Vulnerabilities in mobile apps exposed Hyundai and Genesis car models after 2012 to remote attacks that allowed unlocking and even starting the vehicles. BleepingComputer reports: Security researchers at Yuga Labs found the issues and explored similar attack surfaces in the SiriusXM "smart vehicle" platform used in cars from other makers (Toyota, Honda, FCA, Nissan, Acura, and Infinity) that allowed them to "remotely unlock, start, locate, flash, and honk" them. At this time, the researchers have not published detailed technical write-ups for their findings but shared some information on Twitter, in two separate threads.

The mobile apps of Hyundai and Genesis, named MyHyundai and MyGenesis, allow authenticated users to start, stop, lock, and unlock their vehicles. After intercepting the traffic generated from the two apps, the researchers analyzed it and were able to extract API calls for further investigation. They found that validation of the owner is done based on the user's email address, which was included in the JSON body of POST requests. Next, the analysts discovered that MyHyundai did not require email confirmation upon registration. They created a new account using the target's email address with an additional control character at the end. Finally, they sent an HTTP request to Hyundai's endpoint containing the spoofed address in the JSON token and the victim's address in the JSON body, bypassing the validity check. To verify that they could use this access for an attack on the car, they tried to unlock a Hyundai car used for the research. A few seconds later, the car unlocked. The multi-step attack was eventually baked into a custom Python script, which only needed the target's email address for the attack.

Yuga Labs analysts found that the mobile apps for Acura, BMW, Honda, Hyundai, Infiniti, Jaguar, Land Rover, Lexus, Nissan, Subaru, and Toyota, use SiriusXM technology to implement remote vehicle management features. They inspected the network traffic from Nissan's app and found that it was possible to send forged HTTP requests to the endpoint only by knowing the target's vehicle identification number (VIN). The response to the unauthorized request contained the target's name, phone number, address, and vehicle details. Considering that VINs are easy to locate on parked cars, typically visible on a plate where the dashboard meets the windshield, an attacker could easily access it. These identification numbers are also available on specialized car selling websites, for potential buyers to check the vehicle's history. In addition to information disclosure, the requests can also carry commands to execute actions on the cars. [...] Before posting the details, Yuga Labs informed both Hyundai and SiriusXM of the flaws and associated risks. The two vendors have fixed the vulnerabilities.

Parler announced Thursday it reached a mutual agreement with Ye, formerly known as Kanye West, to terminate the sale of the social media app. Axios reports: The deal already was on life support, as Axios previously reported, and it's unclear if a formal merger agreement was ever signed. Parler originally said it had an agreement "in principle," and today referred to it as "intent of sale." A Parler spokesperson previously told Axios that the acquisition was set to close by year-end but declined to say if Ye ever had signed paperwork to that effect.

In a statement, Parler's parent company said: "This decision was made in the interest of both parties in mid-November. Parler will continue to pursue future opportunities for growth and the evolution of the platform for our vibrant community." A source familiar with the situation said that Ye's precarious financial situation -- including the loss of his Adidas deal -- played a role in the deal collapse.

Popular NFT and cryptocurrency app Coinbase Wallet today said that Apple required an NFT-sending feature to be removed from the app due to an in-app purchase dispute. MacRumors reports: Apple's App Store review team apparently told Coinbase that the "gas fees required to send NFTs need to be paid through in-app purchase." Apple wanted a cut of transactions, which Coinbase Wallet said is similar to Apple attempting to take a cut of fees for every email that's sent over the internet. Apple is asking for something that is not possible, because the in-app purchase system does not support cryptocurrency to begin with.

Coinbase Wallet says that Apple would not approve an app update until the NFT-sending feature was disabled, and the removal of the functionality will make it more difficult for iPhone users who have an NFT to transfer the NFT to other wallets or gift an NFT to friends or family. The developers behind the app say that Apple has introduced profit-protecting policies that come at the expense of "developer innovation across the crypto ecosystem." Coinbase Wallet is hoping that this is a mistake and has tweeted an invitation to Apple to discuss the matter.

