Articoli

User comments are a great way to drive discussion and engagement around articles. But if a publisher wants to run ads on pages where user comments appear, all of the content on those pages — including comments — must follow our Publisher Policies. Publishers are responsible for ensuring that comment sections, forums, social media postings or anything else that users generate on their site or app are compliant with our Program Policies. This content is also subject to our Publisher Restrictions.

To help publishers manage user-generated content (UGC), we’re sharing a new infographic and troubleshooter with important information, like what to consider before incorporating UGC and helpful management strategies.

Check out the infographic below, and download or bookmark it for easy reference.

The years 2020 and 2021 have seen the largest number of acres burned across the state of California since record keeping began, with a record 4 million acres burning in 2020 alone as the state faces one of the worst droughts in living memory. That year brought a day that many in the San Francisco Bay Area remember as the “Orange Day,” as we awoke to darkness when there was usually light and wandered the streets in bewilderment as the sky glowed with a dull orange and street lights remained illuminated in the middle of the day. The smoke that converged on the Bay Area that day was driven by a number of fires, including the CZU Lightening Complex, that began in the early hours of the morning on August 16th as thunderstorms rolled over the Santa Cruz hills sparking fires that would consume over 86,000 acres and 1,400 structures—including large swaths of the Big Basin Redwoods State Park.

Big Basin is California’s oldest State Park, established in 1902 and today covering over 18,000 acres. It includes some of the most beautiful terrain in the coastal ranges from lush canyons and waterfalls to sparse hilltops with magnificent views. Big Basin is perhaps best known for its majestic stand of coastal redwoods, many of which are easily accessible on the Redwood Grove Trail that features named trees such as the Mother of the Forest that soars 282 feet above the forest floor. This grove suffered tremendous damage, but the natural resilience of the coastal redwoods means that almost all will survive unlike the historic Headquarters Administration Building and other structures that were completely destroyed. Overall 97% of the park suffered damage from the fire but the work to rebuild has already begun with the removal of over 25,000 dead trees and the beginning of the planning process for a reimagined park design.

In the Spring of 2021, CyArk partnered with California State Parks to digitally document the impact of the fire on some of the most well known old growth redwood trees and the headquarters area of the park. Through detailed 3D models of famed redwood trees, archival photographs, and multimedia stories from Park employees, you can now explore Resilience of the Redwoods on Google Arts and Culture. Travel through time at California’s first park from the budding preservation movement to Park Rangers’ connections to the trees today. Through interactive 3D, explore centuries of scars and growth of some of the oldest trees in the park and learn about the increasing impacts of fire on the ancient redwood habitat.

The stories highlight the complex relationships between trees, people, and fire in the past and today. While the interactive 3D models demonstrate loss of significant cultural heritage at the park, they also provide an opportunity to reimagine a future for places like Big Basin and what we can all do to ensure redwoods remain resilient for generations to come.

Human rights defenders need information from many sources to do their work effectively. But as issues evolve and new precedents are set, finding the right information to defend a particular case can be like looking for a needle in a haystack.

For example, a human rights advocate campaigning for LGBTQ rights may want to know which countries have made the most progress and what resolutions they’ve passed. To do so, they have to manually sift through thousands of pages of dense documentation covering global laws and victims’ testimonies to find what they’re looking for.

The curation and cataloging of documents makes this process much easier, but still relies on the manual work of skilled experts. To help, the non-profit organization HURIDOCS looked to machine learning. With support from Google.org Fellows and grant funding, they’ve built new tools that can automatically tag human rights documents so they are searchable — making the curation process 13 times faster.

How machine learning can make information more accessible

Typically, non-governmental organizations collect and curate large bodies of human rights information, with the goal of making these collections useful for advocates. Manually processing these documents can take several days, particularly when they’re published in unfamiliar languages or in PDF format which is difficult to search through. As a result, many NGOs face a large backlog of documents that remain to be processed, and by the time they’re added to collections new documentation often supersedes them.

