Category: Uncategorized

In the past year, regulators and privacy advocates have taken potshots at Microsoft over its data collection policies. Today, Microsoft announced some new privacy-related initiatives, including a significant change to the way Windows 10 collects telemetry data.

Of all the body blows Microsoft has absorbed in the past 18 months over Windows 10, the criticisms of its privacy policies have to sting the most.

Last summer, the French National Data Protection Commission (CNIL) issued a formal notice against Microsoft, ordering that the company "stop collecting excessive data and tracking browsing by users without their consent."

The CNIL found Microsoft's collection of diagnostic information (so-called telemetry) acceptable but said that the default settings for Windows 10 go too far. The complaint singled out Microsoft's practice of collecting information about app usage as "excessive."

A month later, the Electronic Freedom Foundation took aim at Windows 10 with a signed editorial criticizing the company for "disregarding user choice" and sending "an unprecedented amount of usage data back to Microsoft...." As I noted at the time, EFF was especially critical of Microsoft's telemetry collection policies.

After months of explaining and defending its policies, publicly and in meetings with regulators, the company today announced that it's making a series of privacy-related moves. Terry Myerson, who runs the Windows and Devices Group, made the announcement in a blog post:

Many of you have asked for more control over your data, a greater understanding of how data is collected, and the benefits this brings for a more personalized experience. Based on your feedback, we are launching two new experiences to help ensure you are in control of your privacy.

First, today we're launching a new web-based privacy dashboard so you can see and control your activity data from Microsoft including location, search, browsing and Cortana Notebook data across multiple Microsoft services. Second, we're introducing in Windows 10 a new privacy set up experience, simplifying Diagnostic data levels and further reducing the data collected at the Basic level.
The changes to Windows 10 will roll out initially in an upcoming Windows Insider preview build, perhaps as soon as this week, and will reach the general public with the release of the Windows 10 Creators Update this spring.

I haven't seen these features in operation yet. The descriptions in the remainder of this post are based on what Microsoft says it plans to deliver. The broad outlines shouldn't change, but you can expect the user experience to evolve before the final release, based on feedback from Windows Insider Program participants and third parties.

Unlike its predecessors, the Creators Update will not arrive silently in the background. Instead, Microsoft plans to notify Windows 10 users that the update is available and allow them to schedule its installation. As part of the process of scheduling that upgrade, users will have the opportunity to make "explicit choices" about privacy settings in five categories.

This is the new privacy settings setup experience that will arrive soon in a Windows Insider preview build, according to Myerson:

This setup screen replaces the Express Settings in current Windows 10 public releases, which requires multiple extra steps to adjust default settings in a clean installation and offers no control over privacy options during upgrades. (To make matters worse, some users have reported that Windows 10 upgrades occasionally reset custom privacy options to their default settings after an upgrade.)

The new interface for setting privacy options also includes an explanation of what happens if you turn any of those settings off or, in the case of the Diagnostics setting, adjust it from Full to Basic.

All of those settings, along with more granular controls (such as setting location permissions on a per-app basis) will also be available after installation, under the Privacy heading in Settings.

The changes to telemetry settings start with the renaming of the category itself, from Diagnostic and Usage Data to just Diagnostics.

In all public releases of Windows 10 so far, non-Enterprise editions allow users and administrators to choose one of three levels to control telemetry collection: Full, Enhanced, and Basic. The changes in the Creators Update will eliminate the Enhanced level and also reduce the amount of information collected when you slide that switch to Basic.

(In Enterprise settings, administrators will continue to have an additional Security option, which eliminates virtually all telemetry collection but requires the deployment of an alternative update mechanism.)

In an interview, Microsoft Corporate Vice President Michael Fortin told me that the Enhanced level was "confusing," and "only a relatively modest number of Windows 10 users were choosing it." Most people either leave the default setting at Full or signal their preference for privacy by switching to the lowest available telemetry option, Basic, he noted.

Effective with this spring's Windows 10 feature update, telemetry information collected at the Basic level will no longer include information about app installation or usage. Instead, Myerson says, information collected at that level will focus strictly on security and reliability, with basic error reporting. That change should assuage some of the concerns of the CNIL and other regulators as well as privacy critics like the EFF.

