The Global Expansion of AI Surveillance

A growing number of states are deploying advanced AI surveillance tools to monitor, track, and surveil citizens. Carnegie’s new index explores how different countries are going about this.

Artificial intelligence (AI) technology is rapidly proliferating around the world. Startling developments keep emerging, from the onset of deepfake videos that blur the line between truth and falsehood, to advanced algorithms that can beat the best players in the world in multiplayer poker. Businesses harness AI capabilities to improve analytic processing; city officials tap AI to monitor traffic congestion and oversee smart energy metering. Yet a growing number of states are deploying advanced AI surveillance tools to monitor, track, and surveil citizens to accomplish a range of policy objectives—some lawful, others that violate human rights, and many of which fall into a murky middle ground.

👉🏼 Read more:
https://carnegieendowment.org/2019/09/17/global-expansion-of-ai-surveillance-pub-79847

👉🏼 PDF:
https://carnegieendowment.org/files/AI_Global_Surveillance_Index1.pdf

#global #surveillance #ai #index #pdf #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Samsung: Anyone's thumbprint can unlock Galaxy S10 phone

A flaw that means any fingerprint can unlock a Galaxy S10 phone has been acknowledged by Samsung.

It promised a software patch that would fix the problem.

The issue was spotted by a British woman whose husband was able to unlock her phone with his thumbprint when it was stored in a cheap case.

When the S10 was launched, in March, Samsung described the fingerprint authentication system as "revolutionary".

Air gap

The scanner sends ultrasounds to detect 3D ridges of fingerprints in order to recognise users.

Samsung said it was "aware of the case of S10's malfunctioning fingerprint recognition and will soon issue a software patch".

South Korea's online-only KaKao Bank told customers to switch off the fingerprint-recognition option to log in to its services until the issue was fixed.

Previous reports suggested some screen protectors were incompatible with Samsung's reader because they left a small air gap that interfered with the scanning.

Thumb print

The British couple who discovered the security issue told the Sun newspaper it was a "real concern".

After buying a £2.70 gel screen protector on eBay, Lisa Neilson registered her right thumbprint and then found her left thumbprint, which was not registered, could also unlock the phone.

She then asked her husband to try and both his thumbs also unlocked it.

And when the screen protector was added to another relative's phone, the same thing happened.

https://www.bbc.com/news/technology-50080586

#phone #bug #samsung #thumbprint #unlock #galaxy #S10
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Tinder

Are you spending hours of your day swiping left and right on Tinder? It’s normal as the app was created to be addictive by activating dopamine in your brain with every swipe drawing you in further.

📺 #Dopamine - #Tinder #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Facebook

Facebook is addictive. Taking advantage of our basic human instinct to socialise, the social network harvests unimaginably large amounts of personal data while never quite fulfilling our thirst for social validation.

📺 #Dopamine - #Facebook #DeleteFacebook #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Candy Crush

Are you wasting hours on Candy Crush when you really should be working? Appealing to our inner sense of order, the video game that millions play on their smartphones is built to draw you in with some clever sales techniques.

📺 #Dopamine - #CandyCrush #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Instagram

Is Instagram irresistible for you? The app was made that way to appeal to your basic need for social validation.

📺 #Dopamine - #Instagram #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - YouTube

With sophisticated algorithms using deep learning, Youtube offers users irresistible video recommendations that become ever more sensationalist or even conspiratorial.

📺 #Dopamine - #YouTube #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Snapchat

Snapchat is so much fun you can’t stop yourself from getting addicted. Using the universal concept of giving and receiving gifts to keep us interacting, the messaging app gnaws its way into our lives.

📺 #Dopamine - #Snapchat #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Uber

You’ve made a decision to become an Uber driver hoping to make some money and be your own boss. But with Uber's clever use of nudge theory, the reality isn’t quite what you hoped for.

📺 #Dopamine - #Uber #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Dopamine - Twitter

Do you constantly check twitter on your smartphone for the latest tweets? Preying on our fear of missing out (fomo), Twitter has harnessed our natural anxiety to make…. a lot of money.

📺 #Dopamine - #Twitter #video #thinkabout

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

"Dopamine": Miniseries about the addiction mechanisms of Tinder, Facebook and Co.

"They'll do anything to make you an addict," they say about #Tinder, #Facebook, #CandyCrush, #Instagram, #YouTube, #Snapchat, #Uber and #Twitter in the miniseries of #Arte. Eight episodes explain in detail which mechanisms are triggered in our brain to keep us engaged

📺 Dopamine - Tinder

📺 Dopamine - Facebook

📺 Dopamine - Candy Crush

📺 Dopamine - Instagram

📺 Dopamine - YouTube

📺 Dopamine - Snapchat

📺 Dopamine - Uber

📺 Dopamine - Twitter

💡 Actually, we have known this for a long time:
Candy Crush, Tinder, Facebook and others are above all one thing - time wasters. Nevertheless, it's extremely difficult for us to leave the #Smartphone on the shelf and not check out what's new every few minutes. Especially since what is then presented to us as news only rarely has news value or really gets us ahead. Nevertheless, we check out pages and pages of Aunt Monika's pictures from Paris, swear to complete "only one more level" at Candy Crush, let ourselves be carried away by the autoplay function into ever more abstruse depths of Youtube and simply can't get enough of cute cat photos on Instagram. What's wrong with us?

