A report commissioned by cloud security company Barracuda found that 94% of respondents have experienced some form of attack on their industrial IoT (IIoT) or operational technology (OT) systems during the last 12 months. From a report: The State of Industrial Security in 2022 report surveyed 800 senior IT and security officers responsible for these industrial systems. "In the current threat landscape, critical infrastructure is an attractive target for cybercriminals, but unfortunately IIoT/OT security projects often take a backseat to other security initiatives or fail due to cost or complexity, leaving organizations at risk," said Tim Jefferson, senior vice president for data protection, network, and application security at Barracuda said in a statement accompanying the report.

Recent attacks such as those targeted through the SolarWinds attack, and the Russian DDoS attack on Lithuania last month, have raised concerns over nation state-backed attacks on industrial systems. As a result, the survey found that 89% of the respondents are very or fairly concerned about the current geopolitical situation. Constellation Research analyst Liz Miller acknowledged that "the Russian invasion of Ukraine set the world on high alert as it anticipated vulnerabilities in IIoT devices becoming prime targets should the battle enter the cyberspace."

Netflix: In April we announced that we will introduce a new lower priced ad-supported subscription plan for consumers, in addition to our existing ads-free basic, standard and premium plans. Today we are pleased to announce that we have selected Microsoft as our global advertising technology and sales partner. Microsoft has the proven ability to support all our advertising needs as we work together to build a new ad-supported offering. More importantly, Microsoft offered the flexibility to innovate over time on both the technology and sales side, as well as strong privacy protections for our members. It's very early days and we have much to work through. But our long term goal is clear. More choice for consumers and a premium, better-than-linear TV brand experience for advertisers. We're excited to work with Microsoft as we bring this new service to life.

An anonymous reader shares a report: Ring, Amazon's perennially controversial and police-friendly surveillance subsidiary, has long defended its cozy relationship with law enforcement by pointing out that cops can only get access to a camera owner's recordings with their express permission or a court order. But in response to recent questions from Sen. Ed Markey, D-Mass., the company stated that it has provided police with user footage 11 times this year alone without either. Last month, Markey wrote to Amazon asking it to both clarify Ring's ever-expanding relationship with American police, who've increasingly come to rely on the company's growing residential surveillance dragnet, and to commit to a raft of policy reforms. In a July 1 response from Brian Huseman, Amazon vice president of public policy, the company declined to permanently agree to any of them, including "Never accept financial contributions from policing agencies," "Never allow immigration enforcement agencies to request Ring recordings," and "Never participate in police sting operations."

Although Ring publicizes its policy of handing over camera footage only if the owner agrees -- or if judge signs a search warrant -- the company says it also reserves the right to supply police with footage in "emergencies," defined broadly as "cases involving imminent danger of death or serious physical injury to any person." Markey had also asked Amazon to clarify what exactly constitutes such an "emergency situation," and how many times audiovisual surveillance data has been provided under such circumstances.

Strider Technologies scours open-source data in China to identify technologies most at risk of being stolen -- and the people who might be tempted to steal them. China's government calls IP theft allegations 'malicious slandering.' From a report: Oak Ridge National Laboratory in Tennessee has for decades been a hotbed of US nuclear experimentation. It's also a target for countries seeking to steal American secrets. More than 1,700 technologies developed in the lab are in China's crosshairs, according to three-year-old startup Strider Technologies. The list includes ion beams, nuclear power equipment and energy storage materials. Using custom software to scour widely available sources of information on China's internet, Strider executives said they identified two postdoctoral researchers in nanotechnology who, while working at Oak Ridge, were recruited into China's Youth Thousand Talents Program. The researchers were lured by perks including a grant of 500,000 yuan (about $75,000) apiece and other subsidies worth up to 3 million yuan (about $450,000), the executives said. Both relocated to China and are now employed by university labs with ties to China's defense industry, they said.

