US companies hit by ‘colossal’ cyber-attack

About 200 US businesses have been hit by a “colossal” ransomware attack, according to a cyber-security firm.

Huntress Labs said the hack targeted Florida-based IT company Kaseya before spreading through corporate networks that use its software.

Kaseya said in a statement on its own website that it was investigating a “potential attack”.

Huntress Labs said it believed the Russia-linked REvil ransomware gang was responsible.

The US Cybersecurity and Infrastructure Agency, a federal agency, said in a statement that it was taking action to address the attack.

The cyber-breach emerged on Friday afternoon as companies across the US were clocking off for the long Independence Day weekend.

Kaseya said one of its applications that runs corporate servers, desktop computers and network devices might have been compromised.

The company said it was urging customers that use its VSA tool to immediately shut down their servers.

Kaseya said in its statement that a “small number” of companies had been affected, though Huntress Labs said the number is already about 200 and counting.

It is not clear what specific companies have been affected – a Kaseya representative contacted by the BBC declined to give details.

Kaseya’s website says it has a presence in over 10 countries and more than 10,000 customers.”This is a colossal and devastating supply chain attack,” Huntress Labs’ senior security researcher John Hammond said in an email to Reuters news agency.

At a summit in Geneva last month, US President Joe Biden said he told Russian President Vladimir Putin he had a responsibility to rein in such cyber-attacks.

Mr Biden said he gave Mr Putin a list of 16 critical infrastructure sectors, from energy to water, that should not be subject of hacking.

REvil – also known as Sodinokibi – is one of the most prolific and profitable cyber-criminal groups in the world.

The gang was blamed by the FBI for a hack in May that paralysed operations at JBS – the world’s largest meat supplier.

FBI accuses Russia-linked hackers of attack on JBS
The ransomware surge ruining lives
Should paying hacker ransoms be banned?
The group sometimes threatens to post stolen documents on its website – known as the “Happy Blog” – if victims don’t comply with its demands.

REvil was also linked to a co-ordinated attack on nearly two dozen local governments in Texas in 2019.

Coding error spotted in Tim Berners-Lee NFT sale

A coding error has been spotted in a video displaying the original source code for the world wide web, used to advertise a $5.4m (£3.9m) auction sale.

Creator Sir Tim Berners-Lee sold a non-fungible token – a certificate of ownership of a digital asset, of the code – through Sotheby’s, on Wednesday.

The NFT included time-stamped files of the source code and an animated video of it being written.

The researcher who spotted the error said it looked like “a simple mistake”.

Mikko Hypponen, from security company F Secure, said the symbols “<” and “>” had been translated into HyperText Markup Language (HTML) as “< >”.

This was a tactic sometimes used deliberately to protect code – known as “escaping” – but in this case it appeared to have been done in error.

“There have already been discussions about whether this would make the NFT more valuable – like a postage stamp with a misprint error,” he said.

Mr Hypponen added he had not personally bid for the NFT, which was sold to an unidentified buyer.

Opening bid
Website creator Mark O’Neill said it appeared “whoever made the video for the website ran the original text file through something that converted it into HTML”.

“It’s embarrassing for Sotheby’s but I trust that nobody has done the same to the original code,” he added.

Sotheby’s and Sir Tim have been contacted by BBC News for comment.

The auction began on 23 June with an opening bid of $1,000.

Proceeds will go to charities chosen by Sir Tim and his wife.

‘Royalty free’
Sir Tim created the world wide web, in 1989, by connecting different pieces of information on the early internet through hyperlinks.

He built the first web browser and server, refusing to patent his invention.

In 1993, Cern, the research organisation Sir Tim worked for at the time, relinquished all its rights to the technology and put it in the open domain.

And when the NFT auction was announced, Sir Tim told the Guardian: “The core codes and protocols on the web are royalty free, just as they always have been.

“I’m not selling the web – you won’t have to start paying money to follow links.

“I’m not even selling the source code.

“I’m selling a picture that I made, with a Python program that I wrote myself, of what the source code would look like if it was stuck on the wall and signed by me.”

Amazon launches ‘child-friendly’ smart speaker in UK

Amazon is launching a child-friendly version of its Echo Dot smart speaker in the UK, several years after it was made available in the US.

The speaker – which comes with either a panda or tiger design – is billed as a learning tool, allowing children “to have fun and learn with Alexa”.

But critics said that parents should remember that it will also be collecting data on their children.

Amazon said it had imposed tight safety protocols on the device.

“We conduct robust testing and research and have strict measures in place for Echo Dot Kids, Amazon Kids and Amazon Kids+ that protect children and provide parents with transparency and control over the experience, creating a safe space in which kids can learn and have fun,” it told the BBC.

