An anonymous reader quotes a report from Motherboard: Researchers have found a new and surprisingly simple method for bypassing facial recognition software using makeup patterns. A new study from Ben-Gurion University of the Negev found that software-generated makeup patterns can be used to consistently bypass state-of-the-art facial recognition software, with digitally and physically-applied makeup fooling some systems with a success rate as high as 98 percent. In their experiment, the researchers defined their 20 participants as blacklisted individuals so their identification would be flagged by the system. They then used a selfie app called YouCam Makeup to digitally apply makeup to the facial images according to the heatmap which targets the most identifiable regions of the face. A makeup artist then emulated the digital makeup onto the participants using natural-looking makeup in order to test the target model's ability to identify them in a realistic situation.

The researchers tested the attack method in a simulated real-world scenario in which participants wearing the makeup walked through a hallway to see whether they would be detected by a facial recognition system. The hallway was equipped with two live cameras that streamed to the MTCNN face detector while evaluating the system's ability to identify the participant. The experiment saw 100 percent success in the digital experiments on both the FaceNet model and the LResNet model, according to the paper. In the physical experiments, the participants were detected in 47.6 percent of the frames if they weren't wearing any makeup and 33.7 percent of the frames if they wore randomly applied makeup. Using the researchers' method of applying makeup to the highly identifiable parts of the attacker's face, they were only recognized in 1.2 percent of the frames.

A man who the Department of Justice says unlocked AT&T customers' phones for a fee was sentenced to 12 years in prison, in what the judge called "a terrible cybercrime over an extended period," which allegedly continued even after authorities were on to the scheme. The Verge reports: According to a news release from the DOJ, in 2012, Muhammad Fahd, a citizen of Pakistan and Grenada, contacted an AT&T employee via Facebook and offered the employee "significant sums of money" to help him secretly unlock AT&T phones, freeing the customers from any installment agreement payments and from AT&T's service. Fahd used the alias Frank Zhang, according to the DOJ, and persuaded the AT&T employee to recruit other employees at its call center in Bothell, Washington, to help with the elaborate scheme. Fahd instructed the AT&T employees to set up fake businesses and phony bank accounts to receive payments, and to create fictitious invoices for deposits into the fake accounts to create the appearance that money exchanged as part of the scheme was payment for legitimate services.

In 2013, however, AT&T put into place a new unlocking system which made it harder for Fahd's crew to unlock phones' unique IMEI numbers, so according to the DOJ he hired a developer to design malware that could be installed on AT&T's computer system. This allegedly allowed him to unlock more phones, and do so more efficiently. The AT&T employees working with Fahd helped him access information about its systems and other employees' credentials, allowing his developer to tailor the malware more precisely, the DOJ said. A forensic analysis by AT&T showed Fahd and his helpers fraudulently unlocked more than 1.9 million phones, costing the company more than $200 million. Fahd was arrested in Hong Kong in 2018 and extradited to the US in 2019. He pleaded guilty in September 2020 to conspiracy to commit wire fraud.

Google announced plans today to port its Permission Auto-Reset feature from Android 11 to older versions of its mobile operating system, as far back as Android 6. From a report: Launched last fall, the Permission Auto-Reset feature works by automatically withdrawing user permissions from an app that hasn't been opened and used for a few months. "Starting in December 2021, we are expanding this [feature] to billions more devices," Google said today. "This feature will automatically be enabled on devices with Google Play services that are running Android 6.0 (API level 23) or higher." Exempt from this new feature will be device admin apps and enterprise apps where the permissions have been fixed through a general enterprise policy.

Federal Trade Commission chair Lina Khan signaled changes are on the way in how the agency scrutinizes acquisitions after revealing the results of a study of a decade's worth of Big Tech company deals that weren't reported to the agency. From a report: Tech's business ecosystem is built on giant companies buying up small startups, but the message from the antitrust agency this week could chill mergers and acquisitions in the sector. The FTC reviewed 616 transactions valued at $1 million or more between 2010 and 2019 that were not reported to antitrust authorities by Amazon, Apple, Facebook, Google and Microsoft. 94 of the transactions actually exceeded the dollar size threshold that would require companies to report a deal. The deals may have qualified for other regulatory exemptions. 79% of transactions used deferred or contingent compensation to founders and key employees, and nearly 77% involved non-compete clauses. 36% of the transactions involved assuming some amount of debt or liabilities. In a statement, Khan said the report shows that loopholes may be "unjustifiably enabling deals to fly under the radar."

