Shodan Safari, where hackers heckle the worst devices put on the internet

If you leave something on the internet long enough, someone will hack it.

The reality is that many device manufacturers make it far too easy by using default passwords that are widely documented, allowing anyone to log in as “admin” and snoop around. Often, there’s no password at all.

Enter “Shodan Safari,” a popular part-game, part-expression of catharsis, where hackers tweet and share their worst finds on Shodan, a search engine for exposed devices and databases popular with security researchers. Almost anything that connects to the internet gets scraped and tagged in Shodan’s vast search engine — including what the device does and internet ports are open, which helps Shodan understand what the device is. If a particular port is open, it could be a webcam. If certain header comes back, it’s backend might be viewable in the browser.

Think of Shodan Safari as internet dumpster diving.

From cameras to routers, hospital CT scanners to airport explosive detector units, you’d be amazed — and depressed — at what you can find exposed on the open internet.

Like a toilet, or prized pot plant, or — as we see below — someone’s actual goat.

The reality is that Shodan scares people — and it should. It’s a window into the world of absolute insecurity. It’s not just exposed devices but databases — storing anything from two-factor codes to your voter records, and where you’re going to the gym tonight. But devices take up the bulk of what’s out there. Exposed CCTV cameras, license plate readers, sex toys, and smart home appliances. If it’s out there and exposed, it’s probably on Shodan.

If there’s ever a lesson to device makers, not everything has to be connected to the internet.

Here’s some of the worst things we’ve found so far. (And here’s where to send your best finds.)

An office air conditioning controller. (Screenshot: Shodan)

 

A weather station monitor at an airport in Alabama. (Screenshot: Shodan)

 

A web-based financial system at a co-operative credit bank in India. (Screenshot: Shodan)

 

For some reason, a beef factory. (Screenshot: Shodan)

 

An electric music carillon near St. Louis. used for making church bell melodies. (Screenshot: Shodan)

 

A bio-gas production and refinery plant in Italy. (Screenshot: Shodan)

 

A bird. Just a bird. (Screenshot: Shodan via @Joshbal4)

 

A brewery in Los Angeles. (Screenshot: Shodan)

 

The back end of a cinema’s projector system. Many simply run Windows. (Screenshot: Shodan via @tacticalmaid)

 

The engine room of a Dutch fishing boat. (Screenshot: Shodan)

 

An explosive residue detector at Heathrow Airport’s Terminal 3. (Screenshot: TechCrunch)

 

A fish tank water control and temperature monitor. (Screenshot: Shodan)

 

A climate control system for a flower store in Colorado Springs. (Screenshot: Shodan)

 

The web interface for a Tesla PowerPack. (Screenshot: Shodan via @xd4rker)

 

An Instagram auto-follow bot.(Screenshot: Shodan)

 

A terminal used by a pharmacist. (Screenshot: Shodan)

 

A controller for video displays and speakers at a Phil’s BBQ restaurant in Texas. (Screenshot: Shodan)

 

A Kodak Lotem printing press. (Screenshot: Shodan)

 

Someone’s already hacked lawn sprinkler system. Yes, that’s Rick Astley. (Screenshot: Shodan)

 

A sulfur dioxide detector. (Screenshot: Shodan)

 

An internet-connected knee recovery machine. (Screenshot: Shodan)

 

Somehow, a really old version of Windows XP still in existence. (Screenshot: Shodan)

 

Someone’s workout machine. (Screenshot: Shodan)


Source: Tech Crunch

Samsung could release three variants of the Galaxy S10

According to a leaked image from Evan Blass, Samsung’s new flagship device could come in three different versions — the Samsung Galaxy S10, the Samsung Galaxy S10+ and the Samsung Galaxy S10E.

That new leak lines up with previous leaks. As you can see on the photo, the new devices don’t have a notch. They feature a hole-punch selfie camera instead. If you’re looking for the fingerprint sensor, Samsung could choose to embed it in the screen.

Just like in previous years, in addition to the main S10, there will be a bigger version of the device — the S10+. On this photo, you can see that the bigger version has two selfie cameras instead of one.

But the S10E is a new addition to the lineup. Samsung is launching a more affordable version of the S10 at the same time as the S10. The S10E features two cameras on the back instead of three for instance. I wouldn’t be surprised if the S10E had an LCD display instead of an AMOLED display as well.