Of the delay in releasing the product in the UK, it said: “There are many elements and challenges that go into expanding into other countries and languages, particularly when it comes to content, services and features that are locally relevant.”

The device comes with one year’s worth of Amazon Kids, which offers Alexa-specific content such as child-friendly skills and audiobooks.

It will also have parental controls which allow adults to block things such as explicit lyrics on music streaming services, as well as set time limits to prevent children from “talking with Alexa late into the night”.

The Magic Word feature rewards children who use the word “please” with positive reinforcement.

However, privacy experts said parents should think twice before buying the device.

“You may want to take a moment to consider whether this is a piece of technology you really want in your child’s bedroom,” said digital privacy expert Attila Tomaschek, from ProPrivacy.

He added that the device would be recording a conversation it had with a child.

“The cute speaker will collect, process and analyse this data, potentially even sharing it with various third parties,” he said.

But Amazon denied that would happen: “We have built privacy and security deeply into the Alexa service. We never share voice recordings with third parties. Parents need to give permission to set up this device and can review, delete or choose not to have voice recordings saved at any time.”

In 2019, a coalition of child protection and privacy groups filed a complaint with the Federal Trade Commission, asking it to investigate the Echo Dot Kids. They said that while the device offered parental controls, it did not offer parents control over how Amazon interacts with their children’s data.

Echo Dot Kids will cost £59.99 and be available from 21 July.

Facebook joins $1 trillion club after anti-trust victory

The stock market value of Facebook has topped $1 trillion for the first time after the tech giant won a court victory against US regulators.

A federal court dismissed two lawsuits, from the Federal Trade Commission (FTC) and a coalition of states, sending Facebook shares up 4.2%.

It took the value of Facebook above $1tn, making it the last of the “big five” tech firms to hit the milestone.

The legal actions had accused Facebook of stifling competition.

But Judge James Boasberg ruled that the FTC’s anti-trust complaint against the social networking giant was too vague.

Another separate anti-competition lawsuit filed by a group of 46 states was thrown out because the alleged violations occurred too long ago.

In the US District Court for the District of Columbia ruling, Judge Boasberg wrote that the FTC’s complaint was “legally insufficient” and had to be dismissed, because the FTC had “failed to plead enough facts” to back up its claim that Facebook was stifling competition.

Facebook asks judge to reject anti-trust lawsuit
Facebook facing US legal action over competition
Facebook faces fresh anti-trust investigation
The FTC’s lawsuit had requested that the technology giant, which also owns Instagram and WhatsApp, be broken up.

“The FTC’s complaint says almost nothing concrete on the key question of how much power Facebook actually had, and still has, in a properly defined anti-trust product market,” wrote Judge Boasberg.

“It is almost as if the agency expects the court to simply nod to the conventional wisdom that Facebook is a monopolist.”

While this is a setback for the FTC that some analysts say could have repercussions for the future of anti-competition law in the US, the watchdog can re-file the charges and has until 28 July to do so.

However, investors saw it as an important victory for Facebook, sending the share price higher. The values of the other tech giants – Apple, Google-owner Alphabet, Microsoft, and Amazon – have already topped $1tn.

‘Doing nothing over the the last half decade’
Separately, Judge Boasberg also dismissed an anti-competition lawsuit brought by a coalition of 45 US states together with the FTC.

This lawsuit had also sought to force Facebook to divest Instagram and WhatsApp. It related to Facebook’s acquisition of the two apps in 2012 and 2014.

In March, Facebook petitioned the federal court in the US to dismiss them, describing the FTC complaint as “nonsensical”.

The firm said the FTC’s case “ignores the reality of the dynamic, intensely competitive high-tech industry in which Facebook operates”.

In his ruling on this case, Judge Boasberg said that the states did not provide “a reasonable justification” for why they had waited between six to eight years to decide to sue Facebook – an argument the social networking giant previously made.

He added that the states had failed to provide “a factual dispute” and only gave a “half-hearted contention that Facebook was not prejudiced but rather ‘benefitted from the states not filing sooner’, since it has been and remains a very profitable company”.

“Ultimately, this anti-trust action is premised on public, high-profile conduct, nearly all of which occurred over six years ago – before the launch of the Apple Watch or Alexa or Periscope, when Kevin Durant still played for the Oklahoma City Thunder and when Ebola was the virus dominating headlines,” wrote Judge Boasberg.

