Amazon Now Charging a Fee For Some UPS Store Returns

Amazon has started charging a fee for some returns made at UPS stores. Insider reports: While customers used to be able to drop off their returns at a UPS Store free of charge, Amazon will now charge a $1 fee if customers have another free-return option the same distance away or closer. Customers can still visit those other drop-off locations — including Whole Foods, Kohl’s, and Amazon stores — and leave their packages for free. The company already charged customers to have UPS pick up returns from their homes or to drop off packages at UPS Access Points, which are located inside third-party businesses, The Information reported.
“We always offer a free option for customers to return their item,” Amazon spokesperson Steve Kelly told Insider by email. “If a customer would prefer to return their item at a UPS Store when there is a free option closer to their delivery address, a very small amount of customers may incur a $1 fee.”

Read more of this story at Slashdot.

DDoS Attacks Shifting To VPS Infrastructure For Increased Power

Hyper-volumetric DDoS (distributed denial of service) attacks in the first quarter of 2023 have shifted from relying on compromised IoT devices to leveraging breached Virtual Private Servers (VPS). BleepingComputer reports: According to internet security company Cloudflare, the newer generation of botnets gradually abandoned the tactic of building large swarms of individually weak IoT devices and are now shifting towards enslaving vulnerable and misconfigured VPS servers using leaked API credentials or known exploits. This approach helps the threat actors build high-performance botnets easier and often quicker, which can be up to 5,000 times stronger than IoT-based botnets.

“The new generation of botnets uses a fraction of the amount of devices, but each device is substantially stronger,” explains Cloudflare in the report. “Cloud computing providers offer virtual private servers to allow start ups and businesses to create performant applications. The downside is that it also allows attackers to create high-performance botnets that can be as much as 5,000x stronger.” Cloudflare has been working with key cloud computing providers and partners to crack down on these emerging VPS-based threats and says it has succeeded in taking down substantial portions of these novel botnets.

Read more of this story at Slashdot.

How Did Earth Get Its Water?

Earth’s water could have originated from interactions between the hydrogen-rich atmospheres and magma oceans of the planetary embryos that comprised Earth’s formative years, according to new work from Carnegie Science’s Anat Shahar and UCLA’s Edward Young and Hilke Schlichting. Their findings, which could explain the origins of Earth’s signature features, are published in Nature. Phys.Org reports: “Exoplanet discoveries have given us a much greater appreciation of how common it is for just-formed planets to be surrounded by atmospheres that are rich in molecular hydrogen, H2, during their first several million years of growth,” Shahar explained. “Eventually these hydrogen envelopes dissipate, but they leave their fingerprints on the young planet’s composition.” Using this information, the researchers developed new models for Earth’s formation and evolution to see if our home planet’s distinct chemical traits could be replicated.

Using a newly developed model, the Carnegie and UCLA researchers were able to demonstrate that early in Earth’s existence, interactions between the magma ocean and a molecular hydrogen proto-atmosphere could have given rise to some of Earth’s signature features, such as its abundance of water and its overall oxidized state. The researchers used mathematical modeling to explore the exchange of materials between molecular hydrogen atmospheres and magma oceans by looking at 25 different compounds and 18 different types of reactions — complex enough to yield valuable data about Earth’s possible formative history, but simple enough to interpret fully.

Interactions between the magma ocean and the atmosphere in their simulated baby Earth resulted in the movement of large masses of hydrogen into the metallic core, the oxidation of the mantle, and the production of large quantities of water. Even if all of the rocky material that collided to form the growing planet was completely dry, these interactions between the molecular hydrogen atmosphere and the magma ocean would generate copious amounts of water, the researchers revealed. Other water sources are possible, they say, but not necessary to explain Earth’s current state. “This is just one possible explanation for our planet’s evolution, but one that would establish an important link between Earth’s formation history and the most common exoplanets that have been discovered orbiting distant stars, which are called Super-Earths and sub-Neptunes,” Shahar concluded.

Read more of this story at Slashdot.

NYT Debuts Digits, the Math Version of Wordle

The New York Times added a new daily puzzle game to its library in the form of Digits. GameSpot reports: This collection of math conundrums tasks you with reaching a designated number by using six numbers that you’re free to multiply, divide, subtract, or add up to reach the final result, so long as your process doesn’t create any fractions or negative numbers.

