computing
Auto Added by WPeMatico
Auto Added by WPeMatico
Security companies Fortinet and Kromtech found seventeen tainted Docker containers that were essentially downloadable images containing programs that had been designed to mine cryptocurrencies. Further investigation found that they had been downloaded 5 million times, suggesting that hackers were able to inject commands into insecure containers to download this code into otherwise healthy web applications. The researchers found the containers on Docker Hub, a repository for user images.
“Of course, we can safely assume that these had not been deployed manually. In fact, the attack seems to be fully automated. Attackers have most probably developed a script to find misconfigured Docker and Kubernetes installations. Docker works as a client/server architecture, meaning the service can be fully managed remotely via the REST API,” wrote researcher David Maciejak.
The containers are now gone, but the hackers may have gotten away with up to $90,000 in cryptocurrency, a small but significant amount for such a hack.
“Today’s growing number of publicly accessible misconfigured orchestration platforms like Kubernetes allows hackers to create a fully automated tool that forces these platforms to mine Monero,” said a writer of a report by Kromtech. “By pushing malicious images to a Docker Hub registry and pulling it from the victim’s system, hackers were able to mine 544.74 Monero, which is equal to $90,000.”
“As with public repositories like GitHub, Docker Hub is there for the service of the community. When dealing with open public repositories and open source code, we recommend that you follow a few best practices including: know the content author, scan images before running and use curated official images in Docker Hub and certified content in Docker Store whenever possible,” wrote Docker’s head of security David Lawrence in a Threatpost report.
Interestingly, of late hackers have moved from attacking AWS Elastic Compute servers on Amazon’s platform to Docker and other container-based systems. While there are security systems available to manage Docker and Kubernetes containers, users should remain vigilant and assess their vulnerabilities before hackers get more of an upper hand.
Powered by WPeMatico
Avast has found that many low-cost, non-Google-certifed Android phones shipped with a strain of malware built in that could send users to download apps they didn’t intend to access. The malware, called called Cosiloon, overlays advertisements over the operating system in order to promote apps or even trick users into downloading apps. Devices effected shipped from ZTE, Archos and myPhone.
The app consists of a dropper and a payload. “The dropper is a small application with no obfuscation, located on the /system partition of affected devices. The app is completely passive, only visible to the user in the list of system applications under ‘settings.’ We have seen the dropper with two different names, ‘CrashService’ and ‘ImeMess,’” wrote Avast. The dropper then connects with a website to grab the payloads that the hackers wish to install on the phone. “The XML manifest contains information about what to download, which services to start and contains a whitelist programmed to potentially exclude specific countries and devices from infection. However, we’ve never seen the country whitelist used, and just a few devices were whitelisted in early versions. Currently, no countries or devices are whitelisted. The entire Cosiloon URL is hardcoded in the APK.”
The dropper is part of the system’s firmware and is not easily removed.
To summarize:
The dropper can install application packages defined by the manifest downloaded via an unencrypted HTTP connection without the user’s consent or knowledge.
The dropper is preinstalled somewhere in the supply chain, by the manufacturer, OEM or carrier.
The user cannot remove the dropper, because it is a system application, part of the device’s firmware.
Avast can detect and remove the payloads and they recommend following these instructions to disable the dropper. If the dropper spots antivirus software on your phone it will actually stop notifications but it will still recommend downloads as you browse in your default browser, a gateway to grabbing more (and worse) malware. Engadget notes that this vector is similar to the Lenovo “Superfish” exploit that shipped thousands of computers with malware built in.
Powered by WPeMatico
An IoT-enabled lab for cannabis farmers, a system for catching drones mid-flight and the Internet of Cows are a few of the 17 startups exhibiting today at Alchemist Accelerator’s 18th demo day. The event, which will be streamed live here, focuses on big data and AI startups with an enterprise bent.
The startups are showing their stuff at Juniper’s Aspiration Dome in Sunnyvale, California at 3pm today, but you can catch the whole event online if you want to see just what computers and cows have in common. Here are the startups pitching onstage.
