Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets

The DDoS arms race shows no signs of slowing down.

Tsunami of junk traffic that broke DDoS records delivered by tiniest of botnets

Enlarge (credit: Aurich Lawson | Getty Images)

A massive flood of malicious traffic that recently set a new distributed denial-of-service record came from an unlikely source. A botnet of just 5,000 devices was responsible as extortionists and vandals continue to develop ever more powerful attacks to knock sites offline, security researchers said.

The DDoS delivered 26 million HTTPS requests per second, breaking the previous record of 15.3 million requests for that protocol set only seven weeks ago, Cloudflare Product Manager ​​Omer Yoachimik reported. Unlike more common DDoS payloads such as HTTP, SYN, or SYN-ACK packets, malicious HTTPS requests require considerably more computing resources for the attacker to deliver and for the defender or victim to absorb.

4,000 times stronger

"We've seen very large attacks in the past over (unencrypted) HTTP, but this attack stands out because of the resources it required at its scale," Yoachimik wrote.

Read 6 remaining paragraphs | Comments

Lilbits: Psion 5MX meets a Raspberry Pi Zero, EU court overturns Qualcomm’s €1 billion antitrust fine

The Psion Series 5 line of PDAs released in the late 90s looked like tiny laptop computers, complete with QWERTY keyboards laid out in a way that even let you touch-type on a device small enough to fold in half and put in your pocket. While they never…

The Psion Series 5 line of PDAs released in the late 90s looked like tiny laptop computers, complete with QWERTY keyboards laid out in a way that even let you touch-type on a device small enough to fold in half and put in your pocket. While they never really became as popular as the smartphones, […]

The post Lilbits: Psion 5MX meets a Raspberry Pi Zero, EU court overturns Qualcomm’s €1 billion antitrust fine appeared first on Liliputing.

CrowPi L kit transforms a Raspberry Pi into a laptop (little assembly required)

The CrowPi L is a small laptop computer shell designed to be powered by a Raspberry Pi. It has a display, keyboard, battery, and other components… but it’s the Raspberry PI you stuff inside that will serve as the actual brains of the compu…

The CrowPi L is a small laptop computer shell designed to be powered by a Raspberry Pi. It has a display, keyboard, battery, and other components… but it’s the Raspberry PI you stuff inside that will serve as the actual brains of the computer. Made by the same folks who delivered the CrowPi and CrowPi […]

The post CrowPi L kit transforms a Raspberry Pi into a laptop (little assembly required) appeared first on Liliputing.

Senate bill would ban data brokers from selling location and health data

“Data brokers gather intensely personal data” without consent, bill summary says.

Sen. Elizabeth Warren (D-Mass.) and Sen. Patty Murray (D-Wash.) speak outside during a press conference.

Enlarge / Sen. Elizabeth Warren (D-Mass.) and Sen. Patty Murray (D-Wash.) hold a press conference about abortion rights outside the US Capitol building on June 15 in Washington, DC. (credit: Getty Images | Joe Raedle)

A bill introduced by Sen. Elizabeth Warren (D-Mass.) would prohibit data brokers from selling Americans' location and health data, Warren's office said Wednesday.

"Largely unregulated by federal law, data brokers gather intensely personal data such as location data from seemingly innocuous sources including weather apps and prayer apps—oftentimes without the consumer's consent or knowledge," a bill summary said. "Then, brokers turn around and sell the data in bulk to virtually any willing buyer, reaping massive profits."

Citing the draft Supreme Court ruling overturning Roe v. Wade, Warren said "it is more crucial than ever for Congress to protect consumers' sensitive data."

Read 4 remaining paragraphs | Comments

An astrophysicist explains the often-misunderstood nature of dark energy

“When it comes to dark energy, we’re just, well, we’re in the dark, right?”

Produced and directed by Corey Eisenstein. Click here for transcript. (video link)

Ars' Edge of Knowledge series looks at important aspects of our Universe that we still understand poorly, like dark matter and the origin of life. This week, our host Paul Sutter bravely ventures into the area we probably understand the least: dark energy. Dark energy accounts for about 75 percent of the stuff in the Universe, but we still don't have even the slightest idea what it is and are a bit stumped as to how to even go about finding out.

Paul goes into how we accidentally discovered that the Universe's expansion is accelerating when astronomers looked for an indication that the expansion was slowing down. Dark energy is simply the term we're using for the big unknown here: What's driving that acceleration?

Read 3 remaining paragraphs | Comments

EPA announces new PFAS exposure guidance, grants for water-supply cleanup

New guidance lowers acceptable exposure to some chemicals by a factor of 10,000.