#Tinder #Facebook #CandyCrush #Instagram #YouTube #Snapchat #Uber #Twitter #Dopamine #video #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

APT41 compromised company behind TeamViewer - which enabled them to access *any* system with TeamViewer installed 👀👀

https://nitter.net/cglyer/status/1182413194360508419

#APT41 #TeamViewer #hacked #breach #alert #warning
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Google chief: I'd disclose smart speakers before guests enter my home

It's an admission that appears to have caught Google's devices chief by surprise.

After being challenged as to whether homeowners should tell guests smart devices - such as a Google Nest speaker or Amazon Echo display - are in use before they enter the building, he concludes that the answer is indeed yes.

"Gosh, I haven't thought about this before in quite this way," Rick Osterloh begins.

"It's quite important for all these technologies to think about all users... we have to consider all stakeholders that might be in proximity."

And then he commits.

"Does the owner of a home need to disclose to a guest? I would and do when someone enters into my home, and it's probably something that the products themselves should try to indicate."

To be fair to Google, it hasn't completely ignored matters of 21st Century privacy etiquette until now.

As Mr Osterloh points out, its Nest cameras shine an LED light when they are in record mode, which cannot be overridden.

But the idea of having to run around a home unplugging or at least restricting the capabilities of all its voice- and camera-equipped kit if a visitor objects is quite the ask.

👉🏼 Read more:
https://www.bbc.com/news/technology-50048144

#DeleteGoogle #smart #speakers #privacy
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping

Smart Spies Hack 1: Requesting the user’s password through a simple backend change
It is possible to ask for sensitive data such as the user’s password from any voice app. To create a password phishing Skill/Action, a hacker could follow the following steps:

📺 https://srlabs.de/bites/smart-spies/

#SmartSpies #alexa #google #vishing #eavesdropping #PoC #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Smart Spies: Alexa and Google Home expose users to vishing and eavesdropping

Smart Spies Hack 2: Faking the stop Intent allows eavesdropping on users
We were able to listen in on conversations after a user believes to have stopped our voice app. To accomplish this, we use a slightly different strategy for each of the voice speaker platforms.

📺 https://srlabs.de/bites/smart-spies/

#SmartSpies #alexa #google #vishing #eavesdropping #PoC #video
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

NordVPN has been hacked

The VPN provider NordVPN apparently had an incident some time ago in which an attacker had access to the servers and private keys. Three private keys appeared on the network, one of which belonged to an expired HTTPS certificate.

Several cryptographic keys and information about NordVPN configuration files have appeared in a leak. One of the keys matches an older NordVPN website certificate. The vendor has not yet commented on the incident.

The leak appeared in an online discussion. In a now deleted tweet NordVPN wrote: "Nobody can steal your online life (if you use a VPN)". In response, someone sent a link to a text file containing evidence of a VPN provider hack.

https://share.dmca.gripe/hZYMaB8oF96FvArZ.txt

https://mobile.twitter.com/NordVPN/status/1185979592374398976

👉🏼 More info (german):

https://www.golem.de/news/leak-nordvpn-wurde-gehackt-1910-144528.html

#leak #NordVPN #hack #hacker #hacked
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

RapidVideo Shuts Down Following Legal Pressure from Warner Bros and Netflix

RapidVideo, a popular file-hosting service with millions of users, has thrown in the towel. The site faces legal pressure from lawyers representing the MPA and ACE, including a lawsuit from Warner Bros. and Netflix. Paired with dwindling revenues and a worsening legal climate, maintaining the site is no longer viable, according to the operator.

RapidVideo is a popular file-hosting service that specializes in hosting videos.
Similar to other file-hosting services, it can be used for good and bad. The bad, in this case, is people uploading pirated videos.

Whether the site’s operators want it or not, that’s what many of RapidVideo’s users are indeed doing. Two weeks ago this resulted in yet another scathing report from movie industry group MPA, which branded the site as a “notorious” piracy haven.

Behind the scenes, the website’s operator faces mounting pressure as well. RapidVideo has been targeted by lawyers from the MPA and ACE, two of the most powerful anti-piracy forces, which are demanding far-reaching copyright enforcement measures from the site.

To back up their pressure, two MPA/ACE members, Warner Bros. Entertainment and Netflix, filed a lawsuit in Germany to stop the alleged copyright infringements the site enables. While this case remains ongoing, the site’s operator decided not to await the verdict and has shut the site down effective immediately.

The millions of users who regularly visit the site currently see nothing more than a 404 error.

