Author name: Kris Guyer

missouri-ag’s-legal-war-against-media-matters-shot-down-by-federal-judge

Missouri AG’s legal war against Media Matters shot down by federal judge

media matters x, missouri attorney general, Policy / /

Stop right there —

Judge: Missouri AG’s actions chill speech about extremist content on Musk’s X.

–

Missouri Attorney General Andrew Bailey adjusts his necktie while in a Congressional hearing room

Enlarge / Missouri Attorney General Andrew Bailey arrives to testify at House Homeland Security Committee hearing on Wednesday, January 10, 2024.

Getty Images | Bill Clark

A federal judge ordered Missouri’s attorney general to halt an investigation into Media Matters for America, a nonprofit journalism organization that earned Elon Musk’s wrath when it published an article showing that Musk’s X platform placed advertisements next to pro-Nazi posts.

In March, Missouri AG Andrew Bailey issued an investigative demand seeking names and addresses of all Media Matters donors who live in Missouri and a range of internal communications and documents regarding the group’s research on Musk and X. Bailey also filed a lawsuit asking Cole County Circuit Court for an order to enforce the investigative demand.

Media Matters countered by suing Bailey in US District Court for the District of Columbia. Last week, US District Judge Amit Mehta granted a preliminary injunction that prohibits Bailey from enforcing the civil investigative demand and from pursuing the related lawsuit.

Mehta had issued a similar order against Texas Attorney General Ken Paxton a few months earlier. Mehta filed a memorandum opinion on August 23 describing the reasons for granting Media Matters’ request for an injunction against Bailey.

Media Matters demonstrated a likelihood of success in its claim that Bailey took retaliatory actions designed to deter speech, Mehta wrote:

The court already has held that Defendant Paxton’s announcement of an investigation and issuance of a CID [Civil Investigative Demand] demanding records relating to Media Matters’ organization, funding, and journalism would sufficiently deter a news organization or journalist “of ordinary firmness” from speaking again about X-related matters. Defendant Bailey has gone one step further. He has filed suit not only to enforce the Missouri CID, but he has asked a state court to sanction Media Matters with a civil penalty. Such action chills speech.

X did not deny basic premise of article

Media Matters has also “likely shown that their reporting was not defamatory and therefore was protected speech,” Mehta wrote. In its public response to the November 2023 Media Matters article, “X did not deny that advertising in fact had appeared next to the extremist posts on the day in question,” Mehta wrote. He continued:

X stated that it had served “less than 50 total ad impressions” next to the “organic content featured in the Media Matters article” (a mere fraction of the 5.5 billion ad impressions served that day), and it conceded that [Media Matters reporter Eric] Hananoki and one other person had seen advertisements of two of the brands identified in the article next to the extremist content. X called these “contrived experiences,” but did not deny the basic premise of the article: that X’s platform was delivering ads of major brands next to extremist content. Many other media outlets, as recently as April 2024, have published similar findings. These other stories corroborate Hananoki’s reporting and Plaintiffs’ belief in its accuracy.

Mehta’s ruling said that Bailey made it clear that “the true purpose of his investigation” was political. “Revealingly, Defendant Bailey expressly tied the investigation to the upcoming election” during an online interview with Donald Trump Jr., Mehta wrote.

“This is absolutely a new front in the fight for the war for free speech. This investigation is really critical and again especially as we move into an election cycle in 2024,” Bailey said during the interview.

Bailey’s lawsuit in Cole County Circuit Court claimed that “Media Matters has used fraud to solicit donations from Missourians in order to trick advertisers into removing their advertisements from X, formerly Twitter, one of the last platforms dedicated to free speech in America.” Bailey hasn’t provided good evidence for this claim, Mehta wrote.

Missouri Assistant Attorney General Steven Reed “never identifies what suspected fraudulent statements or omissions Media Matters made to Missourians for the purpose of soliciting donations,” Mehta wrote. “If he means to say that Media Matters’ defamatory reporting itself is the fraud, he nowhere links that content to Media Matters’ fundraising efforts. He does not claim, for example, that Media Matters used its reporting on X to solicit donations. In fact, the webpage on which the November 16 Article appeared made no express fundraising appeal. Nor did it include a donation link. Defamation is not fraud. It is thus likely that the false reporting-as-fraudulent fundraising justification for the investigation is pretext for retaliation.”

Bailey can appeal Mehta’s order. If the order stands, the preliminary injunction would stay in force until a final judgment in Media Matters’ case against Bailey.

Missouri AG’s legal war against Media Matters shot down by federal judge Read More »

natgeo’s-cursed-gold-documents-rise-and-fall-of-notorious-1980s-treasure-hunter

NatGeo’s Cursed Gold documents rise and fall of notorious 1980s treasure hunter

culture, Disney Plus, documentaries, maritime archaeology, National Geographic, Science, science documentaries, shipwrecks, streaming television / /

From rags to riches—to jail —

Thompson’s expedition discovered wreck of the SS Central America, aka the “Ship of Gold.”

–

gold coins and gold bars scattered on the ocean floor

Enlarge / Cursed Gold: A Shipwreck Scandal documents the spectacular rise and fall of treasure hunter Tommy Thompson.

Recovery Limited Partnership Liquidating Trust

Many people dream of finding lost or hidden treasure, but sometimes realizing that dream turns out to be a nightmare. Such was the case for Tommy Thompson, an American treasure hunter who famously beat the odds to discover the location of the SS Central America shipwreck in 1988. It had been dubbed the “Ship of Gold” since it sank in 1857 laden with 30,000 pounds of gold bars and coins—collectively worth enough money to have some impact on the Panic of 1857 financial crisis.

Thompson and his team recovered significant amounts of gold and artifacts to great fanfare, with experts at the time suggesting the trove could be worth as much as $400 million. The euphoria proved short-lived. Thirty-nine insurance companies filed lawsuits, claiming the gold was rightfully theirs since the companies had paid damages for the lost gold back in the mid-19th century. Thompson eventually prevailed in 1996, when courts awarded him and his discovery team 92 percent of the gold they’d recovered.

But actually realizing profits from the gold proved challenging; In the end, Thompson sold the gold for just $52 million, almost all of which went to pay off the massive debt the project had accumulated over the ensuing years. So naturally, there were more lawsuits, this time from the investors who had financed Thompson’s expedition, accusing him of fraud. Thompson didn’t help his case when he went on the run in 2012 with his assistant, living off some $4 million in assets stashed in an offshore account.

