Author: azeeadmin

03 Jan 2019

Tencent AI Lab loses key executive

Chinese internet giant Tencent just lost a leading artificial intelligence figure. Zhang Tong, who previously worked at Yahoo, IBM and Baidu, has stepped down after directing Tencent’s AI Lab for nearly two years.

The scientist will return to academia and continue research in the AI field, Tencent confirmed with TechCrunch on Thursday, adding that it hasn’t appointed a successor.

”We are grateful for [Zhang]’s contributions to Tencent AI Lab and continue to explore fundamental and applied research that can make the benefits of AI accessible to everyone, everywhere,” Tencent said in a statement.

Zhang’s departure is the latest in a handful of top AI scientists quitting large Chinese tech firms. In 2017, search giant Baidu lost its chief scientist Andrew Ng who started Google’s deep learning initiative. Last year, the firm suffered another blow as renown AI expert Lu Qi resigned as chief operating officer and moved onto spearheading Y Combinator’s newly minted China program.

Talent is key to a tech firm’s AI endeavor, for a revered leader not only inspires employees but also boosts investor confidence. Baidu stocks plunged following Lu’s exit as markets weighed on the talent gap inside the company, which had poured resources into autonomous driving, smart speakers among other AI efforts. Tencent itself had poached Zhang from Baidu’s Big Data Lab to ramp up its own AI division.

Tencent is best known for its billion-user WeChat messenger and being the world’s largest video game publisher, but it’s also been doubling down on machine learning R&D to serve users and enterprise clients. It launched the AI Lab in April 2016 and opened its first U.S. research center in Seattle a year later to work on speech recognition and natural language processing (NLP).

The AI Lab dives into machine learning, computer vision, speech recognition and NLP. Meanwhile, the social and entertainment giant also works to put fundamental research to practical use, applying AI to its key businesses — content, social, online games and cloud computing.

One beneficiary has been WeChat, which applies NLP to enable seamless dialogues between users speaking different languages. Another case in point is Tencent’s news aggregator Tiantian Kuaibao, which deploys deep learning to recommend content based on readers’ past preference. Kuaibao is a direct competitor to Jinri Toutiao, the popular AI-powered news app run by TikTok’s parent company ByteDance.

To date, Tencent’s AI Lab has a team of 70 research scientists and 300 engineers, according to information on its website. Tencent operates another AI initiative called the Youtu Lab, which focuses on image understanding, face recognition, audio recognition and optical character recognition. While its sister AI Lab falls under Tencent’s research-focus Technology Engineering Group, Youtu is the brainchild of the Cloud & Smart Industries Group, a new unit that Tencent set up during its major organizational reshuffle in October to place more emphasis on enterprise businesses.

03 Jan 2019

China’s lunar probe makes history by successfully soft-landing on the far side of the moon

It’s not Lunar New Year yet, but there is something new on the moon. In a major milestone for space exploration, China announced that its lunar program has successfully soft-landed a probe on the far side of the moon, making it the first one to do so. The historic landing was reported by Xinhua, China’s official news agency, earlier today.

According to the China National Space Administration, the probe, consisting of a lander and rover, touched down at about 10:26AM Beijing time. This is the first ever soft-landing (meaning a landing without damage or destruction to the space vehicle) on the far side of the moon, which is never visible from Earth. Named after the Chinese moon goddess, Chang’e-4 launched on Dec. 8 from the Xichang Satellite Launch Center in Sichuan province.

The South China Morning Post reported earlier this week that the Chang’e-4 will be used for “astronomical observation using low-frequency radio, surveying the terrain and landforms, detecting the mineral composition and shallow lunar surface structure, and measuring neutron radiation and neutral atoms.” The successful soft-landing is important for space exploration because there is relatively little information about the far side of the moon compared to the side visible from Earth, which has been explored and surveyed by previous missions.

