IOS

iOS and Android Security Scare: Two Apps Found Supporting 'Pig Butchering' Scheme (forbes.com) 31

"Pig Butchering Alert: Fraudulent Trading App targeted iOS and Android users."

That's the title of a new report released this week by cybersecurity company Group-IB revealing the official Apple App Store and Google Play store offered apps that were actually one part of a larger fraud campaign. "To complete the scam, the victim is asked to fund their account... After a few seemingly successful trades, the victim is persuaded to invest more and more money. The account balance appears to grow rapidly. However, when the victim attempts to withdraw funds, they are unable to do so."

Forbes reports: Group-IB determined that the frauds would begin with a period of social engineering reconnaissance and entrapment, during which the trust of the potential victim was gained through either a dating app, social media app or even a cold call. The attackers spent weeks on each target. Only when this "fattening up" process had reached a certain point would the fraudsters make their next move: recommending they download the trading app from the official App Store concerned.

When it comes to the iOS app, which is the one that the report focussed on, Group-IB researchers said that the app remained on the App Store for several weeks before being removed, at which point the fraudsters switched to phishing websites to distribute both iOS and Android apps. The use of official app stores, albeit only fleetingly as Apple and Google removed the fake apps in due course, bestowed a sense of authenticity to the operation as people put trust in both the Apple and Google ecosystems to protect them from potentially dangerous apps.

"The use of web-based applications further conceals the malicious activity," according to the researchers, "and makes detection more difficult." [A]fter the download is complete, the application cannot be launched immediately. The victim is then instructed by the cybercriminals to manually trust the Enterprise developer profile. Once this step is completed, the fraudulent application becomes operational... Once a user registers with the fraudulent application, they are tricked into completing several steps. First, they are asked to upload identification documents, such as an ID card or passport. Next, the user is asked to provide personal information, followed by job-related details...

The first discovered application, distributed through the Apple App Store, functions as a downloader, merely retrieving and displaying a web-app URL. In contrast, the second application, downloaded from phishing websites, already contains the web-app within its assets. We believe this approach was deliberate, since the first app was available in the official store, and the cybercriminals likely sought to minimise the risk of detection. As previously noted, the app posed as a tool for mathematical formulas, and including personal trading accounts within an iOS app would have raised immediate suspicion.

The app (which only runs on mobile phones) first launches a fake activity with formulas and graphics, according to the researchers. "We assume that this condition must bypass Apple's checks before being published to the store. As we can see, this simple trick allows cybercriminals to upload their fraudulent application to the Apple Store." They argue their research "reinforces the need for continued review of app store submissions to prevent such scams from reaching unsuspecting victims". But it also highlights "the importance of vigilance and end-user education, even when dealing with seemingly trustworthy apps..."

"Our investigation began with an analysis of Android applications at the request of our client. The client reported that a user had been tricked into installing the application as part of a stock investment scam. During our research, we uncovered a list of similar fraudulent applications, one of which was available on the Google Play Store. These apps were designed to display stock-related news and articles, giving them a false sense of legitimacy."
AI

People Are Using Google Study Software To Make AI Podcasts (technologyreview.com) 34

Audio Overview, a new AI podcasting tool by Google, can generate realistic podcasts with human-like voices using content uploaded by users through NotebookLM. MIT Technology Review reports: NotebookLM, which is powered by Google's Gemini 1.5 model, allows people to upload content such as links, videos, PDFs, and text. They can then ask the system questions about the content, and it offers short summaries. The tool generates a podcast called Deep Dive, which features a male and a female voice discussing whatever you uploaded. The voices are breathtakingly realistic -- the episodes are laced with little human-sounding phrases like "Man" and "Wow" and "Oh right" and "Hold on, let me get this right." The "hosts" even interrupt each other.

The AI system is designed to create "magic in exchange for a little bit of content," Raiza Martin, the product lead for NotebookLM, said on X. The voice model is meant to create emotive and engaging audio, which is conveyed in an "upbeat hyper-interested tone," Martin said. NotebookLM, which was originally marketed as a study tool, has taken a life of its own among users. The company is now working on adding more customization options, such as changing the length, format, voices, and languages, Martin said. Currently it's supposed to generate podcasts only in English, but some users on Reddit managed to get the tool to create audio in French and Hungarian.
Here are some examples highlighted by MIT Technology Review: Allie K. Miller, a startup AI advisor, used the tool to create a study guide and summary podcast of F. Scott Fitzgerald's The Great Gatsby.