The new Windows 10 settings are available in all installations, regardless of what type os account the user has signed in with.

The privacy dashboard is a separate feature, designed to give users of Microsoft services the opportunity to see and edit information that is collected and stored in the cloud when they are signed in with a Microsoft account.

According to Myerson, the new privacy dashboard (which will be available at https://account.microsoft.com/privacy) will allow Microsoft customers, regardless of hardware platform or operating system, to review and clear data such as browsing history, search history, location activity, and Cortana's Notebook. (Note that this data is associated with a Microsoft account and is not saved in the cloud when the user browses without signing in.)

Because this dashboard is web-based, it's likely to evolve significantly over time. In an interview, Myerson told me he expects his team to iterate on that user experience in response to feedback. "What we're learning," he said, "is that people don't always understand why something is being collected and what are the implications of clearing it out. We will continuously be improving."

On paper, Redmond can make a strong case that it has an economic incentive to protect its users' privacy. As I noted last summer, privacy should be a competitive advantage for Microsoft, especially when comparing its policies and practices to those of Google, whose entire business is built on collecting data from its users and turning it into advertising profiles.

Most of Microsoft's revenue comes from selling software licenses, cloud services, and hardware. A significant share of that business is with enterprise customers and government agencies that have a profound interest in privacy and security. Indeed, Microsoft has earned generally high marks for its handling of security and privacy issues in cloud services such as Office 365 and Microsoft Azure.

Where things get somewhat murkier is with products and services aimed at consumers and small businesses. Without transparency over exactly what information is collected and how it's used, the company remains vulnerable to accusations that it's spying on customers.

As Google and Facebook have proven, the most effective way to monetize personal information is through online advertising. Microsoft once had dreams of being an advertising powerhouse, which occasionally led to struggles between product designers and ad sellers.

But the company abandoned that strategic goal five years ago when it wrote off the acquisition of aQuantive and scaled back its advertising ambitions after five years of struggling. Today, the company's advertising business is healthy but relatively small and mostly intended to monetize strategic assets such as its Bing and Cortana search tools.

In Microsoft's most recent quarter, search advertising and other forms of online ads accounted for only about 5 percent of total revenue. Contrast that with Google, which earns roughly 90 percent of its revenue from advertising and depends on collecting massive amounts of data to power the ads that pay for Google Search, Gmail, and other free products

Without Microsoft's investments in those technologies, Google's dominance in search would arguably be a monopoly.

Still, even that small-by-Redmond-standards online search advertising business brought in about $1.4 billion in revenue in its recent quarter, up 40 percent over the previous year. Microsoft's ad business might be tiny compared to its rivals, but it's big enough for regulators and privacy advocates to worry about whether the company's data collection is being driven by its ad business.

Myerson tells me that they've shared details about its data collection practices with large enterprise customers and regulators. "That dialog is taking place in every country where we do business," he said. "We believe users have a right to privacy and users should have control over their data."

For consumers and small businesses, the new privacy dashboard offers more control over online data, but you'll have to take Microsoft assurances on faith when it comes to telemetry.

I asked Myerson whether Microsoft would consider contracting with an outside group, such as the EFF, to audit its data collection policies and offer an independent report.

"That's an interesting idea," he replied. "But various countries are going farther than hiring an audit firm. They're passing laws. We're making sure we're fully compliant with laws that affect Windows users."

From:http://www.zdnet.com/article/how-to-turn-on-iphone-ipad-encryption-in-one-minute/

The popular hacking tool kit can now be linked to everything from fridges to cars in the search for vulnerabilities.

The popular Metasploit hacking kit has been upgraded to tackle today's Internet of Things (IoT) devices, granting researchers the opportunity to scour for bugs in modern vehicles.

Rapid7 Research director of transportation security Craig Smith announced on February 2 that the Metasploit framework can now link directly to hardware, permitting users to develop exploits to test their hardware and conduct penetration testing with less time wasted.

It is hoped that researchers will no longer have to build multiple tools to test today's modern devices and overcome previous network limitations.

"Metasploit condensed a slew of independent software exploits and tools into one framework and now we want to do the same for hardware," Smith says.

The open-source penetration testing software, available for free or as an extended, paid-for edition, is over a decade old but is still utilized by thousands of researchers worldwide. The framework currently boasts roughly 1,600 exploits and 3,300 penetration testing modules.

Due to the fresh update to the Hardware Bridge API, users are no longer limited to Ethernet network connections. Instead, researchers can build support directly into firmware or create a relay service through a REST API, which is necessary for some hardware tools including Software Defined Radio (SDR) that cannot communicate over Ethernet.

"Every wave of connected devices, regardless of whether you're talking about cars or refrigerators, blurs the line between hardware and software. As we like to say, this hardware bridge lets you exit the Matrix and directly affect real, physical things," said Smith. "We're working to give security professionals the resources they need to test and ensure the safety of their products, no matter what side of the virtual divide they are on."

The initial release focuses on IoT, with a particular slant towards automotive penetration testing. The bridge now includes modules for testing vehicle Controller Area Network (CAN) buses and users are also offered interactive commands for gathering information on vehicles being tested, such as speed and inbuilt security systems.

"If you are in security at an automaker, you are challenged to test things that are not exposed to traditional networks," Smith told Dark Reading. "The hardware bridge allows security teams to add hardware testing to their QA process. It also allows red teams to have a central user interface to all of their hardware tools."

Additional modules which target embedded, industrial, and hardware devices, including SCADA systems for industrial applications, will be added over time. Rapid7 also plans to add additional BUS systems, such as K-Line, in the future.

Rapid7 is asking users of the initial Metasploit release to provide feedback and suggest new automotive features for future versions.

From:http://www.zdnet.com/article/metasploit-security-kit-now-hacks-iot-devices-hardware/

Rather than using macros, this malware uses Visual Basic Script to avoid detect

Cybercriminals are targeting a US major financial services provider with malicious emails containing the tools required to install information collecting keylogging software onto the infected systems.

Keylogging enables hackers to see everything that's typed using the keyboard of an infected machine, something which can be exploited to steal information, personal information, and login credentials.

Cybersecurity researchers at Proofpoint note that the attack is very narrow in scope, targeting users in just a single US-based financial services and insurance organisation with malicious emails. Naturally, banks are a high-profile target for cybercriminals who not only see money as a lucrative target, but also view financial institutions as a treasure trove of data to exploit.

Like many phishing threats, the email contains an attachment in the form of a Microsoft Word document, designed to deliver the payload. However, unlike most phishing emails containing malicious attachments, which use macros to avoid detection, this one uses an embedded object in the form of a Visual Basic Script that acts as a downloader for the malware.

"It is a Packager Shell Object. When content like a script is packaged as a Packager Shell Object, it can be opened and executed from within the Microsoft Office file in which it is embedded," says Kevin Epstein, VP of the threat operations center at Proofpoint.

In this instance, the emails sent in this cyberattack include a Microsoft World attachment named "info.doc", which contains an image requesting the user clicks on it to install Microsoft Silverlight in order to view the supposed content of the document.

However, upon closer examination of the image, researchers note that it reveals itself as not a link, but rather a Visual Basic Script file which contains code for keylogging malware which will run when clicked on.

Once installed on an infected system, the malware will log the keystrokes and sends the information to two hard-coded Gmail addresses.

While researchers haven't been able to specifically identify the keylogger being used in this attack, it's written in the Aultolt scripting language and uses tools including Lazagne password recovery to help gather credentials.

There's no indication of who is behind the attacks against the unnamed financial services firm, but researchers indicate the malicious software used was obtained from a public malware repository and uploaded from Estonia. According to Proofpoint, this indicates that the keylogger may have been used in attacks against similar institutions.

Researchers note that while the malware is basic compared to other exploits, the way the keylogger is being delivered to end users represents a shift from the tried and tested method of tricking them into enabling macros.

While Microsoft Office applications can block macros by default, this threat indicates that cyberattacks are very much active in developing new ways to deliver their malicious payloads.

From:http://www.zdnet.com/article/this-phishing-email-uses-an-unexpected-trick-to-infect-pcs-with-keylogger-malware/

Phishing emails contain names and telephone numbers of targets.

Cybercriminals are attempting to infect people with bank data stealing Ramnit malware by using phishing emails pretending to come from a charity.