Currently in beta and only available for this week, there’ll be five of these math puzzles to solve every day. These aren’t one-and-done puzzles like Wordle, and depending on the path you choose to solve one of these math mysteries, you’ll be awarded 1-3 star ratings. If Digits proves to be popular with its readers, the New York Times will then start work on the further development of the game.

Read more of this story at Slashdot.

Colorado Approves First-Ever Agricultural Right to Repair Bill

Denver legislators have just passed the first-ever agricultural Right to Repair bill. Today’s landslide 44-16 vote in the House follows a successful vote in the Senate last month. iFixit reports: Once the Agricultural Right to Repair bill passes, manufacturers will be required to share all the parts, embedded software, firmware, tools, and documentation necessary for repair. One critical step remains: a signature by Governor Polis, who has signaled that he supports the legislation.

To support Right to Repair legislation near you, find your state on Repair.org — or, if you’re outside the US, look for your country’s advocacy network here. The summary of HB23-1011 reads: “Starting January 1, 2024, the bill requires a manufacturer to provide parts, embedded software, firmware, tools, or documentation, such as diagnostic, maintenance, or repair manuals, diagrams, or similar information (resources), to independent repair providers and owners of the manufacturer’s agricultural equipment to allow an independent repair provider or owner to conduct diagnostic, maintenance, or repair services on the owner’s agricultural equipment.

The bill folds agricultural equipment into the existing consumer right-to-repair statutes, which statutes provide the following:
– A manufacturer’s failure to comply with the requirement to provide resources is a deceptive trade practice;
– In complying with the requirement to provide resources, a manufacturer need not divulge any trade secrets to independent repair providers and owners; and
– Any new contractual provision or other arrangement that a manufacturer enters into that would remove or limit the manufacturer’s obligation to provide resources to independent repair providers and owners is void and unenforceable; and
– An independent repair provider or owner is not authorized to make modifications to agricultural equipment that permanently deactivate any safety notification system or bring the equipment out of compliance with safety or emissions laws or to engage in any conduct that would evade emissions, copyright, trademark, or patent laws.”

Read more of this story at Slashdot.

Shutting Down Nuclear Power Could Increase Air Pollution, Finds MIT Study

If reactors are retired, polluting energy sources that fill the gap could cause more than 5,000 premature deaths, researchers estimate. The findings appear in the journal Nature Energy. MIT News reports: They lay out a scenario in which every nuclear power plant in the country has shut down, and consider how other sources such as coal, natural gas, and renewable energy would fill the resulting energy needs throughout an entire year. Their analysis reveals that indeed, air pollution would increase, as coal, gas, and oil sources ramp up to compensate for nuclear power’s absence. This in itself may not be surprising, but the team has put numbers to the prediction, estimating that the increase in air pollution would have serious health effects, resulting in an additional 5,200 pollution-related deaths over a single year.

If, however, more renewable energy sources become available to supply the energy grid, as they are expected to by the year 2030, air pollution would be curtailed, though not entirely. The team found that even under this heartier renewable scenario, there is still a slight increase in air pollution in some parts of the country, resulting in a total of 260 pollution-related deaths over one year. When they looked at the populations directly affected by the increased pollution, they found that Black or African American communities — a disproportionate number of whom live near fossil-fuel plants — experienced the greatest exposure. “They also calculated that more people are also likely to die prematurely due to climate impacts from the increase in carbon dioxide emissions, as the grid compensates for nuclear power’s absence,” adds the report. “The climate-related effects from this additional influx of carbon dioxide could lead to 160,000 additional deaths over the next century.”

Lead author Lyssa Freese, a graduate student in MIT’s Department of Earth, Atmospheric and Planetary Sciences (EAPS), said: “We need to be thoughtful about how we’re retiring nuclear power plants if we are trying to think about them as part of an energy system. Shutting down something that doesn’t have direct emissions itself can still lead to increases in emissions, because the grid system will respond.”

Read more of this story at Slashdot.

How Much To Infect Android Phones Via Google Play Store? How About $20K

If you want to sneak malware onto people’s Android devices via the official Google Play store, it may cost you about $20,000 to do so, Kaspersky suggests. The Register reports: This comes after the Russian infosec outfit studied nine dark-web markets between 2019 and 2023, and found a slew of code and services for sale to infect and hijack the phones and tablets of Google Play users. Before cybercriminals can share their malicious apps from Google’s official store, they’ll need a Play developer account, and Kaspersky says those sell for between $60 and $200 each. Once someone’s bought one of these accounts, they’ll be encouraged use something called a loader.