Machine-learning researcher Aaditya Ura fed NotebookLM with the code base of Meta's Llama-3 architecture. He then used another AI tool to find images that matched the transcript to create an educational video.

Alex Volkov, a human AI podcaster, used NotebookLM to create a Deep Dive episode summarizing of the announcements from OpenAI's global developer conference Dev Day.

In one viral clip, someone managed to send the two voices into an existential spiral when they "realized" they were, in fact, not humans but AI systems. The video is hilarious.

The tool is also good for some laughs. Exhibit A: Someone just fed it the words "poop" and "fart" as source material, and got over nine minutes of two AI voices analyzing what this might mean.

Google

Google Vows To Stop Linking To New Zealand News If Forced To Pay For Content (apnews.com) 68

An anonymous reader quotes a report from the Associated Press: Google said Friday it will stop linking to New Zealand news content and will reverse its support of local media outlets if the government passes a law forcing tech companies to pay for articles displayed on their platforms. The vow to sever Google traffic to New Zealand news sites -- made in a blog post by the search giant on Friday -- echoes strategies the firm deployed as Australia and Canada prepared to enact similar laws in recent years. It followed a surprise announcement by New Zealand's government in July that lawmakers would advance a bill forcing tech platforms to strike deals for sharing revenue generated from news content with the media outlets producing it.

The government, led by center-right National, had opposed the law in 2023 when introduced by the previous administration. But the loss of more than 200 newsroom jobs earlier this year -- in a national media industry that totaled 1,600 reporters at the 2018 census and has likely shrunk since -- prompted the current government to reconsider forcing tech companies to pay publishers for displaying content. The law aims to stanch the flow offshore of advertising revenue derived from New Zealand news products.
If the media law passes, Google New Zealand Country Director Caroline Rainsford said the firm would need to change its involvement in the country. "Specifically, we'd be forced to stop linking to news content on Google Search, Google News, or Discover surfaces in New Zealand and discontinue our current commercial agreements and ecosystem support with New Zealand news publishers."

Google's licensing program in New Zealand contributed "millions of dollars per year to almost 50 local publications," she added.
Google

Google Is Testing Verified Checkmarks In Search (theverge.com) 21

Google is testing a new verification feature in search, in a move aimed at helping users avoid fake or fraudulent websites. The Verge's Jess Weatherbed reports: My colleague Jay Peters spotted checkmarks next to official site links for Microsoft, Meta, Epic Games, Apple, Amazon, and HP, but these were no longer displayed once he logged into a different Google account -- meaning this experiment isn't being rolled out widely just yet. Hovering over a checkmark will display a message that explains "Google's signals suggest that this business is the business that it says it is," which is determined by things like website verification, Merchant Center data, and manual reviews according to Shaheen.
Google

Google's AI Search Summaries Officially Have Ads (theverge.com) 30

Google is rolling out ads in AI Overviews, which means you'll now start seeing products in some of the search engine's AI-generated summaries. From a report: Let's say you're searching for ways to get a grass stain out of your pants. If you ask Google, its AI-generated response will offer some tips, along with suggestions for products to purchase that could help you remove the stain. The products will appear beneath a "sponsored" header, and Google spokesperson Craig Ewer told The Verge they'll only show up if a question has a "commercial angle."
Google

Popular Third-Party YouTube App for Vision Pro Pulled From App Store (macrumors.com) 27

Juno, an app designed for watching YouTube on the Vision Pro, has been removed from the App Store, developer Christian Selig said today. From a report: Back in April, YouTube emailed Selig and said that Juno was violating the YouTube Terms of Service and the YouTube API by modifying the native YouTube.com web user interface, and used YouTube trademarks and iconography that could be confusing to customers.

In response, Selig switched from using the embed player to the website player, made it clear that Juno was an unofficial YouTube viewer, and explained to YouTube that as a web viewer, Juno is not using YouTube APIs. At the same time, though, YouTube filed a complaint with the App Store, and Selig went on to warn customers that he would not fight Google on any decision regarding Juno. Juno has now been removed from the App Store by Apple in response to YouTube's complaint. Selig says that he does not agree with the decision because Juno is a simple web view and that that modifies CSS to make the player look more "visionOS like," but he does not plan to appeal the decision.