This is the potential power of Strider, which uses open-source data from China to identify technologies most at risk of being stolen -- and to spot the people who might be tempted to steal them. The company's pitch coincides with a debate in the US over how to investigate Chinese industrial espionage while protecting civil liberties, and follows a decision by the Justice Department to shut down a program targeting crimes involving China amid allegations that the agency was targeting people based on their ethnicity. The brainchild of globetrotting American twin brothers, Strider, which is based in suburban Salt Lake City, used Oak Ridge only as an example of its prowess; the lab isn't a client. "Companies around the world have been dealing with nation-state threats and IP theft for a decade or more, with little to no tools," said Eric Levesque, Strider's chief operating officer. "Governments can't solve for this and there is huge unmet demand in the market. We're enabling companies to get ahead of the threat rather than just react to issues post-incident."

The TikTok threat to Google's business isn't just limited to YouTube, as it turns out. Core Google services, including Search and Maps, are also being impacted by a growing preference for social media and videos as the first stop on younger users' path to discovery, a Google exec acknowledged today, speaking at an industry event. From a report: Senior Vice President Prabhakar Raghavan, who runs Google's Knowledge & Information organization, referenced the popular social apps in a broader conversation at Fortune's Brainstorm Tech conference about the future of Google's products and its use of AI. In a discussion about the evolution of search, he somewhat offhandedly noted that younger users were now often turning to apps like Instagram and TikTok instead of Google Search or Maps for discovery purposes.

"We keep learning, over and over again, that new internet users don't have the expectations and the mindset that we have become accustomed to." Raghavan said, adding, "the queries they ask are completely different." These users don't tend to type in keywords but rather look to discover content in new, more immersive ways, he said. "In our studies, something like almost 40% of young people, when they're looking for a place for lunch, they don't go to Google Maps or Search," he continued. "They go to TikTok or Instagram."

Prices in June climbed 9.1 percent from a year earlier, the fastest pace since 1981, as soaring gas prices, rising rents and swelling grocery bills made everyday life more expensive for American households. The pickup in prices was broad and faster than expected, spelling trouble for the Federal Reserve. From a report: The inflation index, including food and gas could slow down in July's data because prices at the pump have moderated in recent weeks. The national average cost of a gallon of unleaded gas peaked at about $5 last month. This week, it was around $4.65. But gas prices are volatile and could shoot up again. The report contained unwelcome news beyond the headline number. A core inflation index that strips out food and fuel prices -- giving a sense of underlying inflation trends -- remains high and came in faster than economists expected The core index climbed 5.9 percent the year through June, barely a slowdown from 6 percent in the previous report.

The core measure actually climbed 0.7 percent from May to June, more than the previous monthly increase and bad news for central bankers. The question is whether that deceleration will last, and the answer is unclear. The global economy has been buffeted by a series of shocks that have not ceased since the coronavirus pandemic began. Factory shutdowns and shipping shortages have roiled supply chains, worker shortages are making it harder for airlines to fly at capacity and hotels to rent out rooms, and Russia's invasion of Ukraine has disrupted oil and gas supplies. Economists have spent more than a year struggling to predict how and when inflation will settle back down.

An anonymous reader quotes a report from CNBC: Google parent Alphabet will slow the pace of hiring and investments through 2023, CEO Sundar Pichai said in an email to employees on Tuesday. "Like all companies, we're not immune to economic headwinds," Pichai wrote in the memo, which was viewed by CNBC. "We need to be more entrepreneurial working with greater urgency, sharper focus, and more hunger than we've shown on sunnier days." He started by acknowledging that "the uncertain global economic outlook has been top of mind."

Alphabet shares are down 21% so far this year, falling alongside the rest of the tech industry as investors rotate out of the stocks that drove the bull market of the past decade. The company missed analyst estimates for the first quarter, and Chief Financial Officer Ruth Porat warned another rough period could be ahead. Growth in the first quarter slowed to 23% from a year earlier, down from 34% growth in the first three months of 2021, when the economy was reopening from the pandemic. Still, Pichai said in the letter that the company has hired 10,000 employees in the second quarter. "Because of the hiring progress achieved so far this year, we'll be slowing the pace of hiring for the rest of the year, while still supporting our most important opportunities," he wrote. "For the balance of 2022 and 2023, the company will focus on hiring on engineering, technical and other critical roles."

