Android malware steals user credentials using optical character recognition

Enlarge (credit: Getty Images)

Security researchers have unearthed a rare malware find: malicious Android apps that use optical character recognition to steal credentials displayed on phone screens.

The malware, dubbed CherryBlos by researchers from security firm Trend Micro, has been embedded into at least four Android apps available outside of Google Play, specifically on sites promoting money-making scams. One of the apps was available for close to a month on Google Play but didn’t contain the malicious CherryBlos payload. The researchers also discovered suspicious apps on Google Play that were created by the same developers, but they also didn’t contain the payload.

Advanced techniques

The apps took great care to conceal their malicious functionality. They used a paid version of commercial software known as Jiagubao to encrypt code and code strings to prevent analysis that can detect such functionality. They also featured techniques to ensure the app remained active on phones that had installed it. When users opened legitimate apps for Binance and other cryptocurrency services, CherryBlos overlaid windows that mimicked those of the legitimate apps. During withdrawals, CherryBlos replaced the wallet address the victim selected to receive the funds with an address controlled by the attacker.

Read 13 remaining paragraphs | Comments

Reference : https://ift.tt/i20pcEX

Video Friday: Spot Tripping

Video Friday is your weekly selection of awesome robotics videos, collected by your friends at IEEE Spectrum robotics. We also post a weekly calendar of upcoming robotics events for the next few months. Please send us your events for inclusion.

IEEE RO-MAN 2023: 28–31 August 2023, BUSAN, SOUTH KOREA

IROS 2023: 1–5 October 2023, DETROIT

CLAWAR 2023: 2–4 October 2023, FLORIANOPOLIS, BRAZIL

Humanoids 2023: 12–14 December 2023, AUSTIN, TEX.

Enjoy today’s videos!

Two interesting things about this video: first, the “where’s the button” poke at 2:20, and second, the custom Spot-friendly wrench.

[ Boston Dynamics ]

This is one of the more interesting drone designs that I’ve seen recently, since it’s modular, and you can clip on wings and props. And somehow it just flies.

[ AIR LAb ]

This soft robotic gripper is not only 3D printed in one print, it also doesn’t need any electronics to work. The researchers wanted to design a soft gripper that would be ready to use right as it comes off the 3D printer, equipped with built in gravity and touch sensors. As a result, the gripper can pick up, hold, and release objects.

[ UCSD ]

Thanks, Daniel!

Through this powerful collaboration with the U.S. Agency for International Development (USAID), we are proud to donate cutting-edge Skydio drones, complemented by 3D Scan technology and comprehensive professional training. These resources will aid the Office of the Prosecutor General to document the more than 115,000 instances of destroyed civilian infrastructure, and evidence of human rights abuses on frontline communities and liberated territories.

[ Skydio ]

Grasping objects with limited or no prior knowledge about them is a highly relevant skill in assistive robotics. Still, in this general setting, it has remained an open problem. We present a deep learning pipeline consisting of a shape completion module that is based on a single depth image, and followed by a grasp predictor that is based on the predicted object shape.

[ DLR RM ]

This is a video announcing the opening of the MyoChallenge 23, part of the challenge track of the NeurIPS23 conference. This competition merge physiologically realistic musculoskeletal models and AI with the goal of creating controllers for locomotion and manipulation.

[ MyoChallenge ]

Thanks, Guillaume!

The new DJI Air 3 has a transmission range of 20 kilometers and a flight time of 46 minutes. Consumer drones have made a lot of progress in a pretty short time, haven’t they?

[ DJI ]

With [human driving’s track] record of nearly 43,000 deaths and 2.5 million injuries in the U.S. alone in 2021, we believe autonomous driving technology has the potential to save lives and improve mobility options for millions of people. The data to-date indicates that the Waymo Driver is reducing traffic injuries and fatalities in the places where we operate, and we aim to continue safely designing and deploying our Driver to help more people in more places.

Humans are bad drivers for sure, but according to Missy Cummings as quoted by AP, “autonomous vehicles from Waymo, a spinoff of Google, are four times more likely than humans to crash.”

Watch Tanner Lecturers, Fei-Fei Li and Eric Horvitz, discuss the topics of AI and Human Values.

[ Stanford HAI ]

Tin Lun Lam writes, “in the last two months, we have organized a Lecture Series on Multi-robot Systems and invited eight world-renowned scholars to share their wisdom to help promote knowledge sharing and technological advancement in this field.” Here’s two of the lectures, and you can find the other six at the link below.