Telegram has exploded as a hub for cybercriminals looking to buy, sell and share stolen data and hacking tools, new research shows, as the messaging app emerges as an alternative to the dark web. From a report: An investigation by cyber intelligence group Cyberint, together with the Financial Times, found a ballooning network of hackers sharing data leaks on the popular messaging platform, sometimes in channels with tens of thousands of subscribers, lured by its ease of use and light-touch moderation. In many cases, the content resembled that of the marketplaces found on the dark web, a group of hidden websites that are popular among hackers and accessed using specific anonymising software. "We have recently been witnessing a 100 per cent-plus rise in Telegram usage by cybercriminals," said Tal Samra, cyber threat analyst at Cyberint.

"Its encrypted messaging service is increasingly popular among threat actors conducting fraudulent activity and selling stolen dataâ... as it is more convenient to use than the dark web." The rise in nefarious activity comes as users flocked to the encrypted chat app earlier this year after changes to the privacy policy of Facebook-owned rival WhatsApp prompted many to seek out alternatives. Launched in 2013, Telegram allows users to broadcast messages to a following via "channels," or create public and private groups that are simple for others to access. Users can also send and receive large data files, including text and zip files, directly via the app.

The U.S. Department of Justice announced Wednesday that Stefan He Qin, the founder of two cryptocurrency-focused hedge funds who pled guilty to securities fraud in February, has been sentenced to 90 months in prison for his actions. Tom's Hardware reports: Qin's funds were called Virgil Sigma and VQR. Both were supposed to offer investors a way to profit off the crypto market that "was not exposed to any risk from the price of cryptocurrency moving up or down and therefore provided a relatively safe and liquid investment." Those claims didn't seem to attract much scrutiny; the DOJ noted that The Wall Street Journal actually profiled Qin in 2018 to celebrate his fund's apparent success. But U.S. Attorney Audrey Strauss said in a statement that Qin's funds were actually devoted to his personal gain rather than solid financial returns for investors: "Qin's investors soon discovered that his strategies [emphasis Strauss'] weren't much more than a disguised means for him to embezzle and make unauthorized investments with client funds. When faced with redemption requests he couldn't fulfill, Qin doubled down on his scheme by attempting to plunder funds from VQR to satisfy his victim investors' demands. Qin's brazen and wide-ranging scheme left his beleaguered investors in the lurch for over $54 million, and he has now been handed the appropriately lengthy sentence of over seven years in federal prison." The DOJ said that in addition to the 90-month prison sentence, Qin "was also sentenced to three years of supervised release, and ordered to forfeit $54,793,532" and that "the Virgil Sigma fund and VQR have ceased operations and the liquidation and distribution of assets is being handled by a court-appointed receiver."

The Federal Trade Commission (FTC) voted 3-2 Wednesday that a decade-old rule on health data breaches applies to apps that handle sensitive health information, warning these companies to comply. From a report: The new policy statement agreed to by the FTC was intended to clarify the agency's 2009 Health Breach Notification Rule, which requires vendors handling health records to notify consumers if the data is accessed through a breach or other means without the individual's authorization. The new policy states that the rule applies to health apps, such as those tracking fitness or menstrual cycles, which have been developed over the past decade.

"As many Americans turn to apps and other technologies to track diseases, diagnoses, treatment, medications, fitness, fertility, sleep, mental health, diet, and other vital areas, this Rule is more important than ever," the policy statement agreed to Wednesday reads. "Firms offering these services should take appropriate care to secure and protect consumer data." The FTC intends to enforce the new policy, with those in violation facing a financial penalty of over $43,000 per day.

