The Register's Jessica Lyons reports: Chinese state-sponsored spies have been spotted inside a global engineering firm's network, having gained initial entry using an admin portal's default credentials on an IBM AIX server. In an exclusive interview with The Register, Binary Defense's Director of Security Research John Dwyer said the cyber snoops first compromised one of the victim's three unmanaged AIX servers in March, and remained inside the US-headquartered manufacturer's IT environment for four months while poking around for more boxes to commandeer. It's a tale that should be a warning to those with long- or almost-forgotten machines connected to their networks; those with shadow IT deployments; and those with unmanaged equipment. While the rest of your environment is protected by whatever threat detection you have in place, these legacy services are perfect starting points for miscreants. This particular company, which Dwyer declined to name, makes components for public and private aerospace organizations and other critical sectors, including oil and gas. The intrusion has been attributed to an unnamed People's Republic of China team, whose motivation appears to be espionage and blueprint theft. It's worth noting the Feds have issued multiple security alerts this year about Beijing's spy crews including APT40 and Volt Typhoon, which has been accused of burrowing into American networks in preparation for destructive cyberattacks. After discovering China's agents within its network in August, the manufacturer alerted local and federal law enforcement agencies and worked with government cybersecurity officials on attribution and mitigation, we're told. Binary Defense was also called in to investigate. Before being caught and subsequently booted off the network, the Chinese intruders uploaded a web shell and established persistent access, thus giving them full, remote access to the IT network -- putting the spies in a prime position for potential intellectual property theft and supply-chain manipulation. If a compromised component makes it out of the supply chain and into machinery in production, whoever is using that equipment or vehicle will end up feeling the brunt when that component fails, goes rogue, or goes awry. "The scary side of it is: With our supply chain, we have an assumed risk chain, where whoever is consuming the final product -- whether it is the government, the US Department of the Defense, school systems â" assumes all of the risks of all the interconnected pieces of the supply chain," Dwyer told The Register. Plus, he added, adversarial nations are well aware of this, "and the attacks continually seem to be shifting left." That is to say, attempts to meddle with products are happening earlier and earlier in the supply-chain pipeline, thus affecting more and more victims and being more deep-rooted in systems. Breaking into a classified network to steal designs or cause trouble is not super easy. "But can I get into a piece of the supply chain at a manufacturing center that isn't beholden to the same standards and accomplish my goals and objectives?" Dwyer asked. The answer, of course, is yes. [...]

Read more of this story at Slashdot.

The House Energy and Commerce Committee has approved the AM for Every Vehicle Act, which mandates that automakers include AM radio in new vehicles without additional charges. The Verge reports: The bill passed the committee on a roll-call vote of 45-2 and now heads to the full House for final approval. The bill, titled the AM for Every Vehicle Act, would direct the National Highway Traffic Safety Administration (NHTSA) to issue a rule that "requires automakers to maintain AM broadcast radio in their vehicles without a separate or additional payment, fee, or surcharge." Supporters say they are pushing the bill out of a concern that the slow demise of AM radio could make it more difficult to broadcast emergency information during a natural disaster or other related events. Conservatives are also worried about losing a lucrative platform for right-wing news and media. [...] Automakers generally see AM radio as an obsolete technology, arguing that there are other, better technologies, such as internet streaming, HD radio delivered on FM bands, or some apps that provide AM content that will make up for the absence of AM radio in vehicles. Critics say the bill could also add to the costs of producing EVs at a time when many manufacturers are struggling to rein in their costs. "With a new mandate, [EV companies] will have to go through a significant powertrain redesign, vehicle redesign," Albert Gore, executive director of the Zero Emission Transportation Association, said in an interview earlier this year, "because of the degree to which electric motor generates this [electromagnetic] interference."

Read more of this story at Slashdot.