Photographs taken by earlier spacecraft, including the Soviet Union’s Luna 3 and Zond 3 (launched in 1959 and 1965, respectively) and NASA’s Lunar Orbiter program (launched in 1966), found significant differences between the far side’s terrain and the surface of the moon visible from Earth. In 1962, NASA’s Ranger 4 probe became the first spacecraft to impact on the moon, but was unable to send back data after landing.

Since direct communication between Chang’e-4 and Earth is blocked because of the probe’s position, China also launched a relay satellite called Queqiao, or Magpie Bridge, that is currently 400,000 km above Earth, positioned between it and the moon.

Chang’e-4’s successful landing concludes the second phase of the Chinese Lunar Exploration Program (CLEP). The first phase was the launch of Yutu, the lunar rover of Chang’e-3, which landed on the moon in December 2013, but stopped moving after 40 days due to a mechanical problem (it is still able to transmit data and photos, including true color high-definition photos). The successful landing of Chang’e-3 was another a significant milestone for China’s space program, making it only the third country after the U.S. and Soviet Union to soft-land on the moon. After Chang’e-4, the third and final phase of CLEP will be a returnable spacecraft called Chang’e-5. Set to launch by 2020, Chang’e-5 will be used to collect samples.

03 Jan 2019

Vengo, maker of touch-screen vending machines, just collected $7 million in fresh equity funding

Vengo, a six-year-old, Bethpage, New York-based startup that makes touchscreen vending machines for a wide variety of uses and clients, has raised $7 million in new equity funding, shows a new SEC filing.

That roughly doubles the amount of money the company has raised over the years, including from such notable investors as Brad Feld, Gary Vaynerchuk, Tony Hsieh, David Tisch, rap mogul Nas, and Joanna Wilson, among others.

Vengo makes wall-mounted mini-vending machines the size of large picture frames that it then sells to vending machine distributors, asking for a small fee per month in exchange for access to its software. Its customers then either advertise on the video screen that appears, or sell their products in Vengos. (It charges them an additional fee per month per product per machine.)

Each time a sale is made, both the customer and Vengo is notified via cloud-based inventory monitoring. Payments are cashless. And sensors allow automatic refunds if a product isn’t received.

The company first gained attention three years ago, when it competed on the ABC show “Shark Tank,” with cofounder and CEO founding Brian Shimmerlik walking away a deal for $2 million in venture debt, to be paid over three years at 7 percent interest, in return for 3 percent of the company.

Vengo’s machines sell six items at a time, generally electronics (think battery packs and cables at hotel kiosks), personal care products (Kiehl’s was among its earlier customers), and snacks, which it sells at colleges like New York University and at health clubs, among other places.

According to the outlet Inc., which runs an annual list of the 5,000 (!) fastest-growing private companies, Vengo ranked 620th this year, based on 2017 revenue of $3 million and three-year growth of 807 percent. Much of that growth has come from customers in its home state of New York, though the company has been steadily expanding its geographic footprint.

It’s bucking a broader trend, apparently. Overall, the vending machine market has been slowing owing to competition from convenience stores, supermarkets and micro markets. According to the market research firm IBISWorld, annual growth for vending machine operators between 2013 and 2018 was negative 2.9 percent.

03 Jan 2019

Lightspeed announces new $560 million fund for China

Global investor Lightspeed is starting 2019 with its largest-ever fund for China, where it has backed a number of new internet challengers. The firm announced this week that its fourth China fund has closed with a total capital commitment of $560 million.

The firm had a massive 2018, with no fewer than five of its portfolio holding IPOs including two of China’s up-and-coming startups that are challenging the country’s internet establishment — they are Meituan, the super app firm that specializes in deliveries, and Pinduoduo, a group e-commerce company that is threatening Alibaba’s dominance.

Based on those successes, it is perhaps not a surprise that Lightspeed has pulled in a record new fund. TechCrunch previously reported that the new fund was aimed at $360 million based on filings, but it added more capital to give more options.

Lightspeed said it has $360 million for early-stage deals aimed at Series A and Series B stages, with an additional $200 million set aside for “growth investments.” The new fund dwarfs Lightspeed’s previous vehicles in China — the firm’s previous two China funds each closed at $260 million while it raised $168 million for its debut fund in the country in 2013.