Uploading straight-up spyware to the Play store for people to download and install may attract Google’s attention, and cause the app and developer account to be thrown out. A loader will attempt to avoid that: it’s software a criminal can hide in their otherwise innocent legit-looking app, installed from the official store, and at some convenient point, the loader will fetch and apply an update for the app that contains malicious code that does stuff like steal data or commit fraud. That update may ask for extra permissions to access the victim’s files, and may need to be pulled from an unofficial store with the victim’s blessing; it depends on the set up. The app may refuse to work as normal until the loader is allowed to do its thing, convincing marks into opening up their devices to crooks. These tools are more pricey, ranging from $2,000 to $20,000, depending on the complexity and capabilities required.

Would-be crims who don’t want to pay thousands for a loader can pay substantially less — between $50 and $100 — for a binding service, which hides a malicious APK file in a legitimate application. However, these have lower successful install rates compared to loaders, so even in the criminal underground you get what you pay for. Some other illicit services offered for sale on these forums include virtual private servers ($300), which allow attackers to redirect traffic or control infected devices, and web injectors ($25 to $80) that look out for victims’ visiting selected websites on their infected devices and replacing those pages with malicious ones that steal login info or similar. Criminals can pay for obfuscation of their malware, and they may even get a better price if they buy a package deal. “One of the sellers offers obfuscation of 50 files for $440, while the cost of processing only one file by the same provider is about $30,” Team Kaspersky says. Additionally, to increase the number of downloads to a malicious app, thus making it more attractive to other mobile users, attackers can buy installs for 10 cents to $1 apiece. Kaspersky’s report can be found here.

Read more of this story at Slashdot.

The Biggest EV Battery Recycling Plant In the US Is Open For Business

Ascend Elements opened a recycling plant in Covington, Georgia in late March that it says is the largest electric-vehicle battery recycling facility in North America. “It can process 30,000 metric tons of input each year, breaking down old batteries and prepping the most valuable materials inside to be processed and turned into new batteries,” reports Canary Media. “That capacity equates to breaking down the battery packs from 70,000 electric vehicles annually, said Ascend CEO Mike O’Kronley.” From the report: Recycling can deliver new battery materials without the expense and environmental impact of new mining. It is extremely hard to develop new mines in the U.S., but the federal government is lavishing funds on new battery recycling plants. The revamped EV tax credits also call for increasing shares of domestically sourced batteries and battery materials. Those market and policy shifts made recycling sufficiently desirable that Ascend is paying other companies for their old batteries. At the moment, those deals are mostly with EV or battery makers that have high volumes to get rid of.

“Paying for these spent batteries keeps them from going into the landfill,” O’Kronley told Canary Media. “It’s better to get paid for it rather than throw them away.” Ascend also accepts used consumer electronics from battery-collection programs, such as Call2Recycle. That’s not to say there are enough old batteries coming in to fill the factory. Currently, 80 to 90 percent of what’s going into Ascend’s Covington facility is scrap materials from battery factories, including SK Battery America’s plant in Commerce, Georgia.

That relationship influenced Ascend’s choice of location: Covington sits in the emerging “Battery Belt,” a swath of new battery factories and electric-vehicle plants opening up across the Midwest and the Carolinas, Georgia, Tennessee and Kentucky (look for all the blue icons in this White House map of new industrial investments). Fellow battery-recycling startup Redwood Materials also chose South Carolina for a forthcoming $3.5 billion recycling facility. “There will need to be a recycling plant within about an hour’s drive of every single one of those [new battery gigafactories],” O’Kronley said. “You don’t want to be [long-distance] shipping these very large, heavy EV batteries that are classified as Class 9 hazardous materials.” The report notes that the company’s second commercial-scale facility in Hopkinsville, Kentucky will “introduce a brand-new technique for efficiently extracting cathode materials from black mass, which Ascend has dubbed ‘hydro to cathode.'”

Read more of this story at Slashdot.

FTC Orders Supplement Maker To Pay $600K In First Case Involving Hijacked Amazon Reviews

The U.S. Federal Trade Commission has approved a final consent order in its first-ever enforcement action over a case involving “review hijacking,” or when a marketer steals consumer reviews of another product to boost the sales of its own. TechCrunch reports: In this case, the FTC has ordered supplements retailer The Bountiful Company, the maker of Nature’s Bounty vitamins and other brands, to pay $600,000 for deceiving customers on Amazon where it used a feature to merge the reviews of different products to make some appear to have better ratings and reviews than they otherwise would have had if marketed under their own listings. The case exposes how sellers have been exploiting an Amazon feature that allows sellers to request the creation of “variation” relationships between different products and SKUs. The feature is meant to help marketers and consumers alike as it creates a single detail page on Amazon.com that shows similar products that are different only in narrow, specific ways, the FTC explains — like items that come in a different color, size, quantity or flavor. For instance, a t-shirt may have a dozen SKUs associated with one another because the shirt comes in a wide variety of colors.

