Google

Google Rolls Out Updated AI Model Capable of Handling Longer Text, Video (bloomberg.com) 11

An anonymous reader shares a report: Alphabet's Google is rolling out a new version of its powerful artificial intelligence model that it says can handle larger amounts of text and video than products made by competitors. The updated AI model, called Gemini 1.5 Pro, will be available on Thursday to cloud customers and developers so they can test its new features and eventually create new commercial applications. Google and its rivals have spent billions to ramp up their capabilities in generative AI and are keen to attract corporate clients to show their investments are paying off. [...]

Gemini 1.5 can be trained faster and more efficiently, and has the ability to process a huge amount of information each time it's prompted, according to Vinyals. For example, developers can use Gemini 1.5 Pro to query up to an hour's worth of video, 11 hours of audio or more than 700,000 words in a document, an amount of data that Google says is the "longest context window" of any large-scale AI model yet. Gemini 1.5 can process far more data compared with what the latest AI models from OpenAI and Anthropic can handle, according to Google. In a pre-recorded video demonstration for reporters, Google showed off how engineers asked Gemini 1.5 Pro to ingest a 402-page PDF transcript of the Apollo 11 moon landing, and then prompted it to find quotes that showed "three funny moments."

Earth

Scientists Resort To Once-Unthinkable Solutions To Cool the Planet 205

Dumping chemicals in the ocean? Spraying saltwater into clouds? Injecting reflective particles into the sky? Scientists are resorting to once unthinkable techniques to cool the planet because global efforts to check greenhouse gas emissions are failing. From a report: These geoengineering approaches were once considered taboo by scientists and regulators who feared that tinkering with the environment could have unintended consequences, but now researchers are receiving taxpayer funds and private investments to get out of the lab and test these methods outdoors. The shift reflects growing concern that efforts to reduce greenhouse gas emissions aren't moving fast enough to prevent the destructive effects of heat waves, storms and floods made worse by climate change. Geoengineering isn't a substitute for reducing emissions, according to scientists and business leaders involved in the projects. Rather, it is a way to slow climate warming in the next few years while buying time to switch to a carbon-free economy in the longer term.

Three field experiments are under way in the U.S. and overseas. This month, researchers aboard a ship off the northeastern coast of Australia near the Whitsunday Islands are spraying a briny mixture through high-pressure nozzles into the air in an attempt to brighten low-altitude clouds that form over the ocean. Scientists hope bigger, brighter clouds will reflect sunlight away from the Earth, shade the ocean surface and cool the waters around the Great Barrier Reef, where warming ocean temperatures have contributed to massive coral die-offs. The research project, known as marine cloud brightening, is led by Southern Cross University as part of the $64.55 million, or 100 million Australian dollars, Reef Restoration and Adaptation Program. The program is funded by the partnership between the Australian government's Reef Trust and the Great Barrier Reef Foundation and includes conservation organizations and several academic institutions.
Businesses

Nvidia Becomes Third Most Valuable US Company (cnbc.com) 75

Nvidia is now the third most valuable company in the U.S., surpassing Google parent Alphabet and Amazon. It's only behind Apple and Microsoft in terms of market cap. CNBC reports: Nvidia rose over 2% to close at $739.00 per share, giving it a market value of $1.83 trillion to Google's $1.82 trillion market cap. The move comes one day after Nvidia surpassed Amazon in terms of market value. The symbolic milestone is more confirmation that Nvidia has become a Wall Street darling on the back of elevated AI chip sales, valued even more highly than some of the large software companies and cloud providers that develop and integrate AI technology into their products.

Nvidia shares are up over 221% over the past 12 months on robust demand for its AI server chips that can cost more than $20,000 each. Companies like Google and Amazon need thousands of them for their cloud services. Before the recent AI boom, Nvidia was best known for consumer graphics processors it sold to PC makers to build gaming computers, a less lucrative market.