Thompson was finally captured by US marshals in 2015 to face his investors in court. A jury awarded the investors substantial compensatory damages, and the court ordered Thompson to hand over 500 commemorative gold coins that had been minted out of some of the Central America gold to meet that judgment. Thompson claimed he had forgotten where he’d stashed them and was jailed for contempt of court until the coins had been recovered and handed over. He’s still in prison as of this writing, and the gold coins have yet to be found.

It’s quite a tale, so small wonder that National Geographic has made a riveting three-part documentary about Thompson’s spectacular rise and fall: Cursed Gold: A Shipwreck Scandal, based on the 1998 book by Gary Kinder entitled Ship of Gold in the Deep Blue Sea. Cursed Gold director Sam Benstead read Kinder’s book and was instantly hooked on the story. “Not only was it a hugely exciting story with many twists and turns, but it was also an emotional story, which left you pulling for Tommy and his crew,” he told Ars. “Tommy came through as an extraordinary character: eccentric, brilliant, someone willing to try things no one else had. When I discovered all the things that had happened after the book, I knew it was a story I had to tell.”

Ship of Gold

  • Engraving by J. Childs of the 1857 sinking of the SS Central America.

    Public domain/National Maritime Museum, London

  • Sonar expert Mike Williamson hard at work during production of Cursed Gold.

    National Geographic

  • John Moore is a lead designer of deep-sea robot Nemo.

    National Geographic

  • Dramatic reconstruction of crew members looking at monitors in the ship’s control room.

    National Geographic

  • Dramatic reconstruction of a crew member looking at computer screens in the ship’s control room.

    National Geographic

  • Dramatic reconstruction of sonar operator John Lettow navigating Nemo from the ship’s control room.

    National Geographic

  • Dramatic reconstruction showing Nemo descending to the seabed off the coast of North Carolina.

    National Geographic

  • Gold bars and coins on the bottom of the sea bed off the coast of North Carolina.

    Recovery Limited Partnership Liquidating Trust

  • Robotic machine recovers gold bars on the bottom of the seabed.

    Recovery Limited Partnership Liquidating Trust

  • Crew members ogle gold bars on deck after being brought up from the sea floor.

    Recovery Limited Partnership Liquidating Trust

  • Crew members looking at gold bars retrieved from the ocean floor.

    Recovery Limited Partnership Liquidating Trust

  • Journalist Dylan Taylor-Lehman looks through case files.

    National Geographic

  • Veteran US Marshal Mark Stroh lifting box of files in a dramatic reconstruction.

    National Geographic

  • Lawyer Quintin Lindsmith works on case files.

    Gold bars and coins on the bottom of the sea bed off the cost of North Carolina.

  • US Marshal Christopher Crotty waits in his car in a dramatic reconstruction.

    National Geographic

  • A case displaying the missing 500 commemorative gold coins.

    Recovery Limited Partnership Liquidating Trust

A lot has happened to Thompson since Kinder’s book was published in 1998. Benstead and his production team combed through more than 600 hours of archival footage from the original expedition, as well as over 700 pages of court transcripts. “We also consulted multiple figures who we didn’t film with but who helped inform the story,” said Benstead. “In the editing process, National Geographic’s research department, together with our team, worked diligently to do their best to bottom out every fact, every claim. In a story that is so contested, this really helped us feel confident in standing behind the resulting films.”

“One of the main challenges was in condensing an incredibly complex 30-year saga into three films,” Benstead continued. “There were many legal cases and side stories that we had to exclude or could only touch on. And there were areas of the story that were strongly disputed by different sides. Sometimes we had to make choices that didn’t fully satisfy either camp, but we did our best to remain fair to the plurality of viewpoints, while also telling a powerful story.”

The director remains in awe of the original discovery, however badly the adventure turned out. “For the guys on the boat, almost without exception, this period was one of the best times of their lives,” he said. “It was a privilege to relive their struggles and final triumph in finding the gold. I still find it remarkable that they found the SS Central America in almost two miles of water with the resources they had in the 1980s.”

The experience also instilled “a real respect for the people who shared their story with us, especially Tommy’s family members, who have had so much written about them over the years,” said Benstead. “They didn’t trust us easily, and I feel very fortunate that they took part. Whenever people share the deepest, most affecting parts of their lives with you, you walk away carrying a big responsibility. I hope that they feel we have done their side of the story justice.”

Did Benstead come to his own conclusions about whether or not Thompson committed fraud? “Different people have different viewpoints on Tommy, even amongst those on the boat, investors, lawyers, and law enforcement,” he said. “We felt it was very important to allow the series to reflect this diversity and to allow the audience to make up their own mind. My own view is that Tommy isn’t a con man, and to be in prison for approaching nine years for contempt of court feels like a sad reflection on the US justice system. But it is also the case that, albeit under immense pressure, he made certain choices (like going on the run), which contributed to his own downfall. I hope that in the coming years his achievements, which have been obscured by the legal circus, are given the recognition that they deserve.”

Cursed Gold: A Shipwreck Scandal is now streaming on Disney+ and Hulu.

NatGeo’s Cursed Gold documents rise and fall of notorious 1980s treasure hunter Read More »

us-grid-adds-batteries-at-10x-the-rate-of-natural-gas-in-first-half-of-2024

US grid adds batteries at 10x the rate of natural gas in first half of 2024

batteries, Energy, green, natural gas, nuclear, renewable energy, Science, solar, Sustainability, Wind / /

In transition —

By year’s end, 96 percent of the US’s grid additions won’t add carbon to the atmosphere.

–

US grid adds batteries at 10x the rate of natural gas in first half of 2024

While solar power is growing at an extremely rapid clip, in absolute terms, the use of natural gas for electricity production has continued to outpace renewables. But that looks set to change in 2024, as the US Energy Information Agency (EIA) has run the numbers on the first half of the year and found that wind, solar, and batteries were each installed at a pace that dwarfs new natural gas generators. And the gap is expected to get dramatically larger before the year is over.

Solar, batteries booming

According to the EIA’s numbers, about 20 GW of new capacity was added in the first half of this year, and solar accounts for 60 percent of it. Over a third of the solar additions occurred in just two states, Texas and Florida. There were two projects that went live that were rated at over 600 MW of capacity, one in Texas, the other in Nevada.

