Robinhood Is Making Millions Selling Out Customers to High-Frequency Traders

Robinhood is marketed as a commission-free stock trading product but makes a surprising percentage of their revenue directly from high-frequency trading firms. It appears from recent SEC filings that high-frequency trading firms are paying Robinhood over 10 times as much as they pay to other discount brokerages for the same volume. Robinhood needs to be more transparent about their business model.

A new CSS-based web attack will crash and restart your iPhone

Sabri Haddouche tweeted a proof-of-concept webpage with just 15 lines of code which, if visited, will crash and restart an iPhone or iPad. Those on macOS may also see Safari freeze when opening the link. The code exploits a weakness in iOS’ web rendering engine WebKit, which Apple mandates all apps and browsers use,Haddouche told TechCrunch.

He explained that nesting a ton of elements — such astags — inside a backdrop filter property in CSS, you can use up all of the device’s resources and cause a kernel panic, which shuts down and restarts the operating system to prevent damage. TechCrunch tested the exploit running on the most recent mobile software iOS 11.4.1, and confirm it crashes and restarts the phone. Thomas Reed, director of Mac & Mobile at security firm Malwarebytes confirmed that the most recent iOS 12 beta also froze when tapping the link.

Google’s prototype Chinese search engine reportedly links searches to phone numbers

Google is reportedly building a prototype system that would tie Chinese users’ Google searches to their personal phone numbers, as part of a new search service that would comply with the Chinese government’s censorship requirements. The Intercept writes that the “Dragonfly” Android app, a secret project revealed by a whistleblower last month, could be linked to a user’s phone number — making it simple to track individual users’ searches. This tracking would be in addition to Dragonfly’s blacklisting of terms like “human rights,” “student protest,” and “Nobel Prize,” which might normally pull up news about Chinese activist and Nobel laureate Liu Xiaobo.

Tesla Model 3 Stolen From Mall of America Using Only a Smartphone

A little bit of social engineering can go a long way. With cars becoming more connected than ever, cybersecurity is a hot-button topic that extends past your computer screen and into your car. Using a bit of technology, an alleged car thief was able to get his hands on a Model 3 at the Mall of America and drive away without needing a key.

Almost half of US cellphone calls will be scams by next year, says report

Many of us are already conditioned to ignore phone calls from unknown numbers. A new study seems to validate that M.O. By next year, nearly half of the mobile phone calls we get will be scams, according to a new report from First Orion, a company that provides calls management and protection forT-Mobile,MetroPCs,Virgin Mobileand others.

The percentage of scam calls in US mobile traffic increased from 3.7 percent last year to 29.2 percent this year, and it’s predicted to rise to 44.6 percent in 2019, First Orion said in a press release Wednesday. The most popular method scammers use to try to get people to pick up the phone is called ‘neighborhood spoofing,’ where they disguise their numbers with a local prefix so people presume the calls are safe to pick up, First Onion said. Third-party call blocking apps may help protect consumers from known scam numbers, but they can’t tell if a scammer hijacks someone’s number and uses it for scam calls.

Bitmex Accused of Manipulating Ethereum’s Price

A crypto trading exchange with eye-watering margins of 100x has angered ethereans after Bitmex’s CEO, Arthur Hayes, appeared to tell his customers, under an official Bitmex account, to short eth. Hayes then goes on to use some very colorful and highly professional language in contrast to his public tweet which said: No punting here, but to all the Bitmex customers, which are automatically subscribed to a “newsletter,” he told them eth is “a double digit” colorful coin. In other words, Bitmex hates ethereum and as of today Bitmex is apparently handling $3 billion in trading volumes for the eth/usd perpetual swap.

In a Few Days, Credit Freezes Will Be Fee

Later this month, all of the three major consumer credit bureaus will be required to offer free credit freezes to all Americans and their dependents. Maybe you’ve been holding off freezing your credit file because your home state currently charges a fee for placing or thawing a credit freeze, or because you believe it’s just not worth the hassle. If that accurately describes your views on the matter, this post may well change your mind.

Exploit vendor drops Tor Browser zero-day on Twitter

Zerodium, a company that buys and sells vulnerabilities in popular software, has published details today on Twitter about a zero-day vulnerability in the Tor Browser, a Firefox-based browser used by privacy-conscious users for navigating the web through the anonymity provided by the Tor network. In a tweet, Zerodium said the vulnerability is a full bypass of the ‘Safest’ security level of the NoScript extension that’s included by default with all Tor Browser distributions. NoScript is a browser extension that uses a whitelist approach to let the user decide from what domains the browser can execute JavaScript, Flash, Java, or Silverlight content.

IBM secretly used New York’s CCTV cameras to train its surveillance software

New technology is making surveillance cameras more powerful than ever. Such systems are often developed away from the public eye, as detailed in a new report showing how IBM worked with the NYPD to create software that could search CCTV footage for individuals based on their skin tone. Features like searching for individuals based on age, gender, and skin tone IBM’s software was reportedly developed and tested on surveillance cameras run through the Lower Manhattan Security Initiative (pictured).

Proof-of-Stake is a Rebranded Version of the Old Financial System

Over the last few years, there’s been a lot of projects, both public and private, that are attempting to create a next-generation blockchain or something better than Satoshi’s Bitcoin. A great majority of these projects have condemned proof-of-work (PoW) cryptocurrencies because they think they waste resources, and many of these new blockchains have chosen to use a proof-of-stake (PoS) system. However, PoS has many flaws and introduces a distribution process that advocates an ugly planned economy that’s propagated by ancient thinking and basically the old banking system.

