Tech Brew Ride Home - Wed. 05/12 – Xiaomi Gets Out Of The Dog House

Episode Date: May 12, 2021

The US lets Xiaomi out of the blacklist. GitHub ads security key support and wants to move on from the password era. eBay wants in on the NFT action. WhatsApp is gonna turn the screws until you agree to their terms. And speaking of, Brian Krebs outlines how that group suspected to be behind the pipeline hack has sophisticated ways of getting you to pay up. Sponsors: NordVPN.com/ride coupon code: ride LinkedIN.com/ride Links: US agrees to drop Xiaomi from blacklist after lawsuit (Bloomberg) Amazon updates the Echo Show 8 and 5 with better cameras (The Verge) GitHub shifts away from passwords with security key support for SSH Git operations (ZDNet) EBay officially opens its platform to NFT sales (The Block) WhatsApp will gradually stop you calling or messaging contacts if you don't agree to its new privacy policy (Insider) E-scooter company Bird will go public via SPAC (Axios) SoftBank joins corporate heavyweights with $37 bln Vision Fund profit (Reuters) A Closer Look at the DarkSide Ransomware Gang (Krebs on Security) Learn more about your ad choices. Visit megaphone.fm/adchoices

On April 4th, 2023, around 2 in the morning, a man was found stabbed multiple times on a sidewalk in downtown San Francisco. Hey, who did this to you? What happened next turned the story into a political firestorm. Reports have identified the victim as Bob Lee, the founder of Cash App. From Bloomberg Podcasts, this is Foundering, the Killing of Bob Lee, beginning April 16. Welcome to the TechMeme right home for Wednesday, May 12th, 2021. I'm Brian McCullough today. The U.S. lets Zhaummi off the blacklist. Gethub adds security key support and wants to move on from the whole password era. eBay wants in on the NFT action. WhatsApp is going to turn the screws until you agree to their terms. And speaking of, Brian Krebs outlines how that group suspected to be behind the pipeline hack has sophisticated ways of getting you to pay up. Here's what you missed today in the world. of tech. The U.S. has agreed to remove Zhaummi from the blacklist that could have restricted American investment in Zhaomi, following Zhaumie's lawsuit earlier this year, quoting Bloomberg.

The Chinese smartphone giant had sued the government earlier this year after the U.S. Defense Department under former President Donald Trump issued an order designating the firm as a communist Chinese military company, which would have led to a delisting from U.S. exchanges and deletion from global benchmark indexes. The U.S. Defense Department has now agreed that a final order vacating the designation, quote, would be appropriate, according to a filing to the U.S. Courts Tuesday. Jaomi, which makes robot vacuum cleaners, electric bikes, and wearable devices alongside smartphones, had been an unexpected target for the Trump administration, co-founded by billionaire

entrepreneur Lee June more than 10 years ago with U.S. chipmaker Qualcomm. as one of the earliest investors, the company has insisted it's not owned or controlled by the Chinese military. A U.S. court in March sided with Zhaomi in the lawsuit and placed a temporary halt on the ban. U.S. District Judge Rudolph Contreras said at the time, Zami was likely to win a full reversal of the ban as the litigation unfolds and issued an initial injunction to prevent the company from suffering, quote, irreparable harm, end quote. Now, this does not mean that suddenly will be. be able to buy top-of-the-line

Xiaomi phones easily here in the U.S., even though Zhaumie just passed Apple for number two market share in Europe, the phones are not designed or designated for the U.S. market. Though, today I learned, it is possible to buy a Jami phone if you're in the U.S. and use it on U.S. networks, though you have to jump through some quite considerable hoops. Also, Zami does have a whole array of laptops and fitness bands and electronic accessories that are more available than I thought.

Just do a quick Amazon search. Speaking of, Amazon has updated the Echo Show 8 and 5 with largely better cameras, the ability to turn on Alexa's security mode, and also added a $95 kids edition of the Echo Show 5, quoting the Verge. The big new feature on both models is the camera, but the upgrade is more impressive on the bigger Echo Show 8. It now has the same 13 megapixel sensor that you'll find on the Echo Show 10. Instead of moving the screen around to point at you as the 10 does, the Echo Show 8 provides a wider

110-degree field of view. Within that range, it does the pan and zoom trick to keep subjects centered in the frame. To power that trick and some other new software features, Amazon says there's a new octacore processor inside the Echo Show 8. Otherwise, it's the same Echo Show 8 that we reviewed in 2019 with dual speakers and a choice of... of either white or charcoal gray. It still sells at the same price, $129.99. The other software tricks include using the camera to detect if a human has walked into the room and then plugging that information into routines, like turning on the lights. Amazon emphasizes this is an opt-in-only feature, and it even requires users to manually punch in a code during setup to ensure that they

really mean to turn it on. It also does its human shape detection locally. Amazon, will let all Echo 8 and 5 devices turn on Alexa's security mode so you can remotely view the cameras from your phone. Finally, the Echo Show 8 is getting new AR effects for Amazon's own video chat service, including reactions like filling the screen with hearts or setting custom virtual backgrounds, end quote. GitHub has added security key support for SSH Git operations, as it continues its plans to remove password support for Git operations altogether later this year, quoting ZDNet. When you add a security key to SSH operations, you can use these devices to protect you