An anonymous reader quotes a report from Ars Technica: Travis CI is a popular software-testing tool due to its seamless integration with GitHub and Bitbucket. As the makers of the tool explain: "When you run a build, Travis CI clones your GitHub repository into a brand-new virtual environment and carries out a series of tasks to build and test your code. If one or more of those tasks fail, the build is considered broken. If none of the tasks fail, the build is considered passed and Travis CI can deploy your code to a web server or application host." But this month, researcher Felix Lange found a security vulnerability that caused Travis CI to include secure environment variables of all public open source repositories that use Travis CI into pull request builds. Environment variables can include sensitive secrets like signing keys, access credentials, and API tokens. If these variables are exposed, attackers can abuse the secrets to obtain lateral movement into the networks of thousands of organizations.

Tracked as CVE-2021-41077, the bug is present in Travis CI's activation process and impacts certain builds created between September 3 and September 10. As a part of this activation process, developers are supposed to add a ".travis.yml" file to their open source project repository. This file tells Travis CI what to do and may contain encrypted secrets. Another place encrypted secrets may be defined is Travis' web UI. But, these secrets are not meant to be exposed. In fact, Travis CI's docs have always stated, "Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code." Ideally, Travis is expected to run in a manner that prevents public access to any secret environment variables specified. [...] This vulnerability caused these sorts of secrets to be unexpectedly exposed to just about anyone forking a public repository and printing files during a build process. Fortunately, the issue didn't last too long -- around eight days, thanks to Lange and other researchers who notified the company of the bug on September 7. But out of caution, all projects relying on Travis CI are advised to rotate their secrets.

The presence and relatively quick patching of the flaw aside, Travis CI's concise security bulletin and overall handling of the coordinated disclosure process has infuriated the developer community. In a long Twitter thread, Peter Szilagyi details the arduous process that his group endured as it waited for Travis CI to take action and release a brief security bulletin on an obscure webpage. "After 3 days of pressure from multiple projects, [Travis CI] silently patched the issue on the 10th. No analysis, no security report, no post mortem, not warning any of their users that their secrets might have been stolen," tweeted Szilagyi. After Szilagyi and Lange asked GitHub to ban Travis CI over its poor security posture and vulnerability disclosure processes, an advisory showed up. "Finally, after multiple ultimatums from multiple projects, [they] posted this lame-ass post hidden deep where nobody will read it... Not even a single 'thank you.' [No] acknowledgment of responsible disclosure. Not even admitting the gravity of it all," said Szilagyi, while referring to the security bulletin -- and especially its abridged version, which included barely any details. Szilagyi was joined by several members of the community in criticizing the bulletin. Boston-based web developer Jake Jarvis called the disclosure an "insanely embarrassing 'security bulletin.'" "Travis CI implemented a series of security patches starting on Sept 3rd that resolves this issue," concluded Mendy on behalf of the Travis CI team. "As a reminder, cycling your secrets is something that all users should do on a regular basis. If you are unsure how to do this, please contact Support."

DoorDash sued New York City on Wednesday over a new law requiring food delivery companies to share customer data with restaurants, saying it violates customer privacy and lets restaurants compete unfairly. Reuters reports: It was filed in federal court in Manhattan six days after DoorDash, Grubhub and Uber Eats sued the United States' most populous city over a separate law capping fees that delivery companies charge restaurants. [...] In Wednesday's lawsuit, San Francisco-based DoorDash said New York exhibited "naked animus" by requiring food delivery companies to provide customers' names, phone numbers, email addresses and delivery addresses to restaurants. DoorDash said this would let restaurants "free-ride" on the data in a "shocking and invasive intrusion of consumers' privacy," saying restaurants would not demand the same information from in-person diners. It also said "more vulnerable populations, especially undocumented customers" could be harmed if data were mishandled, and shared with immigration authorities or hate groups.