Lightspeed Venture Partners is a well-known investor that is anchored in Silicon Valley with global funds in India, Israeli and — of course — China. Together, those funds manage around $6 billion in capital, according to the firm.

Led by partners Chris Schaepe, Herry Han and James Mi, the China operation has backed a range of unicorns, including the aforementioned Meituan, which raised over $4 billion via a Hong Kong IPO last year, and Pinduoduo, which raised $1.6 billion via a U.S. listing in 2018. Other Lightspeed China IPOs from last year were PPDai, Rong360 and InnoLight while the firm also counts $9 billion-valued Full Truck Alliance, real estate platform Fangdd and Airbnb-like Tujia, both of which are valued in the billions, among the more mature bets in its portfolio.

“We believe there are plenty of new opportunities in China consumer Internet given the depth of China’s mobile payment and social networks. Innovation and entrepreneurship in the next decade will bring more China-based startups to the world stage. This will be China’s first decade of truly global innovation. Chinese entrepreneurs are now developing business plans with global expansion in mind from day one,” said Han, one of the firm’s founding partners, in a statement.

Last year, Lightspeed Venture Partners — the U.S. entity — filed to raise a record $1.8 billion in new capital commitments. In December, it added five new partners to its consumer and enterprise investment teams, including Slack’s former head of growth and Twitter’s former vice president of global business development.

03 Jan 2019

Senate confirms new FCC Commissioners Carr and Starks

The Senate has officially confirmed the incoming FCC commissioners, Brendan Carr and Geoffrey Starks have been officially confirmed by the Senate for their five-year terms. This completes the five-seat commission, which is required to be balanced between the two parties — today’s additions bring it to three Republicans and two Democrats.

Carr, nominated and previously confirmed in August of 2017 (though only just now for his full term), was an advisor to FCC Chairman Ajit Pai during his time as a Commissioner, and before that worked at a law firm that works with telecoms. He’s the Republican of the two.

Starks was nominated this last June and has worked in the FCC’s Enforcement Bureau (think fines and legal threats) and the Justice Department.

A tweet from the Senate Cloakroom account, operated by Republican staff on the floor there, shows a note that seems to have erroneously confused the two: according to the note, Carr’s term starts in 2018 and Starks’s in 2017, despite the fact that the latter wasn’t even nominated at that time, and 2017 is certainly when Carr actually began his duties. I’ve asked the FCC about this discrepancy and will update the post if I hear back.

Chairman Pai issued a statement welcoming both Commissioners to their positions:

I congratulate Geoffrey on his Senate confirmation.  He brings a wealth of experience and expertise, including having served most recently as Assistant Chief in the Enforcement Bureau.  During his confirmation hearing, I was excited to hear him highlight the need to expand rural broadband and the power of telemedicine.  I look forward to working with him and having a fellow Kansan on the Commission.

I also congratulate Brendan on his confirmation to a full term.  Brendan has done tremendous work on a number of issues, including his leadership on wireless infrastructure modernization.  He has also been a staunch advocate for rural broadband deployment, particularly for precision agriculture and advancements in telemedicine.

Commissioners Carr, O’Rielly, and Rosenworcel all tweeted out welcomes as well:

A full Commission means more work gets done, since these people and their staffs have to come up with and enforce all the rules on the books. It maybe politically expedient to have a 2:1 Republican majority on the Commission when taking controversial measures like rolling back net neutrality rules, but ultimately the job to be done needs five.

02 Jan 2019

Magic Leap and other AR startups have a rough 2019 ahead of them

Very rarely does an early technology garner such an air of inevitability like AR has in the past few years.

2018 was supposed to be a year where the foundational tech for augmented reality was built out a bit and the industry took a couple big leaps. Things started off well-enough, but momentum really doesn’t seem be on the side of some of the industry’s heaviest hitters heading into 2019, suggesting that life for earlier-stage startups may not be much easier.

