I would call this “stopping a major security risk,” but then what do I know. 

http://www.programmableweb.com/news/wells-fargo-cites-new-api-screen-scraping-countermeasure/elsewhere-web/2016/06/18?google_editors_picks=true

Wells Fargo Cites New API as Screen Scraping Countermeasure

…   Wells Fargo recently announced that it has created an API to make business bank account data available in accounting software Xero.  According to a recent article by Penny Crosman for American Banker, the turnaround comes in response to the continued use of screen scraping to access bank data.

…   These security concerns are largely founded on the fact that consumers are giving out their online banking username and password to third parties to access accounts and perform the scraping.  Several prominent banks are currently attempting to reduce the risk of financial data aggregation through the use of OAuth, as Wells Fargo is doing with Xero to leverage its commitment to the API concept.

(Related)

The practice is commonplace.  And the end-users are cooperating!

http://www.wsj.com/article_email/fintech-firm-plaid-raises-44-million-1466377808-lMyQjAxMTI2NzEwOTcxMjk1Wj

Fintech Firm Plaid Raises $44 Million

Plaid Technologies Inc., whose software allows a variety of financial-technology startups to access their customers’ bank account information, has raised $44 million in a new round led by a fund at Goldman Sachs Group Inc.

…   Many upstart financial-services providers such as online financial adviser Betterment Inc. use Plaid’s software to access or check customers’ account data when providing mobile and web services like budgeting, investing or lending.

I wish the government would stop providing my Computer Security students with such excellent “Bad Examples!”

FEMA Mishandles Sensitive Information at Disaster Sites: IG Report

Jack Moore reports:

After a wildfire tears through your community, the last thing you may be worried about is having your identity stolen or your personal information breached.

But maybe you should be.

A new inspector general report finds the Federal Emergency Management Agency still struggles to properly handle the safeguarding of personally identifiable information, or PII, at its disaster recovery centers.

Read more on NextGov.

(Related).  Proof that Liberals are Airheads?

Quebec Liberals’ strategy meetings were leaking…

Yet another security incident linked to failure to change default passwords.

CJAD in Canada reports that the Quebec Liberals’ failure to change the default password on their videoconferencing system allowed anyone to gain access to strategy meetings.

The user who found the flaw showed off the unlimited access to the Journal de Montreal. Published screenshots show archived videos of various meetings.

No need to hack opposition research, when you can just wait for the security clueless to leak their own data.

The competition continues.  The term “government malware” is not yet in common use.

Tor Is Teaming Up With Researchers To Protect Users From FBI Hacking

Joshua Kopstein writes:

The FBI has had a fair amount of success de-anonymizing Tor users over the past few years.  Despite the encryption software’s well-earned reputation as one of the best tools for online privacy, recent court cases have shown that government malware has compromised Tor users by exploiting bugs in the underlying Firefox browser—one of which was controversially provided to the FBI in 2015 by academic researchers at Carnegie Mellon University.

But according to a new paper, security researchers are now working closely with the Tor Project to create a “hardened” version of the Tor Browser, implementing new anti-hacking techniques which could dramatically improve the anonymity of users and further frustrate the efforts of law enforcement.

Read more on Motherboard.

Inspiration for our Ethical Hacking students?

http://www.programmableweb.com/news/how-to-use-undocumented-facebook-api-to-identify-friends-photos/how-to/2016/06/19?google_editors_picks=true

How to Use an Undocumented Facebook API to Identify Friends in Photos

…   Tagging friends in photos is nothing new, but the more recent Facebook feature that pops up asking ‘Do you want to tag X?’ when hovering over an image got developer Narendra Rajput wondering how Facebook identifies who the person is.  In this recent post, Rajput explained how he figured out the undocumented API. 

No matter who is right, this provides insight.  Do all Facebook users know this is what happens?  

http://www.bespacific.com/facebook-litigating-15b-user-internet-track-case/

Facebook litigating $15B user internet track case

by Sabrina I. Pacifici on Jun 19, 2016

Facebook Accused Of Tracking Users’ Internet Activity By Consuella Pachico – Jun 18, 2016 – “Facebook is facing multidistrict litigation over allegations that the social media site tracked users’ internet activity after they logged off.  Facebook is insisting that users cannot sue because they were not harmed by the site’s tracking activities.  In response to users’ claim that their privacy rights were violated by post-logoff tracking, Facebook states that nothing in the amended complaint identifies “how the alleged violations caused plaintiffs to suffer real, actually existing injuries that are not abstract, conjectural, or hypothetical.”

·         In re: Facebook Internet Tracking Litigation, case number 5:12-md-02314, in the U.S. District Court for the Northern District of California.

Something for Contract Law students to debate?  If I use your program to do what you program was designed to do, have I done anything wrong? 

Note claiming to be from DAO cryptocurrency hacker says stolen $53 million is legally his

You may feel like you’re entering the Twilight Zone after reading this report from Russell Brandom:

One day after $53 million abruptly disappeared from an experimental cryptocurrency project, a note claiming to be from the attacker has surfaced on PasteBin, claiming that the money drained from the system is now legally his.  The attacker withdrew the money by exploiting a contract bug in the code of the DAO (or Decentralized Autonomous Organization), a collective investment fund that uses the Ethereum cryptocurrency.  The DAO had raised well over $100 million from Ethereum users at the time of the attack.

“I have carefully examined the code of The DAO and decided to participate after finding the feature where splitting is rewarded with additional ether,” the note reads.  “I… have rightfully claimed 3,641,694 ether, and would like to thank the DAO for this reward,” the note reads.  “I am disappointed by those who are characterizing the use of this intentional feature as ‘theft.’”  The note also threatens legal action against any who attempt to reclaim the money through technical means.

Read more on The Verge.

The note from the “attacker” is very well written, suggesting a certain level of education.  But the gist of the note is that the individual thinks s/he’s found a loophole or clause in the contract that can be legally exploited and seems to be bragging about it.

This will be interesting to follow.

Pick one:

There are some things man was not meant to know.

The American people are too delicate to hear such things!

His words would convince millions to join ISIS.

He is right, we is wrong.

Have we become so afraid of terrorists that we can’t let people decide for themselves how crazy this guy was? 

http://www.realclearpolitics.com/video/2016/06/19/lynch_partial_transcript_of_orlando_911_calls_will_have_references_to_isis_cut_out.html

Lynch: "Partial Transcript" Of Orlando 911 Calls Will Have References To Islamic Terrorism Removed

In an interview with NBC's Chuck Todd, Attorney General Loretta Lynch says that on Monday, the FBI will release edited transcripts of the 911 calls made by the Orlando nightclub shooter to the police during his rampage.

"What we're not going to do is further proclaim this man's pledges of allegiance to terrorist groups, and further his propaganda," Lynch said.  "We are not going to hear him make his assertions of allegiance [to the Islamic State]."

A little “one-upmanship?”  I thought all US chips were already made in China – or is that only smartphones? 

http://www.computerworld.com/article/3085483/high-performance-computing/china-builds-world-s-fastest-supercomputer-without-u-s-chips.html?google_editors_picks=true

China builds world’s fastest supercomputer without U.S. chips

China on Monday revealed its latest supercomputer, a monolithic system with 10.65 million compute cores built entirely with Chinese microprocessors.  This follows a U.S. government decision last year to deny China access to Intel's fastest microprocessors.

There is no U.S.-made system that comes close to the performance of China's new system, the Sunway TaihuLight.  Its theoretical peak performance is 124.5 petaflops, according to the latest biannual release today of the world's Top500 supercomputers.  It is the first system to exceed 100 petaflops.  A petaflop equals one thousand trillion (one quadrillion) sustained floating-point operations per second.

Perspective.  Is this real competition or is everyone not Uber or Lyft just another small player?  It’s hard to keep track of them all!

http://www.bloomberg.com/news/articles/2016-06-15/uber-finds-passage-to-india-blocked-by-30-year-old-ola-founder

Uber Finds Passage to India Blocked by 30-Year-Old Ola Founder

(Related)

http://www.businessinsider.com/gett-launches-anti-uber-ad-campaign-2016-6

Black cab app Gett is launching a billboard campaign that mocks Uber for being expensive

(Related)

http://www.bespacific.com/americans-and-the-new-digital-economy-8-key-findings/

Americans and the new digital economy: 8 key findings

by Sabrina I. Pacifici on Jun 19, 2016

“Digital technology has ushered in a slew of new shared, collaborative and on-demand online services ranging from virtual marketplaces to home sharing.  These services have potentially far-reaching implications for consumers and regulators and for the future of work in this country. To examine the scope and impact of these new services, Pew Research Center conducted its first survey devoted to the broader issues of the new digital economy. Here are eight findings from the report…”

Reading with your ears is not really reading, but it beats not reading at all.

http://www.makeuseof.com/tag/this-site-has-thousands-of-free-public-domain-audiobooks/

This Site Has Thousands of Free Public Domain Audiobooks

…   If you want to experience a few audiobooks yourself without shelling out so much cash, consider heading over to Librivox.  It’s home to thousands of public domain audiobooks.  No price tags.

The key is that these audiobooks are read by volunteers from around the world, mainly those who are training to be voiceover artists.  Also, you won’t find newly released books, but you’ll find a lot of classics and hidden gems.

Simple.  Elegant.  Predictable?

http://blog.erratasec.com/2016/06/etheriumdao-hack-similfied.html#.V2aXPhJH6wE

Ethereum/TheDAO hack simplified

…   Bitcoin is just a public ledger (the "blockchain"), of all transaction there ever was.  This ledger is huge (80-gigabytes) and growing, but Moore's Law says computers grow even faster, so that shouldn't be a problem.

Each entry in the ledger says to move the coins received in these previous entries, and give them to this recipient. In other words:

move these coins I received there, to this guy here

…   How did The DAO get hacked?

When a member exits the investment scheme, they call the function name splitDAO().  There are two issues.

The first is that the member will supply some of their own code with the transaction.  Among the things that code will do is tell the DAO code how to transfer Ethereum coin.  It's a necessary feature, part of Bitcoin as well.

The second issue is that Ethereum code is recursive.  That means when a function is running, it may call itself a second time.

The bug is that when splitDAO() is called, it will then call the recipients code to transfer Ethereum coin, after which the recipients code will call splitDAO() again before finishing.  This causes the process to repeat itself, transferring more Ethereum coin, then calling splitDAO() again, which calls the hacker's code, which calls splitDAO(), which calls the hacker's code, and so on.  The process will continue endlessly, until it drains all of TheDAO's coin.

A little something for our Ethical Hacking students. 

https://techcrunch.com/2016/06/17/department-of-defense-expanding-hack-the-pentagon-program/

Department of Defense expanding Hack the Pentagon program

The department announced today that it is expanding its Hack the Pentagon program to include more DoD systems and networks.  Hack the Pentagon pays hackers to find and report vulnerabilities in exchange for cash, and so far it’s proved effective — the first bug was reported 13 minutes after the program launched.

…   “Although the pilot was a success, it only tested the crowdsourced security concept against public-facing websites.  We believe the concept will be successful when applied to many or all of DoD’s other security challenges,” a DoD spokesperson said in a statement.

Hack the Pentagon was administered by the bug bounty platform HackerOne, which reports that the pilot generated 138 unique bug reports and a total of $71,200 in bounties paid to hackers.

Not much guidance out there.

Australia Issues Draft Big Data Guidance

Lisa M. Thomas of Winston & Strawn writes:

The Office of the Australian Information Commissioner (OAIC) recently published a draft “Guide to big data and the Australian Privacy Principles” (Guide), and asked industry participants for comments.  The guide is intended to help companies understand how the Australian Privacy Principles (under the Australian Privacy Act 1988) apply to big data that contains information about “an identified individual, or an individual who is reasonably identifiable.”  Often, there is a question whether or not information contained in big data is really personally identifiable, or is “de-identified,” (Guide, p. 3) which to OAIC, is information that is sufficiently de-identified that “the information is no longer about an identified individual or an individual who is reasonably identifiable.” (Guide, p. 3).  When sufficiently de-identified, the Guide indicates, the privacy principles would not apply.

Read more on Winston & Strawn.

The Sports Book is open!  OR: Oh look, an application for Watson!

http://www.nytimes.com/2016/06/19/sports/new-york-state-lawmakers-vote-to-legalize-fantasy-sports.html

New York State Lawmakers Vote to Legalize Fantasy Sports

…   The businesses’ legislative backers in New York have insisted that fantasy sports is not gambling — which is mostly barred by the state’s Constitution — but rather is “based upon the skill and knowledge of the participants.”  The widely advertised games, in which players create imaginary teams using real players and win or lose depending on the players’ statistics, would be classified as games of skill, not chance, a distinction under a 2006 federal law governing online wagering.