For shoppers, it’s helpful to see all the options on one page so you can pick the item that best matches your needs and budget. In the case of supplements, the feature could be used to combine the same products by merging various SKUs featuring different quantities of the item in question, like bottles with 50, 100 or 200 pills, for example. However, The Bountiful Company exploited Amazon’s feature to merge its newer products with older, well-established products which had different formulations, the FTC said. The FTC cited and screenshotted more than a dozen examples from 2020 and 2021 in its original complaint (PDF) against the vitamin and supplement maker, which in 2021 sold its core brands — including Nature’s Bounty and Sundown — to Nestle. As a result of these product merges, consumers who happened across any of the newer products would believe them to be better received than they were in reality, as they were benefiting from the merged ratings and reviews of other, differentiated items.

“Boosting your products by hijacking another product’s ratings or reviews is a relatively new tactic, but is still plain old false advertising,” Samuel Levine, Director of the FTC’s Bureau of Consumer Protection, said this February when the consent order was first announced ahead of its public comment period and finalized version. With today’s decision, Bountiful will have to pay the Commission $600,000 as monetary relief for consumers. It’s also prohibited from making similar types of misrepresentations and barred from using “deceptive review tactics that distort what consumers think about its products or services,” the FTC said in a unanimous 4-0 decision.

Read more of this story at Slashdot.

After Low-Speed Bus Crash, Cruise Recalled Software for Its Self-Driving Taxis in March

San Francisco autonomous vehicle company Cruise recalled and updated the software of its fleet of 300 cars, reports the San Francisco Chronicle, ” after a Cruise taxi rear-ended a local bus “when the car’s software got confused by the articulated vehicle, according to a federal safety report and the company.”
The voluntary report notes that Cruise updated its software on March 25th.

Since last month’s low-speed crash, which resulted in no injuries, Cruise CEO Kyle Vogt said the company chose to conduct a voluntary recall, and the software update assured such a rare incident “would not recur….” As for the March bus collision, Vogt said the software fix was uploaded to Cruise’s entire fleet of 300 cars within two days. He said the company’s probe found the crash scenario “exceptionally rare” with no other similar collisions.

“Although we determined that the issue was rare, we felt the performance of this version of software in this situation was not good enough,” Vogt wrote in a blog post. “We took the proactive step of notifying NHTSA that we would be filing a voluntary recall of previous versions of our software that were impacted by the issue.” The CEO said such voluntary recalls will probably become “commonplace.”

“We believe this is one of the great benefits of autonomous vehicles compared to human drivers; our entire fleet of AVs is able to rapidly improve, and we are able to carefully monitor that progress over time,” he said.

The Cruise car was traveling about 10 miles per hour, and the collision caused only minor damage to its front fender, Vogt’s blog post explained. San Francisco’s buses have front and back coaches connected by articulated rubber, and when the Cruise taxi lost sight of the front half, it made the assumption that it was still moving (rather than recognizing that the back coach had stopped). Or, as Cruise told the National Highway Traffic Safety Administration, their vehicle “”inaccurately predicted the movement” of the bus.

It was not the first San Francisco incident involving Cruise since June, when it became the first company in a major city to win the right to taxi passengers in driverless vehicles — in this case Chevrolet Bolts. The city’s Municipal Transportation Agency and County Transportation Authority recorded at least 92 incidents from May to December 2022 in which autonomous ride-hailing vehicles caused problems on city streets, disrupting traffic, Muni transit and emergency responders, according to letters sent to the California Public Utilities Commission….

Just two days before the Cruise crash in March, the company had more problems with Muni during one of San Francisco’s intense spring storms. A falling tree brought down a Muni line near Clay and Jones streets on March 21, and a witness reported on social media that two Cruise cars drove through caution tape into the downed wire. A company representative said neither car had passengers and teams were immediately dispatched to remove the vehicles.

On Jan. 22, a driverless Cruise car entered an active firefighting scene and nearly ran over hoses. Fire crews broke a car window to try to stop it.

Read more of this story at Slashdot.