Crime

Locking Up Items To Deter Shoplifting Is Pushing Shoppers Online (axios.com) 276

Longtime Slashdot reader schwit1 shares a report from Axios: Locking up merchandise at drugstores and discount retailers hasn't curbed retail theft but is driving frustrated consumers to shop online more, retail experts tell Axios. Retail crime is eating into retailers' profits and high theft rates are also leading to a rise in store closures. Secured cases can cause sales to drop 15% to 25%, Joe Budano, CEO of anti-theft technology company Indyme, previously told Axios. Barricading everything from razors to laundry detergent has largely backfired and broken shopping in America, Bloomberg reports.

Aisles full of locked plexiglass cases are common at many CVS and Walgreens stores where consumers have to wait for an employee to unlock them. Target, Walmart, Dollar General and other retailers have also pulled back on self-checkout to deter shoplifting. "Locking up products worsens the shopping experience, and it makes things inconvenient and difficult," GlobalData retail analyst Neil Saunders said, adding it pushes shoppers to other retailers or to move purchases online.

Driving the news: Manmohan Mahajan, Walgreens global chief financial officer, said in a June earnings call that the retailer was experiencing "higher levels of shrink." Amazon CEO Andy Jassy spoke of the "speed and ease" of ordering online versus walking into pharmacies on a call with investors last week. "It's a pretty tough experience with how much is locked behind cabinets, where you have to press a button to get somebody to come out and open the cabinets for you," Jassy said.
schwit1 adds: "The American-style retail shopping experience was invented in a high-trust environment. As trust erodes, so does the experience."
Businesses

Canceling Subscriptions Should Be As Easy As Signing Up, Newly Proposed federal Rule Says (go.com) 52

In an effort to beef up protections for consumers against corporations, the Biden administration on Monday announced a handful of policies to crack down on "headaches and hassles that waste Americans' time and money." From a report: Through the Federal Trade Commission (FTC) and the Federal Communications Commission (FCC), the administration will ask companies to make it as easy to cancel subscriptions and memberships as it is to sign up for them, and through the Consumer Financial Protection Bureau, a new rule will require companies to let customers cut through automated customer service "doom loops" by pressing a single button to reach a real person.

"For a lot of services, it takes one or two clicks on your phone to sign up. It should take one or two clicks on your phone to end the service," White House Domestic Policy Advisor Neera Tanden said on a call with reporters to discuss the new policies. Consumers could see the new rule applied to gym memberships or subscriptions with phone and internet companies. The administration will also call on health insurance companies to allow claims to be submitted online, rather than requiring insured customers to print out and mail forms in for coverage.

Mozilla

Mozilla Wants You To Love Firefox Again (fastcompany.com) 142

Mozilla's interim CEO Laura Chambers "says the company is reinvesting in Firefox after letting it languish in recent years," reports Fast Company, "hoping to reestablish the browser as independent alternative to the likes of Google's Chrome and Apple's Safari.

"But some of those investments, which also include forays into generative AI, may further upset the community that's been sticking with Firefox all these years..." Chambers acknowledges that Mozilla lost sight of Firefox in recent years as it chased opportunities outside the browser, such as VPN service and email masking. When she replaced Mitchell Baker as CEO in February, the company scaled back those other efforts and made Firefox a priority again. "Yes, Mozilla is refocusing on Firefox," she says. "Obviously, it's our core product, so it's an important piece of the business for us, but we think it's also really an important part of the internet."

Some of that focus involves adding features that have become table-stakes in other browsers. In June, Mozilla added vertical tab support in Firefox's experimental branch, echoing a feature that Microsoft's Edge browser helped popularize three years ago. It's also working on tab grouping features and an easier way to switch between user profiles. Mozilla is even revisiting the concept of web apps, in which users can install websites as freestanding desktop applications. Mozilla abandoned work on Progressive Web Apps in Firefox a few years ago to the dismay of many power users, but now it's talking with community members about a potential path forward.

