When we think about privacy and who can access our location data, we’re often focusing on our phones and not on the machine that actually takes us places: our car. A recent report from NBC News goes into just how much data is collected by our vehicles and how it can be used by police and criminals alike.

Your car, depending on how new it is and what capabilities it has, could be collecting all sorts of data without your knowledge – including location data, when its doors were opened, and even recordings of your voice. The NBC article uses the example of Joshua Wessel, a man charged with murder because the victim’s truck has a recording of his voice at the time of the killing. The report also looks at a company called Berla Corp., which has built a business out of extracting that data on behalf of the police.

In broad strokes, it’s hard to guarantee any kind of data protection, simply because cars collect so much sensitive data. Berla’s software boasts the ability to read the unique IDs of Bluetooth and Wi-Fi devices that have connected to a car’s infotainment system, as well as call logs, contacts, and text messages. But infotainment data isn’t all it can read – it can also look at the logs kept by the car’s internal computer, revealing when specific doors were opened, as well as providing a location log from its built-in GPS.

It’s not just the police that can get at this information. NBC mentions an Australian man who used an app to access live data from his ex-girlfriend’s Land Rover. Not only was he able to access live information about the car, but he was also able to control it, remotely turning it on and off and opening windows.
​
The heart of the problem is that we’re sharing our private data with more and more devices, and the systems we rely on to keep that data safe are getting more complicated. If we really want to deal with the issue, we may have to take a hard look at our cars and start thinking about how much data they need.

Cybersecurity firm FireEye has recently released a report detailing the techniques used by the SolarWinds hackers inside the networks of companies they breached.

With the report, FireEye researchers have also released a free tool on GitHub named Azure AD Investigator that they say can help companies determine if the SolarWinds hackers (also known as UNC2452) used any of these techniques inside their networks.

Today's FireEye report comes as the security firm has spearheaded investigations into the SolarWinds supply chain compromise, together with Microsoft and CrowdStrike.

The SolarWinds hack came to light on December 13, 2020, when FireEye and Microsoft confirmed that a threat actor broke into the network of IT software provider SolarWinds and poisoned updates for the Orion app with malware.

The malware, known as Sunburst (or Solorigate), was used to gather info on infected companies. Most of the 18,000 SolarWinds customers who installed a trojanized version of the Orion app were ignored. Still, for some selected targets, the hackers deployed a second strain of malware known as Teardrop. They then used several techniques to escalate access inside the local network and the company's cloud resources, focusing on breaching Microsoft 365 infrastructure.

In its 35-page report, FireEye has detailed these post initial compromise techniques, along with detection, remediation, and hardening strategies that companies can apply.

Summarized, they are as follows:

1. Steal the Active Directory Federation Services (AD FS) token-signing certificate and use it to forge tokens for arbitrary users (sometimes described as Golden SAML). This would allow the attacker to authenticate into a federated resource provider (such as Microsoft 365) as any user, without the need for that user's password or their corresponding multi-factor authentication (MFA) mechanism.
2. Modify or add trusted domains in Azure AD to add a new federated Identity Provider (IdP) that the attacker controls. This would allow the attacker to forge tokens for arbitrary users and has been described as an Azure AD backdoor.
3. Compromise the credentials of on-premises user accounts synchronized to Microsoft 365 that have high privileged directory roles, such as Global Administrator or Application Administrator.
4. Highjack an existing Microsoft 365 application by adding a rogue credential to it to use the legitimate permissions assigned to the application, such as the ability to read email, send email as an arbitrary user, access user calendars, etc., while bypassing MFA.

"While UNC2452 has demonstrated a level of sophistication and evasiveness, the observed techniques are both detectable and defensible," FireEye said.

FireEye's ability to detect these techniques inside its network led to the company investigating an internal breach and then discovering the broader SolarWinds incident.
​
Similar tools to the one FireEye released today have also been released by the US Cybersecurity and Infrastructure Security Agency (called Sparrow) and CrowdStrike (called CRT).