Google, which has historically invested heavily in research and development, will also be more particular about where it spends money during this period of economic uncertainty. "In some cases, that means consolidating where investments overlap and streamlining processes," Pichai wrote. In other instances, it will mean "pausing development and re-deploying resources to higher priority areas," he said. Pichai ended the note by telling employees that "scarcity breeds clarity" and emphasizing that "I'm excited for us to rise to the moment again."

Early last month, TikTok users across Europe were told that, starting July 13th, the platform would begin using their on-app data to serve up targeted ads, even if those users didn't consent to the practice. Now, less than a day before that change would have rolled out European Union-wide, it looks like the company's reconsidering things a bit. Gizmodo reports: A company spokesperson told TechCrunch on Tuesday that TikTok is "pausing" the update while it "engage[s] on the questions from stakeholders," about the way it handles personalized ads. And needless to say, there are quite a lot of questions about that right now -- from data protection authorities in the EU, from lawmakers in the US, and from privacy experts pretty much everywhere.

For context: until this point, European users that opened the TikTok app needed to offer express consent to let the company use their data for targeted ads. This update planned to do away with the need for that pesky consent by on a legal basis known as "legitimate interest" to target those ads instead. In a nutshell, the "legitimate interest" clause would let TikTok process people's data, consent-free, if it was for a purpose that TikTok deemed reasonable. This means the company could say, for example, that because targeted ads bring in more money than their un-targeted equivalent, it would be reasonable to serve all users -- consenting or otherwise -- targeted ads. Reasonable, right?

US security technology provider L3Harris has courted controversial Israeli spyware firm NSO with an aim to buy it, according to reports. The Register reports: The New York Times claims L3Harris in recent months sent a team to Israel to try to smooth passage of the deal, which was made challenging by US president Joe Biden's decision to blacklist NSO following the use of its Pegasus software to crack phones of politicians and campaigners. The L3Harris executives delivered a message that the US government offers tacit support of its acquisition bid, although public statements were unlikely, according to five separate sources.

The claims run counter to statements from US officials who were said to be outraged to learn about the negotiations for an American company to purchase a blacklisted spy-tech vendor. Later, L3Harris told officials it planned to end its attempt to buy the company while conflicting accounts said it hoped to restart them. The Times says that the US military contractor hired lawyer Daniel Reisner, who once worked for Israeli Military Prosecutor's Office to advise on the deal. News website Intelligence Online has also reported L3Harris efforts to buy NSO, although it quoted White House officials as saying the deal could create "serious counterintelligence and security concerns" for the US.

Magic Leap's next AR headset is coming this fall, and it's not cheap. The self-contained Magic Leap 2 glasses, which CNET tried earlier this year, will cost at least $3,299, and be available Sept. 30. From a report: Unlike the first Magic Leap headset, which launched back in 2018 and aspired to be for creative consumers, the Magic Leap 2 is entirely business-focused. The smaller glasses have their own dedicated AMD hip-worn processor puck. They offer a wider field of view than any other AR headset we've tried recently, and a unique feature that dims parts of the real world to make virtual objects seem less ghostly. The headset will come in three variations: the $3,299 Magic Leap 2 Base is the hardware plus a one-year warranty; while the Magic Leap 2 Developer Pro comes with extra developer-focused software and sample projects for $4,099. A Magic Leap 2 Enterprise version, with two-year support for enterprise-ready software, costs $4,999. Magic Leap's website will indicate where headsets will be available to buy: in the US, UK, Germany, France, Spain, Italy and Saudi Arabia on Sept. 30, and Japan and Singapore by the end of the year.