He added that the states’ allegations made it clear that the lawsuit could easily have been filed between 2012 and 2014: “The system of anti-trust enforcement that Congress has established does not exempt plaintiffs here from ‘the consequences of [their] choice’ to do nothing over the last half decade. “

Binance: Watchdog clamps down on cryptocurrency exchange

Binance, the world’s biggest cryptocurrency exchange, has been issued a warning by the UK’s financial regulator.

The Financial Conduct Authority (FCA) has ruled that the firm cannot conduct any “regulated activity” in the UK.

It also advised people to be wary of adverts promising high returns on cryptoasset investments.

Binance said the FCA notice would have no “direct impact” on the services it provides from its website Binance.com.

Binance’s existing crypto exchange is not UK-based so despite the FCA ruling, there will be no impact on UK residents who use the website to purchase and sell cryptocurrencies.

The FCA does not regulate cryptocurrencies, but requires exchanges to register with them. Binance has not registered with the FCA and therefore is not allowed to operate an exchange in the UK.

The FCA move comes amid pushback from regulators around the world against cryptocurrency platforms.

Binance.com is an online centralised exchange that offers users a range of financial products and services, including purchasing and trading a wide range of digital currencies, as well as digital wallets, futures, securities, savings accounts and even lending.

Binance Group is currently based in the Cayman Islands, while Binance Markets Limited is an affiliate firm based in London. The firm has multiple entities dotted around the world and Binance Group was previously based in Malta.

Fears over risk-taking by cryptoasset investors
Donald Trump calls Bitcoin ‘a scam’
World Bank rejects El Salvador Bitcoin request
The FCA said that Binance Markets Limited (BML), which is owned by Binance Group, is not currently permitted to undertake any regulated activities without the prior written consent of the FCA. It has until Wednesday to comply with the ruling.

The regulator also stressed that no entity in the Binance Group holds any form of authorisation, registration or licence to conduct regulated activity in the UK.

At first sight, the Financial Conduct Authority’s move to bar Binance from operating in the UK will have little impact. After all, it won’t stop the company’s many UK customers from using its exchange based in the Cayman Islands to buy and sell Bitcoin and other cryptocurrencies.

Nevertheless, the FCA is sending a strong signal that it is worried about the dangers of investing in cyptocurrencies in general.

The reason it wants them all to register is because it’s concerned about their potential use as a cover for illicit activity – and it wants consumers to be very careful indeed.

As well as forbidding Binance from setting up an exchange in the UK, the regulator is ordering its UK division to stop any form of advertising here by 30 June. More significantly, it has until the end of this week to show the FCA that it has stored records of all of its UK customers, ready to be handed over if necessary.

And there’s a message to UK consumers to check whether any crypto company is registered with the regulator and, if it isn’t, to consider withdrawing their assets.

The FCA cannot stop people from trading in cryptocurrencies – but it has got out its biggest red flag and is waving it vigorously.

Google tracking cookies ban delayed until 2023

Google has delayed its plan to block third-party cookies from its Chrome internet browser.

Cookies track users’ internet activity and allow digital publishers to target advertising.

They are already blocked by a number of Google’s rivals, including Apple, Microsoft and Mozilla.

But critics say Google’s ban forces ad sellers to go direct to the tech giant for this information instead – giving it an unfair advantage.

This is because it plans to replace the system with another one of Google’s own design, which it claims is better for privacy but still allows marketing. Its proposals are already under investigation by the UK Competition and Markets Authority (CMA).

The ban had been planned for 2022, and has now been put back until 2023.

In a blog, Vinay Goel, privacy engineering director for Google’s Chrome browser said: “It’s become clear that time is needed across the ecosystem” in order to “get this right”.

According to GlobalStats, Chrome has a 65% market share worldwide.

Farhad Divecha, founder of digital marketing agency AccuraCast, said the delay was good news for his industry.

“We welcome this delay and only hope that Google uses this time to consult with the CMA as well as different parties that will be affected by the changes, including advertisers, agencies, publishers, and ad-tech and tracking solutions providers,” he said.

Google’s new privacy proposals are known as the Privacy Sandbox .

One of its ideas is the introduction of something called The Federated Learning of Cohorts, or “Floc”.

The idea is that a browser enabled with Floc would collect information about browsing habits and assign users to a group, or “flock”, with similar browsing histories. Each would share an ID which would indicate their interests to advertisers.

This too has faced a lot of criticism, including from the Electronic Frontiers Foundation (EFF) which described it as “[Internet] users begin[ning] every interaction with a confession: ‘Here’s what I’ve been up to this week, please treat me accordingly’.”

Apple claims ‘sideloading’ apps is ‘serious’ security risk

Apple claims that allowing developers to distribute apps outside its official App Store would “expose users to serious security risks”.

