Month: August 2017

Enlarge (credit: Aurich / Thinkstock)

The ongoing Waymo v. Uber lawsuit continues to yield more interesting information about the internal plans of the ride-hailing company and its self-driving car ambitions. Uber was recently compelled by the court to hand over copies of text messages sent between former Uber CEO Travis Kalanick and Anthony Levandowski. While there's no "smoking gun" in the redacted document that would settle the matter in Waymo's favor, the messages—sent between February and December 2016—do show a particular disregard for Elon Musk and Tesla's autonomous driving project.

Waymo says that Levandowski stole more than 14,000 secret files while he worked at Google, then departed to create his own startup, which was purchased last year by Uber for $680 million. Now Uber stands accused of using Google trade secrets in building its self-driving car project—charges that Uber vehemently denies.

Levandowski's texts have a particular relevance to the case since he hasn't answered many questions himself, instead pleading his Fifth Amendment rights to avoid testifying. Earlier this year, Uber fired Levandowski when he wouldn't cooperate with court-ordered document production.

(credit: Jeremy Brooks)

For 17 days starting last month, an advanced backdoor that gave attackers complete control over networks lurked in digitally signed software used by hundreds of banks, energy companies, and pharmaceutical manufacturers, researchers warned Tuesday.

The backdoor, dubbed ShadowPad, was added to five server- or network-management products sold by NetSarang, a software developer with offices in South Korea and the US. The malicious products were available from July 17 to August 4, when the backdoor was discovered and privately reported by researchers from antivirus provider Kaspersky Lab. Anyone who uses the five NetSarang titles Xmanager Enterprise 5.0, Xmanager 5.0, Xshell 5.0, Xftp 5.0, or Xlpd 5.0, should immediately review posts here and here from NetSarang and Kaspersky Lab respectively.

Covert data collection

The attack is the latest to manipulate the supply chain of a legitimate product in hopes of infecting the people who rely on it. The NotPetya worm that shut down computers around the world in June used the same tactic after attackers hijacked the update mechanism for tax software that was widely used in Ukraine. Supply-chain attacks that targeted online gamers included one used to spread the PlugX trojan in 2015 and the malware dubbed WinNTi in 2013.

Enlarge / Outside the US Supreme Court in Washington, DC. (credit: Win McNamee / Getty Images News)

A group of prominent tech companies and lawyers has come together in new friend-of-the-court filings submitted to the Supreme Court on Tuesday. The group is arguing in favor of stronger legal protections for data generated by apps and digital devices in an important privacy case pending before the court.

The companies, which include Apple, Google, and Microsoft among many others, argue that the current state of the law, which distinguishes between "content" (which requires a warrant) and "non-content" (which does not) "make[s] little sense in the context of digital technologies."

The amicus filing by dozens of law professors also concludes that the third-party doctrine "cannot support future application of the Fourth Amendment." The legal theory posits that individuals relinquish their privacy interest in data (like a call record or location data) to a third-party—so the government can access it with a court order rather than a warrant.

Greetings, Arsians! Courtesy of our friends at TechBargains, we have new deals to share today. Amazon Prime members can get the popular new game Sonic Mania: Collector's Edition for just $55.99. That's 20 percent off its original price, which is great for such a new release. We also have a JACKYLED 45-in-1 screwdriver set for just $6.93 and a Dell XPS tower desktop with Core i7 for $599.

Check out the rest of the deals below, too.

Ars Technica may earn compensation for sales from links on this post through affiliate programs.

Enlarge / LinkedIn CEO Jeff Weiner. (credit: Ken Yeung)

A California federal court has handed a setback to LinkedIn in a case that could determine whether scraping a public website triggers anti-hacking law. The 25-page ruling, released on Monday, holds that federal anti-hacking law isn't triggered by scraping a website, even if the website owner—LinkedIn in this case—explicitly asks for the scraping to stop.

The case pits a business analytics startup called hiQ against the Microsoft-owned behemoth LinkedIn. HiQ scrapes data from publicly available portions of the LinkedIn website, then sells reports to employers about which of their employees seem to be looking for new jobs. LinkedIn sent hiQ a cease-and-desist letter warning that continued scraping could subject hiQ to liability under the Computer Fraud and Abuse Act (CFAA), the anti-hacking legislation Congress enacted in 1986.

But critics argued that the LinkedIn interpretation of the law could have sweeping and harmful consequences. After all, lots of people scrape publicly available websites, and they don't always do so with the approval of website owners.

Enlarge (credit: Jaap Arriens/NurPhoto via Getty Images)

Uber has reached a deal with the Federal Trade Commission to be subject to regular privacy audits, settling a complaint (PDF) in which the FTC accused Uber of violating its own privacy policy.

The FTC investigation began following news reports in November 2014 about Uber employees using a mode called "God view" to track journalists. In December 2014, Uber created a system for monitoring employee access to consumer information—but stopped using it less than a year after it was put in place, according to the FTC.

For more than nine months, Uber "rarely monitored internal access to personal information about users and drivers," today's FTC statement reads.