The Defense Advanced Research Projects Agency (DARPA) wants to invest in new materials and processes that could enable manufacturing in space and on the moon’s surface.

To that end, the agency is launching the Novel Orbital and Moon Manufacturing, Materials and Mass-efficient Design program, or NOM4D.

“NOM4D’s vision is to develop foundational materials, processes, and designs needed to realize in-space manufacturing of large, precise, and resilient Defense Department systems,” said Bill Carter, program manager in DARPA’s Defense Sciences Office.

DARPA said it is launching the program in response to the natural limitations of rocket launches in placing larger structures and systems in orbit. While the launch industry has expanded significantly in recent years, with dozens of new launch providers entering the fray, rocket launches are inherently limited – even the largest rockets have weight and volume restrictions. The solution? Place smaller pieces of a structure on-orbit with multiple launches, and then assemble them in space. Or better yet, collect materials from the moon to build with.

“We will explore the unique advantages afforded by on-orbit manufacturing using advanced materials ferried from Earth,” Carter said. “Large structures such as antennas and solar panels can be substantially more weight-efficient and potentially much more precise. We will also explore the unique features of in-situ resources obtained from the moon’s surface as they apply to future defense missions.”

Manufacturing in space could also enable more flexibility in designing space systems. Today, most satellites are designed to be as compact as possible to be integrated with and launched on rockets. But by assembling systems in space, systems can be designed without some of those volume restrictions, allowing them to be more mass efficient.

“We’re looking for proposers to come up with system designs that are so mass efficient that they can only be built off-earth, and with features that enable them to withstand maneuvers, eclipses, damage, and thermal cycles typical of space and lunar environments” Carter said. “Given the constraints of ground test, launch, and deployment, the traditional approach to designing space structures is not likely to result in dramatic improvements in mass efficiency. To take the next step, we’ve got to go about materials, manufacturing, and design in a completely new way.”

The idea of assembling systems and structures in space isn’t exactly new. Famously, the International Space System was assembled in space using several components individually launched into space.

“People have been thinking about on-orbit manufacturing for some time, so we expect to demonstrate new materials and manufacturing technologies by the program’s end,” Carter added.

With NOM4D, DARPA will work with participants over three 18-month phases to develop precise, mass efficient structures that could be used for on-orbit construction. Each phase will focus on one of three applications: Large solar arrays, large radio frequency reflector antennas, and segmented infrared reflective optics.
​
The agency is hosting a proposers day webinar on Feb. 26 and expects to release a Broad Agency Announcement (BAA) solicitation later in the month.

The shift to digital work and play from home, hastened by the pandemic, has wreaked havoc on commercial real estate. But experts say it has also generated one surprising bright spot for the industry: data centers.

The growing reliance on cloud-based technology – and the huge, blocky buildings that house its hardware – has created greater opportunities for developers and investors as businesses and consumers gobble up more data in a world that has become increasingly connected.

“Our houses are connected, our cars are connected, our streetlights and parking meters are connected, and every single one of those connections is passing data back and forth,” said Sean O’Hara, president of the exchange-traded funds’ division at Pacer Financial, an investment advisory firm in Malvern, PA.

Companies that provide data storage are preparing for even greater demand as new technologies like 5G, and artificial intelligence become more widely used.

“Our business has continued to grow through the pandemic,” said Nelson Fonseca, chief executive of Cyxtera. This company owns 62 data centers across the United States and five markets in Europe and Asia. “It actually accelerated all the drivers that were growing the industry in the first place.”

Mr. Fonseca said Cyxtera, which typically leases space in its centers for three-year contracts, was on the hunt for new markets. “We’re seeing demand across the board,” he said. “Our pipeline going into 2021 is even larger.”

The acceleration of existing consumer behaviors and workforce trends has driven companies to demand more space for their data, said Patrick Lynch, senior managing director of the data center solutions group at the real estate services and investment firm CBRE.

