Month: November 2019

(credit: Pixabay)

The official site for the Monero digital coin was hacked to deliver currency-stealing malware to users who were downloading wallet software, officials with GetMonero.com said on Tuesday.

The supply-chain attack came to light on Monday when a site user reported that the cryptographic hash for a command-line interface wallet downloaded from the site didn't match the hash listed on the page. Over the next several hours, users discovered that the mismatching hash wasn't the result of an error. Instead, it was an attack designed to infect GetMonero users with malware. Site officials later confirmed that finding.

"It's strongly recommended to anyone who downloaded the CLI wallet from this website between Monday 18th 2:30 AM UTC and 4:30 PM UTC, to check the hashes of their binaries," GetMonero officials wrote. "If they don't match the official ones, delete the files and download them again. Do not run the compromised binaries for any reason."

• 

  Google's eventual plan for Android, one kernel for every device, instead of the device-specific kernels that exist now. [credit: Saravana Kannan ]

It seems like Google is working hard to update and upstream the Linux kernel that sits at the heart of every Android phone. The company was a big participant in this year's Linux Plumbers Conference, a yearly meeting of the top Linux developers, and Google spent a lot of time talking about getting Android to work with a generic Linux kernel instead of the highly-customized version it uses now. It even showed an Android phone running a mainline Linux kernel.

But first, some background on Android's current kernel mess.Currently, three major forks happen in between the "mainline" Linux kernel and a shipping Android device (note that "mainline" here has no relation to Google's own "Project Mainline"). First, Google takes the an LTS (Long Term Support) Linux kernel and turns it into the "Android Common kernel"—the Linux kernel with all the Android OS-specific patches applied. Android Common is shipped to the SoC vendor (usually Qualcomm) where it gets its first round of hardware-specific additions, first focusing on a particular model of SoC. This "SoC Kernel" then gets sent to a device manufacturer for even more hardware-specific code that supports every other piece of hardware, like the display, camera, speakers, usb ports, and any extra hardware. This is the "Device Kernel," and it's what actually ships on a device.

This is an extremely long journey that results in every device shipping millions of lines of out-of-tree kernel code. Every shipping device kernel is different and device specific—basically no device kernel from one phone will work on another phone. The mainline kernel version for a device is locked in at the beginning of an SoC's initial development, so it's typical for a brand-new device to ship with a Linux kernel that is two years old. Even Google's latest and, uh, greatest device, the Pixel 4, shipped in October 2019 with Linux kernel 4.14, an LTS release from November 2017. It will be stuck on kernel 4.14 forever, too. Android devices do not get kernel updates, probably thanks to the incredible amount of work needed to produce just a single device kernel, and the chain of companies that would need to cooperate to do it. Thanks to kernel updates never happening, this means every new release of Android usually has to support the last three years of LTS kernel releases (the minimum for Android 10 is 4.9, a 2016 release). Google's commitments to support older versions of Android with security patches means the company is still supporting kernel 3.18, which is five years old now. Google's band-aid solution for this so far has been to team up with the Linux community and support mainline Linux LTS releases for longer, and they're now up to six years of support.

Enlarge / AT&T executive John Stankey at a presentation for investors at Warner Bros. Studios on October 29, 2019, in Burbank, California. (credit: Getty Images | Presley Ann)

AT&T's traditional TV business is tanking, with the company having lost nearly 5 million satellite-and-wireline TV customers since the end of 2016.

But AT&T President John Stankey sees a path forward in recreating the traditional cable-TV bundle on the Internet. AT&T's HBO Max is slated to launch in May 2020 for $14.99 a month, and AT&T has set an ambitious goal of 50 million US subscribers within five years.

A subscriber number like that would make HBO Max far bigger than AT&T's DirecTV satellite division and its U-verse wireline TV service. But ultimately, the service customers get could end up looking pretty similar to DirecTV, U-verse, or cable TV.

Enlarge / A sketch drawn by study participant of visuals during their experience. (credit: Imperial College London/Chris Timmermann)

People under the influence of a psychedelic brew known as ayahuasca frequently experience vivid visual and aural hallucinations and also report feeling as if they are in a dream. Now a new study published in Scientific Reports has shown that the drug alters the user's waking brain-wave patterns to produce a mental state that the researchers describe as "dreaming while awake."

Ayahuasca is a bitter tea made from the Brazilian vine banisteriopsis caapi, colloquially known as the "spirit vine," used in shaman-led spiritual ceremonies among native people in the Amazon basin. Its primary active ingredient is dimethyltryptamine (DMT). That's the secret to ayahuasca's powerful psychedelic effects, which can also produce feelings of elation and fear or a sense of epiphany or psychological breakthrough. Those mind-altering properties come at a price, however. Participants in the ceremonies are often advised to bring a bucket, since nausea and vomiting (and sometimes diarrhea) are common reactions to the tea.

The brain controls perception and communication throughout the body via chemical neurotransmitters. Each neurotransmitter attaches to matching areas on nerve cells known as receptors. LSD, for example, targets the brain's serotonin receptors. Ayahuasca contains a compound (banisterine) that latches onto dopamine receptors in the brain. (That's why banisterine holds potential as a treatment for Parkinson's disease, which destroys dopamine receptors.)

Enlarge / Regardless of the crazy pricing, you should get your flu shot. (credit: Getty | Bloomberg)

The annual flu shots that are free to those with health insurance are not immune from the convoluted and contemptible price-gouging that plague the US healthcare system.

Health insurance companies pay wildly different amounts for the same vaccines depending on how negotiations go with individual medical providers across the country. In some cases, providers have forced insurers to pay upward of three times the price they would pay to other providers, according to an investigation by Kaiser Health News.

The outlet noted that one Sacramento, California, doctors’ office got an insurer to pay $85 for a flu shot that it offered to uninsured patients for $25.

Enlarge (credit: Bureau of Land Management Alaska Follow)

Password data and other personal information belonging to as many as 2.2 million users of two websites—one a cryptocurrency wallet service and the other a gaming bot provider—have been posted online, according to Troy Hunt, the security researcher behind the Have I Been Pwned breach notification service.

One haul includes personal information for as many as 1.4 million accounts from the GateHub cryptocurrency wallet service. The other contains data for about 800,000 accounts on RuneScape bot provider EpicBot. The databases include registered email addresses and passwords that were cryptographically hashed with bcrypt, a function that's among the hardest to crack.

The person posting the 3.72GB Gateway database said it also includes two-factor authentication keys, mnemonic phrases, and wallet hashes, although GateHub officials said an investigation suggested wallet hashes were not accessed. The EpicBot database, meanwhile, purportedly included usernames and IP addresses. Hunt said he selected a representative sample of accounts from both databases to verify the authenticity of the data. All of the email addresses he checked were registered to accounts of the two sites.