Dan Goodin reports via Ars Technica: Software maker Ivanti is urging users of its end-point security product to patch a critical vulnerability that makes it possible for unauthenticated attackers to execute malicious code inside affected networks. The vulnerability, in a class known as a SQL injection, resides in all supported versions of the Ivanti Endpoint Manager. Also known as the Ivanti EPM, the software runs on a variety of platforms, including Windows, macOS, Linux, Chrome OS, and Internet of Things devices such as routers. SQL injection vulnerabilities stem from faulty code that interprets user input as database commands or, in more technical terms, from concatenating data with SQL code without quoting the data in accordance with the SQL syntax. CVE-2023-39336, as the Ivanti vulnerability is tracked, carries a severity rating of 9.6 out of a possible 10.

"If exploited, an attacker with access to the internal network can leverage an unspecified SQL injection to execute arbitrary SQL queries and retrieve output without the need for authentication," Ivanti officials wrote Friday in a post announcing the patch availability. "This can then allow the attacker control over machines running the EPM agent. When the core server is configured to use SQL express, this might lead to RCE on the core server." RCE is short for remote code execution, or the ability for off-premises attackers to run code of their choice. Currently, there's no known evidence the vulnerability is under active exploitation. Ivanti has also published a disclosure that is restricted only to registered users. A copy obtained by Ars said Ivanti learned of the vulnerability in October. [...]

Putting devices running Ivanti EDM behind a firewall is a best practice and will go a long way to mitigating the severity of CVE-2023-39336, but it would likely do nothing to prevent an attacker who has gained limited access to an employee workstation from exploiting the critical vulnerability. It's unclear if the vulnerability will come under active exploitation, but the best course of action is for all Ivanti EDM users to install the patch as soon as possible.

Code within the latest version of the ChatGPT Android app suggests that you'll soon be able to set it as the default assistant app, replacing the Google Assistant. Android Authority's Mishaal Rahman reports: ChatGPT version 1.2023.352, released last month, added a new activity named com.openai.voice.assistant.AssistantActivity. The activity is disabled by default, but after manually enabling and launching it, an overlay appears on the screen with the same swirling animation as the one shown when using the in-app voice chat mode. This overlay appears over other apps and doesn't take up the entire screen like the in-app voice chat mode. So, presumably, you could talk to ChatGPT from any screen by invoking this assistant. However, in my testing, the animation never finished and the activity promptly closed itself before I could speak with the chatbot. This could either be because the feature isn't finished yet or is being controlled by some internal flag. [...]

However, the fact that the aforementioned XML file even exists hints that this is what OpenAI intends to do with the app. Making the ChatGPT app Android's default digital assistant app would enable users to launch it by long-pressing the home button (if using three-button navigation) or swiping up from a bottom corner (if using gesture navigation). Unfortunately, the ChatGPT app still wouldn't be able to create custom hotwords or respond to existing ones, since that functionality requires access to privileged APIs only available to trusted, preinstalled apps. Still, given that Google will launch Assistant with Bard any day now, it makes sense that OpenAI wants to make it easier for Android users to access ChatGPT so that users don't flock to Bard just because it's easier to use.

An anonymous reader quotes a report from VICE News: Last week border officials in the Punjab region of India revealed they intercepted 107 drug-carrying drones sent by smuggling gangs last year over the border from Pakistan, the highest number on record. Most were carrying heroin or opium from Pakistan to be dropped and received by collaborators in the Punjab, notorious for having India's worst levels of opiate addiction. Last year the head of a police narcotics unit in Lahore, a city in Pakistan which borders the Punjab, was dismissed after he was suspected of running a drug trafficking gang sending drones over to India. But the use of cheap flying robots instead of humans to smuggle drugs across borders is a worldwide phenomenon. [...]

[D]rones will likely become an everyday part of drug dealing too, according to Peter Warren Singer, author of multiple books on national security and a Fellow at think tank New America, with legit medicines due to be delivered by drone in the U.S. later this year and maybe in the U.K. too. "We are just scraping the surface of what is possible, as drone deliveries become more and more common in the commercial world, it will be the same with delivery of illicit goods. In our book, Burn-In, we explain how a future city will see drones zipping about delivering everything from groceries and burritos to drugs, both prescribed by a doctor or bought off a dealer. Drones have traditionally been used by governments and corporations for what are known as the "3 D's" jobs that are too dull, dirty, or dangerous for humans. For criminals, it is the same, except add in another D: Dependable. A drone doesn't steal the product and can't be arrested or snitch if caught."