An anonymous reader quotes a report from Slate, written by Lizzie O'Leary: When the New York Times announced, on November 7, that Wordle would have an editor, I didn't give it much thought. How much could the mere presence of a person really change it? Oh, how naive I was! Four days later, I got my answer. And that answer was MEDAL. MEDAL? On November 11th? Wait a minute -- was the Times punning with its Wordle on Veterans Day? Hmm. I was willing to chalk it up to a coincidence, until November 23rd, the day before Thanksgiving, one of the busiest travel days of the year when DRIVE appeared. I tapped angrily on my phone, muttering to myself. And then, on the day of the holiday itself? FEAST. This -- this was too much. My treasured mind awakener had gone soft. (Two days later came CLEAN. Harrumph.)

Folks (FOLKS), I do not want a punny Wordle. Wordle should not be cutesy, or themed, or even ironic. Wordle should stay hard and weird. No hints! Especially no thematic hints! People on Twitter should post their scores, and we should be able to scoff privately. Haha, what a loser; it took him four guesses! When the word is FEAST, you then must wonder: Did he intentionally take four guesses so as not to appear lame?? Wordle's very randomness is what makes it so great! It's why thousands of people play. And, I'd wager, why the Times eagerly shelled out in the "low seven figures" for it. The ability to guess the Wordle based on context clues that would appeal to Andy Borowitz is soul-crushing. Or, at the very least, quite annoying.

Andrew Tarantola writes via Engadget: It's been six years since Tesla, SpaceX (and now Twitter) CEO Elon Musk co-founded brain-control interfaces (BCI) startup, Neuralink. It's been three years since the company first demonstrated its "sewing machine-like" implantation robot, two years since the company stuck its technology into the heads of pigs -- and just over 19 months since they did the same to primates, an effort that allegedly killed 15 out of 23 test subjects. After a month-long delay in October, Neuralink held its third "show and tell" event on Wednesday where CEO Elon Musk announced, "we think probably in about six months, we should be able to have a Neuralink installed in a human."

Neuralink has seen tumultuous times in the previous April 2021 status update: The company's co-founder, Max Hodak, quietly quit just after that event, though he said was still a "huge cheerleader" for Neuralink's success. That show of confidence was subsequently shattered this past August after Musk reportedly approached Neuralink's main rival, Synchron, as an investment opportunity. Earlier in February, Neuralink confirmed that monkeys had died during prototype testing of its BCI implants at the University of California, Davis Primate Center but rejected accusations by the Physicians Committee for Responsible Medicine of animal cruelty. Musk responded indirectly to those charges on Wednesday. "Before we would even think of putting a device in an animal, we do everything possible we with rigorous benchtop testing, We're not cavalier about putting these devices into animals," he said. "We're extremely careful and we always want the device, whenever we do the implant -- whether into a sheep, pig or monkey -- to be confirmatory, not exploratory."

Neuralink is still working towards gaining FDA approval for its implant, though the company was awarded the agency's Breakthrough Device Designation in July 2020. This program allows patients and caregivers more "timely access" to promising treatments and medical devices by fast tracking their development and regulatory testing. As of September, 2022 the FDA has granted that designation to 728 medical devices. The FDA has also updated its best practices guidance regarding clinical and nonclinical BCI testing in 2021. "The field of implanted BCI devices is progressing rapidly from fundamental neuroscience discoveries to translational applications and market access," the agency asserted in its May guidance. "Implanted BCI devices have the potential to bring benefit to people with severe disabilities by increasing their ability to interact with their environment, and consequently, providing new independence in daily life."

Spotify's CEO Daniel Ek renewed his attack on Apple on Wednesday in a series of tweets alleging the iPhone maker "gives itself every advantage while at the same time stifling innovation and hurting consumers." From a report: Ek tagged a number of sympathetic business leaders in his 21-tweet thread, including Musk, Microsoft president Brad Smith, and Proton founder Andy Yen. On Monday, the world's richest person Elon Musk criticized the fee Apple charges software developers - including his Twitter business - for in-app purchases, and posted a meme suggesting he was willing to "go to war" rather than pay it. Spotify has previously submitted antitrust complaints against Apple in various countries, alleging the 30% charge has forced Spotify to "artificially inflate" its own prices.