"We haven't always prioritized those features as highly as we should have," Chambers says. "That's been a real shift that's been very felt in the community, that the things they're asking for . . . are really being prioritized and brought to life."

Firefox was criticized for testing a more private alternative to tracking cookies which could make summaries of aggregated data available to advertisers. (Though it was only tested on a few sites, "Privacy-Preserving Attribution" was enabled by default.) But EFF staff technologist Lena Cohen tells Fast Company that approach was "much more privacy-preserving" than Google's proposal for a "Privacy Sandbox." And according to the article, "Mozilla's system only measures the success rate of ads — it doesn't help companies target those ads in the first place — and it's less susceptible to abuse due to limits on how much data is stored and which parties are allowed to access it." In June, Mozilla also announced its acquisition of Anonym, a startup led by former Meta executives that has its own privacy-focused ad measurement system. While Mozilla has no plans to integrate Anonym's tech in Firefox, the move led to even more anxiety about the kind of company Mozilla was becoming. The tension around Firefox stems in part from Mozilla's precarious financial position, which is heavily dependent on royalty payments from Google. In 2022, nearly 86% of Mozilla's revenue came from Google, which paid $510 million to be Firefox's default search engine. Its attempts to diversify, through VPN service and other subscriptions, haven't gained much traction.

Chambers says that becoming less dependent on Google is "absolutely a priority," and acknowledges that building an ad-tech business is one way of doing that. Mozilla is hoping that emerging privacy regulations and wider adoption of anti-tracking tools in web browsers will increase demand for services like Anonym and for systems like Firefox's privacy-preserving ad measurements. Other revenue-generating ideas are forthcoming. Chambers says Mozilla plans to launch new products outside of Firefox under a "design sprint" model, aimed at quickly figuring out what works and what doesn't. It's also making forays into generative AI in Firefox, starting with a chatbot sidebar in the browser's experimental branch.

Chambers "says to expect a bigger marketing push for Firefox in the United States soon, echoing a 'Challenge the default' ad campaign that was successful in Germany last summer. Mozilla's nonprofit ownership structure, and the idea that it's not beholden to corporate interests, figures heavily into those plans."
Google

Will the Google Antitrust Ruling Change the Internet? (msn.com) 50

Though "It could take years to resolve," the Washington Post imagines six changes that could ultimately result from the two monopoly rulings on Google: Imagine a Google-quality search engine but without ads — or one tailored to children, news junkies or Lego fans. It's possible that Google could be forced to let other companies access its search technology or its essential data to create search engines with the technical chops of Google — but without Google...

Would Apple create a search engine...? The likeliest scenario is you'd need to pick whether to use Google on your iPhone or something else. But technologists and stock analysts have also speculated for years that Apple could make its own search engine. It would be like when Apple started Apple Maps as an alternative to Google Maps.

What if Google weren't allowed to know so much about you? Jason Kint of Digital Content Next, an industry group that includes online news organizations, said one idea is Google's multiple products would no longer be allowed to commingle information about what you do. It would essentially be a divorce of Google's products without breaking the company up. That could mean, for example, that whatever you did on your Android phone or the websites you visit using Chrome would not feed into one giant Google repository about your activities and interests.

The article also wonders if the judge could order Google to be broken up, with separate companies formed out of Android, Google search, and Chrome. (Or if more search competition might make prices drop for the products advertised in search results — or lower the fees charged in Android's app store.) Android's app store might also lose its power to veto apps that compete with Google.

"This is educated speculation," the article acknowledges. "It's also possible that not much will really change. That's what happened after Google was found to have broken the European Union's anti-monopoly laws."

Google has also said it plans to appeal Monday's ruling.
AI

Cannibal AIs Could Risk Digital 'Mad Cow Disease' Without Fresh Data (sciencealert.com) 74

A new article in ScienceAlert describes new research into the dangers of "heavily processed sources of digital nourishment" for generative AI: A new study by researchers from Rice University and Stanford University in the US offers evidence that when AI engines are trained on synthetic, machine-made input rather than text and images made by actual people, the quality of their output starts to suffer.

