Connect with us

Biz & IT

Facebook will shut down its spyware VPN app Onavo

Published

on

Facebook will end its unpaid market research programs and proactively take its Onavo VPN app off the Google Play store in the wake of backlash following TechCrunch’s investigation about Onavo code being used in a Facebook Research app the sucked up data about teens. The Onavo Protect app will eventually shut down, and will immediately cease pulling in data from users for market research though it will continue operating as a Virtual Private Network in the short-term to allow users to find a replacement.

Facebook has also ceased to recruit new users for the Facebook Research app that still runs on Android but was forced off of iOS by Apple after we reported on how it violated Apple’s Enterprise Certificate program for employee-only apps. Existing Facebook Research app studies will continue to run, though.

With the suspicions about tech giants and looming regulation leading to more intense scrutiny of privacy practices, Facebook has decided that giving users a utility like a VPN in exchange for quietly examining their app usage and mobile browsing data isn’t a wise strategy. Instead, it will focus on paid programs where users explicitly understand what privacy they’re giving up for direct financial compensation.

Onavo billed itself as a way to “limit apps from using background data and “use a secure VPN network for your personal info” but also noted it would collect the “Time you spend using apps, mobile and Wi-Fi data you use per app, the websites you visit, and your country, device and network type” A Facebook spokesperson confirmed the change and provided this statement: “Market research helps companies build better products for people. We are shifting our focus to reward-based market research which means we’re going to end the Onavo program.”

Facebok acquired Onavo in 2013 for a reported $200 million to use its VPN app the gather data about what people were doing on their phones. That data revealed WhatsApp was sending over twice as many messages per day as Messenger, BuzzFeed’s Ryan Mac and Charlie Warzel reported, convincing Facebook to pay a steep sum of $19 billion to buy WhatsApp. Facebook went on to frame Onavo as a way for users to reduce their data usage, block dangerous websites, keep their traffic safe from snooping — while Facebook itself was analyzing that traffic. The insights helped it discover new trends in mobile usage, keep an eye on competitors, and figure out what features or apps to copy. Cloning became core to Facebook’s product strategy over the past years, with Instagram’s version of Snapchat Stories growing larger than the original.

But last year, privacy concerns led Apple to push Facebook to remove the Onavo VPN app from the App Store, though it continued running on Google Play. But Facebook quietly repurposed Onavo code for use in its Facebook Research app that TechCrunch found was paying users in the U.S. and India ages 13 to 35 up to $20 in gift cards per month to give it VPN and root network access to spy on all their mobile data.

Facebook ran the program in secret, obscured by intermediary beta testing services like Betabound and Applause. It only informed users it recruited with ads on Instagram, Snapchat and elsewhere that they were joining a Facebook Research program after they’d begun signup and signed non-disclosure agreements. A Facebook spokesperson claimed in a statement that “there was nothing ‘secret’ about this”, yet it had threatened legal action if users publicly discussed the Research program.

But the biggest problem for Facebook ended up being that its Research app abused Apple’s Enterprise Certificate program meant for employee-only apps to distribute the app outside the company. That led Apple to ban the Research app from iOS and invalidate Facebook’s certificate. This shut down Facebook’s internal iOS collaboration tools, pre-launch test versions of its popular apps, and even its lunch menu and shuttle schedule to break for 30 hours, causing chaos at the company’s offices.

To preempt any more scandals around Onavo and the Facebook Research app and avoid Google stepping in to forcibly block the apps, Facebook is now taking Onavo off the Play Store and stopping recruitment of Research testers. That’s a surprising voluntary move that perhaps shows Facebook is finally getting in tune with the public perception of its shady actions. The company has repeatedly misread how users would react to its product launches and privacy invasions, leading to near constant gaffes and an unending news cycle chronicling its blunders.

Without Onavo, Facebook loses a powerful method of market research, and its future initiatives here will come at a higher price. Facebook has run tons of focus groups, surveys, and other user feedback programs over the past decade to learn where it could improve or what innovations it could co-opt. And with more apps recently turning on encryption, Onavo likely started learning less about their usage. But given how cloning plus acquisitions like WhatsApp and Instagram have been vital to Facebook’s success, it’s likely worth paying out more gift cards and more tightly monitoring its research practices. Otherwise Facebook could miss the next big thing that might disrupt it.