Tarsier – Tarsier has built AI computer vision to detect drones. The founders discovered the need while getting their MBAs at Stanford, after one had completed a PhD in aeronautics. Drones are proliferating. And getting into places they shouldn’t — prisons, R&D centers, public spaces. Securing these spaces today requires antiquated military gear that’s clunky and expensive. Tarsier is all software. And cheap, allowing them to serve markets the others can’t touch.
Lightbox – Retail 3D is sexy — think virtual try-ons, VR immersion, ARKit stores. But creating these experiences means creating 3D models of thousands of products. Today, artists slog through this process, outputting a few models per day. Lightbox wants to eliminate the humans. This duo of recent UPenn and Stanford Computer Science grads claim their approach to 3D scanning is pixel perfect without needing artists. They have booked $40,000 to date and want to digitize all of the world’s products.
Vorga – Cannabis is big business — more than $7 billion in revenue today and growing fast. The crop’s quality — and a farmer’s income — is highly sensitive to a few chemicals in it. Farmers today test the chemical composition of their crops through outsourced labs. Vorga’s bringing the lab in-house to the cannabis farmer via their IoT platform. The CEO has a PhD in chemical physics, and formerly helped the Department of Defense keep weapons of mass destruction out of the hands of terrorists. She’s now helping cannabis farmers get high… revenue.
Neulogic – Neulogic is founded by a duo of Computer Science PhDs that led key parts of Walmart.com product search. They now want to solve two major problems facing the online apparel industry: the need to provide curated inspiration to shoppers and the need to offset rising customer acquisition costs by selling more per order. Their solution combines AI with a fashion knowledge graph to generate outfits on demand.
Intensivate – Life used to be simple. Enterprises would use servers primarily for function-driven applications like billing. Today, servers are all about big data, analytics and insight. Intensivate thinks servers need a new chip upgrade to reflect that change. They are building a new CPU they claim gets 12x the performance for the same cost. Hardware plays like this are hard to pull off, but this might be the team to do it. It includes the former co-founder and CEO of CPU startup QED, which was acquired for $2.3 billion, and a PhD in parallel computation who was on the design team for the Alpha CPU from DEC.
Integry – SaaS companies put a lot of effort into building out integrations. Integry provides app creators their own integrations marketplace with pre-boarded partners so they can have apps working with theirs from the get go. The vision is to enable app creators to mimic their own Slack app directory without spending the years or the millions. Because these integrations sit inside their app, Integry claims setup rates are significantly better and churn is reduced by as much as 40 percent.
Cattle Care – AI video analytics applied to cows! Cattle Care wants to increase dairy farmers’ revenue by more than $1 million per year and make cows healthier at the same time. The product identifies cows in the barn by their unique black and white patterns. Algorithms collect parameters such as walking distance, interactions with other cows, feeding patterns and other variables to detect diseases early. Then the system sends alerts to farm employees when they need to take action, and confirms the problem has been solved afterwards.
VadR – VR/AR is grappling with a lack of engaging content. VadR thinks the cause is a broken feedback loop of analytics to the creators. This trio of IIT-Delhi engineers has built machine learning algorithms that get smarter over time and deliver actionable insights on how to modify content to increase engagement.
Tika – This duo of ex-Googlers wants to help engineering managers manage their teams better. Managers use Tika as an AI-powered assistant over Slack to facilitate personalized conversations with engineering teams. The goal is to quickly uncover and resolve employee engagement issues, and prevent talent churn.
GridRaster – GridRaster wants to bring AR/VR to mobile devices. The problem? AR/VR is compute-intensive. Latency, bandwidth and poor load balancing kill AR/VR on mobile networks. The solution? For this trio of systems engineers from Broadcom, Qualcomm and Texas Instruments, it’s about starting with enterprise use cases and building edge clouds to offload the work. They have 12 patents.
AitoeLabs – Despite the buzz around AI video analytics for security, AitoeLabs claims solutions today are plagued with hundreds of thousands of false alarms, requiring lots of human involvement. The engineering trio founding team combines a secret sauce of contextual data with their own deep models to solve this problem. They claim a 6x reduction in human monitoring needs with their tech. They’re at $240,000 ARR with $1 million of LOIs.
Ubiquios – Companies building wireless IoT devices waste more than $1.8 billion because of inadequate embedded software options making products late to market and exposing them to security and interoperability issues. The Ubiquios wireless stack wants to simplify the development of wireless IoT devices. The company claims their stack results in up to 90 percent lower cost and up to 50 percent faster time to market. Qualcomm is a partner.