Privacy

US Military Notifies 20,000 of Data Breach After Cloud Email Leak (techcrunch.com) 11

An anonymous reader quotes a report from TechCrunch: The U.S. Department of Defense is notifying tens of thousands of individuals that their personal information was exposed in an email data spill last year. According to the breach notification letter sent out to affected individuals on February 1, the Defense Intelligence Agency -- the DOD's military intelligence agency -- said, "numerous email messages were inadvertently exposed to the Internet by a service provider," between February 3 and February 20, 2023. TechCrunch has learned that the breach disclosure letters relate to an unsecured U.S. government cloud email server that was spilling sensitive emails to the open internet. The cloud email server, hosted on Microsoft's cloud for government customers, was accessible from the internet without a password, likely due to a misconfiguration.

The DOD is sending breach notification letters to around 20,600 individuals whose information was affected. "As a matter of practice and operations security, we do not comment on the status of our networks and systems. The affected server was identified and removed from public access on February 20, 2023, and the vendor has resolved the issues that resulted in the exposure. DOD continues to engage with the service provider on improving cyber event prevention and detection. Notification to affected individuals is ongoing," said DOD spokesperson Cdr. Tim Gorman in an email to TechCrunch.

United States

FTC Chair Khan: Stop Monopolies Before They Happen (axios.com) 40

FTC chair Lina Khan is hunting for evidence that Microsoft, Google and Amazon require cloud computing spend, board seats or exclusivity deals in return for their investments in AI startups. From a report: At a Friday event, Khan framed today's AI landscape as an inflection point for tech that is "enormously important for opening up markets and injecting competition and disrupting existing incumbents." The FTC chair offered Axios' Sara Fischer new details of how she's handling a market inquiry into the relationship between Big Tech companies and AI startups, in an interview at the Digital Content Next Summit in Charleston, S.C.

In handling the surge in AI innovation and its impacts on the broader tech and media landscape, Khan said she aims to tackle monopoly "before it becomes fully fledged." She said the FTC is looking for chokepoints in each layer of the AI tech stack: "chips. compute, foundational models, applications." Khan said she's also paying close attention to vertical integration -- when players look to extend dominance over one tech layer into adjacent layers -- or when they attempt acquisitions aimed at solidifying an existing monopoly. That includes any potential integration between Sam Altman's nascent chip project and OpenAI, though she said she welcomes chip competition.

Data Storage

Backblaze's Geriatric Hard Drives Kicked the Bucket More in 2023 (theregister.com) 51

Backblaze has published a report on hard drive failures for 2023, finding that rates increased during the year due to aging drives that it plans to upgrade. From a report: Backblaze, which focuses on cloud-based storage services, claims to have more than three exabytes of data storage under its management. As of the end of last year, the company monitored 270,222 hard drives used for data storage, some of which are excluded from the statistics because they are still being evaluated. That still left a collection of 269,756 hard drives comprised of 35 drive models. Statistics on SSDs used as boot drives are reported separately.

Backblaze found one drive model exhibited zero failures for all of 2023, the Seagate 8 TB ST8000NM000A. However, this came with the caveat that there are only 204 examples in service, and these were deployed only since Q3 2022, so have accumulated a limited number of drive days (total time operational). Nevertheless, as Backblaze's principal cloud storage evangelist Andy Klein pointed out: "Zero failures over 18 months is a nice start."

Communications

The US Government Makes a $42 Million Bet On Open Cell Networks (theverge.com) 26

An anonymous reader quotes a report from The Verge: The US government has committed $42 million to further the development of the 5G Open RAN (O-RAN) standard that would allow wireless providers to mix and match cellular hardware and software, opening up a bigger market for third-party equipment that's cheaper and interoperable. The National Telecommunications and Information Administration (NTIA) grant would establish a Dallas O-RAN testing center to prove the standard's viability as a way to head off Huawei's steady cruise toward a global cellular network hardware monopoly.