Two top lawmakers on the Senate Commerce Committee's panel over consumer protection said they were launching a probe into Facebook after The Wall Street Journal reported Tuesday that the company was aware of the harm Instagram can cause to teenage girls. The Verge reports: Sens. Richard Blumenthal (D-CT) and Marsha Blackburn (R-TN) announced their investigation into Facebook in a statement released Tuesday. The senators said that they were in touch with "a Facebook whistleblower" and would seek new documents and witness testimony from the company related to the reporting. "It is clear that Facebook is incapable of holding itself accountable. The Wall Street Journal's reporting reveals Facebook's leadership to be focused on a growth-at-all-costs mindset that valued profits over the health and lives of children and teens," the lawmakers said. "When given the opportunity to come clean to us about their knowledge of Instagram's impact on young users, Facebook provided evasive answers that were misleading and covered up clear evidence of significant harm."

House lawmakers also criticized Facebook over the Journal's new reporting, and Republicans even issued a new amendment to the $3.5 trillion budget reconciliation seeking to address tech's effects on teens. Rep. Gus Bilirakis (R-FL) introduced the measure that would direct the Federal Trade Commission to go after "unfair and deceptive acts or practices targeting our children's mental health and privacy by social media." The amendment failed. Rep. Ken Buck (R-CO), top Republican on the House Judiciary Committee's antitrust subcommittee, said in a tweet, "Big Tech has become the new Big Tobacco. Facebook is lying about how their product harms teens." A group of Democrats, including Sen. Ed Markey (D-MA), Rep. Kathy Castor (D-FL), and Lori Trahan (D-MA), penned a letter to Facebook Wednesday calling on the company to abandon its plans to launch an Instagram app for kids in light of the report.

The US Department of Justice has fined three former NSA employees who worked as hackers-for-hire for a United Arab Emirates cybersecurity company. From a report: Marc Baier, 49, Ryan Adams, 34, and Daniel Gericke, 40, broke US export control laws that require companies and individuals to obtain a special license from the State Department's Directorate of Defense Trade Controls (DDTC) before providing defense-related services to a foreign government. According to court documents, the three suspects helped the UAE company develop and successfully deploy at least two hacking tools. The three entered into a first-of-its-kind deferred prosecution agreement with the DOJ today, agreeing to pay $750,000, $600,000, and $335,000, respectively, over a three-year term, in order to avoid jail time for their actions.

The Securities and Exchange Commission announced Tuesday that it's charging App Annie, the mobile app data provider, with securities fraud, accusing the company of "engaging in deceptive practices" and misrepresenting the origins of its data. From a report: App Annie will pay a $10 million settlement, according to the announcement, although the company has not admitted to any of the SEC's findings. According to the SEC, the company, which sells estimates on app downloads, usage and revenue, assured app businesses that the performance data they shared with App Annie would only be used in an anonymized way and run through an algorithm to generate performance estimates. But the SEC accuses App Annie and its former CEO and Chairman Bertrand Schmitt of reneging on that promise and using actual performance data to tweak its estimate models between 2014 and 2018. Then, the SEC alleges, the company sold that confidential data to trading firms, and misled those customers into thinking that the data was compliant with federal securities laws.

Chinese police are using a new anti-fraud app installed on more than 200m mobile phones to identify and question people who have viewed overseas financial news sites, according to individuals summoned by the authorities. From a report: The app was launched in March by the public security ministry's National Anti-Fraud Center and blocks suspicious phone calls and reports malware. Police said it was needed to combat a surge in fraud, often perpetrated by overseas operations managed by Chinese and Taiwanese nationals. The ministry recommended that the app was downloaded but numerous local government agencies made it mandatory for their employees and individuals with whom they work, such as students and tenants. One Shanghai-based user told the Financial Times he was contacted by police after accessing a US financial news service. He was also asked whether he had contacts abroad and regularly visited overseas websites. The user, who asked not to be identified, said police seemed genuinely concerned about foreign scams. "But the questions they raised about whether I have contacted foreigners made me feel like they don't want me accessing foreign websites," he added. "I deleted the app after the meeting."

