Cops Bust Botnet of 1.3 Million Android TV Boxes | | A coalition of security firms working with Japan's National Police Agency has disrupted a botnet of more than 1.3 million Android devices across 200+ countries. "We assess with high confidence that the backdoor and botnet were intentionally developed, deployed, and operated for financial gain by Videostrong Technology," the Google Threat Intelligence Group (GTIG) said in a blog post. The Register reports: Videostrong Technology is a hardware manufacturer based in Shenzhen, China. It builds Android devices, including home TV boxes and projectors. According to Google, Videostrong deliberately embedded the XCPE backdoor in device firmware and sold access to criminal affiliates, allowing them to install additional malware modules on devices shipped to unsuspecting customers. When buyers connected these devices to their home networks, the preinstalled backdoor allowed operators to create proxy networks and hide malicious traffic using the customers' internet connections without their knowledge.
The firmware's pre-installed management agent purported to be a standard remote-management client, according to TrendAI. It pulled updates from a GitHub page, and connected to a Message Queuing Telemetry Transport (MQTT) server that gave the operator full remote control of each box, allowing them to install and remove apps, change settings, and push updates to the infected devices. Between June 3 and October 1, TrendAI documented more than 3.8 million distinct home and mobile IP addresses connected to the operation.
The coalition also disrupted the command-and-control domains used to manage the affiliate modules. "Because these affiliates each have diversified distribution channels for their modules beyond XCPE, we assess that taking down their C2 domains will sever access to at least 10 million additional compromised devices," according to GTIG. Google said it had since cut ties with Videostrong, and banned the OEM from making devices with preloaded Google apps. Read more of this story at Slashdot. |
China Publicly Discloses Plan For a Lunar Landing Within Three Years | | At the Seventh Manned Spaceflight Conference in Beijing, Chinese space officials publicly outlined the most detailed roadmap yet for landing astronauts on the Moon "before 2030." Ars Technica reports: China's lunar landings will involve a lunar-orbit rendezvous similar to what NASA did in the 1960s and early 1970s with the Apollo program. However, lacking a rocket as powerful as the Saturn V vehicle, the crew and lunar lander will launch separately to the Moon. According to slides shared on social media, the current plan involves:
- An uncrewed test of the Long March 10A rocket (a single-stick variant, with no boosters) and the Mengzhou spacecraft to low-Earth orbit. Target: early 2027
- An uncrewed test of the larger Long March 10 rocket (a core stage with two boosters) and the Lanyue lunar lander, including descent/ascent from Moon's surface. Target: 2028
- A concurrent launch of two Long March 10 rockets, one carrying uncrewed Mengzhou and the other the Lanyue vehicle; they will dock in lunar orbit. Target: 2029
- Dual launch of Long March 10 rockets, this time with crew on the Mengzhou spacecraft, leading to crewed landing mission. Target: "Before 2030"
The public release of this new information provides a timeline for gauging China's technical progress in its efforts to land humans on the Moon before 2030 and beat NASA and the United States back to the lunar surface. Notably, the plan (for now, at least) omits a mission similar to Apollo 8 or Artemis II, which involved a crew flying out to the Moon and either entering orbit or passing close by before returning to Earth. The Mengzhou vehicle should still get a workout closer to Earth with humans on board as part of missions carrying astronauts to Tiangong, China's space station in low-Earth orbit. Read more of this story at Slashdot. |
BYD Sold More EVs Last Month Than the US Did All Quarter | | An anonymous reader quotes a report from Electrek: The world's leading EV maker is showing no signs of slowing down. BYD sold 490,168 new energy vehicles (NEVs) in October, up 11% from the prior year and the company's highest monthly total in 2026. BYD's battery electric vehicles drove the growth, with a record 305,743 units sold, up 37% year over year and marking the first time its EV sales have crossed the 300,000 mark. To put that into perspective, just over 262,500 EVs were sold in the US in the entire third quarter combined, according to Kelley Blue Book estimates. By the end of the year, BYD expects overseas shipments to reach about 2 million vehicles. "In 2027, that number is expected to rise to more than 2.5 million vehicles," adds Electrek. Read more of this story at Slashdot. |
Snap Reaches Settlement In Social Media Addiction Lawsuit Ahead of Trial | | Snap has settled a lawsuit brought by two teenagers who alleged Snapchat was deliberately designed to be addictive and contributed to their mental health problems, avoiding a trial that was scheduled to begin this week. Snap was the last defendant to settle after Meta, Alphabet and TikTok resolved claims in the same case. CBS News reports: The teenage plaintiffs, identified in court documents as S.J. and K.D.B., had alleged in the suit that Snapchat was designed to be addictive and that using the platform from a young age contributed to their mental health issues. "We are glad to reach resolution for our clients," Mark Lanier, founder of The Lanier Law Firm and lead counsel for the plaintiffs, said in a statement to CBS News. "We believe this jury would have found the companies' conduct reprehensible."