Verizon global network and technology president Joe Russo promoted the funding as a way to achieve "faster innovation in an open environment." To achieve the standard's goals, AT&T vice president of RAN technology Robert Soni says that AT&T and Verizon have formed the Acceleration of Compatibility and Commercialization for Open RAN Deployments Consortium (ACCoRD), which includes a grab bag of wireless technology companies like Ericsson, Nokia, Samsung, Dell, Intel, Broadcom, and Rakuten. Japanese wireless carrier Rakuten formed as the first O-RAN network in 2020. The company's then CEO, Tareq Amin, told The Verge's Nilay Patel in 2022 that Open RAN would enable low-cost network build-outs using smaller equipment rather than massive towers -- which has long been part of the promise of 5G.

But O-RAN is about more than that; establishing interoperability means companies like Verizon and AT&T wouldn't be forced to buy all of their hardware from a single company to create a functional network. For the rest of us, that means faster build-outs and "more agile networks," according to Rakuten. In the US, Dish has been working on its own O-RAN network, under the name Project Genesis. The 5G network was creaky and unreliable when former Verge staffer Mitchell Clarke tried it out in Las Vegas in 2022, but the company said in June last year that it had made its goal of covering 70 percent of the US population. Dish has struggled to become the next big cell provider in the US, though -- leading satellite communications company EchoStar, which spun off from Dish in 2008, to purchase the company in January.
The Washington Post writes that O-RAN "is Washington's anointed champion to try to unseat the Chinese tech giant Huawei Technologies" as the world's biggest supplier of cellular infrastructure gear.

According to the Post, Biden has emphasized the importance of O-RAN in conversations with international leaders over the past few years. Additionally, it notes that Congress along with the NTIA have dedicated approximately $2 billion to support the development of this standard.
Cloud

Why Companies Are Leaving the Cloud (infoworld.com) 176

InfoWorld reports: Don't look now, but 25% of organizations surveyed in the United Kingdom have already moved half or more of their cloud-based workloads back to on-premises infrastructures. This is according to a recent study by Citrix, a Cloud Software Group business unit. The survey questioned 350 IT leaders on their current approaches to cloud computing. The survey also showed that 93% of respondents had been involved with a cloud repatriation project in the past three years. That is a lot of repatriation. Why?

Security issues and high project expectations were reported as the top motivators (33%) for relocating some cloud-based workloads back to on-premises infrastructures such as enterprise data centers, colocation providers, and managed service providers (MSPs). Another significant driver was the failure to meet internal expectations, at 24%... Those surveyed also cited unexpected costs, performance issues, compatibility problems, and service downtime. The most common motivator for repatriation I've been seeing is cost. In the survey, more than 43% of IT leaders found that moving applications and data from on-premises to the cloud was more expensive than expected.

Although not a part of the survey, the cost of operating applications and storing data on the cloud has also been significantly more expensive than most enterprises expected. The cost-benefit analysis of cloud versus on-premises infrastructure varies greatly depending on the organization... The cloud is a good fit for modern applications that leverage a group of services, such as serverless, containers, or clustering. However, that doesn't describe most enterprise applications.

The article cautions, "Don't feel sorry for the public cloud providers."

"Any losses from repatriation will be quickly replaced by the vast amounts of infrastructure needed to build and run AI-based systems... As I've said a few times here, cloud conferences have become genAI conferences, which will continue for several years."
Hardware

Nvidia is Forming a New Business Unit to Make Custom Chips (reuters.com) 13

An anonymous reader shared this report from Reuters: Nvidia is building a new business unit focused on designing bespoke chips for cloud computing firms and others, including advanced AI processors, nine sources familiar with its plans told Reuters. The dominant global designer and supplier of AI chips aims to capture a portion of an exploding market for custom AI chips and shield itself from the growing number of companies pursuing alternatives to its products.

The Santa Clara, California-based company controls about 80% of high-end AI chip market, a position that has sent its stock market value up 40% so far this year to $1.73 trillion after it more than tripled in 2023. Nvidia's customers, which include ChatGPT creator OpenAI, Microsoft, Alphabet, and Meta Platforms, have raced to snap up the dwindling supply of its chips to compete in the fast-emerging generative AI sector. Its H100 and A100 chips serve as a generalized, all-purpose AI processor for many of those major customers. But the tech companies have started to develop their own internal chips for specific needs. Doing so helps reduce energy consumption, and potentially can shrink the cost and time to design.

