Photographer Using FaceTime to Take Portraits During Lockdown

Lockdown is hard for everyone, including creative people used to being out and about playing music or creating art. One photographer, Tim Dunk, found a way to keep taking portraits – using FaceTime. He explained how on Peta Pixel.

I then had an idea to sustain myself creatively and socially, and threw it out to a few contacts — maybe with the use of some common apps and bits of tech, I could continue to make work. Using FaceTime, a MacBook Pro, and my subject using an iPhone under instruction, I was able to make portraits of people in isolation, distanced from the world and the people that make it up. I’ve been lucky enough that my FaceTime portraits have really caught folk’s attention, and I’ve been fielding a lot of questions from other photographers.

Jack Dorsey Donates $1 Billion to COVID-19 Relief

Twitter and Square founder Jack Dorsey announced Tuesday that he has moved $1 billion worth of Square equity into an LLC to fund COVID-19 relief, NBC News reported. This equates to around 28 percent of his total net-worth.

Dorsey’s investment in coronavirus relief is the most significant financial pledge by a private individual to date. Several other current and former tech executives, including Bill Gates and Jeff Bezos, have each pledged $100 million. Unlike other donors, Dorsey also promised to keep a consistently updated public record of all the donations. Once the pandemic is over, Dorsey said, the rest of the $1 billion will be dedicated to “girl’s health and education, and UBI,” which is short for Universal Basic Income, a program that calls for each person to receive a certain amount of money from the government every month.

Will Apple Kill Beats? Probably Not This Year

As shared by The Loop, there is some speculation on whether Apple will end the Beats brand. iMore says Apple should kill it, while 9to5Mac claims to have learned there is no plan to kill it. It started because of a separate rumor that Apple will release over-the-ear headphones under the AirPods brand. Quote from the iMore piece:

If Apple is truly planning to release over-the-ear noise-canceling pair of headphones similar to the Bose 700 has Jon Prosser suggests, it would be incredibly redundant to continue to release Beats as well. The Apple brand is just more valuable to Apple than the Beats brand — plain and simple.

My two cents is that Apple will probably phase out Beats, but not this year. It will be a gradual process over the next 10 years, like how the iPod touch still gets an occasional refresh but otherwise isn’t mentioned. You can’t kill a brand like Beats overnight. Once over-the-ear AirPods come out, and they will, phase one will be complete. There will be an AirPod for each Beats category, because you can’t leave customers hanging without alternatives, thank you very much.

Russia Implicated in BGP Hijacking Incident This Week

Russian telecom company Rostelecom is implicated in a BGP hijacking incident which rerouted network traffic from Akamai, Amazon, Facebook, Google, and others.

BGP stands for the Border Gateway Protocol and is the de-facto system used to route internet traffic between internet networks across the globe…

BGPMon founder Andree Toonk is giving the Russian telco the benefit of the doubt. On Twitter, Toont said he believes the “hijack” happened after an internal Rostelecom traffic shaping system might have accidentally exposed the incorrect BGP routes on the public internet, rather than Rostelecom’s internal network…

But, as many internet experts have also pointed out in the past, it is possible to make an intentional BGP hijack appear as an accident, and nobody could tell the difference.

Facebook Tried to Buy a Hacking Tool to Spy on iPhone Users

According to court filings, when Facebook was in the early stages of building its spyware VPN called Onavo Protect, it noticed that it wasn’t as effective on Apple devices as it was on Android. So Facebook approached a hacking group called NSO Group to use its Pegasus malware.

According to the court documents, it seems the Facebook representatives were not interested in buying parts of Pegasus as a hacking tool to remotely break into phones, but more as a way to more effectively monitor phones of users who had already installed Onavo.

Zoom’s Encryption is Linked to Chinese Servers

Researchers found that Zoom uses its own encryption scheme, sometimes using keys issued by China.

Some of the key management systems — 5 out of 73, in a Citizen Lab scan — seem to be located in China, with the rest in the United States. Interestingly, the Chinese servers are at least sometimes used for Zoom chats that have no nexus in China. The two Citizen Lab researchers, Bill Marczak and John Scott-Railton, live in the United States and Canada. During a test call between the two, the shared meeting encryption key “was sent to one of the participants over TLS from a Zoom server apparently located in Beijing,” according to the report.

I don’t have further commentary on Zoom, other than asking, “How will this end?”

iPhone Accessory Maker Gamevice Wants to Ban Nintendo Switch From US

Gamevice makes game controllers for iPhones, and believes that the Nintendo Switch infringes on its design.

This is a new complaint, separate from another against Nintendo that Gamevice is now appealing after the Patent Trial and Appeal Board ruled in Nintendo’s favor. In that case, Nintendo was accused of infringing 19 Gamevice patents.

Nintendo will be hoping that the ITC dismisses Gamevice’s latest suit before it ends up in another lengthy legal battle. But if Gamevice had its way, Nintendo would not be allowed to import and sell the Switch in the U.S.