Migrant Help is a real British charity which offers support to distressed migrants arriving in the UK, but hackers are using its name in an effort to infect victims with the Ramnit banking Trojan, Action Fraud, the UK's fraud and cybercrime centre has warned.

A phishing email with the subject 'Thank you for choosing to donate to Migrant helpline' is sent to the potential victim, claiming that they recently donated money to the charity.

The emails contain a fake receipt for which, as noted by My Online Security, lists the first name and second name of target as well as their actual phone number. It is not clear how the scammers obtained this information, but using the target's real name and phone number makes the email make look more authentic.

The message contains a reference number and invites those with questions about their donation - which victims are likely to have if they've never given to Migrant Help - to click on a link which has been customised to contain the target's name, in order to download a document supposedly containing more information.

Those who click on the link are taken to an online Word document which downloads the Ramnit payload onto the victim's machine.

First appearing appeared in 2010 in the form of a self-replicating computer worm, Ramnit has evolved to become much more dangerous, reaching the point where those behind it have developed it into a banking Trojan, designed to steal bank customer login credentials for theft and fraud.

Despite being seven years old Ramnit remains dangerous, and even accounted for the largest increase in malware attacks during November last year, with the number of infections doubling since the previous month.

Advice from Action fraud on not becoming a victim of phishing scams is to not open attachments in unsolicited emails and to install the latest software security updates.

The police warning on malware distributing Migrant Help phishing email scam comes shortly after City of London police warned of a ransomware scheme targeting schools.

From:http://www.zdnet.com/article/this-phishing-scam-poses-as-a-charity-email-delivers-ramnit-banking-trojan-malware/

Campaign targets those who most often need to open attachments from unknown sources.

Cybercriminals are posing as job applicants as part of a new campaign to infect victims in corporate human resources departments with GoldenEye ransomware -- and they're even providing covering letters in an effort to lull targets into a false sense of security.

A variant of the Petya ransomware, GoldenEye targets human resources departments in an effort to exploit the fact that HR employees must often open emails and attachments from unknown sources.

Cybersecurity researchers at Check Point have been monitoring the campaign, which attempts to deliver ransomware to German targets using emails and attachments claiming to be from job applicants. The initial email contains a short message from the fake applicant, directing the victim to two attachments.

The first is a covering letter within a PDF which doesn't actually contain any malicious software, but is intended to reassure the target that they're dealing with a standard job application. However, the second attachment is an Excel file supposedly containing an application form but which in fact contains the malicious GoldenEye payload.

Upon opening the Excel attachment, the target is presented with a document which claims to be 'Loading' and requires them to enable Macros to view the file. When Macros are enabled, GoldenEye executes a code and begins encrypting the users' files before presenting them with a ransom note using yellow text -- rather than the red or green used by other Petya variants.

The note demands the victim pays a ransom of 1.3 bitcoins - around $1,000 - in order to retrieve their files. Much like other increasingly professional ransomware and cybercriminal campaigns, the perpetrators detail how the victim can acquire bitcoin on the dark web and even offer the option of exchanging messages with a GoldenEye admin if they're having trouble with the payment or decryption process.

It's believed by researchers that the developer behind Petya ransomware is going by the alias Janus -- apparently borrowing the name of a cybercrminal group in the 1995 James Bond film GoldenEye.

The cybercriminal operation behind the GoldenEye campaign has also been known to offer ransomware-as-a-service schemes which allow almost any wannabe hacker to cash-in on cyber extortion.

One way users can avoid falling victim to GoldenEye and other ransomware variants is by never enabling Macros within Microsoft Office documents and being mindful of unexpected or overly generic email messages.

From:http://www.zdnet.com/article/this-ransomware-targets-hr-departments-with-fake-job-applications/

Third-party solutions for monitoring, managing, and protecting containers on AWS step in to fill the gaps left by Docker or Amazon

What's hot on AWS these days? If you guessed containers, you'd be right. However, it's no longer simply about getting containers into Amazon's infrastructure, but about providing management, introspection, and protection functionality that Amazon can't -- or won't.

This week at Amazon Re:Invent, various third parties unveiled solutions for container-management issues on AWS. In many cases they're adding deeper integration with AWS to existing third-party cloud-based monitoring services.

