La NASA y Bosch han enviado un sistema de control acústico dotado de delicados micrófonos capaces de oÃr frecuencias inaudibles para los humanos y que orbitará alrededor de la estructura. Su objetivo será monitorizar ruidos que puedan indicar amenazas como fugas y anomalÃas en los sistemas de a bordo
Source: MIT
It was the one of the best phishing emails we’ve seen… that wasn’t.
Phishing remains one of the most popular attack choices for scammers. Phishing emails are designed to impersonate companies or executives to trick users into turning over sensitive information, typically usernames and passwords, so that scammers can log into online services and steal money or data. But detecting and preventing phishing isn’t just a user problem — it’s a corporate problem too, especially when companies don’t take basic cybersecurity precautions and best practices to hinder scammers from ever getting into a user’s inbox.
Enter TriNet, a human resources giant, which this week became the poster child for how how to make a genuine email to its customers look inadvertently as suspicious as it gets.
Remote employees at companies across the U.S. who rely on TriNet for access to outsourced human resources, like their healthcare benefits and workplace policies, were sent an email this week as part of an effort to keep employees “informed and up-to-date on the labor and employment laws that affect you.”
Workers at one Los Angeles-based health startup that manages its employee benefits through TriNet all got the email at the same time. But one employee wasn’t convinced it was a real email, and forwarded it — and its source code — to TechCrunch.
TriNet is one of the largest outsourced human resources providers in the United States, primarily for small-to-medium-sized businesses that may not have the funding to hire dedicated human resources staff. And this time of year is critical for companies that rely on TriNet, since health insurance plans are entering open enrollment and tax season is only a few weeks away. With benefit changes to consider, it’s not unusual for employees to receive a rash of TriNet-related emails towards the end of the year.
But this email didn’t look right. In fact when we looked under the hood of the email, everything about it looked suspicious.
This is the email that remote workers received. TriNet said the use of an Imgur-hosted image in the email was “mistakenly” used. (Image: TechCrunch/supplied)
We looked at the source code of the email, including its headers. These email headers are like an envelope — they say where an email came from, who it’s addressed to, how it was routed, and if there were any complications along the way, such as being marked as spam.
There were more red flags than we could count.
Chief among the issues were that the TriNet logo in the email was hosted on Imgur, a free image-hosting and meme-sharing site, and not the company’s own website. That’s a common technique among phishing attackers — they use Imgur to host images they use in their spam emails to avoid detection. Since the image was uploaded in July, that logo was viewed more than 70,000 times until we reached out to TriNet, which removed the image, suggesting thousands of TriNet customers had received one of these emails. And, although the email contained a link to a TriNet website, the page that loaded had an entirely different domain with nothing on it to suggest it was a real TriNet-authorized site besides a logo, which if it were a phishing site could’ve been easily spoofed.
Fearing that somehow scammers had sent out a phishing email to potentially thousands of TriNet customers, we reached out to security researcher John Wethington, founder of security firm Condition:Black, to examine the email.
It turns out he was just as convinced as us that the email may have been fake.
“As hackers and self-proclaimed social engineers, we often think that spotting a phishing email is ‘easy’,” said Wethington. “The truth is it’s hard.”
“When we first examined the email every alarm bell was going off. The deeper we dug into it the more confusing things became. We looked at the domain name records, the site’s source code, and even the webpage hashes,” he said.
There was nothing, he said, that gave us “100% confidence” that the site was genuine until we contacted TriNet.
TriNet spokesperson Renee Brotherton confirmed to TechCrunch that the email campaign was legitimate, and that it uses the third-party site “for our compliance ePoster service offering. She added: “The Imgur image you reference is an image of the TriNet logo that Poster Elite mistakenly pointed to and it has since been removed.”
“The email you referenced was sent to all employees who do not go into an employer’s physical workspace to ensure their access to required notices,” said TriNet’s spokesperson.
When reached, Poster Elite also confirmed the email was legitimate.
This is not a phishing site, but it sure looks like one. (Image: TechCrunch)
How did TriNet get this so wrong? This culmination of errors had some who received the email worried that their information might have been breached.
