WhatsApp finally forces Pegasus spyware maker to share its secret code

Israeli spyware maker loses fight to only share information on installation.

WhatsApp finally forces Pegasus spyware maker to share its secret code

Enlarge (credit: NurPhoto / Contributor | NurPhoto)

WhatsApp will soon be granted access to explore the "full functionality" of the NSO Group's Pegasus spyware—sophisticated malware the Israeli Ministry of Defense has long guarded as a "highly sought" state secret, The Guardian reported.

Since 2019, WhatsApp has pushed for access to the NSO's spyware code after alleging that Pegasus was used to spy on 1,400 WhatsApp users over a two-week period, gaining unauthorized access to their sensitive data, including encrypted messages. WhatsApp suing the NSO, Ars noted at the time, was "an unprecedented legal action" that took "aim at the unregulated industry that sells sophisticated malware services to governments around the world."

Initially, the NSO sought to block all discovery in the lawsuit, "due to various US and Israeli restrictions," but that blanket request was denied. Then, last week, the NSO lost another fight to keep WhatsApp away from its secret code.

Read 12 remaining paragraphs | Comments

Huge funding round makes “Figure” Big Tech’s favorite humanoid robot company

Investors Microsoft, OpenAI, Nvidia, Jeff Bezos, and Intel value Figure at $2.6B.

The Figure 01 and a few spare parts. Obviously they are big fans of aluminum.

Enlarge / The Figure 01 and a few spare parts. Obviously they are big fans of aluminum. (credit: Figure)

Humanoid robotics company Figure AI announced it raised an astounding $675 million in a funding round from an all-star cast of Big Tech investors. The company, which aims to commercialize a humanoid robot, now has a $2.6 billion valuation. Participants in the latest funding round include Microsoft, the OpenAI Startup Fund, NVIDIA, Jeff Bezos' Bezos Expeditions, Parkway Venture Capital, Intel Capital, Align Ventures, and ARK Invest. With all these big-name investors, Figure is officially Big Tech's favorite humanoid robotics company. The manufacturing industry is taking notice, too. In January, Figure even announced a commercial agreement with BMW to have robots work on its production line.

"In conjunction with this investment," the press release reads, "Figure and OpenAI have entered into a collaboration agreement to develop next generation AI models for humanoid robots, combining OpenAI's research with Figure's deep understanding of robotics hardware and software. The collaboration aims to help accelerate Figure's commercial timeline by enhancing the capabilities of humanoid robots to process and reason from language."

With all this hype and funding, the actual robot must be incredible, right? Well, the company is new and only unveiled its first humanoid "prototype," the "Figure 01," in October. At that time the company said it represented about 12 months of work. With veterans from "Boston Dynamics, Tesla, Google DeepMind, and Archer Aviation," the company has a strong starting point.

Read 5 remaining paragraphs | Comments

Apple changes course, will keep iPhone EU web apps how they are in iOS 17.4

Alternative browsers can pin web apps, but they only run inside Apple’s WebKit.

EU legislation has pushed a number of changes previously thought unthinkable in Apple products, including USB-C ports in iPhones sold in Europe.

Enlarge / EU legislation has pushed a number of changes previously thought unthinkable in Apple products, including USB-C ports in iPhones sold in Europe. (credit: Getty Images)

Apple has changed its stance on allowing web apps on iPhones and iPads in Europe and will continue to let users put them on their home screens after iOS 17.4 arrives. They will, however, have to be "built directly on WebKit and its security architecture," rather than running in alternative browsers, which is how it had worked up until new legislation forced the issue.

After the European Union's Digital Markets Act (DMA) demanded Apple open up its mobile devices to alternative browser engines, the company said it would remove the ability to install home screen web apps entirely. In a developer Q&A section, under the heading "Why don't users in the EU have access to Home Screen web apps?", Apple said that "the complex security and privacy concerns" of non-native web apps, and what addressing them would require "given the other demands of the DMA and the very low user adoption of Home Screen web apps," made it so that the company "had to remove the Home Screen web apps feature in the EU." Any web app installed on a user's home screen would have simply led them back to their preferred web browser.