[ Freeform Robotics ]

Thanks, Tin Lun!

Reference: https://ift.tt/9Cwuzra

Most of the 100 million people who signed up for Threads stopped using it

Enlarge (credit: Getty Images | NurPhoto)

Meta's new Twitter competitor, Threads, is looking for ways to keep users interested after more than half of the people who signed up for the text-based platform stopped actively using the app, Meta CEO Mark Zuckerberg reportedly told employees in a company town hall yesterday. Threads launched on July 5 and signed up over 100 million users in less than five days, buoyed by user frustration with Elon Musk-owned Twitter.

"Obviously, if you have more than 100 million people sign up, ideally it would be awesome if all of them or even half of them stuck around. We're not there yet," Zuckerberg told employees yesterday, according to Reuters, which listened to audio of the event.

Third-party data suggests that Threads may have lost many more than half of its active users. Daily active users for Threads on Android dropped from 49 million on July 7 to 23.6 million on July 14, and then to 12.6 million on July 23, web analytics company SimilarWeb reported.

Read 8 remaining paragraphs | Comments

Reference : https://ift.tt/83LFKPk

The Long and Mostly Short of China’s Newest GPT

Who said all large-language models (LLMs) necessarily need to be large? In China’s case, LLMs are currently downsizing in their size and number of parameters. According to sources, this is because the country is now focusing on enabling Chinese startups and smaller entities to build their own generative AI applications. As part of this downscaling trend, in June the Beijing Academy of Artificial Intelligence (BAAI) introduced Wu Dao 3.0, a series of open-source, LLMs.

Based on interviews with high-ranking, anonymous sources involved in the project, IEEE Spectrum can report that Wu Dao 3.0 builds on the academy’s work with Wu Dao 2.0, a sparse, multimodal generative AI model—as has been widely reported about version 2.0—with 1.75 trillion parameters. Although the number of Wu Dao 3.0’s parameters is currently a matter of speculation, it is certainly well below the high-water mark that version 2.0 set.

“Wu dao” means “path to enlightenment” in Chinese. Parameters are the weights of the connections between digital “neurons” in the model, representing the relationships between words and phrases. The number of parameters in a model is a measure of its complexity. In a sparse model, only a small subset of the parameters is actually used, making them more efficient than dense models, because they require less memory and computational resources.

“Ultimately, [the government-funded BAAI] can only produce models with smaller parameters, to be used within other Chinese companies.”
—Hejuan Zhao, TMTPost

Rather than another Wu Dao 2.0-size behemoth, however, the Wu Dao 3.0 project is a collection of smaller, nimbler, dense models under the name Wu Dao Aquila, reflecting efforts to enable companies to easily adopt generative AI in their products, Spectrum’s sources say. (In Chinese, the smaller models are called “Wu Dao Tianying,” meaning “path to enlightenment eagle.” Aquila is the Latin for “eagle” and so the smaller models are referred to as the Aquila models in English)

“Due to high costs, chip sanctions, and regulatory systems, large language models like Wu Dao 2.0 can’t be implemented,” said Hejuan Zhao, founder and CEO of TMTPost, one of China’s largest tech media outlets. “Ultimately, they can only produce models with smaller parameters, to be used within other Chinese companies.”

Open sourcing relatively smaller models may also be a strategic choice by BAAI, sources say, as the academy is a non-profit research organization—and the return on investment for training another large model is low. (BAAI officials declined to comment on the record for this story).

The new Wu Dao 3.0 Aquila models have failed to garner much attention in China, possibly due to the similarity in parameter scale to other available open-source models, like Meta’s LLaMA and its recently announced open-source(ish) language model, Llama 2.

China’s LLM landscape is dominated by companies like Alibaba, Baidu, Huawei, and others. Baidu’s largest model, Ernie 3.5, is arguably the most powerful, though it still lags the performance of OpenAI’s GPT-4. And China’s more powerful models including Ernie 3.5, Huawei’s Pangos 3.0, and Alibaba’s Tongyi suite, remain proprietary.

Smaller, open-source models have lower inference costs—that is, how much it costs to run the model as it provides an output—and can be commercialized more readily. They are particularly suitable for niche applications, such as medical chatbots.

Training smaller models also requires fewer chips, making them less vulnerable to hardware shortages. Access to sufficient hardware, especially graphics processing units for model training, is a critical aspect of China’s burgeoning AI sector.