Serum, a decentralized crypto exchange backed by FTX, notified its 215,000 Twitter followers the project is "defunct" after the crypto exchange giant's sudden collapse -- while pointing users towards a community-led fork of the project. From a report: "The Serum program on mainnet became defunct" following FTX's implosion, Serum tweeted. "As upgrade authority is held by FTX, security is in jeopardy, leading to protocols like Jupiter and Radium moving away," it added, referring to two DeFi projects on the Solana blockchain. Earlier this month, the now-bankrupt FTX exchange was hacked for more than $400 million, which is said to have compromised the security of Serum's code. This is because the "update authority" for its code was held solely in the hands of insiders at the FTX exchange, Serum explained. The team also commented on its native Serum (SRM) token, stating its future was "uncertain" and that developers have proposed to scrap its use due to exposure to FTX and its sister trading firm Alameda Research.

The British government has abandoned a plan to force tech firms to remove internet content that is harmful but legal, after the proposal drew strong criticism from lawmakers and civil liberties groups. From a report: The U.K. on Tuesday defended its decision to water down the Online Safety Bill, an ambitious but controversial attempt to crack down on online racism, sexual abuse, bullying, fraud and other harmful material. Similar efforts are underway in the European Union and the United States, but the U.K.'s was one of the most sweeping. In its original form, the bill gave regulators wide-ranging powers to sanction digital and social media companies like Google, Facebook, Twitter and TikTok.

Critics had expressed concern that a requirement for the biggest platforms to remove "legal but harmful" content could lead to censorship and undermine free speech. The Conservative government of Prime Minister Rishi Sunak, who took office last month, has now dropped that part of the bill, saying it could "over-criminalize" online content. The government hopes the change will be enough to get the bill through Parliament, where it has languished for 18 months, by mid-2023. Digital Secretary Michelle Donelan said the change removed the risk that "tech firms or future governments could use the laws as a license to censor legitimate views."

Britain will not force tech giants to remove content that is "legal but harmful" from their platforms after campaigners and lawmakers raised concerns that the move could curtail free speech, the government said on Monday. Reuters reports: Online safety laws would instead focus on the protection of children and on ensuring companies removed content that was illegal or prohibited in their terms of service, it said, adding that it would not specify what legal content should be censored. Platform owners, such as Facebook-owner Meta and Twitter, would be banned from removing or restricting user-generated content, or suspending or banning users, where there is no breach of their terms of service or the law, it said.

The government had previously said social media companies could be fined up to 10% of turnover or 18 million pounds ($22 million) if they failed to stamp out harmful content such as abuse even if it fell below the criminal threshold, while senior managers could also face criminal action. The proposed legislation, which had already been beset by delays and rows before the latest version, would remove state influence on how private companies managed legal speech, the government said. It would also avoid the risk of platforms taking down legitimate posts to avoid sanctions. [...]

The revised Online Safety Bill, which returns to parliament next month, puts the onus on tech companies to take down material in breach of their own terms of service and to enforce their user age limits to stop children circumventing authentication methods, the government said. If users were likely to encounter controversial content such as the glorification of eating disorders, racism, anti-Semitism or misogyny not meeting the criminal threshold, the platform would have to offer tools to help adult users avoid it, it said. Only if platforms failed to uphold their own rules or remove criminal content could a fine of up to 10% of annual turnover apply. Britain said late on Saturday that a new criminal offense of assisting or encouraging self-harm online would be included in the bill.

Coinsquare, one of Canada's largest cryptocurrency exchanges, may have been breached, but the company claims customer assets are "secure in cold storage and are not at risk." CoinDesk reports: The exchange, which touts itself as "Canada's trusted platform to securely buy, sell and trade Bitcoin, Ethereum, and more," emailed customers Friday to report a "data incident" in which an unauthorized third party accessed a customer database containing personal information. According to the email, the breach exposed "customer names, email addresses, residential addresses, phone numbers, dates of birth, device IDs, public wallet addresses, transaction history, and account balances." Although the email was sent Friday, Coinsquare discovered the breach last week and notified customers via Twitter. "No passwords were exposed. We have no evidence any of this information was viewed by the bad actor," the email stated.