Apple further warned against "malicious web apps," which, without the isolation built into its WebKit system, could read data, steal permissions from other web apps, and install further web apps without permission, among other concerns.

Read 7 remaining paragraphs | Comments

Daily Deals (3-01-2024)

Best Buy is running a 3-day sale this Friday, Saturday, and Sunday with discounts on laptops, tablets, and a whole bunch of other products… although some of the best deals that are listed as part of the sale have actually been live for a while. …

Best Buy is running a 3-day sale this Friday, Saturday, and Sunday with discounts on laptops, tablets, and a whole bunch of other products… although some of the best deals that are listed as part of the sale have actually been live for a while. For example the Asus ROG Ally handheld gaming PC for […]

The post Daily Deals (3-01-2024) appeared first on Liliputing.

Hugging Face, the GitHub of AI, hosted code that backdoored user devices

Malicious submissions have been a fact of life for code repositories. AI is no different.

Photograph depicts a security scanner extracting virus from a string of binary code. Hand with the word "exploit"

Enlarge (credit: Getty Images)

Code uploaded to AI developer platform Hugging Face covertly installed backdoors and other types of malware on end-user machines, researchers from security firm JFrog said Thursday in a report that’s a likely harbinger of what’s to come.

In all, JFrog researchers said, they found roughly 100 submissions that performed hidden and unwanted actions when they were downloaded and loaded onto an end-user device. Most of the flagged machine learning models—all of which went undetected by Hugging Face—appeared to be benign proofs of concept uploaded by researchers or curious users. JFrog researchers said in an email that 10 of them were “truly malicious” in that they performed actions that actually compromised the users’ security when loaded.

Full control of user devices

One model drew particular concern because it opened a reverse shell that gave a remote device on the Internet full control of the end user’s device. When JFrog researchers loaded the model into a lab machine, the submission indeed loaded a reverse shell but took no further action.

Read 17 remaining paragraphs | Comments

KDE Plasma 6 Mobile UI for mobile Linux distros brings homescreen, navigation, and desktop mode improvements

This weeks the developers behind the KDE plasma desktop environment for Linux-based operating systems released Plasma 6, the biggest update in 10 years. While the free and open source user interface is most commonly used on desktop operating systems, …

This weeks the developers behind the KDE plasma desktop environment for Linux-based operating systems released Plasma 6, the biggest update in 10 years. While the free and open source user interface is most commonly used on desktop operating systems, there’s also a Plasma Mobile version for use on supported smartphones and tablets, and the Plasma […]

The post KDE Plasma 6 Mobile UI for mobile Linux distros brings homescreen, navigation, and desktop mode improvements appeared first on Liliputing.

Piracy Moghul Aniwatch Rebrands to HiAnime

The massively popular anime pirate site Aniwatch has a new name. The site, which was known as Zoro.to just a year ago, just rebranded to HiAnime. The site’s staff doesn’t explain the latest brand switch but a recent ‘dynamic+’ site blocking order in India may have factored into their decision. With well over 100 million monthly visits globally, there is a lot at stake.

From: TF, for the latest news on copyright battles, piracy and more.

hianimeAnime is growing globally as an entertainment category and this popularity surge isn’t limited to legal platforms.

Today, several of the world’s largest pirate sites are exclusively dedicated to anime. This includes Aniwatch.to, the streaming portal that operated as Zoro.to earlier last year.

The streaming portal, which is arguably the largest pirate site in the world, is a prime target for anti-piracy groups. The Alliance for Creativity and Entertainment (ACE), for example, is actively trying to shut the platform down, which they believe is operated from Vietnam.

Last year, ACE had its sights set on shutting down the rogue operation. And indeed, it managed to take over the domain name Zoro.to, but not before the site had rebranded to Aniwatch.to. Under that new brand, business continued as usual.

ACE and others kept up the pressure and in recent months branded Aniwatch one of the most notorious pirate sites. However, taking it offline is easier said than done.