An anonymous reader quotes a report from TechCrunch: At its Made On YouTube event on Wednesday, the company announced a new dedicated space for creators to interact with their fans and viewers. The space, called "Communities," is kind of like a Discord server built into a creator's channel. With Communities, YouTube is hoping creators won't need to use other platforms like Discord or Reddit in order to interact with viewers. Communities are a space for viewers to post and interact with other fans directly within a creator's channel. In the past, viewers have been limited to leaving comments on a creator's video. Now, they can share their own content in a creator's Community to interact with other fans over shared interests. For instance, a fitness creator's Community could include posts from fans who are sharing videos and photos from their most recent hike. To start, the feature is only available to subscribers. The company sees Communities as a dedicated space for conversation and connection, while still allowing creators to maintain control over their content. Conversations in Communities are meant to flow over time, YouTube says, as they would in any other forum-style setting. The new Communities feature shouldn't be confused with YouTube's Community feature, which is a space for creators to share text and images with viewers. The feature launched back in 2016, and doesn't allow viewers to interact with each other. YouTube is testing Communities now on mobile devices with a small group of creators. The company plans to test the feature with more creators later this year before expanding access to additional channels in early 2025.

Read more of this story at Slashdot.

OpenAI truly does not want you to know what its latest AI model is "thinking." From a report: Since the company launched its "Strawberry" AI model family last week, touting so-called reasoning abilities with o1-preview and o1-mini, OpenAI has been sending out warning emails and threats of bans to any user who tries to probe how the model works. Unlike previous AI models from OpenAI, such as GPT-4o, the company trained o1 specifically to work through a step-by-step problem-solving process before generating an answer. When users ask an "o1" model a question in ChatGPT, users have the option of seeing this chain-of-thought process written out in the ChatGPT interface. However, by design, OpenAI hides the raw chain of thought from users, instead presenting a filtered interpretation created by a second AI model. Nothing is more enticing to enthusiasts than information obscured, so the race has been on among hackers and red-teamers to try to uncover o1's raw chain of thought using jailbreaking or prompt injection techniques that attempt to trick the model into spilling its secrets.

Read more of this story at Slashdot.

All seven independent directors of DNA-testing company 23andMe resigned Tuesday, following a protracted negotiation with founder and Chief Executive Anne Wojcicki over her plan to take the company private. WSJ: It is the latest challenge for 23andMe, which has struggled to find a profitable business model. The stock price fell to $0.30 per share after hours on Tuesday. At that price the company is worth less than the cash on its balance sheet. In a letter addressed to Wojcicki, the directors wrote that "after months of work, we have yet to receive from you a fully financed, fully diligenced, actionable proposal that is in the best interests of the non-affiliated shareholders." It is very rare for a publicly traded company to see so many directors resign simultaneously. The board members wrote that they differ with Wojcicki on the "strategic direction for the company" and because of her voting power, it was best that they resign. Wojcicki controls 49% of 23andMe votes, giving her a level of control that blocked board members from shopping the company to other potential bidders. She is the only remaining board member after the resignations. Further reading: 23andMe's Fall From $6 Billion To Nearly $0 (January 2024)

Read more of this story at Slashdot.

IBM has been laying off a substantial number of employees this week and is trying to keep it quiet, The Register reported Wednesday, citing its sources. From the report: One IBM employee told The Register that IBM Cloud experienced "a massive layoff" in the past few days that affected thousands of people. "Unlike traditional layoffs, this one was done in secret," the insider said. "My manager told me that they were required to sign an NDA not to talk about the specifics." Multiple posts on layoff-focused message boards and corroborating accounts with other sources familiar with the IT giant's operations suggest the cuts are large. Asked to confirm the layoffs, an IBM spokesperson told The Register, "Early this year, IBM disclosed a workforce rebalancing charge that would represent a very low single digit percentage of IBM's global workforce, and we still expect to exit 2024 at roughly the same level of employment as we entered with."

Read more of this story at Slashdot.

