Speaker 1: Welcome to Tech Stuff, a production from iHeartRadio. Hey thereon
Speaker 1: Welcome to Tech Stuff. I'm your host, Jonathan Strickland. I'm
Speaker 1: an executive producer with iHeartRadio and how the tech are you.
Speaker 1: It's time for the tech news for Thursday August third,
Speaker 1: twenty twenty three. Over in the UK, the Competition and
Speaker 1: Markets Authority or CMA has re entered negotiations with Microsoft
Speaker 1: regarding the long awaited acquisition of Activision Blizzard. Now, you
Speaker 1: might recall that there were a lot of regulators around
Speaker 1: the world who initially resisted this deal, but over time
Speaker 1: most of them came around to giving the acquisition the
Speaker 1: green light after the companies had made multiple assurances that
Speaker 1: they weren't going to freeze out competitors like Sony from
Speaker 1: having access to stuff like Call of Duty, specifically that franchise.
Speaker 1: Here in the United States, a judge denied the Federal
Speaker 1: Trade Commission's attempt to secure an injunction against this deal,
Speaker 1: and then the FTC subsequently withdrew its case, but it
Speaker 1: could still file that case again in the future, so
Speaker 1: that's not necessarily over here in the US. But right now,
Speaker 1: the one remaining hurdle for these two companies is in
Speaker 1: the UK. Microsoft has committed to a ten year licensing
Speaker 1: arrangement with Sony regarding the Call of Duty franchise and
Speaker 1: an effort to remove concerns about this arrangement. The CMA
Speaker 1: is seeking comment from companies and individuals, leaving open the
Speaker 1: option to respond to the CMA until the end of
Speaker 1: the day tomorrow. It's unknown if the CMA will reverse
Speaker 1: its decision, but if it does, that would be the
Speaker 1: first time the CMA has done so since Brexit. According
Speaker 1: to the Financial Times, the CMA has until August twenty
Speaker 1: ninth to rule on this matter, so by the end
Speaker 1: of this month we should know if this acquisition can
Speaker 1: move forward or not, at least until the FTC makes
Speaker 1: its next move. Dan gooden Over at Ours Technica has
Speaker 1: a great piece about how Microsoft is reeling after security
Speaker 1: experts have blasted the company's security practices or lack thereof
Speaker 1: for its cloud based products like Azure. In case you're
Speaker 1: not familiar with Azure or Asure if you prefer, it's
Speaker 1: Microsoft's cloud platform and it lets customers use Microsoft's cloud
Speaker 1: services to develop apps and that kind of thing. So
Speaker 1: it's similar in many ways to Amazon Web Services or
Speaker 1: Google Cloud or countless other cloud platforms anyway, Gooden quotes
Speaker 1: Amit Juran, the CEO of internet security firm Tenable, who
Speaker 1: called my Microsoft quote unquote grossly irresponsible, which doesn't seem
Speaker 1: to be mincing many words. You know, the complaints aren't unfounded.
Speaker 1: Earlier this year, Chinese backed hacker groups penetrated Microsoft's systems
Speaker 1: and stole boatloads of emails from Microsoft customers who were
Speaker 1: using Azure. And there are open questions as to how
Speaker 1: that actually happened, because it would have meant the hackers
Speaker 1: somehow gained access to what should have been a heavily
Speaker 1: protected encryption key. Juran took to a LinkedIn post and
Speaker 1: sent a very lengthy description of how Microsoft is continuing
Speaker 1: to fail its customers. In his opinion, while the company
Speaker 1: initially claims to have fixed the security issue, Uran says
Speaker 1: that his team was able to gain access to quote,
Speaker 1: authentication secrets to a bank end quote. Yeah. All that
Speaker 1: definitely doesn't sound like things were fixed inside cybersecurity terms.