Coinsquare suspended activities on its platform after detecting the vulnerability last week, triggering speculation of possible liquidity issues, given the momentous implosion of multi-billion-dollar crypto exchange, FTX, earlier this month. Full service was restored on Friday, according to a tweet. "We want to reiterate that 100% of client funds are safely held in cold storage and are not used for business activities," the company tweeted.

In a series of tweets Monday, Elon Musk said Apple had mostly stopped advertising on Twitter and had threatened to withhold the Twitter app from the App Store. Musk said the iPhone-maker won't disclose why it is making the threat.

"Amazon workers at the air hub outside the Cincinnati Northern Kentucky international airport, Amazon's largest air hub in the world, are pushing to organize a union," reports the Guardian, "in the latest effort to mobilize workers at the tech company." Workers say they are dissatisfied with annual wage increases this year. About 400 of them have signed a petition to reinstate a premium hourly pay for Amazon's peak season that hasn't been enacted at the site yet. Their main demands also include a $30 an hour starting wage, 180 hours of paid time off and union representation at disciplinary hearings....

About 4,500 workers are employed at the expanding air hub in Kentucky. Those organizing have already filed two unfair labor practice charges over Amazon's response to the unionization effort, which has included anti-union talking points on televisions and its communications system for employees that characterize the effort as a third-party scheme....

Organizing efforts at Amazon have spread beyond the JFK8 Staten Island, New York, warehouse, where workers won the first union election at an Amazon site in the US in April 2022. But they have yet to repeat the success.... Employees at an Amazon warehouse outside Raleigh, North Carolina, are now collecting union authorization signatures in hopes of filing for an election by this summer.... At other Amazon warehouses in Georgia, Minnesota, Illinois and California, workers have organized strikes and petitions to push the company to increase wages and improve working conditions.

Steven Kelley, a learning ambassador at the Kentucky air hub, explained that most workers were paid less than $20 an hour. He said the pay wasn't commensurate with the dangerous work the workers perform, in a location where employee turnover was about 150%, with a constant training of workers who wind up quitting. He also said the disciplinary procedures at Amazon weren't transparent or communicated well enough.... He explained that workers weren't paid enough to live without roommates and made less than other workers in transportation and logistics because they were classified as retail employees.
One worker at the Kentucy air hub complained to the Guardian, "We're the lifeblood of the company, not corporate, not upper management. We're actually the ones who are sorting the freight, and loading the freight."

From the BBC: "Individuals associated with the U.S. military" are linked to an online propaganda campaign, Meta's latest adversarial-threat report says....

On Facebook, 39 accounts, 16 pages, and two groups were removed, as well as 26 accounts on Instagram, for violating the platforms' policy against "coordinated inauthentic behaviour". "This network originated in the United States," Meta wrote. It focused on countries including Afghanistan, Algeria, Iran, Iraq, Kazakhstan, Kyrgyzstan, Russia, Somalia, Syria, Tajikistan, Uzbekistan and Yemen — and mirrored tactics commonly used in propaganda campaigns against the West...

Some of those supporting the U.S. had posed as independent media outlets and some had tried to pass off content from legitimate outlets, such as BBC News Russian, as their own. The operation ran across many internet services, including Twitter, YouTube, Telegram, VKontakte and Odnoklassniki, according to Meta. "Although the people behind this operation attempted to conceal their identities and coordination, our investigation found links to individuals associated with the US military," its report says.
The article adds that experts believe the campaign "was largely ineffective."

About an hour ago SpaceX began tweeting video highlights of their latest launch — a NASA-commissioned resupply mission for the International Space Station.

- "Liftoff!"