👉🏼 Read more:
https://torrentfreak.com/rapidvideo-shuts-down-following-legal-pressure-from-warner-bros-and-netflix-191021/

#RapidVideo #legalpressure #WarnerBros #Netflix
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Apparently other VPN providers were also compromised:

It’s also believed several other VPN providers may have been breached around the same time. Similar records posted online — and seen by TechCrunch — suggest that TorGuard and VikingVPN may have also been compromised, but spokespeople did not return a request for comment.

https://mobile.twitter.com/hexdefined/status/1186106695073726466

https://techcrunch.com/2019/10/21/nordvpn-confirms-it-was-hacked/

👉🏼 NordVPN has been hacked:
https://t.iss.one/BlackBox_Archiv/677

#leak #NordVPN #TorGuard #VikingVPN #hack #hacker #hacked
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Avast, NordVPN Breaches Tied to Phantom User Accounts

Antivirus and security giant Avast and virtual private networking (VPN) software provider NordVPN each today disclosed months-long network intrusions that — while otherwise unrelated — shared a common cause: Forgotten or unknown user accounts that granted remote access to internal systems with little more than a password.

Based in the Czech Republic, Avast bills itself as the most popular antivirus vendor on the market, with over 435 million users. In a blog post today, Avast said it detected and addressed a breach lasting between May and October 2019 that appeared to target users of its CCleaner application, a popular Microsoft Windows cleanup and repair utility. https://blog.avast.com/ccleaner-fights-off-cyberespionage-attempt-abiss

Avast said it took CCleaner downloads offline in September to check the integrity of the code and ensure it hadn’t been injected with malware. The company also said it invalidated the certificates used to sign previous versions of the software and pushed out a re-signed clean update of the product via automatic update on October 15. It then disabled and reset all internal user credentials.

“Having taken all these precautions, we are confident to say that our CCleaner users are protected and unaffected,” Avast’s Jaya Baloo wrote.

This is not the first so-called “supply chain” attack on Avast: In September 2018, researchers at Cisco Talos and Morphisec disclosed that hackers had compromised the computer cleanup tool for more than a month, leading to some 2.27 million downloads of the corrupt CCleaner version.

Avast said the intrusion began when attackers used stolen credentials for a VPN service that was configured to connect to its internal network, and that the attackers were not challenged with any sort of multi-factor authentication — such as a one-time code generated by a mobile app.

“We found that the internal network was successfully accessed with compromised credentials through a temporary VPN profile that had erroneously been kept enabled and did not require 2FA,” Baloo wrote.

👉🏼 Read more:
https://krebsonsecurity.com/2019/10/avast-nordvpn-breaches-tied-to-phantom-user-accounts/#more-49296

#leak #breach #NordVPN #Avast #CCleaner #TorGuard #VikingVPN #hack #hacker #hacked
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

Lies, Damned Lies, and Government Nutrition Advice

#Nutrition #science is almost always a hot, steaming pile of contradictory nonsense. How much worse, then, that our eating habits and dietary #guidelines are shaped by the #government (and its corporate string-pullers)? Join James for this extra tasty, sugar-free, all organic, non-GMO edition of The #CorbettReport.

📻 Episode 365 - #corbettreport #podcast
https://www.corbettreport.com/nutrition/

📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN

30+ civil rights organizations call on elected officials to stop Amazon’s doorbell surveillance partnerships with police

Today, 30+ civil rights organizations signed an open letter sounding the alarm about Amazon’s spreading Ring doorbell partnerships with police. The letter calls on local, state, and federal officials to use their power to investigate Amazon Ring’s business practices, put an end to Amazon-police partnerships, and pass oversight measures to deter such partnerships in the future.

With no oversight and accountability, these partnerships pose a threat to privacy, civil liberties, and democracy. A few of the concerns highlighted by the organizations:

❓ In the absence of clear civil liberties and rights-protective policies to govern the technologies and the use of surveillance footage, once collected, stored footage can be used by law enforcement to conduct facial recognition searches, target protesters exercising their First Amendment rights, teenagers for minor drug possession, or shared with other agencies like ICE or the FBI.

❓ Ring technology gives Amazon employees and contractors in the US and Ukraine direct access to customers’ live camera feeds, a literal eye inside their homes and areas surrounding their homes. These live feeds provide surveillance on millions of American families––from a baby in their crib to someone walking their dog to a neighbor playing with young children in their yard––and other bystanders that don’t know they are being filmed and haven’t given their consent.

❓ Amazon has not been transparent about plans to integrate facial recognition into Ring cameras. The Information reported Ring’s Ukraine-based research team accessed customer’s surveillance footage to train image recognition software. As facial recognition software has been shown to disproportionately misidentify people of color, women and transgender people, it further compounds existing civil liberties concerns and expands suspected criminality centered in racial profiling and gender bias.

👉🏼 Read more:
https://www.fightforthefuture.org/news/2019-10-08-new-30-civil-rights-organizations-call-on/

#amazon #DeleteAmazon #ring #surveillance #partnership #police #why #thinkabout
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_ES
📡@FLOSSb0xIN