Privacy

What Happens When 'Ring Neighbors' Are Always Watching? (denverpost.com) 98

The New York Times reports on "Ring Neighbors," a local social networking service launched by Amazon in 2018 where users "share videos of delivery people carelessly throwing packages, or failing to wait for an answer at the door; others share footage of mail people navigating treacherous ice, or merely waving at the camera." On a U.S. Postal Service forum, a mail carrier asked: "Anyone else feel kind of creeped out that people are recording and watching you, up close, deliver mail to their house or is it just me...?" The company also selects videos from its users to be shared on Ring TV, a video portal run by the company, under categories such as "Crime Prevention," "Suspicious Activity" and "Family & Friends." The videos are, essentially, free ads: The terrifying ones might convince viewers to buy cameras of their own; funny or sweet ones, at a minimum, condition viewers to understand front-door surveillance as normal, or even fun...

Ring videos also provide a constant stream of news and news-like material for media outlets. The headlines that accompany those videos portray an America both macabre and surreal: "Screams for Help Caught on Ring Camera," in Sacramento; "Man pleads for help on doorbell camera after being carjacked, shot in Arizona," in Phoenix; "WOMAN CAUGHT ON MEDFORD DOORBELL CAMERA WITH STOLEN GUN," in Oregon; "Alien abduction' caught on doorbell cam," in Porter, Tex. (it was a glitch); "Doorbell camera captures Wichita boy's plea for help after getting lost." And then there are videos like one shared by Rob Fox, in McDonough, Ga., in which his dog, locked out of the house, learns to use his doorbell. Mr. Fox posted the video to Facebook and then Reddit, from which the story drew news coverage. Ring contacted him, too, he said, to ask whether the company could use the footage in marketing materials.

Elsewhere, the footage is billed as entertainment. In early December, "America's Funniest Home Videos," which has been aggregating viewer videos since the 1980s, released a best-of compilation: "Funny Doorbell Camera Fails." It is composed almost entirely of people falling down...

Home surveillance means you're never quite home, but you're never completely away from home, either.

Footage from one Florida camera showed a bearded man who "licks the doorbell repeatedly. Then he stands back and stares," according to the Times.

And they also report that Ring cameras are now also being stolen, "leaving their owners with a final few seconds of footage — a hand, a face, a mask — before losing their connections."
Crime

Alan Turing's Doctorate & Knighthood Medal Recovered 36 Years After Theft (bizwest.com) 22

Slashdot reader McGruber shares the news that several of Alan Turing's historic personal effects have been recovered nearly 36 years after they were stolen. From a report: In filings in the U.S. District Court of Colorado Friday, federal officials say they seized the British mathematician's Princeton University degree, his Order of the British Empire medal and several photos, school reports and letters from his time at Sherborne School, a boarding school in Dorset, England.

According to the seizure notices, a woman named Julia Turing approached the University of Colorado Boulder in January 2018, saying she wanted to loan Alan Turing's memorabilia to the library. Archivists at the library determined that the items were stolen from Sherborne in 1984... Julia Turing isn't related to Alan Turing, but she changed her last name from Schwinghamer in 1988, according to the complaint...

A month after she reached out to the University of Colorado Boulder, federal officials searched Julia Turing's home in Conifer and recovered the items.

The Guardian shared this quote from a member of the government committee that decided Turing should appear on the U.K.'s new £50 note.

"[He was] the father of computer science, a significant influence on the modern field of artificial intelligence and most importantly, his work at Bletchley Park during the second world war led a team of code-breakers to crack the German Enigma code."
Crime

Amazon To Ramp Up Counterfeit Reporting To Law Enforcement (reuters.com) 73

Amazon is planning to give more data on counterfeit goods to law enforcement in a further crackdown on fakes listed on its e-commerce sites. Reuters reports: In the past, the world's largest online retailer has informed authorities of counterfeit peddlers when it thought it had enough information for police to pursue a culprit. Now, the company plans to disclose merchant information to European and U.S. federal authorities every time it confirms a counterfeit was sold to customers, increasing the frequency and volume of reporting to law enforcement, according to the person, who spoke on condition of anonymity.

