Netflix Password Sharing Crackdown To Expand To US In Q2 2023

Netflix is planning a “broad rollout” of the password sharing crackdown that it began implementing in 2022, the company said today in its Q1 2023 earnings report (PDF). MacRumors reports: The “paid sharing” plan that Netflix has been testing in a limited number of countries will expand to additional countries in the second quarter, including the United States. Netflix said that it was “pleased with the results” of the password sharing restrictions that it implemented in Canada, New Zealand, Spain, and Portugal earlier this year. Netflix initially planned to start eliminating password sharing in the United States in the first quarter of the year, but the company said that it had learned from its tests and “found opportunities to improve the experience for members.” There is a “cancel reaction” expected in each market where paid sharing is implemented, but increased revenue comes later as borrowers activate their own Netflix accounts and existing members add “extra member” accounts.

In Canada, paid sharing resulted in a larger Netflix membership base and an acceleration in revenue growth, which has given Netflix the confidence to expand it to the United States. When Netflix brings its paid sharing rules to the United States, multi-household account use will no longer be permitted. Netflix subscribers who share an account with those who do not live with them will need to pay for an additional member. In Canada, Netflix charges $7.99 CAD for an extra member, which is around $6. […] Netflix claims that more than 100 million households are sharing accounts, which is impacting its ability to “invest in and improve Netflix” for paying members.

Read more of this story at Slashdot.

US FTC Leaders Will Target AI That Violates Civil Rights Or Is Deceptive

Leaders of the U.S. Federal Trade Commission said on Tuesday the agency would pursue companies who misuse artificial intelligence to violate laws against discrimination or be deceptive. Reuters reports: In a congressional hearing, FTC Chair Lina Khan and Commissioners Rebecca Slaughter and Alvaro Bedoya were asked about concerns that recent innovation in artificial intelligence, which can be used to produce high quality deep fakes, could be used to make more effective scams or otherwise violate laws. Bedoya said companies using algorithms or artificial intelligence were not allowed to violate civil rights laws or break rules against unfair and deceptive acts. “It’s not okay to say that your algorithm is a black box” and you can’t explain it, he said.

Khan agreed the newest versions of AI could be used to turbocharge fraud and scams and any wrongdoing would “should put them on the hook for FTC action.” Slaughter noted that the agency had throughout its 100 year history had to adapt to changing technologies and indicated that adapting to ChatGPT and other artificial intelligence tools were no different. The commission is organized to have five members but currently has three, all of whom are Democrats.

Read more of this story at Slashdot.

Two UK Police Forces Unlawfully Recorded Phone Calls Via App, Watchdog Finds

Bruce66423 shares a report from the Guardian: Two police forces have been reprimanded by Britain’s data watchdog after officers unlawfully recorded more than 200,000 phone conversations using an app originally intended for hostage negotiators. The automatic recordings, made over several years, included ‘highly sensitive’ conversations with victims, witnesses and perpetrators of suspected crimes, according to the Information Commissioner’s Office (ICO). The app, called Another Call Recorder (ACR), recorded all incoming and outgoing calls and was originally intended for use by a small number of officers at Surrey and Sussex forces. However, it was downloaded on to the work phones of more than 1,000 staff members.

It has now been withdrawn from use and the recordings, other than those considered to be evidential material, have been destroyed, according to the ICO. The watchdog said it considered issuing a million euro fine to both forces but opted for the reprimand to reduce the impact on public services. Police officers that downloaded the app were unaware all calls would be recorded, the watchdog said, and people were not informed their conversations were being taped.

Read more of this story at Slashdot.

How Google’s ‘Don’t Be Evil’ Motto Has Evolved For the AI Age

In a special report for CBS News’ 60 Minutes, Google CEO Sundar Pichai shares his concerns about artificial intelligence and why the company is choosing to not release advanced models of its AI chatbot. From the report: When Google filed for its initial public offering in 2004, its founders wrote that the company’s guiding principle, “Don’t be evil” was meant to help ensure it did good things for the world, even if it had to forgo some short term gains. The phrase remains in Google’s code of conduct. Pichai told 60 Minutes he is being responsible by not releasing advanced models of Bard, in part, so society can get acclimated to the technology, and the company can develop further safety layers.

