Only Cloud Providers Get Security Right. Can IT Vendors Catch Up?

Slashdot reader storagedude writes: If cloud service providers are the only ones who can get security right, will everyone eventually move to the cloud? That’s one of the questions longtime IT systems architect Henry Newman asks in a new article on eSecurity Planet. “The concept of zero trust has been around since 2010, when Forrester Research analyst John Kindervag created the zero trust security model. Yet two years after the devastating Colonial Pipeline attack and strong advocacy from the U.S. government and others, we are still no closer to seeing zero trust architecture widely adopted,” Newman writes. “The only exception, it seems, has been cloud service providers, who boast an enviable record when it comes to cybersecurity, thanks to rigorous security practices like Google’s continuous patching.” “As security breaches continue to happen hourly, sooner or later zero trust requirements are going to be forced upon all organizations, given the impact and cost to society. The Biden Administration is already pushing ambitious cybersecurity legislation, but it’s unlikely to get very far in the current Congress. I am very surprised that the cyber insurance industry has not required zero trust architecture already, but perhaps the $1.4 billion Merck judgment that went against the industry last week will begin to change that.

“The central question is, can any organization implement a full zero trust stack, buy hardware and software from various vendors and put it together, or will we all have to move to cloud service providers (CSPs) to get zero trust security?

“Old arguments that cloud profit margins will eventually make on-premises IT infrastructure seem like the cheaper alternative failed to anticipate an era when security became so difficult that only cloud service providers could get it right.” Cloud service providers have one key advantage when it comes to security, Newman notes: They control, write and build much of their software and hardware stacks.

Newman concludes: “I am somewhat surprised that cloud service providers don’t tout their security advantages more than they do, and I am equally surprised that the commercial off-the-shelf vendors do not band together faster than they have been to work on zero trust. But what surprises me the most is the lack of pressure on everyone to move to zero trust and get a leg or two up on the current attack techniques and make the attack plane much smaller than it is.”

Read more of this story at Slashdot.

US Focuses on Invigorating ‘Chiplet’ Production in the US

More than a decade ago engineers at AMD “began toying with a radical idea,” remembers the New York Times. Instead of designing one big microprocessor, they “conceived of creating one from smaller chips that would be packaged tightly together to work like one electronic brain.”

But with “diminishing returns” from Moore’s Law, packaging smaller chips suddenly becomes more important. [Alternate URL here.] As much as 80% of microprocessors will be using these designs by 2027, according to an estimate from the market research firm Yole Group cited by the Times:

The concept, sometimes called chiplets, caught on in a big way, with AMD, Apple, Amazon, Tesla, IBM and Intel introducing such products. Chiplets rapidly gained traction because smaller chips are cheaper to make, while bundles of them can top the performance of any single slice of silicon. The strategy, based on advanced packaging technology, has since become an essential tool to enabling progress in semiconductors. And it represents one of the biggest shifts in years for an industry that drives innovations in fields like artificial intelligence, self-driving cars and military hardware. “Packaging is where the action is going to be,” said Subramanian Iyer, a professor of electrical and computer engineering at the University of California, Los Angeles, who helped pioneer the chiplet concept. “It’s happening because there is actually no other way.”

The catch is that such packaging, like making chips themselves, is overwhelmingly dominated by companies in Asia. Although the United States accounts for around 12 percent of global semiconductor production, American companies provide just 3 percent of chip packaging, according to IPC, a trade association. That issue has now landed chiplets in the middle of U.S. industrial policymaking. The CHIPS Act, a $52 billion subsidy package that passed last summer, was seen as President Biden’s move to reinvigorate domestic chip making by providing money to build more sophisticated factories called “fabs.” But part of it was also aimed at stoking advanced packaging factories in the United States to capture more of that essential process… The Commerce Department is now accepting applications for manufacturing grants from the CHIPS Act, including for chip packaging factories. It is also allocating funding to a research program specifically on advanced packaging…

Some chip packaging companies are moving quickly for the funding. One is Integra Technologies in Wichita, Kan., which announced plans for a $1.8 billion expansion there but said that was contingent on receiving federal subsidies. Amkor Technology, an Arizona packaging service that has most of its operations in Asia, also said it was talking to customers and government officials about a U.S. production presence… Packaging services still need others to supply the substrates that chiplets require to connect to circuit boards and one another… But the United States has no major makers of those substrates, which are primarily produced in Asia and evolved from technologies used in manufacturing circuit boards. Many U.S. companies have also left that business, another worry that industry groups hope will spur federal funding to help board suppliers start making substrates.