An illustration of the old adage, “Cheaters never prosper!”  (Unless they get away with it of course.) 

http://www.bloomberg.com/news/articles/2016-06-18/vw-said-ready-with-10-bln-diesel-accord-to-devise-fix-later

VW Said Ready With $10 Billion Diesel Plan, to Devise Fix Later

Volkswagen AG  will submit its $10 billion plan this month to fix a half-million emissions-cheating cars or get them off U.S. roads even though it’s awaiting regulators’ sign-off on how to retrofit the vehicles, a person familiar with the matter said.

About $6.5 billion will go to car owners and $3.5 billion to the U.S. government and California regulators, said the person, who asked not to be identified because the deal isn’t public yet.

Perspective.  Successful is not always profitable.  A lesson for my IT Architecture students.

http://www.nytimes.com/2016/06/19/magazine/can-netflix-survive-in-the-new-world-it-created.html?_r=0

Can Netflix survive in the new world it created?

…   Netflix, since its streaming service debuted in 2007, has had its annual revenue grow sixfold, to $6.8 billion from $1.2 billion.  More than 81 million subscribers pay Netflix $8 to $12 a month, and slowly but unmistakably these consumers are giving up cable for internet television: Over the last five years, cable has lost 6.7 million subscribers; more than a quarter of millennials (70 percent of whom use streaming services) report having never subscribed to cable in their lives.  Those still paying for cable television were watching less of it.  In 2015, for instance, television viewing time was down 3 percent; and 50 percent of that drop was directly attributable to Netflix, according to a study by MoffettNathanson, an investment firm that tracks the media business.

All of this has made Netflix a Wall Street favorite, with a stock price that rose 134 percent last year.

…   At the moment, Netflix has a negative cash flow of almost $1 billion; it regularly needs to go to the debt market to replenish its coffers.  Its $6.8 billion in revenue last year pales in comparison to the $28 billion or so at media giants like Time Warner and 21st Century Fox.  And for all the original shows Netflix has underwritten, it remains dependent on the very networks that fear its potential to destroy their longtime business model in the way that internet competitors undermined the newspaper and music industries.

(Related) Something else for my Architecture students.  (Who are all too young to remember.)

http://www.theatlantic.com/business/archive/2016/06/mobile-is-eating-everything/487148/

How Mobile Today Is Like TV Six Decades Ago

In the early 1950s, television was popular, but unsophisticated.  This was a common sentiment, even among the people who produced it—"a hybrid monstrosity derived from newspapers, radio news, and newsreels, which inherited none of the merits of its ancestors," as one CBS News anchor summed it up.  But either despite its gimmicky shortcomings or because of them, advertisers loved the little box.  Revenue from ads increased more than 60 percent a year for the first five years of the decade, so that by 1955, television accounted for nearly 20 percent of total U.S. media advertising.

This year, mobile media accounts for the exact same share, nearly 20 percent of total U.S. media spending.  So, in a very real way, mobile is today where television was exactly six decades ago.

In case you missed this yesterday…

http://chronicle.com/blogs/ticker/facebook-reveals-how-it-decides-if-a-research-project-is-ethical/112165

Facebook Reveals How It Decides if a Research Project Is Ethical

…   Now, after nearly two years of soul-searching, Facebook has revealed how it reviews and approves the experiments the company runs on users without them knowing about it.
In a new paper, called “Evolving the IRB: Building Robust Review for Industry Research,” company officials describe a process that loosely imitates the system used at universities, which convene institutional review boards, or IRBs, to evaluate research projects on their scientific and ethical merits.
At Facebook, which is constantly experimenting on its users, “expert” managers have to approve all research projects, according to the paper.

Many students use Chrome; not sure how many have a map-able mind.

http://www.freetech4teachers.com/2016/06/connected-mind-mind-mapping-app-in.html

Connected Mind - A Mind Mapping App in Chrome

Connected Mind is a free mind mapping tool that you can find in the Google Chrome Web Store. Using Connected Mind you can create free-form mind maps or use a template. A lot of mind mapping tools lock you into using straight lines between elements, but Connected Mind is not one of them. Connected Minds allows you to create mind maps in any configuration that you like. As it is a Chrome Web Store app, Connected Mind allows you to save your work online using your Google Account credentials. The video below offers a demonstration of Connected Minds (there is not any sound in the video).

https://www.youtube.com/watch?v=owY8BkH2eaU

This is not the future.  This is now!

http://dilbert.com/strip/2016-06-19

A most interesting hack. 

http://www.wsj.com/articles/investment-fund-based-on-digital-currency-to-wind-down-after-alleged-hack-1466175033

Fund Based on Digital Currency Ethereum to Wind Down After Alleged Hack

…   Founders of the fund, DAO, which was built around a digital currency called Ethereum and which raised more than $150 million this spring, said Friday morning they have been forced to shut down the fund and plan for its unwinding.