4me, Inc. – 4me helps companies organize and track their IT outsourcing projects. They have 16 employees, 92 customers and generate several million in revenue annually. Storm Ventures led a $1.65 million investment into the company.
TorchFi – You know the pop-up screen you see when you log into a Wi-Fi hotspot? TorchFi thinks it’s a digital gold mine in the waiting. Their goal is to convert that into a sales channel for hotspot owners. Their first product is a digital menu that transforms the login screen into a food ordering screen for hotels and restaurants. Cisco has selected them as one of 20 apps to be distributed on their Meraki hotspots.
Cogitai – This team of 16 PhDs wants to usher in a more powerful type of AI called continual learning. The founders are the fathers of the field — and include professors in computer science from UT Austin and U Michigan. Unlike what we commonly think of as AI, Cogitai’s AI is built to acquire new skills and knowledge from experience, much like a child does. They have closed $2 million in bookings this year, and have $5 million in funding.
LoadTap – On-demand trucking apps are in vogue. LoadTap explicitly calls out that it is not one. This team, which includes an Apple software architect and founder with a family background in trucking, is an enterprise SaaS-only solution for shippers who prefer to work with their pre-vetted trucking companies in a closed loop. LoadTap automates matching between the shippers and trucking companies using AI and predictive analytics. They’re at $90,000 ARR and growing revenue 50 percent month over month.
Ondaka – Ondaka has built a VR-like 3D platform to render industrial information visually, starting with the oil and gas industry. For these industrial customers, the platform provides a better way to understand real-time IoT data, operational and job site safety issues and how reliable their systems are. The product launched two months ago, they have closed three customers already and are projecting ARR in the six figures. They have raised $350,000 in funding.
Powered by WPeMatico
“Travel is expensive, but we are at the cusp of a revolution that will democratize travel and leisure for everyone,” reads the breathless whitepaper for HoweyCoins. “The Internet was the first part of the revolution. The other part is blockchain technology and cryptocurrencies.”
“I’m all about HoweyCoins – this thing is going to pop at the top!” writes @boxingchamp1934, an official celebrity backer of the token. The website is full of beautiful beaches, features a handsome team of international men and women and the technology is nowhere to be seen, buried under a sea of excitement. The whitepaper is complete and well-written, focusing on the upside that is to come. Riches await if you invest in HoweyCoin, the latest ICO opportunity from trusted folks.
Or do they?
They don’t. All that breathless optimism is a site created by US Securities Exchange Commission to warn investors of scams and issues associated with token sales. The site features all the trademarks of a scammy security token, including tiered pre-sale pricing and an urgent countdown clock.
The site features a number of red flags that the SEC encourages users to watch out for, including, most importantly, claims that tokens can only go up in value. They write:
Every investment carries some degree of risk, which is reflected in the rate of return you can expect to receive. High returns entail high risks, possibly including a total loss on the investments. Most fraudsters spend a lot of time trying to convince investors that extremely high returns are “guaranteed” or “can’t miss.”
The SEC also notes that “it is never a good idea to make an investment decision just because someone famous says a product or service is a good investment,” and that it is never a good idea to invest with a credit card.
They also warn against pump and dump language found on many ICO pages. “Our past two pumps have doubled value for the period immediately after the pump for returns of over 225%,” wrote the HoweyCoins “creators,” a giant no-no in the world of investing.
You can read the rest of the red flags here.
While the site is fairly comical, it is sufficiently complete and would fool the casual observer. The SEC also posted a real-looking whitepaper that makes it clear that anyone can string together a few buzzwords and write a passable investment prospectus. That this is now a service available to anyone — for a price — makes things even scarier.
The site is part of the SEC’s outreach efforts to help investors understand ICOs.
“Strong investor protection is part of what makes American markets so strong…and striking the balance, [between innovation and investor protection] is very important,” said Chief of the SEC Cyber Unit Robert Cohen at Consensus this week. During the same panel the SEC claimed its doors were always open for questions.