Snap was the last social media company named in the lawsuit to settle the case, which was set for opening arguments this week. Meta resolved claims last week, while Alphabet and TikTok, the other defendants, each also resolved the allegations. Terms of the Snap settlement were undisclosed [...].
Earlier this year, a jury found Meta and Google-owned YouTube liable in a landmark social media addiction lawsuit, awarding $6 million in damages to a young woman who alleged the platforms' addictive features harmed her mental health. In August, Meta also agreed to pay up to $18 billion in settlements and introduce new child-safety measures to resolve claims from dozens of U.S. states that it deliberately designed Facebook and Instagram to addict children while misleading the public about their risks. Read more of this story at Slashdot. |
Study Claims Vizio Simply Ignores 'Smart' TV Spying Opt Out Requests | | An anonymous reader quotes a report from Techdirt: Recently, reports emerged that LG TVs are sniffing around your local network, and even listening to your local environment, even when the TV is purportedly "off." Some of those voice commands were then stored in plain text and uploaded to the internet. LG's response? To deny everything. [...] That latter point is central to a new study out of Northeastern that conducted 5,943 experiments across twelve commercial "smart" TV devices. The researchers found that most smart TVs utilize automatic content recognition (ACR), a technology that captures audio or video snapshots of viewed content and then monetizes that data to help build personalized profiles of viewers.
TV makers insist that users are supposed to be able to opt out, but the choice simply doesn't work across a large segment of TVs. Companies like Vizio simply ignored the consumer requests entirely more often than not: "We find that the advertised ACR opt-out fully suppresses ACR-attributable traffic on only four operating systems; on Samsung Tizen traffic consistent with ACR activity persists in more
than 60% of evaluated scenarios, and on Vizio SmartCast a content correlated endpoint hosted on Amazon Kinesis continues to receive traffic in 100% of opted-out scenarios."
[...] The researchers say since they can't see the precise scope of what's being collected due to encryption, they're unsure whether Vizio is technically violating its FTC agreement (not that we have a current FTC that would care if they were): "The opt-out setting has no observable effect on traffic sent to this endpoint; however, we cannot inspect the payload due to encryption so we cannot confirm whether this violates the FTC settlement." Results of whether opting out of ACR tracking actually stopped ACR tracking were all over the map. Roku, for example, ignores opt-out requests when users are watching Roku's own channels. None of the smart TV vendors track Netflix viewing for fear of violating agreements with the streaming giant. Samsung's opt out function was more likely to actually work when a user was watching antenna broadcasts.