Liam O'Shea, senior research fellow for organized crime and policing at defense and security thinktank RUSI, said drones were at the moment of limited value to wholesale traffickers and organized criminal gangs because of their range and the weight they can carry. "It makes sense that smugglers would seek to use drones. They are cheap and easy to acquire. They also lower the risks involved in some transactions, as smugglers do not have to be physically present during transactions. They offer opportunities for smuggling in areas where previous routes were too risky, such as prisons and over securitized borders. "I expect them to be of greater value to smaller players and distributors dealing with smaller quantities. Wholesale drug traffickers will still need to use routes that facilitate smuggling at higher volume or using drones to make multiple trips, which entails risks of detection. That may well change as improvements in technology improve drones' carrying capacity and crime groups are better able to access drones with greater capacity."

Tesla and Samsung are joining forces to allow users of Samsung's SmartThings platform to connect to Tesla products so they can keep track of energy production and usage. The Verge reports: When connected to the Powerwall, SmartThings Energy can sync with the "Storm Watch" feature so that you're notified of heavy weather on a Samsung phone or TV, for example. In addition to the Powerwall, SmartThings Energy will be able to connect to other Tesla products, including its electric vehicles, Solar Inverter, and Wall Connector charging solutions. The collaboration is possible thanks to Tesla's API, which Samsung claims SmartThings Energy is the first to take advantage of.

An anonymous reader shares a report: The DeepMind robotics team has revealed three new advances that it says will help robots make faster, better, and safer decisions in the wild. One includes a system for gathering training data with a "Robot Constitution" to make sure your robot office assistant can fetch you more printer paper -- but without mowing down a human co-worker who happens to be in the way.

Google's data gathering system, AutoRT, can use a visual language model (VLM) and large language model (LLM) working hand in hand to understand its environment, adapt to unfamiliar settings, and decide on appropriate tasks. The Robot Constitution, which is inspired by Isaac Asimov's "Three Laws of Robotics," is described as a set of "safety-focused prompts" instructing the LLM to avoid choosing tasks that involve humans, animals, sharp objects, and even electrical appliances.

For additional safety, DeepMind programmed the robots to stop automatically if the force on its joints goes past a certain threshold and included a physical kill switch human operators can use to deactivate them. Over a period of seven months, Google deployed a fleet of 53 AutoRT robots into four different office buildings and conducted over 77,000 trials. Some robots were controlled remotely by human operators, while others operated either based on a script or completely autonomously using Google's Robotic Transformer (RT-2) AI learning model.

Orange Espana, Spain's second-biggest mobile operator, suffered a major outage on Wednesday after an unknown party obtained a "ridiculously weak" password and used it to access an account for managing the global routing table that controls which networks deliver the company's Internet traffic, researchers said. From a report: The hijacking began around 9:28 Coordinated Universal Time (about 2:28 Pacific time) when the party logged into Orange's RIPE NCC account using the password "ripeadmin" (minus the quotation marks). The RIPE Network Coordination Center is one of five Regional Internet Registries, which are responsible for managing and allocating IP addresses to Internet service providers, telecommunication organizations, and companies that manage their own network infrastructure. RIPE serves 75 countries in Europe, the Middle East, and Central Asia.

The password came to light after the party, using the moniker Snow, posted an image to social media that showed the orange.es email address associated with the RIPE account. RIPE said it's working on ways to beef up account security. Security firm Hudson Rock plugged the email address into a database it maintains to track credentials for sale in online bazaars. In a post, the security firm said the username and "ridiculously weak" password were harvested by information-stealing malware that had been installed on an Orange computer since September. The password was then made available for sale on an infostealer marketplace.