Ultimately there is little separating the scams from the real token sales. This is a problem. The SEC is framing this problem in their own way based on decades of dealing with pink sheet pump and dumps and bogus get-rich-quick schemes. While HoweyCoins may not be real, there are plenty of scammers out there, and at least something like this bogus website makes it easier to spot the warning signs.
Powered by WPeMatico
A Cleveland.com article detailed the lengths the small midwestern city would go to lure Amazon’s in 50,000-person HQ2. In a document obtained by reporter Mark Naymik, we learn that Cleveland was ready to give over $120 million in free services to Amazon including considerably reduced fares on Cleveland-area trains and buses.
The document, available here, focuses on the Northeast Ohio Areawide Coordinating Agency (NOACA)’s ideas regarding the key component in many of Amazon’s decisions – transportation.
Ohio has a budding but often tendentious connection to public transport. Cities like Columbus have no light rail while Cincinnati just installed a rudimentary system. Cleveland, for its part, has a solid if underused system already in place.
That the city would offer discounts is not surprising. Cities were falling over themselves to gain what many would consider – including Amazon itself – a costly incursion on the city chosen. However, given the perceived importance of having Amazon land in a small city – including growth of the startup and tech ecosystems – you can see why Cleveland would want to give away plenty of goodies.
Ultimately the American Midwest is at a crossroads. It could go either way, with small cities growing into vibrant artistic and creative hubs or those same cities falling into further decline. And the odds are stacked against them.
The biggest city, Chicago, is a transport, finance, and logistics hub and draws talent from smaller cities that orbit it. Further, “smart” cities like Pittsburgh and Ann Arbor steal the brightest students who go on to the coasts after graduation. As Richard Florida noted, the cities with a vibrant Creative Class are often the ones that succeed in this often rigged race and many cities just can’t generate any sort of creative ecosystem – cultural or otherwise – that could support a behemoth like Amazon landing in its midst.
What Cleveland did wasn’t wrong. However, it did work hard to keep the information secret, a consideration that could be dangerous. After all, as Maryland Transportation Secretary Pete K. Rahn told reporters: “Our statement for HQ2 is we’ll provide whatever is necessary to Amazon when they need it. For all practical purposes, it’s a blank check.”
Powered by WPeMatico
Analysts have long-warned of a growth crunch in China’s smartphone space, and it’s looking like that’s very much the case right now.
China’s smartphone growth has been the feel-good story for domestic OEMs who have clocked impressive figures as the billion-plus population has rushed online via mobile devices. However, the market reached saturation point in 2017 — when sales stopped growing for the first time — and the first quarter of this year is already showing savage results.
In a report released today, Canalys claimed that shipments across the industry fell by 21 percent year-on-year in Q1.
The total number of mobile devices shipped in China dropped below the 100 million mark in a quarter for the first time since late 2013, the firm added.
“Eight of the top 10 smartphone vendors were hit by annual declines, with Gionee, Meizu and Samsung shrinking to less than half of their respective Q1 2017 numbers,” the report read.
Ouch.
Of the field, only Xiaomi — the firm tipped for an IPO at a $100 billion valuation — was able to post positive momentum as its numbers grew by 37 percent to reach 12 million. That was enough to see it overtake Apple into fourth place, but Xiaomi numbers are still heavily reliant on its $150 Redmi range, which isn’t as lucrative as its higher-end products.
Huawei, Oppo and Vivo led the market. Somewhat incredibly, those three firms plus Xiaomi now account for a very dominant 73 percent of all shipments, which Canalys believes is bad for consumers and smartphone aficionados in China.
“The level of competition has forced every vendor to imitate the others’ product portfolios and go-to-market strategies,” analyst Mo Jia said in a statement. “While Huawei, Oppo, Vivo and Xiaomi must contend with a shrinking Chinese market, they can take comfort from the fact that it will continue to consolidate, and that their size will help them last longer than other smaller players.”
There might be a bright spark coming soon. Canalys anticipates growth in the second quarter as Oppo, Vivo and Huawei trot out new flagship devices. But China’s once-booming industry is now having to contend with the same issue as the U.S.: consumers don’t upgrade their phone as frequently as carriers would like.
Powered by WPeMatico
The first thing to understand about media-sharing app Rapchat is that co-founder Seth Miller is not a rapper and his other co-founder, Pat Gibson, is. Together they created Rapchat, a service for making and sharing raps, and the conjunction of rapper and nerd seems to be really taking off.