Why the new program was happening now was not immediately clear. In recent weeks, Amazon has held meetings with government authorities and related organizations to discuss its new counterfeit reporting strategy and how the company can further their enforcement efforts, the person said. The hope has been that Amazon's coveted data will help law enforcement make connections about criminals. According to the source, Amazon will report a merchant's name, company name, product and contact information to authorities, after it confirms a business was selling fakes, closes the seller's account, and the account holder does not make a successful appeal via Amazon's typical processes.

Security

Notorious Crime Gang Targets Internet Routers Using Tomato Firmware (arstechnica.com) 51

An anonymous reader quotes a report from Ars Technica: Internet routers running the Tomato alternative firmware are under active attack by a self-propagating exploit that searches for devices using default credentials. When credentials are found, the exploit then makes the routers part of a botnet that's used in a host of online attacks, researchers said on Tuesday. The Muhstik botnet came to light about two years ago when it started unleashed a string of exploits that attacked Linux servers and Internet-of-things devices. It opportunistically exploited a host of vulnerabilities, including the so-called critical Drupalgeddon2 vulnerability disclosed in early 2018 in the Drupal content management system. Muhstik has also been caught using vulnerabilities in routers that use Gigabit Passive Optical Network (GPON) or DD-WRT software. The botnet has also exploited previously patched vulnerabilities in other server applications, including the Webdav, WebLogic, Webuzo, and WordPress.

On Tuesday, researchers from Palo Alto Networks said they recently detected Muhstik targeting Internet routers running Tomato, an open-source package that serves as an alternative to firmware that ships by default with routers running Broadcom chips. The ability to work with virtual private networks and provide advanced quality of service control make Tomato popular with end users and in some cases router sellers. The exploits use already infected devices to scan the Internet for Tomato routers and, when found, to check if they use the default username and password of "admin:admin" or "root:admin" for remote administration. The exploit causes Tomato routers that haven't been locked down with a strong password to join an IRC server that's used to control the botnet. The infection also causes the routers to scan the Internet for servers or devices running WordPress, Webuzo, or WebLogic packages that are vulnerable.

Books

71-Year-Old William Gibson Explores 'Existing Level of Weirdness' For New Dystopian SciFi Novel (thedailybeast.com) 81

71-year-old science fiction author William Gibson coined the word "cyberspace" in his 1984 novel Neuromancer. 36 years later he's back with an even more dystopian future in his new novel Agency.

But in a surprisingly candid interview in the Daily Beast, Gibson says he prefers watching emerging new technologies first because "To use it is to be changed by it; you're not the same person."
"I'm not someone who works from assumptions about where technology might be going. My method of writing is exploratory about that."

That's certainly the case with Agency, Gibson's latest, a densely structured, complexly plotted novel that takes place in two separate time frames, which he refers to as "stubs," and has as one of its central characters an AI named Eunice, who is one part uploaded human consciousness and another part specialized military machine intelligence. In one stub it's 2017, a woman is in the White House, and Brexit never happened. But the threat of nuclear war nonetheless hovers over a conflict in the Middle East. In the other stub, it's 22nd century London after "the jackpot," a grim timeline of disasters that has reduced the Earth's population by 80 percent and left Britain to be ruled by "the klept," which Gibson describes as a "hereditary authoritarian government, [with its] roots in organized crime."

Given these scenarios, it's no surprise to discover that the 71-year-old Gibson's latest work was heavily influenced by the 2016 election and the ascendancy of Donald Trump to the presidency. "The book I had been imagining had been a kind of a romp," says the U.S.-born Gibson down the phone line from his long-time home in Vancouver, B.C. "But then the election happened, and I thought, 'Uh-oh, my whole sense of the present is 24 hours out of date, and that's enough to make the book I've been working on kind of meaningless.' It took me a long time [to re-think and re-write the book], and I thought the weirdness factor of reality, finding some balance -- what can I do with the existing level of weirdness, and that level kept going up. I wanted to write a book that current events wouldn't have left by the time it got out, and I think Agency works...."