Transportation

Google Flights Now Uses Amtrak Data To Show 'Trains To Consider' Alongside Flights (9to5google.com) 152

Google Flights is offering train routes as an alternative to airlines, thanks to a new partnership with Amtrak. 9to5Google reports: In the US, this option surfaces routes and pricing directly provided by Amtrak, as the rail service announced recently: "Amtrak and Google have joined forces to help travelers choose more sustainable transportation options when searching for intercity travel. Thanks to a newly launched, direct data integration, travelers using Google can now view the most up-to-date Amtrak departure times, trip durations and fares directly on the Google Search results page. Amtrak's new integration with Google also means that once customers select a train, they can click through to Amtrak.com to complete the booking for their chosen itinerary without needing to re-enter their trip details."

Amtrak says that choosing a train route over a flight can cut a customer's carbon footprint by up to 72%. Of course, train routes in the US often take considerably longer than flights, but this new option should make it far easier to make the comparison.

Businesses

Epic Games CEO Tim Sweeney Renews Blast At 'Gatekeeper' Platform Owners (venturebeat.com) 77

An anonymous reader quotes a report from VentureBeat: Epic Games CEO Tim Sweeney opened the Unreal Fest Seattle event today with an update on news that included a blistering criticism of monopolistic platform owners. Sweeney is a big proponent of open platforms and the open metaverse. In fact, he will talk about that subject in a virtual talk at our GamesBeat Next 2024 event on October 28-29 in San Francisco. (You can use this code for a 25% discount: gbn24dean). And so Sweeney continues to pressure the major platforms to give more favorable terms to game developers. He started out on that front by giving a price cut for users of Unreal Engine 5, Epic's tools for making games. For those who release games first or simultaneously on the Epic Games Store, Epic is cutting its royalty rate from 5% to 3.5% for Unreal developers. He noted that Epic is in better financial shape than it was a year ago, when Epic had to lay off a lot of staff. Sweeney said the company spent the last year rebuilding. "We're at a point now where game development is expensive. It's low margin, and game companies are suffering. Apple and Google make way more profit from most games than the developers make themselves, while contributing nothing," Sweeney said.

Sweeney reminisced about programming on early Apple computers, aligning with Steve Wozniak's vision for Apple where users had complete freedom without corporate restrictions. He contrasted this with today's mobile platforms, accusing Apple and Google of acting as gatekeepers that stifle innovation. "Among the fights we've taken on here, he noted the case with Apple is still an ongoing fight to open up payments so developers can process payments without Apple mediation and without Apple fees," he said, noting the "massive victory" against Google in a jury trial late last year.
AI

Anthropic Hires OpenAI Co-Founder Durk Kingma 9

OpenAI co-founder Durk Kingma announced that he'll be joining Anthropic. "Anthropic's approach to AI development resonates significantly with my own beliefs," Kingma wrote in a post on X. "[L]ooking forward to contributing to Anthropic's mission of developing powerful AI systems responsibly. Can't wait to work with their talented team, including a number of great ex-colleagues from OpenAI and Google, and tackle the challenges ahead!" TechCrunch reports: Kingma, who has a Ph.D. in machine learning from the University of Amsterdam, spent several years as a doctoral fellow at Google before joining OpenAI's founding team as a research scientist. At OpenAI, Kingma focused on basic research, leading the algorithms team to develop techniques and methods primarily for generative AI models, including image generators (e.g. DALL-E 3) and large language models (e.g. ChatGPT). In 2018, Kingma left to become a part-time angel investor and advisor for AI startups. He rejoined Google in July of that year, and started at Google Brain, which became one of the tech giant's premiere AI R&D labs before it merged with DeepMind in 2023.
Windows

Microsoft Paint is Getting Photoshop-like Generative AI Fill and Erase Features (theverge.com) 26

Microsoft is bringing some new AI-powered Paint and Photos features to Copilot Plus PCs that could make creatives less reliant on more powerful image editing software. From a report: Generative Fill and Generative Erase -- which appear to be heavily inspired by similar AI tools in Adobe Photoshop -- are being introduced to Paint, allowing users to precisely add or remove objects in their images.