I always wonder what goes through company minds in cases like these. Does Gamevice think that people will magically flock to its products if the Switch gets banned? Because that definitely won’t happen.

WireGuard VPN Gets Added to the Next Linux Kernel

I briefly mentioned WireGuard when I wrote of Cloudflare’s WARP beta. I think it’s something to add to your technology watch lists. It’s just not any old VPN app, it’s a VPN protocol that could very well replace current protocols like IPsec and OpenVPN, or at least be offered as an alternative. You can read the technical whitepaper here [PDF], along with this write up from Ars Technica.

WireGuard will now operate as either a Loadable Kernel Module (LKM) or built statically into the kernel itself. But whether static or loadable, it will be “in-tree”—which means it’s provided ready to go with the vanilla kernel itself, with no need for repackaging by the various distros. This puts it on the same footing as other supported drivers.

YouTube Kids Gets the Watch Time, While Netflix Gets The Installs

Netflix was installed 59 million times in the first quarter of 2020. However, it was YouTube Kids that had the most usage, according to AppTopia and Blaze data reported on by Reuters.

Netflix Inc led rivals YouTube, Amazon Prime and Disney+ with over 59 million installs in the first quarter of 2020, but more time was spent on YouTube’s Kids service as usage boomed following the shutdown of thousands of schools in March. YouTube, owned by Alphabet Inc’s Google, collected $110 million in in-app spending during the same time period, the highest among major streaming apps globally, according to a report by analytics firms Apptopia and Braze. The report did not give actual hours of usage, but ranked YouTube Kids first, followed by Netflix. YouTube itself was in third place.

Tile: Apple’s Anticompetitive Behavior Has Gotten Worse

On Wednesday, Tile told a congressional panel that Apple didn’t live up to its promises to resolve a dispute between the two companies.

Tile had objected to Apple requiring its users to repeatedly agree to allow Tile to operate in the background, which is crucial to Tile’s service…Tile also said that there were indications that Apple planned to update its Find My product, adding hardware, so it would be a competitor to Tile.

Those are Tile’s two arguments. One – They’re mad that Apple cracked down on apps collecting location data in the background. No sympathy there from me. Two – Apple allegedly plans to compete with Tile with its own hardware Bluetooth device, rumored “AirTag.” Tile is acting as if Apple specifically aimed its location crackdown at them, to set itself up for AirTag, but I’m not sure if that’s right. Tile certainly wasn’t the only one doing that.

U.S. Census Goes Digital With The iPhone 8

It’s census year in the U.S., but this time around it’s going to be different. Each enumerator tasked with getting the data is to be handed an iPhone 8 instead of a pen and paper. CNet looked into how it is all going to work, and the risks involved.

In an effort to make the door-to-door process, which is the most laborious and expensive part of the census, faster and more efficient, the bureau is arming 500,000 enumerators with the Apple iPhone 8. But as the census goes mobile, instantaneously beaming respondents’ answers to data centers and cloud servers, it opens itself up to those who may want to access or manipulate such valuable information. The stakes to pull off a census have always been high, but with this year’s adoption of new technological methods, the pressure to succeed is even higher.

New Zoom Bug Can Be Used to Steal Passwords, Access Your Webcam, Microphone

Security researcher Patrick Wardle disclosed two Zoom bugs today. They can be used to steal Windows passwords and access your webcam and microphone. They do however require physical access to the machine.

In this blog post, we’ll start by briefly looking at recent security and privacy flaws that affected Zoom. Following this, we’ll transition into discussing several new security issues that affect the latest version of Zoom’s macOS client.

At this point, Zoom should just rewrite its software completely.

OpenWRT is Vulnerable to Remote Code Execution Attacks

For three years, router firmware OpenWRT has been vulnerable to remote code execution attacks.

The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.

This is especially concerning because OpenWRT is commonly recommend by privacy advocates as an alternative to built-in proprietary router firmware.

SiriusXM Premier is Free Through May 15

Announced by Howard Stern, Sirius XM is giving people free access to Premier content through May 15, starting today.

Listeners will have free access to more than 300 channels of dynamic programming, featuring the acclaimed The Howard Stern Show , hundreds of exclusive ad-free music channels, and vital news and information sources.  SiriusXM is also adding entirely new curated content, and bringing back some beloved music channels by top artists.

Zoom Meetings Aren’t Encrypted End-to-End, Despite Marketing

Along with recent news that Zoom sent your data to Facebook (although it stopped) now we learn that its video calls don’t use end-to-end encryption, despite the company marketing it as such.

…But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption, explained further below.

It just keeps getting worse for Zoom. It’s unfortunate the company has chosen such tactics, because it really is one of the better video calling apps out there.

Marriott Hit by Second Data Breach Affecting up to 5.2M People

Hotel chain Marriott International has suffered a second data breach, exposing the personal data of up to 5.2 million guests.