“When companies communicate with customers in ways that are similar to the way scammers communicate, it can weaken their customer’s ability over time to spot and shut down security threats in future communications,” said Rachel Tobac, a hacker, social engineer, and founder of SocialProof Security.
Tobac pointed to two examples of where TriNet got it wrong. First, it’s easy for hackers to send spoofed emails to TriNet’s workers because TriNet’s DMARC policy on its domain name is not enforced.
Second, the inconsistent use of domain names is confusing for the user. TriNet confirmed that it pointed the link in the email — posters.trinet.com — to eposterservice.com, which hosts the company’s compliance posters for remote workers. TriNet thought that forwarding the domain would suffice, but instead we thought someone had hijacked TriNet’s domain name settings — a type of attack that’s on the increase, though primarily carried out by state actors. TriNet is a huge target — it stores workers’ benefits, pay details, tax information and more. We had assumed the worst.
“This is similar to an issue we see with banking fraud phone communications,” said Tobac. “Spammers call bank customers, spoof the bank’s number, and pose as the bank to get customers to give account details to ‘verify their account’ before ‘hearing about the fraud the bank noticed on their account — which, of course, is an attack,” she said.
“This is surprisingly exactly what the legitimate phone call sounds like when the bank is truly calling to verify fraudulent transactions,” Tobac said.
Wethington noted that other suspicious indicators were all techniques used by scammers in phishing attacks. The posters.trinet.com subdomain used in the email was only set up a few weeks ago, and the eposterservice.com domain it pointed to used an HTTPS certificate that wasn’t associated with either TriNet or Poster Elite.
These all point to one overarching problem. TriNet may have sent out a legitimate email but everything about it looked problematic.
On one hand, being vigilant about incoming emails is a good thing. And while it’s a cat-and-mouse game to evade phishing attacks, there are things that companies can do to proactively protect themselves and their customers from scams and phishing attacks. And yet TriNet failed in almost every way by opening itself up to attacks by not employing these basic security measures.
“It’s hard to distinguish the good from the bad even with proper training, and when in doubt I recommend you throw it out,” said Wethington.
Source: TechCrunch
With Black Friday just days away, here are the best deals you can get on Xbox One: Consoles with hot new games or a spare controller, and great games too.
Source: CNET
After years of centralizing internet control, Iran pulled the plug on connectivity for nearly all of its citizens.
Source: Wired
There are fewer than ever, but here are your options.
Source: CNET
Something strange is afoot in the world of cryptocurrencies. For the first time since Satoshi dropped Bitcoin on us like a benevolent bomb, this painfully new, highly bizarre field has become … well … boring. The true believers will tell you that great strides are being made, and the mainstream breakthrough is just around the corner, but they’ve been saying that for long enough that it’s beginning to seem reasonable to start wondering if these wolves were ever real.
I know, I know, it seems especially weird to be saying this at the same time that the President of China and CEO of Facebook have both become blockchain advocates. But China’s cryptocurrency, if it happens, will be a panopticoin, a tool to centralize monetary control even more firmly in the hands of the Communist Party, nothing like the decentralized censorship-resistant programmable money that the crypto community is theoretically all about; and Facebook’s, while making technical progress, keeps losing partners and gaining enemies.
The crypto community is currently all agog about “DeFi,” for decentralized finance, a movement which basically expands cryptocurrencies from “censorship-resistant money” to “censorship-resistant financial instruments,” such as collateralized loans and interest-bearing investments, along with “staking” (not really DeFi, but often treated as it.) Inside the crypto world, this seems like a revolution which will one day replace Wall Street. Outside the crypto world, it seems … a little like monks debating how many angels can dance on the end of a pin, one that no one is actually using and nobody outside the monastery cares about.
It’s easy to get the impression the cryptocurrency world has sacrificed technical engineering in favor of financial engineering. It’s easy to see them as having abandoned “banking the unbanked,” the alleged initial noble goal of many, to “offering sophisticated financial instruments to the unbanked,” long before any of those famous unbanked have actually been, you know, banked. And I’m sorry to report that you wouldn’t be entirely wrong.
But there are real technical advances being made. It’s just that they’re mostly slow and behind the scenes, and in the interim, the community’s “MOPs and sociopaths” have seized on DeFi.