theodp writes: In partnership with tech-bankrolled nonprofit Code.org, over 500 of the nation's business, education and nonprofit leaders issued a letter calling for state governments and education leaders to bring more Computer Science to K-12 students across the U.S. The signatories include a who's who of tech leaders, including Bill Gates, Jeff Bezos, Satya Nadella, Steve Ballmer, Tim Cook, Sundar Pichai, and Mark Zuckerberg. A new website -- CEOs for CS -- was launched in conjunction with the campaign. "The United States leads the world in technology, yet only 5% of our high school students study computer science. How is this acceptable?" the CEOs demand to know in their letter addressed "To the Governors and Education Leaders of the United States of America." They add, "Nearly two-thirds of high-skilled immigration is for computer scientists, and every state is an importer of this strategic talent. The USA has over 700,000 open computing jobs but only 80,000 computer science graduates a year. We must educate American students as a matter of national competitiveness."

A press release explains that the announcement "coincides with the culmination of the National Governors Association Chairman's Initiative for K-12 computer science, led by Arkansas Gov. Asa Hutchinson." Hutchinson is a founding Governor of the Code.org-led advocacy group Govs for CS, which launched in anticipation of President Obama's tech-supported but never materialized $4 billion CS for All initiative. Hutchinson was a signatory of an earlier 2016 Code.org organized letter from Governors, business, education, and nonprofit leaders that implored Congress to make CS education for K-12 students a priority.

Tech companies and data brokers that misuse or misrepresent how they handle Americans' personal data, including reproductive health information, may find themselves on the hook with the Federal Trade Commission, the agency warned this week. From a report: On Monday, the FTC renewed its vow to investigate or sue companies that use Americans' digital data in unfair or deceptive ways, following an executive order by the Biden administration that explicitly called for it and other agencies to consider steps to protect abortion-seekers. Since the Supreme Court decision overturning Roe v. Wade, civil liberties experts have warned that Americans' extensive digital footprints could give away whether they have visited an abortion clinic or sought information on how to access an abortion, prompting questions about the security of that data.

"The misuse of mobile location and health information -- including reproductive health data -- exposes consumers to significant harm," the FTC said in a blog post. "The exposure of health information and medical conditions, especially data related to sexual activity or reproductive health, may subject people to discrimination, stigma, mental anguish, or other serious harms." It added: "The Commission is committed to using the full scope of its legal authorities to protect consumers' privacy. We will vigorously enforce the law if we uncover illegal conduct that exploits Americans' location, health, or other sensitive data."

After weeks of teases, Nothing is finally announcing its debut smartphone -- the Nothing Phone 1 -- at a launch event today. From a report: Led by OnePlus co-founder Carl Pei, it's the well-funded startup's second product released following last year's Ear 1 true wireless earbuds. The big news is that the Nothing Phone 1 will be sold with a modest starting price of $475 USD (though it's not getting a widespread release in the US) when it goes on sale on July 21st. $475 gets you the model with 8GB of RAM and 128GB of storage, while stepping up to $535 gets you 256GB of storage. The model with 12GB of RAM and 256GB of storage goes on sale later this summer for $593 USD.

BMW is now selling subscriptions for heated seats in a number of countries -- the latest example of the company's adoption of microtransactions for high-end car features. From a report: A monthly subscription to heat your BMW's front seats costs roughly $18, with options to subscribe for a year ($180), three years ($300), or pay for "unlimited" access for $415. It's not clear exactly when BMW started offering this feature as a subscription, or in which countries, but a number of outlets this week reported spotted its launch in South Korea. BMW has slowly been putting features behind subscriptions since 2020, and heated seats subs are now available in BMW's digital stores in countries including the UK, Germany, New Zealand, and South Africa. It doesn't, however, seem to be an option in the US -- yet.

Japanese camera maker Nikon will withdraw from the single-lens reflex camera business and shift toward digital offerings amid intensifying competition from smartphone cameras, Nikkei reported Tuesday. From the report: Nikon's SLR cameras have been widely used by professional photographers for more than 60 years and have come to be seen as synonymous with the Japanese company. It now plans to focus resources on mirrorless cameras, which have become mainstream products on the back of more advanced digital technologies.