Since we last looked at the app in 2016 (you can see Tito’s review below), a lot has changed. The team has raised $1.6 million in funding from investors out of Oakland and the Midwest. Their app, which is sort of a musical.ly for rap, is a top 50 music app on iOS and Android and hit 100 million listens since launch. In short, their little social network/sharing platform is a “millionaire in the making, boss of [its] team, bringin home the bacon.”
The pair’s rap bona fides are genuine. Gibson has opened or performed with Big Sean, Wiz Khalifa and Machine Gun Kelly, and he’s sold beats to MTV. “My music has garnered over 20M+ plays across YouTube, SoundCloud and more,” he wrote me, boasting in the semi-churlish manner of a rapper with a “beef.” Miller, on the other hand, likes to freestyle.
“I grew up loving to freestyle with friends at OU and I noticed lots of other millennials did this too (even if most suck lol) … at any party at 3am – there would always be a group of people in the corner freestyling,” he said. “At the same time Snapchat was blowing up on campus and just thought you should be able to do the same exact thing for rap.”
Gibson, on the other hand, saw it as a serious tool to help him with his music.
“I spent a lot of time, energy and resources making music,” he said. “I was producing the beats, writing the songs, recording/mixing the vocals, mastering the project, then distributing & promoting the music all by myself. With Rapchat, there’s a library of 1,000+ beats from top producers, an instant recording studio in your pocket, and the network to distribute your music worldwide and be discovered…. all from a free app. Rapchat is disrupting the creation, collaboration, distribution, & discovery of music via mobile.”
“We have a much bigger but also more active community than any other music creation app,” said Miller.
While it’s clear the world needs another sharing platform like it needs a hole in the head, thanks to a rabid fan base and a great idea, the team has ensured that Rapchat is not, as they say, wicka-wicka-whack. That, in the end, is all that matters.
Powered by WPeMatico
Startup life is full of quick, lateral thinking. “Move fast and break things” is the mantra. However, with the rise of token sales – essentially vehicles for untested startups to raise millions in a few minutes – lots of stuff gets broken and little gets fixed.
Take BCT – the Blockchain Terminal – for example. This frothy project led by Bob Bonomo, a former hedge fund guy turned Blockchain guru, features some interesting breakages.
Yesterday at about 3pm Eastern Time the company’s FAQ – which has since been updated but is still hidden here – read something like this:
While this sort of techno greeking is fine if you’re sending mock-ups back and forth, the token sale had been running since April 1st, a fact that was baffling to me and another reporter. Was this an April Fool’s joke? No, because when I visited the sale’s Telegram room I found a group of happy buyers asking questions about their future tokens.
Ever the reporter, I asked if anyone had seen the terminals and a community manager sent me this:
Interesting… blank screens at a demo event. The other CM, quicker on the draw, sent this:
Fair enough. In fact, crypto needs a product like this to legitimize it with Wall Street. But clearly they were moving so fast that the wheels were falling off.
Finally I did the obvious thing: visit the white paper. There we find that the Terminal is being built in conjunction with FactSet, a venerable research company that has seen all the vicissitudes of financial data. In fact, the paper is a tour-de-force on par with the best of the white papers I’ve seen. But we also discover that the white paper is a draft.
In short, BCT wouldn’t pass the average human investor sniff test but is definitely well on the way to completing its token sale. This is a problem.
BCT is not alone. I’ve spoken to development houses working with founders who barely understand cryptocurrency let alone understand their own token sales. I’ve seen founders’ eyes light up like the Big Bad Wolf eyeing Porky Pig when they talk about all the capital they will unlock. And I spoke to a founder on stage who said he would be very careful with the $80 million they raised for a company designed to raise money for ICOs. Greed is clouding this market in ways that are at once dangerous and comical.
There is precedent for this. In the early days of the Internet and even the frothiest dot-com days you could see the avarice in the eyes of Pets.com and Cisco executives who knew that big money was just around the corner. And we can’t begrudge these founders their excitement. What founder wouldn’t want the sweet feeling of being fully funded for, we presume, the next decade?
