Month: July 2020

Enlarge (credit: Sucker Punch / SIE)

Like clockwork, certain friends of mine text or IM when a big video game is about to launch. I'm the guy they know who gets games like a new Smash Bros. or Half-Life before the general public, and they love to push my embargoes to the limits with questions like "does it live up to the hype?" or "no spoilers: should I buy it?"

With Ghost of Tsushima, likely the last major new first-party game for Sony's PS4, I got a surprising number of these questions over the past few weeks. You might say they were surprising because Tsushima is an entirely new game series, not a hotly anticipated sequel. But the surprise came in a different form, as all of my friends came out of the woodwork to essentially ask me the same question: "Is this new Sony game hopeful?"

PS4 fans are likely still reeling from the console's last major exclusive, June's brutal Last of Us Part II—a game that revolves around the biological and social devastation following a global pandemic. TLOU2 is a brave, challenging, and compelling game, but the consensus I've gathered is that people are hungry for a different kind of adventure right now.

Enlarge / LeakyPick as it monitors a network that has an Amazon Echo connected. (credit: Mitev, et al.)

As the popularity of Amazon Alexa and other voice assistants grows, so too does the number of ways those assistants both do and can intrude on users' privacy. Examples include hacks that use lasers to surreptitiously unlock connected-doors and start cars, malicious assistant apps that eavesdrop and phish passwords, and discussions that are surreptitiously and routinely monitored by provider employees or are subpoenaed for use in criminal trials. Now, researchers have developed a device that may one day allow users to take back their privacy by warning when these devices are mistakenly or intentionally snooping on nearby people.

LeakyPick is placed in various rooms of a home or office to detect the presence of devices that stream nearby audio to the Internet. By periodically emitting sounds and monitoring subsequent network traffic (it can be configured to send the sounds when users are away), the ~$40 prototype detects the transmission of audio with 94-percent accuracy. The device monitors network traffic and provides an alert whenever the identified devices are streaming ambient sounds.

LeakPick also tests devices for wake word false positives, i.e., words that incorrectly activate the assistants. So far, the researchers' device has found 89 words that unexpectedly caused Alexa to stream audio to Amazon. Two weeks ago, a different team of researchers published more than 1,000 words or phrases that produce false triggers that cause the devices to send audio to the cloud.

(credit: Pixy)

Three weeks ago, security researchers exposed a sinister piece of malware lurking inside tax software that the Chinese government requires companies to install. Now there’s evidence that the high-stealth spy campaign was preceded by a separate piece of malware that employed equally sophisticated means to infect taxpayers in China.

GoldenHelper, as researchers from security firm Trustwave dubbed the malware, hid inside the Golden Tax Invoicing software, which all companies registered in China are mandated to use to pay value-added taxes. The malware is able to bypass the User Account Control, the Windows mechanism that requires users to give their approval before software can install programs or make other system changes. Once that’s done, GoldenSpy can install modules with System-level privileges. Trustwave published its findings on Tuesday here.

GoldenHelper employs other tricks to conceal its malicious behavior and evade detection from endpoint protection systems and software. The tricks include: