10 interesting stories served every morning and every evening.
Opinion I’m an eighth-generation American, and let me tell you, I wouldn’t trust my data, secrets, or services to a US company these days for love or money. Under our current government, we’re simply not trustworthy.
In the Trump‑redux era of 2026, European enterprises are finally taking data seriously, and that means packing up from Redmond-by-Seattle and moving their most sensitive workloads home. This isn’t just compliance theater; it’s a straight‑up national economic security play.
Europe’s digital sovereignty paranoia, long waved off as regulatory chatter, is now feeding directly into procurement decisions. Gartner told The Reg last year that IT spending in Europe is set to grow by 11 percent in 2026, hitting $1.4 trillion, with a big chunk rolling into “sovereign cloud” options and on‑prem/edge architectures.
The kicker? Fully 61 percent of European CIOs and tech leaders say they want to increase their use of local cloud providers. More than half say geopolitics will prevent them from leaning further on US‑based hyperscalers.
The American hypercloud vendors have figured this out. AWS recently made its European Sovereign Cloud available. This AWS cloud, Amazon claims, is “entirely located within the EU, and physically and logically separate from other AWS Regions.” On top of that, EU residents will “independently operate it” and “be backed by strong technical controls, sovereign assurances, and legal protections designed to meet the needs of European governments and enterprises for sensitive data.”
Many EU-based companies aren’t pleased with this Euro-washing of American hypercloud services. The Cloud Infrastructure Service Providers in Europe (CISPE) trade association accuses the EU Cloud Sovereignty Framework of being set up to favor the incumbent (American) hypercloud providers.
You don’t need a DEA warrant or a Justice Department subpoena to see the trend: Europe’s 90‑plus‑percent dependency on US cloud infrastructure, as former European Commission advisor Cristina Caffarra put it, is a single‑shock‑event security nightmare waiting to rupture the EU’s digital stability.
Seriously. What will you do if Washington decides to unplug you? Say Trump gets up on the wrong side of the bed and decides to invade Greenland. There goes NATO, and in all the saber-rattling leading up to the 10th Mountain Division being shipped to Nuuk, he orders American companies to cut their services to all EU countries and the UK.
With the way things are going, they’re not going to say no. I mean, CEOs Tim Cook of Apple, Eric Yuan of Zoom, Lisa Su of AMD, and — pay attention — Amazon’s Andy Jassy all went obediently to watch a feature-length White House screening of Melania, the universally-loathed, 104‑minute Amazon‑produced documentary about First Lady Melania Trump.
Sure, that’s a silly example, but for American companies to do business today, they’re kowtowing to Trump. Or, take a far more serious example, when Minnesota company CEOs called for “de-escalation” in the state, there was not one word about ICE or the government’s role in the bloodshed. It was the corporate equivalent of the mealy-mouthed “thoughts and prayers” American right-wingers always say after a US school shooting.
Some companies have already figured out which way the wind is blowing. Airbus, the European aerospace titan, has put out a €50 million, decade‑long tender to migrate its mission‑critical applications to a “sovereign European cloud.” Airbus wants its whole stack — data at rest, data in transit, logging, IAM, and security‑monitoring infrastructure — all rooted in EU law and overseen by EU operators. As Catherine Jestin, Airbus’s executive vice president of digital, told The Register: “We want to ensure this information remains under European control.”
Who can blame them? Thanks to the American CLOUD Act and related US surveillance statutes, US‑headquartered providers must hand over European data regardless of where the bytes sit. Exhibit A is that Microsoft has already conceded that it cannot guarantee data independence from US law enforcement. Airbus is betting that “data residency on paper” from AWS‑styled “EU sections” is not enough. Real sovereignty demands EU‑owned and run operations with full contractual and legal firewalls. Sure, your data may live in Frankfurt, but your fate still rests in Seattle, Redmond, or Mountain View if an American company owns your cloud provider.
Besides, do you really want some Trump apparatchik getting their hands on your data? I mean, this is a government where Madhu Gottumukkala, the acting director of the US Cybersecurity and Infrastructure Security Agency, uploaded sensitive data into ChatGPT!
In response, Brussels is pushing an open source‑led exit from hyperscaler lock‑in. Ministries are standardizing on Nextcloud‑style collaboration stacks instead of Microsoft 365 to fund Euro‑native clouds via the European Cloud Alliance. Some countries, like France, are already shoving Zoom, Teams, and other US videoconferencing platforms out the door in favor of a local service.
