Facebook believes they can use machine learning to speed up magnetic resonance imaging (MRI) scans. Computer scientists from the social networking site are working with New York University's medical school on the project. CNNMoney reports: NYU is providing an anonymous dataset of 10,000 MRI exams, a trove that will include as many as three million images of knees, brains and livers. Researchers will use the data to train an algorithm, using a method called deep learning, to recognize the arrangement of bones, muscles, ligaments, and other things that make up the human body. Building this knowledge into the software that powers an MRI machine will allow the AI to create a portion of the image, saving time. Making the tests faster would allow radiologists to perform a wider variety of tests.

News outlet CNET has two big stories on Microsoft today. The publication interviewed CEO Satya Nadella on the changes he has made since taking the top job. The stories, among other things, talks about Microsoft Hackathon, the diversity pushes Nadella has made at the company, and how Microsoft lost the touch with what made it successful, and how Nadella is trying to fix that. From story one: Nadella dreamed up the Microsoft Hackathon, which the company calls the "largest private hackathon in the world," when he became CEO in February 2014. Just a few of the thousands of projects pitched over the past five years have inspired mainstream products. Most of these let's-change-the-world ideas aren't the kind of business tech that Microsoft makes the bulk of its money on -- at least not today.

That's just fine with Nadella, because the meetup serves another purpose: rebranding Microsoft as a modern, relevant company. When he became the third CEO of the world's largest software company, after Bill Gates and Steve Ballmer, Nadella made changing Microsoft's rigid, hierarchical and arrogant culture his top priority. He sort of had to. Though arguably one of the most successful technology companies in history, Microsoft's had a string of high-profile misses in mobile, search and social networking. Additionally, the company's toxic culture, characterized by corporate politics, infighting and backstabbing, fed an image of Microsoft as a fading legend.

Rivals Apple, Google and Facebook were seen as innovators creating shiny new opportunities with their disruptive tech. A generation grew up without ever having used a Microsoft product. "One of the things that happens when you're super successful is you sort of sometimes lose touch with what made you successful in the first place," Nadella tells us when we ask what he was trying to solve with the hackathon."I wanted to go back to the very genesis of this company: What is that sense of purpose and drive that made us successful? What was the culture that may have been there in the very beginning or in the times when we were able to achieve that success? How do we really capture it?" says Nadella, who joined Microsoft in 1992. It's about "the renaissance as much as about just sort of fixing something that's broken." From story two: CNET: What is the vibe or image of Microsoft you want the world to know?
Nadella: It's in our mission. It's empowering. Any association with this company should be, they put some tools, they put some platforms, they gave me the opportunity to really do something. Whether it's a student writing a term paper, whether it's a startup trying to create a company, a small business that's trying to be more productive or even a public sector institution that's trying to be more efficient and serve its citizens -- [they] should feel that association with Microsoft is empowering to them. That's what I want us to stand for.

An anonymous reader quotes the BBC: Ordinary wi-fi could be used to detect weapons and explosives in public places, according to a study led by the Rutgers University in New Jersey. Wireless signals can penetrate bags to measure the dimensions of metal objects or estimate the volume of liquids, researchers claim. Initial tests appeared to show that the system was at least 95% accurate.

It could provide a low-cost alternative to airport-style security, researchers said. The system works by analysing what happens when wireless signals penetrate and bounce off objects and materials.

The systems and database administrator for a Fortune 500 company notes that while NFS is "decades old and predating Linux...the most obvious feature missing from NFSv4 is native, standalone encryption." emil (Slashdot reader #695) summarizes this article from Linux Journal: NFS is the most popular remote file system in the Linux, UNIX, and greater POSIX community. The NFS protocol pushes file traffic over cleartext connections in the default configuration, which is poison to sensitive information.

TLS can wrap this traffic, finally bringing wire security to files vulnerable to compromise in transit. Before using a cloud provider's toolset, review NFS usage and encrypt where necessary.
The article's author complains that Google Cloud "makes no mention of data security in its documented procedures," though "the performance penalty for tunneling NFS over stunnel is surprisingly small...."

"While the crusade against telnet may have been largely won, Linux and the greater UNIX community still have areas of willful blindness. NFS should have been secured long ago, and it is objectionable that a workaround with stunnel is even necessary."

fstack writes: Linus Torvalds has released Linux 4.18 as the newest kernel bringing a Steam Controller kernel driver, Spectre updates for ARM64, power management updates, a "Restartable Services" system call, AMD Radeon graphics driver improvements, V3D DRM as Broadcom's new graphics driver, DM writecache support, USB 3.2 support, and many other updates. Linus Torvalds wrote of the 4.18 final release: "It was a very calm week, and arguably I could just have released on schedule last week, but we did have some minor updates. Mostly networking, but some vfs race fixes (mentioned in the rc8 announcement as 'pending') and a couple of driver fixes (scsi, networking, i2c). Some other minor random things (arm crypto fix, parisc memory ordering fix)." In a separate article, Phoronix details all the changes and new features available in this release.

Booby-trapped image data sent by fax can let malicious hackers sneak into corporate networks, security researchers have found. From a report: Since many companies use fax machines that are also printers and photocopiers, they often have a connection to the internal network. The malicious images exploit protocols established in the 1980s that define the format of fax messages. The research was presented at the Def Con hacker conference in Las Vegas. The two researchers said millions of companies could be at risk because they currently did little to secure fax lines. "Fax has no security measures built in -- absolutely nothing," security researcher Yaniv Balmas, from Check Point software, told the BBC. Mr Balmas uncovered the security holes in the fax protocols with the help of colleague Eyal Itkin and said they were "surprised" by the extent to which fax was still used.

An anonymous reader quotes a report from ZDNet: Security researchers are warning Linux system users of a bug in the Linux kernel version 4.9 and up that could be used to hit systems with a denial-of-service attack on networking kit. The warning comes from Carnegie Mellon University's CERT/CC, which notes that newer versions of the Linux kernel can be "forced to make very expensive calls to tcp_collapse_ofo_queue() and tcp_prune_ofo_queue() for every incoming packet which can lead to a denial of service (DoS)".

It lists a number of network-equipment vendors, PC and server manufacturers, mobile vendors, and operating-system makers that may be affected but notes that it hasn't confirmed whether any of them actually are. But, given the widespread use of Linux, the bug could affect every vendor from Amazon and Apple through to Ubuntu and ZyXEL. A remote attacker could cause a DoS by sending specially modified packets within ongoing TCP sessions. But sustaining the DoS condition would mean an attacker needs to have continuous two-way TCP sessions to a reachable and open port. The bug, dubbed "SegmentSmack" by Red Hat, has "no effective workaround/mitigation besides a fixed kernel."

NEC, a Japanese IT and networking company, announced plans to provide a large-scale facial recognition system for the 2020 Summer Olympic and Paralympic Games in Tokyo. "The system will be used to identify over 300,000 people at the games, including athletes, volunteers, media, and other staff," reports The Verge. From the report: NEC's system is built around an AI engine called NeoFace, which is part of the company's overarching Bio-IDiom line of biometric authentication technology. The Tokyo 2020 implementation will involve linking photo data with an IC card to be carried by accredited people. NEC says that it has the world's leading face recognition tech based on benchmark tests from the US's National Institute of Standards and Technology. NEC demonstrated the technology in Tokyo today, showing how athletes and other staff wouldn't be able to enter venues if they were holding someone else's IC card. The company even brought out a six-foot-eight former Olympic volleyball player to demonstrate that the system would work with people of all heights, though he certainly had to stoop a bit. It worked smoothly with multiple people moving through it quickly; the screen displayed the IC card holder's photo almost immediately after.

At least two malls in Calgary are using facial recognition technology to track shoppers' ages and genders without first obtaining their consent. "A visitor to Chinook Center in south Calgary spotted a browser window that had seemingly accidentally been left open on one of the mall's directories, exposing facial-recognition software that was running in the background of the digital map," reports CBC.ca. "They took a photo and posted it to the social networking site Reddit on Tuesday." From the report: The mall's parent company, Cadillac Fairview, said the software, which they began using in June, counts people who use the directory and predicts their approximate age and gender, but does not record or store any photos or video from the directory cameras. Cadillac Fairview said the software is also used at Market Mall in northwest Calgary, and other malls nationwide. Cadillac Fairview said currently the only data they collect is the number of shoppers and their approximate age and gender, but most facial recognition software can be easily adapted to collect additional data points, according to privacy advocates. Under Alberta's Personal Information Privacy Act, people need to be notified their private information is being collected, but as the mall isn't actually saving the recordings, what they're doing is legal. It's not known how many other Calgary-area malls are using the same or similar software and if they are recording the data.