Based in Geneva, HURIDOCS has been developing tools to manage and analyze collections of human rights evidence, law and research for nearly four decades. In 2016, they had an idea: What if machine learning could skim through documents, make terms extractable, and classify the content to catalog documents more quickly?

HURIDOCS took their idea to the Google AI Impact Challenge and was selected for a $1 million grant from Google.org and six months of technical support from a team of seven full-time pro bono Google.org Fellows. As one of the Fellows, I helped train AI models and make sure that the tool was useful to human rights experts, not just machine learning experts.

The curation process of human rights documents gets a boost

Since then, HURIDOCS has launched ML-powered features to improve platforms they’ve built with other NGO partners, and, earlier this year, they began integrating the technology into more of its tools, including their flagship application Uwazi. As a result, updating documents now takes one week instead of two to three months, and curators have been able to catch up on multi-year document backlogs.

In June, HURIDOCS won a CogX Award for its machine learning work, and now the organization is continuing to explore what else its machine learning models can do — from creating automatic tables of contents for documents to identifying references within text. With the power of artificial intelligence, HURIDOCS hopes to solve the trickiest challenges facing human rights defenders.

Nearly 4 billion people around the world don’t have access to the essential healthcare services they need, like immunizations or pediatric care. Complicating matters, the World Health Organization (WHO) estimates a global shortage of 18 million healthcare workers by 2030 — primarily in low-and-middle income countries (LMICs).

In many countries, healthcare workers use smartphone applications to manage data specific to certain diseases like malaria and tuberculosis. However, the data is often stored across multiple applications using different data formats, making it difficult for healthcare workers to have all the information they need. Additionally, it’s difficult for healthcare providers and organizations to exchange data, so they often don’t have a holistic view of individual or community health data to inform health decisions.

To give healthcare workers access to advanced mobile digital health solutions, we’re collaborating with the WHO on building an open source software developer kit (SDK). This SDK will help Android developers around the world, including in LMICs, build secure mobile solutions using the Fast Healthcare Interoperability Resources (FHIR), a global standard framework for healthcare data that is being widely adopted to address fragmentation and foster more patient-centered care. With Android OS powering 3 billion active devices worldwide, this collaboration provides an opportunity to support more healthcare workers on the frontlines.

Supporting developers and frontline health workers

Frontline health workers often work in areas where connectivity is unreliable. The SDK allows Android applications to run offline by storing and processing data locally, so health workers can deliver care without worrying about connectivity. When there is connectivity, the SDK will send the server the latest data collected on the device, and receive new updates to patient records.

The SDK is being designed to provide healthcare workers with access to decision support tools. For example, the WHO is using the SDK to develop EmCare, an app for healthcare workers in emergency settings. This application provides clinical decision support, based on the WHO SMART Guidelines content, which ensures compliance with evidence-based recommendations at the point of care.

By providing a common set of application components – like on-device storage, data-access and search APIs – the SDK reduces the time and effort it takes to build FHIR-based, interoperable digital health applications on Android, maximizing the efforts of local developers and unlocking their potential to meet their community’s needs.

The FHIR SDK facilitates interoperability and high-quality data exchange and is designed with a high level of security. Interoperability not only opens up the ability for healthcare workers to more easily gather community health data, but also makes it possible to use high-quality data to understand health trends, better prioritize high-risk patients and deliver more patient-centered care to everyone. All data stored by apps built on the SDK is strongly encrypted, and the SDK does not send or share any data with Google.

Extending interoperability globally

The global digital health community is rallying around FHIR to help improve health data interoperability, and we are committed to helping developers everywhere safely use our SDK to build secure and interoperable digital health solutions for their communities.

We are collaborating with WHO and a group of developers to make sure the SDK meets the needs of the community. We plan to release it more widely in the coming months and look forward to supporting developers as they build digital health tools for healthcare workers everywhere.