If you’re running an EU‑based firm in 2026, the takeaway isn’t that AWS‑in‑Frankfurt is evil; it’s that for certain workloads, especially national security, industrial IP, or high‑profile consumer data franchises, EU‑native cloud and services are no longer a nice‑to‑have but a business continuity plan requirement.
It’s time to get serious about digital sovereignty. The clock is ticking, and there’s no telling when Trump will go off. ®
...
Read the original on www.theregister.com »
TL;DR: Mandarin pronunciation has been hard for me, so I took ~300 hours of transcribed speech and trained a small CTC model to grade my pronunciation. You can try it here.
In my previous post about Langseed, I introduced a platform for defining words using only vocabulary I had already mastered. My vocabulary has grown since then, but unfortunately, people still struggle to understand what I’m saying.
Part of the problem is tones. They’re fairly foreign to me, and I’m bad at hearing my own mistakes, which is deeply frustrating when you don’t have a teacher.
My initial plan was to build a pitch visualiser: split incoming audio into small chunks, run an FFT, extract the dominant pitch over time, and map it using an energy-based heuristic, loosely inspired by Praat.
But this approach quickly became brittle. There were endless special cases: background noise, coarticulation, speaker variation, voicing transitions, and so on.
And if there’s one thing we’ve learned over the last decade, it’s the bitter lesson: when you have enough data and compute, learned representations usually beat carefully hand-tuned systems.
So instead, I decided to build a deep learning–based Computer-Assisted Pronunciation Training (CAPT) system that could run entirely on-device. There are already commercial APIs that do this, but hey, where’s the fun in that?
I treated this as a specialised Automatic Speech Recognition (ASR) task. Instead of just transcribing text, the model needs to be pedantic about how something was said.
Speech is weird: you need to catch both local and global patterns:
Local interactions
The difference between a retroflex zh and an alveolar z happens in a split second. CNNs are excellent at capturing these short-range spectral features.
Global interactions
Mandarin tones are relative (a “high” pitch for me might be low for a child) and context-dependent (tone sandhi). Transformers excel at modeling this longer-range context.
Conformers combine both: convolution for local detail, attention for global structure.
Most modern ASR models (e.g. Whisper) are sequence-to-sequence: they turn audio into the most likely text. The downside is they’ll happily auto-correct you.
That’s a feature for transcription, but it’s a bug for language learning. If my tone is wrong, I don’t want the model to guess what I meant. I want it to tell me what I actually said.
CTC works differently. It outputs a probability distribution for every frame of audio (roughly every 40 ms). To handle alignment, it introduces a special token.
If the audio is “hello”, the raw output might look like:
Collapsing repeats and removing blanks gives hello. This forces the model has to deal with what I actually said, frame by frame.
CTC tells us what was said, but not exactly when.
For a 3-second clip, the model might output a matrix with ~150 time steps (columns), each containing probabilities over all tokens (rows). Most of that matrix is just .
If the user reads “Nǐ hǎo” (ni3, hao3), we expect two regions of high probability: one for ni3, one for hao3.
We need to find a single, optimal path through this matrix that:
This is exactly what the Viterbi algorithm computes, using dynamic programming.
Most Mandarin ASR systems output Hanzi. That hides pronunciation errors, because the writing system encodes meaning rather than pronunciation.
Instead, I created a token for every Pinyin syllable + tone:
If I say the wrong tone, the model explicitly predicts the wrong token ID.
I also normalised the neutral tone by forcing it to be tone 5 (ma5). This resulted in a vocabulary of 1,254 tokens, plus and .
I combined the AISHELL-1 and Primewords datasets (~300 hours total), augmented by SpecAugment (time/frequency masking). On 4× NVIDIA GeForce RTX 4090s, training took about 8 hours. Instead of obsessing over loss, I mostly focused on these metrics:
Confusion Groups: errors between difficult initial pairs like zh/ch/sh vs z/c/s.
I started with a “medium” model (~75M parameters). It worked well, but I wanted something that could run in a browser or on a phone without killing the battery.
So I kept shrinking it, and I was honestly surprised by how little accuracy I lost:
The 9M-parameter model was barely worse. This strongly suggests the task is data-bound, not compute-bound.
The FP32 model was ~37 MB. After INT8 quantisation, it shrank to ~11 MB with a negligible accuracy drop (+0.0003 TER). Small enough to load instantly via onnxruntime-web.
To highlight mistakes, we need forced alignment. But I hit a nasty bug with leading silence.
I recorded myself saying “我喜欢…” and paused for a second before speaking. The model confidently told me my first syllable was wrong. Confidence score: 0.0.
The alignment assigned the silent frames to wo3. When I averaged probabilities over that span, the overwhelming probability completely drowned out wo3.
I decoupled UI spans (what gets highlighted) from scoring frames (what contributes to confidence).
We simply ignore frames where the model is confident it’s seeing silence:
This single change moved my confidence score for the first syllable from 0.0 → 0.99.
I can already feel my pronunciation improving while beta testing this. It’s strict and unforgiving, exactly what I needed.
Native speakers, interestingly, complained that they had to over-enunciate to get marked correct. That’s likely a domain-shift issue: AISHELL is mostly read speech, while casual speech is faster and more slurred. Kids do poorly too: their pitch is higher, and they’re basically absent from the training data. Adding conversational datasets like Common Voice feels like the obvious next step.
You can try the live demo here. It runs entirely in your browser. The download is ~13MB, still smaller than most websites today.
...
Read the original on simedw.com »
To see all available qualifiers, see our documentation.
We read every piece of feedback, and take your input very seriously.
Secure your code as you build
To see all available qualifiers, see our documentation.
We read every piece of feedback, and take your input very seriously.
Secure your code as you build
You signed in with another tab or window. Reload to refresh your session.
You signed out in another tab or window. Reload to refresh your session.
You switched accounts on another tab or window. Reload to refresh your session.
...
Read the original on github.com »
PeerWeb is a revolutionary way to host and share websites using WebTorrent technology. Instead of relying on centralized servers, websites are distributed across a peer-to-peer network, making them censorship-resistant and always available. 🌍✨
Keep this PeerWeb tab open to host your site! As long as this tab remains open, your website will be available to others through the peer-to-peer network.
💡 Alternative: Download our desktop client for permanent hosting without keeping browser tabs open:
📚 How to Use PeerWeb
🎨 Create your website - Build a static website with HTML, CSS, JavaScript, and assets
📤 Upload via drag & drop - Simply drag your website folder to the upload area above
🔗 Share the link - Your site gets a unique PeerWeb link that works anywhere
🌍 Keep hosting - Leave this tab open or use our desktop client for permanent hosting
To load a website from a torrent hash, enter it below:
🎯 Just the hash! PeerWeb automatically adds the magnet link prefix and trackers.
For developers and troubleshooting, add &debug=true to see detailed progress:
📄 Must contain an index.html file (in root or subfolder)
🔗 All resources should use relative paths
🔒 Files are served in a sandboxed environment for security
📱 Always Available - Works as long as peers are online
🎯 Simple URLs - Just add the torrent hash to any PeerWeb site
🌍 Made with ❤️ for the decentralized web 🌍
...
Read the original on peerweb.lol »
Nicole Sperling and Brooks Barnes, reporting for The New York Times:
Amazon paid Ms. Trump’s production company $40 million for the rights to “Melania,” about $26 million more than the next closest bidder, Disney. The fee includes a related docuseries that is scheduled to air later this year. The budget for “Melania” is unknown, but documentaries that follow a subject for a limited amount of time usually cost less than $5 million to produce. The $35 million for marketing is 10 times what some other high-profile documentaries have received.
All of which has a lot of Hollywood questioning whether Amazon’s push is anything more than the company’s attempt to ingratiate itself with President Trump.
This is a good story, with multiple industry sources with experience making political documentaries, but the Times’s own subhead downplays Amazon’s spending on the film: “The tech giant is spending $35 million to promote its film about the first lady, far more than is typical for documentaries.” They’re spending $35 million now, to promote it, but they already paid $40 million for the rights to the film, $28 million of which is believed to have gone to Melania Trump herself. A $35 million total spend would be a lot compared to other high-profile documentaries, but it’s a $75 million total spend. This is not just a little fishy — it’s a veritable open air seafood market.
To grasp just how uncustomary Amazon’s marketing push for “Melania” is, consider how Magnolia Pictures handled “RBG,” a portrait of Ruth Bader Ginsburg during her 25th year as a Supreme Court justice, in 2018.
CNN Films produced “RBG” for around $1 million. The promotional budget, including an awards campaign that helped it land two Oscar nominations, totaled about $3 million. The film debuted in 34 theaters and expanded into 432 locations over several weeks. It ultimately collected $14 million, enough to rank as the year’s No. 1 political documentary.
On Friday, “Melania” will also be released in 1,600 theaters overseas, where FilmNation, a New York company, is handling distribution in more than 20 countries. International ticket sales are expected to be weak, according to box office analysts.
...
Read the original on daringfireball.net »
Gold and silver prices plunged Friday, as President Donald Trump’s nomination for the next chair of the Federal Reserve, Kevin Warsh, appeared to relieve concerns about the central bank’s independence and sent the dollar soaring. Spot silver was down 28% at $83.45 an ounce, trading near its lows of the day. Silver futures plummeted 31.4% to settle at $78.53, marking its worst day since March 1980.
The sharp moves down were initially triggered by reports of Warsh’s nomination. However, they gained steam in afternoon U. S. trading as investors who piled into the metals raced to book profits. Metals were also under pressure as the dollar spiked higher, making it more expensive for foreign investors to buy gold and silver and spoiling the theory that metals would replace the greenback as the globe’s reserve currency. The dollar index last traded around 0.8% higher. “This is getting crazy,” said Matt Maley, equity strategist at Miller Tabak. “Most of this is probably ‘forced selling.’ This has been the hottest asset for day traders and other short-term traders recently. So, there has been some leverage built up in silver. With the huge decline today, the margin calls went out.”
National Economic Council Director Kevin Hassett had been the favorite to replace Powell for some time, but Warsh became the front-runner in prediction markets in recent days. In a note on Friday morning, Evercore ISI’s Krishna Guha said the market was “trading Warsh hawkish.“”The Warsh pick should help stabilize the dollar some and reduce (though not eliminate) the asymmetric risk of deep extended dollar weakness by challenging debasement trades — which is also why gold and silver are sharply lower,” the firm’s vice chairman said.“But, we advise against overdoing the Warsh hawkish trade across asset markets — and even see some risk of a whipsaw. We see Warsh as a pragmatist not an ideological hawk in the tradition of the independent conservative central banker.“Claudio Wewel, FX strategist at J. Safra Sarasin Sustainable Asset Management, told CNBC’s “Squawk Box Europe” on Friday that a “perfect storm” of geopolitical tensions had helped precious metals move higher this year, pointing to the U. S. capture of Venezuelan President Nicolás Maduro and Washington’s threats to use military force in Greenland and Iran.More recently, he said, speculation over who would be nominated as the next Fed chair had been influencing metals markets. “The market has clearly been pricing the risk of a much more dovish contender, that’s been largely helping the gold price along with other precious metal prices. Over the last 24 hours, the news flow has changed a little bit,” Wewel said, prior to Trump’s announcement.
Gold and silver both enjoyed record-smashing rallies in 2025, surging 66% and 135%, respectively, over the course of the year. Coeur Mining lost 17%. Silver ETFs were dragged into the action, with the ProShares Ultra Silver fund last seen more than 62% lower. The iShares Silver Trust ETF lost 31%. Both funds were headed for their worst days on record. Precious metals have been on a stellar rally over the past 12 months, amid broader market volatility, the decline of the U.S. dollar, bubbling geopolitical tensions and concerns about the independence of the Federal Reserve. Katy Stoves, investment manager at British wealth management firm Mattioli Woods, told CNBC on Friday morning that the moves were likely “a market-wide reassessment of concentration risk.” “Just as tech stocks — particularly AI-related names — have dominated market attention and capital flows, gold has similarly seen intense positioning and crowding,” she said. “When everyone is leaning the same way, even good assets can sell off as positions get unwound. The parallel isn’t accidental: both represent areas where capital has flooded in based on powerful narratives, and concentrated positions eventually face their day of reckoning.“Meanwhile, Toni Meadows, head of investment at BRI Wealth Management, contended that gold’s run to the $5,000 mark had happened “too easily.” He noted that the unwinding of the greenback had supported gold prices, but that the dollar had appeared to stabilize. “Central bank buying has driven the longer-term rally but this has tailed off in recent months,” he said. “The case for further reserve diversification is still there though as Trump’s trade policies and intervention in foreign affairs will make a lot of countries nervous about holding U.S. assets, especially those countries in the emerging markets or aligned to China or Russia. Silver will mirror the direction of gold, so it is not surprising to see falls there.”
...
Read the original on www.cnbc.com »
Visibility and context on the threats that matter most. Contact Us & Get a Demo
This week Google and partners took action to disrupt what we believe is one of the largest residential proxy networks in the world, the IPIDEA proxy network. IPIDEA’s proxy infrastructure is a little-known component of the digital ecosystem leveraged by a wide array of bad actors.
This disruption, led by Google Threat Intelligence Group (GTIG) in partnership with other teams, included three main actions:
Took legal action to take down domains used to control devices and proxy traffic through them.
