“ScienceAlert is reporting that researchers may have finally determined why, for many years, power grids around the world have been pulsing every 60 seconds,” writes longtime Slashdot reader fahrbot-bot. The likely culprit? Uninterruptible power supplies running routine battery checks. From the report: Every minute, some uninterruptible power supplies perform routine battery checks, creating small but measurable surges in electricity demand. And it’s like clockwork. “Even benign control routines can become systemically relevant when many devices act coherently,” writes a team led by physicist Dirk Witthaut of the University of Cologne, Germany, in a paper published in Nature Energy. “Unintended synchronization can generate recurrent and potentially amplified oscillatory behavior in large-scale cyber-physical energy systems.”

To figure it out, Witthaut and his colleagues analyzed high-resolution electricity measurements from buildings at the Forschungszentrum Julich research campus in Germany. [… they found that] the 60-second pattern appeared in four buildings, all of which contained uninterruptible power supplies. None of the buildings they measured without these systems showed the same pattern. Following the electrical signals more closely, the researchers detected tiny bursts of current from the batteries at precisely one-minute intervals. They were able to trace the resulting fluctuations through one building’s electrical system, all the way to the connection with the public high-voltage grid.

The manufacturer subsequently confirmed the culprit’s identity — routine battery self-tests, conducted automatically by the systems’ management software. But why would equipment in different buildings, let alone different countries, be doing this at the same time? The answer appears to lie in the clocks. Digital devices can synchronize their internal clocks using external time signals, meaning that independently operating systems can end up performing their scheduled tasks together. Individually, these small checks are insignificant. But when enough devices act in synchrony, their combined electricity demand can produce a measurable effect across an entire power grid.

Read more of this story at Slashdot.

An anonymous reader quotes a report from PBS: The historic ocean liner SS United States will be intentionally sunk Wednesday off the coast of the Florida panhandle. Live coverage of the sinking of the SS United States is expected to start at 1 p.m. EST, with the sinking expected at 2 p.m. EST. Watch live in the video player above. In its heyday, the SS United States crushed the trans-Atlantic speed record, which it still holds. The luxury ocean liner took only three days to cross from New York to Europe on its maiden voyage in 1952. Carrying presidents and Hollywood stars, the nearly 1,000-foot vessel was a technical marvel of its time. However, the rise of air travel and high operating costs sunk its economic viability, and the ship was pulled from service in 1969. The ocean liner sat at Philadelphia’s Pier 82 for nearly 30 years.

After a contentious back and forth with a pier landlord over rent and docking fees, Okaloosa County in Florida eventually stepped in to purchase the ship and bring it to the Gulf of Mexico to become the world’s largest artificial reef. The multi-million dollar project is also aimed at creating an economic development opportunity as a major diving attraction. “It was our goal to make sure that she wasn’t lost forever,” said David Lawrence, a member of the board for the SS United States Conservancy, the group that sold the vessel to the Florida county.

Like the ship’s unconventional life, it will also have an unconventional sinking. Federal environmental and explosives rules prevent the county from using explosives. Instead, tanks inside the ship have been removed and large holes were cut into the decks. Once the valves are opened, water will flood the hull, sinking the ship. Resting at 180 feet below the surface of the water, the SS United States will join more than 500 artificial reefs in Okaloosa County, which the county relies on to support the underwater ecosystem.

Read more of this story at Slashdot.

United Airlines is banning unauthorized third-party AI agents from booking flights, checking in passengers or making account changes on travelers’ behalf. CBS News reports: To make an airline booking, an AI agent requires access to a customer’s personal information, including credentials like payment information. United has a problem with that, saying that “sharing account credentials with personal, third-party, AI assistants can expose sensitive information, and actions taken by these tools may result in unintended purchases, account changes, or use of MileagePlus miles.”

The carrier also said that using an AI agent to, for example, check in for a flight could violate federal regulations, including rules requiring travelers to verify in person that their luggage does not contain banned substances. “As a result, United is taking steps to restrict access — directly within our digital platforms and indirectly via travel agencies and aggregators — to prohibit use by unauthorized, third-party personal AI agents or assistants,” said the airline, which is updating its booking and ticketing policies to reflect the new rule. “United is saying they don’t want to add yet another, and potentially even more powerful, intermediary than they already face in terms of Google search, price-comparison metasearch sites and online travel agencies,” said Henry Harteveldt, an aviation analyst at Atmosphere Research Group. “Flight searches cost airlines money, and undoubtedly United wants to avoid the expense associated with the surge of AI bot flight searches.”

Read more of this story at Slashdot.

The dark web isn’t just for illicit activities. In fact, many legitimate online platforms maintain a “.onion” domain on the dark web for privacy reasons, including media outlets like ProPublica and BBC News, social media sites like Facebook, and privacy-conscious communication platforms like Proton Mail and SecureDrop. 