Both tools utilize a size-adjustable brush to "paint" over specific areas of an image to edit. Generative Erase will remove unwanted figures, objects like background clutter, and other distractions, similar to the Magic Eraser feature on Google's Pixel phones. Generative Fill allows Paint users to add new AI-generated assets to an image using a text description and select precisely where they should be placed -- much like the Photoshop tool that shares the same name. These build on the Cocreator tool for Paint announced for Copilot Plus PCs earlier this year that can generate images using a combination of text prompts and reference sketches. The company says the diffusion-based model powering these features has been updated to improve output quality and speed and now includes "built-in moderation" to help prevent it from being abused.

Google

Chromebooks Are Getting a New Button and a Host of Google AI Features (wired.com) 25

Google is introducing a new "Quick Insert" button on Chromebooks, offering contextual AI tools across the operating system. The feature debuts on Samsung's Galaxy Chromebook Plus, replacing the traditional Caps Lock key. Older Chromebooks can access Quick Insert via a keyboard shortcut. The button opens an overlay providing access to emojis, GIFs, Google's Help Me Write AI feature, and recent web links. Future updates will include AI-generated image creation.

Google is also rolling out new AI features to Chromebook Plus devices, including automatic transcription, real-time translation, and voice isolation for video calls. Standard Chromebooks will receive updates like Welcome Recap and Focus mode. Lenovo and Samsung are launching new Chromebook models to coincide with these software updates. The Lenovo Duet, a detachable 2-in-1, features an 11-inch 2K screen and starts at $349. Samsung's Galaxy Chromebook Plus boasts a 15.6-inch OLED display in a lightweight 2.58-pound package.
Crime

Google Wins Lawsuit Against Scammers Who 'Weaponized' DMCA Takedowns (torrentfreak.com) 63

Google has obtained (PDF) a default judgment against two men who abused its DMCA takedown system to falsely target 117,000 URLs of competitors' online stores. With none of the defendants showing up in court, a California federal court sided with the search engine. Through an injunction, the men are now prohibited from sending false takedown notices and creating new Google accounts. TorrentFreak reports: Last November, Google decided to take action against the rampant DMCA abuse. In a lawsuit filed at a federal court in California, it accused Nguyen Van Duc and Pham Van Thien of sending over 100,000 fraudulent takedown requests. Many of these notices were allegedly filed against third-party T-shirt shops. [...] Following the complaint, the defendants, who are believed to reside in Vietnam, were summoned via their Gmail accounts and SMS. However, the pair remained quiet and didn't respond in court. Without the defendants representing themselves, Google requested a default judgment. According to the tech giant, it's clear that the duo violated the DMCA with their false takedown notices. In addition, they committed contract breach under California law.

Google said that, absent a default judgment, the defendants would continue to harm consumers and third-party businesses. These actions, in turn, will damage Google's reputation as a search engine. In July, U.S. Magistrate Judge Sallie Kim recommended granting Google's motion for default judgment. The recommendation included an injunction that prevents the two men from abusing Google's services going forward. However, the District Judge had the final say. Last Friday, U.S. District Court Judge Edward Davila adopted the recommendations, issuing a default judgment in favor of Google. The order confirms that defendants Nguyen Van Duc and Pham Van Thien violated the DMCA with their false takedown notices. In addition, they committed contract breach under California law.

In typical copyrights-related verdicts, most attention is paid to the monetary damages, but not here. While Google could have requested millions of dollars in compensation, it didn't request a penny. Google's primary goal was to put an end to the abusive behavior, not to seek financial compensation. Therefore, the company asked for an injunction to prohibit the defendants from sending false takedowns going forward. This includes a ban on registering any new Google accounts. The request ticked all the boxes and, without a word from the defendants, Judge Davila granted the default judgment as well as the associated injunction.

Businesses

AI Chipmaker Cerebras Files For IPO To Take On Nvidia (cnbc.com) 24

Cerebras Systems, an AI chip startup, filed (PDF) for an IPO and plans to trade under the ticker "CBRS" on Nasdaq. CNBC reports: Cerebras competes with Nvidia, whose graphics processing units are the industry's choice for training and running AI models. Cerebras says on its website that its WSE-3 chip comes with more cores and memory than Nvidia's popular H100. It's also a physically larger chip. In addition to selling chips, Cerebras offers cloud-based services that rely on its own computing clusters. [...] In addition to Nvidia, Cerebras cites AMD, Intel, Microsoft and Google as competitors, "as well as internally developed custom application-specific integrated circuits and a variety of private companies." Taiwan Semiconductor Manufacturing Company makes the Cerebras chips. Cerebrus warned investors that any possible supply chain disruptions may hurt the company.