"It's an interesting time for science fiction now," says Gibson, "because there are people writing contemporary fiction who are effectively writing science fiction, because the world they live in has become science fiction. Writing a contemporary novel today that doesn't involve concepts that wouldn't have been seen in science fiction 20 years ago is impossible. Unless it's an Amish novel."

The Washington Post calls Gibson's new novel "engaging, thought-provoking and delightful," while the senior editor at Medium's tech site One Zero says it's the first time Gibson "has taken direct aim at Silicon Valley, at the industry and culture that has reorganized the world -- with some of his ideas propelling it."

"The result is a blend of speculation and satire that any self-respecting denizen of the digital world should spend some time with."

And they're also publishing an exclusive excerpt from the novel.
Businesses

PopSockets, Tile and Other Companies Will Ask Congress To Help Stop Big Tech Bullying (washingtonpost.com) 58

The two companies, along with Sonos and Basecamp, are set to testify at an antitrust hearing Friday that Apple, Amazon, Facebook and Google threaten their businesses. From a report: David Barnett is an unlikely warrior in the battle against big tech. The founder and chief executive of PopSockets, a Colorado company that makes a widely popular kickstand-of-sorts for smartphones, says he isn't even an "expert on antitrust laws" in Washington. But Barnett discovered firsthand the rare power and influence of Amazon in 2018, after clashing with the e-commerce giant over policies that made it hard to sell his products on his preferred terms and prices. PopSockets soon terminated its ties with Amazon, which helped lead to sizable losses later as a result. "What company that started a business out of their garage can afford to lose $10 million?" he asked in an interview. "We're lucky we're in a position we're profitable and could take a stand."

Barnett's story could resonate with federal regulators: Such tales of big tech's debatably brash, bullying tactics are set to take center stage when he and his corporate peers testify at a high-profile congressional hearing Friday. The session could elicit the most convincing, public evidence to date that Apple, Amazon, Facebook and Google have become too big and powerful -- and need to be restrained. [...] Along with PopSockets, lawmakers are set to hear from top executives at Sonos, a high-end audio company, and Basecamp, which makes collaborative workplace software. Both allege Google undermines smaller rivals. Sonos has sued Google, alleging patent infringement as well.

Crime

FBI Arrests Man Suspected of Orchestrating Dozens of 'Swatting' Calls (arstechnica.com) 59

An anonymous reader quotes a report from Ars Technica: The U.S. government has criminally charged a Virginia man for helping to organize dozens of "swatting" attacks and bomb threats made against a variety of targets in the United States and Canada. The man allegedly belonged to a group that coordinated via IRC and Tor hidden services to target prominent gamers, journalists, and government officials. The group's online chats were often racist, with comments suggesting antipathy toward Jews and black people. In one case, the group made a fake bomb threat to the Alfred Street Baptist Church, a predominantly African American church in Alexandria, Virginia.

Security reporter Brian Krebs was one of the first to report on the arrest of defendant John William Kirby Kelley. Krebs was the target of a swatting call he believes was organized by the group. Kelley allegedly did research for the group, identifying possible targets and suggesting that others make calls. He also helped maintain the group's infrastructure, according to the FBI. While Kelley is now in custody, two other suspects are still at large, according to the FBI. The bureau believes that these two suspects are the ones who actually made most of the calls at issue in the case. Evidently, the suspects' efforts to conceal their identities from law enforcement have been successful -- at least so far.
Kelley was caught when he failed to properly block his number after calling a bomb threat to his own school. When searching his devices (after receiving a warrant), police found videos, chats, and other records Kelley had saved documenting his involvement in other hoax calls. They also found recruiting material for a violent white supremacist group.
Encryption

FBI Asks Apple To Help Unlock Two iPhones (nytimes.com) 134

An anonymous reader quotes a report from The New York Times: The encryption debate between Apple and the F.B.I. might have found its new test case. The F.B.I. said on Tuesday that it had asked Apple for the data on two iPhones that belonged to the gunman in the shooting last month at a naval base in Pensacola, Fla., possibly setting up another showdown over law enforcement's access to smartphones. Dana Boente, the F.B.I.'s general counsel, said in a letter to Apple that federal investigators could not gain access to the iPhones because they were locked and encrypted and their owner, Second Lt. Mohammed Saeed Alshamrani of the Saudi Royal Air Force, is dead. The F.B.I. has a search warrant for the devices and is seeking Apple's assistance executing it, the people said.