The attack spirited away roughly 3.6 million Ethereum coins, valued at around $55 million, from DAO to another account.

…   The DAO’s founders are planning to “fork” the code and effectively void the hacker’s transactions.

“The DAO’s journey is over but all funds are safe,” said Stephan Tual, the founder of Slock.It, the group that created DAO, which stands for Decentralized Autonomous Organization.  “All stolen funds will be retrieved from the attacker.”

…   DAO was set up in May as an experiment in using digital currencies and self-operating digital contracts to create a venture-capital fund that could run itself.  But it was criticized early on for being poorly constructed, and there were calls for it to halt operations while it worked out its bugs.  Those criticisms now appear prescient.

…   One investor in the DAO, Menno Pietersen, said he opposed the rescue and called the incident a “horrible mess.”  The DAO’s creators “messed up” and didn’t take the time to build their product correctly, he said.  He acknowledged that he himself didn’t vet the investment carefully enough, but said that as a backer of Ethereum, he was against any fix that would invalidate the goal of creating a decentralized platform.  If trades can simply be erased, he asked, “what will they do next?”

Because no one is perfect.  Perhaps penetration testing should be continuous?  (Pay attention Ethical Hacking students.) 

https://www.buzzfeed.com/williamalden/how-hired-hackers-got-complete-control-of-palantir?utm_term=.umzBEJm0x#.vugWrJB6M

How Hired Hackers Got “Complete Control” Of Palantir

Palantir Technologies has cultivated a reputation as perhaps the most formidable data analysis firm in Silicon Valley, doing secretive work for defense and intelligence agencies as well as Wall Street giants.  But when Palantir hired professional hackers to test the security of its own information systems late last year, the hackers found gaping holes that left data about customers exposed.

Palantir, valued at $20 billion, prides itself on an ability to guard important secrets, both its own and those entrusted to it by clients.  But after being brought in to try to infiltrate these digital defenses, the cybersecurity firm Veris Group concluded that even a low-level breach would allow hackers to gain wide-ranging and privileged access to the Palantir network, likely leading to the “compromise of critical systems and sensitive data, including customer-specific information.”

…   Virtually every company is vulnerable to hacks, to varying degrees.  In recent years, red teams generally have had a high success rate in getting deep inside of companies’ networks, and they virtually always find at least some security flaws, according to an industry source.  That Palantir did a red team exercise shows that it wanted to identify and repair any such flaws.  The Veris report notes multiple strengths in Palantir’s defenses, including an “excellent” response by its security staff.

I’ll bet this is not their policy.  If they have a policy.  Something my Computer Security students need to think about.

Screwing up the basics of incident response, Friday edition

For today’s object lesson (and maybe abject lesson), I give you FIS Global and Guaranty Bank and Trust.  I’ve written up the incident in more detail over on the Daily Dot, but the short version is a hacker (@1×0123) found a vulnerability in FIS Global’s client portal login and tweeted about it.  FIS didn’t respond to him directly.  Instead, they got his Twitter account locked and the screenshots removed.

Getting a hacker’s Twitter account locked.  What could possibly go wrong, right?

It wasn’t just the hacker they failed to respond to.  FIS also failed to respond to two inquiries by this blogger to their communications department and one attempt to reach their Twitter team.

Trying a different route, and not knowing at the time whether the vulnerability had been addressed, this blogger also reached out to contact the bank client whose data was being exposed on the Internet.  They didn’t reply to two voicemails left with two different executives.

C’mon, folks.  Don’t you want people to let you know if they find a vulnerability that’s exposing your customer data or proprietary information?  Are you familiar with behaviorism?

If you keep ignoring people when they take time out of their lives to try to alert you to a situation, well, then the next time someone finds a vulnerability, they’ll either just keep it to themselves, exploit it, or share it with others who will exploit it.  Is that what you really want?  When someone notifies you, then even if you were already aware of the situation, take a damned moment to let them know you got their message and appreciated it.