Every day, millions of people come to Google Search to ask important questions about their wellbeing. The COVID-19 pandemic drove even more concern for our health and the health of our loved ones – and this year, searches for ways to heal reached record highs. We saw questions about vaccinations, therapists, body positivity and mental wellbeing, to name a few. Today, we launched our annual Year in Search, which takes a look back at the top-trending searches of the year. Here’s a glimpse into some of the trending searches of 2021, a year we looked for ways to feel better and heal together.

Finding resources near me

Across the world, people searched for information on COVID-19 vaccinations and testing. The top trending “near me” queries in 2021 were “covid vaccine near me” and “covid testing near me.” To help people find credible, timely testing and vaccine information, we updated Google Search information panels, and worked with national and international partners to help people get vaccinated and tested.

Learning how to help

Helping ourselves and our communities was a priority for many of us. We asked questions about how to help others with anxiety and depression, and we also looked for help with our own mental wellbeing. Search interest for “therapists near me” hit record highs in 2021, and the phrase “why do I feel anxious for no reason” also hit an all-time high this year, spiking more than 400%. In addition to providing mental health resources and helplines, a quick Google Search also surfaces self-assessments to help you learn more about mental health topics like depression, anxiety, PTSD and postpartum depression.

Evaluating information effectively

Is it allergies or COVID? A sinus infection or COVID? Pfizer or Moderna? As many of us searched for health related information online, we wanted to know what we found was trustworthy. Connecting people with critical, timely and authoritative health information has been a crucial part of our role over the last year, and our team is constantly working to find ways to help people everywhere find credible and actionable information to help manage their health. To help people evaluate information online, we launched a new tool called About This Result, so you can learn more about the pages you see across a range of topics. About This Result helps people evaluate the credibility of sources, and decide which results are useful for them.

Search continues to be one of the first stops people make when making decisions, big and small, about their health — and so much more. To dive deeper into some of the other trending topics that defined 2021, visit yearinsearch.google/trends.

This year, searches for “how to heal” reached an all time high. Across the world, we were looking for ways to come back stronger.

We reflected on difficult times that continued to test our resolve. We thought about those we lost, asking “how to honor someone.” We looked inward, searching for “how to take care of your mental health” and asking the big questions, like “how to be yourself” and “what is my purpose?”

We looked outward, too – thinking about how we could help rebuild and strengthen our communities. We searched for how to make sustainable choices, how to help Afghan refugees, how to stop Asian hate and how to support people in need across the world – from communities in India battling the pandemic to communities in Texas facing severe weather.

And we looked to move forward, searching, “how to make a come back.”

As the world asked “how to be hopeful,” 2021 brought us hope. This was the year that search interest for “covid vaccine” officially surpassed interest in “covid testing.” Searches soared for “covid vaccine near me” – just as people eagerly asked when they could visit their family or eat in a restaurant again.

Like last year, people continued to search for ways to stay connected and entertained at home (“Squid Game” took the top spot this year for searches for TV shows to watch). But we also started to navigate a return to life outside the house, wondering how we should go about ditching the sweatpants (the top trending search for “how to style…” was “how to style straight leg jeans”).

As this year of comebacks comes to a close, we’re taking a closer look at trending topics across searches, news, people, “how to’s,” entertainment, trends and more from across almost 70 countries. Search can help you find a world of information – and what people search for can be a window into the world. So join us in taking a closer look at this year’s trending lists at yearinsearch.google/trends.

Today, we took action to disrupt Glupteba, a sophisticated botnet which targets Windows machines and protects itself using blockchain technology. Botnets are a real threat to Internet users, and require the efforts of industry and law enforcement to deter them. As part of our ongoing work to protect people who use Google services via Windows and other IoT devices, our Threat Analysis Group took steps to detect and track Glupteba’s malicious activity over time. Our research and understanding of this botnet’s operations puts us in a unique position to disrupt it and safeguard Internet users around the world.

We’re doing this in two ways. First, we are coordinating with industry partners to take technical action.

And second, we are using our resources to launch litigation — the first lawsuit against a blockchain enabled botnet — which we think will set a precedent, create legal liability for the botnet operators, and help deter future activity.