On two Smart TV platforms, personal viewing data collected by ACR remains unencrypted, despite years of bad press and scandal on the subject. Many appear to be violating the law, but because U.S. regulatory oversight has been gutted, they see no meaningful accountability. That includes smart TV OS' like VIDAA, which is most prominently found on Hisense and Toshiba smart TVs: "VIDAA OS sends ACR data to servers run by Unruly over MQTT without encryption, so anyone on the network path between the TV and those servers can read it. Each message carries a Client ID, a permanent identifier for the TV that can't be reset, along with the time zone, the app name, the input (antenna, HDMI), the antenna channel and an audio fingerprint." Read more of this story at Slashdot. |
Apple HomeView Ultra, Drone and Laundry-Folding Robot Reportedly In Development | | According to The Information, Apple is developing a $1,000 HomeView Ultra smart home hub with a 9-inch touchscreen mounted on a motorized arm that can follow users around a room and autonomously respond to its surroundings. It's also said to be experimenting with more ambitious home robots, including a wheeled robot that follows people, a smart home drone and a machine capable of folding laundry. Notebookcheck reports: According to the report, HomeView Ultra will feature a larger 9-inch touchscreen mounted on a robotic arm. This arm can automatically turn the screen toward the user. With a camera and several sensors, this smart home hub is said to be "fully aware" of its surroundings and capable of acting autonomously. This autonomy ranges from turning on the lights when someone enters the room to shooing a cat away when it jumps onto a table. These sensors are also intended to prevent the arm from hitting nearby objects with the display.
Apple is reportedly currently planning to announce this smart home hub in 2027 for around $1,000, but according to The Information, its launch could be delayed until 2028. The reason is allegedly the software, which has not yet been finalized, while the hardware is said to be ready for market already. Read more of this story at Slashdot. |
SpaceX Is Reportedly Looking At Buying Boost Mobile | | SpaceX has reportedly held talks with EchoStar about acquiring Boost Mobile or gaining access to its network, potentially giving Starlink a shortcut toward becoming a full-fledged U.S. mobile carrier. Engadget reports: According to Washington Post's sources, the deal could look like SpaceX acquiring Boost Mobile outright or gaining access to its cell network, which is leased from AT&T and T-Mobile. There could be a major hitch with the deal though, since SpaceX's potential mobile service would need the green light from those major mobile carriers, according to the report. The Washington Post also reported that major cell companies, which include AT&T, T-Mobile and Verizon, have already turned down Musk down for access to its cell networks in order to launch a separate SpaceX service. Last month, SpaceX reportedly held talks with Crown Castle to access at least 80,000 cellular tower sites across the U.S. as it prepares to launch Starlink Mobile. "We will be building out our terrestrial networks so there's broad-based connectivity anywhere that SpaceX and Starlink are allowed to operate," Musk said during SpaceX's earnings call this week. Satellite launches plus spectrum acquisition "will pave the way for Starlink Mobile to become a major mobile carrier in the US," he said. Read more of this story at Slashdot. |
OpenAI Might Rebrand Its Data Centers As 'AI Compute Campuses' | | An anonymous reader quotes a report from TechCrunch: Data centers are deeply unpopular. But what if we called them something else? Axios reports that OpenAI is preparing a "PR blitz" for after the midterm elections on Tuesday, as Democrats seem likely to win back the House of Representatives, and possibly the Senate, too. The company's chief global affairs officer Chris Lehane told Axios that the midterms will be "a bit of a movie trailer for what you're going to see in 2028," when he expects AI to be "the issue" in the presidential election.