At the very least, try not to tick off the hacker, okay, because it just may make a difference in their decision to publicly dump your data.

Read my report on the Daily Dot

I thought this might happen.  Firefox is allowing anyone to have a personal account, a business account, a dating account, a job search account, a ‘say outrageous things’ account, a ‘don’t let this screw up my credit’ account, etc.  No doubt the FBI (et al) will want to make connections that users would like to keep separate. 

http://www.forbes.com/sites/federicoguerrini/2016/06/18/firefox-containers-help-you-browse-the-web-using-separate-identities/#45e281b95a6b

Firefox Containers Help You Browse The Web Using Separate Identities

In the physical world, when interacting with other people, we like to think that we have a strong, recognizable personality, but the truth is we often tend to change it according to the context we’re in.  We behave differently when we are among friends than with our boss, our parents or our children. At work we’re one person, on holiday another.

So far this has been hardly possible to replicate online, mainly because our surfing experience is tracked and monitored in every possible way in order to build a single, identifiable profile, which advertisers can use to target us.

Enters “Containers”, a new interesting feature Mozilla is testing in version 50 of the Nightly build of its popular Firefox browser.  As security engineer Tanvi Vyas writes in the company’s blog, with Containers “users are able to portray different characteristics of themselves in different situations”.

Say you have two twitter accounts and want to login to them at the same time? No need to open a secondary browser or launch a desktop application like TweetDeck.  With Nightly, you could just open the File menu and select the “New Container Tab” option, choosing between the Personal, Work, Shopping, and Banking options.

…   Imagine you’re trying to book a flight and you don’t want the airline to adjust the price according to your browsing history: you won’t have to delete all your cookies any more, just open a separate tab.

As Vyas acknowledges, the idea of contextual identities is not new, but so far it has been hard to implement, mainly because it’s difficult to figure out what the best user experience should be.

The model I’ve proposing for years!

http://arstechnica.com/information-technology/2016/06/what-if-switching-fiber-isps-was-as-easy-as-clicking-a-mouse/

Municipal fiber network will let customers switch ISPs in seconds

Most cities and towns that build their own broadband networks do so to solve a single problem: that residents and businesses aren't being adequately served by private cable companies and telcos.

But there's more than one way to create a network and offer service, and the city of Ammon, Idaho, is deploying a model that's worth examining.  Ammon has built an open access network that lets multiple private ISPs offer service to customers over city-owned fiber.  The wholesale model in itself isn't unprecedented, but Ammon has also built a system in which residents will be able to sign up for an ISP—or switch ISPs if they are dissatisfied—almost instantly, just by visiting a city-operated website and without changing any equipment.

Perspective.  My students will be shocked.  They thought Uber was always profitable. 

http://www.ft.com/cms/s/0%2Fafa1d4de-33bc-11e6-bda0-04585c31b153.html

Uber points to profits in all developed markets

Uber says it has now reached profitability in all its developed markets, underscoring the business case for the new ride-hailing models that are disrupting the transportation industry.

Travis Kalanick, chief executive, told the FT that Uber is making money in North America, Australia and in its Europe, Middle East and Africa region, on a basis that excludes interest and tax.

“We have hundreds of cities that are profitable globally,” he said.  “That allows us to invest in new places, and to sustainably invest in a very expensive place like China.”

Mr Kalanick also disclosed that China — where the company is fighting a costly subsidy battle with rival Didi Chuxing — is now Uber’s biggest market by number of rides, accounting for a third of the company’s daily trips.

Because crazy people…

http://www.bespacific.com/active-shooter-event-quick-reference-guide-dhs/

Active Shooter Event: Quick Reference Guide – DHS

by Sabrina I. Pacifici on Jun 17, 2016

Department of Homeland Security guide – quick reference guide to assist friends, family, colleagues, co-workers, organizations – “An “active shooter” is an individual who is engaged in killing or attempting to kill people in a confined and populated area; in most cases, active shooters use firearms(s) and there is no pattern or method to their selection of victims.”