There are plenty of reasons to be long-term bullish on AR, but the time horizons some have espoused seems to be bogus and pitch decks organized around a near-term spike in phone-based or glasses-based users are going to have a tougher time being taken seriously in 2019.

The ghost with the most

For all of the AR advances made this year, the company most emblematic of AR’s numerous challenges was clearly Magic Leap .

The company spent the past few years trashing industry standards and lauding their own approaches with braggadocio, but ended up releasing a product that largely iterated on its competitors. With the release of their “developer kit” this year, a product that clearly seems to have stopped being a first-gen product only when the reality of the climate availed itself, the startup seems to be finding that optics and infra progress is going to come more slowly than foretold.

I’ve talked to more than a few people who think Magic Leap hindered progress in the AR industry by siphoning investor attention and discouraging other hardware startups from joining the fray in the face of a billions-backed unknown. But in 2019, there are fewer available plays for the funding juggernaut. They spent years trying to distinguish themselves from the corporate mission of Microsoft and their HoloLens headset; now it seems they’ve begun to see that the only hope of justifying their sitting valuation in the next few years is enlisting support from the big customers that MSFT is chasing, as opposed to single-handedly birthing a consumer market. Magic Leap recently lost a bid to Microsoft for a $480 million military contract to outfit troops with AR headsets, and as Microsoft prepares to release a second-generation HoloLens with the enterprise in full concentration, it seems like Magic Leap is going to reshuffle its deck.

Dead-on-arrival content plays

Magic Leap’s struggles are well-documented, but what plagues the overall AR industry seems less discussed.

The consumer appetite for phone-based AR content is obviously lacking. Even Apple’s reality distortion field isn’t enough to convince people that its ARKit releases have led to anything other than some weird experimentation for iOS users. Few Android OEMs are boasting about compatibility with Google’s ARCore platform anymore, suggesting that approachable hardware standards for device makers wasn’t all that was missing from the failed Tango brand.

The most apparent mobile AR opportunities are probably in user-generated content, but there seems to be a disconnect between platforms and users in terms of how complex these AR experiences can and should become. At this point, selfie masks still seem to be at the edge of users’ comfort levels, leaving a lot of solved tech problems stuck in limbo waiting for a problem that makes them worthwhile.

Niantic is probably one of the most revenue-heavy startups dabbling in phone AR, even if it is a bit of a false idol for the industry. Nobody seems to think of Niantic as a capital-A augmented reality startup, but it’s clear that the team behind Pokémon GO sees the technology as a not-fully-tapped reservoir of potential for future gaming experiences that feel more social and more immersive than any mobile RPG that’s sucking up the majority of your playtime today. The company’s new Harry Potter title still doesn’t have a release date, we haven’t seen any gameplay, but we do know that AR plays a part in the title in some capacity. We’ll see if they figure out things the rest of the industry hasn’t.

Platform tech opportunities

Part of this broader content pain is the fact that some known platform fundamentals are still getting tackled. In 2018, the startups in AR that were raising the most buzz were so-called “AR cloud” startups, teams that were largely focused on solving more fundamental back-end problems around localization and mapping. It turns out “simple” problems like getting a bunch of users in a single session or keeping track of objects you’ve moved around between sessions are actually incredibly complex.

A big issue is that AR fundamentally relies on a level of spatial understanding that goes far beyond grasping geometry. For all the ground that has been traversed by computer vision researchers this year, issues like segmenting environments by objects and accurately identifying them are still in the earliest stages. When you think of AR tech as a subset of vision problems, you realize that products today are being approached in a kind of bizarre manner.

Google has been making worthwhile movements in proliferating their Lens computer vision engine across new apps and devices. In a very roundabout way, the company seems to have come to the worthwhile perspective that mapping an environment spatially doesn’t really help that much if you can’t parse the contextual nuances of what the camera is actually looking at, as well.

A lot of the AR startups in this space have raised some cash on the backs of the smartphone AR trend and the hundreds of millions of potential users, but it still seems pretty dubious whether this market has legs. Fortunately, most of these solutions have wide applicability across future industries like robotics and autonomous vehicles, helping computers interface with the real world through visual and geographic cues, but their utility might not be as ripe as they’d hope.