[ Dig into the the red-hot open source framework in InfoWorld's beginner's guide to Docker. Pick it up today! | Get a digest of the day's top tech stories in the InfoWorld Daily newsletter. ]
CoreOS

CoreOS, best known for its stripped-down, container-based Linux distribution, has fused its product with Google's Kubernetes container-management tool to create Tectonic, a full-stack product designed to be used by enterprises with a minimum of fuss. However, getting it to run on AWS hasn't been easy, so CoreOS is now providing an AWS installer for Tectonic.

CoreOS claims to provide a consistent environment for managing containers, both in the development environment and in production -- assuming you use Kubernetes or Tectonic as part of that workflow. What makes this interesting is the integration between Kubernetes and native AWS features like the Elastic Load Balancer and Auto Scaling; Tectonic makes use of what's already in AWS rather than reinventing the wheel.

Threat Stack

Threat Stack, which offers security monitoring solutions for those applications running on AWS, is also adding integration with Docker on AWS, with monitored events logged to AWS CloudTrail. A base rule set for Docker containers is included with the product, but it can be customized as needed.

New Relic

New Relic, which makes analytic tools for applications, is also highlighting closer integration with Amazon's native feature set. Its New Relic Software Analytics Cloud already harvests a great deal of customer data from AWS instances, but the newest version (currently in private beta) has features that enrich monitored apps with numerous AWS-specific details, such as AWS tags and metadata, or AWS's Identity and Access Management.

Sysdig

Sysdig also announced a Docker-on-Amazon monitoring system, one of many that offer detailed information about the contents of running containers. Like Threat Stack and New Relic, Sysdig Cloud's latest release adds support for monitoring AWS-specific metadata and tags.

As long as Docker's features -- including its security model -- are seen as incomplete, third parties will step up and fill the gaps. (In CoreOS's case, the company is offering a substitute for Docker.) And as long as Amazon keeps rolling out AWS features aimed at least-common-denominator uses, there'll continue to be plenty of room for third parties.

From:http://www.infoworld.com/article/2990115/virtualization/container-management-and-monitoring-dominate-amazon-reinvent.html

Campaign targets those who most often need to open attachments from unknown sources.

Cybercriminals are posing as job applicants as part of a new campaign to infect victims in corporate human resources departments with GoldenEye ransomware -- and they're even providing covering letters in an effort to lull targets into a false sense of security.

A variant of the Petya ransomware, GoldenEye targets human resources departments in an effort to exploit the fact that HR employees must often open emails and attachments from unknown sources.

Cybersecurity researchers at Check Point have been monitoring the campaign, which attempts to deliver ransomware to German targets using emails and attachments claiming to be from job applicants. The initial email contains a short message from the fake applicant, directing the victim to two attachments.

The first is a covering letter within a PDF which doesn't actually contain any malicious software, but is intended to reassure the target that they're dealing with a standard job application. However, the second attachment is an Excel file supposedly containing an application form but which in fact contains the malicious GoldenEye payload.

Upon opening the Excel attachment, the target is presented with a document which claims to be 'Loading' and requires them to enable Macros to view the file. When Macros are enabled, GoldenEye executes a code and begins encrypting the users' files before presenting them with a ransom note using yellow text -- rather than the red or green used by other Petya variants.

The note demands the victim pays a ransom of 1.3 bitcoins - around $1,000 - in order to retrieve their files. Much like other increasingly professional ransomware and cybercriminal campaigns, the perpetrators detail how the victim can acquire bitcoin on the dark web and even offer the option of exchanging messages with a GoldenEye admin if they're having trouble with the payment or decryption process.

It's believed by researchers that the developer behind Petya ransomware is going by the alias Janus -- apparently borrowing the name of a cybercrminal group in the 1995 James Bond film GoldenEye.

The cybercriminal operation behind the GoldenEye campaign has also been known to offer ransomware-as-a-service schemes which allow almost any wannabe hacker to cash-in on cyber extortion.

One way users can avoid falling victim to GoldenEye and other ransomware variants is by never enabling Macros within Microsoft Office documents and being mindful of unexpected or overly generic email messages.