and your account from accidental exposure, account hijacking, or malware. GitHub security engineer Kevin Jones said in a blog post on May 10th, security keys, including the Ubiki, Thetis Fido U2F security key, and Google Titan, security keys are physical, portable dongles that implement an additional layer of security to your online services and accounts. GitHub wants to move away from typical passwords and to more secure authentication standards. At present, users can now use a password personal access token, or PAT, or an SSH key to access Git, but the company intends to remove support for passwords later this year. We recognize that passwords are convenient, but they are a consistent source of

account security challenges, Jones commented. We believe passwords represent the present and past, but not the future. By removing password support for Get, as we already successfully did for our API, we will raise the baseline security hygiene for every user and organization and for the resulting software supply chain, end quote. Don't know why I didn't see this coming, but think about it. It makes a ton of sense. With the fad for collectibles that NFTs have either brought about or it's a wave that they're writing, who, if you think about it, has owned the collectibles market since the beginning of the internet era. Yeah, eBay says it will now allow NFTs to be sold on its platform and will add new capabilities for blockchain-driven collectibles in the coming months,

quoting the block. Users can bid on NFTs as they would for a physical item. All payments will be made in US dollars, unlike other prominent NFT platforms, which usually except ETH for NFT payments. Many of the NFTs currently available for sale on eBay appear to be on the wax blockchain, with sellers stipulating that buyers create a wax wallet in order to receive their NFT. The move to allow NFT sales comes a week after the e-commerce firm's CEO Jamie Iannoni told CNBC that the company was looking at ways to incorporate NFTs on its platform. It also appears to be part of a larger plan. In the coming months, eBay will add new capabilities that bring blockchain-driven collectibles to our platforms, Jordan Sweetnam,

senior vice president and general manager for eBay's North American market, told Reuters, end quote. Remember how WhatsApp announced that new mandatory privacy policy that people didn't like, so much so that they started fleeing to Telegram and other messaging services in significant numbers, even though the changes weren't as severe as everyone was assuming? But what if you're trying to just ride this all out, to stay on WhatsApp, but hopefully not agree to their new terms? Well, WhatsApp has detailed the experience for those of you who don't agree to its new privacy policy, including eventually losing access to calls, messages, and notifications.

Basically, WhatsApp will slowly strangle the service for you until you agree to their new terms, quoting Insider. If users do not agree to the new policy after several weeks, they will begin to lose access to their chat lists, WhatsApp said. Users will only be able to call and message someone if they, are contacted first and click on a notification. After a few more weeks, users won't receive calls or notifications, WhatsApp said, although the timing will vary from user to user. The new privacy policy was originally planned for February, but was delayed by three months after critics claimed

the update would allow the app to share more personal data with Facebook, WhatsApp's parent company. This isn't the case. WhatsApp has said the updated terms only apply to messaging business accounts, enabling businesses to link up with Facebook's platform more easily. Anyone that previously opted out of sharing their data with Facebook will have that decision honored, WhatsApp told Insider in February. Users will receive persistent reminders on the app to accept the new terms. A company blog post said, a company spokesperson confirmed to Insider that WhatsApp would not delete the accounts of users who refused to sign the new policy.

It would also not limit functionality immediately on May 15th. When the new policy comes into force, they said users would lose functionality over the next few weeks, they said, end quote. E-Scooter startup bird has agreed to go public via a SPAC at an implied value of around $2.3 billion, thereby bringing a conclusion to a startup story that was all the rage when this podcast was only a few months old. Remember the big scooter and micromobility land grab and wars of the before times? It's interesting that Byrd at least is getting out the door at basically the valuations that it first made headlines for, which is a good or bad thing depending on how you look at it. Quoting Dan Premack in Axios. This is a lower valuation than what Byrd got in the private markets before the pandemic, but could help set it up to benefit from a rider rebound as cities reopen. Bird is being acquired by Switchback 2, a spec that was originally formed to buy an energy company.

The deal includes a $160 million pipe investment led by existing Bird investor fidelity, plus a $40 million asset financing facility from Apollo investment and mid-cap financial trust. Bird has raised nearly $1 billion in private funding, including a previously undisclosed $208 million infusion just last month, from Brackett Capital, Sequoia Capital, and Valor Equity Partners, end quote. And since we're circling back to old stories today, I thought I'd let you know that softback Bank has reported a Q4 profit for the Vision Fund of $37 billion and net profit of $45.88 billion due to good stock performance of portfolio companies such as Kupang and Uber. So again, think back to, I don't know, 18 months ago, and Marvel at how Masassan has just sort of weighted things out successfully,

quoting Reuters. It's clearly validation of Masa's thesis. Navneet Govill Vision Fund's chief financial officer told Reuters in an interview. Market enthusiasm for tech stocks drove the public listing of SoftBank-backed e-commerce firm Kupang and Usecar trading platform Auto One Group and the rising share price of ride-hailing firm Uber during the quarter. To sustain SoftBank's position among the global corporate elite, Son will have to replicate that performance with other yet-to-list companies in the Vision Fund portfolio. Son has likened that to laying golden eggs. Candidates including ride-hailing firm, D-Dick-Tock owner Bite Dance,