So OpenAI is to influence the AI debate moving forward, with Lehane discussing several proposals, including the development of AI "speed limits"; finding ways to help people see AI as empowering them in their daily lives; pushing the U.S. to take a role in developing global standards; and yes -- rebranding data centers as "AI compute campuses." Lehane also described the conversation around data centers (a debate that has pushed Amazon and Microsoft to say they will no longer use NDAs in their negotiations with local governments) as "good and healthy." "Communities should hold companies responsible and accountable so they really and truly get a transformative benefit from these projects," he said. Read more of this story at Slashdot. |
The New York Times Sues Brave Web Browser For AI Scraping, Bypassing Paywalls | | The New York Times and several other publishers have sued (PDF) Brave Software, accusing the browser maker of scraping their websites without permission and helping users bypass paywalls. The Verge reports: According to a complaint (PDF) filed by the companies that run New York Daily News, the Chicago Tribune, and the Orlando Sentinel, Brave Software has monetized its index of scraped websites by, in part, providing AI companies with paid access to "real-time online content from the Brave Index." The AI companies then use that index to train their models, access content to "respond to specific user queries," or both. Brave has allegedly provided "stolen copyrighted content" to "many" AI companies including Anthropic, Perplexity, Mistral, xAI, and Cohere. Brave also promotes "hundreds of top publishers" as being accessible through its "Paywall blocker" feature in its browser.
"Brave has never asked for the Publishers' permission to access their websites, much less to copy the material and provide it to users or other AI companies," the complaint says. "On the contrary, as noted above, Brave allows its users to bypass the Publishers' paywalls without their consent, and has taken other steps that prevent the Publishers from blocking Brave's access to the Publishers' websites. Brave has never compensated the Publishers for the unlawful use, copying, and distribution of the Publishers' copyrighted content." "While we believe in the ethical and responsible use and development of AI, Brave has flouted established copyright law and ignored repeated requests by The Times to stop its infringing conduct," Graham James, an NYT spokesperson, says in a statement. "We filed this lawsuit to hold Brave accountable for stealing our content to power its own products and to provide it to some of the most prominent and well resourced generative AI companies in the world." Read more of this story at Slashdot. |
Microsoft's Canada Timezone Troubles Leave Admins Fixing Calendars, Pretending They're In Bogota | | Microsoft is scrambling to fix time-zone problems across Outlook, Power Automate, Fabric, SharePoint and other products after parts of Canada stopped observing seasonal clock changes on November 1. "The company has confirmed problems across a chunk of its software estate, leaving some customers facing incorrect times, broken schedules and a collection of workarounds while Redmond catches up," reports The Register. From the report: Outlook users have been left with the most homework. Switching to the new Canadian time zones won't automatically update existing calendar entries, meaning that meetings scheduled after November 1 are potentially an hour out of whack. Microsoft advises users to change their Outlook calendar time zone, then update upcoming events and meetings to use it. For meetings involving other people, only the organizer can make the change.
Recurring meetings come with an additional treat: changing the time zone resets any previously moved occurrences, which then have to be recreated. Anyone with a calendar full of recurring meetings may wish to put the kettle on first. Microsoft is working on an Exchange Online PowerShell cmdlet to remediate non-recurring meetings, but according to its guidance, that's not due until later this week. A fix for recurring meetings remains "in development," with an ETA yet to be confirmed.
Things get stranger with Power Automate and Fabric, where Microsoft's temporary fix involves pretending you're somewhere else entirely. Depending on the product and province, that could mean Saskatchewan, Arizona or, for Manitobans, Bogota. Because apparently time zones weren't confusing enough already. SharePoint On-Prem customers, meanwhile, have to wait until November 10 for the correct time zones to arrive, while Power Pages users could see server-formatted dates appear an hour out until a service fix lands. Microsoft's current milestone for that is December 12. Read more of this story at Slashdot. |
Marvell to Buy Lumentum In $115 Billion Bet On AI Connectivity | | Marvell has agreed to acquire optical components maker Lumentum in an all-stock deal with an implied enterprise value of $115 billion. "AI infrastructure is undergoing a fundamental architectural shift toward optical connectivity, creating an opportunity that comes along once in a generation," said Marvell Chairman and CEO Matt Murphy. "The companies that move first and help define this transition will set the standard for decades to come." CNBC reports: Through the acquisition, Marvell said it can combine electrical and optical technologies to meet accelerating and shifting AI connectivity demands across regions and systems. Companies are increasingly relying on optical connections to piece together chips used to run and train large language models. Lumentum shareholders will receive 4.5 Marvell shares for each Lumentum share under the agreement. The deal is expected to close during the first half of 2028. Marvell's takeover marks one of the most significant bets on AI in 2026 and comes despite recent concerns over the long-term sustainability of infrastructure spending. Read more of this story at Slashdot. |
Supermarket Freezers Across Europe Hit By Second Suspected Cyberattack | | An anonymous reader quotes a report from The Guardian: Supermarket chains in Sweden, Belgium and Luxembourg have said the temperatures of their refrigerators and freezers in dozens of stores rose overnight, prompting fears of a cyber-attack similar to one that caused millions of euros of food losses in France. Sweden's Coop chain told the daily Aftonbladet on Monday that six of its stores had been affected, while ICA said it was "aware that a limited number of stores were affected by an incident overnight which impacted their refrigeration and freezer systems".