One of the things Pichai told 60 Minutes that keeps him up at night is Google’s AI technology being deployed in harmful ways. Google’s chatbot, Bard, has built in safety filters to help combat the threat of malevolent users. Pichai said the company will need to constantly update the system’s algorithms to combat disinformation campaigns and detect deepfakes, computer generated images that appear to be real. As Pichai noted in his 60 Minutes interview, consumer AI technology is in its infancy. He believes now is the right time for governments to get involved.

“There has to be regulation. You’re going to need laws … there have to be consequences for creating deep fake videos which cause harm to society,” Pichai said. “Anybody who has worked with AI for a while … realize[s] this is something so different and so deep that, we would need societal regulations to think about how to adapt.” Adaptation that is already happening around us with technology that Pichai believes, “will be more capable “anything we’ve ever seen before.” Soon it will be up to society to decide how it’s used and whether to abide by Alphabet’s code of conduct and, “Do the right thing.”

Read more of this story at Slashdot.

New MacBooks, a Big New WatchOS Update, and Apple’s Mixed Reality Headset To Be Announced At WWDC

In addition to the company’s long-rumored mixed reality headset, Apple is expected to launch new MacBooks, as well as a “major” update to the Apple Watch’s watchOS software at its Worldwide Developers Conference (WWDC) in June. All told, WWDC 2023 could end up being one of Apple’s “biggest product launch events ever,” according to Bloomberg’s Mark Gurman. The Verge reports: Let’s start with the Macs. Gurman doesn’t explicitly say which macOS-powered computers Apple could announce in June, but lists around half a dozen devices it currently plans to release this year or early 2024. There’s an all new 15-inch MacBook Air, an updated 13-inch MacBook Air, and new 13-inch and “high-end” MacBook Pros. Meanwhile on the Mac side Apple still needs to replace its last Intel-powered device, the Mac Pro, with an Apple Silicon model, and it also reportedly has plans to refresh its all-in-one 24-inch iMac.

Bloomberg’s report notes that “at least some of the new laptops” will make an appearance. The bad news is that none are likely to run Apple’s next-generation M3 chips, and will instead ship with M2-era processors. Apple apparently also has a couple of new Mac Studio computers in development, but Bloomberg is less clear on when they could launch.

Over on the software side, which is WWDC’s traditional focus, watchOS will reportedly receive a “major” update that includes a revamped interface. Otherwise, we could be in for a relatively quiet show on the operating system front as iOS, iPadOS, macOS, and tvOS are not expected to receive major updates this year. Gurman does say that work to allow sideloading on iOS to comply with upcoming EU legislation is ongoing.

Read more of this story at Slashdot.

YouTube TV Nabs Its First Technical Emmy Win For ‘Views’ Feature

YouTube TV just won its first Technical Emmy award for its “Views” suite of features, which lets users access sports highlights, key plays, player stats and game scores. TechCrunch reports: At the 74th annual Technology & Engineering Emmy Awards last night, YouTube TV was declared the winner for the category “AI-ML Curation of Sports Highlights.” The tech company also announced today that Key Plays reached a notable milestone — the feature was used in over 10 million watch sessions on the platform. Last year, viewers used key plays the most during the World Cup, regular season NFL games and Premier League matches.

The Key Plays view tracks important plays in a game. Users can tap on the plays to rewatch when it occurs in the game. This is helpful for users that missed a live game and want to catch up on key moments. When YouTube TV launched Views in 2018, it was only available for baseball, basketball, football and hockey. Soccer and golf were added later on. The suite of features was also initially limited to phones and tablets. Today, the feature is available within the YouTube TV app across smart TVs and mobile devices.