and Truck Service Platform Full Truck Alliance have strong revenue growth, healthy market share, and a clear path to profitability, according to Goville. This is not a result to make us puffed up with pride. I don't want it to be a one-time thing, founder and CEO Masayoshi Son, told a news conference, end quote. Finally today, another long read that I don't want to hold for Friday. The great Brian Krebs has penned a deep dive on the Darkside ransomware gang, which is being connected to that colonial pipeline hack that is causing gas runs here in the U.S. Krebs outlines how he says that Darkside pressures victims into paying

via phone calls by affiliates, DDoS attacks, and threats of tipping off short sellers unless the targets pay up. Read the whole thing for sure if you're interested in the story, but enjoy these snippets as well. Quote, first surfacing on Russian language hacking forums in August of 2020, Darkside is a ransomware as a service platform that vetted cybercriminals can use to infect companies with ransomware and carry out negotiations and payments with victims. Darkside says it targets only big companies and forbids affiliates from dropping ransomware on organizations in several industries including healthcare, funeral services, education, public sector, and nonprofits. Like other ransomware platforms, Darkside adheres to the current bad guy best practice of double extortion, which involves demanding separate sums

for both a digital key needed to unlock any files and servers, and a separate ransom in exchange for a promise to destroy any data stolen from the victim. At its launch, Darkside sought to Wu affiliates from competing ransomware programs by advertising a victim data leak site that gets, quote, stable visits and media coverage, as well as the ability to publish victim data by stages. Under the Why Choose Us heading of the ransomware program thread, the admin in answers, quote, high trust level of our targets. They pay us and know that they're going to receive decryption tools. They also know that we download data, a lot of data. That's why the percent of our victims who pay the ransom is so high, and it takes so little time to negotiate,

end quote. In late March, Darkside introduced a call service innovation that was integrated into the affiliates management panel, which enabled the affiliates to arrange calls pressuring victims into paying ransoms directly from the management panel. In mid-eathing, April, the ransomware program announced new capabilities for affiliates to launch distributed denial of service attacks against targets whenever added pressure is needed during ransom negotiations. Darkside also has advertised a willingness to sell information about upcoming victims before their stolen information is published on the Darkside Victim Shaming blog so that enterprising investment scammers can short the company's stock in advance of the news. Now our team and partners

encrypt many companies that are trading on NASDAQ and other states. stock exchanges, Darkside explains. If the company refuses to pay, we are ready to provide information before the publication so that it would be possible to earn in the reduction price of shares. Write to us and contact us and we will provide you with detailed information, end quote. Darkside has shown itself to be fairly ruthless with victim companies that have deep pockets, but they can be reasoned with. Cybersecurity intelligence firm Intel 471 observed a negotiation between the Darkside crew and a $15 billion U.S. victim company that was hit with a $30 million ransom demand in January 2021. And in this incident,

the victim's efforts at negotiating a lower payment ultimately reduced the ransom demand by almost two-thirds, end quote. So among many things here that I find fascinating is that this is not just ransomware as a service, but that they allegedly are also offering a full like software platform, like a whole suite of products, like an actual dashboard and everything, all aims. at professional extortion schemes. It's the professionalization and regimentation of this that I find to be fascinating and terrifying, to be clear. And there's one more interesting nugget here, quoting Nicole Pearl Roth. The assumption is that Darkside is not nation state affiliated, but like oh so many ransomware groups, it uses tools like get user default lang ID to perform language

checks. If the victim uses any languages below, Darkside moves on, end quote. The languages that she quoted include Uzbek, Romanian, Russian, etc., quoting Brian Krebs. Pro tip for the, but how do we protect ourselves, folks? Darkside ransomware, like many other strains, will not install on systems where certain Cyrillic keyboard and other scripts are already installed. So, install the Russian keyboard. You don't have to use it, end quote. And quoting Alex Stamos. People discussing the relationship between ransomware teams and the Russian government should probably keep Jason Healy's spectrum of national responsibility in mind. Right now, it looks like the dark side group that attacked Colonial is at least state encouraged, end quote. High of mind, can you help me out, as you always do?

We are thinking of pursuing a project that is deeper in the clubhouse slash Twitter spaces sort of space. but I need to identify some folks to reach out to about joining this project. So you know how Chris and I have been regularly doing a clubhouse room or a Twitter space for the last few months? We do one about once a week or so. Can you think of any other folks who have been regularly doing events like we have? Yes, Pachy McCormick and Austin Reef. I'm already talking to them. Anyone else you can think of folks that have been hosting regular live audio events could be.

tech-related, but could be anything. Could be regular rooms talking about the latest real housewives gossip. Literally any name you can think of. Who's doing these regular rooms and spaces? Just shoot those names at me, no matter how big or small or outside our usual topic circles, hit me up on Twitter with your ideas at Brian MCC or email podcast at techmeme.com. Thanks in advance. Talk to you tomorrow.