Zoro -> Aniwatch -> HiAnime

A few hours ago, Aniwatch users were in for a surprise as the anime streaming portal rebranded again. Instead of Aniwatch, the site formerly known as Zoro will now continue under the name HiAnime.

Users who try to access the old Aniwatch.to domain name are redirected to the new domain name automatically.

hianime

With the previous rebrand, the operators said that the site was being acquired by a new team. There are no such mentions today. Neither is there an explanation for the move but users are assured that their information remains intact.

“All data and information shall be transferred and shall remain the same as before. User accounts and watchlist records shall thus remain unchanged,” a message in the site’s Discord reads.

rebrand

Why Now?

Without an official explanation, we can only speculate as to why the operators have decided to adopt another new brand. It’s unlikely that this is a facade to confuse anti-piracy groups, as they’re not easily fooled anymore.

What would make more sense is that the new brand and domain are an attempt to evade blocking efforts, at least temporarily. This includes advertising blacklists and site-blocking efforts, including one issued in India recently.

As reported last week, the High Court in New Delhi, India, issued a dynamic+ blocking injunction that requires local ISPs to block several pirate domains, including Aniwatch.to. Since nearly a quarter of all the site’s visits come from India, this order may have quite an impact on the site.

Whether a ‘rebrand’ will be sufficient to evade this order is unclear though, as these dynamic orders can be updated with new domains, precisely to deal with these types of situations.

H*anime Confusion

Whatever the reason, the site’s users are not as shocked by the new name as they were last time. Changes generally elicit some backlash and that’s also the case here. However, most of the critique we’ve seen stems from the similarity to another anime-themed site.

Several users note that Hianime is only a typo away from Hanime, which is an adult-themed site focusing on Hentai content. In fact, the logo reads “Hanime” as the first “i” is replaced by an exclamation mark.

“Cool rebrand and all but…. You decided to pick Hanime I thought I was on a very different website for a minute..,” one user writes.

hanime

The good news is that both sites use different TLDs which makes it less likely that people will end up at the wrong site. And even if any more serious brand clashes emerge, the site can always pick another name and try again. They know how it works by now.

From: TF, for the latest news on copyright battles, piracy and more.

MSI Claw is up for pre-order, ships March 12 (First handheld gaming PC with Intel Meteor Lake)

The first handheld gaming PC powered by an Intel Meteor Lake processor with Intel Arc integrated graphics is almost here. Customers in the US can now pre-order the MSI Claw for $699 and up, and it’s expected to begin shipping on March 12, 2024. …

The first handheld gaming PC powered by an Intel Meteor Lake processor with Intel Arc integrated graphics is almost here. Customers in the US can now pre-order the MSI Claw for $699 and up, and it’s expected to begin shipping on March 12, 2024. All models of the MSI Claw features a 7 inch, 1920 […]

The post MSI Claw is up for pre-order, ships March 12 (First handheld gaming PC with Intel Meteor Lake) appeared first on Liliputing.

Judge mocks X for “vapid” argument in Musk’s hate speech lawsuit

Judge to X lawyer: “I’m trying to figure out in my mind how that’s possibly true.”

Judge mocks X for “vapid” argument in Musk’s hate speech lawsuit

Enlarge (credit: NurPhoto / Contributor | NurPhoto)

It looks like Elon Musk may lose X's lawsuit against hate speech researchers who encouraged a major brand boycott after flagging ads appearing next to extremist content on X, the social media site formerly known as Twitter.

X is trying to argue that the Center for Countering Digital Hate (CCDH) violated the site's terms of service and illegally accessed non-public data to conduct its reporting, allegedly posing a security risk for X. The boycott, X alleged, cost the company tens of millions of dollars by spooking advertisers, while X contends that the CCDH's reporting is misleading and ads are rarely served on extremist content.

But at a hearing Thursday, US district judge Charles Breyer told the CCDH that he would consider dismissing X's lawsuit, repeatedly appearing to mock X's decision to file it in the first place.

Read 21 remaining paragraphs | Comments