Google is collecting the eyelid shape and skin tone of children via parent submitted videos, according to a project description online reviewed by 404 Media. From the report: Canadian tech conglomerate TELUS, which says it is working on Google's behalf, is offering parents $50 to film their children wearing various props such as hats or sunglasses as part of the project, the description adds. The project shows the methods some companies are using to build machine learning, artificial intelligence, or facial recognition datasets and products. Rather than scraping already existing images or analyzing previously collected material, TELUS, and by extension Google, is asking the public to contribute directly and get paid in return. Google told 404 Media the collection was part of the company's efforts to verify users' age.

A cartel in the embattled central Mexico state of Michoacan set up its own makeshift internet antennas and told locals they had to pay to use its wifi service or they would be killed, according to prosecutors. New submitter awwshit shares a story: Dubbed "narco-antennas" by local media, the cartel's system involved internet antennas set up in various towns built with stolen equipment. The group charged approximately 5,000 people elevated prices between 400 and 500 pesos ($25 and $30) a month, the Michoacan state prosecutor's office told the Associated Press. That meant the group could rake in about $150,000 a month. People were terrorized "to contract the internet services at excessive costs, under the claim that they would be killed if they did not," prosecutors said, though they did not report any such deaths. Local media identified the criminal group as a faction known as Los Viagras. Prosecutors declined to say which cartel was involved because the case was still under investigation, but they confirmed Los Viagras dominates the towns forced to make the wifi payments.

Qualcomm today unveiled a new Snapdragon XR2+ Gen 2 chipset, a single-chip architecture that will likely power Apple Vision Pro competitors from Meta, Samsung, Google and HTC, among others. ZDNet reports: Succeeding last year's XR2 Gen 2, the plus variant brings improved GPU and CPU frequency -- up 15% and 20% respectively, support for 4.3K per eye resolution at 90fps, and the ability for headsets to field 12 or more cameras with on-device AI capabilities. The latter allows equipped models to better track user movements and surrounding objects for more immersive (and harmonious) VR and MR experiences. As for efficiency gains, you'll still be getting the 50% improvement as the previous XR2 Gen 2 when stacked against the XR2 Gen 1 platform. Basically, there's no change on that front.

"(Snapdragon XR2+ Gen 2) will take XR productivity and entertainment to the next level by bringing spectacularly clear visuals to use cases such as room-scale screens, life-size overlays and virtual desktops," said Hugo Swart, vice president and general manager of XR, Qualcomm Technologies, Inc, in a Thursday press release. Clearly, the new silicon is aimed at headsets that can do it all -- with feature parity to the $3,500 gorilla in the room, Apple's upcoming Vision Pro headset -- though Qualcomm says it'll be priced accessibly for manufacturers to build hardware around.

How affordable will these competing wearables be? Your guess is as good as mine. But considering we've already gotten products like the $500 Meta Quest 3 fielding the slightly less capable XR2 Gen 2 chip, the future of XR may not be as expensive as it seems. The new Snapdragon XR2+ Gen 2 chipset is made in collaboration with Google and Samsung, both of which bring expertise in the Android ecosystem and developing mobile VR devices. The trio had announced plans to develop an XR platform back in February of 2023, likely in reaction to the then-rumored headset by Apple.

As spotted by X user bedros_p, Google appears to be preparing to introduce a paid upgrade for Bard Advanced, a "new, cutting-edge AI experience" announced in December that gives users access to Google's best models and capabilities. Android Police reports: According to the strings, you will be able to "Try Bard Advanced for 3 months, on us." After that test period, you will likely have to pay up for the service. A defunct link within the code suggests that it may be part of Google One, but it's not clear if Bard Advanced will be added to all tiers or only more expensive ones with more Google Drive storage. It's also possible that it will be an extra new tier in Google One.

As a refresher, Google launched its most capable AI model yet in December 2023, called Gemini. The LLM is available in three tiers, including a Nano version capable of running on devices like phones and a Pro version currently powering Bard in the US. There is also a Gemini Ultra which isn't public just yet, but supposedly outperforms other LLMs in almost all metrics. Google says that this is the one that will power Bard Advanced.