The researchers are calling this effect Model Autophagy Disorder (MAD). The AI effectively consumes itself, which means there are parallels for mad cow disease — a neurological disorder in cows that are fed the infected remains of other cattle. Without fresh, real-world data, content produced by AI declines in its level of quality, in its level of diversity, or both, the study shows. It's a warning about a future of AI slop from these models.

"Our theoretical and empirical analyses have enabled us to extrapolate what might happen as generative models become ubiquitous and train future models in self-consuming loops," says computer engineer Richard Baraniuk, from Rice University. "Some ramifications are clear: without enough fresh real data, future generative models are doomed to MADness."

The article notes that "faces began to look more and more like each other when fresh, human-generated training data wasn't involved. In tests using handwritten numbers, the numbers gradually became indecipherable.

"Where real data was used but in a fixed way without new data being added, the quality of the output was still degraded, merely taking a little longer to break down. It appears that freshness is crucial."

Thanks to long-time Slashdot reader schwit1 for sharing the news.
Space

China's Long March 6A Rocket Is Making a Mess In Low-Earth Orbit. (arstechnica.com) 34

Longtime Slashdot reader schwit1 shares a report from Ars Technica: The upper stage from a Chinese rocket that launched a batch of Internet satellites Tuesday has broken apart in space, creating a debris field of at least 700 objects in one of the most heavily-trafficked zones in low-Earth orbit. US Space Command, which tracks objects in orbit with a network of radars and optical sensors, confirmed the rocket breakup Thursday. Space Command initially said the event created more than 300 pieces of trackable debris. The military's ground-based radars are capable of tracking objects larger than 10 centimeters (4 inches). Later Thursday, LeoLabs, a commercial space situational awareness company, said its radars detected at least 700 objects attributed to the Chinese rocket. The number of debris fragments could rise to more than 900, LeoLabs said. The culprit is the second stage of China's Long March 6A rocket, which lifted off Tuesday with the first batch of 18 satellites for a planned Chinese megaconstellation that could eventually number thousands of spacecraft. The Long March 6A's second stage apparently disintegrated after placing its payload of 18 satellites into a polar orbit.

Space Command said in a statement it has "observed no immediate threats" and "continues to conduct routine conjunction assessments to support the safety and sustainability of the space domain." According to LeoLabs, radar data indicated the rocket broke apart at an altitude of 503 miles (810 kilometers) at approximately 4:10 pm EDT (20:10 UTC) on Tuesday, around 13-and-a-half hours after it lifted off from northern China. At this altitude, it will take decades or centuries for the wispy effect of aerodynamic drag to pull the debris back into the atmosphere. As the objects drift lower, their orbits will cross paths with SpaceX's Starlink Internet satellites, the International Space Station and other crew spacecraft, and thousands more pieces of orbital debris, putting commercial and government satellites at risk of collision.

Technology

World's Largest 3D-Printed Neighborhood Nears Completion in Texas (reuters.com) 91

ICON, a construction technology company, is nearing completion of 100 3D-printed homes in Wolf Ranch, Texas, using a massive robotic printer. The 45-foot-wide, 4.75-ton Vulcan printer began constructing the walls of what ICON claims is the world's largest 3D-printed community in November 2022. The printer extrudes a concrete mixture layer by layer, creating corduroy-textured walls. ICON senior project manager Conner Jenkins told Reuters the process is faster and more efficient than traditional construction, requiring fewer workers and reducing material waste.

The single-story homes, priced between $450,000 and $600,000, feature concrete walls resistant to water, mold, termites, and extreme weather. However, homeowners reported weak wireless signals due to the thick walls, necessitating mesh internet routers. ICON, which printed its first home in Austin in 2018, is also developing lunar construction systems for NASA's Artemis program.
The Internet

ICANN Reserves .Internal For Private Use at the DNS Level (theregister.com) 62

The Internet Corporation for Assigned Names and Numbers (ICANN) has agreed to reserve the .internal top-level domain so it can become the equivalent to using the 10.0.0.0, 172.16.0.0 and 192.168.0.0 IPv4 address blocks for internal networks. From a report: Those blocks are reserved for private use by the Internet Assigned Numbers Authority, which requires they never appear on the public internet. As The Register reported when we spotted the proposal last January, ICANN wanted something similar but for DNS, by defining a top-level domain that would never be delegated in the global domain name system (DNS) root.