Apple's VP of camera software engineering Jon McCormack has affirmed the company's commitment to traditional photography in an interview, contrasting with Google's "memories" approach for Pixel cameras. (A Google executive said last month of the AI usage in the pictures Pixel smartphone owners take: "What some of these edits do is help you create the moment that is the way you remember it, that's authentic to your memory and to the greater context, but maybe isn't authentic to a particular millisecond.") The Verge: I asked Apple's VP of camera software engineering Jon McCormack about Google's view that the Pixel camera now captures "memories" instead of photos, and he told me that Apple has a strong point of view about what a photograph is -- that it's something that actually happened. It was a long and thoughtful answer, so I'm just going to print the whole thing: "Here's our view of what a photograph is. The way we like to think of it is that it's a personal celebration of something that really, actually happened. "Whether that's a simple thing like a fancy cup of coffee that's got some cool design on it, all the way through to my kid's first steps, or my parents' last breath, It's something that really happened. It's something that is a marker in my life, and it's something that deserves to be celebrated. "And that is why when we think about evolving in the camera, we also rooted it very heavily in tradition. Photography is not a new thing. It's been around for 198 years. People seem to like it. There's a lot to learn from that. There's a lot to rely on from that. "Think about stylization, the first example of stylization that we can find is Roger Fenton in 1854 -- that's 170 years ago. It's a durable, long-term, lasting thing. We stand proudly on the shoulders of photographic history." Further reading: 'There is No Such Thing as a Real Picture,' Says Samsung Exec.

Read more of this story at Slashdot.

International police forces have taken down an encrypted communication platform and arrested 51 people, marking a success for co-ordinated efforts to crack down on anonymous messaging services used by criminal groups. FT: Europol and law enforcement agencies from nine countries dismantled Ghost [non-paywalled source], an online platform which used three different encryption standards and allowed users to destroy all messages by sending a specific code, Europol announced on Wednesday. The crackdown is the latest operation by international agencies to decode encrypted messaging services used by criminals to manage their international operations, following the takedown of platforms such as EncroChat and Sky ECC in recent years. [...] McLean said Ghost was administered by a 32-year-old man from Australia, one of the operation's principal targets. As a result of the decryption operation, where officers broke the app's code so they could read users' messages, the death or injury of as many as 50 people could have been prevented, McLean said.

Read more of this story at Slashdot.

The Federal Reserve cut its benchmark interest rate by half a percentage point [non-paywalled source] on Wednesday and signalled more reductions would follow, launching its first easing cycle since the onset of the pandemic. Financial Times: The US central bank's first cut in more than four years leaves the federal funds rate at a range of 4.75 per cent. Michelle Bowman, a governor on the Federal Open Market Committee, voted against the decision, favouring a quarter-point reduction. The half-point cut is larger than the Fed's more customary quarter-point pace and suggests the US central bank is concerned about the prospects of a weakening economy after more than a year of holding rates at a 23-year high.

Read more of this story at Slashdot.

An anonymous reader shares a report: Last week, the FBI took control of a botnet made up of hundreds of thousands of internet-connected devices, such as cameras, video recorders, storage devices, and routers, which was run by a Chinese government hacking group, FBI director Christopher Wray and U.S. government agencies revealed Wednesday. The hacking group, dubbed Flax Typhoon, was "targeting critical infrastructure across the U.S. and overseas, everyone from corporations and media organizations to universities and government agencies," Wray said at the Aspen Cyber Summit cybersecurity conference on Wednesday. "But working in collaboration with our partners, we executed court-authorized operations to take control of the botnet's infrastructure," Wray said, explaining that once the authorities did that, the FBI also removed the malware from the compromised devices. "Now, when the bad guys realized what was happening, they tried to migrate their bots to new servers and even conducted a [Distributed Denial of Service] attack against us."

Read more of this story at Slashdot.

An anonymous reader shares a report: LinkedIn is using its users' data for improving the social network's generative AI products, but has not yet updated its terms of service to reflect this data processing, according to posts from various LinkedIn users and a statement from the company to 404 Media. Instead, the company says it will update its terms "shortly." The move is unusual in that LinkedIn appears to have gone ahead with training AI on its users' data, even creating a new option in its settings, without updating its terms of service, which is traditionally one of the main documents that can explain how users' data is collected or used.

