AWS unveiled its plans to aid and accelerate the research of quantum computing at its Re:Invent conference on Monday.

The cloud giant announced three new services for testing, researching and experimenting with the technology.

The first of which was Amazon Bracket, a service that enables scientists, researchers, and developers to begin experimenting with computers from quantum hardware providers in a single place.

To go with Bracket is the AWS Centre for Quantum Computing which brings together quantum computing experts from Amazon, the California Institute of Technology (Caltech) and other academic research institutions to collaborate on the research and development of new quantum computing technologies.

And finally Amazon Quantum Solutions Lab, which is a program that connects customers with quantum computing experts and consulting partners to develop internal expertise aimed at identifying practical uses of quantum computing. The aim is to accelerate the development of quantum applications with meaningful impact.

There has been significant progress in quantum computing this year, particularly from IBM and Google, with both announcing large investments in the technology. The two made headlines in October after IBM discredited claims made by Google that its 53-qubit Sycamore processor had achieved «quantum supremacy».

Quantum computing refers to extremely powerful machines capable of processing massive swathes of data due to a reliance on the theory of quantum mechanics in the way they are constructed. For example, Google suggested its processor was able to perform a complex mathematical problem in 200 seconds, while the world’s most-powerful supercomputer would need 10,000 years to complete.

Despite the work of IBM, Google and now AWS, quantum computing is not quite a mainstream technology just yet, but according to AWS evangelist Jeff Barr, that time is coming.

«I suspect that within 40 or 50 years, many applications will be powered in part using services that run on quantum computers,» he wrote in a blog post. «As such, it is best to think of them like a GPU or a math coprocessor. They will not be used in isolation, but will be an important part of a hybrid classical/quantum solution.»

Facebook is letting users move uploaded photos and videos to Google Photos as part of a project enabling data portability. 

The new tool lets Facebook users bulk export all of their photos and videos to Google’s photo hosting service. So far, the tool is only available in Ireland, but is set to be rolled out more widely in the first half of next year. 

«At Facebook, we believe that if you share data with one service, you should be able to move it to another,» said Steve Satterfield, Director of Privacy and Public Policy at Facebook, in a blog post. «That’s the principle of data portability, which gives people control and choice while also encouraging innovation.»

Data portability is required under laws such as GDPR and the California Consumer Privacy Act; the data portability rules in the latter come into play next year, just as this tool arrives more widely. 

Transferring the data to Google Photos does not appear to delete it from Facebook, but you can move the images over to the rival digital provider and then delete your account. It’s worth noting that Facebook has long allowed users to download everything from their account, photos and videos included, and then they can, of course, be uploaded again to your digital host of choice, Google Photos or otherwise. 

Facebook said the photo transfer tool is just the first step, and its release is designed to be assessed by policymakers, academics and regulators, in order to help decide what data should be portable and how to keep it private and secure.

«We’ve learned from our conversations with policymakers, regulators, academics, advocates and others that real-world use cases and tools will help drive policy discussions forward,» said Satterfield. 

He added: «We are currently testing this tool, so we will continue refining it based on feedback from people using it as well as from our conversations with stakeholders.»

The photo tool is based on code developed at the Data Transfer Project, an effort launched in 2018 that includes leading tech companies including Microsoft, Twitter, Google and Apple. The aim is to develop an open-source data portability platform to make it easier for individuals using their products to shift to a new provider if desired. 

The tool will eventually be available via the settings section of «Your Facebook Information.» «We’ve kept privacy and security as top priorities, so all data transferred will be encrypted and people will be asked to enter their password before a transfer is initiated,» said Satterfield. 

Satterfield saying Facebook hoped to «advance conversations» on the privacy questions identified in the white paper, which included the need to make users aware of privacy terms at the destination service, the types of data being transferred, and to ensure it’s encrypted to avoid it being diverted by hackers. For example, should contact list data be portable, given it’s private information of other people? Satterfield called on more companies to join the Data Transfer Project to further such efforts, which will be welcome to everyone as, after a string of security and privacy concerns, Facebook might not be the most trusted service on such issues. 

Hackers have exploited Netflix’s data retention policies to reactivate cancelled customer subscriptions and steal their accounts.

Former subscribers say they noticed their accounts had been reinstated when they were charged a monthly fee, months after cancellation.

The hackers can log in to dormant accounts and reactivate them without knowing users bank details, according to the BBC.

This is due to the streaming service storing customer data, including billing information, for ten months after cancellation. This is to enable a speedy account recovery should a user wish to rejoin.

However, this is proving to be a benefit for hackers who just need an email address and password to reactivate an account.

