Month: September 2022

Enlarge (credit: Bloomberg / Contributor | Bloomberg)

After a TikTok accusing Patreon of ignoring reports and knowingly profiting off accounts posting child sexual abuse materials (CSAM) attracted hundreds of thousands of views, more TikTokers piled on, generating more interest. Patreon immediately responded by branding the TikToks as disinformation. In a blog, Patreon denied allegations, accusing TikTokers of spreading a "conspiracy that Patreon knowingly hosts illegal and child-exploitative material."

According to Patreon, the conspiracy theory sprang from a fake post on a job-posting site; Vice later reported that site was Glassdoor. The Glassdoor review was posted in August and claimed that Patreon refused to respond to reports of accounts suspected of "selling lewd photographs" of children. As TikTokers described their failed attempts to report these accounts, Patreon laid off members of its security team and, Patreon said, "onlookers inaccurately linked" the "small-scale staffing changes we made last week to our security organization." The TikTokers claimed that Patreon laid off its staff specifically for not complying with orders to allow CSAM to stay on the platform.

"Dangerous and conspiratorial disinformation began circulating on social media recently," Patreon said. "We want to let all of our creators and patrons know that these claims are unequivocally false and set the record straight."

Longtime console hacker CTurt has blasted what he calls an "essentially unpatchable" hole in the security of the PS4 and PS5, detailing a proof-of-concept method that should allow for the installation of arbitrary homebrew applications on the consoles.

CTurt says he disclosed his exploit, dubbed Mast1c0re, to Sony via a bug bounty program a year ago without any sign of a public fix. The method exploits errors in the just-in-time (JIT) compilation used by the emulator that runs certain PS2 games on the PS4 (and PS5). That compilation gives the emulator special permissions to continually write PS4-ready code (based on the original PS2 code) just before the application layer itself executes that code.

By gaining control of both sides of that process, a hacker can write privileged code that the system treats as legitimate and secure. "Since we're using the JIT system calls for their intended purpose, it's not really an exploit, just a neat trick," CTurt said of a since-patched JIT exploit on the PS4's web browser.

Enlarge / Using Teams in a browser is actually safer than using Microsoft's desktop apps, which are wrapped around a browser. It's a lot to work through. (credit: Jernej Furman / Flickr)

Microsoft's Teams client stores users' authentication tokens in an unprotected text format, potentially allowing attackers with local access to post messages and move laterally through an organization, even with two-factor authentication enabled, according to a cybersecurity company.

Vectra recommends avoiding Microsoft's desktop client, built with the Electron framework for creating apps from browser technologies, until Microsoft has patched the flaw. Using the web-based Teams client inside a browser like Microsoft Edge is, somewhat paradoxically, more secure, Vectra claims. The reported issue affects Windows, Mac, and Linux users.

Microsoft, for its part, believes Vectra's exploit "does not meet our bar for immediate servicing" since it would require other vulnerabilities to get inside the network in the first place. A spokesperson told Dark Reading that the company will "consider addressing (the issue) in a future product release."

• 

  Discord's Forum Channels feature. [credit: Discord ]

Discord announced a new feature on Wednesday called "Forum Channels" to allow for more organized and asynchronous discussions within servers.

The intent with Forum Channels seems to be to make it easier for specific conversations to continue for extended periods without the worry that a topic change or another simultaneous conversation will bury a subject in the annals of chat log history.

The feature will most benefit large servers, where multiple, simultaneous, open-ended conversations can make it hard to keep up. Often, members of these servers might just mute channels because they become overwhelming, or they might lose the plot on conversations they care about when they step away for a few minutes.

Enlarge (credit: Google)

Google CEO Sundar Pichai seems to be on a cost-cutting mission. After he said that the company's productivity was "not where it needs to be" in July, Google axed the Google Hardware laptop division and spun off what was left of Project Loon to try to survive as an independent company. The latest move is aimed at Google Area 120 "idea incubator" group, which Bloomberg reports is being cut by half.

Area 120 launched in 2016. The motto on the group's website says, "At Area 120, we work on 20% projects 100% of the time." Google gives employees 20 percent free time to work on interesting projects, and it sounds like if they land on a good idea, Area 120 spins up a group project around it.