Shared technical intelligence on discovered IPIDEA software development kits (SDKs) and proxy software with platform providers, law enforcement, and research firms to help drive ecosystem-wide awareness and enforcement. These SDKs, which are offered to developers across multiple mobile and desktop platforms, surreptitiously enroll user devices into the IPIDEA network. Driving collective enforcement against these SDKs helps protect users across the digital ecosystem and restricts the network’s ability to expand.
These efforts to help keep the broader digital ecosystem safe supplement the protections we have to safeguard Android users on certified devices. We ensured Google Play Protect, Android’s built-in security protection, automatically warns users and removes applications known to incorporate IPIDEA SDKs, and blocks any future install attempts.
We believe our actions have caused significant degradation of IPIDEA’s proxy network and business operations, reducing the available pool of devices for the proxy operators by millions. Because proxy operators share pools of devices using reseller agreements, we believe these actions may have downstream impact across affiliated entities.
In contrast to other types of proxies, residential proxy networks sell the ability to route traffic through IP addresses owned by internet service providers (ISPs) and used to provide service to residential or small business customers. By routing traffic through an array of consumer devices all over the world, attackers can mask their malicious activity by hijacking these IP addresses. This generates significant challenges for network defenders to detect and block malicious activities.
A robust residential proxy network requires the control of millions of residential IP addresses to sell to customers for use. IP addresses in countries such as the US, Canada, and Europe are considered especially desirable. To do this, residential proxy network operators need code running on consumer devices to enroll them into the network as exit nodes. These devices are either pre-loaded with proxy software or are joined to the proxy network when users unknowingly download trojanized applications with embedded proxy code. Some users may knowingly install this software on their devices, lured by the promise of “monetizing” their spare bandwidth. When the device is joined to the proxy network, the proxy provider sells access to the infected device’s network bandwidth (and use of its IP address) to their customers.
While operators of residential proxies often extol the privacy and freedom of expression benefits of residential proxies, Google Threat Intelligence Group’s (GTIG) research shows that these proxies are overwhelmingly misused by bad actors. IPIDEA has become notorious for its role in facilitating several botnets: its software development kits played a key role in adding devices to the botnets, and its proxy software was then used by bad actors to control them. This includes the BadBox2.0 botnet we took legal action against last year, and the Aisuru and Kimwolf botnets more recently. We also observe IPIDEA being leveraged by a vast array of espionage, crime, and information operations threat actors. In a single seven day period in January 2026, GTIG observed over 550 individual threat groups that we track utilizing IP addresses tracked as IPIDEA exit nodes to obfuscate their activities, including groups from China, DPRK, Iran and Russia. The activities included access to victim SaaS environments, on-premises infrastructure, and password spray attacks. Our research has found significant overlaps between residential proxy network exit nodes, likely because of reseller and partnership agreements, making definitive quantification and attribution challenging.
In addition, residential proxies pose a risk to the consumers whose devices are joined to the proxy network as exit nodes. These users knowingly or unknowingly provide their IP address and device as a launchpad for hacking and other unauthorized activities, potentially causing them to be flagged as suspicious or blocked by providers. Proxy applications also introduce security vulnerabilities to consumers’ devices and home networks. When a user’s device becomes an exit node, network traffic that they do not control will pass through their device. This means bad actors can access a user’s private devices on the same network, effectively exposing security vulnerabilities to the internet. GTIG’s analysis of these applications confirmed that IPIDEA proxy did not solely route traffic through the exit node device, they also sent traffic to the device, in order to compromise it. While proxy providers may claim ignorance or close these security gaps when notified, enforcement and verification is challenging given intentionally murky ownership structures, reseller agreements, and diversity of applications.
Our analysis of residential proxy networks found that many well-known residential proxy brands are not only related but are controlled by the actors behind IPIDEA. This includes the following ostensibly independent proxy and VPN brands:
The same actors that control these brands also control several domains related to Software Development Kits (SDKs) for residential proxies. These SDKs are not meant to be installed or executed as standalone applications, rather they are meant to be embedded into existing applications. The operators market these kits as ways for developers to monetize their applications, and offer Android, Windows, iOS, and WebOS compatibility. Once developers incorporate these SDKs into their app, they are then paid by IPIDEA usually on a per-download basis.Figure 1: Advertising from PacketSDK, part of the IPIDEA proxy networkOnce the SDK is embedded into an application, it will turn the device it is running on into an exit node for the proxy network in addition to providing whatever the primary functionality of the application was. These SDKs are the key to any residential proxy network—the software they get embedded into provides the network operators with the millions of devices they need to maintain a healthy residential proxy network.
While many residential proxy providers state that they source their IP addresses ethically, our analysis shows these claims are often incorrect or overstated. Many of the malicious applications we analyzed in our investigation did not disclose that they enrolled devices into the IPIDEA proxy network. Researchers have previously found uncertified and off-brand Android Open Source Project devices, such as television set top boxes, with hidden residential proxy payloads.
The following SDKs are controlled by the same actors that control the IPIDEA proxy network:
We performed static and dynamic analysis on software that had SDK code embedded in it as well as standalone SDK files to identify the command-and-control (C2) infrastructure used to manage proxy exit nodes and route traffic through them. From the analysis we observed that EarnSDK, PacketSDK, CastarSDK, and HexSDK have significant overlaps in their C2 infrastructure as well as code structure.
Tier One: Upon startup, the device will choose from a set of domains to connect to. The device sends some diagnostic information to the Tier One server and receives back a data payload that includes a set of Tier Two nodes to connect to.
Tier Two: The application will communicate directly with an IP address to periodically poll for proxy tasks. When it receives a proxy task it will establish a new dedicated connection to the Tier Two IP address and begin proxying the payloads it receives.
The device diagnostic information can be sent as HTTP GET query string parameters or in the HTTP POST body, depending on the domain and SDK. The payload sent includes a key parameter, which may be a customer identifier used to determine who gets paid for the device enrollment.The response from the Tier One server includes some timing information as well as the IP addresses of the Tier Two servers that this device should periodically poll for tasking.{“code”:200,“data”:{“schedule”:24,“thread”:150,“heartbeat”:20,“ip”:[redacted],“info”:“US”,“node”:[{“net_type”:“t”,“connect”:“49.51.68.143:1000”,“proxy”:“49.51.68.143:2000”},{“net_type”:“t”,“connect”:“45.78.214.188:800”,“proxy”:“45.78.214.188:799”}]}
Figure 4: Sample response received from the Tier One Server
The Tier Two servers are sent as connect and proxy pairs. In all analyses the pairs have been IP addresses, not domains. In our analysis, the pairs are the same IP address but different ports. The connect port is used to periodically poll for new proxy tasking. This is performed by sending TCP packets with encoded JSON payloads.{“name”: “0c855f87a7574b28df383eca5084fcdc”, “o”: “eDwSokuyOuMHcF10″, “os”: “windows”}
Figure 5: Sample encoded JSON sent to Tier Two connect portWhen the Tier Two server has traffic to route to the device, it will respond back with the FQDN to proxy traffic to as well as a connection ID.www.google.com:443&c8eb024c053f82831f2738bd48afc256
Figure 6: Sample proxy tasking from the Tier Two serverThe device will then establish a connection to the proxy port of the same Tier Two server and send the connection ID, indicating that it is ready to receive data payloads.8a9bd7e7a806b2cc606b7a1d8f495662|ok
Figure 7: Sample data sent from device to the Tier Two proxy portThe Tier Two server will then immediately send data payloads to be proxied. The device will extract the TCP data payload, establish a socket connection to the specified FQDN and send the payload, unmodified, to the destination.
The SDKs each have their own set of Tier One domains. This comes primarily from analysis of standalone SDK files.
Download requests to files from the Hex SDK website redirect to castarsdk\.com. The SDKs are exactly the same.
The EarnSDK JAR package for Android has strong overlaps with the other SDK brands analyzed. Earlier published samples contained the Tier One C2 domains:
Of note, these domains were observed as part of the BadBox2.0 botnet and were sinkholed in our earlier litigation. Pivoting off these domains and other signatures, we identified some additional domains used as Tier One C2 domains:
Our analysis of various malware samples and the SDKs found a single shared pool of Tier Two servers. As of this writing there were approximately 7,400 Tier Two servers. The number of Tier Two nodes changes on a daily basis, consistent with a demand-based scaling system. They are hosted in locations around the globe, including the US. This indicates that despite different brand names and Tier One domains, the different SDKs in fact manage devices and proxy traffic through the same infrastructure.
The IPIDEA actors also control domains that offer free Virtual Private Network services. While the applications do seem to provide VPN functionality, they also join the device to the IPIDEA proxy network as an exit node by incorporating Hex or Packet SDK. This is done without clear disclosures to the end user, nor is it the primary function of the application.