The Dutch retailer Ahold Delhaize, which last month reported a cybersecurity incident to police in the Netherlands, said an "IT incident" had hit fridges and freezers in dozens of its supermarkets in Belgium and Luxembourg. A company spokesperson, Sarah De Meester, said the supermarket chain had established that temperatures in the cooling systems had increased, adding that the incident was being investigated. Belgium's Le Soir newspaper reported that dozens of stores and supermarkets were affected, including five Spar outlets, multiple Shop & Go convenience stores attached to Q8 service stations, and a number of smaller Proxy Delhaize minimarkets. "We started mobilizing technicians at 1am," Stephan Moelans, the chief executive of Sabcobel, which specialises in refrigeration system installations, told the paper. "We spent all night and morning disconnecting the affected installations from the grid." Read more of this story at Slashdot. |
Itch Is Being Flooded By AI-Generated Garbage | | The number of game pages being created per-day on Itch has doubled, the indie games site announced Saturday on Bluesky. When asked why, they responded: "take a guess."
As the gaming news site Aftermath puts it, "the surge has been almost entirely down to AI-created garbage racing onto the platform as the popularity of vibe-coded theft, copycats and machine-built slop explodes."
Back in 2024, when the spectre of AI-'created' video games was still in its infancy, indie platform itch.io decided that the best it could do to combat this growing threat was, like Valve has done with Steam, institute a voluntary 'AI' filter when adding new projects to the site. By November 2026, as itch buckles under the weight of new AI-generated 'games' pouring onto the site, that filter is proving about as robust as a wet paper bag.... Shopfronts are being deluged by this shit, and it's making it a terrible user experience for customers.
And while in Valve's case there's a compelling case for stronger human moderation of the store, I'm not sure that's a viable option for a relatively tiny, community-run platform like itch... [A]t time of writing I visited the latest releases section and there was still a huge number of clearly AI-generated titles (or titles making extensive use of AI in their visual assets) which made no use of itch's voluntary tag system.
The issue here isn't that these games are making money--itch themselves say in a reply that while the number of projects listed has doubled, "the number of downloads and purchases has not"--it's that an inability to combat this surge makes the site worse for every single person using it. It gets harder to find real games, for example, and it also makes the shopfront look like a clearance rack.
Read more of this story at Slashdot. |
Bad Flock Info Leads Police To Tow Wrong Car, Then Towing Company Totals It | | "Police continue to blindly trust Flock cameras above and beyond the evidence in front of their own eyes," reports Jalopnik.com.
"After incorrectly connecting Rosalyn Crump's car to a shooting that had occurred the previous day, police had her car towed and impounded as evidence, reports Moneywise..."
According to WWBT 12 On Your Side, Richmond, Virginia, police didn't have a license plate number for the suspect's car, making it impossible to search Flock's records for that plate. Flock cameras collect more than just license plate information, so police searched for a make, model, color, and approximate model year. Based on this extremely vague description, police zeroed in on Crump's 2012 Hyundai Elantra. Around 2 a.m. they started looking through the windows with flashlights to see what was in plain sight, which isn't technically a "search" — at least, not one that would require a warrant... [Crump was asleep, but left her home to speak to the police officers to tell them they had the wrong car. But they didn't believe her.]