But this also provides perfect cover for criminals and hackers who create clones of legitimate dark web sites to steal sensitive data and cryptocurrency from privacy-conscious users. And given that onion links are long and jumbled, it’s easy for users to accidentally click on the wrong link and end up on a fake website instead of the real one. When the FBI seized 276 onion addresses during 2014’s Operation Onymous, they found that 153 of them were phishing sites.

Thankfully, Tor Browser already has a cryptography-backed feature that can verify the authenticity of an onion site, by confirming whether it has end-to-end encryption and extended validation certificates. Here’s how this feature works, where it falters, as well as what other red flags you should look for. 

How phishing works on the dark web

While phishing on the dark web works as it does on the clear web, scammers have a few unique advantages due to the secretive nature of the environment. Most importantly, you can’t just glance at an onion link to tell if the site is genuine. Normal website URLs tend to be short and memorable, while onion links are 56-character strings of alphanumeric text that look mostly like gibberish. 

When you try to connect, Tor Browser verifies the URL against the originating website’s cryptographic key, which is how you know nobody has hijacked the address or tampered with it midway. But since this has the unwanted effect of making domains harder to recall, scammers have a much easier time generating lookalike addresses or creating website clones. 

For example, many popular websites use “vanity prefixes” to make their onion addresses more easily identifiable or to add some branding appeal. That means their 56-character onion link starts with something like “facebook,” “bbcnews,” or “ciadotgov.” But scammers can use a free tool like mkp224o to generate lookalike addresses with the same vanity prefix as the legitimate website, which gives users a false sense of security. 

Of course, most dark web users don’t type addresses directly into Tor Browser; they use dark web directories like the Hidden Wiki to find useful onion sites relevant to their search. Scammers will create fake search engines or link directories to point users to their fake websites, like when the Ahmia search engine discovered that a copy of its platform was directing users to 255 cloned services back in 2015. 

Of course, it’s possible to orchestrate phishing attempts that don’t involve cloning sites at all. Researchers at Freie Universität Berlin describe a sophisticated technique where attackers serve the real website through their own reverse proxy, which lets them manipulate parts of the site or log your online activity without your awareness. In 2019, ESET even found a trojanized version of Tor Browser that replaced Bitcoin addresses on websites to direct payments to hackers. So both genuine websites and your browser itself are also vulnerable to manipulation if you download or access them from an unverified source. 

How to verify an onion site in Tor Browser

There are a few best practices to avoid phishing attacks when using the dark web. None of them are foolproof on their own, but together, they considerably lower the risk of ending up on a fake or manipulated website. 

1. The Tor Project has a feature called Onion-Location, which lets clear web websites advertise that they have a dark web version available for users who prefer more privacy. If opening a regular TLS-backed website using the Tor Browser reveals a purple “onion available” button in the address bar, you can click on it and be redirected to the official onion link associated with that site. 

2. On the desktop version of Tor Browser, you can access an onion site using a shortened version of its URL called an Onion Name. For now, this feature only works with SecureDrop, so newsrooms can establish tip lines with addresses like mysitename.securedrop.tor.onion, which would then redirect to the 56-character original onion address. This feature is in active development, so more platforms might support it in the future.

3. When you load up an onion site using the Tor Browser, you’ll see an onion icon on the address bar, which confirms that your connection is end-to-end encrypted. But you can also click on the onion icon to check if the site has an Extended Validation (EV) certificate, which tells you that its authenticity has been verified by a trusted certificate authority like DigiCert. While not every legitimate onion site will have an EV certificate, famous ones like Facebook tend to. 

4. On the other hand, if you see a caution sign next to the onion icon, that means the site is using a self-signed or expired certificate that isn’t guaranteed by a trusted authority. It may also imply that the site is being served over an insecure URL. This doesn’t definitely tell you it’s a phishing site, but it’s a red flag to watch out for nevertheless.

5. Don’t rely on search engines, link directories, Reddit threads, or Telegram channels too heavily on the dark web. Once you’re sure you’ve found the onion address for a genuine site, bookmark it so you can access it directly the next time you want to visit. 

What to do if you think you’ve been phished

If you realized that you’ve been the victim of a phishing attempt, the first step is to close the browser window with the fake site and access the real onion address to reset any account passwords you may have accidentally divulged. 

Also, generally try to enable two-factor authentication and PGP logins on any dark web account that supports it for added security. And if you downloaded Tor Browser from anywhere other than the official Tor Project site, uninstall it now and grab a fresh copy from the official address. 

Nvidia’s board is set to hold urgent talks about the future of its founder Jensen Huang after revelations that he had an affair with a top executive at the company, according to people familiar with the matter.

The meeting on Wednesday comes amid a deepening scandal at the $4.2 trillion group, after Donald Trump said the FBI was investigating allegations that Huang was romantically involved with an alleged Chinese spy.

The Nvidia chief executive had a romantic relationship with Kimberly Powell, the chipmaker’s vice-president of healthcare, according to two people familiar with the matter. Powell, a more than 18-year veteran at Nvidia, is among the company’s more prominent public figures.

Read full article

Comments