters investigation explored how the United States and China are racing to prepare for that moment, dubbed "Q-Day," both by pouring money into quantum research and by investing in new encryption standards known as post-quantum cryptography. Washington and Beijing have traded allegations of intercepting massive amounts of encrypted data in preparation for Q-Day, an approach sometimes dubbed "catch now, crack later."
More on Apple's security blog.
Piracy

Cox Communications Wins Order Overturning $1 Billion US Copyright Verdict 17

Internet service provider Cox Communications has been cleared of a $1 billion jury verdict in favor of several major record labels that had accused it of failing to curb user piracy. "The 4th U.S. Circuit Court of Appeals in Richmond, Virginia, ruled on Tuesday that the amount of damages was not justified and that a federal district court should hold a new trial to determine the appropriate amount," reports Reuters. From the report: A Virginia jury in 2019 found Cox, the largest unit of privately-owned Cox Enterprises, liable for its customers' violations of over 10,000 copyrights belonging to labels including Sony Music Entertainment, Warner Music Group, and Universal Music Group. The labels' attorney Matt Oppenheim said that the appeals court "affirmed the jury's verdict that Cox is a willful infringer," and that "the evidence of Cox's complete disregard for copyright law and copyright owners has not changed." "A second jury will get to hear that same compelling evidence, and we fully expect it will render a significant verdict," Oppenheim said.

More than 50 labels teamed up to sue Cox in 2018, in what was seen as a test of the obligations of internet service providers (ISPs) to thwart piracy. The labels accused Cox of failing to address thousands of infringement notices, cut off access for repeat infringers, or take reasonable measures to deter pirates. Atlanta-based Cox had told the 4th Circuit that upholding the verdict would force ISPs to boot households or businesses based on "isolated and potentially inaccurate allegations," or require intrusive oversight of customers' internet usage. Other ISPs, including Charter Communications, Frontier Communications and Astound Broadband, formerly RCN, have also been sued by the record labels.
Encryption

Signal Finally Rolls Out Usernames, So You Can Keep Your Phone Number Private (wired.com) 38

Encrypted messaging app Signal has launched new feature allowing users to conceal their phone numbers and instead use usernames, in a move aimed at boosting privacy protections long sought by cybersecurity experts and privacy advocates. From a report: Rather than give your phone number to other Signal contacts as the identifier they use to begin a conversation with you, in other words, you can now choose to be discoverable via a chosen handle -- or even to prevent anyone who does have your phone number from finding you on Signal.

The use of phone numbers has long been perhaps the most persistent criticism of Signal's design. These new privacy protections finally offer a fix, says Meredith Whittaker, Signal's executive director. "We want to build a communications app that everyone in the world can easily use to connect with anyone else privately. That 'privately' is really in bold, underlined, in italics," Whittaker tells WIRED. "So we're extremely sympathetic to people who might be using Signal in high-risk environments who say, 'The phone number is really sensitive information, and I don't feel comfortable having that disseminated broadly.'"

United States

Cox Communications Wins Order Overturning $1 Billion US Copyright Verdict (reuters.com) 42

Cox, the cable television and internet service provider, convinced a U.S. appeals court to throw out a $1 billion jury verdict in favor of several major record labels that had accused it of failing to curb user piracy, setting the stage for a new trial on the matter. From a report: The 4th U.S. Circuit Court of Appeals in Richmond, Virginia ruled on Tuesday that the amount of damages was not justified and that a federal district court should hold a new trial to determine the appropriate amount. A Virginia jury in 2019 found Cox, the largest unit of privately owned Cox Enterprises, liable for its customers' violations of over 10,000 copyrights belonging to labels including Sony Music Entertainment, Warner Music Group, and Universal Music Group. More than 50 labels teamed up to sue Cox in 2018, in what was seen as a test of the obligations of internet service providers (ISPs) to thwart piracy.
Encryption

Backdoors That Let Cops Decrypt Messages Violate Human Rights, EU Court Says (arstechnica.com) 30

An anonymous reader quotes a report from Ars Technica: The European Court of Human Rights (ECHR) has ruled that weakening end-to-end encryption disproportionately risks undermining human rights. The international court's decision could potentially disrupt the European Commission's proposed plans to require email and messaging service providers to create backdoors that would allow law enforcement to easily decrypt users' messages. This ruling came after Russia's intelligence agency, the Federal Security Service (FSS), began requiring Telegram to share users' encrypted messages to deter "terrorism-related activities" in 2017, ECHR's ruling said. [...] In the end, the ECHR concluded that the Telegram user's rights had been violated, partly due to privacy advocates and international reports that corroborated Telegram's position that complying with the FSB's disclosure order would force changes impacting all its users.