Bitcoin Gold delisted from major cryptocurrency exchange after refusing to pay hack damages

Bittrex, one of the largest cryptocurrency exchange platforms, has delisted Bitcoin Gold (BTG) from its trading platform over the weekend after BTG maintainers declined to pay half of the damages Bittrex suffered during a complex multi-stage cyber-attack earlier this year. According to a statement from the BTG team, Bittrex asked the BTG team to pay 12,372 BTG (~$256,000) as reparations for the attacks. BTG maintainers said they did all that was possible on their end to help trading platforms prevent the attacks, but they did not have the legal power to intervene inside a private company like Bittrex.

Liberal Radicalism: Breaking down Buterin, Hitzig and Weyl’s paper

Vitalik Buterin, Zoë Hitzig and E. Glen Weyl yesterday released their paper Liberal Radicalism: Formal Rules for a Society Neutral among Communities. As prior readers will know, I tend to break down whitepapers I suspect most of the community won’t have the time or inclination to do. This falls squarely in that bracket given it is self admittedly ‘strange’ and weighs in at a healthy 41 pages.

There’s a Problem With Crypto Funding – And Vitalik Just Might Have a Solution

There are free-riders in the cryptocurrency ecosystem. At least, that’s the contention of a new paper, shared with CoinDesk on Monday, written by ethereum founder Vitalik Buterin,Microsoft researcher Glen Weyl and Ph.D. of economics at Harvard, Zoë Hitzig. And free-riders pose a problem.

Described in the paper, free-riders are people or businesses that profitfrom the under-provision of public goods. And, on top of that, ‘the more people [these public goods] benefit the more they will be under-provided.’ It’s an issue that plagues development even outside the cryptocurrency space, but the authors are – at least – initially focused on how the idea creates harmful incentives for the funding of blockchain projects.

Almost $1B in Bitcoin Moved Around in Silk Road Wallet Addresses

Mysterious movements from the original Silk Road wallet suggest that the US government is cashing out on the Bitcoin gradually. The Silk Road market may be dead—we actually checked just to see if it came back somehow—but its wallet appears to be alive. Over a billion dollars in Bitcoin are being moved from several wallets that are all tied to the supposed original Silk Road cold storage wallet.

Ethereum co-founder Vitalik Buterin speaks on ‘collapse of ETH’

Ethereum community got all curious and agitated after Tech Crunch published an article on Ethereum – ‘collapse of ETH is inevitable’. Number of questions and doubts popped up and to answer it all co-founder Vitalik Buterin wrote a post giving an insight about it. Surprisingly, he agrees ‘collapse of ETH is inevitable’, at least for now.

Cryptocurrency entrepreneur Jeremy Rubin wrote the Tech Crunch article stipulating the price of ETH and that it is bound to plummet. Vitalik Buterin agreeing to the piece wrote on Reddit, “In Ethereum as it presently exists, this is absolutely true.” Buterin further added, “[A]nd in fact if Ethereum were not to change, all parts of the author’s argument […] would be correct.”

New EOS Bug Steals Resources Directly From Users

A new EOS bug has been discovered that allows users to use malicious code to steal RAM, which is a scarce resource in EOS blockchain. EOS,the fifth-largest cryptocurrency in terms of capitalization, has made headlines in connection with a new issue. A new EOS bug has been discovered that allows stealing resources directly from a user.

The resource in question is RAM, which is valuable in the EOS blockchain due to its scarcity. EOS is working on solving the issue and has provided a temporary fix in the meantime. The EOS blockchain aims to be a decentralized operating system and to allow the running of decentralized applications and smart contracts.

Debugging an evil Go runtime bug

I’m a big fan of Prometheus and Grafana. As a former SRE at Google I’ve learned to appreciate good monitoring, and this combination has been a winner for me over the past year. I’m using them for monitoring my personal servers (both black-box and white-box monitoring), for the Euskal Encounter external and internal event infra, for work I do professionally for clients, and more.

Remote Code Execution on a Facebook server

I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers. While scanning an IP range that belongs to Facebook (199.201.65.0/24), I found a Sentry service hosted on 199.201.65.36, with the hostname sentryagreements.thefacebook.com.

Sentry is a log collection web application, written in Python with the Django framework. While I was looking at the application, some stacktraces regularly popped on the page, for an unknown reason. The application seemed to be unstable regarding the user password reset feature, which occasionally crashed.

Remote Code Execution on a Facebook server

I regularly search for vulnerabilities on big services that allow it and have a Bug Bounty program. Here is my first paper which covers a vulnerability I discovered on one of Facebook’s servers. While scanning an IP range that belongs to Facebook (199.201.65.0/24), I found a Sentry service hosted on 199.201.65.36, with the hostname sentryagreements.thefacebook.com.

Sentry is a log collection web application, written in Python with the Django framework. While I was looking at the application, some stacktraces regularly popped on the page, for an unknown reason. The application seemed to be unstable regarding the user password reset feature, which occasionally crashed.

Florida Man Arrested in SIM Swap Conspiracy

Police in Florida have arrested a 25-year-old man accused of being part of a multi-state cyber fraud ring that hijacked mobile phone numbers in online attacks that siphoned hundreds of thousands of dollars worth of bitcoin and other cryptocurrencies from victims. The following month, Michigan authorities found the same individual accessing personal consumer data via public Wi-Fi at a local library, and seized 45 SIM cards, a laptop and a Trezor wallet — a hardware device designed to store crytpocurrency account data. In April 2018, the mom again called the cops on her son — identified only as confidential source #1 (“CS1”) in the criminal complaint — saying he’d obtained yet another mobile phone.