Doing so would mean the TLD could never be accessed on the open internet -- achieving the org's goal of delivering a domain that could be used for internal networks without fear of conflict or confusion. ICANN suggested such a domain could be useful, because some orgs had already started making up and using their own domain names for private internal use only. Networking equipment vendor D-Link, for example, made the web interface for its products available on internal networks at .dlink. ICANN didn't like that because the org thought ad hoc TLD creation could see netizens assume the TLDs had wider use -- creating traffic that busy DNS servers would have to handle. Picking a string dedicated to internal networks was the alternative. After years of consultation about whether it was a good idea -- and which string should be selected -- ICANN last week decided on .internal. Any future applications to register it as a global TLD won't be allowed.

Communications

SpaceX's New Direct-To-Cell Starlink Satellites Are Way Brighter Than the Originals (space.com) 70

According to a recent study, SpaceX's new Starlink direct-to-cell (DTC) satellites are nearly five times brighter than traditional Starlinks due to their lower orbit. While these satellites offer the promise of widespread connectivity, their increased brightness poses challenges for astronomical observations, prompting SpaceX to consider applying brightness mitigation techniques. Space.com reports: The higher luminosity of these DTCs compared to regular Starlinks is partly because they circle Earth at just 217 miles (350 kilometers) above the surface, which is lower than traditional Starlink internet satellites, whose altitude is 340 miles (550 kilometers), the study reported. [...] At the time the study was conducted, SpaceX had not yet applied its routine brightness mitigation techniques to the DTCs, such as adjusting their chassis and solar panels to reduce the portion of spacecraft illuminated by the sun, study lead author Anthony Mallama of the IAU Centre for the Protection of Dark and Quiet Skies from Satellite Constellation Interference (IAU-CPS) told Space.com.

SpaceX began applying brightness mitigation techniques to regular Starlinks in 2020, after astronomers voiced serious concerns about the satellites' trails streaking across telescope images, rendering them unusable. Prior to launch, the company now applies a mirror-like dielectric surface to the underside of each Starlink chassis, to help reflect sunlight into space rather than scattering it toward Earth. Post launch, the company adjusts spacecraft chassis and solar panels to further reduce luminosity. Together, these techniques are very effective, reducing Starlink satellites' brightness by a factor of 10, Mallama said. If SpaceX applies these brightness mitigation techniques to the DTCs, which are nearly the same size as the regular Starlinks, the DTCs would still be 2.6 times brighter than their traditional counterparts, Mallama and his colleagues reported in the recent study, which was reviewed internally by IAU-CPS and posted to the preprint server arXiv last month.

However, while DTCs are brighter objects, they move at a faster apparent rate and spend more time in Earth's shadow than regular Starlinks, which would offset some of their negative impact on astronomy observations, the study noted. "I see it as a tradeoff in parameters rather than an absolute better/worse kind of situation," John Barentine, a principal consultant at Arizona-based Dark Sky Consulting who was not involved with the new study, told Space.com.

The Internet

Techdirt's Mike Masnick Joins the Bluesky Board To Support a 'More Open, Decentralized Internet' (techdirt.com) 18

Mike Masnick, a semi-regular Slashdot contributor and founder of the tech blog Techdirt, is joining the board of Bluesky, where he "will be providing advice and guidance to the company to help it achieve its vision of a more open, more competitive, more decentralized online world." Masnick writes: In the nearly three decades that I've been writing Techdirt I've been writing about what is happening in the world of the internet, but also about how much better the internet can be. That won't change. I will still be writing about what is happening and where I believe we should be going. But given that there are now people trying to turn some of that better vision into a reality, I cannot resist this opportunity to help them achieve that goal. The early internet had tremendous promise as a decentralized system that enabled anyone to build what they wanted on a global open network, opening up all sorts of possibilities for human empowerment and creativity. But over the last couple of decades, the internet has moved away from that democratizing promise. Instead, it has been effectively taken over by a small number of giant companies with centralized, proprietary, closed systems that have supplanted the more open network we were promised.