Once again…

http://hackeducation.com/2016/06/17/hack-education-weekly-news

Hack Education Weekly News

…   “A Swedish college has been ordered to refund tuition fees to an American business student for giving her a poor economics education,” the AP reports.  “The Vastmanland court ruled Tuesday the Malardalen University’s two-year program ‘Analytical Finance’ that Connie Askenback attended from 2011 to 2013 ‘had no practical value.’”

…   From the press release: “Achieving the Dream Launches Major National Initiative to Help 38 Community Colleges in 13 States Develop New Degree Programs Using Open Educational Resources.”  More via The Chronicle of Higher Education.

…   Via the Detroit Free Press: “Wayne State drops math as general ed requirement.”  [5 out of 4 students thrilled!  Bob]

…   Via The Chronicle of Higher Education: “Facebook Reveals How It Decides if a Research Project Is Ethical.”

Another e-milestone.  Google tells me that this is Blog number 3650 – that’s one Blog post per day for 10 years!  (Ignoring leap years and those days when all I said was, “I have nothing to say.”)  And just for your amusement, here’s a map showing my loyal(?) fans on one recent post.

(I have no idea why Poland leads the list, unless some professor there has been using me as a “Bad Example.”)

Does Janet Yellen know this is what happens when the economy stagnates?

http://www.networkworld.com/article/3084471/security/fbi-business-e-mail-scam-losses-top-3-billion-a-1-300-increase-in-since-jan.html?google_editors_picks=true

FBI: Business e-mail scam losses top $3 billion, a 1,300% increase in since Jan.

The FBI’s Internet Crime Complaint Center (IC3) this week said the scourge it calls the Business Email Compromise continues to rack-up victims and money – over $3 billion in losses so far.

The BEC scam is typically carried out by compromising legitimate business e-mail accounts through social engineering or computer intrusion to conduct unauthorized transfers of funds, the IC3 stated.

…   The IC3 said that the latest variant of the scam goes like this: “Fraudulent requests are sent utilizing a business executive’s compromised e-mail.  The entity in the business organization responsible for W-2s or maintaining PII, such as the human resources department, bookkeeping, or auditing section, have frequently been identified as the targeted recipient of the fraudulent request for W-2 and/or PII.  Some of these incidents are isolated and some occur prior to a fraudulent wire transfer request.  Victims report they have fallen for this new BEC scenario, even if they were able to successfully identify and avoid the traditional BEC incident.

I see this as rather disingenuous.  Am I wrong?

http://thehill.com/policy/national-security/283739-cia-chief-argues-for-action-on-encryption-before-senate-panel

CIA chief argues for action on encryption before Senate panel

The head of the CIA told congressional overseers on Thursday that the law is failing to keep up with rapidly evolving technology, potentially giving foreign terrorists an avenue to escape U.S. intelligence agents' eyes.  

During his testimony before the Senate Intelligence Committee, John Brennan appeared to endorse bipartisan legislation that would create a commission examining how the government should exert authority over encrypted technologies that protect people’s data — even from government agents with a warrant.

…   Lawmakers have struggled to deal with the wide adoption of encryption tools, torn between concerns of security and privacy.  Critics of the trend say the digital barriers prevent government officials from gathering crucial evidence from criminals and terrorists.  But defenders warn that undermining encryption would erode Americans’ rights to privacy and degrade security for everyone.

Sens. Dianne Feinstein (D-Calif.) and Richard Burr (R-N.C.), the Intelligence Committee's leaders, have pushed for legislation that would require companies to provide “technical assistance” to the government to unlock data in the course of an investigation.  The legislation was made public on the heels of a high-profile legal fight between the FBI and Apple over the iPhone used by one of the killers in the San Bernardino, Calif., attack last year.

“What we had hoped is that we would start a national debate,” Burr said on Thursday.

But Brennan notably appeared to ignore that bill.

This is a bit of a stretch. 

http://thehill.com/policy/technology/283819-lawsuit-alleges-social-media-companies-liable-for-paris-attack

Lawsuit claims social media companies liable for Paris attack

The family of one of the victims in the 2015 Paris terrorist attack has filed a lawsuit in U.S. federal court, accusing social media companies of providing material support to the Islamic State in Iraq and Syria (ISIS). 

The civil lawsuit filed earlier this week against Twitter, Google and Facebook asks the court to hold the companies liable for enhanced damages, and rule that the companies “violated, and [are] continuing to violate, the Anti-Terrorism Act.”