Apple said in a statement that it had given the F.B.I. all the data "in our possession" related to the Pensacola case when it was asked a month ago. "We will continue to support them with the data we have available," the company said. Apple regularly complies with court orders to turn over information it has on its servers, such as iCloud data, but it has long argued that it does not have access to material stored only on a locked, encrypted iPhone. Before sending the letter, the F.B.I. checked with other government agencies and its national security allies to see if they had a way into the devices -- but they did not, according to one of the people familiar with the investigation.
"The official said the F.B.I. was not asking Apple to create a so-called backdoor or technological solution to get past its encryption that must be shared with the government," the report adds. "Instead, the government is seeking the data that is on the two phones, the official said."

"Apple has argued in the past that obtaining such data would require it to build a backdoor, which it said would set a dangerous precedent for user privacy and cybersecurity." Apple did not comment on the request.
Crime

'Police Tracked a Terror Suspect on WhatsApp -- Until His Phone Went Dark After a Warning From Facebook' (morningstar.com) 113

"A team of European law-enforcement officials was hot on the trail of a potential terror plot in October, fearing an attack during Christmas season, when their keyhole into a suspect's phone went dark," reports the Wall Street Journal: WhatsApp, Facebook Inc.'s popular messaging tool, had just notified about 1,400 users -- among them the suspected terrorist -- that their phones had been hacked by an "advanced cyber actor."

An elite surveillance team was using spyware from NSO Group, an Israeli company, to track the suspect, according to a law-enforcement official overseeing the investigation. A judge in the Western European country had authorized investigators to deploy all means available to get into the suspect's phone, for which the team used its government's existing contract with NSO. The country's use of NSO's spyware wasn't known to Facebook... WhatsApp's Oct. 29 message to users warned journalists, activists and government officials that their phones had been compromised, Facebook said. But it also had the unintended consequence of potentially jeopardizing multiple national-security investigations in Western Europe about which Facebook hadn't been alerted -- and about which government agencies can't formally complain, given their secret nature...

NSO has faced criticism for selling its products to government agencies in the Middle East, Mexico and India, which Facebook and human-rights research group Citizen Lab, among others, allege used them to spy on dissidents, religious leaders, journalists and political opponents. Among the 1,400 WhatsApp users notified in October, more than 100 fell into these categories, Citizen Lab said. The group, which is based at the University of Toronto's Munk School of Global Affairs and Public Policy, worked with Facebook on identifying these people... Citizen Lab has issued reports for several years linking NSO's spyware to governments with a history of human-rights abuses, and said that record should put NSO out of the running for government contracts from Western agencies, said Ronald Deibert, Citizen Lab's director. "What we have been trying to do with our research is to raise alarm bells...."

On the day WhatsApp sent its alert, the official overseeing the terror investigation in Western Europe said, he was stuck in traffic on his way to work when a call came in from Israel. "Have you seen the news? We've got a problem," he said he was told. WhatsApp was notifying suspects whom his team was tracking that their phones had been hacked. "No, that can't be right. Why would they do that?" the official said he asked his contact, thinking it a joke. The most immediate concern was a suspected terrorist investigators linked to Islamic State. They had received a tip he was part of a group plotting an attack around Christmas. Once they saw the suspect's phone receive WhatsApp's alert, the phone went dark, the official said. The sleuths soon lost access to the suspect's messages, the official said, indicating he had discarded or disabled the phone. "We only had that one phone," the official said.

Though that suspect was still under traditional surveillance, "He's not the only suspect we have to follow..." the official complained to the Wall Street Journal, adding that their counterparts in other Western European countries told him more than 10 other investigations "may have been" compromised by WhatsApp's alert.