The "confidentiality of communications is an essential element of the right to respect for private life and correspondence," the ECHR's ruling said. Thus, requiring messages to be decrypted by law enforcement "cannot be regarded as necessary in a democratic society." [...] "Weakening encryption by creating backdoors would apparently make it technically possible to perform routine, general, and indiscriminate surveillance of personal electronic communications," the ECHR's ruling said. "Backdoors may also be exploited by criminal networks and would seriously compromise the security of all users' electronic communications. The Court takes note of the dangers of restricting encryption described by many experts in the field."

Martin Husovec, a law professor who helped to draft EISI's testimony, told Ars that EISI is "obviously pleased that the Court has recognized the value of encryption and agreed with us that state-imposed weakening of encryption is a form of indiscriminate surveillance because it affects everyone's privacy." [...] EISI's Husovec told Ars that ECHR's ruling is "indeed very important," because "it clearly signals to the EU legislature that weakening encryption is a huge problem and that the states must explore alternatives." If the Court of Justice of the European Union endorses this ruling, which Husovec said is likely, the consequences for the EU's legislation proposing scanning messages to stop illegal content like CSAM from spreading "could be significant," Husovec told Ars. During negotiations this spring, lawmakers may have to make "major concessions" to ensure the proposed rule isn't invalidated in light of the ECHR ruling, Husovec told Ars.
Europol and the European Union Agency for Cybersecurity (ENISA) said in a statement: "Solutions that intentionally weaken technical protection mechanisms to support law enforcement will intrinsically weaken the protection against criminals as well, which makes an easy solution impossible."
Communications

FCC Commissioner Wants To Investigate Apple Over Beeper Mini Shutdown (theverge.com) 63

Republican Commissioner Brendan Carr is calling on the Federal Communications Commission to investigate Apple's response to Beeper Mini -- the app that briefly brought iMessage to Android. From a report: During the State of the Net Conference on Monday, Carr said the FCC should look into whether Apple's move "complies with the FCC's Part 14 rules" about accommodating users with disabilities.

Beeper Mini launched last year, allowing Android users to gain access to iMessage features, including blue message bubbles and the ability to send high-quality photos and videos. However, Apple quickly blocked Beeper Mini users and continued to shut down attempts to make the app work, leading its developers to eventually just give up.
The FCC's Part 14 rules lay out requirements that "advanced communications service," such as iMessage, must follow to ensure they're accessible.
Communications

The US Government Makes a $42 Million Bet On Open Cell Networks (theverge.com) 26

An anonymous reader quotes a report from The Verge: The US government has committed $42 million to further the development of the 5G Open RAN (O-RAN) standard that would allow wireless providers to mix and match cellular hardware and software, opening up a bigger market for third-party equipment that's cheaper and interoperable. The National Telecommunications and Information Administration (NTIA) grant would establish a Dallas O-RAN testing center to prove the standard's viability as a way to head off Huawei's steady cruise toward a global cellular network hardware monopoly.

Verizon global network and technology president Joe Russo promoted the funding as a way to achieve "faster innovation in an open environment." To achieve the standard's goals, AT&T vice president of RAN technology Robert Soni says that AT&T and Verizon have formed the Acceleration of Compatibility and Commercialization for Open RAN Deployments Consortium (ACCoRD), which includes a grab bag of wireless technology companies like Ericsson, Nokia, Samsung, Dell, Intel, Broadcom, and Rakuten. Japanese wireless carrier Rakuten formed as the first O-RAN network in 2020. The company's then CEO, Tareq Amin, told The Verge's Nilay Patel in 2022 that Open RAN would enable low-cost network build-outs using smaller equipment rather than massive towers -- which has long been part of the promise of 5G.

But O-RAN is about more than that; establishing interoperability means companies like Verizon and AT&T wouldn't be forced to buy all of their hardware from a single company to create a functional network. For the rest of us, that means faster build-outs and "more agile networks," according to Rakuten. In the US, Dish has been working on its own O-RAN network, under the name Project Genesis. The 5G network was creaky and unreliable when former Verge staffer Mitchell Clarke tried it out in Las Vegas in 2022, but the company said in June last year that it had made its goal of covering 70 percent of the US population. Dish has struggled to become the next big cell provider in the US, though -- leading satellite communications company EchoStar, which spun off from Dish in 2008, to purchase the company in January.
The Washington Post writes that O-RAN "is Washington's anointed champion to try to unseat the Chinese tech giant Huawei Technologies" as the world's biggest supplier of cellular infrastructure gear.