In March, Mr. Biden issued a determination that advanced packaging and domestic circuit board production were essential for national security, and announced $50 million in Defense Production Act funding for American and Canadian companies in those fields. Even with such subsidies, assembling all the elements required to reduce U.S. dependence on Asian companies “is a huge challenge,” said Andreas Olofsson, who ran a Defense Department research effort in the field before founding a packaging start-up called Zero ASIC. “You don’t have suppliers. You don’t have a work force. You don’t have equipment. You have to sort of start from scratch.”

Read more of this story at Slashdot.

Millions of Mobile Phones Come Pre-Infected With Malware, Say Researchers

Trend Micro researchers at Black Hat Asia are warning that millions of Android devices worldwide come pre-infected with malicious firmware before the devices leave their factories. “This hardware is mainly cheapo Android mobile devices, though smartwatches, TVs, and other things are caught up in it,” reports The Register. From the report: This insertion of malware began as the price of mobile phone firmware dropped, we’re told. Competition between firmware distributors became so furious that eventually the providers could not charge money for their product. “But of course there’s no free stuff,” said [Trend Micro researcher Fyodor Yarochkin], who explained that, as a result of this cut-throat situation, firmware started to come with an undesirable feature — silent plugins. The team analyzed dozens of firmware images looking for malicious software. They found over 80 different plugins, although many of those were not widely distributed. The plugins that were the most impactful were those that had a business model built around them, were sold on the underground, and marketed in the open on places like Facebook, blogs, and YouTube.

The objective of the malware is to steal info or make money from information collected or delivered. The malware turns the devices into proxies which are used to steal and sell SMS messages, take over social media and online messaging accounts, and used as monetization opportunities via adverts and click fraud. One type of plugin, proxy plugins, allow the criminal to rent out devices for up to around five minutes at a time. For example, those renting the control of the device could acquire data on keystrokes, geographical location, IP address and more. “The user of the proxy will be able to use someone else’s phone for a period of 1200 seconds as an exit node,” said Yarochkin. He also said the team found a Facebook cookie plugin that was used to harvest activity from the Facebook app.

Through telemetry data, the researchers estimated that at least millions of infected devices exist globally, but are centralized in Southeast Asia and Eastern Europe. A statistic self-reported by the criminals themselves, said the researchers, was around 8.9 million. As for where the threats are coming from, the duo wouldn’t say specifically, although the word “China” showed up multiple times in the presentation, including in an origin story related to the development of the dodgy firmware. Yarochkin said the audience should consider where most of the world’s OEMs are located and make their own deductions.

The team confirmed the malware was found in the phones of at least 10 vendors, but that there was possibly around 40 more affected. For those seeking to avoid infected mobile phones, they could go some way of protecting themselves by going high end. That is to say, you’ll find this sort of bad firmware in the cheaper end of the Android ecosystem, and sticking to bigger brands is a good idea though not necessarily a guarantee of safety. “Big brands like Samsung, like Google took care of their supply chain security relatively well, but for threat actors, this is still a very lucrative market,” said Yarochkin.

Read more of this story at Slashdot.

Discord Discloses Data Breach After Support Agent Got Hacked

Discord has informed users of a data breach that occurred after a third-party support agent’s account was compromised, exposing user email addresses, messages exchanged with Discord support, and any attachments sent as part of the tickets. Discord immediately disabled the account and worked with the customer service partner to prevent similar incidents in the future, but users are advised to stay vigilant for any suspicious activity. BleepingComputer reports: “Due to the nature of the incident, it is possible that your email address, the contents of customer service messages and any attachments sent between you and Discord may have been exposed to a third party,” Discord said in letters sent to affected users. “As soon as Discord was made aware of the issue, we deactivated the compromised account and completed malware checks on the affected machine.”

They also worked with the customer service partner to implement effective measures to prevent similar incidents in the future. “While we believe the risk is limited, it is recommended that you be vigilant for any suspicious messages or activity, such as fraud or phishing attempts,” the company said.

Read more of this story at Slashdot.

Apple Silicon Macs Now Natively Support Unreal Engine 5

Epic Games has released a new update for Unreal Engine 5 that allows it to run natively on Apple Silicon. With the recent update, Mac users will no longer have to rely on Rosetta technology in order to run the software, resulting in a significant boost in performance on M1 and M2 Macs. Engadget reports: There’s more news for Apple users as well. Epic unveiled a new iPad app (below) for virtual productions that works with the Unreal Engine’s ICVFX (In-Camera VFX) editor. It offers “an intuitive touch-based interface for stage operations such as color grading, light card placement, and nDisplay management tasks from anywhere within the LED volume,” the company said. In other words, it lets DPs, VFX folks and others tweak lighting and more on virtual sets from a simple, portable interface.