Samsung plans to unveil the Galaxy S10 at an event in San Francisco on February 20. We’ll have a team on the ground to tell you more about the device.


Source: Tech Crunch

Facebook is reportedly testing solar-powered internet drones again — this time with Airbus

Facebook last year grounded its ambitious plan to develop a solar-powered drone to beam internet across the world, but the company isn’t done with the concept, it seems. The social media giant is working with aeronautics giant Airbus to test drones in Australia, according to a new report from Germany’s NetzPolitik.

Using a request under Australia’s Freedom of Information Act, NetzPolitik got hold of a document that shows the two companies spent last year in talks over a collaboration with test flights scheduled for November and December 2018. The duo have collaborated before on communication systems for satellite drones.

Those trials — and it isn’t clear if they took place — involved the use of Airbus’ Zephyr drone, a model that is designed for “defence, humanitarian and environmental missions.” The Zephyr is much like Facebook’s now-deceased Aquila drone blueprint; it is a HAPS — “High Altitude Pseudo Satellite” — that uses solar power and can fly for “months.”

The Model S version chosen by Facebook sports a 25-meter wingspan, can operate at up to 20km altitude and it uses millimeter-wave radio to broadcast to the ground.

The Zephyr Model S and Model T as displayed on the Airbus website

The Facebook and Airbus were designed to test a payload from the social network — doubtless internet broadcasting gear — but, since the document covers planning and meetings prior to the tests, we don’t know what the outcome or results were.

“We continue to work with partners on High Altitude Platform System (HAPS) connectivity. We don’t have further details to share at this time,” a Facebook spokesperson told NetzPolitik.

TechCrunch contacted Facebook for further comment (06:55 am EST), but the company had not responded at the time of writing.

Facebook has a raft of projects that are aimed at increasing internet access worldwide, particularly in developing regions such as Asia, Africa and Latin America. The drone projects may be its boldest, they are aimed at bringing connectivity to remote areas, but it has also used software and existing infrastructure to try to make internet access more affordable.

That has included the controversial Internet.org project, which was outlawed in India because it violated net neutrality by selecting the websites and apps that could be used. Since renamed to Free Basics — likely promoted by the Indian setback — it has been scaled back in some markets but, still, Facebook said last year that the program has reached nearly 100 million people to date. Beyond that top line number, little is known about the service, which also includes paid tiers for users.

That aside, the company also has a public-private WiFi program aimed at increasing hotspots for internet users while they are out and about.


Source: Tech Crunch

French data protection watchdog fines Google $57 million under the GDPR

The CNIL, the French data protection watchdog, has issued its first GDPR fine of $57 million (€50 million). The regulatory body claims that Google has failed to comply with the General Data Protection Regulation (GDPR) when new Android users set up a new phone and follow Android’s onboarding process.

Two nonprofit organizations called ‘None Of Your Business’ (noyb) and La Quadrature du Net had originally filed a complaint back in May 2018 — noyb originally filed a complaint against Google and Facebook, so let’s see what happens to Facebook next. Under the GDPR, complaints are transferred to local data protection watchdogs.

While Google’s European HQ is in Dublin, the CNIL first concluded that the team in Dublin doesn’t have the final say when it comes to data processing for new Android users — that decision probably happens in Mountain View. That’s why the investigation continued in Paris.

The CNIL then concluded that Google fails to comply with the GDPR when it comes to transparency and consent.

Let’s start with the alleged lack of transparency. “Essential information, such as the data processing purposes, the data storage periods or the categories of personal data used for the ads personalization, are excessively disseminated across several documents, with buttons and links on which it is required to click to access complementary information,” the regulator writes.

For instance, if a user wants to know how their data is processed to personalize ads, it takes 5 or 6 taps. The CNIL also says that it’s often too hard to understand how your data is being used — Google’s wording is broad and obscure on purpose.

Second, Google’s consent flow doesn’t comply with the GDPR according to the CNIL. By default, Google really pushes you to sign in or sign up to a Google account. The company tells you that your experience will be worse if you don’t have a Google account. According to the CNIL, Google should separate the action of creating an account from the action of setting up a device — consent bundling is illegal under the GDPR.