Nvidia is now attempting to play a role in helping these companies develop custom AI chips that have flowed to rival firms such as Broadcom and Marvell Technology, said the sources, who declined to be identified because they were not authorized to speak publicly...

Nvidia moving into this territory has the potential to eat into Broadcom and Marvell sales.

The Almighty Buck

Ring Video Doorbell Customers Angry At 43% Price Hike (bbc.co.uk) 42

Longtime Slashdot reader Alain Williams shares a report from the BBC: Users of Ring video doorbells have reacted angrily to a huge price hike being introduced in March. After buying the devices, customers can pay a subscription to store footage on the cloud, download clips and get discounted products. That subscription is going up 43%, from $44 to $63 per device, per year, for basic plan customers. The firm, which is owned by Amazon, insisted it still provided "some of the best value in the industry." Its customers appear not to to agree.
Google

Google Rebrands Bard as Gemini, Rolls Out $20 Paid Subscription (reuters.com) 26

Google has renamed its AI assistant to "Gemini" and unveiled a paid subscription tier offering. The $19.99/month "Gemini Advanced" includes a more powerful AI model and cloud storage integration, targeting users seeking advanced content creation and complex query resolution. Google is also leveraging its Android user base by making Gemini the default digital assistant, aiming to replicate the success of its billion-user products.
Microsoft

Since Steve Ballmer Retired 10 Years Ago, Microsoft's Valuation Has Increased 10X (cnbc.com) 93

"When Satya Nadella replaced Steve Ballmer as Microsoft CEO in February 2014, the software company was mired in mediocrity," writes CNBC, noting that Microsoft's market cap was just over $300 billion.

"A decade later, Microsoft's valuation has swelled tenfold, to $3.06 trillion, making it the world's most valuable public company, ahead of Apple." (And it's also "firmly entrenched as a leader in key areas, such as cloud and artificial intelligence.") As Nadella marks his 10-year anniversary at the helm, he's widely praised across the tech industry for changing the narrative at Microsoft, whose stock fell 30% during Ballmer's 14 years at the top. In that era, the company was squelched by Google in web search and mobile and was completely left behind in social media. Many tech industry analysts and investors would say that, thanks largely to Nadella, Microsoft is now set up to be a powerhouse for the foreseeable future...

In a 2020 interview, Pat Gelsinger, then CEO of VMware, said offering his company's software on Microsoft's Azure cloud was akin to a "Middle East peace treaty...." In the Nadella age, Microsoft has also contributed to open-source projects, released software under open-source licenses and released a version of its Teams communications app for Linux... In 2018, Nadella came to believe in the idea of buying GitHub just 20 minutes after Nat Friedman, then a Microsoft corporate vice president, started pitching him on it. Right away, Nadella suggested that Friedman become GitHub's new CEO, Friedman said. Microsoft paid $7.5 billion for the code-storage startup...

While Nadella may not bring as much entertainment value, he's proven to be more effective than Ballmer when it comes to dealmaking. In addition to GitHub, Nadella has made pricey acquisitions such as LinkedIn, Minecraft parent Mojang, and Nuance Communications that have contributed to Microsoft's top line. More recently, Nadella helped Microsoft land the $75 billion acquisition of game publisher Activision Blizzard...

The article also adds that Microsoft "looked at buying TikTok in the U.S. in 2020, but nothing came of those discussions."
Privacy

Ask Slashdot: How Can I Stop Security Firms From Harvesting My Data? 82

Slashdot reader Unpopular Opinions requests suggestions from the Slashdot community: Lately a boom of companies decided to play their "nice guy" card, providing us with a trove of information about our own sites, DNS servers, email servers, pretty much anything about any online service you host.

