The Linkielist

Linking ideas with the world

The Linkielist

Monthly Archives: May 2019

Docker Bug Allows Root Access to Host File System

Posted on by

All of the current versions of Docker have a vulnerability that can allow an attacker to get read-write access to any path on the host server. The weakness is the result of a race condition in the Docker software and while there’s a fix in the works, it has not yet been integrated.

The bug is the result of the way that the Docker software handles some symbolic links, which are files that have paths to other directories or files. Researcher Aleksa Sarai discovered that in some situations, an attacker can insert his own symlink into a path during a short time window between the time that the path has been resolved and the time it is operated on. This is a variant of the time of check to time of use (TOCTOU) problem, specifically with the “docker cp” command, which copies files to and from containers.

“The basic premise of this attack is that FollowSymlinkInScope suffers from a fairly fundamental TOCTOU attack. The purpose of FollowSymlinkInScope is to take a given path and safely resolve it as though the process was inside the container. After the full path has been resolved, the resolved path is passed around a bit and then operated on a bit later (in the case of ‘docker cp’ it is opened when creating the archive that is streamed to the client),” Sarai said in his advisory on the problem.

“If an attacker can add a symlink component to the path after the resolution but beforeit is operated on, then you could end up resolving the symlink path component on the host as root. In the case of ‘docker cp’ this gives you read and write access to any path on the host.”

Sarai notified the Docker security team about the vulnerability and, after talks with them, the two parties agreed that public disclosure of the issue was legitimate, even without a fix available, in order to make customers aware of the problem. Sarai said researchers were aware that this kind of attack might be possible against Docker for a couple of years. He developed exploit code for the vulnerability and said that a potential attack scenario could come through a cloud platform.

“The most likely case for this particular vector would be a managed cloud which let you (for instance) copy configuration files into a running container or read files from within the container (through “docker cp”),,” Sarai said via email.

“However it should be noted that while this vulnerability only has exploit code for “docker cp”, that’s because it’s the most obvious endpoint for me to exploit. There is a more fundamental issue here — it’s simply not safe to take a path, expand all the symlinks within it, and assume that path is safe to use.”

Source: Docker Bug Allows Root Access to Host File System | Decipher

Flipboard hacked and open for 9 months – fortunately passwords properly salted and encrypted so not much damage

Posted on by

In a series of emails seen by ZDNet that the company sent out to impacted users, Flipboard said hackers gained access to databases the company was using to store customer information.

Most passwords are secure

Flipboard said these databases stored information such as Flipboard usernames, hashed and uniquely salted passwords, and in some cases, emails or digital tokens that linked Flipboard profiles to accounts on third-party services.

The good news appears to be that the vast majority of passwords were hashed with a strong password-hashing algorithm named bcrypt, currently considered very hard to crack.

The company said that some passwords were hashed with the weaker SHA-1 algorithm, but they were not many.

“If users created or changed their password after March 14, 2012, it is hashed with a function called bcrypt. If users have not changed their password since then, it is uniquely salted and hashed with SHA-1,” Flipboard said.

[…]

In its email, Flipboard said it is now resetting all customer passwords, regardless if users were impacted or not, out of an abundance of caution.

Furthermore, the company has already replaced all digital tokens that customers used to connect Flipboard with third-party services like Facebook, Twitter, Google, and Samsung.

“We have not found any evidence the unauthorized person accessed third-party account(s) connected to your Flipboard accounts,” the company said.

Extensive breach

But despite some good news for users, the breach appears to be quite extensive, at least for the company’s IT staff.

According to Flipboard, hackers had access to its internal systems for almost nine months, first between June 2, 2018, and March 23, 2019, and then for a second time between April 21 and April 22, 2019.

The company said it detected the breach the day after this second intrusion, on April 23, while investigating suspicious activity on its database network.

Source: Flipboard says hackers stole user details | ZDNet

Laboratory Black Hole Shows Stephen Hawking Was Right, – wait they make black holes in labs now?!

Posted on by

Physicists have confirmed predictions of Stephen Hawking’s namesake theory of black holes using a black hole they constructed in their lab, according to a new paper.

This black hole isn’t like the black holes out in space, where gravity creates a region of spacetime so warped that light can’t escape. Instead, the researchers built a black hole analog using a strange quantum material called a Bose-Einstein condensate, in which the point of no return is for sound rather than light. Still, it’s an important verification Hawking’s work.

“I’m interested in learning whatever we can about real black holes and real gravity,” study author Jeff Steinhauer, physicist at the Technion-Israel Institute of Technology, told Gizmodo.