- "Falcon 9's first stage has landed on the Just Read the Instructions droneship"

- "Dragon separation confirmed; autonomous docking to the Space Station on Sunday, November 27 at ~7:30 a.m. ET"

You can watch the whole launch on SpaceX's web site. But CNN explains that SpaceX "has launched more than two dozen resupply missions to the space station over the past decade as part of a multibillion-dollar deal with NASA. This launch comes amid SpaceX's busiest year to date, with more than 50 operations so far, including two astronaut missions."

And yet this one carries something unique. (And it's not just the Thanksgiving-themed treats and solar arrays to boost the space station's power...) Nutrients are a key component of maintaining good health in space. But fresh produce is in short supply on the space station compared with the prepackaged meals astronauts eat during their six-month stays in low-Earth orbit. "It is fairly important to our exploration goals at NASA to be able to sustain the crew with not only nutrition but also to look at various types of plants as sources for nutrients that we would be hard-pressed to sustain on the long trips between distant destinations like Mars and so forth," said Kirt Costello, chief scientist at NASA's International Space Station Program and a deputy manager of the ISS Research Integration Office.

Astronauts have grown and tasted different types of lettuce, radishes and chiles on the International Space Station. Now, the crew members can add some dwarf tomatoes — specifically, Red Robin tomatoes — to their list of space-grown salad ingredients. The experiment is part of an effort to provide continuous fresh food production in space.... The space tomatoes will be grown inside small bags called plant pillows installed in the Vegetable Production System, known as the Veggie growth chamber, on the space station. The astronauts will frequently water and nurture the plants....

The hardware is still in development for larger crop production on the space station and eventually other planets, but scientists are already planning what plants might grow best on the moon and Mars. Earlier this year, a team successfully grew plants in lunar soil that included samples collected during the Apollo missions. "Tomatoes are going to be a great crop for the moon," Massa said. "They're very nutritious, very delicious, and we think the astronauts will be really excited to grow them there."

"A violent workers' revolt at the world's largest iPhone factory this week in central China is further scrambling Apple's strained supply," reports CNN, adding that the revolt is also "highlighting how the country's stringent zero-Covid policy is hurting global technology firms." The troubles started last month when workers left the factory campus in Zhengzhou, the capital of the central province of Henan, due to Covid fears. Short on staff, bonuses were offered to workers to return. But protests broke out this week when the newly hired staff said management had reneged on their promises. The workers, who clashed with security officers wearing hazmat suits, were eventually offered cash to quit and leave.

Analysts said the woes facing Taiwan contract manufacturing firm Foxconn, a top Apple supplier which owns the facility, will also speed up the pace of diversification away from China to countries like India.

Daniel Ives, managing director of equity research at Wedbush Securities, told CNN Business that the ongoing production shutdown in Foxconn's sprawling campus in the central Chinese city of Zhengzhou was an "albatross" for Apple. "Every week of this shutdown and unrest we estimate is costing Apple roughly $1 billion a week in lost iPhone sales. Now roughly 5% of iPhone 14 sales are likely off the table due to these brutal shutdowns in China," he said.

Demand for iPhone 14 units during the Black Friday holiday weekend was much higher than supply and could cause major shortages leading into Christmas, Ives said, adding that the disruptions at Foxconn, which started in October, have been a major "gut punch" to Apple this quarter. In a note Friday, Ives said Black Friday store checks show major iPhone shortages across the board.
Ives' note says he believes "many Apple Stores now have iPhone 14 Pro shortages ... of up to 25%-30% below normal heading into a typical December."

CNN also cites an analyst at TF International Securities who estimated on Twitter that more than 10% of global iPhone production capacity has been affected by the situation at the Zhengzhou campus.

Are we missing some clarifying details in the saga of Sam Bankman-Fried? The New York Post seems to think so, writing among other things, that inside a glamorous Bahamas penthouse, 10 roommates became "a group of financial renegades that dropped speed, blithely swapped in and out of relationships with one another, and watched their boss play video games while pitching for a billion-dollar investment." And they all lived together at "Albany, Bahamas, home to the swanky $40 million digs" used by cryptocurrency giant FTX & "the $15 billion company that went recently belly up amid allegations of fraud and mismanagement" according to accounts of staffers who lived and worked there. Led by disgraced CEO and co-founder Sam Bankman-Fried, a 30-year-old Californian known as SBF, the group pulled all-nighters while high on amphetamines at their retreat"; which boasted six bedrooms, two elevators, manicured grounds, a golf course and a boat basin packed with super yachts.