Which is not anything new... Companies have been doing this for decades, except as paid services you requested. Now the trend is basically anyone can do it over my systems, and they are always more than happy to sell anyone, me included, my data they collected without authorization or consent. It's data they never had the rights to collect and/or compile to begin with, including data collected thru access attempts via known default accounts (Administrator, root, admin, guest) and/or leaked credentials provided by hacked databases when a few elements seemingly match...

"Just block those crawlers"? That's what some of those companies advise, but not only does the site operator have to automate it themself, not all companies offer lists of their source IP addresses or identify them. Some use multiple/different crawler domain names from their commercial product, or use cloud providers such as Google Cloud, AWS and Azure â" so one can't just block access to their company's networks without massive implications. They also change their own information with no warning, and many times, no updates to their own lists. Then, there is the indirect cost: computing cost, network cost, development cost, review cycle cost. It is a cat-and-mice game that has become very boring.

With the raise of concerns and ethical questions about AI harvesting and learning from copyrighted work, how are those security companies any different from AI, and how could one legally put a stop on this?

Block those crawlers? Change your Terms of Service? What's the best fix... Share your own thoughts and suggestions in the comments.

How can you stop security firms from harvesting your data?
AI

Police Departments Are Turning To AI To Sift Through Unreviewed Body-Cam Footage (propublica.org) 40

An anonymous reader quotes a report from ProPublica: Over the last decade, police departments across the U.S. have spent millions of dollars equipping their officers with body-worn cameras that record what happens as they go about their work. Everything from traffic stops to welfare checks to responses to active shooters is now documented on video. The cameras were pitched by national and local law enforcement authorities as a tool for building public trust between police and their communities in the wake of police killings of civilians like Michael Brown, an 18 year old black teenager killed in Ferguson, Missouri in 2014. Video has the potential not only to get to the truth when someone is injured or killed by police, but also to allow systematic reviews of officer behavior to prevent deaths by flagging troublesome officers for supervisors or helping identify real-world examples of effective and destructive behaviors to use for training. But a series of ProPublica stories has shown that a decade on, those promises of transparency and accountability have not been realized.

One challenge: The sheer amount of video captured using body-worn cameras means few agencies have the resources to fully examine it. Most of what is recorded is simply stored away, never seen by anyone. Axon, the nation's largest provider of police cameras and of cloud storage for the video they capture, has a database of footage that has grown from around 6 terabytes in 2016 to more than 100 petabytes today. That's enough to hold more than 5,000 years of high definition video, or 25 million copies of last year's blockbuster movie "Barbie." "In any community, body-worn camera footage is the largest source of data on police-community interactions. Almost nothing is done with it," said Jonathan Wender, a former police officer who heads Polis Solutions, one of a growing group of companies and researchers offering analytic tools powered by artificial intelligence to help tackle that data problem.

The Paterson, New Jersey, police department has made such an analytic tool a major part of its plan to overhaul its force. In March 2023, the state's attorney general took over the department after police shot and killed Najee Seabrooks, a community activist experiencing a mental health crisis who had called 911 for help. The killing sparked protests and calls for a federal investigation of the department. The attorney general appointed Isa Abbassi, formerly the New York Police Department's chief of strategic initiatives, to develop a plan for how to win back public trust. "Changes in Paterson are led through the use of technology," Abbassi said at a press conference announcing his reform plan in September, "Perhaps one of the most exciting technology announcements today is a real game changer when it comes to police accountability and professionalism." The department, Abassi said, had contracted with Truleo, a Chicago-based software company that examines audio from bodycam videos to identify problematic officers and patterns of behavior.