“Things like working from home and online shopping and distributed workforces all just layered into the momentum the industry had,” he said.

And investors have taken note. “Over the past 90 days, we’re seeing a massive shift in capital toward this industry by big investment funds,” said Andy Cvengros, senior vice president and a member of the technology solutions practice at JLL, a real estate services, and investing company.

In October, Goldman Sachs announced an investment of up to $500 million in data center infrastructure, and the private equity firms Blackstone and KKR have recently announced data center investments.

Real estate investment trusts focused on data centers delivered returns of 19% in the first half of 2020 – one of only two real estate investment trust (REIT) sectors that showed growth, according to a recent report by JLL. (The other sector, industrials, yielded a modest 2% return.) By comparison, returns for hotel and resort REITs plunged 49%, those for retail fell 37%, and office space dropped 25%.

“It’s an acknowledgment that this is not a niche real estate market anymore,” Mr. Lynch said.
​
Data centers have emerged as a critical part of the digital infrastructure that connects people and businesses to one another and the rest of the world, said Jon Lin, president for the Americas region at Equinix, one of the largest global data center companies.

It may sound cliche, but we’re officially in the digital economy.

“If you’re feeling whiplash, it might be the ten years forward we just jumped in 90 days’ time.” This is how the final McKinsey & Companies quarterly briefing of 2020 began, which was fittingly dubbed “The Quickening” — a stunning glimpse into the meteoric rise of all things digital. 

Their research found that eCommerce penetration in the United States had experienced ten years of growth in the first quarter of 2020 alone. 

That number is only increasing. If you’re a business owner or an aspiring entrepreneur, you must have a digital-first strategy if you want to succeed.

Entrepreneurs have learned that you must pay attention to emerging trends and consumer behavior.

You need every advantage you can get in changing economies and market downturns. It means taking advantage of opportunities, trends, and technologies to which your competitors are not yet paying attention.
Here are three emerging mega-trends you need to understand.

The No-Code Revolution. Building software has traditionally required technical expertise or significant investment in a development team.

According to PayScale, the average annual salary for a single React engineer (a popular front-end development framework) is $92,020. These hurdles meant that lots of budding entrepreneurs with great ideas were stuck dead in their tracks in the past.

Enter the “no-code” revolution.

Tools like Bubble.is, Airtable and Glide help level the playing field by allowing anyone regardless of programming knowledge to build a fully-fledged web or mobile application with drag-and-drop components and visual interfaces.

Using these tools, business owners or team members can unlock innovation and improve efficiency in even the smallest of companies – without using any code.

The Rise Of The Bots. According to Juniper Research, retail sales resulting from interactions with chatbots are forecast to nearly double every year – reaching $112 billion by 2023.

Juniper anticipates that retailers who don’t take note and implement bots in their business will face substantial challenges from more technologically inclined disruptors.

While somewhat in their infancy in the west, globally, bots are big business. 

In China, a significant portion of commerce happens through bots via the WeChat app. According to Tencent’s Q4 2019 financials, the number of commercial transactions happening on their app reached 1 billion per day.

Bots are growing rapidly here in the western world, too, with venture capital firms pouring huge amounts of money into bot-driven companies like Drift and Intercom.

Bots can be used to drive sales, collect leads, help solve customer problems without human interaction (increasingly important as more and more consumers shop online), or can even be used as fun engagement tools – think text-based adventure games – to keep an audience sticking around.

Voice Apps Are Radio 2.0. Podcasts are booming. In 2020, Spotify sent earthquakes through the tech world when they announced they would be signing leading podcaster Joe Rogan to an exclusive deal worth $100 million.

Online listening has doubled over the last ten years, reaching 70% of the United States, while the 2020 Infinite Dial study recorded an incredible 100 million monthly podcast listeners.

But it’s not just podcasts. Looking ahead, there’s a new wave of voice apps on the horizon.