LinkedIn has been trying to make its business networking platform more like Facebook of late, with features like presence, and Google-like smart replies. Now, it's introducing voice messages just like Facebook and Facebook-owned WhatsApp. From a report: "Whether you're responding while walking or multitasking, or need to give an in-depth explanation, voice messages let you more easily and quickly communicate in your own voice with your connections," LinkedIn said in a blog. Personally, I loathe having to open voice messages on WhatsApp and have never received one on Facebook Messenger, but for the sender, at least, such services can be helpful if they're on the go and can't stop to type a message. And that's LinkedIn's justification for releasing the feature. LinkedIn thinks its new option will be a time-saver for users who find typing laborious in some situations. On the downside, this feature could rapidly become a real pain for those who already get bombarded with written messages from strangers promoting products and services on LinkedIn Messages.

secwatcher writes from a report via Threatpost: Cisco Talos researchers found flaws located in Samsung's centralized controller, a component that connects to an array of IoT devices around the house -- from light bulbs, thermostats, and cameras. SmartThings Hub is one of several DIY home networking devices designed to allow homeowners to remotely manage and monitor digital devices. "Given that these devices often gather sensitive information, the discovered vulnerabilities could be leveraged to give an attacker the ability to obtain access to this information, monitor and control devices within the home, or otherwise perform unauthorized activities," researchers said in a report. Threatpost goes on to detail the "multiple attack chain scenarios." Thankfully, Samsung has since patched the bugs. "We are aware of the security vulnerabilities for SmartThings Hub V2 and released a patch for automatic update to address the issue," a Samsung spokesperson told Threatpost. "All active SmartThings Hub V2 devices in the market are updated to date." The company released a firmware advisory for Hub V2 devices on July 9th.

Qualcomm announced its new QTM052 mmWave antenna modules that will enable 5G networks on select mobile phones. The penny-sized antenna array features four antennas that can accurately point toward the nearest 5G tower. It can even bounce signals off of surrounding surfaces, if needed. The Verge reports: The QTM052 is designed to be small enough that device manufacturers will be able to embed it into the bezel of a phone. Qualcomm's X50 5G modem is already designed to support up to four of the antenna arrays, one for each side of the phone, allowing for 16 total antennas and ensuring that no matter how you hold your phone, the signal won't get blocked. Qualcomm says that the first devices with the QTM052 antennas should be launching as early as the beginning of 2019 -- and hopefully, there'll be some actual 5G networks to use them with by then.

Cisco released 25 security updates Wednesday, including a critical patch removing an undocumented password for "root" accounts of Cisco Policy Suite (sold to ISPs and large corporate clients). "The vulnerability received a rare severity score of 9.8 out of a maximum of 10 on the CVSSv3 scale," reports Bleeping Computer.

An anonymous reader quotes Tom's Hardware: Over the past few months, not one, not two, but five different backdoors joined the list of security flaws in Cisco routers.... In March, a hardcoded account with the username "cisco" was revealed. The backdoor would have allowed attackers to access over 8.5 million Cisco routers and switches remotely. That same month, another hardcoded password was found for Cisco's Prime Collaboration Provisioning software, which is used for remote installation of Cisco's video and voice products. Later this May, Cisco found another undocumented backdoor account in Cisco's Digital Network Architecture Center, used by enterprises for the provisioning of devices across a network. In June, yet another backdoor account was found in Cisco's Wide Area Application Services, a software tool for Wide Area Network traffic optimization...

Whether or not the backdoor accounts were created in error, Cisco will need to put an end to them before this lack of care for security starts to affect its business.

A week after a report claimed that Amazon Web Services was building its own bare-bones networking switch in a potential threat to networking giant companies, Cisco says it has checked with Amazon, with which it has long maintained a relationship, and it has been assured by the ecommerce giant that is not entering its territory. From a report: AWS CEO Andy Jassy and Cisco CEO Chuck Robbins had a "recent call" from which Robbins walked away satisfied that AWS wasn't "actively building a commercial network switch," Marketwatch reported Wednesday, citing a statement from Cisco that it confirmed as authentic with AWS. That follows a report last week from The Information that AWS was working on a so-called "white-box switch," which the site portrayed as a frontal assault on Cisco that sent networking stocks slumping on a lazy summer Friday afternoon.

Mehedi Hassan, writing for Thurrott: Microsoft is bringing support for leap seconds -- yes, that one extra second -- to Windows, starting with Windows 10 Redstone 5 and Windows Server 2019. With the upcoming updates for Windows 10, Microsoft's operating system now deals with leap seconds in a way that is incredibly accurate, UTC-compliant, and traceable. Leap seconds typically occur every 18 months, resulting in one extra second. The extra leap second occurs to adjust with the earth's slowed down rotation, and an extra second is added to UTC in order to keep it in-sync with mean solar time. To deal with the extra second more appropriately, Windows 10 will now display that extra second, instead of directly jumping to the next one. H/T Perfycat who adds: The new move makes Windows Server the first OS to have full support of the rare but valid timestamp of: 23:59:60. Linus Torvalds has long maintained that users needs to chill out about leap seconds. Further reading: Microsoft's blog post 1, and blog post 2.