Hopefully Facebook will be less clandestine with its future market research programs. It should be upfront about its involvement, make certain that users understand what data they’re giving up, stop researching teens or at the very least verify the consent of their parents, and avoid slurping up sensitive information or data about a user’s unwitting friends. For a company that depends on people to trust it with their content, it has a long way to go win back our confidence.

Source link

Source link

Continue Reading
Click to comment

Leave a Reply

Your email address will not be published. Required fields are marked *

Biz & IT

ChatGPT sets record for fastest-growing user base in history, report says

Published

on

Enlarge / A realistic artist’s depiction of an encounter with ChatGPT Plus.

Benj Edwards / Ars Technica / OpenAI

On Wednesday, Reuters reported that AI bot ChatGPT reached an estimated 100 million active monthly users last month, a mere two months from launch, making it the “fastest-growing consumer application in history,” according to a UBS investment bank research note. In comparison, TikTok took nine months to reach 100 million monthly users, and Instagram about 2.5 years, according to UBS researcher Lloyd Walmsley.

“In 20 years following the Internet space, we cannot recall a faster ramp in a consumer internet app,” Reuters quotes Walmsley as writing in the UBS note.

Reuters says the UBS data comes from analytics firm Similar Web, which states that around 13 million unique visitors used ChatGPT every day in January, doubling the number of users in December.

ChatGPT is a conversational large language model (LLM) that can discuss almost any topic at an almost human level. It reads context and answers questions easily, though sometimes not accurately (improving its accuracy is a work in progress). After launching as a free public beta on November 30, the GPT-3 powered AI bot has inspired awe, wonder, and fear in education, computer security, and finance. It’s shaken up the tech industry, prompting a $10 billion investment from Microsoft and causing Google to see its life flash before its eyes.

Also on Wednesday, OpenAI announced ChatGPT Plus, a $20 per month subscription service that will offer users faster response times, preferential access to ChatGPT during peak times, and priority access to new features. It’s an attempt to keep up with the intense demand for ChatGPT that has often seen the site deny users due to overwhelming activity.

Over the past few decades, researchers have noticed that technology adoption rates are quickening, with inventions such as the telephone, television, and the Internet taking shorter periods of time to reach massive numbers of users. Will generative AI tools be next on that list? With the kind of trajectory shown by ChatGPT, it’s entirely possible.

Continue Reading

Biz & IT

Netflix stirs fears by using AI-assisted background art in short anime film

Published

on

Enlarge / A still image from the short film Dog and Boy,, which uses image synthesis to help generate background artwork.

Netflix

Over the past year, generative AI has kicked off a wave of existential dread over potential machine-fueled job loss not seen since the advent of the industrial revolution. On Tuesday, Netflix reinvigorated that fear when it debuted a short film called Dog and Boy that utilizes AI image synthesis to help generate its background artwork.

Directed by Ryotaro Makihara, the three-minute animated short follows the story of a boy and his robotic dog through cheerful times, although the story soon takes a dramatic turn toward the post-apocalyptic. Along the way, it includes lush backgrounds apparently created as a collaboration between man and machine, credited to “AI (+Human)” in the end credit sequence.

In the announcement tweet, Netflix cited an industry labor shortage as the reason for using the image synthesis technology:

As an experimental effort to help the anime industry, which has a labor shortage, we used image generation technology for the background images of all three-minute video cuts!

Netflix and the production company WIT Studio tapped Japanese AI firm Rinna for assistance with generating the images. They did not announce exactly what type of technology Rinna used to generate the artwork, but the process looks similar to a Stable Diffusion-powered “img2img” process than can take an image and transform it based on a written prompt.

The film is currently available to view for free on YouTube.

Netflix’s official Dog and Boy promotional video.

Almost immediately, Twitter users responded with a torrent of negative replies to Netflix’s tweet announcing the film, such as, “I know a ton of animators looking for work if you guys are struggling to find them (are you looking very hard?).” Several others quoted legendary Studio Ghibli animator Hayao Miyazaki as saying that AI-powered art “is an insult to life itself.”

In a news release, Netflix expressed its hopes that the new technology would assist with future animation productions (translated by Google Translate): “As a studio, Netflix focuses on supporting creators in the creation of works on a daily basis. As the shortage of human resources in the animation industry is seen as an issue, we hope that this initiative will contribute to the realization of a flexible animation production process through appropriate support for creators using the latest technology.”