…   The lawsuit alleges that the companies have not done enough to block the spread of terror recruitment and communication online.  It also claims the companies, which are driven by digital ad sales, have profited from ISIS postings. 

“For years, Defendants have knowingly permitted the terrorist group ISIS to use their social networks as a tool for spreading extremist propaganda, raising funds and attracting new recruits,” according to the lawsuit. 

The future is here?

http://www.csmonitor.com/Technology/2016/0616/Meet-Olli-America-s-first-driverless-public-shuttle-bus

Meet Olli, America's first driverless public shuttle bus

What do you get when you cross self-driving artificial intelligence, 3-D printing, and public transportation? Olli, an autonomous, electric shuttle with room for 12 passengers.

…   To test Olli, Local Motors plans to offer free rides to the public around the development in what is believed to be the first public trial of a completely self-driving vehicle in the United States, reported The Washington Post.  In February, the Netherlands launched a fleet of WEpod driverless buses, which can carry six passengers, on the campus of Wageningen University in a central Dutch agricultural town.

Miami-Dade County has bought two Olli shuttles, and Las Vegas has bought one.  The two municipalities are expected to pilot the shuttles by the fourth quarter of this year

…   Olli has services powered by IBM Watson, the company's artificial intelligence platform.  That means Ollie can process information, interact with passengers and ask them their destination, explain why they made certain driving decisions and even use face recognition to identify them and their favorite destinations, according to Local Motors.

When words fail you?

http://adage.com/article/digital/twitter-introduces-emoji-marketing/304516/

Twitter Introduces Emoji-Based Targeting

…   Advertisers can make the most of the cartoonish icons by targeting consumers who have tweeted or engaged with tweets that feature emoji.  That means someone in Chicago who tweets a pizza emoji can now be targeted by a local restaurant to come in for a delicious slice of deep dish.

Keeping an eye on the competition.  Whatever make your employees happy?  I bet we could turn this to our advantage. 

http://www.seattletimes.com/business/amazon/amazon-says-it-will-share-employee-training-know-how-with-other-firms/?utm_source=news.google.com&utm_medium=Referral&utm_campaign=rss_editors_picks_feed_technology&google_editors_picks=true

Amazon says it will share employee training know-how with other firms

Amazon.com wants to spread the knowledge of how it put together an ambitious employee-training program that prepares entry-level, mostly warehouse workers for better-paying careers outside the company.

Juan Garcia, Amazon’s global leader for career advancement, said in a LinkedIn post that the company is “open-sourcing” the program, known as Career Choice.  That’s basically providing the blueprint free to other companies so they can “build upon it, tailor it for their own use cases, and improve upon it,” Garcia wrote.

Career Choice is an Amazonian twist on the tuition-reimbursement programs common among many employers.  The difference is that Amazon prepays 95 percent of the cost, and staffers aren’t required to study something related to furthering their Amazon career.

In fact, Amazon will pay for training only in high-demand fields that could lead to better-paying jobs, CEO Jeff Bezos said in a recent interview at a Recode conference in California.  That means jobs in health care or, say, as an airplane mechanic.  The program is 4 years old.

“The last thing any enlightened company wants is for any employee in their company to feel trapped in that job,” he said.  “If they want to be there, great. But if they want to be a nurse, then help them do that.”

…   Career Choice works with community colleges to offer classes right at the warehouses.

An Amazon spokeswoman said that the information the tech and retail giant plans to share with other companies includes how to pick what courses to pay for, how to run the administration of the program, how to do the classes on-site “as well as lessons we’ve learned along the way about what works and what doesn’t.”

Something for my ESL students?

http://www.makeuseof.com/tag/cortana-can-be-your-personal-dictionary-in-windows-10/

Cortana Can Be Your Personal Dictionary in Windows 10

…   Cortana, the assistant who wears many hats, is happy to define any words you send her way.

Simply pull up Cortana by pressing the Windows Key on your keyboard or by clicking her icon on the left side of the Taskbar and type What does mumpsimus mean? and she would tell you that it means “a traditional custom or notion adhered to although shown to be unreasonable.”  You can also phrase the question by typing “define sialoquent.”

This brings you a brief definition, which might not be enough for some words.  If you need more info, hit Enter or click on the definition to bring up an expanded box with more info on the word, including origins and translations.

If that still doesn’t satisfy your quest for word knowledge, hit Enter again to search for the word on Bing and receive all the info you could ever need.