Image of a child drinking from a tap.

Enlarge (credit: Thanasis Zovoilis)

Late in 2021, the Environmental Protection Agency announced a long-term project that aimed to come to grips with contamination by a class of chemicals called PFAS, for per- and poly-fluoroalkyl substances. Sometimes termed "forever chemicals," these compounds don't naturally degrade at an appreciable rate, and they show up in everything from food packaging to drinking water. Lab and epidemiological studies have indicated that they carry potential health risks, and the EPA started a program to evaluate the latest research on them.

On Tuesday, the agency announced some of the first results of this effort and is issuing updated drinking-water health advisories on four of the chemicals, one of which tightens exposure risks by a factor of 10,000. In addition, the EPA announced that it is planning to spend a billion dollars of Infrastructure Bill funding in disadvantaged and small communities to help them monitor and reduce PFAS exposures.

Less is better

PFAS are hydrocarbons in which some of the hydrogen atoms have been replaced by fluorine. This makes them chemically inert, allowing them to stick around in the environment for a long time without breaking down—hence the term "forever chemicals." Their stability and tendency to repel water makes them useful for a variety of industrial processes. Their users, however, haven't always been careful about what happens to the chemicals during use. As a result, PFAS have contaminated both soil and drinking water, among other things.

Read 10 remaining paragraphs | Comments

Canadian Judge: Movie Company’s Piracy Evidence Just Not Good Enough

Movie company Voltage Holdings has a reputation for filing lawsuits against alleged BitTorrent pirates, usually based on IP address evidence backed up by creative interpretations of copyright law. A well-considered and highly logical decision handed down by a judge in Canada’s Federal Court this week will also be of interest to those facing Voltage lawsuits elsewhere, the UK in particular.

From: TF, for the latest news on copyright battles, piracy and more.

ip addressAmong the many movie companies that have attempted to turn piracy into profit, Voltage Pictures and parent Voltage Holdings stand out among the most persistent.

With ties to the shadowy piracy monitoring and settlement factory GuardaLey, Voltage is currently pursuing Virgin Media customers in the UK to retrieve cash while warning that something much worse could happen.

Voltage is also active in Canada, demanding cash settlements from the same type of people, backed up by similar evidence, and supported by similar creative legal theories that attempt to establish liability for internet billpayers due to their inability to accurately identify primary infringers.

An order handed down by Canada’s Federal Federal Court last week demonstrates that when evidence is not good enough, a logical assessment of the law can significantly undermine plans for an easy influx of cash settlements. Given the similarities between Canadian and UK law, the order and the reasoning behind it should prove interesting to Voltage letter recipients on both sides of the Atlantic.

Background

In 2017, piracy monitoring company Maverickeye set out to collect IP addresses of BitTorrent users sharing the Voltage-owned sci-fi movie ‘Revolt’. Canada has a so-called ‘notice-and-notice’ regime so Voltage identified the ISPs related to the IP addresses and sent initial warning notices, which were forwarded by ISPs to the relevant subscribers. Second notices were sent after Maverickeye found the same IP addresses sharing the same work a week or more later.

On March 16, 2018, a statement of claim was filed against 110 ‘Doe’ defendants, identified only by their IP addresses. On December 3, 2018, a so-called ‘Norwich’ discovery order was obtained which, like its UK counterpart, compelled ISPs to disclose the names and addresses of subscribers associated with the allegedly infringing activity.

Voltage subsequently labeled 30 of these internet subscribers “the worst of the worst” after they allegedly shared ‘Revolt’ over a period of weeks to months, possibly to thousands of people. This evidence was supported by an affidavit from Benjamin Perino, who in court documents is described as GuardaLey’s former CEO and creator of the piracy tracking software used by Maverickeye.

The fact that Perino currently runs affiliated Cyprus-based company Guardaley Technologies Ltd isn’t mentioned in the order and since no defenses were filed in the action, once again the mechanics and evidence produced by the Maverickeye software went uncontested.

Voltage Requests Default Judgment

Given that these ‘worst of the worst’ defendants failed to file a defense, Voltage sought default judgment against them. Canadian Internet Policy and Public Interest Clinic (CIPPIC) was allowed to intervene, arguing that Voltage should not be able to bring a default proceeding as it had not done enough to identify the people who had actually infringed.