We've mentioned the group a few times here at Ars, mostly for the "Google Reply" experiment that brought AI-generated quick replies to any instant messaging service. Reply was openly called an "experiment" and was a real hack job of an app, but today, the feature is a standard part of Android, which counts as a big success. A project management app called "Tables" was successful enough that Google is working on a full Google Workspace app based on the idea. GameSnacks, an Area 120 HTML5 game platform for users in developing countries with low bandwidth, has over 35 million users.

Enlarge / Still from a demo video showing ACT-1 performing a search on Redfin.com in a browser when asked to "find me a house." (credit: Adept)

Yesterday, California-based AI firm Adept announced Action Transformer (ACT-1), an AI model that can perform actions in software like a human assistant when given high-level written or verbal commands. It can reportedly operate web apps and perform intelligent searches on websites while clicking, scrolling, and typing in the right fields as if it were a person using the computer.

In a demo video tweeted by Adept, the company shows someone typing, "Find me a house in Houston that works for a family of 4. My budget is 600K" into a text entry box. Upon submitting the task, ACT-1 automatically browses Redfin.com in a web browser, clicking the proper regions of the website, typing a search entry, and changing the search parameters until a matching house appears on the screen.

Another demonstration video on Adept's website shows ACT-1 operating Salesforce with prompts such as "add Max Nye at Adept as a new lead" and "log a call with James Veel saying that he's thinking about buying 100 widgets." ACT-1 then clicks the right buttons, scrolls, and fills out the proper forms to finish these tasks. Other demo videos show ACT-1 navigating Google Sheets, Craigslist, and Wikipedia through a browser.

Enlarge (credit: Getty Images | Yuichiro Chino)

Ethereum developers today executed the "Merge," an upgrade that eliminates mining and dramatically reduces the energy consumption of the world's second-biggest cryptocurrency. Today's action "completed Ethereum's transition to proof-of-stake consensus, officially deprecating proof-of-work and reducing energy consumption by ~99.95 percent," the Ethereum.org Merge page said.

The Ethereum blockchain has existed since July 2015, and planning for today's change has been in the works for several years. Because a botched transition could have caused chaos, Ethereum developers over the past year have "repeatedly pushed back the date of 'the Merge' to give themselves more time to prepare," as Ars writer Timothy B. Lee previously wrote in a detailed feature on the transition. The Merge will "put the world's Ethereum miners out of work," as the new system doesn't require the powerful graphics cards previously needed to maintain the blockchain and create new ether, Lee wrote.

The switch was highly anticipated. "When the Merge officially kicked in at 6:43 a.m. UTC, more than 41,000 people were tuned in on YouTube to an 'Ethereum Mainnet Merge Viewing Party,'" CoinDesk wrote. "They watched with bated breath as key metrics trickled in suggesting that Ethereum's core systems had remained intact. After about 15 long minutes, the Merge officially finalized, meaning it could be declared a success."

Enlarge (credit: Evgen Kotenko/Getty Images)

Yurii Shchyhol doesn’t have a lot of time to spare.

The head of the Derzhspetszviazok, Ukraine’s version of the US Cybersecurity and Infrastructure Security Agency, can be forgiven for working speedily. His country is under attack—and with it, the world order. “This is the first time ever in history that we’ve had such a full-fledged cyberwar happening right now in Ukraine,” says Shchyhol, who’s tasked with keeping Ukraine’s cyber territory safe in the same way president Volodymyr Zelensky oversees the country’s physical armed forces.

Skirmishes on the internet against Russian hackers weren’t new to Shchyhol, nor to the people he oversees as part of the Derzhspetszviazok, also known as the State Service of Special Communications and Information Protection. Before invading Ukraine on February 24, Russia had been testing the defenses of Ukraine’s cybersecurity. Mostly it was persistent, low-level attacks, but one larger attack was launched on January 14, when Russia targeted more than 20 Ukrainian government institutions. The attack, designed to disrupt government-linked websites, leached out into the wider Ukrainian internet. “We also identified that around 90 websites were not accessible as a result of that attack,” says Shchyhol. “The goal of the Russian hackers was to sow panic among the Ukrainian population, and to demonstrate to the outside world that Ukraine is a weak state that couldn’t handle the attacks,” he says. This is why the Derzhspetszviazok rushed to relaunch the sites affected. “The longest it took us for one site was close to one week,” he says. “No data was lost, and the outcome of this attack was more psychological warfare.”