From:http://www.zdnet.com/article/this-ransomware-targets-hr-departments-with-fake-job-applications/

A concerted effort between law enforcement and cybersecurity firms has resulted in the destruction of a major botnet platform.

After four years of investigation, Europol and other agencies have moved against the prominent Avalanche botnet platform which acted as a hub for malware campaigns worldwide.

Europol publicly disclosed the operation on Thursday, made possible through partnerships with the FBI, the US Department of Justice (DoJ), the German Public Prosecutor's Office Verden Eurojust, and technology firms including Shadowserver and Symantec.

Law enforcement agencies moved November 30 in a takedown which disrupted the infrastructure of criminal operations in over 30 countries and US states across 60 registries worldwide.

Five arrests were made and 37 premises searched, resulting in the seizure of 39 servers. However, a total of 221 servers were taken offline through abuse notices.

It is estimated that Avalanche is responsible for a loss of 6 million euros in damages in Germany alone through malware campaign and money mule recruiting campaigns. It is thought that the botnet platform has facilitated the loss of hundreds of millions of euros worldwide, but Europol says "exact calculations are difficult due to the high number of malware families managed through the platform."

In a post on Shadowserver, the company said that Avalanche is a Double Fast Flux content delivery and management platform designed for the so-called "bullet-proof management of botnets." Sinkholing was used to destroy the botnet's activities, which also disrupted malware families including Citadel, VMZeus, the ransomware TeslaCrypt, and Nymaim.

In total, 800,000 malicious and fraudulent domains were also seized, sinkholed, or blocked during the operation.

Avalanche has been in operation since 2009. The platform has been utilized for a variety of malware, spam, and phishing campaigns, and over one million emails have been sent as part of phishing campaigns worldwide to potential victims.

Julian King, European Commissioner for the Security Union commented:

"Avalanche shows that we can only be successful in combating cybercrime when we work closely together, across sectors and across borders. Cybersecurity and law enforcement authorities need to work hand in hand with the private sector to tackle continuously evolving criminal methods.

The EU helps by ensuring that the right legal frameworks are in place to enable such cooperation on a daily basis."

From:http://www.zdnet.com/article/customer-relationships-its-all-about-the-data/

Facebook is the ringleader in a movement to drive down datacenter, telecom, and networking costs. Here's why Facebook has won over IT partners via an open source approach.

Facebook is increasingly wielding influence on the infrastructure design that stretches from the fiber optic cables to the datacenter to the last mile of your home. And it's using an open source approach to rally a vast ecosystem that'll follow its lead.

In the future, it's highly likely that Facebook will influence the behind-the-scenes network designs as well as datacenter architecture that'll run your business. And, presumably, Facebook's open source and white-box approach will drive costs down.

The progress of the Open Compute Project is fairly well known. Facebook has outlined how it approaches its datacenters and designs its servers and infrastructure. Sure, these designs revolve around Facebook's use cases, but they increasingly apply to more enterprises that have to operate at web scale.

And now Facebook is taking its Open Compute Project mojo into the Telecom Infrastructure Project. The Open Compute Project took years to land key cloud partners such as Microsoft and Google. The Telecom Infra Project has hit the ground running with partners such as Accenture, Hewlett Packard Enterprise, Broadcom, Cisco, Juniper, and a host of others.

Consider:

Facebook contributes telecom designs, plans to Telecom Infra Project, adds partners
Open Compute Project: Gauging its influence in datacenter, cloud computing infrastructure
Facebook wants to do to 5G what it has already done to the datacenter
Open Compute Project enlists AT&T, Verizon while growing telco support
Microsoft to release version 2 of its Open Compute Project server design
Microsoft submits new open-sourced networking components to Open Compute Project
Google joins Open Compute Project, contributes 48V rack
Google, Facebook pause rivalries: Here's their 48V power-saving rack spec for Open Compute Project

Add it up and it's clear Facebook's approach has given it a lot of voice in how cloud datacenters are designed. It's also worth noting that Facebook's capital spending relative to hyperscale cloud providers is sizable, but the social network's influence is still punching above its wallet (not that $1 billion or so in capital expenses a quarter is chump change).