According to the Post, Biden has emphasized the importance of O-RAN in conversations with international leaders over the past few years. Additionally, it notes that Congress along with the NTIA have dedicated approximately $2 billion to support the development of this standard.
Australia

New Australian Law Will Give Workers 'Right to Disconnect' (seattletimes.com) 97

An anonymous reader shared this report from the New York Times When it's after hours, and the boss is on the line, Australian workers — already among the world's best-rested and most personally fulfilled employees — can soon press "decline" in favor of the seductive call of the beach. In yet another buttress against the scourge of overwork, Australia's Senate on Thursday passed a bill giving workers the right to ignore calls and messages outside of working hours without fear of repercussion. It will now return to the House of Representatives for final approval.

The bill, expected to pass in the House with ease, will let Australian workers refuse "unreasonable" professional communication outside of the workday. Workplaces that punish employees for not responding to such demands could be fined. "Someone who is not being paid 24 hours a day shouldn't be penalized if they're not online and available 24 hours a day," Prime Minister Anthony Albanese said at a news conference Wednesday...

Australia follows in the footsteps of European nations such as France, which in 2017 introduced the right of workers to disconnect from employers while off duty, a move later emulated by Germany, Italy and Belgium. The European Parliament has also called for a law across the European Union that would alleviate the pressure on workers to answer communications off the clock...

Australians already enjoy a host of standardized benefits, including 20 days of paid annual leave, mandatory paid sick leave, "long service" leave of six weeks for those who have remained at an employer for at least seven years, 18 weeks of paid maternity leave and a nationwide minimum wage of about $15 an hour.

Privacy

Security Flaw In a Popular Smart Helmet Allowed Silent Location Tracking (techcrunch.com) 3

An anonymous reader quotes a report from TechCrunch: The maker of a popular smart ski and bike helmet has fixed a security flaw that allowed the easy real-time location tracking of anyone wearing its helmets. Livall makes internet-connected helmets that allow groups of skiers or bike riders to talk with each other using the helmet's in-built speaker and microphone, and share their real-time location in a friend's group using Livall's smartphone apps. Ken Munro, founder of U.K. cybersecurity testing firm Pen Test Partners, said Livall's smartphone apps had a simple flaw allowing easy access to any group's audio chats and location data. Munro says the two apps, one for skiers and one for bike riders, collectively have about a million users.

At the heart of the bug, Munro found that anyone using Livall's apps for group audio chat and sharing their location must be part of the same friends group, which could be accessed using only that group's six-digit numeric code. "That 6-digit group code simply isn't random enough," Munro said in a blog post describing the flaw. "We could brute force all group IDs in a matter of minutes." In doing so, anyone could access any of the 1 million possible permutations of group chat codes.

"As soon as one entered a valid group code, one joined the group automatically," said Munro, adding that this happened without alerting other group members. "It was therefore trivial to silently join any group, giving us access to any users' location and the ability to listen in to any group audio communications," said Munro. "The only way a rogue group user could be detected was if the legitimate user went to check on the members of that group." [...] In an email, Livall's R&D director Richard Yi explained that the company improved the randomness of group codes by also adding letters, and including alerts for new members joining groups. Yi also said the app now allows the shared location to be turned off at the user level.

Piracy

Reddit Doesn't Have To Share IP-Addresses of Piracy Commenters, Court Rules (torrentfreak.com) 22

An anonymous reader quotes a report from TorrentFreak: Reddit is not required to share the IP-address of six users who made piracy-related comments on the website. The company successfully protested the third attempt of a group of filmmakers, which planned to use the requested logs as evidence in their lawsuit against Internet provider Frontier. Instead of focusing on anonymous Redditors, filmmakers can go after the ISP's subscribers directly. [...] Early last year, the film companies subpoenaed Reddit for the first time, requesting the personal details of several users. Reddit refused to cooperate, defending their users' right to anonymous speech, and found a California federal court in agreement. In a second attempt a few weeks later, several film companies sent a similar subpoena to Reddit. This time, the request was more targeted, as all comments specifically referred to the ISP being sued; Grande Communications. Reddit still refused to comply, however, stressing that its users' First Amendment rights would still be at stake. After hearing both parties, Magistrate Judge Laurel Beeler sided with Reddit once again.