For around $50,000 a year, Truleo's software allows supervisors to select from a set of specific behaviors to flag, such as when officers interrupt civilians, use profanity, use force or mute their cameras. The flags are based on data Truleo has collected on which officer behaviors result in violent escalation. Among the conclusions from Truleo's research: Officers need to explain what they are doing. "There are certain officers who don't introduce themselves, they interrupt people, and they don't give explanations. They just do a lot of command, command, command, command, command," said Anthony Tassone, Truleo's co-founder. "That officer's headed down the wrong path." For Paterson police, Truleo allows the department to "review 100% of body worn camera footage to identify risky behaviors and increase professionalism," according to its strategic overhaul plan. The software, the department said in its plan, will detect events like uses of force, pursuits, frisks and non-compliance incidents and allow supervisors to screen for both "professional and unprofessional officer language."
There are around 30 police departments currently use Truleo, according to the company.

Christopher J. Schneider, a professor at Canada's Brandon University who studies the impact of emerging technology on social perceptions of police, is skeptical the AI tools will fix the problems in policing because the findings might be kept from the public just like many internal investigations. "Because it's confidential," he said, "the public are not going to know which officers are bad or have been disciplined or not been disciplined."
XBox (Games)

Microsoft Says Palworld Is the Biggest Ever Third-Party Game Pass Launch (engadget.com) 40

Palworld, a viral "Pokemon with guns" game, has become Microsoft's biggest third-party launch on Game Pass. According to developer Pocketpair, the game sold 12 million copies on Steam and seven million on Xbox since its January 19 launch. A million of the copies were sold in its first eight hours. Engadget reports: In addition to being the biggest third-party Game Pass launch ever, Palworld had the largest third-party day-one launch on Xbox Cloud Gaming (included with Game Pass Ultimate). The game's highest peak since launch was nearly three million daily active users on Xbox. Microsoft says it was the most-played game on Xbox platforms during that period.

Palworld uses Pokemon-esque characters and themes -- enough to catch the attention of Nintendo's lawyers. It has battles with monsters similar to those in the creature-collecting series, including the ability to capture them inside a sphere after winning. But Palworld also includes biting social commentary and incorporates themes you'd never see in Pokemon -- like labor exploitation. "Don't worry, there are no labor laws for Pals," a game FAQ reads. One of the title's trailers showed a player circling hard-at-work Pals with an assault rifle. "Creating a productive base like this is the secret to living a comfortable life in Palworld," the narration reads.

Youtube

YouTube Says It Has More Than 100 Million Premium and Music Subscribers (variety.com) 48

YouTube has announced it has surpassed 100 million YouTube Music and YouTube Premium subscribers globally. Variety reports: The 100 million figure includes uses who are on free trials, according to YouTube. The company didn't break down how many are on YouTube Music versus YouTube Premium, the subscription service for ad-free viewing, background listening, offline video downloads and full access to YouTube Music. In November 2022, the company said YouTube Music and YouTube Premium topped 80 million paying subscribers combined.

The announcement comes after Alphabet, in reporting fourth-quarter 2023 earnings, boasted that YouTube and Google subscription services generated more than $15 billion in revenue last year. That includes YouTube Premium and YouTube Music, as well as YouTube TV and Google One cloud storage.

Microsoft

Microsoft Seeks Rust Developers To Rewrite Core C# Code (theregister.com) 77

An anonymous reader shares a report: Microsoft's adoption of Rust continues apace if a posting on the IT titan's careers website is anything to go by. Although headcount at Microsoft might currently be down -- by two percent compared to the previous year -- recruitment persists at the Windows giant. In this case, the company is forming a team of Rustaceans to tackle a platform move away from C#.

The job, a principal software architect for Microsoft 365, has responsibilities that include "guiding technical direction, design and implementation of Rust component libraries, SDKs, and re-implementation of existing global scale C# based services to Rust." According to the post, the job lurks within the Substrate App Platform group, part of the Microsoft 365 Core Platform organization. The Substrate does the heavy lifting behind the scenes for Microsoft's cloud services, making a rewrite into Rust quite a statement of intent. Microsoft said: "We are forming a new team focused on enabling the adoption of the Rust programming language as the foundation to modernizing global scale platform services, and beyond."