I’ve been following token sales with great interest over the past few months for a few reasons. First, I understand the hype cycle. I’ve seen tactics used by token sellers used before by hardware sellers, most notably with flops like the Phantom gaming console and the Notion Ink Adam, and there is a stink that permeates projects that are, at best, half-baked.
I want token sales to thrive as a method to raise capital. I want small startups to be able to turn on a spigot previously available to the well-connected and well-heeled. But the exact opposite seems true. Bankers are moving into a technology space that they little understand while carpetbaggers – lawyers, PR folks, advisors – are working hard to extract cash out of these windfalls. In the end the token sale industry should formalize itself and become as boring as the VC industry. I just hope it survives long enough to get there.
Powered by WPeMatico
Microsoft has released the source code for the original, 1990s-era File Manager that is so familiar to all of us who were dragging and dropping on Windows 3.0. The code, which is available on Github under the MIT OSS license, will compile under Windows 10.
File Manager uses the multiple-document interface or MDI to display multiple folders inside one window. This interface style, which changed drastically with later versions of Windows, was the standard for almost a decade of Windows releases.
These little gifts to the open source community are definitely fun but not everyone is happy. One Hacker News reader noted that “Most of the MSFT open source stuff is either trash or completely unmaintained. Only a couple of high profile projects are maintained and they jam opt-out telemetry in if you like it or not (despite hundreds of comments requesting them to go away). Even Scott Hanselman getting involved in one of our tickets got it nowhere. Same strong arming and disregard for customers.”
Ultimately these “gifts” to users are definitely a lot of fun and a great example of nostalgia-ware. Let me know how yours compiles by Tweeting me at @johnbiggs. I’d love to see it running again.
Powered by WPeMatico
SteelSeries has two new Arctis Pro gaming headsets out, and they pack a lot of tech and versatility into a comfortable, visually attractive package. The SteelSeries Arctis Pro Wireless and Arctis Pro + GameDAC are both incredibly capable headsets that deliver terrific sound, and depending on your system needs, should probably be your first choice when looking for new gaming audio gear.
The Arctis Pro Wireless is, true to its name, wire-free, but also promises lossless 2.4GHz transmission to ensure lag-free audio, too – a must for competitive gaming. The combination of the wireless functionality, the long-wearing comfort of the suspension system headband and the included transmitter base that can hold and charge a swappable battery as well as display all key information on an OLED readout makes this a standout choice.
There are some limitations, however – compatibility is limited to either PS4 or PC for this one, for instance. The wired Arctis Pro (without GameDAC) is compatible with the Xbox One, but both the wireless version and the version that connected to the wired DAC will only work with either Sony’s latest consoles or with a Windows or Mac-based gaming PC.
I’m a bit saddened by that since I’m a big fan of PUBG on Xbox, and also lately of Sea of Thieves, but I also do regularly play PS4 and PC games, and the Arctis Pro Wireless is my weapon of choice now when using either, either for multiplayer or single player games. The wearability and sound quality (which includes DTS X 7.1 surround on PC) is so good that I’ll often opt to use them in place of my actual 5.1 physical surround system, even when I don’t need to chat with anyone.
Other options, like the Turtle Beach Elite Pro Tournament Headset, offer different advantages including more easily accessible fine-tune control over soundscape, balance of chat and game audio and other features, but the SteelSeries offers a less complicated out-of-box experience, and better all-day wearability thanks to taking cues from athletic wear for its materials and design.
The GameDAC option additionally has Hi-Res Audio certificate, which is good if you’re looking to stream FLAC files or high-res audio from services like Tidal. The DAC itself also makes all audio sound better overall, and gives you more equalization options from the physical controller .
The main thing to consider with the Arctis Pro + DAC ($249.99) and the Arctis Pro Wireless ($329.99) is the cost. They’re both quite expensive relative to the overall SteelSeries lineup and those of competitors, too. But in this case, cost really is reflective of quality – channel separation and surround virtualization is excellent on these headsets, and the mic sounds great to other players I talked to as well. Plus, the Pro Wireless can connect to both Bluetooth and the 2.4GHz transmitter simultaneously, so you can use it with your phone as well as your console, and the retractable mic keeps things looking fairly stylish, too.
Powered by WPeMatico