Speaker 1: This is very bad for Microsoft and also for its customers. Heck,
Speaker 1: it's also bad for cloud computing in general, because the
Speaker 1: promise of cloud computing is that a company can benefit
Speaker 1: from some other company's investment in computing and storage capabilities. Right,
Speaker 1: There's no need for you to build out your own
Speaker 1: server farm and databases, or to heavily invest in compute
Speaker 1: power if instead, you can offload those responsibilities onto a
Speaker 1: cloud based product that you purchase or subscribe to. But
Speaker 1: that only works if customers are confident that the system
Speaker 1: is secure and that the provider will respond quickly and
Speaker 1: sufficiently to any vulnerabilities in the system. Failing to do
Speaker 1: that essentially boils down to a breach of trust. Microsoft
Speaker 1: reps have said that the threat of sophisticated attas makes
Speaker 1: cybersecurity more challenging than ever, which is undoubtedly true, but
Speaker 1: Microsoft's critics say this doesn't excuse the company's response to
Speaker 1: this particular breach and how that's been handled so far.
Speaker 1: In other Microsoft hacking news, the company warns that a
Speaker 1: Russian backed hacking group is trying to steal login credentials
Speaker 1: at various specific organizations by sending fraudulent Microsoft team's messages
Speaker 1: while posing as it support, which is of course an
Speaker 1: age old trick, right. We call it social engineering. It's
Speaker 1: where you convince someone to hand over the keys to
Speaker 1: a system, and it's one of the most effective tools
Speaker 1: in hackers arsenals because it's usually way easier to trick
Speaker 1: someone into being an unwitting accomplice to giving you access
Speaker 1: to a system than it is to brute force your
Speaker 1: way into a system. Anyway, Microsoft says the attacks are
Speaker 1: quote unquote highly targeted, with the hacker sending messages to
Speaker 1: people working at less than forty unique global organizations fewer
Speaker 1: than forty This isn't a wide phishing net. In other words,
Speaker 1: this isn't like just trying to see what you can catch.
Speaker 1: This is more like spear phishing, where you have specifically
Speaker 1: identified the targets you're interested in. Now, the name of
Speaker 1: this hacking group is APT twenty nine, but it's better
Speaker 1: known as Midnight Blizzard, and US authorities say this group
Speaker 1: has links to Russia's intelligence service. So if you use
Speaker 1: Microsoft teams, then you happen to work for one of
Speaker 1: these unnamed organizations. I don't know which ones specifically we're
Speaker 1: being targeted, but presumably a lot of them are like
Speaker 1: government agencies and things of that nature, and high profile
Speaker 1: tech companies that sort of stuff. I would recommend against
Speaker 1: responding to weird requests from it, especially if they're asking
Speaker 1: you to share multi factor authentication information. That should be
Speaker 1: a dead giveaway every single time if someone's asking you
Speaker 1: to share some multi factor authentication stuff, like they're like, hey,
Speaker 1: I need to log into your account, can you give
Speaker 1: me the the the six digit you know number so
Speaker 1: I can access and authenticate? Obviously your answer should be
Speaker 1: no every single time, no, no, no, no no. But
Speaker 1: you know again, it's a trick that works. So Microsoft
Speaker 1: has raised the flag on that one. Speaking of Russia,
Speaker 1: a court in Moscow has fined Apple four hundred thousand rubles,
Speaker 1: which is, let me do the quick calculation here, around
Speaker 1: two hundred and seventy dollars. And the reason is Russia
Speaker 1: says that Apple failed to delete what the court was
Speaker 1: calling inaccurate content, specifically about the ongoing quote unquote special
Speaker 1: military operation in Ukraine. Apple, which by the way, stopped
Speaker 1: all products sales in Russia more than a year ago
Speaker 1: after Russia first invaded Ukraine, has not commented on this fine.
Speaker 1: I mean, two hundred and seventy dollars, that's not even
Speaker 1: enough money to even read as a thing to Apple,
Speaker 1: that's nothing, And really it's another example of how Russian
Speaker 1: institutions are trying to define the narrative on Russia's war
Speaker 1: on Ukraine and anyone who doesn't toe the line in
Speaker 1: that they're trying to punish. Although four hundred thousand rubles,
Speaker 1: I mean, I just like it, Why would you even bother? Anyway,
Speaker 1: Apple joins Wikimedia as one of the companies that the
Speaker 1: Russians have declared are in violation for disseminating incorrect information.