Next up is batteries: The US saw 4.2 additional gigawatts of battery capacity during this period, meaning over 20 percent of the total new capacity. (Batteries are treated as the equivalent of a generating source by the EIA since they can dispatch electricity to the grid on demand, even if they can’t do so continuously.) Texas and California alone accounted for over 60 percent of these additions; throw in Arizona and Nevada, and you’re at 93 percent of the installed capacity.

The clear pattern here is that batteries are going where the solar is, allowing the power generated during the peak of the day to be used to meet demand after the sun sets. This will help existing solar plants avoid curtailing power production during the lower-demand periods in the spring and fall. In turn, this will improve the economic case for installing additional solar in states where its production can already regularly exceed demand.

Wind power, by contrast, is running at a more sedate pace, with only 2.5 GW of new capacity during the first six months of 2024. And for likely the last time this decade, additional nuclear power was placed on the grid, at the fourth 1.1 GW reactor (and second recent build) at the Vogtle site in Georgia. The only other additions came from natural gas-powered facilities, but these totaled just 400 MW, or just 2 percent of the total of new capacity.

Wind, solar, and batteries are the key contributors to new capacity in 2024.

Enlarge / Wind, solar, and batteries are the key contributors to new capacity in 2024.

The EIA has also projected capacity additions out to the end of 2024 based on what’s in the works, and the overall shape of things doesn’t change much. However, the pace of installation goes up as developers rush to get their project operational within the current tax year. The EIA expects a bit over 60 GW of new capacity to be installed by the end of the year, with 37 GW of that coming in the form of solar power. Battery growth continues at a torrid pace, with 15 GW expected, or roughly a quarter of the total capacity additions for the year.

Wind will account for 7.1 GW of new capacity, and natural gas 2.6 GW. Throw in the contribution from nuclear, and 96 percent of the capacity additions of 2024 are expected to operate without any carbon emissions. Even if you choose to ignore the battery additions, the fraction of carbon-emitting capacity added remains extremely small, at only 6 percent.

Gradual shifts on the grid

Obviously, these numbers represent the peak production of these sources. Over a year, solar produces at about 25 percent of its rated capacity in the US, and wind at about 35 percent. The former number will likely decrease over time as solar becomes inexpensive enough to make economic sense in places that don’t receive as much sunshine. By contrast, wind’s capacity factor may increase as more offshore wind farms get completed. For natural gas, many of the newer plants are being designed to operate erratically so that they can provide power when renewables are under-producing.

A clearer sense of what’s happening comes from looking at the generating sources that are being retired. The US saw 5.1 GW of capacity drop off the grid in the first half of 2024, and aside from a 0.2 GW of “other,” all of it was fossil fuel-powered, including 2.1 GW of coal capacity and 2.7 GW of natural gas. The latter includes a large 1.4 GW natural gas plant in Massachusetts.

But total retirements are expected to be just 7.5 GWO this year—less than was retired in the first half of 2023. That’s likely because the US saw electricity use rise by 5 percent in the first half of 2025, based on numbers the EIA released on Friday (note that this link will take you to more recent data a month from now). It’s unclear how much of that was due to weather—a lot of the country saw heat that likely boosted demand for air conditioning—and how much could be accounted for by rising use in data centers and for the electrification of transit and appliances.

That data release includes details on where the US got its electricity during the first half of 2024. The changes aren’t dramatic compared to where they were when we looked at things last month. Still, what has changed over the past month is good news for renewables. In May, wind and solar production were up 8.4 percent compared to the same period the year before. By June, they were up by over 12 percent.

Given the EIA’s expectations for the rest of the year, the key question is likely to be whether the pace of new solar installations is going to be enough to offset the drop in production that will occur as the US shifts to the winter months.

US grid adds batteries at 10x the rate of natural gas in first half of 2024 Read More »

microsoft-to-host-security-summit-after-crowdstrike-disaster

Microsoft to host security summit after CrowdStrike disaster

Crowdstrike, microsoft, Security, syndication, Windows / /

Bugging out —

Redmond wants to improve the resilience of Windows to buggy software.

–

Photo of a Windows BSOD

Microsoft is stepping up its plans to make Windows more resilient to buggy software after a botched CrowdStrike update took down millions of PCs and servers in a global IT outage.

The tech giant has in the past month intensified talks with partners about adapting the security procedures around its operating system to better withstand the kind of software error that crashed 8.5 million Windows devices on July 19.

Critics say that any changes by Microsoft would amount to a concession of shortcomings in Windows’ handling of third-party security software that could have been addressed sooner.

Yet they would also prove controversial among security vendors that would have to make radical changes to their products, and force many Microsoft customers to adapt their software.

Last month’s outages—which are estimated to have caused billions of dollars in damages after grounding thousands of flights and disrupting hospital appointments worldwide—heightened scrutiny from regulators and business leaders over the extent of access that third-party software vendors have to the core, or kernel, of Windows operating systems.

Microsoft will host a summit next month for government representatives and cyber security companies, including CrowdStrike, to “discuss concrete steps we will all take to improve security and resiliency for our joint customers,” Microsoft said on Friday.

The gathering will take place on September 10 at Microsoft’s headquarters near Seattle, it said in a blog post.

Bugs in the kernel can quickly crash an entire operating system, triggering the millions of “blue screens of death” that appeared around the globe after CrowdStrike’s faulty software update was sent out to clients’ devices.

Microsoft told the Financial Times it was considering several options to make its systems more stable and had not ruled out completely blocking access to the Windows kernel—an option some rivals fear would put their software at a disadvantage to the company’s internal security product, Microsoft Defender.

“All of the competitors are concerned that [Microsoft] will use this to prefer their own products over third-party alternatives,” said Ryan Kalember, head of cyber security strategy at Proofpoint.

Microsoft may also demand new testing procedures from cyber security vendors rather than adapting the Windows system itself.

Apple, which was not hit by the outages, blocks all third-party providers from accessing the kernel of its MacOS operating system, forcing them to operate in the more limited “user-mode.”

Microsoft has previously said it could not do the same, after coming to an understanding with the European Commission in 2009 that it would give third parties the same access to its systems as that for Microsoft Defender.

Some experts said, however, that this voluntary commitment to the EU had not tied Microsoft’s hands in the way it claimed, arguing that the company had always been free to make the changes now under consideration.

“These are technical decisions of Microsoft that were not part of [the arrangement],” said Thomas Graf, a partner at Cleary Gottlieb in Brussels who was involved in the case.

“The text [of the understanding] does not require them to give access to the kernel,” added AJ Grotto, a former senior director for cyber security policy at the White House.