The Journal also notes that tech companies "have come under growing pressure in the U.S. and Europe to give law enforcement a back door into encrypted messages. But they are also under fire for not doing enough to protect the privacy of their users and, in some jurisdictions, they have legal obligations to disclose security breaches."
Crime

Man Faces Felony Charges After His Apple Watch Proves That He Lied To the Police (freep.com) 56

26-year-old Sean Samitt faked his own stabbing, and is now facing a felony charge and up to four years in prison, according to a Michigan police department -- which says it solved the case with help from his own Apple Watch. Samit reported he was attacked and stabbed in the abdomen by an unknown man in the parking lot at the Temple Kol Ami, where he worked as a cantorial soloist, which is a music director. He reported the crime on December 15, telling police that he was confronted about 7 p.m. as he was leaving work by a white male in his late 30s to early 40s... Police said officers searched the parking lot for a weapon, blood or any other piece of evidence but came back negative. K-9 officers were not able to locate a scent on the suspect. While searching Temple Kol Ami, detectives found bloody tissues in Samitt's office and the men's bathroom. They also located a knife in the kitchen area with blood on the tip of the blade.

Suspecting Samitt's wounds were self-inflicted, officers obtained surveillance footage from a house across the street and confirmed that no assault took place. Police said Samitt admitted to making up the attack and said he lost consciousness and accidentally stabbed himself while he was washing dishes at the synagogue. He said he lied about the incident because he was being harassed at work about his medical condition.

The second story also turned out to be fabricated, police said. Officers were able to obtain information from Samitt's cellphone health application that was synced to his Apple Watch, confirming he did not lose consciousness. Samitt then admitted to intentionally stabbing himself.

"We are very disturbed to hear of incidents like these. Not only is it a crime to file a false police report, but those who commit such acts take vital resources away from the folks who need help from law enforcement," said Carolyn Normandin, Regional Director of Anti Defamation League Michigan.
Crime

Seoul To Install AI Cameras For Crime Detection (zdnet.com) 35

An anonymous reader quotes a report from ZDNet: Cameras with artificial intelligence (AI) software that the South Korean government claims can detect the likelihood of crime will be installed in Seoul within the year. The Seocho District of South Korea's capital and Electronics and Telecommunications Research Institute (ERTI), a national research institute, said they will install 3,000 cameras at the district by July. The cameras will use AI software that processes the location, time, and behavior patterns of passersby to measure the likelihood of a crime taking place.

The cameras will automatically measure whether somebody is walking normally or tailing someone. It will also detect what passersby are wearing -- such as hats, masks, or glasses -- and what they are carrying with them such as bags or dangerous objects that have a strong possibility of being used to commit a crime. The cameras will also consider whether it is day or night. They will use this information to deduce the probability that a crime will take place, they claim. If the rate exceeds a certain rate, the cameras will alert the district office and nearby police stations to send personnel to the location. Going forward, Seocho and ETRI plan to analyze 20,000 court sentencing documents and crime footage to deduce crime patterns for the AI software to memorize.

Privacy

Baltimore Police Back Pilot Program for Surveillance Planes, Reviving Controversial Program (baltimoresun.com) 31

Baltimore Police Commissioner Michael Harrison said Friday he now supports a pilot program to fly three private surveillance planes over the city, reviving a controversial effort that had been shelved since it was revealed to have been used secretly three years ago. From a report: Harrison, who as recently as two months ago said he was skeptical of the planes, said the trial run will commence in May, funded by philanthropic dollars. Baltimore will become the first city in the country to use the technology, Harrison said. "I'm obviously well aware of the plane's controversial history," Harrison said. "I'm looking forward to hearing from our community and to educate them on what this is and what this is not." Harrison previously said the plane system's proponents had oversold its benefits and it was unproven to work. His apparent reversal followed a lobbying campaign that included members of the Greater Baltimore Committee endorsing the program and a prominent pastor presenting a poll that claimed to show community support. It also has become an issue in the mayor's race, with at least one candidate receiving support from the system backers and city officials arguing over whether the technology should be adopted.
Crime

A 22-Year-Old Was Convicted For Attempting To Blackmail Apple For $100,000 In iTunes Gift Cards (gizmodo.com) 32

An anonymous reader quotes a report from Gizmodo: A 22-year-old boss backed by a gangster cabal of "internet buddies" has been thwarted and convicted in their attempt to blackmail Apple, the UK's National Crime Agency reports. In 2017, London-based Kerem Albayrak made Apple an offer they couldn't refuse: deliver $100,000 in iTunes gift cards or $75,000 in cryptocurrency or kiss 319 million iCloud accounts goodbye. On Friday, a court sentenced him to a two year suspended jail term.

