Overnight news online 01-24-2014 | Politics

Israeli coder Tal Ater found the bug while working on his own speech recognition software.

Despite Google finding a way to fix the bug in October 2013 the update has yet to be rolled out to Chrome, he said.

Google said there was no immediate threat to users from the speech recognition system.

Listening in "Even while not using your computer - conversations, meetings and phone calls next to your computer may be recorded and compromised," wrote Mr Ater in a blogpost explaining what he had found.

The bug emerges when malicious sites try to subvert the way Chrome handles speech recognition, he said.

Typically, people must manually grant permission to each site that wants to access a computer's microphone to listen in. Once permission has been granted Chrome lets people know a site is listening via a blinking red dot on the tab for that site.

In a video accompanying the blogpost, Mr Ater showed how a malicious attacker could use specially crafted code to exploit these permissions to launch a "pop-under" window that starts the speech recognition system.

"The malicious site you visited can continue listening in on you long after you have left it," said Mr Ater. "As long as Chrome is still running nothing said next to your computer is private."

Google was told about the bug in September last year, said Mr Ater and soon after found a way to fix it. However, this has yet to be included in updates for Chrome.

Mr Ater asked why Chrome remains vulnerable and was told that Google was still waiting for the World Wide Web consortium (W3C), which defines how the web develops, to make a decision about what to do.

"The security of our users is a top priority, and this feature was designed with security and privacy in mind," said a Google spokesperson. "We've re-investigated and still believe there is no immediate threat, since a user must first enable speech recognition for each site that requests it."

AOL, which is already part of Gravity's network, said it will use its technology across its own properties like TechCrunch and the Huffington Post as well as AOL's publisher network of more than 2,000 partners.

"Our theory is the web is going from search to social to personal," said AOL CEO Tim Armstrong. "Gravity is the best company in the world to do personal."

Gravity co-founder and CEO Amit Kapur said Gravity uses machine based algorithms to determine what topics are interesting to a specific reader based on their preferences and habits.

"When you go to a website, it organizes the entire experience just for you," said Kapur, who was also the chief operating officer of MySpace.

Gravity clients include a range of brands and publishers like Sony, Intel and USA Today.

Regulator Ofcom outlined the plan in October after the UK government said the fees should reflect "full market value".

The proposal also came after Britain raised a less-than-expected 2.34 billion pounds ($3.7 billion) in a 4G spectrum auction for airwaves to carry high-speed mobile Internet traffic earlier last year.

"The GSMA is concerned that Ofcom's proposal to more than quadruple annual license fees ... will jeopardize mobile operators' ability to upgrade their networks for 4G services in the UK," GSMA's chief regulatory officer Tom Phillips said.

Ofcom wants to hike charges for the 900MHz band to 138.5 million pounds ($229.7 million) from 24.8 million pounds, and to 170.4 million pounds from 39.7 million pounds for 1800MHz.

Europe has lagged the United States and parts of Asia in rolling out superfast mobile broadband, in part because spectrum has only recently become available for the services.

Britain's Vodafone, for one, is planning big increases in capital expenditure on upgrading its networks in Britain and elsewhere.

Vodafone said on Thursday its own analysis indicated the proposed fees were more than double where they should be.

"Vodafone UK is spending more than 900 million pounds this year alone on its network and has pledged to bring indoor 4G coverage to 98 percent of the UK population by 2015," a spokesman said.

"The regulator should be encouraging private sector investment in infrastructure and new services like 4G, which will benefit consumers, businesses and the wider British economy for many years to come."

Ofcom said it had not yet made a final decision on the level of the fees.

"We are currently consulting on this, and we will consider all responses with an open mind before making our decision later this year," it said.

Espirito Santo analyst Robert Grindle said that while the proposed fees were "somewhat based on the market price," mobile operators did have a point.

Bitcloud aims to harness the same methods used to mine Bitcoins, to provide services currently controlled by internet service providers (ISPs) and corporations.

Individuals would perform tasks such as storing, routing and providing bandwidth, in return for payment.

The founders are searching for developers for the project.

"We will start by decentralising the current internet, and then we can create a new internet to replace it," they said.

Just as Bitcoin miners provide computing power and are rewarded for solving complex mathematical equations with the virtual currency, so individual net users would be rewarded based on how much bandwidth they contribute to the Bitcloud network.

"Adding the profit motive to the equation gives this project a chance to succeed where many others have failed in the past," reads the group's white paper.