Justice Angela Furlanetto ultimately agreed that all of the defendants are indeed in default. However, a consideration of the merits should take place before handing down any judgment. Given the uncontested evidence, the Judge found that portions of the ‘Revolt’ movie had indeed been shared online in breach of copyright but the thorny issue remained – were the defaulting defendants, identified as ISP account holders and billpayers, the actual infringers?

Direct Infringement and Discovery

CIPPIC argued that it cannot be presumed that an internet subscriber/billpayer and an internet user are the same person and as such, Voltage had failed to identify the persons behind the monitored IP addresses at the time the alleged infringements were carried out.

The Judge’s summing up of Voltage’s position notes that “there is no technological way to pierce through the veil of the internet to determine who was actually using the IP addresses at the time the Work was offered for download”, which effectively admits that via an IP address alone, Voltage can’t identify the actual infringer. Of course, Voltage wouldn’t be giving up that easily.

The company insisted that since it had provided evidence of repeat infringement (backed up by infringement notices) the burden should shift, thereby requiring the defendant internet billpayers to disprove their association with the infringement monitored via their IP address. The Judge disagreed, noting that in a Canadian default proceeding, all allegations are treated as denied. The plaintiff must show, on the balance of probabilities, that they have named the proper defendants – the infringers.

CIPPIC said that Voltage should’ve obtained more evidence before requesting default judgment but Voltage expressed concern over potential breaches of privacy. Obtaining all electronic devices (or forensic copies) belonging to all people associated with an IP address would be intrusive, as would requests to ISPs to provide detailed internet activity logs.

In a previous Voltage case, the Court said that privacy rights should be invaded “in the most minimal way” and in this matter Justice Furlanetto suggested that written discovery could be used to seek information on the nature of the system behind an IP address. This could include the type of control the IP address owner has over users and devices, the number of users behind an IP address, and what actions were taken by the billpayer in response to the first and second infringement notices.

“In my view, some attempt must be made to determine the internet user responsible for the alleged infringement before a presumption can arise that the internet subscriber is that user or a proper adverse inference can be drawn based on non-responsiveness,” the Judge’s order reads.

“A direct link must be addressed by the evidence between the internet subscriber and the alleged infringing use or sufficient steps taken for an adverse inference to be drawn against the internet subscriber. An assumption of infringement is not enough. Based on the steps taken and evidence filed, I cannot conclude that direct infringement by the default internet subscribers has occurred.”

Voltage’s Backup Plan – Billpayers ‘Authorized’ Infringement

Voltage settlement actions always seek to maximize pressure on the internet bill payer. In the UK, their settlement letters state: “This letter assumes that you, as the account holder for the Infringing IP Address, were the user of the relevant device on the dates and time” the movie was shared.

Letters continue by noting that Voltage can bring court proceedings if it can show on the balance of probabilities that the bill payer was the direct infringer or that the bill payer “authorized or allowed” someone else to infringe Voltage’s rights using the broadband connection.

The concept of authorization in the UK turns on whether the defendant (in this case an internet billpayer) participated in a copyright infringement carried out by someone else in more than a minimal way, to the extent that they now bear some responsibility for the infringement itself. Authorization is interpreted broadly but in Twentieth Century Fox Film Corporation v Newzbin Limited, Justice Kitchin found that authorization does not extend to “mere enablement, assistance or even encouragement.”

Unlike in Canada, Voltage does not send any warning notices to UK billpayers, so arguing that they knew something about the infringement yet failed to stop it is much harder. However, the warning notice system in Canada doesn’t help Voltage either, because even when those notices have been sent to the billpayer, there is still a need for Voltage to establish a relationship between the billpayer and the infringer.

“To establish authorization in this context, in my view, consideration must be given to not only whether the Default Defendant had knowledge of the alleged infringing activity, but also the relationship and extent of control over the user and whether the internet subscriber had some ability to prevent the act of concern,” Justice Furlanetto writes.

GuardaLey’s Benjamin Perino views things very differently. He believes that home wifi routers must be passworded and billpayers should configure them with a blacklist to ban specified devices. A whitelist should also be in place to restrict access to specified devices alongside filtering to completely block BitTorrent traffic.

Of course, it’s entirely possible that the defaulting billpayers did take steps to prevent infringement but failed in some way. Maybe, faced with a complete lack of technical knowledge, they warned everyone in the house that if any pirating took place, there would be consequences? Maybe the infringer holds the ultimate power in the house, is a violent drunk, refuses to pay the bill, and can’t be reasoned with?

The truth is that Voltage doesn’t know and the Federal Court finds this problematic. If the movie company wants to take the authorization route it needs evidence to show that, perhaps obtained through some sort of discovery. In the meantime, Justice Furlanetto says there is insufficient evidence to ground a finding of infringement by authorization.