On March 12th, 2017, Albayrak, don of hacker syndicate the "Turkish Crime Family," sent Apple Security and several media outlets a YouTube video showing him apparently logging in to two victims' iCloud accounts. The NCA reports that Albayrak had threatened to factory reset the accounts and sell the database vis-a-vis his "internet buddies," boasting to outlets that he'd had access to 300 million accounts (a figure which was later increased to 559 million). They gave Apple until April 7th to fill their demands, Apple Insider has reported. One week and zero gift cards later, they upped their demands and reportedly sent ZDNet a set of 54 sample accounts. ZDNet confirmed their authenticity, though the plot thickened: at least one account had been compromised years prior. Apple and UK authorities ultimately found that the Turkish Crime Family had not, in fact, successfully compromised the network, and concluded that the data came from an unrelated breach of largely defunct third-party services.
Albayrak pleaded guilty to one count of blackmail and two counts of unauthorized acts with intent to impair the operation of or prevent/hinder access to a computer. He was handed a two year suspended jail term, 300 hours of unpaid labor, and six months of "electronic curfew" (an ankle bracelet).
Crime

IT Worker With Grudge Jailed (bbc.com) 31

A former Jet2 IT contractor with a grudge has been jailed for a cyber-attack on the company. From a report: Scott Burns, 27, of Queen Street in Morley, Leeds, was jailed for 10 months for his actions, which cost the company $214,000. The attack shut down Jet2's computer network for 12 hours in January 2018. Burns wanted revenge for the firm's treatment of him following an incident at a 2017 "Benidorm roadshow," Leeds Crown Court heard. Details about happened at the event in Benidorm were not outlined in court. The court heard only fast-thinking by one employee at the Leeds-based airline stopped Burns' actions being a "complete disaster" for Jet2. Burns pleaded guilty to eight counts under the Computer Misuse Act at a previous hearing. Judge Andrew Stubbs QC told Burns: "You intended to cause as much damage to Jet2's computer system as you could. "This went far beyond being mischievous. This was a revenge attack for a perceived slight you had suffered."
Crime

How a Fake Murder-For-Hire Site Led To Real Convictions (harpers.org) 38

Harper's profiles sys-admin Chris Monteiro, who moonlights as a white-hat hacker monitoring dark web sites claiming to offer murder-for-hire services. For example, he tipped off one local police department to a $5,000 bitcoin payment someone made to try to arrange the murder of a teenaged girl on a site run by someone named "Yura". [U]sers set up an anonymous account, select from a drop-down menu the kind of violence they would like inflicted, upload the photo and address of their intended target, and wait to hear back through the messaging system. Users often have questions for Yura: How do I know you're for real? Can you make it look like an accident? When they are satisfied, the user transfers bitcoin into a special wallet on the site, where it will ostensibly be held until the job is completed. Instead, Yura takes the money immediately, and makes no attempt to complete the job. The user complains; Yura says he needs more money to hire a better hit man; the user either pays again or asks for a refund; and Yura either disappears or attempts to extort the user by threatening to turn information over to the authorities...

Despite the repulsive intent, there's an element of black comedy to some of the logs from Yura's sites. For one thing, the users' eagerness to believe the service is real leads them to ignore obvious signs that they are being scammed. Yura's marketplaces, for example, use stock photos of assassins or photos pulled from Google image searches. His poor English and poorer knowledge of U.S. geography result in glaring slipups, and the language he employs can make him sound like a customer service representative channeling a B-grade Mafia film. During the back-and-forth on one recent order, the user Happynewyear asked Yura if he could send hit men to Hawaii. "Yes," Yura responded, "we have someone in a nearby state. He can drive to the location with a stolen car and do the job with no problems." Overlooking the fact that the nearest state is 2,500 miles and a considerable swath of the Pacific Ocean away, the user paid him around three thousand dollars.