A currency known as Cloudcoins is proposed to underpin the network.

"If you're interested in privacy, security, ending internet censorship, decentralising the internet and creating a new mesh network to replace the internet, then you should join or support this project," the group said.

'Much to do' Among examples of new services, the proposal describes how YouTube could become WeTube.

"WeTube can act as a replacement for YouTube, Netflix, Hulu, Soundcloud, Spotify and other audio video streaming services," it said.

Artists would be paid with a percentage of advertising revenues, it said.

Critics may question how such a model can be sustained but the success of Bitcoin suggests that such decentralised networks can work.

Online retailer Overstock began accepting Bitcoin payments earlier this month and recently Google revealed it was looking at ways to integrate Bitcoins into its payment systems.

But the team behind Bitcloud, whose names have not been released, acknowledged they were only at the beginning of the project.

"There are still many key decisions that need to be made in the Bitcloud protocol. We have a basic idea of how everything will work, but we need assistance from programmers and thinkers from around the world who want to help," they said.

"The idea is an interesting thought-experiment at least," Boing Boing co-founder Cory Doctorow blogged on the site.

The long-awaited acquisition comes nearly a decade after Lenovo bought IBM's loss-making ThinkPad business for $1.75 billion, eventually becoming the world leader in personal computers in 2012.

The sale of the low-end server operation - which still needs U.S. government approval - would allow International Business Machines (IBM) to focus on its decade-long shift to more profitable software and services.

For Lenovo, the deal would increase its market share in the server market to 14 percent from 2 percent, said Peter Hortensius, senior vice-president at Lenovo and president of its Think Business Group.

The deal still needs clearance from the Committee on Foreign Investment in the United States (CFIUS), a body charged with protecting U.S. national security interests.

Chinese companies faced the most scrutiny over their U.S. acquisitions in 2012, according to a CFIUS report issued in December.

Lenovo's purchase of IBM's notebook division faced similar scrutiny before getting the go-ahead.

This time is likely to be easier, analysts said.

"It's fair to say that this deal is more likely to get through CFIUS without major problems than the 2005 transaction," said John Reynolds, a partner at law firm Davis Polk & Wardwell in Washington, D.C. who has 20 years of experience dealing with

CFIUS.

Reynolds said there seemed to be relatively little national security risk in the deal, adding that Lenovo was now a fairly well-known corporate citizen compared with 2005.

ISI Group analyst Brian Marshall also said he did not anticipate significant regulatory hurdles in the United States or China. "...Our seasoned China analyst believes the Chinese government is likely pleased with the deal," he added.

Maybank Kim Eng analyst Warren Lau noted that the System X server, among the systems to be bought by Lenovo, is based on commoditized technology and components that are sourced from the United States.

IBM shares were slightly higher at $182.98 in early trading on Thursday. Trading in Lenovo shares was halted before the close in Hong Kong ahead of the announcement.

SEVEN QUARTERS OF LOSSES

The deal with Lenovo marks another step in IBM's switch away from hardware to software and services.

USIS, which also vetted Edward Snowden before he leaked documents about U.S. spying efforts, has a contract with the U.S. government since 1996 to vet individuals seeking employment with federal agencies. Such background checks include investigative fieldwork on each application.

The Department of Justice (DOJ) said in a court filing on Wednesday that between March 2008 and September 2012, USIS filed at least 665,000 flawed background checks, which was about 40 percent of the total submissions.

A former employee of USIS filed a whistleblower lawsuit in July 2011 under the False Claims Act, which lets people collect rewards for blowing the whistle on fraud against the government.

The lawsuit alleged that USIS failed to perform quality control reviews in connection with its background investigations.

In its filing, the DOJ said USIS submitted background investigations that were not reviewed as per agreed standards.

DOJ said USIS received millions of dollars that it otherwise would not have received had the government been aware that the background investigations had not gone through the quality review process required by the contract.

"USIS management devised and executed a scheme to deliberately circumvent contractually required quality reviews of completed background investigations in order to increase the company's revenues and profits," DOJ said in its filing.

The payments to the firm ranged from $95 to $2,500, depending on the type of background investigation. The lawsuit requested for a jury trial and seeks to recover treble damages and penalties.

Through a software known as "Blue Zone," USIS was able to quickly make an electronic "Review Complete" notation without fully going through the mandated review process, DOJ said.

"The alleged conduct referenced in the civil complaint is contrary to our values and commitment to exceptional service," a USIS spokesperson told Reuters in an email.