Microsoft

Microsoft's Gaming Revenue Is Up 49 Percent In Q2, Mostly Thanks To the Activision Deal (engadget.com) 10

For the first time, Microsoft's Q2 earnings report includes the impact of the company's $68.7 billion Activision Blizzard acquisition. "While Microsoft isn't breaking out specific numbers, it says that its overall gaming revenue increased by 49 percent, 44 points of which came from the 'net impact' of the Activision deal," reports Engadget. From the report: Microsoft's More Personal Computing division, which includes Xbox, Surface and Windows, was up 19 percent ($16.9 billion) since last year. The company says the Activision deal accounted for 15 points of that increase. It's a huge change for a division that's been severely impacted by dwindling PC sales (which affects Windows licenses and Surfaces) and struggling Xbox consoles. PC device revenues were down 9 percent for the quarter, while Xbox hardware sales were up 3 percent. Xbox content and services revenue is also up 61 percent since last year, 55 points of which comes from Activision. Overall, Microsoft reported revenues of $62 billion, up from $52.7 billion a year earlier. Microsoft's cloud division posted revenue growth of 28%, with its intelligent-cloud revenue up 20% to $25.9 billion. Meanwhile, its productivity and business-processes segment generated $19.2 billion.
United States

US Disabled Chinese Hacking Network Targeting Critical Infrastructure (reuters.com) 24

The U.S. government in recent months launched an operation to fight a pervasive Chinese hacking operation that successfully compromised thousands of internet-connected devices, Reuters reported Tuesday, citing two Western security officials and another person familiar with the matter. From the report: The Justice Department and Federal Bureau of Investigation sought and received legal authorization to remotely disable aspects of the Chinese hacking campaign, the sources told Reuters. The Biden administration has increasingly focused on hacking, not only for fear nation states may try to disrupt the U.S. election in November, but because ransomware wreaked havoc on Corporate America in 2023.

The hacking group at the center of recent activity, Volt Typhoon, has especially alarmed intelligence officials who say it is part of a larger effort to compromise Western critical infrastructure, including naval ports, internet service providers and utilities. While the Volt Typhoon campaign initially came to light in May 2023, the hackers expanded the scope of their operations late last year and changed some of their techniques, according to three people familiar with the matter. The widespread nature of the hacks led to a series of meetings between the White House and private technology industry, including several telecommunications and cloud commuting companies, where the U.S. government asked for assistance in tracking the activity.

Security

Mistakenly Published Password Exposes Mercedes-Benz Source Code (techcrunch.com) 29

An anonymous reader quotes a report from TechCrunch: Mercedes-Benz accidentally exposed a trove of internal data after leaving a private key online that gave "unrestricted access" to the company's source code, according to the security research firm that discovered it. Shubham Mittal, co-founder and chief technology officer of RedHunt Labs, alerted TechCrunch to the exposure and asked for help in disclosing to the car maker. The London-based cybersecurity company said it discovered a Mercedes employee's authentication token in a public GitHub repository during a routine internet scan in January. According to Mittal, this token -- an alternative to using a password for authenticating to GitHub -- could grant anyone full access to Mercedes's GitHub Enterprise Server, thus allowing the download of the company's private source code repositories.

"The GitHub token gave 'unrestricted' and 'unmonitored' access to the entire source code hosted at the internal GitHub Enterprise Server," Mittal explained in a report shared by TechCrunch. "The repositories include a large amount of intellectual property connection strings, cloud access keys, blueprints, design documents, [single sign-on] passwords, API Keys, and other critical internal information." Mittal provided TechCrunch with evidence that the exposed repositories contained Microsoft Azure and Amazon Web Services (AWS) keys, a Postgres database, and Mercedes source code. It's not known if any customer data was contained within the repositories. It's not known if anyone else besides Mittal discovered the exposed key, which was published in late-September 2023.
A Mercedes spokesperson confirmed that the company "revoked the respective API token and removed the public repository immediately."

"We can confirm that internal source code was published on a public GitHub repository by human error. The security of our organization, products, and services is one of our top priorities. We will continue to analyze this case according to our normal processes. Depending on this, we implement remedial measures."

Slashdot Top Deals