A new report from the company argues strongly against allowing so-called sideloading of apps.

The report suggests a range of hypothetical problems including ransomware and financial scams.

It comes as Apple is under pressure from regulators and some developers over its App Store.

The company is awaiting the outcome of its legal battle with Epic Games over what the games studios says are unfair terms set by Apple.

Epic Games has made no secret of its ambition to create a competing storefront – but Apple does not allow third-party app stores to be downloaded from its own App Store.

Separately, Apple is under investigation in the EU, UK, and US over its App Store policies, as an increasing number of developers have spoken out against the so-called “Apple tax” over the past year.

Similar allegations are lodged against Apple’s main rival in the space, Google, which is also embroiled in a legal battle with Epic Games.

Apple is also concerned that forthcoming EU regulation of digital markets could effectively force Apple to enable sideloading.

The 16-page report from Apple appears to be a compilation of all the tech giant’s arguments against relinquishing exclusive control of app sales on its iPhone and iPad platforms.

Apple charged over ‘anti-competitive’ app policies
Apple investigated over ‘unfair’ App Store claims
“Some have suggested that we should create ways for developers to distribute their apps outside of the App Store, through websites or third-party app stores,” the report says.

“Allowing sideloading would degrade the security of the iOS platform and expose users to serious security risks.”

It also claimed that allowing sideloading “would expose users to scammers who will exploit apps to mislead users, attack iPhone security features, and violate user privacy”.

Accompanying the claims were a series of theoretical scenarios which Apple said showed “a family’s everyday experience” in “this more uncertain world” – accompanied by illustrations of a thieving cartoon fox, apparently representing unscrupulous developers.

It referenced news reports and blogs it said suggested real-world examples of those kinds of activities on Android systems, where sideloading is permitted.

The report also touted Apple’s app review process – itself controversial among developers – as the primary way to defend users from threats.

Some developers took issue with the report, suggesting it was cherry-picking or misrepresenting examples, while others ridiculed the cartoons suggesting the thief could be seen as Apple siphoning off its large cut of sales.

“Is this fox meant to represent the bad guys or Apple taking 30%?” tweeted developer and blogger Benjamin Mayo.

The BBC is not responsible for the content of external sites.
View original tweet on Twitter
Tim Sweeney, the head of Epic Games and a vocal Apple critic, characterised the report as a “a sea of lies”.

Marco Arment, a well-known developer behind popular apps Overcast and Instapaper, has previously said he is against sideloading on iOS.

But reacting to Apple’s paper, he wrote that “the best thing Apple could do to protect the safety and security of iOS touted so heavily in that sideloading PDF [is] lift the most anticompetitive [in-app purchases] rules”.

“Without them, no government would have enough reason to force larger changes like sideloading or alternative app stores.”

Online Safety Bill ‘catastrophic for free speech’

The draft Online Safety Bill harms free speech and hands policing the internet to Silicon Valley, a new campaign claims.

The “Legal to Say. Legal to Type” campaign says if it becomes law, US tech firms would gain too much power.

The draft bill places new duties on social media firms to remove harmful or illegal content.

The government has said firms should have safeguards to ensure freedom of speech.

These would include effective routes for people who have had their content removed to appeal against any decision.

The new campaign includes Ruth Smeeth, of Index on Censorship, Jim Killock of the Open Rights Group, Gavin Millar QC and MP David Davis.

While the group supports the bill’s aim of ensuring online platforms remove images of child sexual abuse, terrorist material and content which incites racial hatred and violence, it fears other provisions will adversely affect free speech.

The new bill could see legal online posts from ordinary people blocked and would turn Ofcom into a free speech “super regulator”, it claims.

Legal harms
Published in May 2021 the Draft Online Safety Bill imposes a “duty of care” on social media companies, and some other platforms that allow users to share and post material, to remove “harmful content”.

This can include content that is legal but still judged to be harmful, such as abuse that doesn’t reach the threshold of criminality, and posts that encourage self-harm and misinformation.

Under the bill, Ofcom will be given the power to block access to sites and fine companies which do not protect users from harmful content up to £18m, or 10% of annual global turnover, whichever is the greater.

Campaigners claim this gives tech firms an incentive to “over-censor”, and “effectively outsources internet policing from the police, courts and Parliament to Silicon Valley”.

Government lays out plans to protect users online
Porn blocker ‘missing’ from Online Safety Bill prompts concern
Online harms law to let regulator block apps in UK
Campaigners are particularly concerned about content that is legal, but deemed to be harmful.