The company said the allegations in the complaint related to a small group of people over a specific time period and that it had appointed a new leadership team, enhanced oversight procedures, and improved control protocols.

USIS said it has been cooperating with the government's investigation.

The firm also vetted Aaron Alexis, the technology contractor who killed 12 people at the Washington Navy Yard in September.

"Now that Congress has finished its work on this year's appropriations, the administration is able to finalize next year's budget," spokesman Steve Posner said in a statement.

"We are moving to complete the budget as quickly as possible to help Congress return to regular order in the annual budget process."

The U.S. Senate approved a $1.1 trillion spending bill last week that ends the threat of another broad shutdown of government agencies this fiscal year.

It funds government programs through the September 30 fiscal year-end.

Yanukovich was due to hold talks on Thursday with opposition leaders including heavyweight boxer-turned-politician Vitaly Klitschko, and anti-government demonstrators in the capital agreed to a truce with police until 8 p.m. pending the outcome.

The parliamentary website said the special session would be held on Tuesday.

Underlining the level of mistrust between the government and opposition, Prime Minister Mykola Azarov accused protesters of trying to stage a coup d'etat, and dismissed the possibility of an early presidential election to resolve the standoff.

"All those who support this coup should say clearly, 'Yes, we are for the overthrow of the legitimate authorities in Ukraine', and not hide behind peaceful protesters," Azarov said at the World Economic Forum in Davos, Switzerland.

"A genuine attempt at a coup d'etat is being carried out," Russian news agency Interfax quoted him as saying.

Azarov told Reuters the government had no plans to introduce a state of emergency: "We don't see the need for tough and extreme measures at the moment ... But don't put the government into an impasse," he said.

"People should not think that the government lacks available resources to put an end to this. It is our constitutional right and obligation to restore order in the country."

The protests against Yanukovich began in November, when he pulled out of signing a free trade deal with the European Union in favour of closer economic ties with former Soviet overlord Russia.

The unrest has swollen in recent weeks, and turned violent on Sunday when hard-core radicals broke away from the main protest area in the capital Kiev and clashed violently with riot police.

Three people have been killed on the side of protesters - two of them from gunshot wounds - and more than 150 police have been injured.

Outside the capital, thousands stormed the regional administration headquarters in Rivne in western Ukraine on Thursday, breaking down doors and demanding the release of people detained in the unrest there, UNIAN news agency reported.

ALARM ABROAD

The turmoil has caused alarm abroad, and on Thursday German Chancellor Angela Merkel expressed anger over the Ukraine government's crackdown on protesters.

"We are greatly worried, and not only worried, but also outraged at the way laws have been pushed through that call these freedoms into question," she told a news conference.

Shape Security says its product works with the HTML, JavaScript and CSS languages, transforming a site's code into a "moving target" to prevent cybercriminals from carrying out scripted attacks.

The Silicon Valley firm has several high-profile backers including Google.

But one expert said hackers might still be able to work round the defence.

However, Ron Austin - a senior lecturer on computer security at Birmingham City University - said that it would probably take them longer than previously.

Shape says the "look and feel" of the sites that use its tech remains unchanged to legitimate visitors.

It adds that several companies have already trialled its product, including Citigroup bank and the ticket seller StubHub.

Morphing code

Shape describes its product as a being a "botwall" - a reference to it being a barrier against automated software tools known as bots that recognise and exploit vulnerabilities in a site's code.

These can be used for malicious purposes, such as carrying out DDoS (distributed denial of service) attacks - forcing a website server to crash by flooding it with traffic - or to hijack a site, allowing the hacker to modify its contents, steal private details and spread malware.

Many products try to prevent such breaches by identifying bots by their signatures - the name they use when registering themselves - and the internet and email addresses they send data to.

Hackers have tried to counter detection by using a technique called "real-time polymorphism" - making their bots rewrite their own code every time they infect a new machine to make them harder to recognise.

Shape says its product reverses this advantage.

"The website looks and feels exactly the same to legitimate users, but the underlying site code is different on every page view," wrote the firm's founder, Sumit Agarwal, on its blog.

"Ultimately, the ShapeShifter aims to stop non-human visitors from executing large-scale automated attacks. This may help break the economics of breaches like the one Target experienced in late 2013, by eliminating the monetisation path.

The No. 4 U.S. mobile provider said it is offering a Visa card with banking features and a smartphone money management application with reduced-fee or zero-cost services for T-Mobile wireless customers.