There are, of course, understandable reasons why those centralized systems have been successful, such as by providing a more user-friendly experience on the front-end. But there was a price to pay: losing user autonomy, privacy and the benefits of decentralization (not to mention losing a highly dynamic, competitive internet). The internet need not be so limited, and over the years I've tried to encourage people and companies to make different choices to return to the original promise and benefits of openness. With Bluesky, we now have one company who is trying.
"Mike's work has been an inspiration to us from the start," says Jay Graber, CEO of Bluesky. "Having him join our board feels like a natural progression of our shared vision for a more open internet. His perspective will help ensure we're building something that truly serves users as we continue to evolve Bluesky and the AT Protocol."
Security

Mac and Windows Users Infected By Software Updates Delivered Over Hacked ISP (arstechnica.com) 68

An anonymous reader quotes a report from Ars Technica: Hackers delivered malware to Windows and Mac users by compromising their Internet service provider and then tampering with software updates delivered over unsecure connections, researchers said. The attack, researchers from security firm Volexity said, worked by hacking routers or similar types of device infrastructure of an unnamed ISP. The attackers then used their control of the devices to poison domain name system responses for legitimate hostnames providing updates for at least six different apps written for Windows or macOS. The apps affected were the 5KPlayer, Quick Heal, Rainmeter, Partition Wizard, and those from Corel and Sogou.

Because the update mechanisms didn't use TLS or cryptographic signatures to authenticate the connections or downloaded software, the threat actors were able to use their control of the ISP infrastructure to successfully perform machine-in-the-middle (MitM) attacks that directed targeted users to hostile servers rather than the ones operated by the affected software makers. These redirections worked even when users employed non-encrypted public DNS services such as Google's 8.8.8.8 or Cloudflare's 1.1.1.1 rather than the authoritative DNS server provided by the ISP. "That is the fun/scary part -- this was not the hack of the ISPs DNS servers," Volexity CEO Steven Adair wrote in an online interview. "This was a compromise of network infrastructure for Internet traffic. The DNS queries, for example, would go to Google's DNS servers destined for 8.8.8.8. The traffic was being intercepted to respond to the DNS queries with the IP address of the attacker's servers."

In other words, the DNS responses returned by any DNS server would be changed once it reached the infrastructure of the hacked ISP. The only way an end user could have thwarted the attack was to use DNS over HTTPS or DNS over TLS to ensure lookup results haven't been tampered with or to avoid all use of apps that deliver unsigned updates over unencrypted connections. As an example, the 5KPlayer app uses an unsecure HTTP connection rather than an encrypted HTTPS one to check if an update is available and, if so, to download a configuration file named Youtube.config. StormBamboo, the name used in the industry to track the hacking group responsible, used DNS poisoning to deliver a malicious version of the Youtube.config file from a malicious server. This file, in turn, downloaded a next-stage payload that was disguised as a PNG image. In fact, it was an executable file that installed malware tracked under the names MACMA for macOS devices or POCOSTICK for Windows devices.
As for the hacked ISP, the security firm said "it's not a huge one or one you'd likely know."

"In our case the incident is contained but we see other servers that are actively serving malicious updates but we do not know where they are being served from. We suspect there are other active attacks around the world we do not have purview into. This could be from an ISP compromise or a localized compromise to an organization such as on their firewall."
The Internet

Indonesia Bans Search Engine DuckDuckGo On Gambling, Pornography Concerns (reuters.com) 71

An anonymous reader quotes a report from Reuters: Indonesia said it has banned the privacy-oriented search engine DuckDuckGo, citing concerns that it could be used to access pornography and online gambling websites which are illegal in the country, the communications ministry said on Friday. Indonesia, with the world's biggest Muslim population, has strict rules that ban the sharing online of content deemed obscene. Social media platform Reddit and video-hosting platform Vimeo are blocked.