Speaker 1: TorrentFreak dot com reports that Putin's government in Russia is
Speaker 1: trying to lock down internet within the country even more
Speaker 1: than it already has. A New law that will go
Speaker 1: into effect later this year will make it illegal for
Speaker 1: any Russian Internet platform to allow someone to sign up
Speaker 1: for their services if that person is using a foreign
Speaker 1: email system. For example, if someone has a Gmail email account,
Speaker 1: they cannot use that email account to sign up for
Speaker 1: one of these Russian internet platforms. It would be against
Speaker 1: the law. Further, these platforms will not be allowed to
Speaker 1: offer services to customers until those customers go through a
Speaker 1: verification process to prove their identities first. Now, obviously that
Speaker 1: means that anything the customers then access or post or
Speaker 1: whatever is linked directly to them there's no anonymity here.
Speaker 1: They have a trail that leads right back to them,
Speaker 1: assuming that it is the person who created the account
Speaker 1: who's actually using the account. So that's a real big
Speaker 1: concern too. Right, it's like a form of government tracking.
Speaker 1: As I have talked about in previous episodes of this show.
Speaker 1: Russia is also cracked down on virtual private networks or
Speaker 1: VPN services within Russia. Like all outside VPN services have
Speaker 1: had real problems working within Russia because Russia wanted to
Speaker 1: crack down on that internally, some of the VPN services
Speaker 1: that were originating out of Russia chose to just shut
Speaker 1: down operations in the country because the only way they
Speaker 1: are allowed to operate within the country is to also
Speaker 1: agree to certain criteria with Russia's government. Those are the
Speaker 1: only VPN services that are allowed to operate within Russia,
Speaker 1: So that brings into question if the Russian government can
Speaker 1: demand that a VPN service within Russia must share its
Speaker 1: logs that show what customers were doing on the VPN,
Speaker 1: which kind of defeats at least one of the purposes
Speaker 1: of using a VPN in the first place. Right, Like,
Speaker 1: a lot of the reason to use a VPN is
Speaker 1: to kind of make sure that snoops don't see what
Speaker 1: you're doing. Like it may be that you know you
Speaker 1: need to handle some sensitive information, or maybe you're a whistleblower,
Speaker 1: or maybe you're a journalist or whatever, and so you
Speaker 1: don't want to be tracked down. That's obviously a big
Speaker 1: danger to you and your work. But if the government
Speaker 1: can come to the VPN and demand, hey, you've got
Speaker 1: to hand over all your logs and show us who
Speaker 1: was accessing what, then the VPN doesn't really serve its
Speaker 1: purpose anyway. Russian law also makes it illegal to talk
Speaker 1: about using VPNs and other methods like tor in an
Speaker 1: effort to circumvent Russian controls. So not only are they
Speaker 1: limiting things, you can't even talk about the possibility of
Speaker 1: using tools to get around these controls because that in
Speaker 1: itself is illegal. So yeah, really cracking down over there. Okay,
Speaker 1: I've got a bunch of other news items we're going
Speaker 1: to cover today. Let's take a quick break to thank
Speaker 1: our sponsors. We're back, and now for some the left
Speaker 1: hand doesn't know what the right hand is doing news.
Speaker 1: The Washington Post reports that the FBA has actually discovered
Speaker 1: who was at least partly responsible for directing a contractor
Speaker 1: to purchase a spy tool from the Israeli company in SOO.
Speaker 1: Now you might remember NSO is the company that was
Speaker 1: behind Pegasus. That was a tool that could turn a
Speaker 1: targeted iOS device like an iPhone into an espionage gadget.