The breach, which began in mid-January 2020 and was discovered at the end of February 2020, saw contact details, including names, addresses, birth dates, gender, email addresses and telephone numbers exposed. Employer name, gender, room stay preferences and loyalty account numbers were also exposed.

Marriott has also said that at present it does not believe passports, payment details or passwords were exposed in the data breach.

It sounds like login credentials of two employees were stolen, likely through a social engineering attack.

Perhaps Apple Shouldn't Release an iPhone in 2020

People have been speculating for a while about what the coronavirus outbreak means for global supply chains, not least Apple’s. It is all based on the assumption there has to be an iPhone in 2020. Over on iMore Bryan M. Wolfe says there doesn’t. It’s a view I’m increasingly sympathetic with – the world is in turmoil, does Apple really want to be waving shiny new devices around right now?

There’s nothing wrong with the iPhone 11. More importantly, with unemployment rising, now is not the best time for the company to release a new device intended for the masses. Instead, the company should use its first online WWDC conference to announce splashy updates for iOS, iPadOS, and other systems. Then, when this crisis (finally) ebbs, Apple should launch the iPhone 12 in 2021. I understand Apple just released a new iPad Pro. However, the line hadn’t been updated in nearly two years, so a refresh was justified. Same too for the 2020 MacBook Air, which includes the company’s well-received new Backlit Magic Keyboard.

Photographer Claims Apple Copied his Photo in Apple TV+ Show

Adrian Murphy writes that Apple copied his photo of two kids looking into a glowing chest, a visual that can be seen in Amazing Stories on Apple TV+.

To me, this is flagrant copyright infringement and is using my intellectual property to derive visual elements for one of the most viewed portions of their entire series… the intro that plays before every episode. I’m flattered by the obvious imitation, but I’m also disappointed by the obvious theft.

The scene does look visually similar to Mr. Murphy’s photo. I wonder if he will legally pursue this.

Saudi Spies Use Network Flaws to Track Citizens in US

A report today reveals that Saudi Arabia uses flaws in telecom networks to track its citizens as they move through the U.S.

The data shows requests for mobile phone location data that were routed through the decades-old SS7 global messaging system, which allows mobile operators to connect users around the world…The SS7 system also enables tracking of phones, which has been a cause for concern by security experts. When a US carrier – such as Verizon, T-Mobile or AT&T – receives what is known as a Provide Subscriber Information SS7 message (or PSI) from a foreign mobile phone operator, they are getting, in effect, a tracking request.

Also included in the report: Senator Ron Wyden says the FCC knew about these flaws and failed to act, blaming FCC chairman Ajit Pai.

Google Restarting Chrome Updates

Google announced Thursday that it will resume its Chrome and Chrome OS update program, ZDNet reported. It paused the updates to avoid disruptions web developers during the coronavirus pandemic.

The company said that starting next week, the current Chrome 80 release will start receiving security updates once againt. Chrome v81, initially scheduled to be released on March 17, was rescheduled for April 7, at which time, web developers and system administrators would have had the time to adapt to their new working conditions. The Chrome 82 release was canceled altogether, with features being reshuffled into Chrome 83 and other versions. Per the new adjusted schedule, Chrome 83 is now expected to be released somewhere in mid-May.

There’s a Cyber Defense Force Fighting Coronavirus Hackers

An international group of roughly 400 cybersecurity experts are fighting hacking related to the coronavirus.

One of four initial managers of the effort, Marc Rogers, said the top priority would be working to combat hacks against medical facilities and other frontline responders to the pandemic. It is already working on hacks of health organizations.

Also key is the defense of communication networks and services that have become essential as more people work from home, said Rogers, head of security at the long-running hacking conference Def Con and a vice president at security company Okta Inc.

At least there’s some good news.

Why is Zoom Sending Our Data to Facebook?

As people are required to work from home, apps like Zoom help us with video conferencing. But why is the iOS app sending our data to Facebook?

Upon downloading and opening the app, Zoom connects to Facebook’s Graph API, according to Motherboard’s analysis of the app’s network activity. The Graph API is the main way developers get data in or out of Facebook. The Zoom app notifies Facebook when the user opens the app, details on the user’s device such as the model, the time zone and city they are connecting from, which phone carrier they are using, and a unique advertiser identifier created by the user’s device which companies can use to target a user with advertisements.

I’ll add this to my #DeleteFBSDK endeavors.

The FBI is Collecting Your Data Through its ‘FitTest’ App

The FBI has been promoting its fitness app called FitTest to help people exercise at home. It’s also collecting your data.

…an FBI spokesperson reiterated the app’s privacy statement, adding that “the app does not gather or save any personal information other than what you select for your profile.”

But the app’s privacy statement makes room for some tracking: When FitTest accesses pages from the official FBI website, it says, “fbi.gov’s privacy policy applies.” The fbi.gov privacy policy states that “individuals using this computer system are subject to having all of their activities monitored and recorded.”

I can’t wait for the FBIPhone and FBIMessage apps.