This is an area where Magic Leap could be poised to find some relatively near-term success. The startup’s top brass spent a hefty amount of time at their developer conference talking about the “Magicverse,” basically their vision for bringing localized AR layers onto geographic spaces where users with Magic Leap glasses could observe the content. Without having taken a peek at the tech they’re working with, their biggest advantage seems to rely on their partnership with AT&T, which is poised to start working more seriously with 5G in 2019.

The back end still remains a much more exciting market than hardware in 2019, but there may still be some interesting movement with devices this year. I don’t trust most of the predictive data that exists surrounding headset sales, so I’m not even going to reference it; suffice to say that AR headset sales aren’t going to explode anytime soon.

North Focals

More conservative AR hardware

One trend that I am curious to see shake out is the more simplistic version of AR where the glasses basically just offer users a heads-up display for notifications and lightweight apps.

Companies like North and Vuzix have been talking a lot about their work here. Apple’s rumored AR glasses have been talked about for ages at this point, with 2020/2021 seeming to be the rumor mill sweet spot for a release time frame. If that’s the case, I’d bet it falls more into this design ethos than a HoloLens type device. The hardware just isn’t small enough yet, but it is getting close, and there could be some interesting early ground that the industry could gain by moving in more heavily on traditional wearable use cases — though high component costs will be an early limiter as well.

This is probably a hardware space Snap has their eyes on; Spectacles jogged a lot of the current thinking on glasses-type wearables, but at this point, the company needs something that has wide appeal and can feed users back into its own app. The company isn’t in a position to hock something with razor-thin or non-existent margins, and it doesn’t gain that much from a product that sells a few thousand units in terms of building its platform.

Bottom line

For the Facebooks and Apples of the world, immediate market conditions and user interest obviously hold a different weight. U.S. investment firms with good track records spent a lot of time this year rejiggering their expectations for their first waves of investments. For the more ambitious privately held AR startups of the world, there’s probably going to be an issue with raising capital this year, as a lot of the top hardware companies have been seeking more free-flowing late-stage cash from Chinese firms, which have been growing harder to pin down as the trade climate worsens. This is going to be a problem for hardware companies especially.

For the most part, the BS is going to continue to get easier to parse this year.

Platform plays are going to have to dial in their target audience a bit more than “everyone with an AR-enabled phone”; more realistic expectations are something the industry should benefit from. ARKit and ARCore are going to level-up and game engine-makers are going to get better solutions for AR content creators. Back-end vision challenges are going to get solved and enable things like more seamless multi-player, but there are plenty of reasons why these tech problem solutions won’t lead to big changes in user behavior. Users failing to take off in the second year of some of these big platforms probably won’t dissuade Apple, but it definitely will dissuade some investors from continuing to bet big on the near-term future of mobile AR.

02 Jan 2019

Sorry that I took so long to upgrade, Apple

Apple had some bad news tonight. It was so bad in fact that it had to halt trading for a time while posting a grim report that its numbers would be lower than it had forecast at the last quarterly earnings report in November. Apple blamed faltering sales in Asia, particularly in China, for the adjustment, but I’m afraid it can lay at least part of the blame on me too.

You see I was part of the problem as well. On the bright side, I finally upgraded my iPhone this week. I had been using an old iPhone 6 that was over three years old. It had become crotchety with a bad battery life and the recharge cable wouldn’t say stuck without some serious coaxing. The phone had to be flat on a table, and would often disconnect if I even brushed against the cord or looked at it the wrong way.

I had been thinking about upgrading for several months, but I kept putting it off because the thought of spending $1000 for a new phone frankly irked me, and I had after all paid off my trusty 6 in full long ago. I was going to squeeze every bit of life out of it, dammit.

In spite of my great frustration with my old phone, it took the enticement of a $200 credit to finally get me to replace it, as I’m sure the promotion was intended to do. Just yesterday on New Year’s Day, I headed to my closest Apple Store and I finally did right by the company.