Read more of this story at Slashdot.

Fossil fuel companies pumped at least $5.6bn of sponsorship money into motorsports, football, golf and even snow sports in an effort to "buy social licence to operate," according to a new report. From a report: Almost no major spectator sport remains untouched by oil and gas money, according to research carried out by the New Weather Institute (NWI), a climate thinktank, which traced more than 200 sponsorship deals between sports teams and the industry. In addition, sports stars such as Cristiano Ronaldo, Lionel Messi, Tyson Fury and Anthony Joshua have all been successfully recruited to spend time in the Middle East as part of sponsorship deals, the report says. It comes as concern grows about the fossil fuel industry's increasing efforts to launder its global standing through "sportswashing" -- a practice, long used by nation states, of building associations with sporting events to improve tarnished reputations. In 2023, Mohammed bin Salman, the crown prince of Saudi Arabia, said: "If sportswashing is going to increase my GDP by 1%, then we'll continue doing sportswashing." According to NWI's Dirty Money report, Aramco, Saudi Arabia's national oil company, was the biggest single investor in sports sponsorship identified by NWI's report, handing out almost $1.3bn across 10 deals. The petrochemical company Ineos was second, with $777m in sponsorship deals; Shell had sponsored sports to the tune of $470m; and TotalEnergies, France's leading oil company, had $340m in deals.

Read more of this story at Slashdot.

An anonymous reader shares a report: Israel blew up thousands of two-way personal radios used by Hezbollah members in Lebanon in a second wave of an intelligence operation that started on Tuesday with the explosions of pager devices, two sources with knowledge of the operation told Axios. The second wave of clandestine attacks is another serious security breach in Hezbollah's ranks and increases the pressure on the militant Lebanese group. Lebanon's official news agency reported that at least three people were killed and dozens wounded in the explosions across the country. The walkie-talkies were booby-trapped in advance by Israeli intelligence services and then delivered to Hezbollah as part of the militia's emergency communications system, which was supposed to be used during a war with Israel, the sources said. Associated Press reports: Lebanon's official news agency reports that solar energy systems exploded in homes in several areas of Beirut and in southern Lebanon, wounding at least one girl.

Read more of this story at Slashdot.

YouTube has announced a series of AI-related features on the platform, including a couple that might change how creators make videos -- and the videos they make. From a report: The first feature is the new Inspiration tab in the YouTube Studio app, which YouTube has been testing in a limited way over the last few months. The tab's job is, essentially, to tell you what to make: the AI-powered tool will suggest a concept for a video, provide a title and a thumbnail, and even write an outline and the first few lines of the video for you. YouTube frames it as a helpful brainstorming tool but also acknowledges that you can use it to build out entire projects. And I'm just guessing here, but I'd bet those AI-created ideas are going to be pretty darn good at gaming the YouTube algorithm. Once you have some AI inspiration, you can make some AI videos with Veo, the superpowerful DeepMind video model that is now being integrated into YouTube Shorts. Veo is mostly going to be part of the "Dream Screen" feature YouTube has been working on, which is an extension of the green screen concept but with AI-generated backgrounds of all sorts. You'll also be able to make full Veo videos, too, but only with clips up to six seconds long. (After a few seconds, AI video tends to get... really weird.)

Read more of this story at Slashdot.

The entertainment company behind "The Hunger Games" and "Twilight" plans to start using generative AI in the creation of its new movies and TV shows, a sign of the emerging technology's advance in Hollywood. From a report: Lions Gate Entertainment has agreed to give Runway, one of several fast-evolving AI startups, access to its content library in exchange for a new, custom AI model that the studio can use in the editing and production process. The deal -- the first of its kind for Runway and one that could become a blueprint in the entertainment industry -- comes as creatives, actors and studio executives debate whether to use the new technology and how to protect their copyright material. Advocates say generative AI can enhance creators' work and help a cash-strapped industry save time and money. Michael Burns, vice chairman of Lionsgate Studio, expects the company to be able to save "millions and millions of dollars" from using the new model. The studio behind the "John Wick" franchise and "Megalopolis" plans to initially use the new AI tool for internal purposes like storyboarding -- laying out a series of graphics to show how a story unfolds -- and eventually creating backgrounds and special effects, like explosions, for the big screen.

