U.S. government sides with Apple and Amazon, effectively denying Bloomberg ‘spy chip’ report

Homeland Security has said it has “no reason to doubt” statements by Apple, Amazon and Supermicro denying allegations made in a Bloomberg report published earlier this week.

It’s the first statement so far from the U.S. government on the report, casting doubt on the findings. Homeland Security’s statement echos near-identical comments from the U.K.’s National Cyber Security Center.

Bloomberg said, citing more than a dozen sources, that China installed tiny chips on motherboards built by Supermicro, which companies across the U.S. tech industry — including Amazon and Apple — have used to power servers in their datacenters. The chip can reportedly compromise data on the server, allowing China to spy on some of the world’s most wealthy and powerful companies.

Apple, Amazon and Supermicro later published statements on their websites. Bloomberg said it’s sticking by its story. And yet, this latest twist isn’t likely to leave anyone less confused, days after the story was first published.

Homeland Security protects the nation’s cyber defenses from both domestic and foreign threats. It’s rare for the government to issue a statement on an apparent threat which, according to Bloomberg, is a classified matter that’s been under federal investigation for three years.

The reality is that days after this story broke, it seems many of the smartest, technically minded, rational cybersecurity experts still don’t know who to believe — Bloomberg, or everyone else.

And until someone gets their hands on these apparent chips, don’t expect that to change any time soon.

Bloomberg’s spy chip story reveals the murky world of national security reporting

from Apple – TechCrunch https://ift.tt/2C41DaO

Here’s how Google is revamping Gmail and Android security

Eager to change the conversation from their years-long exposure of user data via Google+ to the bright, shining future the company is providing, Google has announced some changes to the way permissions are approved for Android apps. The new process will be slower, more deliberate, and hopefully secure.

The changes are part of “Project Strobe,” a “root-and-branch review of third-party developer access to Google account and Android device data and our philosophy around apps’ data access.” Essentially they decided it was time to update the complex and likely not entirely cohesive set of rules and practices around those third-party developers and API access.

One of those roots (or perhaps branches) was the bug discovered inside Google+, which theoretically (the company can’t tell if it was abused or not) exposed non-public profile data to apps that should have received only a user’s public profile. This, combined with the fact that Google+ never really justified its own existence in the first place, led to the service essentially being shut down. “The consumer version of Google+ currently has low usage and engagement,” Google admitted. “90 percent of Google+ user sessions are less than five seconds.”

But the team doing the review has plenty of other suggestions to improve the process of informed consent to sharing data with third parties.

The first change is the most user-facing. When an application wants to access your Google account data — say your Gmail, Calendar, and Drive contents for a third-party productivity app — you’ll have to approve each one of those separately. You’ll also have the opportunity to deny access to one or more of those requests, so if you never plan on using the Drive functionality, you can just nix it and the app will never get that permission.

These permissions can also be delayed and gated behind the actions that require them. For instance, if this theoretical app wanted to give you the opportunity to take a picture to add to an email, it wouldn’t have to ask up front when you download it. Instead, when you tap the option to attach a picture, it would ask permission to access the camera then and there. Google went into a little more detail on this in a post on its developer blog.

Notably there is only the option to “deny” or “allow,” but no “deny this time” or “allow this time,” which I find to be useful when you’re not totally on board with the permission in question. You can always revert the setting manually but it’s nice to have the option to say “okay, just this once, strange app.”

The changes will start rolling out this month, so don’t be surprised if things look a little different next time you download a game or update an app.

The second and third changes have to do with limiting what data from your Gmail and messaging can be accessed by apps, and what apps can be granted access in the first place.

Specifically, Google is restricting access to these sensitive data troves to apps “directly enhancing email functionality” for Gmail and your default calling and messaging apps for call logs and SMS data.

There are some edge cases where this might be annoying to power users; some have more than one messaging app that falls back to SMS or integrates SMS replies, and this might require those apps to take a new approach. And apps that want access to these things may have trouble convincing Google’s review authorities that they qualify.

Developers will also need to review and agree to a new set of rules governing what Gmail data can be used, how they can use it, and the measures they must have in place to protect it. For example, apps are not allowed to “transfer or sell the data for other purposes such as targeting ads, market research, email campaign tracking, and other unrelated purposes.” That probably puts a few business models out of the running.

Apps looking to handle Gmail data will also have to submit a report detailing “application penetration testing, external network penetration testing, account deletion verification, reviews of incident response plans, vulnerability disclosure programs, and information security policies.” No fly-by-night operations permitted, clearly.

There will also be additional scrutiny on what permissions developers ask for to make sure it matches up with what their app requires. If you ask for Contacts access but don’t actually use it for anything, you’ll be asked to remove that, since it only increases risk.

These various new requirements will go into effect next year, with application review (a multi-week process) starting on January 9; tardy developers will see their apps stop working at the end of March if they don’t comply.

The relatively short timeline here suggests that some apps may in fact shut down temporarily or permanently due to the rigors of the review process. Don’t be surprised if early next year you get an update saying service may be interrupted due to Google review policies or the like.