I replaced my ancient 6, but I did something else that probably hurt Apple as part of its death by a thousand cuts. I went into the store thinking I would buy the more expensive XS, but in the end I walked out with the lower-cost XR. I looked at the two phones and I couldn’t justify spending over $1000 for a phone with 256 GB of storage. I wanted a phone with longer battery life and a decent display and camera and the XR gave it to me. Yes, I could have gotten an even better phone, but in the end the XR was good enough for me, and certainly a huge upgrade over what I had been using.

Clearly lots of people across the world had similar thoughts, and one thing lead to another and before you knew it, you had a situation on your on your hands, one that forced you to halt the trading of your stock and report the bad news. The stock price is paying a price, down over 7 percent as I write this post.

So, sorry Apple, but it appears that there is a tipping point when it comes to the cost of a new phone. As essential as these devices have become in our lives, it’s just too hard for many consumers around the world to justify spending more than $1000 for a new phone, and you just have to realize that.

02 Jan 2019

The number of Alexa skills in the U.S. more than doubled in 2018

Amazon Alexa had a good year as a developer platform – at least in terms of the number of voice apps being built for Alexa, if not yet the monetization of those apps. According to new data published today by Voicebot, the number of Amazon Alexa skills in the U.S. more than doubled over 2018, while the number of skills grew by 233 percent and 152 percent in Alexa’s two other top markets, the U.K. and Germany, respectively.

Amazon began the year with 25,784 Alexa skills in the U.S., which grew to 56,750 skills by the end of 2018, said Voicebot. That represents 120 percent growth, which is down from the 266 percent growth seen the year prior – but still shows continued developer interest in the Alexa platform.

At this rate of growth, that means developers were publishing an average of around 85 skills per day in 2018.

Voicebot has its own method for tracking skill counts, so these are not Amazon’s own numbers, we should note. However, Amazon itself did say at year-end 2018 that its broader Alexa ecosystem had grown to “over 70,000” total skills across markets.

In the U.K., the number of Alexa skills rose 233 percent this year to reach 29,910 by year end. In Germany, the skill count grew by 152 percent to reach 7,869 skills. Canada had 22,873 skills as of the beginning of January 2019; Australia has 22,398; Japan has 2,364; and France has 981. (Voicebot says it hasn’t yet set up a system for counting the skills in India, Spain, Mexico or Italy at this time.)

Also of interest is that much of the skill growth occurred near year-end, ahead of the busy holiday season when Alexa devices became top sellers. In the U.S., U.K. and Germany, developers published 181, 84, and 37 skills per day, respectively, during the last two months of the year.

The firm also pointed out there is some debate over whether or not the growth in third-party skills even matters, since so many of them are virtually invisible – never discovered by end users or installed in large numbers. That’s a fair criticism, in a way, but it’s also still early days for voice-based computing. Developers who are today publishing lower-rated skills may be learning from their mistakes and figuring out what works; and they’re doing so, in large numbers, on the Alexa platform.

As to what sort of skills are actually striking a chord with consumers, Amazon itself recently shared that information.

It released a year-end list of Alexa’s “top” skills, which were selected based on a number of factors including customer reviews, engagement, innovation and more, Amazon told us.

Many of the top skills were games. And many had benefited from their association with big-name brands, or had been promoted heavily by Amazon, or both.

Among the top games were music skill Beat the Intro; Heads Up!, already a top paid iOS app from Ellen DeGeneres; National Geographic’s Geo Quiz skill; Question of the Day; Skyrim Very Special Edition; The Magic Door; Trivia Hero; World Mathematics League; Would You Rather for Family; and Volley’s roleplaying game, Yes Sire.

The non-game skills were focused on daily habits, wellness, and – not surprisingly, given Alexa’s central place in consumers’ homes – family fun.

These included kid-friendly skills like Animal Workout, Chompers, Kids Court, Lemonade Stand, and Sesame Street; plus habit and wellness skills like Chop Chop, Fitbit, Headspace, Sleep and Relaxation Sounds, Find My Phone, AnyPod, Big Sky, Make Me Smart, and TuneIn Live.