Read more of this story at Slashdot.

An anonymous reader quotes a report from CBC News: Inside a bustling unit at St. Michael's Hospital in downtown Toronto, one of Shirley Bell's patients was suffering from a cat bite and a fever, but otherwise appeared fine -- until an alert from an AI-based early warning system showed he was sicker than he seemed. While the nursing team usually checked blood work around noon, the technology flagged incoming results several hours beforehand. That warning showed the patient's white blood cell count was "really, really high," recalled Bell, the clinical nurse educator for the hospital's general medicine program. The cause turned out to be cellulitis, a bacterial skin infection. Without prompt treatment, it can lead to extensive tissue damage, amputations and even death. Bell said the patient was given antibiotics quickly to avoid those worst-case scenarios, in large part thanks to the team's in-house AI technology, dubbed Chartwatch. "There's lots and lots of other scenarios where patients' conditions are flagged earlier, and the nurse is alerted earlier, and interventions are put in earlier," she said. "It's not replacing the nurse at the bedside; it's actually enhancing your nursing care." A year-and-a-half-long study on Chartwatch, published Monday in the Canadian Medical Association Journal, found that use of the AI system led to a striking 26 percent drop in the number of unexpected deaths among hospitalized patients. The research team looked at more than 13,000 admissions to St. Michael's general internal medicine ward -- an 84-bed unit caring for some of the hospital's most complex patients -- to compare the impact of the tool among that patient population to thousands of admissions into other subspecialty units. "At the same time period in the other units in our hospital that were not using Chartwatch, we did not see a change in these unexpected deaths," said lead author Dr. Amol Verma, a clinician-scientist at St. Michael's, one of three Unity Health Toronto hospital network sites, and Temerty professor of AI research and education in medicine at University of Toronto. "That was a promising sign." The Unity Health AI team started developing Chartwatch back in 2017, based on suggestions from staff that predicting deaths or serious illness could be key areas where machine learning could make a positive difference. The technology underwent several years of rigorous development and testing before it was deployed in October 2020, Verma said. Dr. Amol Verma, a clinician-scientist at St. Michael's Hospital who helped lead the creation and testing of CHARTwatch, stands at a computer. "Chartwatch measures about 100 inputs from [a patient's] medical record that are currently routinely gathered in the process of delivering care," he explained. "So a patient's vital signs, their heart rate, their blood pressure ... all of the lab test results that are done every day." Working in the background alongside clinical teams, the tool monitors any changes in someone's medical record "and makes a dynamic prediction every hour about whether that patient is likely to deteriorate in the future," Verma told CBC News.

Read more of this story at Slashdot.

Longtime Slashdot reader theodp writes: Python in Excel is now generally available for Windows users of Microsoft 365 Business and Enterprise," Microsoft announced in a Monday blog post. "Last August, in partnership with Anaconda, we introduced an exciting new addition to Excel by integrating Python, making it possible to seamlessly combine Python and Excel analytics within the same workbook, no setup required. Since then, we've brought the power of popular Python analytics libraries such as pandas, Matplotlib, and NLTK to countless Excel users." Microsoft also announced the public preview of Copilot in Excel with Python, which will take users' natural language requests for analysis and automatically generate, explain, and insert Python code into Excel spreadsheets. While drawing criticism for limiting Python execution to locked-down Azure cloud containers, Python in Excel has also earned accolades from the likes of Python creator Guido van Rossum, now a Microsoft Distinguished Engineer, as well as Pandas creator Wes McKinney. Left unmentioned in Monday's announcement is that Microsoft managed to convince the USPTO to issue it a patent in July 2024 on the Enhanced Integration of Spreadsheets With External Environments (alt. source), which Microsoft explains covers the "implementation of enhanced integrations of native spreadsheet environments with external resources such as-but not limited to-Python." All of which may come as a surprise to software vendors and individuals that were integrating Excel and external programming environments years before Microsoft filed its patent application in September 2022.