In addition to Stats, Key Plays and Scores View, there’s also Fantasy Football View, which is a mobile-only feature and lets users link their existing fantasy football account. That way, when a user is watching NFL games on YouTube TV, the feature allows them to see how their team is performing in real time. Plus, there’s a “Jump to” function for users to quickly access a segment they want to view, which is especially handy for tennis fans and for users watching the Olympics. “Views came out of a team brainstorm about five years ago and launched about a year after YouTube TV,” said Kathryn Cochrane, YouTube TV’s group project manager, in a company blog post. “A lot of our viewers are devoted sports fans, and we found that when they watch sports, they aren’t just looking at what’s on the big screen. They were also actively on their phones, finding more details such as stats for their fantasy football league, updates from other games, and more, all to enhance what they were already watching.”

Read more of this story at Slashdot.

Google Releases Emergency Chrome Security Update

“Earlier this week, Google released an emergency security update for the Chrome browser due to a vulnerability that is being actively exploited in the wild,” reports Hot Hardware:

On Friday, Google highlighted CVE-2023-2033, reported by Clément Lecigne of Google’s own Threat Analysis Group (TAG). This vulnerability is a ‘type confusion’ bug in the JavaScript engine for Chromium browsers useing the V8 Javascript engine. In short, type confusion is a bug that allows memory to be accessed with the wrong type, allowing for the reading or writing of memory out of bounds. The CVE page says that an attacker could create an HTML page that allows the exploitation of heap corruption.

While there is no Common Vulnerability Scoring System (CVSS) score attached to the vulnerability yet, Google is tracking this as a “high” severity issue. This is likely due in part to the fact that “Google is aware that an exploit for CVE-2023-2033 exists in the wild.”
The article notes that Chrome updates are generally done automatically, but you can also check for updates by clicking Chrome’s three-dots menu in the top-right corner, then “Help” and “About Chrome.”

Read more of this story at Slashdot.

Compromised Sites Use Fake Chrome Update Warnings to Spread Malware

Bleeping Computer warned this week about compromised web sites “that display fake Google Chrome automatic update errors that distribute malware to unaware visitors.”
The campaign has been underway since November 2022, and according to NTT’s security analyst Rintaro Koike, it shifted up a gear after February 2023, expanding its targeting scope to cover users who speak Japanese, Korean, and Spanish. BleepingComputer has found numerous sites hacked in this malware distribution campaign, including adult sites, blogs, news sites, and online stores…

If a targeted visitor browses the site, the scripts will display a fake Google Chrome error screen stating that an automatic update that is required to continue browsing the site failed to install. “An error occurred in Chrome automatic update. Please install the update package manually later, or wait for the next automatic update,” reads the fake Chrome error message. The scripts will then automatically download a ZIP file called ‘release.zip’ that is disguised as a Chrome update the user should install.

However, this ZIP file contains a Monero miner that will utilize the device’s CPU resources to mine cryptocurrency for the threat actors. Upon launch, the malware copies itself to C:Program FilesGoogleChrome as “updater.exe” and then launches a legitimate executable to perform process injection and run straight from memory. According to VirusTotal, the malware uses the “BYOVD” (bring your own vulnerable driver) technique to exploit a vulnerability in the legitimate WinRing0x64.sys to gain SYSTEM privileges on the device.

The miner persists by adding scheduled tasks and performing Registry modifications while excluding itself from Windows Defender. Additionally, it stops Windows Update and disrupts the communication of security products with their servers by modifying the IP addresses of the latter in the HOSTS file. This hinders updates and threat detection and may even disable an AV altogether.

Read more of this story at Slashdot.

How Should AI Be Regulated?

A New York Times opinion piece argues people in the AI industry “are desperate to be regulated, even if it slows them down. In fact, especially if it slows them down.” But how?

What they tell me is obvious to anyone watching. Competition is forcing them to go too fast and cut too many corners. This technology is too important to be left to a race between Microsoft, Google, Meta and a few other firms. But no one company can slow down to a safe pace without risking irrelevancy. That’s where the government comes in — or so they hope… [A]fter talking to a lot of people working on these problems and reading through a lot of policy papers imagining solutions, there are a few categories I’d prioritize.