It’s interesting to note that many of these also are known app names from the mobile app ecosystem, rather than breakout hits that are unique to Alexa or smart speakers. That begs the question as to how much the voice app ecosystem will end up being just a voice-enabled clone of the App Store, versus becoming a home to a new kind of app that truly leverages voice-first design and smart speakers’ capabilities.

It may be a few years before we have that answer, but in the meantime, it seems we have a lot of voice app developers trying to figure that out by building for Alexa.

 

 

02 Jan 2019

FCC Chairman Pai celebrates failure to nullify his net neutrality repeal

As one Congress ends and another begins, many are looking forward to a rebalancing of power — especially in the House of Representatives, which Democrats handily retook in November. But FCC Chairman Ajit Pai is more pleased with what the House failed to do — namely, roll back his repeal of net neutrality rules.

To be fair, he does have reason to celebrate; no one likes to see their work undone. But a statement issued today tells a very selective truth about Congressional opposition to his master plan.

“I’m pleased that a strong bipartisan majority of the U.S. House of Representatives declined to reinstate heavy-handed Internet regulation,” Pai said. The “heavy-handed” remark is the usual boilerplate in reference to 2015’s rules, which used what the current FCC calls “depression-era” regulations to exert control over internet providers. That aspersion doesn’t really make sense, as I’ve noted before.

And the “strong bipartisan majority” bears a bit of explanation as well. Indeed, the Democrats fell about 30 short of the votes they needed to put the Congressional Review Act into effect and undo the FCC’s order. But that was only after the Senate, by a similar “strong bipartisan majority,” as Pai would no doubt put it, voted for the rollback. No mention of that in his statement.

In fact the CRA was a long shot from the beginning, but as Senator Brian Schatz (D-HI) told me shortly after the repeal, “it’s very important to try, and it’s important to get everybody in Congress on the record. We want every member of Congress to have to go on the record and say whether or not they agree with what the commission just did.”

Although there was no actual change to the rule, the forced votes of the CRA did succeed in exposing the stances of Senators and Representatives who had hitherto avoided the issue.

Pai followed this questionable bit of crowing with a litany of vague reasons the new rules should be kept. The internet, he points out, “has remained free and open. Broadband speeds are up… Internet access is also expanding, and the digital divide is closing.”

The former claim is, as always, being tested by internet providers, who continue to inject ads, block or throttle services, and otherwise interfere until customers and watchdogs call them out.

But the latter claim in particular would be disputed by many, especially since the FCC’s own numbers tracking broadband deployment in the U.S. have been widely mocked as inaccurate and sourced uncritically from an industry with a vested interest in overstating its own accomplishments.

Furthermore, it’s entirely unclear whether Pai’s new rules have had any positive influence at all. Broadband investment has in fact not been affected, despite a $2 billion tax break given to cable companies and a number of other sweetheart deals. The most likely explanation for any positive effects is investment planned or made years ago, perhaps as far back as the Obama administration and the previous rules.

On top of that, the new rules are under such close scrutiny and face several legal challenges that the industry would be foolish to let them affect their policies in anything but short term matters. As happened with the 2015 rules, these ones could be gone in a year or two, or — with the Senate bullish on real net neutrality rules and a flipped House — replaced with actual legislation.

02 Jan 2019

Google sat on a Chromecast bug for years, now hackers could wreak havoc

Google was warned of a bug in its Chromecast media streaming stick years ago, but did not fix it. Now, hackers are exploiting the bug — and security researchers say things could get even worse.

A hacker, known as Hacker Giraffe, has become the latest person to figure out how to trick Google’s media streamer into playing any YouTube video they want — including videos that are custom-made. This time around, the hacker hijacked thousands of Chromecasts, forcing them to display a pop-up notice that’s viewable on the connected TV, warning the user that their misconfigured router is exposing their Chromecast and smart TV to hackers like himself.