If you choose to sign up to an account, when the company asks you to tick or untick some settings, Google doesn’t explain what it means. For instance, when Google asks you if you want personalized ads, the company doesn’t tell you that it is talking about many different services, from YouTube to Google Maps and Google Photos — this isn’t just about your Android phone.

In addition to that, Google doesn’t ask for specific and unambiguous consent when you create an account — the option to opt out of personalized ads is hidden behind a “More options” link. That option is pre-ticked by default (it shouldn’t).

Finally, by default, Google ticks a box that says “I agree to the processing of my information as described above and further explained in the Privacy Policy” when you create your account. Broad consent like this is also forbidden under the GDPR.

The CNIL also reminds Google that nothing has changed since its investigation in September 2018.

Chairman of noyb Max Schrems has sent us the following statement:

“We are very pleased that for the first time a European data protection authority is using the possibilities of GDPR to punish clear violations of the law. Following the introduction of GDPR, we have found that large corporations such as Google simply ‘interpret the law differently’ and have often only superficially adapted their products. It is important that the authorities make it clear that simply claiming to be complaint is not enough. We are also pleased that our work to protect fundamental rights is bearing fruit. I would also like to thank our supporters who make our work possible.”

Update: A Google spokesperson has sent us the following statement:

“People expect high standards of transparency and control from us. We’re deeply committed to meeting those expectations and the consent requirements of the GDPR. We’re studying the decision to determine our next steps.”


Source: Tech Crunch

The Tesla Model 3 is finally approved for European roads

Tesla can now deliver Model 3 vehicles to European customers. The automakers midsize sedan was recently granted approval from RDW, the Dutch regulator and European authority tasked by Tesla to approve the vehicle for European roads.

The approval comes just ahead of the vehicle’s European introduction next month. Right now, it’s been reported that a cargo ship full of Model 3s is currently en route to Zeebrugge, Belgium and should arrive around February 2.

The nod from the European governing body was a critical last step. Tesla is clearly racing to get its least expensive vehicle in Europe ahead of the onslaught of EVs planned by European auto makers.

Last week, Tesla announced a cost-savings plan in an effort to shore up its international Model 3 deliveries. The automaker stated that it was cutting 7 percent of its full-time workers. In the email, CEO Elon Musk says the focus must be on delivering “at least the mid-range Model 3 variant in all markets.” He also warns those employees not set to be axed that there are “many companies that can offer a better work-life balance, because they are larger and more mature or in industries that are not so voraciously competitive.”


Source: Tech Crunch

Thanks to Hulu, Disney lost $580 million last fiscal year

The streaming media business is tough. Disney, which has a 30 percent stake Hulu, saw losses of $580 million last fiscal year, according to an SEC filing.

This was, the SEC filing states, “primarily due to a higher loss from our investment in Hulu, partially offset by a favorable comparison to a loss from BAMTech in the prior year.”

BAMTech is the streaming technology that powers ESPN+ and other services. In total, streaming accounted for more than $1 billion in losses for Disney last fiscal year.

Meanwhile, Disney has yet to release its own streaming service, Disney+, which is slated for late 2019. Disney is also planning to increase its investment in Hulu, focusing more on original content and international expansion.

As part of Disney’s buyout of 21st Century Fox, Disney will soon own another 30 percent of Hulu. If the business goes similarly for Hulu this fiscal year, that will only increase Disney’s losses.


Source: Tech Crunch

Uber is exploring autonomous bikes and scooters

Uber is looking to integrate autonomous technology into its bike and scooter-share programs. Details are scarce, but according to 3D Robotics CEO Chris Anderson, who said Uber announced this at a DIY Robotics event over the weekend, the division will live inside Uber’s JUMP group, which is responsible for shared electric bikes and scooters.

The new division, Micromobility Robotics, will explore autonomous scooters and bikes that can drive themselves to be charged, or drive themselves to locations where riders need them. The Telegraph has since reported Uber has already begun hiring for this team.

“The New Mobilities team at Uber is exploring ways to improve safety, rider experience, and operational efficiency of our shared electric scooters and bicycles through the application of sensing and robotics technologies,” Uber’s ATG wrote in a Google Form seeking information from people interested in career opportunities.