"The feeling was that they were treating Albany like a frat house," a well-heeled Bahamian local told The Post.....

"Stimulants when you wake up, sleeping pills if you need them when you sleep" that was the formula for FTX's success, according to a tweet from Bankman-Fried....

"He gave money for this, money for that," a restaurateur in Nassau told The Post. "I don't know if he is a great fellow with bad management." Asked what the Albany locals are saying about the implosion of FTX, the high-society source responded: "Nothing. They're embarrassed."

Google says "60% of the internet is duplicate." Gary Illyes from Google posted this slide at the Google Search Central Live in Singapore the other day.

Proton Next has been announced by Valve developer Pierre-Loup Griffais on Twitter, as an easier way to check out and test the upcoming stable releases of new Proton versions for Linux desktop and Steam Deck. GamingOnLinux reports: It is mostly the same as the Release Candidate for Proton 7.0-5 that was put up in October. However, it's now its own entry in Steam as Proton Next. This makes it far easier to test, since you can set it to games individually, instead of opting into a Beta with the current main version of Proton. This new Proton Next will only become available when there is a new version of Proton ready for testing, and once stable it will be retired. So games you've set to it, would likely just get bumped to the main version of Proton since it would replace it. The changelog and patch notes are available here.

The Securities and Exchange Commission was seeking information from collapsed cryptocurrency exchange FTX earlier this year, the Prospect reported Wednesday, bringing a new perspective to an effort by a bipartisan group of congressmembers to slow down that investigation. From the report: The March letter [PDF] from eight House members -- four Democrats and four Republicans -- questioned the SEC's authority to make informal inquiries to crypto and blockchain companies, and intimated that the requests violated federal law. Rep. Tom Emmer (R-MN), whom the Republican caucus just elected as majority whip, the number three position in the House GOP leadership, led the letter. In a contemporaneous Twitter thread, Emmer wrote: "My office has received numerous tips from crypto and blockchain firms that SEC Chair Gary Gensler's information reporting 'requests' to the crypto community are overburdensome, don't feel particularly ... voluntary ... and are stifling innovation."

We now know that FTX was one of those firms receiving information requests from the SEC, about the very activities that have brought down the firm. This raises the question of whether Emmer and the other congressmembers were acting on behalf of FTX (which has been credibly accused of snatching customer money to make risky bets) to try to chill an ongoing investigation from an independent regulatory and law enforcement agency. Some of the "Blockchain Eight," as the Prospect termed them in March, have benefited from crypto largesse. Five of the eight members received campaign donations from FTX employees, ranging from $2,900 to $11,600. Rep. Ted Budd (R-NC), one of the signatories, received half a million dollars in support from a Super PAC created by FTX co-CEO Ryan Salame.

SonicSpike shares a report from Futurism: It appears that NASA's Artemis 1 rocket launch pad caught way more damage than expected when it finally took off from Kennedy Space Center last week. As Reuters space reporter Joey Roulette tweeted, a source within the agency said that damage to the launchpad "exceeded mission management's expectations," and per his description, it sounds fairly severe.

"Elevator blast doors were blown right off, various pipes were broken, some large sheets of metal left laying around," the Reuters reporter noted in response to SpaceNews' Jeff Foust, who on Friday summarized a NASA statement conceding that the launchpad's elevators weren't working because a "pressure wave" blew off the blast doors. Shortly after the launch, NASA acknowledged that debris was seen falling off the rocket, though officials maintain that it caused "no additional risk" to the mission. In spite of those sanguine claims, however, reporters revealed that NASA seemed very intent on them not photographing the Artemis launch tower -- and now, with these preliminary reports about how messed up it seems to have gotten, we may know why.