An anonymous reader quotes a report from the Los Angeles Times: The former Westside Pavilion, a long shuttered indoor mall, will be transformed into a UCLA biomedical research center aimed at tackling such towering challenges as curing cancer and preventing global pandemics, officials announced Wednesday. The sprawling three-story structure will be known as the UCLA Research Park and will house two multidisciplinary centers focusing on immunology and immunotherapy as well as quantum science and engineering. Establishment of the public-private research center is a coup for Southern California that "will cement California's global, economic, scientific and technical dominance into the 22nd century and beyond," said Gov. Gavin Newsom.

The former owners of the mall, Hudson Pacific Properties Inc. and Macerich, said Wednesday that they sold the property to the Regents of the University of California for $700 million. By purchasing the former shopping center, UCLA saved several years of potential toil to build such a facility on campus. UCLA is the most-applied-to university in the nation, but its Westwood home is among the smallest of the nine UC undergraduate campuses, leaving it limited room for growth. The former mall sits on prime real estate in the heart of the Westside at Pico Boulevard and Overland Avenue, about two miles from the UCLA campus. The mall was owned by commercial developers who spent hundreds of millions of dollars to dramatically remake the old shopping center into an office complex intended to appeal to technology firms, which signed some of the biggest office leases in L.A.'s Silicon Beach before the pandemic.

Google agreed to become the sole tenant and began paying rent last year yet never moved in. The interior is mostly unfinished, but is ready for UCLA to build out to its specifications in a process Newsom said would take about 40 months. The UCLA Research Park "will serve as a state of the art hub of research and innovation that will bring together academics, corporate partners, government agencies and startups to explore new areas of inquiry and achieve breakthroughs that serve the common good," UCLA Chancellor Gene Block said. In addition to flexible work areas, the former mall's 12-screen multiplex movie theater may be converted into lecture halls or performance spaces offering programming across the arts, humanities, sciences and social sciences, the chancellor's office said. One tenant of the research park will be the new California Institute for Immunology and Immunotherapy.

All new cars and vans bought in the UK must be zero emission by 2035, according to the latest legal mandate updated this week. From a report: The date for all new petrol and diesel cars to be banned was originally set for 2030. However, in September, Prime Minister Rishi Sunak pushed this date back to 2035. The government says this is giving consumers more time to make the switch and deal with the UK's charging infrastructure.

The transition will still be challenging. Eighty percent of new cars and 70 percent of new vans sold in Great Britain must be zero emission by 2030, increasing to 100 percent by 2035. While the government points to statistics indicating a 41 percent increase in zero-emission vehicles registered for the first time -- note, the vast majority of newly registered vehicles still remain conventionally powered -- charging infrastructure is an altogether different story. The government boasts of more than 50,000 public charge points, an increase of 44 percent year on year, but not all chargers are born equal. According to research from RAC, a local roadside assistance business, the government has failed to meet its target of having six or more rapid or ultra-rapid electric vehicle chargers at every motorway service area in England.

LG says it developed a 27-inch OLED gaming monitor that can reach an incredibly high 480Hz refresh rate, promising to usher in an "era of OLEDs featuring ultra-high refresh rates," LG says. From a report: LG says it achieved the 480Hz rate on a QHD 2,560-by-1,440-resolution display. Other vendors, including Alienware and Asus, have also introduced PC monitors that can hit 500Hz. But they did so using IPS or TN panels at a lower 1920-by-1080 resolution. OLED panels, on the other hand, are known for offering stunning color contrasts, and true blacks, resulting in top-notch picture quality.

The 480Hz refresh rate will be overkill for the average gamer. But the ultra-high refresh rate could appeal to competitive players, where latency and smooth gameplay matters. LG adds that the 27-inch OLED monitor features a 0.03-millisecond response time. The OLED panel should also be easier on the eyes during long playthroughs. "The company's Gaming OLEDs emit the lowest level of blue light in the industry and approximately half the amount emitted by premium LCDs," LG says. "This reduction in blue light not only minimizes eye fatigue but also eliminates flickers, providing gamers with more comfortable and enjoyable gaming sessions."

From a report: According to Statcounter, which should be taken with a pinch of salt of course like any sampling, the Linux share on the desktop hit nearly 4% in December 2023. Last month was a record too and a clear trend over time, as going back a couple of years, it was rarely coming close to 2% but now it's repeatedly nearing 4% so it's quite a good sign overall.