Usman Kansong, a communications ministry official, told Reuters that DuckDuckGo had been blocked "because of the many complaints made to us about the rampant online gambling and pornography content in its search results." The ministry did not say how DuckDuckGo differs from other search engines such as Alphabet's Google but on its website, DuckDuckGo said it offered several products intended to "help people protect their online privacy" including the search engine, which it said has been praised by privacy advocates.

Biotech

Neuralink Has Successfully Implanted a Second Brain Chip, Musk Says (reuters.com) 91

Late Friday Elon Musk appeared on Lex Fridman's podcast for a special eight-hour episode about Neuralink.

It's already been viewed 1,702,036 times on YouTube — and resulted in this report from Reuters: Neuralink has successfully implanted in a second patient its device designed to give paralyzed patients the ability to use digital devices by thinking alone, according to the startup's owner Elon Musk... [Musk] gave few details about the second participant beyond saying the person had a spinal cord injury similar to the first patient, who was paralyzed in a diving accident.

Musk said 400 of the implant's electrodes on the second patient's brain are working. Neuralink on its website states that its implant uses 1,024 electrodes... Musk said he expects Neuralink to provide the implants to eight more patients this year as part of its clinical trials.

Neuralink's device "has allowed the first patient to play video games, browse the internet, post on social media and move a cursor on his laptop," according to the article: The first patient, Noland Arbaugh, was also interviewed on the podcast, along with three Neuralink executives, who gave details about how the implant and the robot-led surgery work. Before Arbaugh received his implant in January, he used a computer by employing a stick in his mouth to tap the screen of a tablet device. Arbaugh said with the implant he now can merely think about what he wants to happen on the computer screen, and the device makes it happen... Arbaugh has improved on his previous world record for the speed at which he can control a cursor with thoughts alone "with only roughly 10, 15% of the electrodes working," Musk said on the podcast.
Fridman said his interview with Musk was "the longest podcast I've ever done," calling their conversation "fascinating, super technical, and wide-ranging... I loved every minute of it."
Stats

What's the 'Smartest' City in America - Based on Tech Jobs, Connectivity, and Sustainability? (newsweek.com) 66

Seattle is the smartest city in America, with Miami and then Austin close behind. That's according to a promotional study from smart-building tools company ProptechOS. Newsweek reports: The evaluation of tech infrastructure and connectivity was based on several factors, including the number of free Wi-Fi hot spots, the quantity and density of AI and IoT companies, average broadband download speeds, median 5G coverage per network provider, and the number of airports. Meanwhile, green infrastructure was assessed based on air quality, measured by exposure to PM2.5, tiny particles in the air that can harm health. Other factors include 10-year changes in tree coverage, both loss and gain; the number of electric vehicle charging points and their density per 100,000 people; and the number of LEED-certified green buildings. The tech job market was evaluated on the number of tech jobs advertised per 100,000 people.
Seattle came in first after assessing 16 key indicators across connectivity/infrastructure, sustainability, and tech jobs — "boasting 34 artificial intelligence companies and 13 Internet of Things companies per 100,000 residents." In terms of sustainability, Seattle has enhanced its tree coverage by 13,700 hectares from 2010 to 2020 and has established the equivalent of 10 electric vehicle charging points per 100,000 residents. Seattle has edged out last year's top city, Austin, to claim the title of the smartest city in the U.S., with an overall score of 75.7 out of 100. Miami wasn't far behind, achieving a score of 75.4. However, Austin still came out on top for smart city infrastructure, scoring 86.2 out of 100. This is attributed to its high broadband download speed of 275.60 Mbps — well above the U.S. average of 217.14 Mbps — and its concentration of 337 AI companies, or 35 per 100,000 people.
You can see the full listings here. The article notes that the same study also ranked Paris as the smartest city in Europe — slipping ahead of London — thanks to Paris's 99.5% 5G coverage, plus "the second-highest number of AI companies in Europe and the third-highest number of free Wi-Fi hot spots. Paris is also recognized for its traffic management systems, which monitor noise levels and air quality."