Grotto said Microsoft shared some of the blame for the July disruption since the outages would not have been possible without its decision to allow access to the kernel.

Nevertheless, while it might boost a system’s resilience, blocking kernel access could also bring “real trade-offs” for the compatibility with other software that had made Windows so popular among business customers, Forrester analyst Allie Mellen said.

“That would be a fundamental shift for Microsoft’s philosophy and business model,” she added.

Operating exclusively outside the kernel may lower the risk of triggering mass outages but it was also “very limiting” for security vendors and could make their products “less effective” against hackers, Mellen added.

Operating within the kernel gave security companies more information about potential threats and enabled their defensive tools to activate before malware could take hold, she added.

An alternative option could be to replicate the model used by the open-source operating system Linux, which uses a filtering mechanism that creates a segregated environment within the kernel in which software, including cyber defense tools, can run.

But the complexity of overhauling how other security software works with Windows means that any changes will be hard for regulators to police and Microsoft will have strong incentives to favor its own products, rivals said.

It “sounds good on paper, but the devil is in the details,” said Matthew Prince, chief executive of digital services group Cloudflare.

© 2024 The Financial Times Ltd. All rights reserved Not to be redistributed, copied, or modified in any way.

Microsoft to host security summit after CrowdStrike disaster Read More »

after-cybersecurity-lab-wouldn’t-use-av-software,-us-accuses-georgia-tech-of-fraud

After cybersecurity lab wouldn’t use AV software, US accuses Georgia Tech of fraud

Security / /
Photo of Georgia Tech

Georgia Tech

Dr. Emmanouil “Manos” Antonakakis runs a Georgia Tech cybersecurity lab and has attracted millions of dollars in the last few years from the US government for Department of Defense research projects like “Rhamnousia: Attributing Cyber Actors Through Tensor Decomposition and Novel Data Acquisition.”

The government yesterday sued Georgia Tech in federal court, singling out Antonakakis and claiming that neither he nor Georgia Tech followed basic (and required) security protocols for years, knew they were not in compliance with such protocols, and then submitted invoices for their DoD projects anyway. (Read the complaint.) The government claims this is fraud:

At bottom, DoD paid for military technology that Defendants stored in an environment that was not secure from unauthorized disclosure, and Defendants failed to even monitor for breaches so that they and DoD could be alerted if information was compromised. What DoD received for its funds was of diminished or no value, not the benefit of its bargain.

AV hate

Given the nature of his work for DoD, Antonakakis and his lab are required to abide by many sets of security rules, including those outlined in NIST Special Publication 800–171, “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations.”

One of the rules says that machines storing or accessing such “controlled unclassified information” need to have endpoint antivirus software installed. But according to the US government, Antonakakis really, really doesn’t like putting AV detection software on his lab’s machines.

Georgia Tech admins asked him to comply with the requirement, but according to an internal 2019 email, Antonakakis “wasn’t receptive to such a suggestion.” In a follow-up email, Antonakakis himself said that “endpoint [antivirus] agent is a nonstarter.”

According to the government, “Other than Dr. Antonakakis’s opposition, there was nothing preventing the lab from running antivirus protection. Dr. Antonakakis simply did not want to run it.”

The IT director for Antonakakis’ lab was allowed to use other “mitigating measures” instead, such as relying on the school’s firewall for additional security. The IT director said that he thought Georgia Tech ran antivirus scans from its network. However, this “assumption” turned out to be completely wrong; the school’s network “has never provided” antivirus protection and, even if it had, the lab used laptops that were regularly taken outside the network perimeter.

The school realized after some time that the lab was not in compliance with the DoD contract rules, so an administrator decided to “suspend invoicing” on the lab’s contracts so that the school would not be charged with filing false claims.

According to the government, “Within a few days of the invoicing for his contracts being suspended, Dr. Antonakakis relented on his years-long opposition to the installation of antivirus software in the Astrolavos Lab. Georgia Tech’s standard antivirus software was installed throughout the lab.”

But, says the government, the school never acknowledged that it had been out of compliance for some time and that it had filed numerous invoices while noncompliant. In the government’s telling, this is fraud.

After cybersecurity lab wouldn’t use AV software, US accuses Georgia Tech of fraud Read More »

microsoft-formally-deprecates-the-39-year-old-windows-control-panel

Microsoft formally deprecates the 39-year-old Windows Control Panel

Tech, windows 1.0, Windows 11, windows 11 24h2, windows 95, Windows NT / /

losing control —

The Settings app has taken over, but Control Panels aren’t going anywhere yet.

–

  • Here’s the Keyboard control panel from Windows NT 4.0.

    Andrew Cunningham

  • Aside from some updated Windows Vista-era icons, the design of the modern Keyboards panel is identical.

    Andrew Cunningham

  • The Mouse Pointers panel in Windows NT 4.

    Andrew Cunningham

  • Again, Windows 11 hews remarkably close to the old NT-era design.

    Andrew Cunningham

  • The Date & Time control panel from NT 4.

    Andrew Cunningham

  • Dig a couple of menus down, and you’ll find a version of Date & Time that still looks a lot like its NT counterpart.

    Andrew Cunningham

With an operating system as old as Windows, what Microsoft decides to remove is often just as (if not more) newsworthy as what it is trying to add. You may or may not care about new AI-themed MS Paint additions or the soon-to-be-reborn Recall feature, but you’ve almost certainly interacted with one of Windows’ Control Panel applets at some point in the last 39 years. And according to a note buried on Microsoft’s support site, those Control Panels’ days may be numbered (emphasis ours):

“The Control Panel is a feature that’s been part of Windows for a long time. It provides a centralized location to view and manipulate system settings and controls,” the support page explains. “Through a series of applets, you can adjust various options ranging from system time and date to hardware settings, network configurations, and more. The Control Panel is in the process of being deprecated in favor of the Settings app, which offers a more modern and streamlined experience.“

This won’t be news to anyone who has followed Windows’ development over the last decade. The Settings app was initially introduced in Windows 8 in 2012 as a touchscreen-friendly alternative for some of the Control Panel applets, but during the Windows 10 era it began picking up more and more Control Panel settings, and by the time Windows 11 rolled around it was full-featured enough to serve as a complete Control Panel replacement most of the time, with a handful of exceptions made for especially obscure changes (and those who simply prefer the Old Ways).