Other new features introduced with the Unreal Engine 5.2 update include a “Procedural Content Generation framework” that lets you populate large scenes with the Unreal Engine assets of your choice, making it faster to build large worlds. And another feature called Substrate allows material creation with more control over the look and feel of objects used in in real-time applications like games or for linear content creation. Epic demonstrated that using its previous Rivian demo, giving a metallic-looking paint job to the R1T electric pickup.

Read more of this story at Slashdot.

Pure Storage: No More Hard Drives Will Be Sold After 2028

An anonymous reader shares a report: In the latest blast of the HDD vs SSD culture wars, a Pure Storage exec is predicting that no more hard disk drives will be sold after 2028 because of electricity costs and availability, as well as NAND $/TB declines. Shawn Rosemarin, VP R&D within the Customer Engineering unit at Pure, told B&F: “The ultimate trigger here is power. It’s just fundamentally coming down to the cost of electricity.” Not the declining cost of SSDs and Pure’s DFMs dropping below the cost of disks, although that plays a part. In his view: “Hard drive technology is 67 years old. We need to herald this technology that went from five megabytes the size of this room to where we are today. And even the latest HAMR technology, putting a laser on the top of the head in order to heat up the platters, is pretty remarkable … But we’re at the end of that era.”

HDD vendors sing a different tune, of course. Back in 2021, HDD vendor Seagate said the SSD most certainly would not kill disk drives. There’s a VAST vs Infinidat angle to it as well, with the former also stating disk drive IO limitations would cripple the use of larger disk drives in petabyte-scale data stores, with Infidat blasting back that it “must be joking.” Gartner has had a look in too, claiming that enterprise SSDs will hit 35 percent of HDD/SSD exabytes shipped by 2026 – though that would make Rosemarin’s 2028 cutoff unlikely. Pure recently stated SSDs would kill HDDs in a crossover event that would happen “soon.” Rosemarin, meanwhile, continued his argument: “Our CEO in many recent events has quoted that 3 percent of the world’s power is in datacenters. Roughly a third of that is storage. Almost all of that is spinning disk.

So if I can eliminate the spinning disk, and I can move to flash, and I can in essence reduce the power consumption by 80 or 90 percent while moving density by orders of magnitude in an environment where NAND pricing continues to fall, it’s all becoming evident that hard drives go away.” Are high electricity prices set to continue? “I think the UK’s power has gone up almost 5x recently. And here’s the thing … when they go up, they very seldom if ever come down … I’ve been asked many times do I think the cost of electricity will drop over time. And, frankly, while I wish it would and I do think there are technologies like nuclear that could help us over time. I think it’ll take us several years to get there. We’re already seeing countries putting quotas on electricity, and this is a really important one — we’ve already seen major hyperscalers such as one last summer who tried to enter Ireland [and] was told you can’t come here, we don’t have enough power for you. The next logical step from that is OK, so now if you’re a company and I start to say, well, we only have so much power, so I’m gonna give you X amount of kilowatts per X amount of employees, or I’m gonna give you X amount of kilowatts for X amount of revenue that you contribute to the GDP of the country or whatever metric is acceptable.”

Read more of this story at Slashdot.

Google Brings Dark Web Monitoring At All US Gmail Users

At Google I/O on Wednesday, Google said that all Gmail users in the U.S. will soon be able to discover if their email address has been found on the dark web. The dark web report security feature will roll out over the coming weeks, and will be expanded to select international markets. BleepingComputer reports: Once enabled, it will allow Gmail users to scan the dark web for their email addresses and take action to protect their data based on guidance provided by Google. For instance, they’ll be advised to turn on two-step authentication to protect their Google accounts from hijacking attempts. Google will also regularly notify Gmail users to check if their email has been linked to any data breaches that ended up on underground cybercrime forums.

“Dark web report started rolling out in March 2023 to members across all Google One plans in the United States, providing a simple way to get notified when their personal information was discovered on the dark web. “Google One’s dark web report helps you scan the dark web for your personal info — like your name, address, email, phone number and Social Security number — and will notify you if it’s found,” said Google One Director of Product Management Esteban Kozak in March when the feature was first announced. The company says all the personal info added to the profile can be deleted from the monitoring profile or by removing the profile in the dark web report settings.

Read more of this story at Slashdot.

Will AI Become the New McKinsey?

