Day: December 6, 2016

Donald Trump’s incoming administration might be going full steam ahead in returning to fossil fuels, but the clean energy sector might have other ideas. Nikola Motor Company has just unveiled a huge class 8 truck (as big as they get) that’s powered by a hydrogen fuel cell, claiming it will have an operational range of as much as 1,200 miles (1,900km) when it’s released in 2020.

The Nikola One, which is designed for long-haul good transport across a large landmass, will according to its creators be able to travel between 800 and 1,200 miles on a single tank of fuel, while delivering over 1,000 horsepower and 2,000 foot-pounds of torque.

If these claims are true, it will provide nearly double the power of the current generation of diesel-powered semis/articulated lorries.

It has been a long road back from a fatal 2014 accident for Virgin Galactic, the splashy spaceship company founded by Sir Richard Branson to bring the masses into space. After its VSS Enterprise crashed into the Mojave Desert during a test flight, killing vehicle co-pilot Michael Alsbury, the company has had to redesign some key safety systems and rebuild its spacecraft. It revealed the VSS Unity in February.

Since then Virgin Galactic has completed a series of ground tests and mating to the “mothership” aircraft, Eve. Following captive carry tests in September, the company performed its first glide test on Saturday, when VSS Unity was released at an altitude of about 15km. The spacecraft reached a velocity of mach 0.6 during its 10-minute descent back to the ground in California. It then made a safe landing at test facilities in Mojave.

This morning, President-Elect Donald Trump lambasted the ongoing program to build a new presidential aircraft in a post to Twitter, calling for its cancellation:

Boeing is building a brand new 747 Air Force One for future presidents, but costs are out of control, more than $4 billion. Cancel order!

— Donald J. Trump (@realDonaldTrump) December 6, 2016

The Air Force One replacement contract, awarded in February 2016 to Boeing, is for a single 747-8 aircraft equipped for the chief executive’s travel and communications. The current pair of VC-25A aircraft that serve as Air Force One—two heavily modified Boeing 747-200B jetliners—are the last of their kind, and have been in service since 1990. There are no 747-200 aircraft in commercial service anywhere in the world, making logistic support for them expensive. “Parts obsolescence, diminishing manufacturing sources, and increased down times for maintenance are existing challenges that will increase until a new aircraft is fielded,” Secretary of the Air Force Deborah Lee James said of the existing aircraft when the Boeing contract was announced.

The 747-8 has a longer range, greater maximum take-off weight, and higher top airspeed than the 747-200 that it is intended to replace, as well as better fuel efficiency and lower carbon dioxide emissions. Capable of Mach 0.855, according to Boeing, the 747-8 is the fastest commercial jet in the world. However, the modifications required for a presidential aircraft are extensive. The VC-25A version of the 747-200 is capable of in-flight refueling, carries a full communications suite, and is “self-sufficient” at airports (having its own self-deploying “air stairs” and baggage handling equipment).

The initial contract award in February was for $25.8 million, with the total cost estimated by the Air Force to be as much as $1.65 billion over the full development, construction, and testing cycle. But the new Boeing aircraft aren’t expected to enter service until 2024—nearly a full two presidential terms from now.

Ars contacted Boeing and Air Force officials for comment. An Air Force spokesperson said that the service was gathering numbers on the program for a response, and a Boeing representative said that a response would be forthcoming. This story will be updated as those details become available.

For the first time in a century, the US Supreme Court has weighed in how much design patents are worth. The answer: not nearly as much as Apple thinks.

The 8-0 opinion (PDF) is a rebuke to the US Court of Appeals for the Federal Circuit, which held that the relevant “article of manufacture” for calculating damages was—in fact, had to be—the entire smartphone. That meant even though Apple’s patents covered only certain design elements, it was entitled to $399 million in lost profits damages.

In an opinion authored by Justice Sonia Sotomayor, the Supreme Court rejected that approach, finding that the statutory term “article of manufacture” could mean either a whole product or just one component of a product.

Thieves can guess your secret Visa payment card data in as little as six seconds, according to researchers in the UK. Bad actors can use browser bots to distribute guesses across hundreds of legitimate online merchants.

The attack starts out with a card’s 16-digit number, which can be obtained in a variety of ways. Attackers can buy numbers on black-market websites, often for less than $1 apiece, or use a smartphone equipped with a near-field communication reader to skim them. The numbers can also be inferred by combining your first six digits—which are based on the card brand, issuing bank, and card type—with a verification formula known as the Luhn Algorithm. Once an attacker has a valid 16-digit number, four seconds is all they need to learn the expiration date and the three-digit card-verification value that most sites use to verify the validity of a credit card. Even when sites go a step further by adding the card holder’s billing address to the process, the technique can correctly guess the information in about six seconds.

The technique relies on Web bots that spread random guesses across almost 400 e-commerce sites that accept credit card payments. Of those, 26 sites use only two fields to verify cards, while an additional 291 sites use three fields. Because different sites rely on different fields, the bots are able to enter intelligent guesses into the user field of multiple sites until the bots hit on the right ones. Once the correct expiration date is obtained for a given card—typically banks issue cards that are valid for up to 60 months—the bots use a similar process to obtain the CVV number. In other cases, when sites allow the bots to obtain the CVV first—a process that can never require more than 1,000 guesses—the bots then work to obtain the expiration date and, if required, the billing address.

“We came to an important observation that the difference in security solutions of various websites introduces a practically exploitable vulnerability in the overall payment system,” researchers from New Castle University in the UK wrote an a research paper titled Does the Online Card Payment Landscape Unwittingly Facilitate Fraud?. “An attacker can exploit these differences to build a distributed guessing attack which generates usable card payment details (card number, expiry date, card verification value, and postal address) one field at a time.” The researchers continued:

Each generated field can be used in succession to generate the next field by using a different merchant’s website. Moreover, if individual merchants were trying to improve their security by adding more payment fields to be verified on their site, they potentially inadvertently weaken the whole system by creating an opportunity to guess the value of another field, as explained later in the article.

In an effort to make online purchases as easy as possible, many websites allow prospective customers to make as many as 50, and in some cases an unlimited number, of incorrect guesses. Even in cases where the number is lower, the bots can still succeed by spreading the guesses over a large number of sites. Surprisingly, Visa—the world’s biggest payment card service—didn’t employ any system-wide mechanism for detecting the mass guessing attack. The Newcastle University researchers said that Visa competitor MasterCard, on the other hand, did detect the distributed mass guesses and shut down the attacks before they could succeed.

One of the tasks the bots carried out was to create a fake account that could charge a credit card belonging to the researchers and transfer the balance to a contact in India.

The researchers wrote:

Within minutes, we received a confirmation e-mail for the order made, and our contact confirmed the pick-up of the money. The time it took from the process of creating an account to collecting the money at the destination was only 27 minutes, which is short enough to avoid the bank reversing the payment.

The researchers said they contacted the 40 biggest websites used in the guessing attack to notify them of the findings. As a result, some sites have already changed some of their verification procedures. While that’s a good start, a better solution would be for Visa to implement the type of Internet-wide alert system used by MasterCard and for online merchants to standardize the verification process.

The findings provide another good reason for people to closely scrutinize credit card bills each month for fraudulent purchases. It’s also a good idea to use a single non-Visa credit card for all online purchases and to keep the spending limit on that card as low as possible.