Radio 4’s You and Yours programme spoke to Emily Keen who said she cancelled her subscription in April 2019 but was charged £11.99 by Netflix in September. She tried to log in to the account but found that email and password were no longer recognised as the hackers had changed her details and signed her up to the more expensive service option.

Keen contacted Netflix and was assured her card would be blocked and she would receive a full refund, but the streaming service went on to take two further payments in October and November.

Other users that have had their accounts mysteriously reactivated have hit out at the company on Twitter.

«Super disappointed with my @netflix customer service experience,» one user posted on the social media site. «Our account was hacked, supposed to have been deactivated, was reactivated by hacker, and continued to use our credit card. We were told to file chargeback and @netflix would not offer refund.»

Stolen Netflix login details have reportedly been found on sites like eBay, sold as «lifetime» accounts for as little as £3. The same issue was reported for Disney+ accounts just hours after the service launched in the US, with login details serfacing on hacking forums. 

Cloud Pro has approached Netflix for comment.

When the login details of an Uber engineer were exposed in 2016 – signalling one of the most high-profile breaches of recent years – the names and addresses of 57 million riders and drivers were left at the mercy of hackers. 

None of Uber’s corporate systems had been directly breached, though. Its security infrastructure was working as it should. Instead, the credentials were found buried within the code of an Uber developer’s personal GitHub account. This account and its repositories were hacked, reportedly due to poor password hygiene and the stolen credentials used to access Uber’s vast datastore. This breach, which Uber sat on for a year, resulted in a then-record-breaking $148 million fine.

Yet despite this public lesson in how not to handle private credentials, so-called company secret leakage is an everyday occurrence. 

The rise of secret leakage

Research from North Carolina State University found that in just six months between October 2017 and April 2018, more than half a million secrets were uploaded to GitHub repositories, including sensitive login details, access keys, auth tokens and private files. A 2019 SANS Institute survey found that half of company data breaches in the past 12 months were a result of credential hacking – higher than any other attack method among firms using cloud-based services. 

This is where GitGuardian comes in. 

Founded in 2017 by Jérémy Thomas and Eric Fourrier – a pair of applied mathematics graduates and software engineers specialising in data science, machine learning and AI – the Paris-based cybersecurity startup uses a combination of algorithms, including pattern matching and machine learning, to hunt for signs of company secrets in online code. According to the company’s figures, more than a staggering 3,000 secrets make their way online every day.

“The idea for GitGuardian came when Eric and I spotted a vulnerability buried in a GitHub repository,” CEO and co-founder Thomas tells Cloud Pro. “This vulnerability involved sensitive credentials relating to a major company being leaked online that had the potential to cost the firm tens of millions of dollars if they had got into the wrong hands. We alerted the company to the vulnerability and it was able to nullify it in less than a week.” 

“We then built an algorithm and real-time monitoring platform that automated and significantly built-upon the manual steps we took when we made that initial detection, and this platform attracted interest from GitHub’s own Scott Chacon as well as Solomon Hykes from Docker and Renaud Visage from EventBrite.” 

How the cloud is fuelling secret leakage

The problem of sensitive data leakage stems in part from the increasing reliance of software developers on third-party services. To integrate such services, developers often juggle hundreds of credentials with varying sensitivity, from API keys used to provide mapping features on websites to Amazon Web Services login details, and private cryptographic keys for servers. Not to mention the many secrets designed to protect data, surrounding payment systems, intellectual property and more. 

In the process of handling these integrations, more than 40 million developers and almost 3 million businesses and organisations globally use GitHub, the public platform that lets developers share code and collaboratively work on projects. Either by accident (in the majority of cases), or occasionally knowingly, these uploads have company secrets buried within them alongside the code that’s being developed. As was seen with the Uber breach, hackers can theoretically scour this code, steal credentials and hack company accounts all without the developer and their employer being any the wiser.

How GitGuardian plugs these leaks

GitGuardian’s technology works by first linking developers registered on GitHub to their respective companies. This already gives the company greater insight over who their developers are on GitHub and the levels of public activity they’re involved in. This is especially important for developers’ personal repositories because they’re completely out of their companies’ control, yet too often contain corporate credentials. 

Once linked, GitGuardian’s algorithms scrutinise any and all code changes, known as commits, made by these developers in real-time, looking for signs of company secrets. Such signs within these commits range from code patterns to file types that have previously been found to contain credentials.  

“Our algorithms scan the content of more than 2.5 million commits a day, covering over 300 types of secrets from keys to database connection strings, SSL certificates, usernames and passwords,” Thomas continues.

Once a leak occurs, it takes four seconds for GitGuardian to detect it and send an alert to the developer and their security team. On average, the information is removed within 25 minutes and the credential is revoked within the hour. For every alert, GitGuardian seeks feedback from its developers and security teams who rate the accuracy of the detection: were company secrets actually exposed or was it a false positive? Consequently, the algorithm is constantly evolving in response to new secrets and how they are leaked.