But while individual Control Panel applets have disappeared over the years—the Displays panel, the Add/Remove Programs screen, panels for deprecated features like Homegroups—Microsoft’s note suggests that the rest of the applets may disappear en masse in some future Windows update. That said, for now, there’s nothing that’s changing in Windows. Even the upcoming 24H2 update still has all the old Control Panels in it, and the gap between “deprecated” and “removed” can span years.

What’s incredible about some of the Control Panels at this point is how far back some of their designs go. You’re never more than a double-click away from some piece of UI that has been essentially exactly the same since 1996’s Windows NT 4.0, when Microsoft’s more-stable NT operating system was refreshed with the same user interface as Windows 95 (modern Windows versions descend from NT, and not 95 or 98). The Control Panel idea is even older, dating all the way back to Windows 1.0 in 1985.

Most of the current Control Panel designs and iconography settled down back in Windows Vista and Windows 7 in 2006 and 2009, which explains why so many of the panels still feature the rounded, glassy look that defines those versions of the operating system (check out the way the clock looks in our screenshots above). It’s one of the few areas of the operating system that hasn’t been spruced up for Windows 11, which is otherwise probably Microsoft’s most cohesive Windows design since 95 and NT 4.0; even old apps like Paint and Notepad have gotten facelifts, while other Windows 7-era holdovers like WordPad have been put out to pasture.

Microsoft formally deprecates the 39-year-old Windows Control Panel Read More »

us-sues-realpage,-claims-rental-pricing-algorithm-used-by-landlords-is-illegal

US sues RealPage, claims rental-pricing algorithm used by landlords is illegal

Policy, realpage / /

Rental-pricing software —

AG: Landlords use RealPage algorithm “to align their rents.”

–

US Attorney General Merrick Garland speaking at a news conference while standing behind a podium.

Enlarge / US Attorney General Merrick Garland speaks during a news conference in Washington, DC, on Friday, August 23, 2024.

Getty Images | Bloomberg

The United States today sued RealPage, alleging that the software maker distorts competition in rental housing by helping landlords collectively set prices.

“To ensure they secure the greatest value for their needs, renters rely on robust and fierce competition between landlords. RealPage distorts that competition,” said the lawsuit filed by the US government and eight state attorneys general. In a press release, the Justice Department said that “RealPage’s pricing algorithm violates antitrust laws.”

Attorney General Merrick Garland delivered remarks on the lawsuit. “When the Sherman Act was passed, an anticompetitive scheme might have looked like robber barons shaking hands at a secret meeting,” he said. “Today, it looks like landlords using mathematical algorithms to align their rents. But antitrust law does not become obsolete simply because competitors find new ways to unlawfully act in concert.”

RealPage’s commercial revenue management software “enable[s] landlords to sidestep vigorous competition to win renters’ business,” the lawsuit alleged. “Landlords, who would otherwise be competing with each other, submit on a daily basis their competitively sensitive information to RealPage. This nonpublic, material, and granular rental data includes, among other information, a landlord’s rental prices from executed leases, lease terms, and future occupancy. RealPage collects a broad swath of such data from competing landlords, combines it, and feeds it to an algorithm.”

Using that sensitive data, “RealPage provides daily, near real-time pricing ‘recommendations’ back to competing landlords,” the US said. The US alleges that these “are more than just ‘recommendations'” and that “RealPage monitors compliance by landlords to its recommendations.”

AG: Landlords “outsource their pricing decisions”

The US asked for a court order declaring “that RealPage has acted unlawfully to restrain trade in conventional multifamily rental housing markets across the United States.” The requested order would prohibit RealPage from continuing its allegedly anticompetitive practices and provide “relief necessary and appropriate to restore competitive conditions in the markets affected by RealPage’s unlawful conduct.”

RealPage recently argued that its software “benefits both housing providers and residents,” and “makes price recommendations in all directions—up, down, or no change—to align with property-specific objectives of the housing providers using the software.” Landlords don’t have to follow the recommendations, the company says.

The US said RealPage takes a more direct role in setting prices. RealPage “reviews and weighs in on landlords’ other policies, including trying to—and often succeeding in—ending renter-friendly concessions (like a free month’s rent or waived fees) to attract or retain renters,” the lawsuit said. Garland alleged that “a large number of landlords effectively agree to outsource their pricing decisions to RealPage by using an ‘auto accept’ setting, which effectively permits RealPage to determine the price a renter will pay.”

The RealPage algorithm “can serve as a mechanism for communication,” Diana Moss, director of competition policy at the Progressive Policy Institute, a public policy think tank, was quoted as saying by The New York Times. “That is as approachable and actionable under US antitrust as any form of communication we’ve seen in past cases in the non-digital era.”

The lawsuit was filed in US District Court for the Middle District of North Carolina. Six landlords in North Carolina provided information to the Justice Department. The states joining the lawsuit are North Carolina, California, Colorado, Connecticut, Minnesota, Oregon, Tennessee, and Washington.

Software eliminates “guessing game” on prices

Garland said the investigation preceding the lawsuit took nearly two years. The lawsuit quoted landlords describing how they use RealPage:

One landlord observed that RealPage’s software “can eliminate the guessing game” for landlords’ pricing decisions. Discussing a different RealPage product, another landlord said: “I always liked this product because your algorithm uses proprietary data from other subscribers to suggest rents and term. That’s classic price fixing.” A third landlord explained, “Our very first goal we came out with immediately out of the gate is that we will not be the reason any particular sub-market takes a rate dive. So for us our strategy was to hold steady and to keep an eye on the communities around us and our competitors.”

The lawsuit said that “RealPage frequently tells prospective and current clients that a ‘rising tide raises all ships.’ A RealPage revenue management vice president explained that this phrase means that ‘there is greater good in everybody succeeding versus essentially trying to compete against one another in a way that actually keeps the industry down.'”

The US and states allege that RealPage violated Section 1 of the Sherman Act by unlawfully sharing information for use in competitors’ pricing, and by entering into vertical agreements with landlords to align pricing. RealPage is further accused of violating Section 2 of the Sherman Act through monopolization of the commercial revenue management software market.

RealPage, which is also facing a ban on its software in San Francisco, said the lawsuit is “devoid of merit and will do nothing to make housing more affordable.”

“We are disappointed that, after multiple years of education and cooperation on the antitrust matters concerning RealPage, the DOJ has chosen this moment to pursue a lawsuit that seeks to scapegoat pro-competitive technology that has been used responsibly for years,” RealPage said.

The White House issued a statement saying it has no comment on the lawsuit against RealPage, but that the Biden-Harris administration “continues to support fair and vigorous enforcement of the antitrust laws to prevent illegal collusion.”