An anonymous reader quotes a report from Reuters: Uber drivers are employees, not contractors, and so entitled to greater workers' rights under local labor laws, a Dutch court ruled on Monday, handing a setback to the U.S. company's European business model. It was another court victory for unions fighting for better pay and benefits for those employed in the gig economy and followed a similar decision this year about Uber in Britain. The Amsterdam District Court sided with the Federation of Dutch Trade Unions (FNV), which had argued that Uber's roughly 4,000 drivers in the capital are employees of a taxi company and should be granted benefits in line with the taxi sector.

The court found drivers who transport passengers via the Uber app are covered by the collective labour agreement for taxi transportation. "The legal relationship between Uber and these drivers meets all the characteristics of an employment contract," the ruling said. Uber drivers are in some cases entitled to back pay, the court said. The judges also ordered Uber to pay a fine of 50,000 euros ($58,940) for failing to implement the terms of the labor agreement for taxi drivers. Uber said it would appeal against the decision and "has no plans to employ drivers in the Netherlands." They added: "We are disappointed with this decision because we know that the overwhelming majority of drivers wish to remain independent. Drivers don't want to give up their freedom to choose if, when and where to work."

Last November, Uber, Lyft and other gig economy companies scored a decisive win in California when a majority of the state's voters passed a company-sponsored ballot measure that cemented workers' status as contractors, albeit with some benefits.

President Biden will nominate Georgetown University law professor Alvaro Bedoya to be a Democratic commissioner at the Federal Trade Commission, people familiar with the matter told Axios. From a report: Bedoya, founding director of the Center on Privacy & Technology at Georgetown, will bring a bevy of experience on privacy issues to the FTC's work on tech. If confirmed, Bedoya will solidify the Democratic majority at the FTC with current commissioner Rohit Chopra set to leave the agency as Biden's nominee to lead the Consumer Financial Protection Bureau. Bedoya previously was chief counsel of the Senate Judiciary privacy subcommittee and worked on issues including mobile location data and facial recognition.

Epic Games filed a notice of appeal Sunday following a judge's decision in its antitrust lawsuit against Apple. From a report: U.S. District Judge Yvonne Gonzalez Rogers mostly sided with Apple, rejecting Epic's claims that the iPhone maker is a monopoly. She also didn't rule that Apple needs to restore Fortnite, Epic's hit game at the center of the lawsuit, to the App Store or Epic's Apple developer account. She also rejected the need for third-party App Stores and didn't force Apple to lower its App Store revenue cut of 15% to 30%.

The judge, however, said that Apple has engaged in some anticompetitive conduct and she ordered the Cupertino, California-based technology giant to allow all app and game developers to steer consumers to outside payment methods on the web. All developers for the first time could be able to include a button in their apps to let users pay for transactions online, circumventing Apple's fees. She also ordered Epic to pay at least $4 million in damages to Apple for breach of contract, which included collecting payments outside of Apple's in-app-purchase system.

The Guardian tells the story of "a viral sensation in the global underworld," the high-security An0m phones, which launched with "a grassroots marketing campaign, identifying so-called influencers — 'well-known crime figures who wield significant power and influence over other criminal associates', according to a US indictment — within criminal subcultures." An0m could not be bought in a shop or on a website. You had to first know a guy. Then you had to be prepared to pay the astronomical cost: $1,700 for the handset, with a $1,250 annual subscription, an astonishing price for a phone that was unable to make phone calls or browse the internet.

Almost 10,000 users around the world had agreed to pay, not for the phone so much as for a specific application installed on it. Opening the phone's calculator allowed users to enter a sum that functioned as a kind of numeric open sesame to launch a secret messaging application. The people selling the phone claimed that An0m was the most secure messaging service in the world. Not only was every message encrypted so that it could not be read by a digital eavesdropper, it could be received only by another An0m phone user, forming a closed loop system entirely separate from the information speedways along which most text messages travel. Moreover, An0m could not be downloaded from any of the usual app stores. The only way to access it was to buy a phone with the software preinstalled...