The company, which has gained attention with promises of more flexible and cheaper cellphone services, is hoping to attract a similar following in personal finance.

The card, issued by a Bancorp Inc subsidiary and licensed by Visa Inc, is similar to a bank account. It will allow consumers to direct deposit paychecks and checks from smartphone cameras, make retail purchases, pay bills and withdraw cash from more than 42,000 ATMs with no fees.

The service could be attractive to people who struggle to qualify for traditional bank accounts but is unlikely to bring in revenue for the operator, at least in the short term, said Jackdaw Research analyst Jan Dawson.

"This has to be seen today as strictly a competitive differentiator and not a revenue opportunity, though I would expect T-Mobile to offer a broader range of financial services over time, and perhaps try to make some money on those," Dawson said. "For now, though, this is another marketing effort from T-Mobile that will cost money rather than make money for the company."

T-Mobile Chief Executive John Legere managed to turn around four years of customer losses with subscriber growth in the last three quarters of 2013 by offering discounted services and loudly criticizing bigger rivals Verizon Wireless, AT&T Inc and Sprint Corp.

According to the firm, CrowdStrike, the victims of the previously unreported cyber espionage campaign include energy and technology firms, some of which have lost valuable intellectual property.

CrowdStrike declined to go into detail about those losses or to name any victims, citing confidentiality agreements related to its investigation.

Officials with the Russian Interior Ministry could not be reached for comment early on Wednesday in Moscow.

"These attacks appear to have been motivated by the Russian government's interest in helping its industry maintain competitiveness in key areas of national importance," Dmitri Alperovitch, chief technology officer of CrowdStrike, told Reuters on Tuesday evening.

Cybersecurity researchers have in the past said that China's government was behind cyber espionage campaigns against various corporations dating back as far as 2005, but China has vehemently denied those allegations. Alperovitch said this is the first time the Russian government has been linked to cyber intrusions on companies.

Governments have been using computer networks to spy on each other for more than 30 years in the type of surveillance programs conducted by virtually every nation, according to CrowdStrike. It is only in the past decade that some nations have started using cyber espionage as a platform for gaining data to help promote their national economic interests, according to Alperovitch.

CrowdStrike has been following the activities of the Russian group of hackers, which it dubbed "Energetic Bear," for two years. The firm believes the Russian government is behind the campaign because of technical indicators, as well as analysis of the targets chosen and the data stolen, according to Alperovitch.

"We are very confident about this," he said. Victims include European energy companies, defense contractors, technology companies and government agencies, according to the CrowdStrike report.

Manufacturing and construction firms in the United States, Europe and Middle East as well as U.S. healthcare providers were also cited as targets in the report that was posted on the web early on Wednesday morning, here

Alcatel-Lucent and BT said speeds of 1.4 terabits per second were achieved during their joint test - enough to send 44 uncompressed HD films a second.

The test was conducted on a 410km (255-mile) link between the BT Tower in central London and Ipswich.

However, it may be many years before consumers notice any effect. But the breakthrough is being seen as highly important for internet service providers (ISPs), as it means a greater amount of information can be sent through existing broadband infrastructure, reducing the need for costly upgrades.

"BT and Alcatel-Lucent are making more from what they've got," explained Oliver Johnson, chief executive of broadband analyst firm Point Topic.

"It allows them to increase their capacity without having to spend much more money."

Alcatel-Lucent told the BBC that the demand for higher bandwidth grew by around 35% every year, making the need for more efficient ways to transfer data a massively pressing issue for ISPs, particularly with the growing popularity of data-heavy online services, such as film-streaming website Netflix. There are faster methods of transmitting data - such as the use of complex laser technology - but this is the first test to achieve such high speeds in "real world" conditions, outside testing labs.

Rush-hour traffic The high speeds were achieved using existing fibre cable technology that has already been installed in much of the UK and other parts of the world.

Kevin Drury, optical marketing leader at Alcatel-Lucent, likened the development to reducing space between lanes on a busy motorway, enabling more lanes of traffic to flow through the same area.

He said flexibility meant some could be adapted to specific needs - like opening an extra lane during the morning rush hour.

In internet terms, this would mean, for example, streaming video would get a large, wide lane, while accessing standard web pages would need only a small part of the fibre's capacity.

However, pushing more data through fibre cables presents a challenge "The trade-off is, the more you squeeze into a fibre line, the more potential there is for interference and for error," explained Mr Johnson.

"What has got better is the fact they are able to pack these channels closer together and into the same space."