Speaker 1: You could activate the microphone on the phone and listen
Speaker 1: in on conversations that were happening within the room. You
Speaker 1: could activate the camera, you could look through the phone's
Speaker 1: information like it really was an incredibly dangerous espionage tool
Speaker 1: that NSO sold to lots of different customers. Anyway, back
Speaker 1: in April, the New York Times found that a contractor
Speaker 1: had bought and used a tool from NSO and had
Speaker 1: done so on behalf of a US government agency, though
Speaker 1: it wasn't known which agency, it was, just that this
Speaker 1: this contractor had purchased this from NSO. However, the Biden
Speaker 1: administration had put NSO on a blacklist saying no US
Speaker 1: government office or company or anything like that should purchase
Speaker 1: products from NSO. So the White House directed the FBI
Speaker 1: to track down who the heck authorized a contractor to
Speaker 1: purchase this tool from the NSO, and the FBI says
Speaker 1: it was the FBI sad trombone. But the FBI says
Speaker 1: they toats didn't know that the invasive surveillance they were
Speaker 1: relying upon was thanks to a tool from the NSO group,
Speaker 1: so it's not really their fault. The Contractorriva Networks secured
Speaker 1: the use of a tool from NSO called Landmark. This
Speaker 1: tool allows for geo tracking targets without their knowledge and
Speaker 1: was specifically used for people in Mexico, people like connected
Speaker 1: to drug cartels, such spooky stuff. And also, the FBI
Speaker 1: says once they found out the Reva Networks had been
Speaker 1: naughty and the purchased this tool from NSO, the FBI
Speaker 1: totally terminated that contract with Reva Networks. Now I might
Speaker 1: just be a humble technology podcaster, but I find the
Speaker 1: FBI's excuses to be not fully satisfactory. Firstly, the FBI
Speaker 1: had already used Reva Networks in the past to purchase
Speaker 1: tools from NSO, including Pegasus, and this was before NSO
Speaker 1: was on the blacklist, so arguably it was kind of
Speaker 1: in the clear. But anyway, this was not an unprecedented event.
Speaker 1: FBI had worked with Reva Networks in the past, and
Speaker 1: Reva Networks had been using NSO products as part of
Speaker 1: the contract work they were doing with FBI. Secondly, I
Speaker 1: would argue whether the tool came from NSO or from
Speaker 1: Reva Networks itself or from some other developer, there are
Speaker 1: issues that are really more about what this tool does
Speaker 1: that concern me, rather than where it came from. The
Speaker 1: lack of oversight and accountability for the FBI and for
Speaker 1: its various contract partners raises some really troubling questions about
Speaker 1: the FBI's authority. I mean, part of the reason ANSO
Speaker 1: Group is on the blacklist is not because of these
Speaker 1: incredibly invasive tools it makes. I mean, you would think
Speaker 1: that's the case, but that's not really why it's on
Speaker 1: the blacklist. The reason why it's on the blacklist is
Speaker 1: that company counts among its most loyal customers some of
Speaker 1: the most dangerous dictators and authoritarians in the world, who
Speaker 1: subsequently use those tools to target people like journalists and activists.
Speaker 1: And it would look really, really bad if the US
Speaker 1: government said, you know what, it's okay for us to
Speaker 1: do business with them. So you could argue that optics
Speaker 1: are a really big part of why NSO is on
Speaker 1: that blacklist. However, if we were to be more generous
Speaker 1: and say, maybe the US government said no, this is
Speaker 1: a step too far, This is too invasive, the surveillance
Speaker 1: is too dangerous. There are too few checks and balances
Speaker 1: on authority and overreach. If we were to say that, well,
Speaker 1: I mean a lot of US authorities say right now
Speaker 1: that using geotracking technology doesn't technically violate the Executive Order
Speaker 1: against NSO, so no harm, no foul. If you find
Speaker 1: some other place that makes the same sort of tools,
Speaker 1: oh brave new world. On a different note, researchers at
Speaker 1: Technical University Berlin, along with a researcher named Oleg Droken,
Speaker 1: demonstrated that they could exploit the infotainment system on recent
Speaker 1: Tesla vehicles to gain root access to the vehicles systems.
Speaker 1: This would let someone activate features that normally Tesla reserves
Speaker 1: for paid customers, meaning you could activate stuff that is
Speaker 1: already available in your vehicle and you could do it
Speaker 1: for free rather than have to pay Tesla to unlock it.