Nikon's cameras have been losing out to smartphones, which increasingly feature powerful cameras. Nikon aims to beat them by offering products with more unique features. Since June 2020, when Nikon launched its flagship D6 SLR, no new SLR models have been released. The company has already stopped development of compact digital cameras. From now on, Nikon intends to focus on digital mirrorless cameras, but production and distribution of existing SLR models will continue.

Alex Battaglia from the YouTube channel "Digital Foundry" was able to use the "RetroArch" software emulator to run Windows 98 on the Xbox Series X, along with several PC games of the era. "Technically, you're supposed to be an Xbox developer to access this, and you will need to sign up to the paid Microsoft Partner program and turn on 'Developer Mode' for your system to activate it," notes Pure Xbox. "In DF's case, rather than directly playing emulated games through RetroArch, they used the program to install Windows 98 software." From the report: Beyond the novelty of actually booting up Win98 on a modern console the channel then decided to test out some games, running through the older version of Windows. Playthroughs of Turok, Command & Conquer, Quake 2 and more were all pretty successful, although the act of loading them onto the software requires a bit of messing about (you have to create ISO files and transfer them over -- sadly, Xbox's disc drive can't read the original discs). Of course, this wouldn't be a Digital Foundry video without some performance comparisons, so the team did just that. The video compares hardware of the era with Xbox Series X's emulation, and while the console often lags behind due to the fact that it's literally emulating an entire version of Windows, and then a game on top of that, it fares pretty well overall. You can watch Digital Foundry's video here.

An anonymous reader quotes a report from The Drive: Hackers have uncovered ways to unlock and start nearly all modern Honda-branded vehicles by wirelessly stealing codes from an owner's key fob. Dubbed "Rolling Pwn," the attack allows any individual to "eavesdrop" on a remote key fob from nearly 100 feet away and reuse them later to unlock or start a vehicle in the future without owner's knowledge. Despite Honda's dispute that the technology in its key fobs "would not allow the vulnerability," The Drive has independently confirmed the validity of the attack with its own demonstration.

Older vehicles used static codes for keyless entry. These static codes are inherently vulnerable, as any individual can capture and replay them at will to lock and unlock a vehicle. Manufacturers later introduced rolling codes to improve vehicle security. Rolling codes work by using a Pseudorandom Number Generator (PRNG). When a lock or unlock button is pressed on a paired key fob, the fob sends a unique code wirelessly to the vehicle encapsulated within the message. The vehicle then checks the code sent to it against its internal database of valid PRNG-generated codes, and if the code is valid, the car grants the request to lock, unlock, or start the vehicle. The database contains several allowed codes, as a key fob may not be in range of a vehicle when a button is pressed and may transmit a different code than what the vehicle is expecting to be next chronologically. This series of codes is also known as a "window," When a vehicle receives a newer code, it typically invalidates all previous codes to protect against replay attacks. This attack works by eavesdropping on a paired keyfob and capturing several codes sent by the fob. The attacker can later replay a sequence of valid codes and re-sync the PRNG. This allows the attacker to re-use older codes that would normally be invalid, even months after the codes have been captured.

[...] Contrary to Honda's claim, I independently confirmed the vulnerability by capturing and replaying a sequence of lock and unlock requests with my 2021 Honda Accord and a Software-Defined Radio. Despite being able to start and unlock the car, the vulnerability doesn't allow the attacker to actually drive off with the vehicle due to the proximity functionality of the key fob. However, the fact that a bad actor can get this far is already a bad sign. At this time, the following vehicles may be affected by the vulnerability: 2012 Honda Civic, 2018 Honda X-RV, 2020 Honda C-RV, 2020 Honda Accord, 2021 Honda Accord, 2020 Honda Odyssey, 2021 Honda Inspire, 2022 Honda Fit, 2022 Honda Civic, 2022 Honda VE-1, and 2022 Honda Breeze. It's not yet clear if this affects any Acura-branded vehicles. "[W]e've looked into past similar allegations and found them to lack substance," said a Honda spokesperson in a statement to The Drive. "While we don't yet have enough information to determine if this report is credible, the key fobs in the referenced vehicles are equipped with rolling code technology that would not allow the vulnerability as represented in the report. In addition, the videos offered as evidence of the absence of rolling code do not include sufficient evidence to support the claims."