The first to make a big splash has been the audio-only Clubhouse, which Vogue called “the new FOMO-inducing social app to know”. 

You can think of Clubhouse as a real-time version of a podcast. Nothing is recorded, and there’s nothing you can do in the app other than listening to or joining in with the conversation.
​
The no-code revolution, automated bots, and the rise of audio are three things that any business can take advantage of to increase efficiency, drive innovation, and build lasting relationships with end customers, clients, and consumers.

Amazon, Google's parent Alphabet, and UPS all hope to one day deliver large amounts of goods by drone. New US government rules have cleared some hurdles to make that dream a reality.

The Federal Aviation Administration finalized new rules for small, unmanned drones that could pave the way for expanded commercial uses of the vehicles, including delivery services.

For the first time, the FAA will allow small commercial drones to fly short distances over people and at night without a waiver. Small drones will also be permitted to fly over moving vehicles under limited conditions.

In a change from a previously proposed draft of the rules, drone operators must also have their remote pilot certificates on their persons and ready to be displayed if challenged by the authorities.

The rules apply to drone operators who use their unmanned aircraft for work or business under the FAA's Part 107 regulations. As many as 1.7 million drones have been registered with the FAA, as well as more than 203,000 drone pilots, the agency said. 

"The new rules make way for the further integration of drones into our airspace by addressing safety and security concerns," said FAA Administrator Steve Dickson. "They get us closer to the day when we will more routinely see drone operations such as the delivery of packages."

The agency said it submitted the rule changes to the Federal Register and expects them to be published in January. The new regulations will take effect 60 days after publication.

The new rules mark a significant step forward by the US government toward a future of commercial drone deliveries, a vision outlined by Amazon as far back as 2013. Since then, the FAA's development of drone regulations has progressed in fits and starts, prompting critics to worry that other countries could pull ahead and gain a critical first-mover advantage in drone-based commerce. 

Industry advocates said there are still many steps ahead before that drone delivery can go mainstream in the US – such as opening up the rules to allow routine drone flights beyond an operator's visual line of sight. 
Those types of expanded operations "are critical to fully realizing the promise of [drone] technology to deliver innumerable economic and societal benefits," said the Small UAV Coalition, an industry advocacy group.
​
Last year, UPS and Wing — a sister company to Google — became the first companies to gain FAA approval to operate a drone airline. In August, Amazon received the same approval certificate. Amazon has set a goal of completing drone deliveries within 30 minutes or less of an order being placed. 

The COVID-19 pandemic accelerated a trend that was already well underway: employers letting their workers perform their jobs remotely, from home, most or all of the time. But even if you and your employer both know exactly where you live and work, you may be surprised to learn that state departments of taxation can have some very different ideas about where "here" is. As a result, Texans, Utahns, and Arkansawyers who work for New York- or Massachusetts-based companies will have income taxes withheld from their paychecks, even if they've never set foot in the home office.

In the wake of the pandemic, dozens of major companies are embracing employees' desire to stay remote, increasing their support for working from home permanently. Some businesses have even closed offices or let leases lapse, counting on a physically distant, flexible workforce to reduce their real estate needs.

In many ways, this can be a win/win: employers can save overhead costs on expensive square footage in high-demand cities, and employees can save time and money by skipping the commute and dialing in from, basically, anywhere they want. New York, San Francisco, and Los Angeles are expensive; maybe you want to move to Montana and dial in from the woods or get a nice little ocean-view place in Florida. Unfortunately, as far as the state is concerned, your beachside cabana may as well be squarely in the middle of Manhattan, and you will be taxed as such.

Even before COVID, living in one state but working in another was common in many of the biggest US metropolitan areas. Many commuters into New York live in New Jersey or Connecticut, for example, and vast numbers of workers in Washington, DC live in Maryland, Virginia, or sometimes even farther out in Pennsylvania, West Virginia, or Delaware. Kansas City sprawls into both Kansas and Missouri, so traveling across city limits can mean crossing state lines. Any major city near a border likely has loads of workers that saunter over that line every day.