Conclusion

Given the above, three choices were available to the court – grant a default judgment, dismiss the action, or order the action to proceed to trial where the plaintiff can prove its case.

On the basis of the evidentiary deficiencies, Justice Furlanetto refused to issue a default judgment against the internet subscribers. She also declined to dismiss the action because if Voltage can come up with some proper evidence to identify the infringers (and/or show authorization), it may be able to progress its case.

With that in mind, Voltage was ordered to arrange a case management conference to set the next steps in advance of a trial. In the alternative, Voltage is free to address the evidence shortcomings highlighted by the Judge and return at a later date with a new motion for default judgment.

Justice Furlanetto’s order can be found here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

NASA says it’s ready for a fourth attempt to fuel the massive SLS rocket

“The teams have really done a great job addressing the issues we saw.”

NASA's SLS rocket is seen at sunrise on June 7, 2022, after its second trip to the launch site.

Enlarge / NASA's SLS rocket is seen at sunrise on June 7, 2022, after its second trip to the launch site. (credit: Trevor Mahlmann)

NASA has been attempting to conduct a critical fueling test of its Space Launch System rocket for nearly three months, and now the agency says it is ready to try again.

This will be NASA's fourth attempt to load the SLS rocket's first and second stages with liquid hydrogen and liquid oxygen and go deep into a countdown toward launch before ending the test at T-10 seconds. The space agency plans to call its team of engineers and technicians to their stations on Saturday evening and begin fueling operations on Monday morning, June 20.

"Our team is ready to go," said Charlie Blackwell-Thompson, NASA's launch director for the Artemis I mission, which represents a test flight for the SLS vehicle and Orion spacecraft. "We're really looking forward to getting back to this test and getting into it starting on Saturday evening and certainly looking forward to the tanking operation."

Read 7 remaining paragraphs | Comments

Today’s best deals: A bunch of Apple devices, Amazon Fire HD tablets, and more

Dealmaster also has Sonos speakers, “buy 2 get 1 free” sales, and wireless headphones.

Today’s best deals: A bunch of Apple devices, Amazon Fire HD tablets, and more

Enlarge (credit: Ars Technica)

It's Wednesday, which means the time has come for another Dealmaster. Our latest roundup of the best tech deals from around the web includes a variety of discounts on Apple devices. The Apple TV 4K, for instance, is down to $130 at various retailers, which is the lowest price we've tracked to date. The higher-capacity 64GB model, meanwhile, is down to a new low of $150. That's still a high price for a 4K media player—particularly when the latest Google Chromecast, our favorite 4K streaming stick, is currently on sale for $40—but if you've got cash to burn and prefer Apple's interface, this deal lessens the cost at least somewhat. Apple's set-top box isn't as smart as Google's streamer when it comes to proactively recommending content you might like and its lack of 120 Hz support is still disappointing. However, its hardware is more futureproof, its remote is much improved over past horrorshows, and, perhaps most notably, its UI isn't as riddled with ads as competing platforms like Amazon and Roku. It's still not a great value, but if you live in Apple's world and have been looking to upgrade, its price is a little more palatable here.

Speaking of overpriced-but-high-quality Apple devices, the company's AirPods Max are also on sale for $429. While this isn't an all-time low, the noise-canceling headphones don't fall to this price often, and the discount is still $120 off Apple's MSRP. We recommended the AirPods Max in a past guide to wireless noise-canceling headphones: Their design is on the bulky side, they can't fold up for easier storage, and they're oddly reliant on a thin charging case, but their powerful active noise cancelation and exceptionally clear sound are arguably the best we've heard from a wireless headphone. If you're an iPhone user and, again, can afford to pay up, this deal brings them closer in price to competing models from Sony, Bose, and the like. If you want a more affordable set of premium noise-cancelers, though, note that Sony's still-great WH-1000XM4 are currently discounted to $278.

Beyond that, the excellent iPad Mini is back down to $399, which matches the best price we've tracked (as well as the MSRP of the previous-gen model, but we digress). The latest Apple Pencil stylus is down to a joint-low of $99, while those who prefer the 16-inch MacBook Pro can get one for $200 off Apple's usual going rate. The free six-month Apple Music trial that we highlighted over the weekend is still going on as well, and both Target and Best Buy are running promotions that get you a $10 store gift card at no extra cost when you buy a $100 Apple gift card.

Read 2 remaining paragraphs | Comments