The latest from Statcounter shows for all of 2023 below:

January - 2.91%
February - 2.94%
March - 2.85%
April - 2.83%
May - 2.7%
June - 3.07%
July - 3.12%
August - 3.18%
September - 3.02%
October - 2.92%
November - 3.22%
December - 3.82%

Looking at December it shows Windows rising too, with macOS dropping down. If we actually take ChromeOS directly into the Linux numbers for December 2023 the overall number would actually be 6.24% (ChromeOS is Linux after all).

SpaceX launched a total of 21 satellites on Tuesday night, including "the first six Starlink satellites with Direct to Cell capabilities that enable mobile network operators around the world to provide seamless global access to texting, calling, and browsing wherever you may be on land, lakes, or coastal waters without changing hardware or firmware. The enhanced Starlink satellites have an advanced modem that acts as a cellphone tower in space, eliminating dead zones with network integration similar to a standard roaming partner," the company said. Ars Technica reports: Besides T-Mobile in the US, several carriers in other countries have signed up to use the direct-to-cell satellites. SpaceX said the other carriers are Rogers in Canada, KDDI in Japan, Optus in Australia, One NZ in New Zealand, Salt in Switzerland, and Entel in Chile and Peru. While SpaceX CEO Elon Musk wrote that the satellites will "allow for mobile phone connectivity anywhere on Earth," he also described a significant bandwidth limit. "Note, this only supports ~7Mb per beam and the beams are very big, so while this is a great solution for locations with no cellular connectivity, it is not meaningfully competitive with existing terrestrial cellular networks," Musk wrote.

Starlink's direct-to-cell website says the service will provide text messaging only when it becomes available in 2024, with voice and data service beginning sometime in 2025. Starlink's low Earth orbit satellites will work with standard LTE phones, unlike earlier services that required phones specifically built for satellite use. SpaceX's direct-to-cell satellites will also connect with Internet of Things (IoT) devices in 2025, the company says.

New submitter axlash writes: It has been reported on X that Niklaus Wirth, inventor and co-inventor of several languages including Pascal, Euler and Oberon, died on Jan 1, 2024. He was aged 89. "We lost a titan of programming languages, programming methodology, software engineering and hardware design," writes software engineer Bertrand Meyer in a post on X. "Niklaus Wirth passed away on the first of January. We mourn a pioneer, colleague, mentor and friend."

Niklaus Wirth, born on February 15, 1934, in Switzerland, is a renowned computer scientist known for his significant contributions to the field of computer science and software engineering. He is best known for developing several programming languages, including ALGOL W, Pascal, and Modula-2, which have had a profound impact on the design and development of modern computer software. Wirth's work emphasized simplicity, clarity, and efficiency in programming languages, which greatly influenced subsequent language design and the development of structured programming techniques. His legacy also includes the development of the Oberon programming language and the design of the Oberon operating system. Wirth's dedication to elegant and efficient software design continues to inspire computer scientists and software engineers worldwide, making him a highly respected figure in the history of computing.

You can learn more about Wirth via A.M. Turing Award, Britannica, and the Computer History Museum.

Honda and Mitsubishi are collaborating in a two-year project in Shunan City, Japan, to evaluate the feasibility and environmental benefits of powering a data center with fuel cells taken from electric vehicles. The Register reports: Hydrogen for the fuel cell power station will be provided by a third Japanese company, Tokuyama Corporation, as a byproduct from its salt water electrolysis business, which manufactures about 50,000 tons of sodium hypochlorite each year. The project was proposed by Japan's New Energy and Industrial Technology Development Organization (NEDO), which promotes the research, development and adoption of industrial, energy and environmental technologies. The objective is to consider ways of reducing costs for organizations to install and operate stationary fuel cell systems, which could ultimately contribute to the decarbonization of the electric power supply. No details were disclosed of the kind of datacenter infrastructure that Mitsubishi will operate as part of this project, so it is unknown how much power the fuel cell power station will be required to supply. [...]

Hydrogen can be considered a clean fuel because it produces only water as a byproduct when consumed in a fuel cell. But the problem is in sourcing the hydrogen. Much commercially produced hydrogen is extracted from methane gas via an energy-intensive process typically powered by fossil fuels. It is likely that the process Tokuyama uses in its salt water electrolysis is ultimately powered by fossil fuels, but the hydrogen is produced as a byproduct and this is currently just a demonstration project to evaluate the feasibility of integrated hydrogen business models. In addition to verifying the use of fuel cells for primary and backup power sources in datacenters, the project will also look at the potential for grid-balancing applications.

Alexander Martin reports via The Record: The owner of an apartment in Veliky Novgorod in Russia has been arrested for discrediting the country's armed forces after a neighbor alerted the police to the message 'Slava Ukraini' scrolling across their LED curtains. When police went to the scene, they saw the garland which the owner had hung in celebration of the New Year and a "slogan glorifying the Armed Forces of Ukraine," as a spokesperson for the Ministry of Internal Affairs told state-owned news agency TASS. The apartment owner said the garland was supposed to display a "Happy New Year" greeting, TASS reported.

Several other people in Russia described a similar experience on the AlexGyver web forum, linked to a DIY blog popular in the country. They said at the stroke of midnight on New Year's Eve, their LED curtains also began to show the "Glory to Ukraine" message in Ukrainian. It is not clear whether any of these other posters were also arrested. The man in Veliky Novgorod will have to defend his case in court, according to TASS. Police have seized the curtain itself.

An independent investigation into the cause of the message by the AlexGyver forum users found that affected curtains all used the same open-source firmware code. The original code appears to have originated in Ukraine before someone created a fork translated into Russian. According to the Telegram channel for AlexGyver, the code had been added to the original project on October 18, and then in December the people or person running the fork copied and pasted that update into their own version. "Everyone who downloaded and updated the firmware in December received a gift," the Telegram channel wrote. The message was "really encrypted, hidden from the 'reader' of the code, and is displayed on the first day of the year exclusively for residents of Russia by [geographic region]."

Amazon-owned Wickr is dead, more than a year after reports showed it had become the app of choice for drug traffickers. 404 Media: If you open the encrypted messaging app Wickr Me today, you'll be greeted with a line of red text: "Reconnecting..." Below that, in white text over a black background, the app says "We're having issues connecting to the Wickr Me network. If the problem persists, try restarting your app or contacting support." Closing and reopening the app will not work. There is no point in contacting support either. That's because on December 31, 2023, Wickr Me, the free version of Wickr, was shut down entirely.

Wickr Me is no longer available to download on the Apple App Store or the Google Play Store. The app stopped accepting new users more than a year ago. And now, even current users cannot speak to one another. So ends the story of an app that while never reaching the popularity of other encrypted messaging apps like Signal, nor those that later turned on end-to-end encryption for the masses like WhatsApp, nonetheless played an important role in the adoption of and debate around secure communications.

According to new findings from the Millennium Cohort study, almost half of British teenagers say they feel addicted to social media. The Guardian reports: The latest research, by Dr Amy Orben's team at the University of Cambridge, used data from the Millennium Cohort study which is tracking the lives of about 19,000 people born in 2000-2002 across England, Scotland, Wales and Northern Ireland. When the cohort were aged 16-18 they were asked, for the first time, about social media use. Of the 7,000 people who responded, 48% said they agreed or strongly agreed with the statement "I think I am addicted to social media." A higher proportion of girls (57%) agreed compared to boys (37%), according to the data shared with the Guardian.

Scientists said this did not mean that these people are actually suffering from a clinical addiction, but that expressing a perceived lack of control suggests a problematic relationship. "We're not saying the people who say they feel addicted are addicted," said Georgia Turner, a graduate student leading the analysis. "Self-perceived social media addiction is not [necessarily] the same as drug addiction. But it's not a nice feeling to feel you don't have agency over your own behavior. It's quite striking that so many people feel like that and it can't it be that good."

"Social media research has largely assumed that [so-called] social media addiction is going to follow the same framework as drug addiction," said Turner. Orben's team and others argue that this is likely to be oversimplistic and are investigating whether the teenagers cluster into groups whose behavioral can be predicted by other personality traits. It could be that, for some, their relationship is akin to a behavioral addiction, but for others their use could be driven by compulsive checking, others may be relying on it to cope with negative life experiences, and others may simply be responding to negative social perceptions about "wasting time" on social media.