We're a couple of months out from Apple officially rolling out the next major versions of its various operating systems. However, you can try out iOS 16, iPadOS 16, watchOS 9, macOS Ventura and tvOS 16 right now. Apple has released a public beta, a few weeks after it offered up the first developer betas. To access them, you'll need to sign up for the Apple Beta Software Program and follow the directions.

The Washington Post shares details from "a trove of more than 124,000 previously undisclosed Uber records." For example, in 2015 Uber CEO Travis Kalanick often pulled an emergency kill switch on its data — that is, "ordered the computer systems in Amsterdam cut off from Uber's internal network, making data inaccessible to authorities as they raided its European headquarters, documents show." "Please hit the kill switch ASAP," Kalanick had emailed, ordering a subordinate to block the office laptops and other devices from Uber's internal systems. "Access must be shut down in AMS," referring to Amsterdam. Uber's use of what insiders called the "kill switch" was a brazen example of how the company employed technological tools to prevent authorities from successfully investigating the company's business practices as it disrupted the global taxi industry, according to the documents.

During this era, as Uber's valuation was surging past $50 billion, government raids occurred with such frequency that the company distributed a Dawn Raid Manual to employees on how to respond. It ran more than 2,600 words with 66 bullet points. They included "Move the Regulators into a meeting room that does not contain any files" and "Never leave the Regulators alone."

That document, like the text and email exchanges related to the Amsterdam raid, are part of the Uber Files, an 18.7-gigabyte trove of data obtained by the Guardian and shared with the International Consortium of Investigative Journalists, a nonprofit newsroom in Washington that helped lead the project, and dozens of other news organizations, including The Washington Post. The files, spanning 2013 to 2017, include 83,000 emails and other communications, presentations and direct messages. They show that Uber developed extensive systems to confound official inquiries, going well past what has been known about its efforts to trip up regulators, government inspectors and police. Far from simply developing software to connect drivers and customers seeking rides, Uber leveraged its technological capabilities in many cases to gain a covert edge over authorities....

According to the documents and interviews with former employees, the company used a program called Greyball to keep authorities from hailing cars — and potentially impounding them and arresting their drivers. It used a technology called "geofencing" that, based on location data, blocked ordinary use of the app near police stations and other places where authorities might be working. And it used corporate networking management software to remotely cut computers' access to network files after they had been seized by authorities.... Greyball was created as a fraud-fighting tool to limit scammers' access to the app, a former executive said, and was at times used to frustrate violent Uber opponents hunting drivers. But Uber operations executives took control of the program and redeployed it against the government, former employees said.
The International Consortium of Investigative Journalists describes their trove of documents as "the secret story of how the tech giant won access to world leaders, cozied up to oligarchs and dodged taxes amid chaotic global expansion."

Earlier this week, long-time Slashdot reader ThinkPad760 wrote: How is this not news everywhere?

KDDI, Japan's 2nd largest mobile phone provider and carrier to multiple critical government agencies — including the weather service — failed for 86 hours. After failing to inform users and the government about the problems, questions are starting to be asked.
Japan's government "will set up an expert panel to compile measures to prevent a recurrence," reports Japan Today, citing Japan's Internal Affairs and Communications Minister. The network failure occurred when a router for voice calls was replaced during regular maintenance, with repair work triggering a concentration of traffic that led the company to reduce user access. During that time, the carrier experienced a cascade of technical problems that further prolonged the connection difficultie
40 million users were affected by the outage, Reuters reports — adding that it's not the first time for something like this: Japan's three big telcos have all had widespread network failures in recent years. NTT Docomo's [29-hour] outage last October affected 12.9 customers, while disruption to SoftBank Corp's network in late 2018 cast a shadow over its bumper public listing.