Newsweek also shares this statement from ProptechOS's founder/chief ecosystem officer. "Advancements in smart cities and future technologies such as next-generation wireless communication and AI are expected to reduce environmental impacts and enhance living standards."

In April CNBC reported on an alternate list of the smartest cities in the world, created from research by the World Competitiveness Center. It defined smart cities as "an urban setting that applies technology to enhance the benefits and diminish the shortcomings of urbanization for its citizens." And CNBC reported that based on the list, "Smart cities in Europe and Asia are gaining ground globally while North American cities have fallen down the ranks... Of the top 10 smart cities on the list, seven were in Europe." Here are the top 10 smart cities, according to the 2024 Smart City Index.

- Zurich, Switzerland
- Oslo, Norway
- Canberra, Australia
- Geneva, Switzerland
- Singapore
- Copenhagen, Denmark
- Lausanne, Switzerland
- London, England
- Helsinki, Finland
- Abu Dhabi, United Arab Emirates

Notably, for the first time since the index's inception in 2019, there is an absence of North American cities in the top 20... The highest ranking U.S. city this year is New York City which ranked 34th, followed by Boston at 36th and Washington DC, coming in at 50th place.

Security

How Chinese Attackers Breached an ISP to Poison Insecure Software Updates with Malware (bleepingcomputer.com) 11

An anonymous reader shared this report from BleepingComputer: A Chinese hacking group tracked as StormBamboo has compromised an undisclosed internet service provider (ISP) to poison automatic software updates with malware. Also tracked as Evasive Panda, Daggerfly, and StormCloud, this cyber-espionage group has been active since at least 2012, targeting organizations across mainland China, Hong Kong, Macao, Nigeria, and various Southeast and East Asian countries.

On Friday, Volexity threat researchers revealed that the Chinese cyber-espionage gang had exploited insecure HTTP software update mechanisms that didn't validate digital signatures to deploy malware payloads on victims' Windows and macOS devices... To do that, the attackers intercepted and modified victims' DNS requests and poisoned them with malicious IP addresses. This delivered the malware to the targets' systems from StormBamboo's command-and-control servers without requiring user interaction.

Volexity's blog post says they observed StormBamboo "targeting multiple software vendors, who use insecure update workflows..." and then "notified and worked with the ISP, who investigated various key devices providing traffic-routing services on their network. As the ISP rebooted and took various components of the network offline, the DNS poisoning immediately stopped."

BleepingComputer notes that "âAfter compromising the target's systems, the threat actors installed a malicious Google Chrome extension (ReloadText), which allowed them to harvest and steal browser cookies and mail data."
EU

Initiative Aims To Require EU Game Publishers To Make Retired Games Playable (pcgamer.com) 91

A proposed European Union law seeks to ensure that video games sold or licensed in the EU remain playable even if servers are shut down or studios close. The law would require publishers of sold and free-to-play games with microtransactions to provide resources to keep games functional, such as allowing players to host their own servers. Through a process called the "European Citizens Initiative," the petition needs one million signatures just to have a chance at becoming law. PC Gamer reports: "An increasing number of publishers are selling videogames that are required to connect through the internet to the game publisher, or 'phone home' to function," the petition reads. "While this is not a problem in itself, when support ends for these types of games, very often publishers simply sever the connection necessary for the game to function, proceed to destroy all working copies of the game, and implement extensive measures to prevent the customer from repairing the game in any way."

Understanding that developers and publishers can't support games forever, the initiative would expect "the publisher to provide resources for the said videogame once they discontinue it while leaving it in a reasonably functional (playable) state." That means giving players the tools to host the game on their own servers, for example, and removing the requirement for games to connect to the publisher's (defunct) servers in order to be played. This is what the developer behind Knockout City did when it pulled the plug on the game's official servers.