These changes are just the first handful issuing from the recommendations of Project Strobe; we can expect more to appear over the next few months, though perhaps not such striking ones. To say Gmail and Android apps are widely used is something of an understatement, so it’s understandable that they would be focused on first, but there are many other policies and services the company will no doubt find reason to improve.

from Android – TechCrunch https://ift.tt/2QCNc15
via IFTTT

In letter to Congress, Apple sends strongest denial over ‘spy chip’ story

Apple has doubled down on its repudiation of Bloomberg’s report last week that claimed its systems had been compromised by Chinese spies.

The blockbuster story cited more than a dozen sources claiming that China installed tiny chips on motherboards built by Supermicro, which companies across the U.S. tech industry — including Amazon and Apple — have used to power servers in their datacenters. Bloomberg’s report also claimed that the chip can reportedly compromise data on the server, allowing China to spy on some of the world’s most powerful tech companies.

Now, in a letter to Congress, Apple’s vice president of information security George Stathakopoulos sent the company’s strongest denial to date.

“Apple has never found malicious chips, ‘hardware manipulations’ or vulnerabilities purposely planted in any server,” he said. “We never alerted the FBI to any security concerns like those described in the article, nor has the FBI ever contacted us about such an investigation.”

It follows a statement by both the U.K. National Cyber Security Center and U.S. Homeland Security stating that they had “no reason to doubt” statements by Apple, Amazon and Supermicro denying the claims.

Stathakopoulos added that Apple “repeatedly asked them to share specific details about the alleged malicious chips that they seemed certain existed, they were unwilling or unable to provide anything more than vague secondhand accounts.”

Apple’s statement is far stronger than its earlier remarks. A key detail missing in the Bloomberg story is that its many sources, albeit anonymous, provided the reporters with a first hand account of the alleged spy chips.

Without any evidence that the chips exist beyond eyewitness accounts and sources, Bloomberg’s story remains on shaky grounds.

View this document on Scribd

Bloomberg’s spy chip story reveals the murky world of national security reporting

from Apple – TechCrunch https://ift.tt/2OfvVP5

UK High Court blocks compensation suit against Google’s ‘Safari workaround’

An attempt to bring a class-action style litigation in the UK to claim up to £3BN in compensation from Google for ignoring iPhone user privacy settings has been blocked after the High Court judge ruled the case cannot proceed.

The case pertains to actions by Google between 2011 and 2012 when it allegedly harvested personal data from Safari users without their permission, via the use of tracking cookies.

In the US, Google settled with the FTC over the same cookie tracking issuing — agreeing in 2012 to pay $22.5M to settle the charge that it bypassed Safari’s privacy settings to serve targeted ads to consumers.

In the UK a civil legal action was filed last year by one named iPhone user, Richard Lloyd — the former director of consumer group, Which? — who was seeking to represent millions of UK users, whose Safari settings the complaint alleged were similarly ignored by Google’s tracking technologies, via a representative legal action.

Lawyers for the claimants argued that sensitive personal data such as iPhone users’ political affiliation, sexual orientation, financial situation and more had been gathered by Google via a ‘Safari Workaround’ that operated between August 2011 and February 2012, and used for targeted advertising without their consent.

The suit sought compensation for Google’s improper use of people’s data — with a proposed amount of £750 per claimant, which could have resulted in a bill of up to £3BN for the company (based on representing ~4.4 million UK iPhone users).

While the judge did not disagree “it is arguable that Google’s alleged role in the collection, collation, and use of data obtained via the Safari Workaround was wrongful, and a breach of duty”, the ruling was based on legal questions related to the merit of the case’s compensation claims, and whether the court should allow a representative action in this case.

In a judgement issued today Mr Justice Warby ruled that the claimants had not been able to demonstrate a basis for bringing a compensation claim.

UK law in this area requires claimants to be able to demonstrate they suffered damage as a result of violation of the relevant data protection rules. And in this instance the claimants had not been able to show damage, the judge ruled.

“I do not believe that the authorities show that a person whose information has been acquired or used without consent invariably suffers compensatable harm, either by virtue of the wrong itself, or the interference with autonomy that it involves. Not everything that happens to a person without their prior consent causes significant or any distress. Not all such events are even objectionable, or unwelcome. Some people enjoy a surprise party,” wrote Warby in the judgement, going on to state that “the question of whether or not damage has been sustained by an individual as a result of the non-consensual use of personal data about them must depend on the facts of the case”.

“The bare facts pleaded in this case, which are in no way individualised, do not in my judgment assert any case of harm to the value of any claimant’s right of autonomy that amounts to “damage” within the meaning of DPA s 13,” he concluded.

On a second legal point, the judge also ruled that the case would not have been allowed to proceed as a class-action style suit, asserting that “the essential requirements for a representative action are absent” — owing to individuals in the group not all having the “same interest” in the claim, and the difficulty of reliably defining a class for the purposes of this case.