Sci-fi writer Ted Chiang, writing for New Yorker: So, I would like to propose another metaphor for the risks of artificial intelligence. I suggest that we think about A.I. as a management-consulting firm, along the lines of McKinsey & Company. Firms like McKinsey are hired for a wide variety of reasons, and A.I. systems are used for many reasons, too. But the similarities between McKinsey — a consulting firm that works with ninety per cent of the Fortune 100 — and A.I. are also clear. Social-media companies use machine learning to keep users glued to their feeds. In a similar way, Purdue Pharma used McKinsey to figure out how to “turbocharge” sales of OxyContin during the opioid epidemic. Just as A.I. promises to offer managers a cheap replacement for human workers, so McKinsey and similar firms helped normalize the practice of mass layoffs as a way of increasing stock prices and executive compensation, contributing to the destruction of the middle class in America.

A former McKinsey employee has described the company as “capital’s willing executioners”: if you want something done but don’t want to get your hands dirty, McKinsey will do it for you. That escape from accountability is one of the most valuable services that management consultancies provide. Bosses have certain goals, but don’t want to be blamed for doing what’s necessary to achieve those goals; by hiring consultants, management can say that they were just following independent, expert advice. Even in its current rudimentary form, A.I. has become a way for a company to evade responsibility by saying that it’s just doing what âoethe algorithmâ says, even though it was the company that commissioned the algorithm in the first place.

Read more of this story at Slashdot.

Google’s New Pixel Tablet Is a $500 Slate For the Home

Google has announced the Pixel Tablet after teasing it during last year’s Google I/O conference. The Verge reports: The Pixel Tablet is designed from the ground up to be good at what people typically use tablets for: watching video or playing games in the comfort of their own home. It is not, however, making any statements about the future of computing. The looks of the Pixel Tablet are relatively generic. It has an 11-inch, 16:10, 2560 x 1600 pixel LCD display, even bezels all around, and a matte back. It comes in three colors: white, dark green, and light pink, with the dark green model featuring a black bezel. Though it looks like plastic from a distance, the Pixel Tablet has an aluminum frame with a nanotexture coating, not unlike what Google did with the Pixel 5 smartphone.

Bundled in the box with the Pixel Tablet is a magnetic speaker dock. This serves multiple purposes and is meant to prevent the dreaded “dead tablet in a drawer” syndrome: it’s a place to store the Pixel Tablet when it’s not in use; it charges the battery; and it has a louder, fuller speaker better suited for communal listening than the speakers that are built into the tablet. If you’re playing music or watching a video on the tablet when you put it on the dock, it will seamlessly transfer the audio to the dock’s speaker. Pull the tablet off the dock while something is playing, and it will instantly switch to the tablet’s speakers.

When mounted on the speaker dock, the Pixel Tablet looks an awful lot like the Nest Hub Max, a $250 smart display that Google released back in 2019. But make no mistake, the Pixel Tablet is an Android tablet and not a smart display — it runs completely different software and has different capabilities compared to the Nest Hub. That said, when the tablet is docked on the speaker, it can show a slideshow of images from your Google Photos albums just like the Nest Hub. It also has a quick access button to the Google Home app so you can control smart home devices, and it can accept voice commands from a distance for hands-free Google Assistant queries. The lock screen won’t show any personal information like notifications — for that, you’ll have to unlock the tablet to access the accounts that are set up on it. The $499 slab is available for preorder starting today, and will begin shipping on June 20th.

Read more of this story at Slashdot.

Former Coinbase Product Manager Gets Two Years For Insider Trading

Former Coinbase product manager Ishan Wahi was sentenced to two years in prison for insider trading. Decrypt reports: Ishan Wahi, 32, and his associates — including his brother, Nikhil — made over $1.5 million from investing in new digital assets just before they were listed by America’s biggest crypto exchange. Wahi was able to use his knowledge of incoming assets to buy them and then quickly sell them, to make huge profits. When the San Francisco-based exchange lists new coins and tokens, they quickly shoot up in value, a phenomenon known as “the Coinbase effect.”

The Indian national tried to flee the country after being quizzed by Coinbase, the Department of Justice said. But he was stopped from boarding a flight to India by American cops. Wahi pleaded guilty in February to two counts of conspiracy to commit wire fraud brought against him by prosecutors in the Southern District of New York. Wahi, his brother and his friend, Sameer Ramani, were also hit with civil charges by the U.S. Securities and Exchange Commission. “[Wahi] violated the trust placed in him by his employer” by sharing the secret listings,” said U.S. Attorney Damian Williams. “Today’s sentence should send a strong signal to all participants in the cryptocurrency markets that the laws decidedly do apply to them.”

Read more of this story at Slashdot.