US sues RealPage, claims rental-pricing algorithm used by landlords is illegal Read More »

fda-green-lights-fall-covid-19-boosters

FDA green-lights fall COVID-19 boosters

Comirnaty, COVID-19, health, moderna, mRNA, Pfizer, Spikevax, vaccines / /

Shoot me up —

Updated mRNA vaccines from Pfizer and Moderna are ready to roll.

–

FDA green-lights fall COVID-19 boosters

Getty Images

As the COVID-19 case count continues to tick upward, the US Food and Drug Administration has approved an updated vaccine for use ahead of the northern hemisphere winter. The emergency use authorization covers updated mRNA vaccines from both Pfizer and Moderna.

The booster shots will target the JN.1 and KP.2 strains of SARS-CoV-2, both of which are omicron variants. Last year’s booster keyed on omicron subvariant XBB.1.5, which has long since lost the evolutionary arms race.

Both Spikevax (Moderna) and Comirnaty (Pfizer) vaccines have been updated. While the vaccine is targeted toward those 12 and over, parents of children aged six months through 11 years are also eligible for the updated vaccines under the FDA’s emergency use authorization.

“Vaccination continues to be the cornerstone of COVID-19 prevention,” said Peter Marks, director of the FDA’s Center for Biologics Evaluation and Research. “These updated vaccines meet the agency’s rigorous, scientific standards for safety, effectiveness, and manufacturing quality. Given waning immunity of the population from previous exposure to the virus and from prior vaccination, we strongly encourage those who are eligible to consider receiving an updated COVID-19 vaccine to provide better protection against currently circulating variants.”

Updated vaccines will hit hospitals and pharmacies soon, as Moderna and Pfizer are ready to ship vaccines. Once injected, the boosters will take a couple of weeks to hit peak protection, and they will offer that level of protection for a few months after the shot. Keep that in mind as you think about timing your booster for maximum efficacy.

FDA green-lights fall COVID-19 boosters Read More »

ex-bank-ceo-gets-24-years-after-falling-for-crypto-scam,-causing-bank-collapse

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse

crypto scam, Cryptocurrency, pig butchering, Policy / /

Breaking the bank —

Former bank CEO ignored warnings that he was being scammed while tanking bank.

–

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse

A federal judge sentenced a 53-year-old Kansas man to more than 24 years in prison after the former bank CEO abused his trusted position to embezzle $47 million after falling for a cryptocurrency scam that he believed would make him wildly rich.

In a press release, the US Attorney’s Office said that Shan Hanes was driven by “greed” when directing bank employees to transfer millions in funds to a sketchy crypto wallet managed by still-unknown third parties behind the so-called “pig butchering” scheme.

Hanes was first targeted by scammers in late 2022, apparently when he got a message from an unidentified co-conspirator on WhatsApp, prosecutors said. After blowing through his own funds seeking promised profits, Hanes stole tens of thousands from a local church, then a local investor club, and finally his daughter’s college fund, NBC News reported. Then when all those wells dried up, he started stealing bank funds—all in the false hopes that sending more and more money to the scammers would somehow “unlock the supposed returns” on his crypto investments.

In total, Hanes made 11 wire transfers using bank funds between May 2023 and July 2023. But instead of getting rich quick, Hanes never realized any profits at all, the US Attorney’s Office said.

He pleaded guilty to one count of embezzlement by a bank officer after he singlehandedly caused the collapse of Heartland Tri-State Bank (HTSB) in Elkhart, Kansas, the press release said.

Because the bank was insured by the Federal Deposit Insurance Corporation (FDIC), the FDIC “absorbed the $47.1 million loss” after “Hanes’ fraudulent actions caused HTSB to fail and the bank investors to lose $9 million,” the US Attorney’s Office said. On top of those losses, Hanes’ fraudulent actions caused “catastrophic losses to bank customers who relied on the bank for the safekeeping of their savings,” the press release confirmed.

According to NBC News, Hanes missed at least one opportunity to realize that he was being scammed. After he asked for a $12 million loan from a neighbor, Brian Mitchell, his neighbor detected the scam and refused to lend the money.

“I said, ‘You’re in a scam, walk away,'” Mitchell told NBC News.

But Hanes didn’t walk away. Going the other direction, he directed bank employees to wire millions more to scammers after he got the warning from Mitchell. It wasn’t until Mitchell heard from a bank employee that Hanes had wired money out of the bank that Mitchell insisted on speaking to the bank’s board.

Days later, Hanes was fired, NBC News reported. But even then, Hanes never believed he was being scammed, reportedly telling Mitchell that he was still scheming to find a way to recover his make-believe profits right up to the moment he was arrested.

“He said … ‘If I just had another two months, I could get the money back,'” Mitchell told NBC News.

Law enforcement and government officials have warned that pig-butchering scams are growing increasingly common, urging people to “think twice” to avoid being victimized. Last year, the US Department of the Treasury’s Financial Crimes Enforcement Network issued an alert, which explained in detail how the scams commonly work and laid out red flags to watch out for.

Victims may never fully recover losses, DOJ says

A Kansas FBI agent, Stephen Cyrus, said in the press release that as CEO, Hanes violated “the trust and confidence of the community of Elkhart” by embezzling the funds.

Mitchell described Hanes’ deceptions and manipulations as “pure evil,” while Cyrus said that it was Hanes’ “job” and “the bank’s job” to “protect its customers and identify fraudulent scams—not to participate in them.”

In a court filing at sentencing, Hanes’ lawyer, John Stang, chalked up his client’s misdeeds to “bad choices,” reminding the court that Hanes had been deceived, too, by “an extremely well-run cryptocurrency scam.”

“He was the pig that was butchered,” Stang wrote. “Mr. Hanes’s vulnerability to the Pig Butcher scheme caused him to make some very bad decisions, for which he is truly sorry for causing damage to the bank and loss to the Stockholders.”

Hanes faced a maximum penalty of 30 years. While Judge John Broomes ordered him to serve less time than that, his sentence of more than 24 years is 29 months longer than prosecutors had requested, NBC News reported.

Right now, it’s unclear how or when victims will be repaid for losses. Broomes ordered “that restitution be finalized at a separate hearing within the next 90 days,” the US Attorney’s Office said.

In the community, people are still struggling to recover, Mitchell told NBC News, noting that some people lost up to 80 percent of their retirement savings. For at least one woman, retirement is impossible now, Mitchell said, and for another local woman, it has become difficult to pay for her 93-year-old mother’s nursing home.