In a statement after the ruling was announced, Google said: “The privacy and security of our users is extremely important to us. This claim is without merit, and we’re pleased the Court has dismissed it.”

from iPhone – TechCrunch https://ift.tt/2C1LW3K

The accessibility of the iPhone XS Max

The accessibility of the iPhone XS Max

How the 22-year-old founders of Brex built a billion-dollar business in less than 2 years

When Brazilian-born Henrique Dubugras and Pedro Franceschi met at 16 years old, they bonded over a love of coding and mutual frustrations with their strict mothers, who didn’t understand their Mark Zuckerberg-esque ambitions. 

To be fair, their moms’ fear of their hacking habits only escalated after their pre-teen sons received legal notices of patent infringements in the mail. A legal threat from Apple, which Franceschi received after discovering the first jailbreak to the iPhone, is enough to warrant a grounding, at the very least.

Their parents implored them to quit the hacking and stop messing around online.

They didn’t listen.

Today, the now 22-year-olds are announcing a $125 million Series C for their second successful payments business, called Brex, at a $1.1 billion valuation. Greenoaks Capital, DST Global and IVP led the round, which brings their total raised to date to about $200 million.

San Francisco-based Brex provides startup founders access to corporate credit cards without a personal guarantee or deposit. It’s also supported by the likes of PayPal founders Peter Thiel and Max Levchin, the former chief executive officer of Visa Carl Pascarella and a handful of leading venture capital firms. 

“Brex is off to one of the most exciting starts we’ve ever seen,” IVP’s Somesh Dash said in a statement.

The financing makes them some of the youngest unicorn founders in history and puts them in a rare class of startups that have galloped into unicorn territory at such a fast clip. Brex was founded in the winter of 2017. It only launched publicly in June 2018.

How’d they do it?

“I’ve had two failed attempts, one successful attempt and one on the way to being a successful attempt,” Brex CEO Dubugras told TechCrunch while reciting a lengthy resume.

At 14, when most of us were worrying about what the first year of high school would bring us, Dubugras was more concerned about what his next business attempt would be. He had already built a successful online game but was forced to shut it down after receiving those patent infringement notices.

Naturally, he used the cash he earned from the game to start a company — an education startup meant to help Brazilian students apply to American schools. He himself was hoping to get into Stanford and had learned quickly how little Brazilian students understood of the U.S. college application process.

In some respects, the company was a success. It garnered 800,000 users but failed to make any money. His small fortune wasn’t enough to scale the business.

“There aren’t a lot of VCs in Brazil that are willing to fund 15-year-olds,” Dubugras told TechCrunch.

Shortly after folding the edtech, he met Franceschi, a Brazilian teen from Rio — Dubugras is from São Paulo — who understood his appetite for innovation and was just as hungry for success. The pair got to talking and because of Franceschi’s interest in payments, they started Pagar.me, the “Stripe of Brazil.”

Pagar.me raised $30 million, amassed a staff of 100 and was processing up to $1.5 billion in transactions when it sold. Finally, they had a real success under their belt. Now it was time to relocate. 

“We wanted to come to Silicon Valley to build stuff because everything here seemed so big and so cool,” Dubugras said.

And come to Silicon Valley they did. In the fall of 2016, the pair enrolled at Stanford. Shortly after that, they entered Y Combinator with big dreams for a virtual reality startup called Beyond. 

“I think three weeks in we gave it up,” Dubugras said. “We realized we aren’t the right founders to start this business.”

He credits Y Combinator with helping him realize what they were good at — payments.

As founders themselves, Dubugras and Franceschi were hyper-aware of a huge problem entrepreneurs face: access to credit. Big banks see small businesses as a risk they aren’t willing to take, so founders are often left at a dead-end. Dubugras and Franceschi not only had a big network of startup entrepreneurs in their Rolodex, but they had the fintech acumen necessary to build a credit card business designed specifically for founders.

So, they scrapped Beyond and in April 2017, Brex was born. The startup picked up momentum quickly, so much so that the pair decided to drop out of Stanford and pursue the business full time.

Simplifying financial access

Brex doesn’t require any kind of personal guarantee or security deposit and it doesn’t use third-party legacy technology; its software platform is built from scratch.

It simplifies a lot of the frustrating parts of corporate expenses by providing companies with a consolidated look at their spending. At the end of each month, for example, a CEO can easily see how much the entire company spent on Uber or Amazon. 

Plus, Brex can give entrepreneurs a credit limit that’s as much as 10 times higher than what they’d receive elsewhere and they can issue cards, virtual cards at least, moments after the online application is complete.

“We have a very similar effect of what Stripe had in the beginning, but much faster because Silicon Valley companies are very good at spending money but making money is harder,” Dubugras explained.

As part of their funding announcement, Brex said it will launch a rewards program built with the needs and spending patterns of founders in mind. Beyond that, they plan to use the capital to hire engineers and figure out how to grow the business’s client base beyond only tech startups.

“We want to dominate corporate credit cards,” Dubugras said. “We want every single company in the world, whenever they do businesses expenses, to do it on a Brex card.”

Brazil’s tech startups begin to expand globally

from Apple – TechCrunch https://ift.tt/2yhTgok