There is some visible progress. ZCash is making apparent breakthroughs in important, foundational cryptographic research. Tezos continues to upgrade its governance algorithms — modify its code constitution, basically — successfully.
On the application layer, I’m interested in Vault12, which uses “friends and family to safeguard crypto assets” — basically, instead of entrusting the secret keys which control your cryptocurrencies to a third party like an exchange, something not particularly different from traditional banking, you protect them among people you trust, so that some number of them can collaborate with you to recover your keys if they’re lost, using a cryptographic protocol known as Shamir’s Secret Sharing. Luminaries such as Vitalik Buterin and Christopher Allen have argued for “social key recovery” for some time, and it’s interesting to see it offered by a slick new Valley startup.
But a lot of what’s happening is more fundamental, in search of the ability to support many more transactions than today’s blockchains. The entire foundation of today’s second-leading cryptocurrency, Ethereum, is being torn apart and replaced wholesale, in search of “Ethereum 2.0.” Bitcoin remains much more stable and conservative, but a whole new story is being added to its foundations, the Lightning Network. Both make me uneasy. A fundamental rewrite is always worrying. Lightning may scale, but it is if anything even more user-hostile than Bitcoin, basically the cryptocurrency equivalent of a hard-to-use prepaid credit card. Still, the permissionless equivalent of prepaid credit cards would be good for the unbanked that everyone’s clearly so worried about, right?
I’m also uneasy because almost all blockchain scaling solutions — Lightning, sharding, Plasma, optimistic rollup, etc. — turn fundamental blockchain security from something relatively passive (check the hashes and use the chain with the most computational power) to something active (“watchtowers,” “fraud proofs.”) This seems to me to increase the security attack surface a lot.
All these issues may yet be solved. Sure. But at the same time, it feels like dissonance between the attitude inside the crypto bubble and that of mundanes may never have been greater. Meanwhile, the dark spectre of Tether hangs over the entire industry. OK, circumstantial evidence is inadmissible for good reason … but there sure is a lot of it.
I’ve argued before that “ongoing associations with a cloud of crazy scandal and hangers-on snake-oil salespeople — all of which would be catastrophic signs for, say, a traditional new startup — can actually be indicators of the strength, not weakness” of the cryptocurrency movement …
…but at some point, your religion — or “brain virus,” as Naval Ravikant once called cryptocurrencies — has to begin to appeal to people who do not actually live on your compound, or else you are going to be remain a cult and wither out. When is that going to happen? Is that going to happen? The answer remains no clearer than it was five years ago.
Source: TechCrunch
See what deals you can get at Target right now, as well as the best deals coming later this month. Spoiler alert: You can get the Apple Watch for $170, and an iPad 10.2 for $250.
Source: CNET
It’s the season for finding great game bundles. Here’s what we found for the Xbox One, PS4 and the Nintendo Switch.
Source: CNET
Sony is pulling out all the stops with an amazing trio of PS4 bundles for Black Friday.
Source: CNET
Hello and welcome back to TechCrunch’s China Roundup, a digest of recent events shaping the Chinese tech landscape and what they mean to people in the rest of the world. The earnings season is here. This week, long-time archrivals in the Chinese internet battlefield — Alibaba and Tencent — made some big revelations about their future. First off, let’s look at Alibaba’s long-awaited secondary listing and annual shopping bonanza.
It’s that time of year. On November 11, Alibaba announced it generated $38.4 billion worth of gross merchandise value during the annual Single’s Day shopping festival, otherwise known as Double 11. It smashed the record and grabbed local headlines again, but the event means little other than a big publicity win for the company and showcasing the art of drumming up sales.
GMV is often used interchangeably with sales in e-commerce. That’s problematic because the number takes into account all transactions, including refunded items, and it’s by no means reflective of a company’s actual revenue. There are numerous ways to juice the figure, too, as I wrote last year. Presales began days in advance, incentives were doled out to spur last-minute orders and no refunds could be processed until November 12.
Even Jiang Fan, the boss of Alibaba’s e-commerce business and the youngest among Alibaba’s 38 most important decision-makers, downplayed the number: “I never worry about transaction volumes. Numbers don’t matter. What’s most important is making Single’s Day fun and turning it into a real festival.”