US Attorney Kate E. Brubacher said that it’s hard to say when or if victims will be made whole again.

“Hanes is a liar and a master manipulator” who squandered away “tens of millions of dollars in cryptocurrency” while orchestrating “schemes to cover his tracks concerning the losses at the bank,” Brubacher said. “Many victims will never fully recoup losses to their life savings and retirement funds, but at least we at the Department of Justice can see that Hanes is held criminally responsible for his actions.”

Ex-bank CEO gets 24 years after falling for crypto scam, causing bank collapse Read More »

“we-run-a-business”—why-microsoft’s-indiana-jones-will-be-on-ps5

“We run a business”—why Microsoft’s Indiana Jones will be on PS5

gaming, Indiana Jones, Phil Spencer, xbox / /

PS5 Starfield when? —

Spencer: “There’s going to be more change in how… games are built and distributed.”

–

So I'm not stuck on Xbox, eh?

Enlarge / So I’m not stuck on Xbox, eh?

Bethesda

Bethesda’s Indiana Jones and The Great Circle is the latest game from a Microsoft subsidiary that will make its way to the PlayStation 5. The game will hit Sony’s console in the spring of 2025, Microsoft announced yesterday, months after a planned December launch on Xbox Series S/X and Windows.

In an interview with YouTube channel Xbox On, Microsoft’s Phil Spencer expanded on that decision, implying that multiplatform releases for Microsoft gaming properties were important to the Xbox division’s bottom line. “We run a business,” he said, “It’s definitely true inside of Microsoft the bar is high for us in terms of the delivery that we have to give back to the company, because we get a level of support from the company that’s just amazing in what we’re able to go do.”

Phil Spencer’s comments come about three minutes into this interview.

Amid massive layoffs that have hit Xbox and other gaming companies in recent months, Spencer noted that there’s “a lot of pressure on the [game] industry” these days. “[The industry] has been growing for a long, long time and now people are looking for ways to grow,” he said. “And I think that us, as fans, as players of games, we just have to anticipate there’s going to be more change in how some of the traditional ways that games were built and distributed [ars] going to change… for all of us.”

“It’s just going to be a strategy that works for us”

Although Microsoft released four former Xbox exclusives on other platforms months ago, Spencer suggested that there hasn’t been any commensurate dip in total Xbox usage. “What I see when I look is our franchises are getting stronger; our Xbox console players are as high this year as they’ve ever been,” he said.

“So I look at it, and I say, ‘Okay, our player numbers are going up for the console platform, our franchises are as strong as they’ve ever been… So I look at this [as] ‘How can we make our games as strong as possible?'” our platform continues to grow both on console on PC and on cloud and I think it’s just going to be a strategy that works for us.”

Indiana Jones.” height=”360″ src=”https://cdn.arstechnica.net/wp-content/uploads/2024/02/xboxmulti-640×360.jpg” width=”640″>

Enlarge / Microsoft’s last four multiplatform game releases were a bit smaller than Indiana Jones.

Microsoft

Microsoft has long prioritized maintaining a healthy number of overall Xbox players over selling more raw consoles than competitors like Sony. Still, the continuing cratering of sales revenue from Xbox hardware likely contributes heavily to Microsoft’s decision to release its games on competing platforms.

A big-budget, big-name Bethesda release like Indiana Jones could act as more of an Xbox system seller than the four older, smaller games that Microsoft recently let go multiplatform. Then again, The Great Circle‘s multiple months of Xbox exclusivity—which include the 2024 holiday buying season—could still provide a bit of a relative advantage for Microsoft’s consoles.

Indiana Jones and The Great Circle‘s PS5 availability may come as a particular surprise to readers who remember Spencer saying in February that neither The Great Circle nor Starfield were a part of the company’s current multiplatform plans. But a careful parsing of Spencer’s words at the time shows that he only promised those titles were not among the four multiplatform titles they were announcing at that time.

Back then, Spencer said that those four multiplatform releases didn’t represent “a change to our fundamental exclusive strategy.” But he added that there was a desire to “use what some of the other platforms have right now to help grow our franchises” to help “the long-term health of Xbox.”

“[I have] a fundamental belief that over the next five or ten years… games that are exclusive to one piece of hardware are going to be a smaller and smaller part of the game industry,” Spencer said in February.

“We run a business”—why Microsoft’s Indiana Jones will be on PS5 Read More »

telco-fined-$1m-for-transmitting-biden-deepfake-without-verifying-caller-id

Telco fined $1M for transmitting Biden deepfake without verifying Caller ID

biden deepfake, fake biden robocall, Policy / /

Biden deepfake robocall —

Lingo Telecom signed calls with A-Level attestations despite not verifying them.

–

President Biden walking outdoors while holding a cell phone to his ear with one hand and holding another phone in his other hand.

Enlarge / President Joe Biden leaving the White House on August 16, 2024, in Washington, DC.

Getty Images | Anna Moneymaker

A phone company agreed to pay a $1 million fine for transmitting spoofed robocalls in which a deepfake of President Joe Biden’s voice urged New Hampshire residents not to vote. Lingo Telecom, which is based in Texas, agreed to a settlement with the Federal Communications Commission, the agency announced today.

Lingo Telecom “will pay a $1 million civil penalty and implement a historic compliance plan—the first of its kind secured by the FCC—that will require strict adherence to the FCC’s STIR/SHAKEN Caller ID authentication rules,” the FCC said. The settlement includes “requirements that the company abide by ‘Know Your Customer’ (KYC) and ‘Know Your Upstream Provider’ (KYUP) principles” that focus on vetting call traffic to ensure it is trustworthy, and “requirements that the company more thoroughly verify the accuracy of the information provided by its customers and upstream providers.”

The calls made before New Hampshire’s presidential primary in January were orchestrated by Steve Kramer, a Democratic consultant who was working for a candidate running against Biden. Kramer was indicted on charges of voter suppression and impersonation of a candidate, and the FCC proposed a $6 million fine for Kramer. The calls inaccurately displayed a phone number associated with a prominent New Hampshire political operative.

The FCC originally proposed a $2 million fine for Lingo Telecom before settling for the $1 million penalty in a consent decree issued today. The consent decree resolves the FCC investigation into Lingo Telecom’s apparent violations of rules related to the STIR/SHAKEN Caller ID authentication system.