Amazon Web Services already dominates the market for cloud services. Now, reports The Information, it is eyeing a part of the cloud business it doesn't already control: the $14 billion global market for data center switches [Editor's note: the link may be paywalled; alternative source]. From the report: AWS is considering selling its own networking switches for business customers -- hardware devices that move traffic around networks, according to a person with direct knowledge of the cloud unit's plans and another person who has been briefed on the project. The plan could plunge Amazon more deeply into the lucrative enterprise computing market, posing a direct challenge to incumbents in the business like Cisco, along with Arista Networks and Juniper Networks.

As it does in many other categories, Amazon plans to use price to undercut rivals. The company could price its white-box switches between 70% and 80% less than comparable switches from Cisco, one of the people with knowledge of the program estimated.

Public exploit code has been published for a severe vulnerability which last year affected Hewlett Packard Integrated Lights-Out 4 (HP iLO 4), a tool for remotely managing the company's servers.

HPE "silently released" patches last August, an anonymous reader reports, adding "details only emerged this spring after researchers started presenting their work at security conferences." The vulnerability is an authentication bypass that allows attackers access to HP iLO consoles. Researchers say this access can later be used to extract cleartext passwords, execute malicious code, and even replace iLO firmware. But besides being a remotely exploitable flaw, this vulnerability is also as easy as it gets when it comes to exploitation, requiring a cURL request and 29 letter "A" characters, as below:

curl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA"

Because of its simplicity and remote exploitation factor, the vulnerability — tracked as CVE-2017-12542 — received a severity score of 9.8 out of 10.

An anonymous reader quotes a report from CNET: Facebook has admitted providing dozens of tech companies with special access to user data after publicly saying it restricted such access in 2015. Facebook continued sharing information with 61 hardware and software makers after it said it discontinued the practice in May 2015, the social networking giant acknowledged in 747 pages of documents delivered to Congress late Friday. The documents were in response to hundreds of questions posed to Facebook CEO Mark Zuckerberg by members of Congress in April.

Facebook said it granted a special "one-time" six-month extension to companies that ranged from AOL to package-delivery service United Parcel Service to dating app Hinge so they could come into compliance with the social network's new privacy policy and create their own versions of Facebook for their devices. Data shared without users' knowledge included friends' names, genders and birth dates. Facebook's documents also said it had discovered that five other companies "theoretically could have accessed limited friends' data" as a result of a beta test. Facebook said in the documents it has ended 38 of the partnerships and plans to discontinue seven more by the end of July.

"Despite Microsoft's assurances, Windows 10 1803 isn't ready for prime time," writes ComputerWorld's Woody Leonhard, adding "Microsoft's patches in June took on some unexpected twists..." Win10 1803 was declared fully fit for business, a pronouncement that was followed weeks later by fixes for a few glaring, acknowledged bugs -- and stony silence for other known problems. We're continuing the two-big-cumulative-updates-a-month pace for all supported versions of Windows 10. The second cumulative update frequently fixes bugs introduced by the first cumulative update. Microsoft may think that Win10 (1803) is ready for widespread deployment, but there are a few folks who would take issue with that stance...

Tuesday, Microsoft finally released a fix for two big bugs that have dogged Win10 1803 since its inception... In practice, life isn't so simple. WSUS (the Windows Update Server software) isn't "seeing" KB 4284848, as of late Wednesday afternoon -- which may be a good thing. Along with the second cumulative update this month, there are additional releases to fix the Servicing Stack, and a new "Compatibility update" that, per the documentation, is designed to make it easier to upgrade Win10 1803 Enterprise to Win10 1803 Enterprise (not a typo)...

One problem that has been acknowledged -- but only by a Microsoft Agent on an Answers Forum post -- says that installing 1803 can clobber your peer-to-peer network. That certainly matches my experience.
Woody concludes, "If you think Win10 1803 is ready for prime time, you're welcome to give it a try."

Facebook's controversial Messenger Kids app is heading outside the U.S. to Canada and Peru. From a report: As part of the expansion, the social networking giant said Friday that it would also debut Spanish and French language versions of the children's messaging app that are now available in all three countries where the service is available. Facebook introduced Messenger Kids in December, pitching it as a safer way for children under 13 to chat with friends while sending them silly GIFs, emoji, and other goofy digital imagery. Unlike the core Facebook social networking service or other messaging apps, Facebook said that Messenger Kids does not display any online ads or allow kids to buy things within the app.