About the Glupteba botnet

A botnet is a network of devices connected to the internet that have been infected with a type of malware that places them under the control of bad actors. They can then use the infected devices for malicious purposes, such as to steal your sensitive information or commit fraud through your home network.

After a thorough investigation, we determined that the Glupteba botnet currently involves approximately one million compromised Windows devices worldwide, and at times, grows at a rate of thousands of new devices per day. Glupteba is notorious for stealing users’ credentials and data, mining cryptocurrencies on infected hosts, and setting up proxies to funnel other people’s internet traffic through infected machines and routers.

Technical action

We coordinated with industry partners to take technical action. We have now disrupted key command and control infrastructure so those operating Glupteba should no longer have control of their botnet — for now.

However, due to Glupteba’s sophisticated architecture and the recent actions that its organizers have taken to maintain the botnet, scale its operations, and conduct widespread criminal activity, we have also decided to take legal action against its operators, which we believe will make it harder for them to take advantage of unsuspecting users. .

Legal Strategy & Disruption

Our litigation was filed against the operators of the botnet, who we believe are based in Russia. We filed the action in the Southern District of New York for computer fraud and abuse, trademark infringement, and other claims. We also filed a temporary restraining order to bolster our technical disruption effort. If successful, this action will create real legal liability for the operators.

Making the Internet Safer

Unfortunately, Glupteba’s use of blockchain technology as a resiliency mechanism is notable here and is becoming a more common practice among cyber crime organizations. The decentralized nature of blockchain allows the botnet to recover more quickly from disruptions, making them that much harder to shutdown. We are working closely with industry and government as we combat this type of behavior, so that even if Glupteba returns, the internet will be better protected against it.

Our goal is to bring awareness to these issues to protect our users and the broader ecosystem, and to prevent future malicious activity.

We don’t just plug security holes, we work to eliminate entire classes of threats for consumers and businesses whose work depends on the Internet. We have teams of analysts and security experts who are dedicated to identifying and stopping issues like DDoS, phishing campaigns, zero-day vulnerabilities, and hacking against Google, our products, and our users.

Taking proactive actions like this are critical to our security. We understand and recognize the threats the Internet faces, and we are doing our part to address them.

Google TAG actively monitors threat actors and the evolution of their tactics and techniques. We use our research to continuously improve the safety and security of our products and share this intelligence with the community to benefit the internet as a whole.

As announced today, Google has taken action to disrupt the operations of Glupteba, a multi-component botnet targeting Windows computers. We believe this action will have a significant impact on Glupteba’s operations. However, the operators of Glupteba are likely to attempt to regain control of the botnet using a backup command and control mechanism that uses data encoded on the Bitcoin blockchain.

Glupteba is known to steal user credentials and cookies, mine cryptocurrencies on infected hosts, deploy and operate proxy components targeting Windows systems and IoT devices. TAG has observed the botnet targeting victims worldwide, including the US, India, Brazil and Southeast Asia.

The Glupteba malware family is primarily distributed through pay per install (PPI) networks and via traffic purchased from traffic distribution systems (TDS). For a period of time, we observed thousands of instances of malicious Glupteba downloads per day. The following image shows a webpage mimicking a software crack download which delivers a variant of Glupteba to users instead of the promised software.

While analyzing Glupteba binaries, our team identified a few containing a git repository URL: “git.voltronwork.com”. This finding sparked an investigation that led us to identify, with high confidence, multiple online services offered by the individuals operating the Glupteba botnet. These services include selling access to virtual machines loaded with stolen credentials (dont[.]farm), proxy access (awmproxy), and selling credit card numbers (extracard) to be used for other malicious activities such as serving malicious ads and payment fraud on Google Ads.