From a tax perspective, that's tricky because both the state where you perform a job and the state where you actually live are going to want to try to tax your income. Still, only one state at a time can, and most jurisdictions with a lot of overlap have agreements worked out with their neighboring states that make it easy for workers to take state withholdings and pay state tax where they live. (I, for example, only had to fill out one short form when I worked in downtown Washington, DC to make sure my taxes were properly withheld across the river in Virginia.) 

However, the increase in remote work means as offices downsize, some employees are now migrating to areas of the country where there are not tax agreements in place, leaving individuals to try to muddle through multiple states' tax codes on their own. Even more challenging: states are losing money hand-over-fist due to the pandemic and are likely to be more aggressive about chasing down every dollar they can claim.

Seven states – Arkansas, Connecticut, Delaware, Massachusetts, Nebraska, New York, and Pennsylvania – have so-called "convenience" rules on the books that require any work performed for an employer based in their state to be taxed as if the worker performing the job is in their state, no matter where the employee is located. Those states are still attempting to collect tax from telecommuting workers, and other states are fighting back.
​
New Hampshire,  one of nine states that do not have an income tax, is suing neighboring Massachusetts over its convenience rule. Four other states – New Jersey, Connecticut, Hawaii, and Iowa – are supporting the suit.

At least 80% of cybersecurity failures involve direct attacks on users' passwords, the World Economic Forum warns. This is a problem that's not going away any time soon. For Microsoft, as it explains in an official blog post, the solution may lie in a passwordless future, and it's hoping to ramp it up next year.

Whether it's storing personal information about addresses, finances, and highly private records, or running companies entirely virtually, the internet is where people live a good deal of their lives. And these people rely on passwords to guard their data and information against malicious actors. In response to hackers, some experts encourage the use of two-factor authentication, but that still isn't airtight.

"Passwords are a hassle to use," it notes, "and they present security risks for users and organizations of all sizes, with an average of one in every 250 corporate accounts compromised each month."

Security keys. For years now, Microsoft has been nudging people to adapt to a passwordless virtual landscape. To dispense with passwords without compromising security, the company offers physical encryption devices like the FIDO2 security key to open Hybrid Azure Active Directory Windows 10 devices.

Biometrics. Apart from security keys, Microsoft also emphasizes the need to try other techniques, like using biometric data to open devices as they do with mobile phones: fingerprints, iris scans, or Apple-style Face ID systems.

Biometric security measures come with their share of privacy concerns, though. But Microsoft is nonetheless eager to encourage a transition to biometrics and FIDO2 security keys. Because those are still more difficult to manipulate and compromise and less susceptible to the social engineering that so often sees passwords come undone.

The company wants this passwordless paradigm to be able to transcend different environments. Users should be able to, for instance, gain access to laptops and cloud-based apps with the same information that would let them access company buildings. Of course, this sort of cross-device and environment security makes ensuring it can't be compromised all the more critical.

Microsoft says its research has found that people are very open to the idea of ditching passwords for good. "Passwordless usage in Azure Active Directory is up by more than 50% for Windows Hello for Business, passwordless phone sign-in with Microsoft Authenticator, and FIDO2 security keys," according to the blog post.
​
But if this passwordless strategy is to become common and reliable in everyday use, Microsoft will have to go beyond its own users and bring rivals like Google and Apple on board, too. That could still take a little convincing.

Many Americans are very frustrated that they have to pay a mandatory router rental charge every month as part of their ISP bill. It gets added even if you purchase and use your own router in many cases. But as of Dec. 20, the practice is now illegal, and you can demand your ISP stop the charge.