We identified a total of 3,075 unique Windows PE file hashes where dynamic analysis recorded a DNS request to at least one Tier One domain. A number of these hashes were for the monetized proxy exit node software, PacketShare. Our analysis also uncovered applications masquerading as OneDriveSync and Windows Update. These trojanized Windows applications were not distributed directly by the IPIDEA actors.
We identified over 600 applications across multiple download sources with code connecting to Tier One C2 domains. These apps were largely benign in function (e.g., utilities, games, and content) but utilized monetization SDKs that enabled IPIDEA proxy behavior.
This week we took a number of steps designed to comprehensively dismantle as much of IPIDEA’s infrastructure as possible.
We took legal action to take down the C2 domains used by bad actors to control devices and proxy traffic. This protects consumer devices and home networks by disrupting the infrastructure at the source.
To safeguard the Android ecosystem, we enforced our platform policies against trojanizing software, ensuring Google Play Protect on certified Android devices with Google Play services automatically warns users and removes applications known to incorporate IPIDEA software development kits (SDKs), and blocks any future install attempts.
We took legal action to take down the domains used to market IPIDEA’s products, including proxy software and software development kits, across their various brands.
We’ve shared our findings with industry partners to enable them to take action as well. We’ve worked closely with other firms, including Spur and Lumen’s Black Lotus Labs to understand the scope and extent of residential proxy networks and the bad behavior they often enable. We partnered with Cloudflare to disrupt IPIDEA’s domain resolution, impacting their ability to command and control infected devices and market their products.
While we believe our actions have seriously impacted one of the largest residential proxy providers, this industry appears to be rapidly expanding, and there are significant overlaps across providers. As our investigation shows, the residential proxy market has become a “gray market” that thrives on deception—hijacking consumer bandwidth to provide cover for global espionage and cybercrime. More must be done to address the risks of these technologies.
Residential proxies are an understudied area of risk for consumers, and more can be done to raise awareness. Consumers should be extremely wary of applications that offer payment in exchange for “unused bandwidth” or “sharing your internet.” These applications are primary ways for illicit proxy networks to grow, and could open security vulnerabilities on the device’s home network. We urge users to stick to official app stores, review permissions for third-party VPNs and proxies, and ensure built-in security protections like Google Play Protect are active.
Consumers should be careful when purchasing connected devices, such as set top boxes, to make sure they are from reputable manufacturers. For example, to help you confirm whether or not a device is built with the official Android TV OS and Play Protect certified, our Android TV website provides the most up-to-date list of partners. You can also take these steps to check if your Android device is Play Protect certified.
Residential proxy providers have been able to flourish under the guise of legitimate businesses. While some providers may indeed behave ethically and only enroll devices with the clear consent of consumers, any claims of “ethical sourcing” must be backed by transparent, auditable proof of user consent. Similarly, app developers have a responsibility to vet the monetization SDKs they integrate.
We encourage mobile platforms, ISPs, and other tech platforms to continue sharing intelligence and implementing best practices to identify illicit proxy networks and limit their harms.
To assist the wider community in hunting and identifying activity outlined in this blog post, we have included a comprehensive list of indicators of compromise (IOCs) in a GTI Collection for registered users.
Vishing for Access: Tracking the Expansion of ShinyHunters-Branded SaaS Data TheftGuidance from the Frontlines: Proactive Defense Against ShinyHunters-Branded Data Theft Targeting SaaSClosing the Door on Net-NTLMv1: Releasing Rainbow Tables to Accelerate Protocol Deprecation
...
Read the original on cloud.google.com »
ICE is using a smartphone app called “Mobile Fortify” to scan faces and capture contactless fingerprints, instantly pulling back names and biographical data — and court filings say the same encounters are being followed by revocations of Global Entry and TSA PreCheck.
That turns “trusted traveler” into chilling of speech. DHS runs both the surveillance and the program, and being “under investigation” can be enough to lose your status even if protesting itself cannot legally be a disqualifier.
The Department of Homeland Security and Immigration and Customs Enforcement is expanding use of identificationand tracking — not just immigration targets but also on U. S. citizens who are documenting, protesting, and observing enforcement operations. And participating in these events is getting Global Entry yanked.
The government is using a smartphone app called “Mobile Fortify” that lets agents scan a face and even capture ‘contactless’ fingerprints and run them through biometric matching systems to return names and biographical data. Reportedly the agency has used Mobile Fortify over 100,000 times. They use BI2 Technologies for smartphone iris scanning against a large law enforcement iris database. The agency defends this all as “lawful.”