The U.S. government has imposed export restrictions on Nvidia’s A100 GPUs and forthcoming H100 chips to China, including Hong Kong. In response, Nvidia has released a cut-down, slower version of the A100, known as the A800, specifically for China. But any further tightening of U.S. export controls on cutting-edge chips would severely hamper model training in China. There is already an underground trade in Nvidia GPUs due to the high demand and short supply.

Presently, China’s focus is centered on the practical application of AI models. Encouraging open sourcing of not just models, but also datasets and computational resources, the Chinese government hopes to boost the nation’s overall AI development. By building a foundation for large models and promoting innovation through open-source collaboration, BAAI said it is trying to create an open-source ecosystem akin to Linux.

Reference: https://ift.tt/EvURS3G

Stability AI releases Stable Diffusion XL, its next-gen image synthesis model

Enlarge / Several examples of images generated using Stable Diffusion XL 1.0. (credit: Stable Diffusion)

On Wednesday, Stability AI released Stable Diffusion XL 1.0 (SDXL), its next-generation open weights AI image synthesis model. It can generate novel images from text descriptions and produces more detail and higher-resolution imagery than previous versions of Stable Diffusion.

As with Stable Diffusion 1.4, which made waves last August with an open source release, anyone with the proper hardware and technical know-how can download the SDXL files and run the model locally on their own machine for free.

Local operation means that there is no need to pay for access to the SDXL model, there are few censorship concerns, and the weights files (which contain the neutral network data that makes the model function) can be fine-tuned to generate specific types of imagery by hobbyists in the future.

Read 13 remaining paragraphs | Comments

Reference : https://ift.tt/TVZjxCP

US senator blasts Microsoft for “negligent cybersecurity practices”

Enlarge (credit: Getty Images)

A US senator is calling on the Justice Department to hold Microsoft responsible for “negligent cybersecurity practices” that enabled Chinese espionage hackers to steal hundreds of thousands of emails from cloud customers, including officials in the US Departments of State and Commerce.

“Holding Microsoft responsible for its negligence will require a whole-of-government effort,” Ron Wyden (D-Ore.) wrote in a letter. It was sent on Thursday to the heads of the Justice Department, Cybersecurity and Infrastructure Security Agency, and the Federal Trade Commission.

Bending over backward

Wyden’s remarks echo those of other critics who say Microsoft is withholding key details about a recent hack. In disclosures involving the incident so far, Microsoft has bent over backwards to avoid saying its infrastructure—including the Azure Active Directory, a supposedly fortified part of Microsoft’s cloud offerings that large organizations use to manage single sign-on and multifactor authentication—was breached. The critics have said that details Microsoft has disclosed so far lead to the inescapable conclusion that vulnerabilities in code for Azure AD and other cloud offerings were exploited to pull off the successful hack.

Read 13 remaining paragraphs | Comments

Reference : https://ift.tt/DMqsW8v

The Soviet-Era, Z80-based Galaksija Dared to Be Different

Eastern European Cold War–era computing has a poor reputation. The picture is one of a landscape littered with uninspired attempts to copy American IBM PCs, British ZX Spectrums, and other Western computers. But then there was Yugoslavia’s Galaksija, a very inspired bid to put a computer into the hands of regular comrades.

The Galaksija is a Z80-based, 8-bit DIY machine, cleverly designed so that its bill of materials meshed exactly with what a Yugoslavian was able to import from Western Europe. During its brief heyday, thousands were built, leading to commercially assembled Galaksijas finding their way into homes and schools across the country. And now you can try this scrappy machine for yourself.

As a retrocomputing nerd, when I saw early last year that the Galaksija was being reissued as a complete kit through Crowd Supply, I placed an order on general principles. But my interest was really piqued a few months later when I attended a fascinating talk on Yugoslavian computing given by Vlado Vince at the HOPE hacker conference. As delays kept pushing the delivery of the Crowd Supply kit back into an indefinite future, I ran into Vince at the Vintage Computer Festival East last April, and he slipped me a spare Galaksija printed circuit board and a link to his modern bill of materials. Figuring it was plain sailing from there, I canceled my Crowd Supply kit order and set off on my own.