Cerebras was founded in 2016 and is based in Sunnyvale, California. Andrew Feldman, the startup's co-founder and CEO, sold server startup SeaMicro to AMD for $355 million in 2012. The company said in 2021 that it was valued at over $4 billion in a $250 million funding round.In May, G42 committed to purchasing $1.43 billion in orders from Cerebras before March 2025, according to the filing. G42 currently owns under 5% of Cerebras' Class A shares, and the firm has an option to purchase more depending on how much Cerebras product it buys.

Google

Epic Games Sues Google and Samsung Over App Store Restrictions 45

Epic Games filed a new antitrust lawsuit against Google and Samsung, alleging they conspired to undermine third-party app stores. The suit focuses on Samsung's "Auto Blocker" feature, now enabled by default on new phones, which restricts app installations to "authorized sources" - primarily Google and Samsung's stores.

Epic claims Auto Blocker creates significant barriers for rival stores, requiring users to navigate a complex process to install third-party apps. The company argues this feature does not actually assess app safety, but is designed to stifle competition. Epic CEO Tim Sweeney stated the lawsuit aims to benefit all developers, not secure special privileges for Epic. The company seeks either default deactivation of Auto Blocker or creation of a fair whitelisting process for legitimate apps. This legal action follows Epic's December victory against Google in a separate antitrust case. Epic recently launched its own mobile app store, which it claims faces unfair obstacles due to Auto Blocker.
Power

The Hot New Trend in Commercial Real Estate? Renting to Data Centers (yahoo.com) 49

U.S. real estate developers "are having a hard time keeping up with demand," reports the Los Angeles Times, "as businesses in search of secure spots for their servers rent nearly every square foot that becomes available..." Construction of new data centers is at "extraordinary levels" driven by "insatiable demand," a recent report on the industry by real estate brokerage JLL found. "Never in my career of 25 years in real estate have I seen demand like this on a global scale," said JLL real estate broker Darren Eades, who specializes in data centers...

The biggest drivers are AI and cloud service providers that include some of the biggest names in tech, such as Amazon, Microsoft, Google and Oracle. With occupancy in conventional office buildings still down sharply following the impact of the COVID-19 pandemic and property values falling, data centers represent a rare ripe opportunity for real estate developers, who are pursuing opportunities in major markets like Los Angeles and less urban locales that are served by plentiful and preferably cheap power needed to run data centers. "If you can find a cluster of power to build a site, they'll come," Eades said of developers. Construction is taking place at an "extraordinary" pace nationwide and still not keeping up, the JLL data center report said. [Data center] "Vacancy declined to a record low of 3% at midyear due to insatiable demand and despite rampant construction."

Development increased more than sevenfold in two years, with the pipeline of new projects leveling off in the first half of 2024, a potential signal that the U.S. power grid cannot support development at a faster pace. But when projects currently under construction or planned are complete, the U.S. colocation market, in which businesses rent space in a data center owned by another company for their servers and other computing hardware, will triple in size from current levels... Real estate investors and landlords are being drawn into the market because demand from tenants is high and they are likely to renew their leases after shouldering the costs of setting up data centers. "They invest in their space and in your space and they tend to stick around longer," said Mark Messana, president of Downtown Properties, which owns offices in Los Angeles and San Francisco. "As we all know, the office market is struggling a little bit, so it's nice to be able to have some data customers in the mix..."

Power demand for computing is growing so intense that it threatens to strain the nation's electrical grid, sending users to remote locations where power is plentiful and preferably cheap. Data center developers are working in Alabama, the Dakotas and Indiana, "traditionally states that wouldn't have data centers," Eades said.

The article includes "the mother of all data centers" in the western U.S. — a 30-story building where "thousands of miles of undersea fiber-optic cables disappear into an ordinary-looking office tower." Once a prestigious location for businesses, "The recent departure of a law firm that had been in the building more than 50 years cleared out five floors that will quickly be re-leased to data tenants, said Eades, who represents the landlord..."