Reading through the kill orders, it's easy to spot the online disinhibition effect -- the psychologist John Suler's theory of why and how human behavior changes when we log on... So far, according to Monteiro, eight people have been arrested for ordering murders through Yura's websites, on the basis of evidence Monteiro passed to law enforcement. One of them, a young Californian named Beau Brigham, had paid less than $5 toward a hit on his stepmother. Nevertheless, he was found guilty of soliciting murder and sentenced to three years in prison.

One attempted murder was arranged by a man described as "an I.T. professional and elder in the United Church of God," raising an adopted teenaged son with his wife Amy. "[H]e'd been arranging affairs through the infidelity website Ashley Madison but could not consider divorce because of his position in the church." In the end he'd simply carried out the murder himself, but "His exchanges with Yura would prove central to the state's investigation into Amy's death: the bitcoin signature of the payment...matched the key that authorities found on Stephen's hard drive at home. Stephen had attempted to make the death look like a suicide, and the bitcoin key was proof it was not. In January 2018, he was convicted of first-degree murder and sentenced to life in prison."

The article's author, Brian Merchant, writes that it was hard to research. "There is no easy way to say, 'Hello, I found your name on a kill list on the dark net, and while the site is a scam the order is not; someone you likely know wants you dead badly enough to pay thousands of dollars to an impossibly shady website. Give me a ring back anytime'... Of those I was able to contact, about half said they had never been alerted by the police." (Though Monteiro says America's Department of Homeland Services now plans to investigate everyone who's made transactions on Yura's site.)

The article also notes the first known instance of a murder ordered on the dark web and then successfully carried out -- this March, on a different dark web site.
Security

'We Tested Ring's Security. It's Awful' (vice.com) 48

"Ring lacks basic security features, making it easy for hackers to turn the company's cameras against its customers," reports Motherboard: Ring is not offering basic security precautions, such as double-checking whether someone logging in from an unknown IP address is the legitimate user, or providing a way to see how many users are currently logged in -- entirely common security measures across a wealth of online services... Ring doesn't appear to check a user's chosen password against known compromised user credentials. Although not a widespread practice, more online services are starting to include features that will alert a user if they're using an already compromised password....

Motherboard deliberately entered the wrong password to our account on the login portal while connecting from the Tor anonymity network dozens of times in quick succession. At no point did Ring try to limit our login attempts or present a captcha....

Ring does offer two-factor authentication, where a user is required to enter a second code sent to them as well as their password, but Ring does not force customers to use it. Motherboard verified that Ring's two-factor authentication does work as advertised, but multiple people who were logged into the app didn't have to log back in after it was enabled -- Ring didn't eject them nor ask them to enter a two-factor token...

From a smartphone app, someone who is logged in can watch live and historical footage, listen through the camera's microphone, speak through the camera's speaker, play an alarm, see the name of the specific Wi-Fi network the camera is connected to, see the address the user originally registered the Ring camera with, see the phone number a user has entered into the app, and see nearby crime "incidents." This shows the specific, user-selected home address plotted on a map. Ring requires that a user input a home address to set up the camera.

Crime

Samsung Chair Imprisoned and 24 Others Found Guilty In Union-Busting Case (arstechnica.com) 40

An anonymous reader quotes a report from Ars Technica: Samsung Chairman Lee Sang-hoon yesterday was sentenced to 18 months in prison, following a South Korean court ruling that he violated labor laws with union-busting activities. Lee "was immediately arrested in court to be sent to jail," the Financial Times reported.

Lee's violations came during his time as Samsung chief financial officer between 2012 and 2017; he has been chairman of the board since March 2018. Samsung VP Kang Kyung-hoon also received an 18-month prison sentence for his involvement, the Financial Times wrote. The sentences were handed down by the Seoul Central District Court. In all, about 25 current and former Samsung executives were found guilty on similar charges of violating labor laws. "The case largely focused on efforts by Samsung officials, including Mr. Lee, to dismantle the labor union at the company's customer-service unit," The Wall Street Journal wrote. "The court convicted Samsung officials on multiple charges, including gathering personal information on some union members, such as their marital status, personal finances, and mental-health histories."
Samsung said that the company's "understanding and view towards labor unions in the past fell short of society's expectations."