Other body cam footage shows an officer expressing doubt that Crump's car is the right one, since child seats and other items inside seem inconsistent with a shooting. Another officer replies, "Don't be surprised if they would have set that up like that." Instead of believing the evidence, or Crump, or interviewing witnesses who could have corroborated her story, police called Seibert's Towing to impound the car...
[Later] Police identified a similar-looking car that seemed to be actually connected to the shooting, and released Crump's Elantra. Nobody actually told Crump this until four days later. Seibert's told Moneywise that police didn't actually release the car until then. Either way, they didn't tell her that Seibert's had ripped the front bumper off during the towing process — leaving the car undrivable — until she arrived to pick it up. Seibert's took responsibility for causing the cosmetic damage, and was willing to cover the $2,212.30 bill to paint and replace the bumper cover, fog lights, and wheel liners. Then Crump asked for a full mechanical inspection, which revealed damaged tie rods and ball joints, jacking the bill beyond $6,000. Seibert's says it didn't cause this damage. Regardless of how it occurred, Seibert's insurer and Crump agree that her Hyundai is now a total loss due to the cost of the repairs it needs. It had been drivable, if mechanically worn, before police ordered it towed, damaging it for nothing more than a case of mistaken identity.
The president of Seibert's towing told Moneywise that while they'd originally offered $2,200 to repair the bumper damage, Crump must now negotiate with their insurance company. Crump has now resorted to a GoFundMe campaign to attempt to raise $17,100 for rental car expenses, a new car, and the expenses of moving to a different neighborhood. 130 donors have already contributed $7,431.
Reached for comment, the Richmond Police Department told local newscasters they "understand that Ms. Crump did not ask to become part of this investigation," and that they recognize the "frustration of having a vehicle towed and subsequently damaged." But they also said they were following a "credible" lead, which is their responsibility. The department "appreciates Ms. Crump's cooperation" (and "sincerely hopes the remaining concerns about her vehicle can be resolved.")
The city of Richmond has "already started backing away from Flock before Crump's story aired," reports Moneywise. "Mayor Danny Avula has decided not to renew Richmond's license plate reader deal with Flock, which ends June 30, 2027. As of September, the city had 99 Flock readers on its streets."
They note that the Institute for Justice, a public interest law firm in Arlington, Virginia, "has tallied at least 27 cases since 2018" of similar police errors. "In each case, a license plate reader mistake led police to stop, jail or point guns at drivers who'd done nothing wrong. More than half came in 2023 or later." Read more of this story at Slashdot. |
Rocky Linux Creator Built a New 'Not Linux' Kernel in 11 Days Using AI | | From the blog It's FOSS
Gregory Kurtzer is no stranger to the Linux world. He created CentOS, and when Red Hat messed it up, he started Rocky Linux as the community replacement. He also co-founded CIQ, the company offering enterprise support around Rocky. His latest project has nothing to do with rebuilding another Linux distro, though. He has built an entirely new operating system kernel, and he didn't write most of the code himself. An AI agent did.
Meet Ginux, Linux userspace without Linux underneath... It's an independent, Rust-first x86-64 kernel. Which simply means it is NOT a fork of the Linux kernel. It has its own memory management, scheduler, process model, filesystems, networking, and device support, all written from scratch.
The most interesting part is that even though it is not Linux, it is Linux-compatible. Ginux implements the Linux ABI (the binary interface compiled programs use to talk to the kernel), so existing Linux binaries can run on it unmodified. In the project's own terms, Linux is a "personality" that Ginux exposes, not the kernel running underneath...
Right now, Ginux runs only in a QEMU virtual machine, with no physical hardware profile, no GPU or NVMe support, and no independent security audit. Read more of this story at Slashdot. |
|
|