Back in December, Uber unveiled its next generation of JUMP bikes, with self-diagnostic capabilities and swappable batteries. The impetus for the updated bikes came was the need to improve JUMP’s overall unit economics.

“That is a major improvement to system utilization, the operating system, fleet uptime and all of the most critical metrics about how businesses are performing with running a shared fleet,” JUMP Head of Product Nick Foley told TechCrunch last month. “Swappable batteries mean you don’t have to take vehicles back to wherever you charge a bike or scooter, and that’s good for the business.”

Autonomous bikes and scooters would make Uber’s shared micromobility business less reliant on humans to charge the vehicles. You could envision a scenario where Uber deploys freshly-charged bikes and scooters to areas where other vehicles are low on juice. Combine that with swappable batteries (think about Uber quickly swapping in a new battery once the vehicle makes it back to the warehouse and then immediately re-deploying that bike or scooter), and Uber has itself a well-oiled machine that increases vehicle availability and improves the overall rider experience.

Uber declined to comment.


Source: Tech Crunch

Facebook launches petition feature, its next battlefield

Gather a mob and Facebook will now let you make political demands. Tomorrow Facebook will encounter a slew of fresh complexities with the launch of Community Actions, its News Feed petition feature. Community Actions could unite neighbors to request change from their local and national elected officials and government agencies. But it could also provide vocal interest groups a bully pulpit from which to pressure politicians and bureaucrats with their fringe agendas.

Community Actions embodies the central challenge facing Facebook. Every tool it designs for positive expression and connectivity can be subverted for polarization and misinformation. Facebook’s membership has swelled into such a ripe target for exploitation that it draws out the worst of humanity. You can imagine misuses like “Crack down on [minority group]” that are offensive or even dangerous but some see as legitimate. The question is whether Facebook puts in the forethought and aftercare to safeguard its new tools with proper policy and moderation. Otherwise each new feature is another liability.

Community Actions roll out to the entire US tomorrow after several weeks of testing in a couple of markets. Users can add a title, description, and image to their Community Action, and tag relevant government agencies and officials who’ll be notified. The goal is to make the Community Action go viral and get people to hit the “Support” button. Community Actions have their own discussion feed where people can leave comments, create fundraisers, and organize Facebook Events or Call Your Rep campaigns. Facebook displays the numbers of supporters behind a Community Action, but you’ll only be able to see the names of those you’re friends with or that are Pages or public figures.

Facebook is purposefully trying to focus Community Actions to be more narrowly concentrated on spurring government action than just any random cause. That means it won’t immediately replace Change.org petitions that can range from the civilian to the absurd. But one-click Support straight from the News Feed could massively reduce the friction to signing up, and thereby attract organizations and individuals seeking to maximize the size of their mob.

You can check out some examples here of Community Actions here like a non-profit Colorado Rising calling for the governor to put a moratorium on oil and gas drilling, citizens asking the a Florida’s mayor and state officials to build a performing arts center, and a Philadelphia neighborhood association requesting that the city put in crosswalks by the library. I fully expect one of the first big Community Actions will be the social network’s users asking Senators to shut down Facebook or depose Mark Zuckerberg.

The launch follows other civic-minded Facebook features like its Town Hall and Candidate Info for assessing politicians, Community Help for finding assistance after a disaster, and local news digest Today In. A Facebook spokesperson who gave us the first look at Community Actions provided this statement:

“Building informed and civically engaged communities is at the core of Facebook’s mission. Every day, people come together on Facebook to advocate for causes they care about, including by contacting their elected officials, launching a fundraiser, or starting a group. Through these and other tools, we have seen people marshal support for and get results on issues that matter to them. Community Action is another way for people to advocate for changes in their communities and partner with elected officials and government agencies on solutions.”

The question will be where Facebook’s moderators draw the line on what’s appropriate as a Community Action, and the ensuing calls of bias that line will trigger. Facebook is employing a combination of user flagging, proactive algorithmic detection, and human enforcers to manage the feature. But what the left might call harassment, the right might call free expression. If Facebook allows controversial Community Actions to persist, it could be viewed as complicit with their campaigns, but could be criticized for censorship if it takes one down. Like fake news and trending topics, the feature could become the social network’s latest can of worms.