The first is the question — and it is a question — of interpretability. As I said above, it’s not clear that interpretability is achievable. But without it, we will be turning more and more of our society over to algorithms we do not understand… The second is security. For all the talk of an A.I. race with China, the easiest way for China — or any country for that matter, or even any hacker collective — to catch up on A.I. is to simply steal the work being done here. Any firm building A.I. systems above a certain scale should be operating with hardened cybersecurity. It’s ridiculous to block the export of advanced semiconductors to China but to simply hope that every 26-year-old engineer at OpenAI is following appropriate security measures.

The third is evaluations and audits. This is how models will be evaluated for everything from bias to the ability to scam people to the tendency to replicate themselves across the internet. Right now, the testing done to make sure large models are safe is voluntary, opaque and inconsistent. No best practices have been accepted across the industry, and not nearly enough work has been done to build testing regimes in which the public can have confidence. That needs to change — and fast.
The piece also recommends that AI-design companies “bear at least some liability for what their models.” But what legislation should we see — and what legislation will we see? “One thing regulators shouldn’t fear is imperfect rules that slow a young industry,” the piece argues.

“For once, much of that industry is desperate for someone to help slow it down.”

Read more of this story at Slashdot.

Government Cybersecurity Agencies Unite to Urge Secure Software Design Practices

Several government cybersecurity agencies united to urge secure-by-design and secure-by-default software. Releasing “joint guidance” for software manufactuers were two U.S. security agencies — the FBI and the NSA — joined with the U.S. Cybersecurity and Infrastructure Security Agency and the cybersecurity authorities of Australia, Canada, the United Kingdom, Germany, Netherlands, and New Zealand. “To create a future where technology and associated products are safe for customers,” they wrote in a joint statement, “the authoring agencies urge manufacturers to revamp their design and development programs to permit only secure-by-design and -default products to be shipped to customers.”

The Washington Post reports:
Software manufacturers should put an end to default passwords, write in safer programming languages and establish vulnerability disclosure programs for reporting flaws, a collection of U.S. and international government agencies said in new guidelines Thursday. [The guidelines also urge rigorous code reviews.]

The “principles and approaches” document, which isn’t mandatory but lays out the agencies’ views on securing software, is the first major step by the Biden administration as part of its push to make software products secure as part of the design process, and to make their default settings secure as well. It’s part of a potentially contentious multiyear effort that aims to shift the way software makers secure their products. It was a key feature of the administration’s national cybersecurity strategy, which was released last month and emphasized shifting the burden of security from consumers — who have to manage frequent software updates — to the companies that make often insecure products… The administration has also raised the prospect of legislation on secure-by-design and secure-by-default, but officials have said it could be years away….

The [international affairs think tank] Atlantic Council’s Cyber Statecraft Initiative has praised the Biden administration’s desire to address economic incentives for insecurity. Right now, the costs of cyberattacks fall on users more than they do tech providers, according to many policymakers. “They’re on a righteous mission,” Trey Herr, director of the Atlantic Council initiative, told me. If today’s guidelines are the beginning of the discussion on secure-by-design and secure-by-default, Herr said, “this is a really strong start, and an important one.”
“It really takes aim at security features as a profit center,” which for some companies has led to a lot of financial growth, Herr said. “I do think that’s going to rub people the wrong way and quick, but that’s good. That’s a good fight.”
In the statement CISA’s director says consumers also have a role to play in this transition. “As software now powers the critical systems and services we collectively rely upon every day, consumers must demand that manufacturers prioritize product safety above all else.”

Among other things, the new guidelines say that manufacturers “are encouraged make hard tradeoffs and investments, including those that will be ‘invisible’ to the customers, such as migrating to programming languages that eliminate widespread vulnerabilities.”

Read more of this story at Slashdot.