In addition, ICE uses license plate reader data, commercial phone location data, drones, and other tools to monitor protests by U. S. citizens.
Global Entry is administered by the Department of Homeland Security, its data was used to train Mobile Fortify, and citizens in the program are subject to having the status revoked if they’re being investigated. DHS investigates people protesting DHS.
Customs and Border Protection can deem you ineligible “at its sole discretion” if you present a potential risk for terrorism, criminality, or are otherwise no longer considered low risk. It bases risk determinations partly on demonstrated compliance.
They can kick yo uout for arrests or being the subject of an investigation by any law enforcement agency, or suspect conduct that is ‘terrorism-related’.
Protesting isn’t a listed or ‘valid’ reason for having Global Entry revoked, but being arrested at a protest is. Impeding or interfering with the agency is. And being investigated is.
In a court filing, Nicole Cleland says she observing ICE activities in her neighborhood when an agent approached her vehicle, addressed her by name, said they had “facial recognition” and warned she was “impeding” and could be arrested if it happened again. Three days later, she received email notice her Global Entry and TSA PreCheck status was revoked.
Homeland Security does continuous checks on Global Entry members, and may uncover a past conviction that wasn’t disclosed during the application (generally minor offenses over 10 years old, such as a DUI, are fine if you disclose them) or a new conviction. Breaking program rules or rules in the immigration hall such as failing to declare items or bringing ineligible family members with you into the Global Entry queues can get you kicked out if the customs officer decides to make an issue of it.
You can lose Global Entry for complaining about a customs officer. Putting an apple from your flight in your bag, and then not declaring it can cost you your Global Entry. So can attempting a coup against the United States.
So, too, now it seems just for protesting against government policy. And that has a huge chilling effect on public dissent. If you’re punished for expressing views contrary to those in power, you’ll be less likely to express those views. It’ll then appear to others that there’s a consensus supporting those in power, making it harder for still others to dissent. That’s what you get in authoritarian regimes — preference falsification, where everyone publicly tows the dominant line and is unwilling to reveal their true beliefs.
While more people are being kicked out of Global Entry than ever before, 39% of people who appeal the revocation win. Plus, DHS decisions on Global Entry are subject to judicial review, at least in the ninth circuit.
More From View from the Wing
...
Read the original on viewfromthewing.com »
In my YouTube channel, for some time now I started to refer to the process of writing software using AI assistance (soon to become just “the process of writing software”, I believe) with the term “Automatic Programming”.
In case you didn’t notice, automatic programming produces vastly different results with the same LLMs depending on the human that is guiding the process with their intuition, design, continuous steering and idea of software.
Please, stop saying “Claude vibe coded this software for me”. Vibe coding is the process of generating software using AI without being part of the process at all. You describe what you want in very general terms, and the LLM will produce whatever happens to be the first idea/design/code it would spontaneously, given the training, the specific sampling that happened to dominate in that run, and so forth. The vibe coder will, at most, report things not working or not in line with what they expected.
When the process is actual software production where you know what is going on, remember: it is the software *you* are producing. Moreover remember that the pre-training data, while not the only part where the LLM learns (RL has its big weight) was produced by humans, so we are not appropriating something else. We can pretend AI generated code is “ours”, we have the right to do so. Pre-training is, actually, our collective gift that allows many individuals to do things they could otherwise never do, like if we are now linked in a collective mind, in a certain way.
That said, if vibe coding is the process of producing software without much understanding of what is going on (which has a place, and democratizes software production, so it is totally ok with me), automatic programming is the process of producing software that attempts to be high quality and strictly following the producer’s vision of the software (this vision is multi-level: can go from how to do, exactly, certain things, at a higher level, to stepping in and tell the AI how to write a certain function), with the help of AI assistance. Also a fundamental part of the process is, of course, *what* to do.
I’m a programmer, and I use automatic programming. The code I generate in this way is mine. My code, my output, my production. I, and you, can be proud.
If you are not completely convinced, think to Redis. In Redis there is not much technical novelty, especially at its start it was just a sum of basic data structures and networking code that every competent system programmer could write. So, why it became a very useful piece of software? Because of the ideas and visions it contained.
Programming is now automatic, vision is not (yet).
Please enable JavaScript to view the comments powered by Disqus.
blog comments powered by
...
Read the original on antirez.com »
To add this web app to your iOS home screen tap the share button and select "Add to the Home Screen".
10HN is also available as an iOS App
If you visit 10HN only rarely, check out the the best articles from the past week.
If you like 10HN please leave feedback and share
Visit pancik.com for more.