As Samsung board chairman, Lee Sang-hoon "is responsible for convening quarterly board meetings and reviewing the company's financial statements before they are sent to shareholders for a vote, among other responsibilities," the Journal wrote.
Social Networks

Bank Employee Steals Cash, Then Posts Pics of It On Facebook and Instagram (cnn.com) 78

"If you're systematically stealing money from a bank vault, it may not be a good idea to post the evidence on your social media pages," reports CNN: A bank employee in Charlotte, North Carolina, allegedly stole $88,000 from the bank's vault, according to a release from the United States Attorney's Office Western District of North Carolina. And he wasn't bashful about advertising to his social media followers the life of luxury he was funding.... Henderson's numerous Facebook and Instagram photos depict him posing with stacks of cash, and the U.S. Attorney's Office says he used the money to make a $20,000 down payment on a new Mercedes-Benz....

According to details from the indictment contained in the release, Henderson allegedly took bank customers' cash deposits out of the bank vault for months. Many of those times, he deposited money into an ATM near the bank where he worked, according to the release. "I make it look easy but this shyt really a PROCESS," he wrote in one Facebook post, part of a string in which he talked about building his "brand." That post, showed him him holding a stack of money and smoking a cigarette.

Henderson is now facing up to 30 years in prison.

Which bank? According to the Charlotte Observer, it was Wells Fargo.
Crime

37-Year-Old Mom Finds Instagram's Sex Predators By Pretending To Be 11 (medium.com) 123

Sloane Ryan is a 37-year-old woman who runs the Special Projects Team at Bark, a child-safety tech company selling a $9-a-month software that monitors text messages for bullying, threats of violence, depression, and sexual predators. "In 2018 alone, Bark alerted the FBI to 99 child predators. In 2019? That number is more than 300 -- and counting."

Bark had wanted a way to depict the problem to the public without using actual conversations -- so Ryan began posing as an underage minor on Instagram. Over the past nine months, I've been 15-year-old Libby and 16-year-old Kait and 14-year-old Ava. I've been a studious sophomore contemplating bangs and a lacrosse player being raised by her aunt and an excitable junior eager for prom....

At the beginning of the week, on the very first night as [11-year-old] "Bailey" two new messages came in within 52 seconds of publishing a photo. We sat mouths agape as the numbers pinged up on the screen -- 2, 3, 7, 15 messages from adult men over the course of two hours. Half of them could be charged with transfer of obscene content to a minor. That night, I had taken a breather and sat with my head in my hands.

The second half of the article includes examples of particularly graphic conversations with what the perpetrators think are an 11-year-old girl instead of the 37-year-old woman who's investigating them. "I exit the conversation with @ XXXastrolifer to see another nine requests pending... Over the course of one week, over 52 men reached out to an 11-year-old girl."

Ryan also says they've formed "continuous working relationships" with law enforcement agencies, and "We've seen arrests and sentencings. We've provided testimony in court and invaluable information to investigations."

Now they're using the conversations they've collected to train artificial intelligence algorithms to better detect sexual predators automatically.
Facebook

Someone Stole Facebook Payroll Data For Thousands of Employees (bloomberg.com) 29

mschaffer writes: Apparently Facebook had a recent privacy problem of a different kind. A thief broke into an employee's car and stole equipment -- including hard drives that contained unencrypted personal data of former Facebook employees. "Out of abundance of caution," Facebook alerted their current and former employees about the theft. "The hard drives, which were unencrypted, included payroll data like employee names, bank account numbers and the last four digits of employees' social security numbers," reports Bloomberg. "The drives also included compensation information, including salaries, bonus amounts, and some equity details. In total, the drives contained personal data for about 29,000 U.S. employees who worked at Facebook in 2018."

"We worked with law enforcement as they investigated a recent car break-in and theft of an employee's bag containing company equipment with employee payroll information stored on it," the spokeswoman said in a statement shared with Bloomberg. "We have seen no evidence of abuse and believe this was a smash and grab crime rather than an attempt to steal employee information."

Slashdot Top Deals