While the denial was another setback for the film companies and their attorney, they had no plans to abandon this route to evidence quite so easily. Last month, they were back in court with a similar but tweaked request, this time related to a lawsuit targeting Internet provider Frontier Communications. Broadly speaking, the third case was comparable to the others. The film companies, including Voltage Holdings and Screen Media Ventures, wanted to use comments made by six Redditors to show that the ISP didn't take proper action against repeat infringers, or that 'lax' enforcement acted as a draw to potential pirates. Contrary to the earlier requests, the film companies were no longer looking for any names or email addresses, only the applicable IP address logs. This would allow the commenters to remain anonymous because an 'IP-address is not a person', their attorney argued. Reddit, again, refused to hand over information, arguing it would violate users' right to anonymous speech. The fact that it would only have to reveal IP-addresses wouldn't change that, Reddit argued.

After both sides had the chance to present their arguments, the matter landed on the desk of U.S. Magistrate Judge Thomas Hixson of the California federal court. After reviewing the paperwork, Judge Hixson denied the motion to compel. [...] Of importance in this decision is the so-called '2TheMart.com' standard, which was also applied in the earlier two cases. From that perspective, the court sees no reason to reach a different conclusion. [...] "While the Court is unaware of any cases in the Ninth Circuit in which a court has declined to apply a First Amendment unmasking standard for IP addresses, other courts have recognized that IP addresses are essential to unmasking because an 'IP address cannot be made up in the same way that a poster may provide a false name and address.'" "For this reason, the Court finds no reason to believe provision of an IP address is not unmasking subject to First Amendment scrutiny," Judge Hixson writes. "In sum, the Court finds Movants cannot meet the 2TheMart standard because the evidence they seek can be obtained from other sources, including from Frontier in the normal course of discovery." If the rightsholders are unable to obtain the desired evidence from Frontier, they could always try again, of course. If anything, the film companies have shown that aren't prepared to give up easily.

Communications

Canada Moves To Ban the Flipper Zero Over Car Hacking Fears 63

It appears that the government of Canada is going to ban the Flipper Zero, the tiny, modular hacking device that's become popular with techies for its deviant digital powers. From a report: On Thursday, following a summit that focused on "the growing challenge of auto theft in Canada," the country's Minister of Innovation, Science and Industry posted a statement on X, saying "Criminals have been using sophisticated tools to steal cars...Today, I announced we are banning the importation, sale and use of consumer hacking devices, like flippers, used to commit these crimes.

In a press release issued on Thursday, the Canadian government confirmed that it will be pursuing "all avenues to ban devices used to steal vehicles by copying the wireless signals for remote keyless entry, such as the Flipper Zero." The Flipper, which is technically a penetration testing device, has been controversial due to its ability to hack droves of smart products. Alex Kulagin, the COO of Flipper Devices, said in a statement shared with Gizmodo that the device couldn't be used to "hijack any car" and that certain circumstances would have to be met for it to happen:
Communications

Thieves Steal 200ft Tower From Alabama Radio Station (theguardian.com) 142

A radio station in Alabama has been forced to temporarily shut down after thieves stole a 200ft radio tower. The Guardian reports: WJLX, a station in Jasper, Alabama, was ordered to go off air by the Federal Communications Commission (FCC) after thieves took the station's AM tower last week, the Guardian first learned. "In all my years of being in the business, around the business, everything like that, I have never seen anything like this," WJLX's general manager, Brett Elmore, told the Guardian. "You don't hear of a 200ft tower being stolen," he added.

Elmore said the theft was first discovered last week by a landscaping crew that regularly manages the area nearby the tower, WBRC reported. "They called me and said the tower was gone. And I said, 'What do you mean, the tower is gone?'" Elmore said. The radio tower was previously located in a wooded area, behind a local poultry plant. Elmore said that thieves had cut the tower's wires and somehow removed it. Thieves also stole the station's AM transmitter from a nearby building.

For the small radio station, the theft has had a significant impact. Elmore said the station's property was not insured. Replacing the tower could cost the station anywhere between $100,000 to $150,000, which is "more money than we have," Elmore said. The FCC also notified WJLX on Thursday morning that the station would have to go off the air because of the theft. While WJLX still has its FM transmitter and tower, it is not allowed to operate its FM transmitter while the AM station is off the air.
"I had a guy from Virginia call yesterday and say, 'You know, I think a helicopter grabbed [the tower],'" Elmore said. He's hoping that surveillance video from the nearby poultry plant or witnesses nearby can help figure out who stole the station's tower.

Slashdot Top Deals