Indeed, Alibaba put together another year of what’s equivalent to the Super Bowl halftime show. Taylor Swift and other international big names graced the stage as the evening gala was live-streamed and watched by millions across the globe.
Alibaba is going ahead with its secondary listing in Hong Kong on the heels of reports that it could delay the sale due to ongoing political unrest in the city-state. The company is cash-rich, but listing closer to its customers can potentially ease some of the pressure arising from a new era of volatile U.S.-China relationships.
Alibaba is issuing 500 million new shares with an additional over-allotment option of 75 million shares for international underwriters, it said in a company blog. Reports have put the size of its offering between $10 billion and $15 billion, down from the earlier rumored $20 billion.
The giant has long expressed it intends to come home. In 2014, the e-commerce behemoth missed out on Hong Kong because the local exchange didn’t allow dual-class structures, a type of organization common in technology companies that grants different voting rights for different stocks. The giant instead went public in New York and raised the largest initial public offering in history at $25 billion.
“When Alibaba Group went public in 2014, we missed out on Hong Kong with regret. Hong Kong is one of the world’s most important financial centers. Over the last few years, there have been many encouraging reforms in Hong Kong’s capital market. During this time of ongoing change, we continue to believe that the future of Hong Kong remains bright. We hope we can contribute, in our small way, and participate in the future of Hong Kong,” said chairman and chief executive Daniel Zhang in a statement.
Missing out on Alibaba had also been a source of remorse for the Stock Exchange of Hong Kong. Charles Li, chief executive of the HKEX, admitted that losing Alibaba to New York had compelled the bourse to reform. The HKEX has since added dual-class shares and attracted Chinese tech upstarts such as smartphone maker Xiaomi and local services platform Meituan Dianping.
Content and social networks have been the major revenue drivers for Tencent since its early years, but new initiatives are starting to gain ground. In the third quarter ended September 30, Tencent’s “fintech and business services” unit, which includes its payments and cloud services, became the firm’s second-largest sales avenue trailing the long-time cash cow of value-added services, essentially virtual items sold in games and social networks.
Payments, in particular, accounted for much of the quarterly growth thanks to increased daily active consumers and number of transactions per user. That’s good news for the company, which said back in 2016 that financial services would be its new focus (in Chinese) alongside content and social. The need to diversify became more salient in recent times as Tencent faces stricter government controls over the gaming sector and intense rivalry from ByteDance, the new darling of advertisers and owner of TikTok and Douyin.
Tencent also broke out revenue for cloud services for the first time. The unit grew 80% year-on-year to rake in 4.7 billion yuan ($670 million) and received a great push as the company pivoted to serve more industrial players and enterprises. Alibaba’s cloud business still leads the Chinese market by a huge margin, with revenue topping $1.3 billion during the September quarter.
Luckin Coffee, the Chinese startup that began as a Starbucks challenger, is starting to look more like a convenient store chain with delivery capacities as it continues to increase store density (a combination of seated cafes, pickup stands and delivery kitchens) and widen product offerings to include a growing snack selection. Though bottom-line loss continued in the quarter, store-level operating profit swung to $26.1 million from a loss in the prior-year quarter. 30 million customers have purchased from Luckin, marking an increase of 413.4% from 6 million a year ago.
Minecraft is on the brink of 300 million registered users in China, its local publisher Netease announced at an event this week. That’s a lot of players, but not totally unreasonable given the game is free-to-play in the country with in-game purchases, so users can easily own multiple accounts. Outside China, the game has sold over 180 million paid copies, according to gaming analyst Daniel Ahmed from Niko Partners.
Xiaomi founder Lei Jun is returning a huge favor by backing a long-time friend. Xpeng Motors, the Chinese electric vehicle startup financed by Alibaba and Foxconn, has received $400 million in capital from a group of backers who weren’t identified except Xiaomi, which became its strategic investor. The marriage would allow Xpeng cars to tap Xiaomi’s growing ecosystem of smart devices, but the relationship dates further back. Lei was an early investor in UCWeb, a browser company founded by He and acquired by Alibaba in 2014. A day after Xiaomi’s began trading in Hong Kong in mid-2018, He wrote on his WeChat feed that he had bought $100 million worth of Xiaomi shares (in Chinese) in support of his old friend.
Source: TechCrunch