Facebook is trying to prioritize local Actions where community members have a real stake. It lets user display “constituent” badges so their elected officials know they aren’t just a distant rabble-rouser. It’s why Facebook will not allow President Donald Trump or Vice President Mike Pence to be tagged in Community Actions. But you’re free to tag all your state representatives demanding nude parks, apparently.

Another issue is how people can stand up against a Community Action. Only those who Support one may join in its discussion feed. That might lead trolls to falsely pledge their backing just to stir up trouble in the comments. Otherwise, Facebook tells me users will have to share a Community Action to their own feed with a message of disapproval, or launch their own in protest. My concern is that an agitated but niche group could drive a sense of false equivocacy by using Facebook Groups or message threads to make it look like there’s as much or more support for a vulgar cause or against of a just one. A politician could be backed into a corner and forced to acknowledge radicals or bad-faith actors lest they look negligent

While Facebook’s spokesperson says initial tests didn’t surface many troubles, the company is trying to balance safety with efficiency and it will consider how to evolve the feature in response to emergent behaviors. The trouble is that open access draws out the trolls and grifters seeking to fragment society. Facebook will have to assume the thorny responsibility of shepherding the product towards righteousness and defining what that even means. If it succeeds, there’s an amazing opportunity here for citizens to band together to exert consensus upon government. A chorus of voices carries much further than a single cry.


Source: Tech Crunch

The AI market is growing, but how quickly is tough to pin down

If you work in tech, you’ve heard about artificial intelligence: how it’s going to replace uswhether it’s over-hyped or not and which nations will leverage it to prevent, or instigate, war.

Our editorial bent is more clear-cut: How much money is going into startups? Who is putting that money in? And what trends can we suss out about the health of the market over time?

So let’s talk about the state of AI startups and how much capital is being raised. Here’s what I can tell you: funding totals for AI startups are growing year-over-year; I just don’t know precisely how quickly. Regardless, startups are certainly raising massive sums of money off the buzzword.

To make that point, here are just a few of the biggest rounds announced and recorded by Crunchbase in 2018:

  • SenseTime, a China-based startup that is quite good at tracking your face wherever it may be, raised a $1 billion Series D round. It was the largest round of the year in the AI category, according to Crunchbase. But what’s more mind-blowing is that the company raised a total of $2.2 billion in just one year across three rounds. A picture is worth a thousand words, but a face is worth billions of dollars.
  • UBTech Robotics, another China-based startup focusing on robotics, raised an $820 million Series C. Just a cursory look at its website, however, makes UBTech appear to be a high-end toy maker rather than an AI innovator.
  • And biotech startup Zymergen, which “manufactures microbes for Fortune 500 companies,” according to Crunchbase, raised a $400 million Series C.

Now, this is the part I normally include a chart and 400 words of copy to contextualize the AI market. But if you read the above descriptions closely, you’ll see our problem: What the hell does “AI” mean?

Take Zymergen as an example. Crunchbase tags it with the AI marker. Bloomberg, citing data from CB Insights, agrees. But if you were making the decision, would you demarcate it as an AI company?

Zymergen’s own website doesn’t employ the phrase. Rather, it uses buzzwords commonly associated with AI — machine learning, automation. Zymergen’s home page, technology page and careers page are devoid of the term.

Instead, the company focuses on molecular technology. Artificial intelligence is not, in fact, what Zymergen is selling. We also know that Zymergen uses some AI-related tools to help it understand its data sets (check its jobs page for more). But is that enough to call it an AI startup? I don’t think so. I would call it biotech.

That brings us back to the data. In the spirit of transparency, CB Insights reports a 72 percent boost in 2018 AI investment over 2017 funding totals. Crunchbase data pegs 2018’s AI funding totals at a more modest 38 percent increase over the preceding year.

So we know that AI fundraising for private companies is growing. The two numbers make that plain. But it’s increasingly clear to me after nearly two years of staring at AI funding rounds that there’s no market consensus over exactly what counts as an AI startup. Bloomberg in its coverage of CB Insights’ report doesn’t offer a definition. What would yours be?

If you don’t have one, don’t worry; you’re not alone. Professionals constantly debate what AI actually means, and who actually deserves the classification. There’s no taxonomy for startups like how we classify animals. It’s flexible, and with PR, you can bend perception past reality.