Mr Davis described the bill as a “censor’s charter”. He added: “Lobby groups will be able to push social networks to take down content they view as not politically correct, even though the content is legal.”

The bill includes some protections for political speech and journalism, but in a report published simultaneously with the launch of the new campaign, Index on Censorship argued they did not go far enough.

“For instance, while news published on the Telegraph’s website would be subject to the journalistic exemptions in the bill, the article disseminated on Facebook would be subject to the algorithmic removal of ‘legal but harmful’ content’,” the report said.

Campaigners are also concerned that technology companies may use artificial intelligence to identify harmful content.

That, they say, may introduce racial biases and will wrongly censor language, “especially when it comes to irony-loving Brits”.

The Department for Digital, Culture, Media and Sport has been approached for comment.

Google investigated over ‘dominance’ in ad market

The European Commission has opened an investigation into whether Google is dominating the online-advertising market at the expense of its rivals.

It will examine Google’s role in collecting data, selling advertising space and acting as an online-advertising intermediary.

The commission is concerned the technology giant is making it hard for other online advertisers to compete.

Google has said it will co-operate with the inquiry.

‘Fair competition’
The fact the company is present “at all levels of the supply chain for online display advertising” is concerning, commission executive vice-president Margrethe Vestager said.

“Online-advertising services are at the heart of how Google and publishers monetise their online services,” she said.

“Google collects data to be used for targeted advertising purposes, it sells advertising space and also acts as an online advertising intermediary.

“A level playing field is of the essence for everyone in the supply chain.

“Fair competition is important – both for advertisers to reach consumers on publishers’ sites and for publishers to sell their space to advertisers.”

The inquiry will look at:

the obligation to use Google’s services and or Google Ads to purchase display ads on YouTube
the obligation to use Google Ad Manager to service online display ads on YouTube
the apparent favouring of Google’s ad exchange, AdX, by its other services
the restrictions placed by Google on the ability of rival advertisers to access data about user identity or behaviour
Google’s plans to prohibit third-party cookies on Chrome
Google’s plans to stop making the advertising identifier available to third parties on Android smart mobile devicesGoogle says its plans will strengthen user control over their own data.

Its Privacy Sandbox alternative to cookies, which track users as they move around the web, on Chrome will provide only anonymised feedback.

But there are concerns it will also favour Google over its rivals.

Increased scrutiny
In the UK, the Competition and Markets Authority (CMA) has won commitments from the search giant any alternatives it develops will avoid this.

Google has also agreed with the CMA to publicly disclose the results of tests of new technologies and limit how it uses and combines individual user’s data for advertising purposes.

Google has been hit with a series of EU fines in the past three years, totalling 8.25bn euros (£7bn).

In March 2019, it was fined £91m for abusing its market dominance by restricting third-party rivals from displaying search ads between 2006 and 2016.

Google and Facebook together account for most of the global internet-ad sales market but the practices of both are now under increased scrutiny from regulators around the world.

German watchdog probes Apple’s market dominance

Apple is under investigation by the German competition watchdog.

The Federal Cartel Office (FCO) said the initial investigation will look at whether the company is of “paramount significance across markets”.

Apple said it looked forward to “having an open dialogue” with the FCO about any of its concerns.

Facebook, Amazon and Google have faced similar probes this year, after a new German competition law enabled early action against large digital firms.

In a statement, Andreas Mundt, President of the FCO, said it would examine whether with iOS Apple had created “a digital ecosystem around its iPhone that extends across several markets”.

He added that a focus of the investigation would be the App Store, “as it enables Apple in many ways to influence the business activities of third parties”.

In June the UK’s Competition and Markets Authority (CMA) confirmed it was investigating Apple and Google over their “effective duopoly” in mobile app stores, operating systems and web browsers.

Further scrutiny
Depending on the outcome of its investigation, the FCO said it would look in more detail at specific practices of Apple, in a possible further proceeding.

The FCO said it had received various complaints alleging anti-competitive practices, which a further probe could consider.

The watchdog noted that App developers had criticised “the mandatory use of Apple’s own in-app purchase system and the 30% commission rate associated with this”.

It had also received a complaint from the advertising and media industry about restrictions on user tracking in iOS 14.5, the watchdog said.

The FCO said it would establish contact, where necessary, with the European Commission, which is currently investigating how App Store policies affect music streaming.

In response to the news, Apple said the “iOS app economy” supported more than 250,000 jobs in Germany.

It added that the App Store had given “German developers of all sizes the same opportunity to share their passion and creativity with users around the world, while creating a secure and trusted place for customers to download the apps they love with the privacy protections they expect.”