Not only does this initiative apply to games that are sold, but includes free to play games that have microtransactions for assets (like skins) or other paid-for features. The thought is, if you purchase an item in a free game, you should have the right to continue to use it indefinitely -- which means keeping that free game playable in some form. It's important to note that even a million signatures doesn't mean an automatic win, just that it'll go forward to the European Union as a proposal to become a law.

Japan

Japan Mandates App To Ensure National ID Cards Aren't Forged (theregister.com) 34

The Japanese government has released details of an app that verifies the legitimacy of its troubled My Number Card -- a national identity document. From a report: Beginning in 2015, every resident of Japan was assigned a 12 digit My Number that paved the way for linking social security, taxation, disaster response and other government services to both the number itself and a smartcard. The plan was to banish bureaucracy and improve public service delivery -- but that didn't happen.

My Number Card ran afoul of data breaches, reports of malfunctioning card readers, and database snafus that linked cards to other citizens' bank accounts. Public trust in the scheme fell, and adoption stalled. Now, according to Japan's Digital Ministry, counterfeit cards are proliferating to help miscreant purchase goods -- particularly mobile phones -- under fake identities. Digital minister Taro Kono yesterday presented his solution to the counterfeits: a soon to be mandatory app that confirms the legitimacy of the card. The app uses the camera on a smartphone to read information printed on the card -- like date of birth and name. It compares those details to what it reads from info stored in the smartcard's resident chip, and confirms the data match without the user ever needing to enter their four-digit PIN.

Games

The Best ROM Hack Website is Shutting Down After Nearly 20 Years (polygon.com) 16

ROMhacking.net, a prominent platform for fan translations and modifications of classic games, is shutting down after nearly two decades of operation. The site's administrator, who goes by the name Nightcrawler, said the website will remain accessible in a read-only format, but all new submissions have been halted and the site's extensive database has been transferred to the Internet Archive for preservation.

ROMhacking.net has long served as a crucial resource for gaming enthusiasts, according to Polygon, hosting a vast array of fan-made translations, bug fixes, and modifications for classic titles, many of which never received official localizations outside their countries of origin. The site's contributions to the gaming community include fan translations of Japanese-exclusive titles and even patches for long-standing bugs in popular games like Super Mario 64. Nightcrawler said the website ran into challenges including in managing the site's exponential growth and increasing copyright pressures, things that contributed to the decision to winding down operations.
Communications

US Court Blocks Biden Administration Net Neutrality Rules (ksl.com) 103

schwit1 writes: A U.S. appeals court on Thursday blocked the Federal Communications Commission's reinstatement of landmark net neutrality rules, saying broadband providers are likely to succeed in a legal challenge. The agency voted in April along party lines to reassume regulatory oversight of broadband internet and reinstate open internet rules adopted in 2015 that were rescinded under then-President Donald Trump.

The Sixth Circuit U.S. Court of Appeals, which had temporarily delayed the rules, said on Thursday it would temporarily block net neutrality rules and scheduled oral arguments for late October or early November on the issue, dealing a serious blow to President Joe Biden's effort to reinstate the rules. "The final rule implicates a major question, and the commission has failed to satisfy the high bar for imposing such regulations," the court wrote. "Net neutrality is likely a major question requiring clear congressional authorization."

Technology

Rediff, Once an Internet Pioneer in India, Sells Majority Stake for $3M (techcrunch.com) 2

An anonymous reader shares a report: Payments infrastructure firm Infibeam Avenues has acquired a majority 54% stake in Rediff.com for up to $3 million, a dramatic twist of fate for the 28-year-old business that was the first Indian internet firm to list on Nasdaq back in the year 2000.

Founded in 1996, Rediff rode the initial dot-com wave to become one of India's leading web portals, offering email, news, and e-commerce services. At its peak, Rediff was valued at over $600 million on the Nasdaq stock exchange. It also drove some of the largest traffic in India, climbing at least up to the 12th spot, according to brokerage house Jefferies.

Slashdot Top Deals