This past year, TAG has been collaborating with Google’s CyberCrime Investigation Group to disrupt Glupteba activity involving Google services. We’ve terminated around 63M Google Docs observed to have distributed Glupteba, 1,183 Google Accounts, 908 Cloud Projects, and 870 Google Ads accounts associated with their distribution. Furthermore, 3.5M users were warned before downloading a malicious file through Google Safe Browsing warnings.

In the last few days, our team partnered with Internet infrastructure providers and hosting providers, including CloudFlare, to disrupt Glupteba’s operation by taking down servers and placing warning interstitial pages in front of the malicious domain names. During this time, an additional 130 Google accounts associated with this operation were terminated.

Parallel to the analysis, tracking, and technical disruption of this botnet, Google has filed a lawsuit against two individuals believed to be located in Russia for operating the Glupteba Botnet and its various criminal schemes. Google is alleging violations under the Racketeer Influenced and Corrupt Organizations Act (RICO), the Computer Fraud and Abuse Act, the Electronic Communications Privacy Act, the Lanham Act, and tortious interference of business relationships, and unjust enrichment.

While these actions may not completely stop Glupteba, TAG estimates that combined efforts will materially affect the actor’s ability to conduct future operations.

Glupteba’s C2 Backup Mechanism

The command and control (C2) communication for this botnet uses HTTPS to communicate commands and binary updates between the control servers and infected systems. To add resilience to their infrastructure, the operators have also implemented a backup mechanism using the Bitcoin blockchain. In the event that the main C2 servers do not respond, the infected systems can retrieve backup domains encrypted in the latest transaction from the following bitcoin wallet addresses:

• ‘1CgPCp3E9399ZFodMnTSSvaf5TpGiym2N1’ [1]
• ’15y7dskU5TqNHXRtu5wzBpXdY5mT4RZNC6’ [2]
• ‘1CUhaTe3AiP9Tdr4B6wedoe9vNsymLiD97’ [3]

The following 32 byte AES keys for decryption are hard coded in the binaries:

• ‘d8727a0e9da3e98b2e4e14ce5a6cf33ef26c6231562a3393ca465629d66503cf’
• ‘1bd83f6ed9bb578502bfbb70dd150d286716e38f7eb293152a554460e9223536’

The blockchain transaction’s OP_RETURN data can be decrypted using AES-256 GCM to provide a backup command and control domain name. The first 12 bytes of the OP_RETURN contains the IV, the last 16 bytes the GCM tag, while the middle section is the AES-256 GCM encrypted domain. Full details of Glupteba’s network protocol can be found in this report from 2020, the following Python script illustrates how one can decrypt an encrypted domain name:

IOCs

Recent domains used for command and control:

• nisdably[.]com
• runmodes[.]com
• yturu[.]com
• retoti[.]com
• trumops[.]com
• evocterm[.]com
• iceanedy[.]com
• ninhaine[.]com
• anuanage[.]info

Recent sha256 hashes of malware samples:

• df84d3e83b4105f9178e518ca69e1a2ec3116d3223003857d892b8a6f64b05ba
• eae4968682064af4ae6caa7fff78954755537a348dce77998e52434ccf9258a2
• a2fd759ee5c470da57d8348985dc34348ccaff3a8b1f5fa4a87e549970eeb406
• d8a54d4b9035c95b8178d25df0c8012cf0eedc118089001ac21b8803bb8311f4
• c3f257224049584bd80a37c5c22994e2f6facace7f7fb5c848a86be03b578ee8
• 8632d2ac6e01b6e47f8168b8774a2c9b5fafaa2470d4e780f46b20422bc13047
• 03d2771d83c50cc5cdcbf530f81cffc918b71111b1492ccfdcefb355fb62e025
• e673ce1112ee159960f1b7fed124c108b218d6e5aacbcb76f93d29d61bd820ed
• 8ef882a44344497ef5b784965b36272a27f8eabbcbcea90274518870b13007a0
• 79616f9be5b583cefc8a48142f11ae8caf737be07306e196a83bb0c3537ccb3e
• db84d13d7dbba245736c9a74fc41a64e6bd66a16c1b44055bd0447d2ae30b614