According to Stifel, Facebook will spend $4.5 billion on capital expenditures in 2016, up from $2.5 billion in 2015.

TechRepublic: Enterprise IT's top 4 favorite tech companies | Switching clouds: What Spotify learned when it swapped AWS for Google's cloud | Photos: A look inside Google's, Microsoft's and Facebook's datacenters

So how did Facebook grow this influence? Here are a few reasons:

Facebook has leveraged open source well largely because it is a customer and not a vendor. Facebook has a core competency in running its own infrastructure, but isn't trying to sell you a cloud service or hardware. Facebook is looking to squeeze costs via commodity hardware and automation just like enterprises are. Facebook and enterprise customer interests are aligned.
The inclination to throw designs, intellectual property, and architectural models in open source projects have won Facebook a lot of credibility in datacenter circles.
Facebook spends a ton on infrastructure. Why would a vendor play along with Facebook? Perhaps a technical partner will sell Facebook servers, routers, and switches under a white box arrangement. Even with squeezed margins, the volume may make up the profit difference with Facebook as a customer. The other reason vendors play well with Facebook: they can learn new approaches from the ecosystem and then add their value-added intellectual property to it.

Now we all know what's in it for Facebook. By collaborating with the major datacenter and telecom players, Facebook can influence the next-generation infrastructure to enable everything from artificial intelligence and machine learning (yes, the company open sources a lot of that too) to Oculus virtual reality advertising.

However, the argument is easy to make that Facebook's approach to influencing enterprise infrastructure will have far more pros than cons.

From:http://www.zdnet.com/article/how-facebook-is-using-its-cloud-clout-to-design-your-network-data-center/

A new censorship tool developed by Facebook could get the social media giant back into China after a seven-year ban.

Facebook has developed a censorship tool that could allow the social media site back into China after a seven-year ban, according to reports.

According to The New York Times, the software suppresses posts in specific geographies from appearing in users' news feeds. The company will offer the software to a third party, which will then monitor popular stories and topics, and will have full control over whether they show up in users' news feeds.

Facebook employees, who wished to remain anonymous, stressed that the software is one of many solutions the company has considered to get back into China, and it may not see the light of day, according to the report.

Facebook's founder Mark Zuckerberg has also met with top internet executives in the country, including China's propaganda tsar Liu Yunshan, in an effort to strengthen exchanges and mutual understanding with internet companies there.

"We have long said that we are interested in China, and are spending time understanding and learning more about the country," Facebook spokeswoman Arielle Aryah said in reports. "However, we have not made any decision on our approach to China."

China banned the social media giant in July 2009 in an effort to restrict the flow of information about ethnic unrest following the Urumqi riots that left 140 people dead. Despite this, there are a number of users in the country who are said to circumvent the country's firewall through the use of virtual private networks (VPNs) such as Astrill.

Reports circulated three years after the ban that there were over 60 million Facebook users in China who still used the social media site through the use of proxies and VPNs; however, Facebook's own statistics had the figure at around 600,000 registered users in China.

Last year, China revamped its internet filter to make it more difficult for users to work around the ban. A senior official at the Ministry of Industry and Information Technology at the time said the move was designed to foster the "healthy development" of the internet in China.
Social media in China is largely dominated by Baidu, Tencent's WeChat, and Sina Weibo, the latter of which has around 100 million daily users.

Google's Gmail service was also blocked in China in December 2014 as part of efforts to further regain control over its citizens' access to content.

Earlier this week, Zuckerberg detailed Facebook's plan to prevent fake news from circulating the site, including stronger detection to classify misinformation, easier reporting for users to catch misinformation faster, third-party fact checking, flagging more stories, disrupting the fake news economy, and improving the quality of related articles.

"The bottom line is: We take misinformation seriously," Facebook's chief explained. "Our goal is to connect people with the stories they find most meaningful, and we know people want accurate information. We've been working on this problem for a long time and we take this responsibility seriously. We've made significant progress, but there is more work to be done."

In China, spreading fake news on social media platforms such as Weibo and WeChat can result in criminal punishment of between three to seven years of jail time, as stipulated by an amendment made to Chinese law in November last year.

With AAP

From:http://www.zdnet.com/article/new-software-could-get-facebook-back-into-china-report/