I have a suspicion there are startups that overstate their proximity to AI. For instance, is employing Amazon’s artificial intelligence services in your back end enough to call yourself an AI startup? I would say no. But after perusing Crunchbase data, you can see plenty of startups that classify themselves on such slippery grounds.

And the problem we’re encountering rhymes well with a broader definitional crisis: What exactly is a tech company? In the case of Blue Apron, public investors certainly differed with private investors over the definition, as Alex Wilhelm has touched on before.

So what I can tell you is that AI startup funding is up. By how much? A good amount. But the precise figure is hard to pin down until we all agree what counts as an AI startup.


Source: Tech Crunch

Stung by criticism, Facebook’s Sandberg outlines new plans to tackle misinformation

Stung by criticism of its widely reported role as a platform capable of spreading disinformation and being used by state actors to skew democratic elections, Facebook’s COO Sheryl Sandberg unveiled five new ways the company would be addressing these issues at the annual DLD conference in Munich, staged ahead of the World Economic Forum. She also announced that Facebook would fund a german university to investigate the eithics of AI, and a new partnership with Germany’s office for information and security.
Sandberg laid out Facebooks five-step plan to regain trust:
1. Investing in safety and security
2. Protections against election interference
3. Cracking down on fake accounts and misinformation
4. Making sure people can control the data they share about themselves
5. Increasing transparency

Public backlashes mounted last year after Facebook was accused of losing track of its users’ personal data, and allow the now defunct Cambridge Analytica agency to mount targetted advertising to millions of Facebook users without their explicit consent in the US elections.

On safety and security, she said Facebook now employed 30,000 people to check its platform for hate posts and misinformation, 5 times more than in 2017.
She admitted that in 2016 Facebook’s cybersecurity policies were centered around protecting users data from hacking and phishing. However, these were not adequate to deal with how state actors would try to a “sow disinformation and dissent into societies.”
Over the last year she said Facebook has removed thousand of individuals accounts and page designs to coordinate disinformation campaigns. She said they would be applying all these lessons learned to the EU parliamentary elections this year’s well as working more closely with governments.
Today, she said Facebook was announcing a new partnership with the German government’s office for information and security to help guide policymaking in Germany and across the EU ahead of its parliamentary elections this year.
Sandberg also revealed the sheer scale of the problem. She said Facebook was now cracking down on fake accounts and misinformation, blocking “more than one million Facebook accounts every day, often as they are created.” She did not elucidate further on which state actors were involved in this sustained assault on the social network.
She said Facebook was now working with fact checkers around the world and had tweaked its algorithm to show related articles allowing users to see both sides of a news story that is posted on the platform. It was also taking down posts which had the potential to create real-world violence, she said. However, she neglected to mention that Facebook also owns WhatsApp, which has been widely blamed for the spreading of false rumors leaking a spate of murders in India.
She cited independent studies from Stanford University and the Le Monde newspaper which have show that Facebook user engagement with unreliable sites has declined by half since 2015.
In a subtle attack on critics, she noted that in 2012 Facebook was often attacked because it was a “walled garden”, and that the platform had subsequently bent to demands to open up to allow third-party apps to build on the service, allowing greater sharing, such as for game-play. However, the company was “now in a “very different place”. “We did not a do a good job managing our platform,” she admitted, acknowledging that this data sharing had led to abuse by bad actors.
She said Facebook had now dramatically cut down on the information about users which apps can access, appointed independent data protection officers, bowed to GDPR rules in the EU and created similar users controls globally.
She said the company was also increasing transparency, allowing other organizations to hold them accountable. “We want you to be able to judge our progress,” she said.
Last year it published its first community standards enforcement report and Sandberg said this would now become an annual event, and given as much status as its annual financial results.
She repeated previous announcements that Facebook would be instituting new standards for advertising transparency, allowing people to see all the adverts a page is running and launching new tools ahead of EU elections in May.
She also announced a new partnership with the Technical University of Munich (TUM) to support the creation of an independent AI ethics research center.
The Institute for Ethics in Artificial Intelligence, which is supported by an initial funding grant from Facebook of $7.5 million over five years, will help advance the growing field of ethical research on new technology and will explore fundamental issues affecting the use and impact of AI.


Source: Tech Crunch