Complete plans for the Galaksija were first published in 1983 in an article in the computer magazine Računari u vašoj kući as a joint venture between the Galaksija’s designer, Voja Antonić, and the magazine’s editor, Dejan Ristanović. (An English translation of the article was published by No Starch Press in 2018 in PoC||GTFO Vol. 2.) Yugoslavians who didn’t want to try ordering components from overseas could order them from Antoić and Ristanović.

The Galaksija originally used a single-sided PCB, but a few years ago Antoić released a two-layer revision. This primarily eliminates the need to solder in jumper wires, speeding up construction considerably. The new version makes two other tweaks, with a new set of footprints for video and audio jacks, and an extra capacitor to fix a timing issue when using the modern variant of the Z80 CPU chip.

But even with these decadent concessions, you’ll still be getting a build experience that won’t feel like anything you’ve ever made if you’re under 50. For starters, many of the resistor values used will seem a little off. Modern designs typically revolve around the E6 series of ohmic value multipliers—1.0, 1.5, 2.2, 3.3, 4.7, and 6.8. But you’ll need an E24 set on hand, as many of Galaksija’s resistors have multipliers like 1.8 or 6.2.

The Galaksija uses relatively few components, relying on its CPU to do a lot of the work that’s done by dedicated circuitry in other home computers. Two EPROMs (recognizable by the window that allows their silicon to be exposed to ultraviolet light for data erasure) store the operating system, while a third EPROM stores graphical character data.James Provost

Next, like some other early home computers, the Galaksijia has minimal video circuitry, relying largely on the CPU to generate analog television signals. This helped greatly in keeping its component costs within the legal import limit, although the additional computing overhead did slow the Galaksija down significantly. The Galaksijia generates a European PAL TV signal, which I was able to use with a flat-screen monitor, thanks to the magic of my RetroTink-2X Pro, a wonderful little box that can convert many obsolete video signals to HDMI. You can also try plugging it into an old analog American CRT TV, because its pure black-and-white signal is compatible-ish with the NTSC standard, but I found this requires a forgiving TV and a very dab hand on the vertical hold control.

But the big headaches are the Galaksija’s ROMs, with three chips in two flavors. These chips are erasable programmable ROMs, or EPROMs, which can be electronically written to, as with modern EEPROM chips. But to erase an EPROM you need to blast it with ultraviolet light for a few minutes through a little circular skylight window on top of its package.

Faced with a looming deadline, I did the only logical thing: I cheated.

I hadn’t handled an EPROM since the 1980s, and that was a broken one I was given to look at under my junior scientist microscope. I was able to source some on eBay, but soon realized that getting the chips was only step one of a complicated process. Like many makers, I use a cheap and cheerful TL866-based ROM programmer. Out of the box, these can’t supply the higher voltage needed to program an EPROM, although there are instructions online for a hardware modification to allow this. But I was struggling to even read the chips to verify that they were blank. Was there a problem with my tool chain, or with the chips themselves? If my Galaksija failed to turn on properly, how would I know if the problem lay with the EPROMs or how I’d populated the board?

As seen in this diagram, adapted from EPROM inventor Dov Frohman’s 1971 paper for the IEEE Journal of Solid-State Circuits, each bit of memory is a transistor with an unconnected gate electrode [dark rectangle]. To set a bit, the gate is charged by applying a high breakdown voltage between the transistor’s source and drain, trapping electrons. The field produced by the trapped gate electrons creates a conductive layer in the silicon substrate. The gate is reset by exposing the surface to penetrating UV light.James Provost

Faced with what looked like a lengthy sequence of trial and error, and a looming deadline for this article, I did the only logical thing: I cheated. I emailed Vince, who conveniently also lives in New York City, and he volunteered to come into the IEEE Spectrum office, along with his UV EPROM eraser, hacked TL866 programmer, and some programmed ROMs for testing. After about two hours of troubleshooting, including tossing a dud chip, my Galaksija was displaying its READY prompt. Really, everyone should have an 8-bit Yugoslavian DIY computer guy: You may not need them for years, but when you do, you’re really glad you have them

You don’t have to know Serbian or Croatian to program the Galaksija. It has a version of Basic used by the TRS-80 Model 1, and hence English keywords. Software is saved and loaded through an audio jack originally intended to interface with tape recorders, and there are collections of Galaksija software available for download, including classics like Tetris. The Galaksija may not be as famous as Western 8-bit machines like the ZX Spectrum or Commodore 64, but getting to know it is a great way to see how people in other places joined the digital revolution and how motivated engineering can transcend major barriers.

Reference: https://ift.tt/2QHVkbo