This seems like a simple premise, even if the technology behind it is far from simple. But what’s to stop a hacker building a similar algorithm to intercept the secrets before GitGuardian’s platform spots it? 

“GitGuardian is indeed competing with individual black hat hackers, as well as organised criminal groups,” Thomas explains. “We constantly improve our algorithms to be quicker and smarter than they are, and to be able to detect a wider scope of vulnerabilities, which requires a dedicated, highly skilled team.

“We’re helped in this by our users and customers who give us feedback – at scale – that we reinject into our algorithms. Our white hat approach allows us to collect feedback and this gives us a tremendous edge over black hats. You can see this as the unfair advantage you get by doing good.”

GitGuardian has already supported global government organisations, more than 100 Fortune 500 companies and 400,000 individual developers. It’s now setting its sights on adding even more developers and companies to its platform to further improve its algorithm, and extend this technology for use on private sites. 

“We started GitGuardian by tackling secrets in source code and private sites,” concludes Thomas. “Our ambition really is to be developers’ and cybersecurity professionals’ best friend when it comes to securing the vulnerability area that is emerging due to modern software development techniques [and] we’re on the road to doing this.”

Microsoft and AT&T have integrated 5G with Azure to launch an edge computing service for enterprise customers.

The two companies signed a $2 billion deal in July, which involved the migration of AT&T data and workflows to Azure, and introduced plans to accelerate work on 5G and cloud computing.

The first joint announcement to come out of the deal, announced on 26 November, is a pilot launch of an edge computing service called Network Edge Compute, a virtualised 5G core that can deploy Azure services.

It’s available to certain customers, initially in Dallas, but will roll out to some in Los Angeles and Atlanta over the next year.

«With our 5G and edge computing, AT&T is collaborating uniquely with Microsoft to marry their cloud capabilities with our network to create lower latency between the device and the cloud that will unlock new, future scenarios for consumers and businesses,» said Mo Katibeh, EVP and chief marketing officer, AT&T Business.

«We’ve said all year developers and businesses will be the early 5G adopters and this puts both at the forefront of this revolution.»

The collaboration will see AT&T become a «public-cloud first» business, according to Microsoft. The telecoms giant’s migration is well underway and is set to be completed by 2024.

«We are helping AT&T light up a wide range of unique solutions powered by Microsoft’s cloud, both for its business and our mutual customers in a secure and trusted way,» said Corey Sanders, corporate VP of Microsoft Solutions.

«The collaboration reaches across AT&T, bringing the hyper-scale of Microsoft Azure together with AT&T’s network to innovate with 5G and edge computing across every industry.»

It’s also another big deal for Microsoft, which has made its public cloud strategy clear with a number of acquisitions for migration specialists. Most recently the tech giant snapped up Mover, which swiftly followed a deal to buy similarly named Movere.

AWS has enabled its voice control services to be available on lower-powered devices by offloading the majority of the work to the cloud.

Alexa Voice Services (AVS) is already widely used with its Echo smart speakers and other devices that can be connected to a network or the internet, such as lightbulbs and TVs.

Adding voice controls was costly as Alexa devices had a minimum requirement of at least 100 megabytes of on-device RAM and an ARM Cortex «A» class microprocessor to have enough processing power to handle voice commands. 

That’s no longer the case as the tech giant will use its cloud to handle most of the processing requirements with Alexa Voice Services for IoT, reducing the costs of voice control by up to 50%. The baseline requirement has now been reduced to 1MB of RAM and Arm Cortex M-class microcontrollers.

The move also means that retrieving, buffering and decoding on devices will also be offloaded to its cloud. As such, everything from light switches to thermostats can now be controlled entirely using voice with AVS for IoT.

«We now offload the vast majority of all of this to the cloud,» AWS IoT VP Dirk Didascalou told TechCrunch. «So the device can be ultra dumb. The only thing that the device still needs to do is wake word detection. That still needs to be covered on the device.

«It just opens up the what we call the real ambient intelligence and ambient computing space,» he said. «Because now you don’t need to identify where’s my hub – you just speak to your environment and your environment can interact with you. I think that’s a massive step towards this ambient intelligence via Alexa.»

The cloud giant made a number of IoT announcements aimed at simplifying IoT services for companies deploying large swathes of devices. It revealed added features to AWS IoT Greengrass, for example, which has been given capabilities for Docker. This extends AWS functions to connected devices, allowing businesses to perform data collection and analysis at the edge. The update is with Docker containers, which make it easier to move compute workloads to and from the edge.