Not one to waste an opportunity, the hacker also asks that you subscribe to PewDiePie, an awful internet person with a popular YouTube following. (He’s the same hacker who tricked thousands of exposed printers into printing support for PewDiePie.)

The bug, dubbed CastHack, exploits a weakness in both Chromecast and the router it connects to. Some home routers have enabled Universal Plug and Play (UPnP), a networking standard that can be exploited in many ways. UPnP forwards ports from the internal network to the internet, making Chromecasts and other devices viewable and accessible from anywhere on the internet.

As Hacker Giraffe says, disabling UPnP should fix the problem.

“We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device,” a Google spokesperson told TechCrunch. “This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable,” the spokesperson said.

That’s true on one hand, but it doesn’t address the years-old bug that gives anyone with access to a Chromecast the ability to hijack the media stream and display whatever they want, because Chromecast doesn’t check to see if someone is authorized to change the video stream. (Google did not respond to our follow-up question.)

Hacker Giraffe sent this YouTube video to thousands of exposed Chromecast devices, warning that their streams could be easily hijacked. (Screenshot: TechCrunch)

Bishop Fox, a security consultancy firm, first found the bug in 2014, not long after the Chromecast debuted. The researchers found that they could conduct a “deauth” attack that disconnects the Chromecast from the Wi-Fi network it was connected to, causing it to revert back to its out-of-the-box state, waiting for a device to tell it where to connect and what to stream. That’s when it can be hijacked and forced to stream whatever the hijacker wants. All of this can be done in an instant — as they did — with a touch of a button on a custom-built handheld remote.

Two years later, U.K. cybersecurity firm Pen Test Partners discovered that the Chromecast was still vulnerable to “deauth” attacks, making it easy to play content on a neighbor’s Chromecasts in just a few minutes.

Ken Munro, who founded Pen Test Partners, says there’s “no surprise that somebody else stumbled on to it,” given both Bishop Fix found it in 2014 and his company tested it in 2016.

“In fairness, we never thought that the service would be exposed on the public internet, so that is a very valid finding of his, full credit to him for that,” Munro told TechCrunch.

He said the way the attack is conducted is different, but the method of exploitation is the same. CastHack can be exploited over the internet, while Bishop Fox and his “deauth” attacks can be carried out within range of the Wi-Fi network — yet, both attacks let the hacker control what’s displayed on the TV from the Chromecast, he said.

Munro said Google should have fixed its bug in 2014 when it first had the chance.

“Allowing control over a local network without authentication is a really silly idea on [Google’s] part,” he said. “Because users do silly things, like expose their TVs on the internet, and hackers find bugs in services that can be exploited.”

Hacker Giraffe is the latest to resort to “Good Samaritan security,” by warning users of the issues and providing advice on how to fix them before malicious hackers take over, where tech companies and device makers have largely failed.

But Munro said that these kinds of attacks — although obnoxious and intrusive on the face of it — could be exploited to have far more malicious consequences.

In a blog post Wednesday, Munro said it was easy to exploit other smart home devices — like an Amazon Echo — by hijacking a Chromecast and forcing it to play commands that are loud enough to be picked up by its microphone. That’s happened before, when smart assistants get confused when they overhear words on the television or radio, and suddenly and without warning purchase items from Amazon. (You can and should turn on a PIN for ordering through Amazon.)

To name a few, Munro said it’s possible to force a Chromecast into loading a YouTube video created by an attacker to trick an Echo to: “Alexa, order an iPad,” or, “Alexa, turn off the house alarm,” or, “Alexa, set an alarm every day at 3am.”

Amazon Echos and other smart devices are widely considered to be secure, even if they’re prone to overhearing things they shouldn’t. Often, the weakest link are humans. Second to that, it’s the other devices around smart home assistants that pose the biggest risk, said Munro in his blog post. That was demonstrated recently when Canadian security researcher Render Man showed how using a sound transducer against a window can trick a nearby Amazon Echo into unlocking a network-connected smart lock on the front door of a house.

“Google needs to properly fix the Chromecast deauth bug that allows casting of YouTube traffic,” said Munro.