As The Verge reports, your ISP can still charge for a router sent to a customer, but that customer should be able to return the router, have the fee canceled, and supply their own router instead. The charge is typically $10 a month, so the cost of buying a router is soon recouped. A good budget router can cost less than $50, meaning you'll start seeing the benefit of money saved in less than six months.
​
Don't expect ISPs to take the initiative here and cancel the fee automatically. If you are already using your own equipment, contact your ISP and demand that the fee is stopped. Send them a link to the bill if they protest. Alternatively, if you are using the equipment supplied by your ISP, do some research, see if there's a good alternative available and check the process for returning the ISP-provided equipment before attempting to cancel the fee. You want to avoid any internet downtime, especially as we are all so reliant on the internet for communication right now.

In the near future, your phone may take its 5G signal from the sky instead of a nearby mast on the ground. It's an innovative way to solve the problem of increasing connectivity without relying on thousands of terrestrial cell towers. The concept is known as a High-Altitude Platform Station (HAPS), and it essentially takes the cell tower from the ground and puts it in the sky.

The latest HAPS project to be unveiled is from Great Britain – Stratospheric Platforms and Cambridge Consultants. Recently, the pair revealed the core of its efforts, a special antenna and crewless aircraft, which it has been working on confidentially for the last four years.

How will it work? Instead of talking to a nearby tower to get its signal, your phone talks to a three-square-meter antenna attached to hydrogen-powered aircraft with a 60-meter wingspan, flying at an altitude of 12 miles (20 kilometers). The aircraft, or HAP, is expected to stay aloft for at least a week, all the while providing 4G LTE and 5G network coverage over an area of about 86 miles (140 kilometers).

Phones don't give off a powerful signal, hence the antenna array's size on the aircraft, which has 4,000 radios working together inside it. The processing power is similarly immense, helping to steer and direct the beams toward the ground even when the aircraft is shifting around. The cooling system has to work at high altitudes, minimize drag, and keep the weight manageable. It's an exciting piece of technology in itself.

The aircraft itself, which is made of a composite material, has already been certified for use, so it's deemed safe and ready for flight in civil airspace. There's no pilot, and ground-based operators will only be involved during takeoff and landing. The hydrogen power cell is not only environmentally friendly, as it only produces water vapor and emits very little noise, but it also gives off a lot of power — it has been tested to 50KW in labs already — for a long duration. That's a lot more than the low-power solar power systems used on other HAP vehicles.

HAPS systems are also expected to be cheaper to implement. Building each aircraft reportedly saves 70% over the costs of building and installing a traditional mast. Then there's the space-saving and logistical benefits. According to research quoted by the team, it's estimated that an impractical sum of 400,000 5G masts will be needed to cover the U.K., for example, and each aircraft could replace around 200 of those masts.

What can you expect from the connection? The aircraft should return a smooth Sub-6 5G beamed signal offering speeds of 100Mbits per second and 1m/s latency to devices connected to it, which don't need any special software or hardware modifications. While a fleet of HAPS aircraft could provide enough coverage for an entire country, what's very interesting is that the unique modular design of the antenna enables targeted coverage.

This means a signal from a part of the antenna could be focused on an individual area like a motorway or even a single vehicle driving on it. The team said a fleet of 60 aircraft could cover the U.K. in its entirety, and the idea is for networks to partner with dedicated "airlines" that operate the planes.

Potential problems. This new technology forces networks to rethink how they currently work. Network operators are already installing a 5G network using traditional masts. Convincing them to bypass this and adopt a sky-bound service will take a lot of work. However, the team calls its stratospheric network complementary to a traditional terrestrial network and says the costs involved will be temptingly less than creating a widespread 5G network using only ground-based masts.
​
When will it arrive? When can we expect to see Stratospheric Platforms HAPS system in operation? Deutsche Telekom is the project's initial investor and launch partner, and it has already tested an early version to show the system works. Stratospheric Platforms' aircraft is in preproduction now, with plans for the first prototype flight in 2022, while the antenna exists as a proof of concept and works with 3G, 4G, and 5G. It's anticipated the service will go live in 2024.