Speaker 1: Things like you know, heated seats and full self driving,
Speaker 1: that kind of stuff. They also were able to do
Speaker 1: even more things like remove geolocation restrictions on full self driving.
Speaker 1: They were able to transfer a driver's profile to a
Speaker 1: different Tesla vehicle using this method. However, it's not easy
Speaker 1: to do. It actually requires some electrical engineering, some soldering,
Speaker 1: you know, it's not just software. Hardware is involved too. However,
Speaker 1: if a Tesla owner has the knowledge and skill and
Speaker 1: about one hundred bucks worth of equipment, they could potentially
Speaker 1: do the same thing. They've also said that bad actors
Speaker 1: could possibly use the same method to gain access to
Speaker 1: things like data logs in a Tesla, which could include
Speaker 1: the owner's private information, or otherwise tamper with someone's vehicle.
Speaker 1: It would not be easy. Again, it would require physical
Speaker 1: access to the vehicle, but it is possible, and they
Speaker 1: plan to present their findings at black Hat USA, which
Speaker 1: happens next week in Las Vegas. For what it's worth,
Speaker 1: they actually praised sless security measures. They said that they're
Speaker 1: really leaders in the automotive space on that front. This week,
Speaker 1: the US finally officially banned incandescent light bulbs, and you
Speaker 1: might be thinking, I thought we already did that, but no,
Speaker 1: what we did do is announce the plan to ban
Speaker 1: incandescent light bulbs, but hadn't actually put in action. The
Speaker 1: decision actually traces its history all the way back to
Speaker 1: two thousand and seven during George W. Bush's administration, when
Speaker 1: the White House called for a twenty five percent improvement
Speaker 1: in efficiency for light bulbs. In twenty seventeen, Barack Obama
Speaker 1: planned on facing out incandescent bulbs by twenty twenty. Trump
Speaker 1: reversed that decision. Biden reversed the reversal, although technically it
Speaker 1: doesn't target incandescent bulbs specifically. Rather, it says, hey, light
Speaker 1: bulbs need to be able to produce forty five lumens,
Speaker 1: which is a measurement of brightness per wat of electricity,
Speaker 1: and incantestant bulbs just can't do that. They max out
Speaker 1: at around fifteen lumens per watt. They are banned effectively,
Speaker 1: just not by name. Also, there are a lot of
Speaker 1: exceptions to this, like there are a lot of light
Speaker 1: bulbs that are incandescent that get an exception to this rule,
Speaker 1: like black lights, so your wicked band poster can still
Speaker 1: light up in the dark. Yay, okay. I got two
Speaker 1: article recommendations re all before I sign off. The first
Speaker 1: was published yesterday on ours Tetnica. It was written by
Speaker 1: John Broadkin. The article is titled Internet providers that one
Speaker 1: FCC grants try to escape broadband commitments. As the headline indicates,
Speaker 1: The story covers various ISPs that had agreed to participate
Speaker 1: in the US program to provide broadband to rural communities,
Speaker 1: but now they either want more money to do that
Speaker 1: or they just want to get out because I guess
Speaker 1: it's just too darn hard. The second article I recommend
Speaker 1: is from the Washington Post. It was written by Joseph
Speaker 1: men and the headline is hacking group plans system to
Speaker 1: encrypt social media and other apps. So we live in
Speaker 1: a world where lots of places are trying to chip
Speaker 1: away at privacy and encryption. It's not just a auauortarian
Speaker 1: states like Russia. I'm looking at you, UK and also
Speaker 1: parts of the United States. Anyway. This article talks about
Speaker 1: how the hacker group called Cult of the Dead Cow
Speaker 1: is working to create encrypted alternatives to social media, and
Speaker 1: it's well worth a read. But that's it for the
Speaker 1: Tech News for Thursday, August third, twenty twenty three. I
Speaker 1: hope you are all well, and I'll talk to you
Speaker 1: again really soon. Tech Stuff is an iHeartRadio production. For
Speaker 1: more podcasts from iHeartRadio, visit the iHeartRadio app, Apple podcasts,
Speaker 1: or wherever you listen to your favorite shows.