It also looks like Makihara also wanted to push boundaries in animation by using AI technology as part of the production process. The Netflix release quoted him as saying, “By combining tools and hand-drawn techniques, we can create something unique to humans … I think that the core of the story is ‘drawing a human being.’ I think that it will be possible to secure and return to its roots, which will eventually strengthen the strengths of Japanese animation and expand its possibilities.”

Labor shortage or not, AI assistance may possibly speed up production times and lower production costs, allowing the creation of more animated content than ever before. But will people be happy about it? That remains to be seen.

Continue Reading

Biz & IT

Up to 29,000 unpatched QNAP storage devices are sitting ducks to ransomware

Published

on

As many as 29,000 network storage devices manufactured by Taiwan-based QNAP are vulnerable to hacks that are easy to carry out and give unauthenticated users on the Internet complete control, a security firm has warned.

The vulnerability, which carries a severity rating of 9.8 out of a possible 10, came to light on Monday, when QNAP issued a patch and urged users to install it. Tracked as CVE-2022-27596, the vulnerability makes it possible for remote hackers to perform a SQL injection, a type of attack that targets web applications that use the Structured Query Language. SQL injection vulnerabilities are exploited by entering specially crafted characters or scripts into the search fields, login fields, or URLs of a buggy website. The injections allow for the modifying, stealing, or deleting of data or the gaining of administrative control over the systems running the vulnerable apps.

QNAP’s advisory on Monday said that network-attached storage devices running QTS versions before 5.0.1.2234 and QuTS Hero versions prior to h5.0.1.2248 were vulnerable. The post also provided instructions for updating to the patched versions.

On Tuesday, security firm Censys reported that data collected from network scan searches showed that as many as 29,000 QNAP devices may not have been patched against CVE-2022-27596. Researchers found that of the 30,520 Internet-connected devices showing what version they were running, only 557, or about 2 percent, were patched. In all, Censys said it detected 67,415 QNAP devices. The 29,000 figure was estimated by applying the 2 percent patch rate to the total number of devices.

“Given that the Deadbolt ransomware is geared to target QNAP NAS devices specifically, it’s very likely that if an exploit is made public, the same criminals will use it to spread the same ransomware again,” Censys researchers wrote. “If the exploit is published and weaponized, it could spell trouble to thousands of QNAP users.”

In an email, a Censys representative said that as of Wednesday, researchers found 30,475 QNAP devices that showed their version numbers (45 fewer than on Tuesday), and that of those, 29,923 are running versions that are vulnerable to CVE-2022-27596.

The mention of Deadbolt refers to a series of hack campaigns over the past year that exploited earlier vulnerabilities in QNAP devices to infect them with ransomware that uses that name. One of the most recent campaign waves occurred in September and exploited CVE-2022-27593, a vulnerability in devices that use a proprietary feature known as Photo Station. The vulnerability was classified as an Externally Controlled Reference to a Resource in Another Sphere.

Tuesday’s Censys report said that devices vulnerable to CVE-2022-27596 were most common in the US, followed by Italy and Taiwan.

Censys also provided the following breakdown:

Country Total Hosts Non-Vulnerable Hosts Vulnerable Hosts
United States 3,271 122 3,149
Italy 3,239 39 3,200
Taiwan 1,951 9 1,942
Germany 1,901 20 1,881
Japan 1,748 34 1,714
France 1,527 69 1,458
Hong Kong 1,425 3 1,422
South Korea 1,313 2 1,311
United Kingdom 1,167 10 1,157
Poland 1,001 17 984

In the past, QNAP has also recommended that users follow all of these steps to lower the chances of getting hacked:

  1. Disable the port forwarding function on the router.
  2. Set up myQNAPcloud on the NAS to enable secure remote access and prevent exposure to the Internet.
  3. Update the NAS firmware to the latest version.
  4. Update all applications on the NAS to their latest versions.
  5. Apply strong passwords for all user accounts on the NAS.
  6. Take snapshots and back up regularly to protect your data.

As reported by Bleeping Computer, QNAP devices over the years have been successfully hacked and infected with other ransomware strains, including Muhstik, eCh0raix/QNAPCrypt, QSnatch, Agelocker, Qlocker, DeadBolt, and Checkmate. Users of these devices should take action now.

Continue Reading

Trending