To retrofit the building for data centers, "two elevators were removed so the empty shafts could hold water pipes used to help keep the temperature cool enough for the heat-producing servers" — and developers are happy rents "can be double what they are at newer downtown office high-rises, according to real estate data provider CoStar...

"By 2030, data centers could account for as much as 11% of U.S. power demand — up from 3% now, according to analysts at Goldman Sachs."
AI

California's Governor Just Vetoed Its Controversial AI Bill (techcrunch.com) 35

"California Governor Gavin Newsom has vetoed SB 1047, a high-profile bill that would have regulated the development of AI," reports TechCrunch. The bill "would have made companies that develop AI models liable for implementing safety protocols to prevent 'critical harms'." The rules would only have applied to models that cost at least $100 million and use 10^26 FLOPS (floating point operations, a measure of computation) during training.

SB 1047 was opposed by many in Silicon Valley, including companies like OpenAI, high-profile technologists like Meta's chief AI scientist Yann LeCun, and even Democratic politicians such as U.S. Congressman Ro Khanna. That said, the bill had also been amended based on suggestions by AI company Anthropic and other opponents.

In a statement about today's veto, Newsom said, "While well-intentioned, SB 1047 does not take into account whether an AI system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data. Instead, the.." bill applies stringent standards to even the most basic functions — so long as a large system deploys it. I do not believe this is the best approach to protecting the public from real threats posed by the technology."

"Over the past 30 days, Governor Newsom signed 17 bills covering the deployment and regulation of GenAI technology..." according to a statement from the governor's office, "cracking down on deepfakes, requiring AI watermarking, protecting children and workers, and combating AI-generated misinformation... The Newsom Administration will also immediately engage academia to convene labor stakeholders and the private sector to explore approaches to use GenAI technology in the workplace."

In a separate statement the governor pointed out California " is home to 32 of the world's 50 leading Al companies," and warned that the bill "could give the public a false sense of security about controlling this fast-moving technology. Smaller, specialized models may emerge as equally or even more dangerous than the models targeted by SB 1047 — at the potential expense of curtailing the very innovation that fuels advancement in favor of the public good..."

"While well-intentioned, SB 1047 does not take into account whether an AI system is deployed in high-risk environments, involves critical decision-making or the use of sensitive data. Instead, the bill applies stringent standards to even the most basic functions — so long as a large system deploys it.

"I do not believe this is the best approach to protecting the public from real threats posed by the technology."

Interestingly, the Los Angeles Times reported that the vetoed bill had been supported by Mark Hamill, J.J. Abrams, and "more than 125 Hollywood actors, directors, producers, music artists and entertainment industry leaders" who signed a letter of support. (And that bill also cited the support of "over a hundred current and former employees of OpenAI, Google DeepMind, Anthropic, Meta, and xAI..."
IT

67% of American Tech Workers Interested In Joining a Union (visualcapitalist.com) 218

Long-time Slashdot reader AsylumWraith writes: Visual Capitalist has posted an article and graph showing that, on average, 67% of US tech workers would be interested in joining a union.

The percentage is highest at companies like Intuit, with 94% or respondents indicating they'd be interested in joining a union. On the other end of the scale, fewer than half of the employees at Apple, Tesla, and Google, who were surveyed were interested in such a move.

Businesses

Dozens of Fortune 100 Companies Have Unwittingly Hired North Korean IT Workers (therecord.media) 29

"Dozens of Fortune 100 organizations" have unknowingly hired North Korean IT workers using fake identities, generating revenue for the North Korean government while potentially compromising tech firms, according to Google's Mandiant unit. "In a report published Monday [...], researchers describe a common scheme orchestrated by the group it tracks as UNC5267, which has been active since 2018," reports The Record. "In most cases, the IT workers 'consist of individuals sent by the North Korean government to live primarily in China and Russia, with smaller numbers in Africa and Southeast Asia.'" From the report: The remote workers "often gain elevated access to modify code and administer network systems," Mandiant found, warning of the downstream effects of allowing malicious actors into a company's inner sanctum. [...] Using stolen identities or fictitious ones, the actors are generally hired as remote contractors. Mandiant has seen the workers hired in a variety of complex roles across several sectors. Some workers are employed at multiple companies, bringing in several salaries each month. The tactic is facilitated by someone based in the U.S. who runs a laptop farm where workers' laptops are sent. Remote technology is installed on the laptops, allowing the North Koreans to log in and conduct their work from China or Russia.