Read more of this story at Slashdot.

Neuralink said on Tuesday it has received the FDA's "breakthrough device" designation for its experimental implant aimed at restoring vision. Called Blindsight, the device "will enable even those who have lost both eyes and their optic nerve to see," said Neuralink founder Elon Musk. Reuters reports: The FDA's breakthrough tag is given to certain medical devices that provide treatment or diagnosis of life-threatening conditions. It is aimed at speeding up development and review of devices currently under development. Neuralink did not immediately respond to a request seeking details about when it expects the Blindsight device to move into human trials.

Read more of this story at Slashdot.

Anders sends us an example which isn't precisely a WTF. It's just C handling C strings. Which, I guess, when I say it that way, is a WTF.

while(modPath != NULL) { p = strchr(modPath, ':'); if(p != NULL) { *p++ = '\0'; } dvModpathCreate(utSymCreate(modPath)); modPath = p; } while(modPath != NULL);

We start with a variable called modPath which points to a C string. So long as modPath is not null, we're going to search through the string.

The string is in a : separated format, e.g., foo:bar:goo. We want to split it. This function does this by being very C about it.

It uses strchr to find the address of the first colon. If we think about this in C strings, complete with null terminators, it looks something like this:

"foo:bar:goo\0" ^ ^ | | | p modPath

We then replace : with \0 and increment p, doing a "wonderful" blend of using the dereference operator and the post-increment operator and an assignment to accomplish a lot in one line.

"foo\0bar:goo\0" ^ ^ | | | p modPath

So now, modPath points at a terminated string foo, which we then pass down through some functions. Then we set it equal to p.

"foo\0bar:goo\0" ^ | p modPath

This repeats until strchr doesn't find a :, at which point it returns NULL. Our loop is guarded by a check that modPath (which gets set equal to p) can't be null, so that breaks us out of the loop.

And enters us immediately into another, single line loop with no body, which immediately exits as well. I suspect that originally this was written as a do{}while, and then someone realized that it could just be a plain while{}, and completely forgot to remove the second while clause.

This is, honestly, a pretty common idiom in C. It's arguably wrong to even put it here; aside from the bad while clause, you'll see this kind of string handling all the time. But, maybe, that is the WTF.

[Advertisement] Continuously monitor your servers for configuration changes, and report when there's configuration drift. Get started with Otter today!

An anonymous reader shares a report: Per a recent update to Microsoft's Deprecated Windows features page, Legacy DRM services utilized by Windows Media Player and Silverlight clients for Windows 7 and Windows 8 are now deprecated. This will prevent the streaming or playback of DRM-protected content in those applications on those operating systems. It also includes playing content from personal CD rips and streaming from a Silverlight or Windows 8 client to an Xbox 360 if you were still doing that. For those unfamiliar, "DRM" refers to Digital Rights Management. Basically, DRM tech ensures that you aren't stealing or playing back pirated content. Of course, piracy still exists, but these days, most officially distributed movies, TV shows, games, etc., all involve some form of DRM unless explicitly advertised as DRM-free. DRM does seem like harmless piracy prevention on paper. Still, it hasn't been all that effective at eliminating piracy -- and where it is implemented, it mainly punishes or inconveniences paying customers. It is an excellent example of DRM's folly. Now, anyone who had previously opted into Microsoft's legitimate media streaming ecosystem with Windows 7 and 8 is being penalized for buying media legitimately since it will no longer work without them being forced to pivot to other streaming solutions.

Read more of this story at Slashdot.