Telco didn’t verify calls

Lingo Telecom completed 3,978 calls to potential New Hampshire voters on January 21, 2024, on behalf of a customer called Life Corporation. Lingo Telecom signed those calls with A-Level attestations, which indicate that the phone company “is responsible for the origination of the call onto the IP-based service provider voice network, has a direct authenticated relationship with the customer and can identify the customer, and has established a verified association with the telephone number used for the call.”

Lingo Telecom did not actually verify the calls, the consent decree said:

Lingo Telecom explained that its policy was to assign A-level attestations to a customer’s traffic when the Company directly assigned Direct Inward Dialing (DID) numbers to a customer like Life Corporation. If one of these customers, like Life Corporation, also purchased Company Session Initiation Protocol (SIP) trunks that permits the customer to use numbers assigned by other carriers, Lingo Telecom allowed them to “receive an A-level attestation for traffic associated with… non-Lingo provisioned telephone numbers if the customer certified that it ‘will identify its customer and has a verified association with the telephone number used for the call.'”

Lingo Telecom told the FCC that it relied on the certification provided by Life Corporation, which had been a customer of Lingo Telecom for 16 years. “Lingo Telecom took no additional steps beyond those recited above to independently ascertain whether the customers of Life Corporation could legitimately use the telephone number that appeared as the calling party for the New Hampshire presidential primary calls,” the FCC said.

The consent decree states that, going forward, “Lingo Telecom may only apply an A-level attestation to a call if Lingo Telecom itself has provided the Caller Identity to the calling party associated with the Call.” The consent decree’s “Know Your Customer” provisions require Lingo Telecom to obtain more detailed information from customers, while the “Know Your Upstream Provider” provisions require it to obtain more detailed information from other telcos that it transmits calls for.

Lingo Telecom is also barred from accepting “payment in the form of cryptocurrency, gift cards, or cash to transmit or originate calls.” The consent decree is scheduled to be in effect for three years but can be extended by 12 months for each instance of noncompliance.

Telco fined $1M for transmitting Biden deepfake without verifying Caller ID Read More »

novel-technique-allows-malicious-apps-to-escape-ios-and-android-guardrails

Novel technique allows malicious apps to escape iOS and Android guardrails

android, Biz & IT, iOS, malicious apps, malware, phishing, Security / /

NOW YOU KNOW —

Web-based apps escape iOS “Walled Garden” and Android side-loading protections.

–

An image illustrating a phone infected with malware

Getty Images

Phishers are using a novel technique to trick iOS and Android users into installing malicious apps that bypass safety guardrails built by both Apple and Google to prevent unauthorized apps.

Both mobile operating systems employ mechanisms designed to help users steer clear of apps that steal their personal information, passwords, or other sensitive data. iOS bars the installation of all apps other than those available in its App Store, an approach widely known as the Walled Garden. Android, meanwhile, is set by default to allow only apps available in Google Play. Sideloading—or the installation of apps from other markets—must be manually allowed, something Google warns against.

When native apps aren’t

Phishing campaigns making the rounds over the past nine months are using previously unseen ways to workaround these protections. The objective is to trick targets into installing a malicious app that masquerades as an official one from the targets’ bank. Once installed, the malicious app steals account credentials and sends them to the attacker in real time over Telegram.

“This technique is noteworthy because it installs a phishing application from a third-party website without the user having to allow third-party app installation,” Jakub Osmani, an analyst with security firm ESET, wrote Tuesday. “For iOS users, such an action might break any ‘walled garden’ assumptions about security. On Android, this could result in the silent installation of a special kind of APK, which on further inspection even appears to be installed from the Google Play store.”

The novel method involves enticing targets to install a special type of app known as a Progressive Web App. These apps rely solely on Web standards to render functionalities that have the feel and behavior of a native app, without the restrictions that come with them. The reliance on Web standards means PWAs, as they’re abbreviated, will in theory work on any platform running a standards-compliant browser, making them work equally well on iOS and Android. Once installed, users can add PWAs to their home screen, giving them a striking similarity to native apps.

While PWAs can apply to both iOS and Android, Osmani’s post uses PWA to apply to iOS apps and WebAPK to Android apps.

Installed phishing PWA (left) and real banking app (right).

Enlarge / Installed phishing PWA (left) and real banking app (right).

ESET

Comparison between an installed phishing WebAPK (left) and real banking app (right).

Enlarge / Comparison between an installed phishing WebAPK (left) and real banking app (right).

ESET

The attack begins with a message sent either by text message, automated call, or through a malicious ad on Facebook or Instagram. When targets click on the link in the scam message, they open a page that looks similar to the App Store or Google Play.

Example of a malicious advertisement used in these campaigns.

Example of a malicious advertisement used in these campaigns.

ESET

Phishing landing page imitating Google Play.

Phishing landing page imitating Google Play.

ESET

ESET’s Osmani continued:

From here victims are asked to install a “new version” of the banking application; an example of this can be seen in Figure 2. Depending on the campaign, clicking on the install/update button launches the installation of a malicious application from the website, directly on the victim’s phone, either in the form of a WebAPK (for Android users only), or as a PWA for iOS and Android users (if the campaign is not WebAPK based). This crucial installation step bypasses traditional browser warnings of “installing unknown apps”: this is the default behavior of Chrome’s WebAPK technology, which is abused by the attackers.

Example copycat installation page.

Example copycat installation page.

ESET

The process is a little different for iOS users, as an animated pop-up instructs victims how to add the phishing PWA to their home screen (see Figure 3). The pop-up copies the look of native iOS prompts. In the end, even iOS users are not warned about adding a potentially harmful app to their phone.

Figure 3 iOS pop-up instructions after clicking

Figure 3 iOS pop-up instructions after clicking “Install” (credit: Michal Bláha)

ESET

After installation, victims are prompted to submit their Internet banking credentials to access their account via the new mobile banking app. All submitted information is sent to the attackers’ C&C servers.

The technique is made all the more effective because application information associated with the WebAPKs will show they were installed from Google Play and have been assigned no system privileges.

WebAPK info menu—notice the

WebAPK info menu—notice the “No Permissions” at the top and “App details in store” section at the bottom.

ESET

So far, ESET is aware of the technique being used against customers of banks mostly in Czechia and less so in Hungary and Georgia. The attacks used two distinct command-and-control infrastructures, an indication that two different threat groups are using the technique.

“We expect more copycat applications to be created and distributed, since after installation it is difficult to separate the legitimate apps from the phishing ones,” Osmani said.

Novel technique allows malicious apps to escape iOS and Android guardrails Read More »