Workers typically asked for their work laptops to be sent to different addresses than those listed on their resumes, raising the suspicions of companies. Mandiant said it found evidence that the laptops at these farms are connected to a "keyboard video mouse" device or multiple remote management tools including LogMeIn, GoToMeeting, Chrome Remote Desktop, AnyDesk, TeamViewer and others. "Feedback from team members and managers who spoke with Mandiant during investigations consistently highlighted behavior patterns, such as reluctance to engage in video communication and below-average work quality exhibited by the DPRK IT worker remotely operating the laptops," Mandiant reported.

In several incident response engagements, Mandiant found the workers used the same resumes that had links to fabricated software engineer profiles hosted on Netlify, a platform often used for quickly creating and deploying websites. Many of the resumes and profiles included poor English and other clues indicating the actor was not based in the U.S. One characteristic repeatedly seen was the use of U.S-based addresses accompanied by education credentials from universities outside of North America, frequently in countries such as Singapore, Japan or Hong Kong. Companies, according to Mandiant, typically don't verify credentials from universities overseas.
Further reading: How Not To Hire a North Korean IT Spy
Mozilla

Mozilla Hit With Privacy Complaint In EU Over Firefox Tracking Tech (techcrunch.com) 21

Mozilla has been hit with a complaint by EU privacy group noyb, accusing it of violating GDPR by tracking Firefox users by default without their consent. TechCrunch reports: Mozilla calls the feature at issue "Privacy Preserving Attribution" (PPA). But noyb argues this is misdirection. And if EU privacy regulators agree with the complaint the Firefox-maker could be slapped with orders to change tack -- or even face a penalty (the GDPR allows for fines of up to 4% of global revenue). "Contrary to its reassuring name, this technology allows Firefox to track user behaviour on websites," noyb wrote in a press release. "In essence, the browser is now controlling the tracking, rather than individual websites. While this might be an improvement compared to even more invasive cookie tracking, the company never asked its users if they wanted to enable it. Instead, Mozilla decided to turn it on by default once people installed a recent software update. This is particularly worrying because Mozilla generally has a reputation for being a privacy-friendly alternative when most other browsers are based on Google's Chromium."

Another component of noyb's objection is that Mozilla's move "doesn't replace cookies either" -- Firefox simply wouldn't have the market share and power to shift industry practices -- so all it's done is produce another additional way for websites to target ads. [...] The noyb-backed complaint (PDF), which has been filed with the Austrian data protection authority, accuses Mozilla of failing to inform users about the processing of their personal data and of using an opt-out -- rather than an affirmative "opt-in" -- mechanism. The privacy rights group also wants the regulator to order the deletion of all data collected so far.
In a statement attributed to Christopher Hilton, its director of policy and corporate communications, Mozilla said that it has only conducted a "limited test" of a PPA prototype on its own websites.While acknowledging poor communication around the effort, the company emphasized that no user data has been collected or shared and expressed its commitment to engaging with stakeholders as it develops the technology further.
AI

Google's NotebookLM Can Help You Dive Deeper Into YouTube Videos 14

The Verge's Emma Roth reports: NotebookLM, Google's AI note-taking app, can now summarize and help you dig deeper into YouTube videos. The new capability works by analyzing the text in a YouTube video's transcript, including autogenerated ones. Once you add a YouTube link to NotebookLM, it will use AI to provide a brief summary of key topics discussed in the transcript. You can then click on these topics to get more detailed information as well as ask questions. (If you're struggling to come up with something to ask, NotebookLM will suggest some questions.)

After clicking on some of the topics, I found that NotebookLM backs up the information provided in its chat window with a citation that links you directly to the point in the transcript where it's mentioned. You can also create an Audio Overview based on the content, which is a podcast-style discussion hosted by AI. I found that the feature worked on most of the videos I tried, except for ones published within the past two days or so. [...] In addition to adding support for YouTube videos, Google announced that NotebookLM now supports audio recordings as well, allowing you to search transcribed conversations for certain information and create study guides.

Slashdot Top Deals