[U]sers could set an option to wipe the phone's data if the device went offline for a specified amount of time. Users could also set especially sensitive messages to self-erase after opening, and could record and send voice memos in which the phone would automatically disguise the speaker's voice. An0m was marketed and sold not so much to the security conscious as the security paranoid...

An0m was not, however, a secure phone app at all. Every single message sent on the app since its launch in 2018 — 19.37m of them — had been collected, and many of them read by the Australian federal police (AFP) who, together with the FBI, had conceived, built, marketed and sold the devices.

On 7 June 2021, more than 800 arrests were made around the world....
Law enforcement agencies ultimately saw An0m as a creative workaround for unbreakable encryption, according to the Guardian. "Why debate tech companies on privacy issues through costly legal battles if you can simply trick criminals into using your own monitored network?"

The Guradian's story was shared by jd (Slashdot user #1,658), who sees an ethical question. "As the article notes, what's to stop a tyrant doing the same against rivals or innocent protestors?"

Alain Williams (Slashdot reader #2972) brings this report from the BBC: Boeing's board of directors must face a lawsuit from shareholders over two fatal crashes involving its 737 Max plane, a U.S. judge has ruled. Morgan Zurn said the first crash was a "red flag" about a key safety system on the aircraft "that the board should have heeded but instead ignored".

She said the real victims were the dead and their families but investors had also lost billions of dollars... In her ruling the Delaware judge said: "While it may seem callous in the face of [the families'] losses, corporate law recognizes another set of victims: Boeing as an enterprise, and its stockholders...."

The crashes have already cost Boeing about $20bn in fines, cancelled orders and other costs.

"After 9/11, I took the threat of terrorism seriously, still do," U.S. Senator Ron Wyden tells Fast Company. "But also I was concerned about how the new surveillance authorities might be abused..."

From Fast Company's report: After the 9/11 attacks, one big concern was connecting the dots. Failing to do so was why we missed the warning signs of the attacks and how we would prevent the next ones, the thinking went. One solution, according to the Pentagon, was a project to gather as much data as possible, to look for signs of future bad behavior. It was called Total Information Awareness...

Since the 1970s, Congress has been charged with preventing further abuse of the government's surveillance powers, particularly when it comes to spying on Americans. And few in Congress have questioned these powers as vigorously as Sen. Ron Wyden...

Sen. Wyden: Total Information Awareness was an ominous sounding idea to put together as much data on Americans as possible, and when used with what was then so-called predictive technology, identify who to watch as a way to stop terrorism. In the fight in Congress, here's the lesson that goes to the concerns we had 20 years ago: Total Information Awareness made it clear that the threat is not just surveillance through the aggressive collection, amalgamating, and mining of information through existing authorities. The bigger problem now is the amount of data on Americans that's available commercially or on social media... the threat to people's privacy is just as great. And the job of getting people's attention is still very, very challenging...

This is a national security issue: The personal data of Americans that the data brokers are selling is a gold mine for foreign intelligence services who can exploit it, to target supercharged hacking, blackmail, and influence campaigns. So I'm leading an effort right now that encompasses the biggest online advertising companies, to ask if they're sharing Americans' web browsing and location data with foreign companies.

"Recently, browsing leader Mozilla shared the result of an independent security audit on its VPN service," reports Fossbytes.

"Upon inspection, a few vulnerabilities were discovered in the VPN, one of which was reportedly a major risk." In a blog post, Mozilla shared that Cure53, a Berlin-based cybersecurity firm, had identified and fixed the security vulnerabilities in its VPN... The most severe issue, labeled "FVP-02-014," made the user vulnerable to cross-site WebSocket hijacking. Moreover, the medium-risk vulnerabilities revolved around "VPN leak via captive portal detection" and "Auth code leak" by injecting the port. However, these sophisticated terms shouldn't worry you anymore as Cure53 has already addressed these weaknesses. There has also been no mention of any Mozilla VPN users falling victim to these either.

The Firefox developer's public post that outlines the security flaws detected by the German firm provides users an insight into the potential risks of using a VPN. Moreover, these audits also help Mozilla iron out any issues that its one-year-old VPN service might have.