Stephen Hawking’s landmark theory is called Hawking radiation. When trying to apply the physical laws governing heat to black holes, he realized that black holes must emit radiation from their surfaces. The mechanism marks a combination of quantum mechanics (the science of the smallest things) with gravity (the science of interactions between the most massive things). But astronomers haven’t been able to peer close enough to a black hole to prove or disprove the theory. Some scientists have instead turned to analogues in the lab.

The scientists created an elongated Bose-Einstein condensate by trapping 8,000 rubidium atoms in a focused laser beam. Bose-Einstein condensates are systems of ultra-cold atoms where strange quantum physical phenomena become more visible on larger scales. They are often used for analog-type experiments like these.

A second laser increases the potential energy on one side of the Bose-Einstein condensate, making it denser on that side. A sharp transition separates the denser area (considered to be outside the black hole) and the less dense area (inside the black hole). This transition moves at a constant speed through the condensate, but from the point of view of the experimenters, it appears to be stationary; instead, it looks as if all of the rubidium atoms are moving. Outside the black hole in the denser region, the speed of sound is faster than the speed of this flow, so sound waves can move in either direction. But in the less dense region—inside the black hole—the speed of sound is slower, so sound waves only travel away from the sharp transition and further into the black hole, as described in the paper published in Nature.

This experiment mimics one of the most important features of the black hole—outside the black hole, light can either move away from or into the black hole. But once inside the black hole, it cannot escape. The laboratory analogue replaces light with sound, and the researchers can measure sound waves both outside and inside inside their black hole’s “event horizon.” The signal of the Hawking radiation is a correlation between these two kinds of waves.

Steinhauer’s team previously observed Hawking radiation in this system back in 2016. But this time around, they made at least 21 improvements to the system in order to get a better signal. This was enough to pull out important information about the system’s radiation, namely that it has a thermal spectrum with a temperature determined only by the system’s analogous equivalent to gravity, a relationship between the speed of sound and its flow. This means that it emitted a continuous spectrum of wavelengths, rather than preferred wavelengths. These observations, and the temperatures, were exactly as predicted in Hawking’s theories.

“The way I see it, what we saw was that Hawking’s calculations were correct,” Steinhauer said. By correct, he means that they’re a real effect that happens in these kinds of systems. Whether they happen in real black holes in space, well, we don’t quite know yet. But they do show that if Hawking was correct, then any information that falls into a black hole is lost, the subject of an important black hole paradox.

Mathematician Silke Weinfurtner at the University of Nottingham in the United Kingdom wrote in a Nature commentary that the research was “promising” and that the scheme the researchers used to extract the temperature of the radiation was “clever.” Perhaps, she wrote, the setup will be useful in measuring other interesting quantum phenomenon expected to occur near the black hole’s event horizon.

This research is yet another example of scientists using analogues to access physical phenomena that might otherwise be impossible to observe. It can serve as an important verification of the theories that drive our understanding of inaccessible things.

Next up, the researchers hope to repeatedly redo the experiment in order to determine how this Hawking radiation changes over time. And who knows, maybe one day we really will be able to measure these properties in actual black holes.

Source: Laboratory Black Hole Shows Stephen Hawking Was Right, Obviously

Apple’s privacy schtick is just an act, say folks suing the iGiant: iTunes ‘purchase histories sold’ to highest bidders

Posted on by

Apple has been hit with a class-action complaint in the US accusing the iGiant of playing fast and loose with the privacy of its customers.

The lawsuit [PDF], filed this month in a northern California federal district court, claims the Cupertino music giant gathers data from iTunes – including people’s music purchase history and personal information – then hands that info over to marketers in order to turn a quick buck.

“To supplement its revenues and enhance the formidability of its brand in the eyes of mobile application developers, Apple sells, rents, transmits, and/or otherwise discloses, to various third parties, information reflecting the music that its customers purchase from the iTunes Store application that comes pre-installed on their iPhones,” the filing alleged.

“The data Apple discloses includes the full names and home addresses of its customers, together with the genres and, in some cases, the specific titles of the digitally-recorded music that its customers have purchased via the iTunes Store and then stored in their devices’ Apple Music libraries.”

What’s more, the lawsuit goes on to claim that the data Apple sells is then combined by the marketers with information purchased from other sources to create detailed profiles on individuals that allow for even more targeted advertising.

Additionally, the lawsuit alleges the Music APIs Apple includes in its developer kit can allow third-party devs to harvest similarly detailed logs of user activity for their own use, further violating the privacy of iTunes customers.

The end result, the complaint states, is that Cook and Co are complacent in the illegal harvesting and reselling of personal data, all while pitching iOS and iTunes as bastions of personal privacy and data security.

“Apple’s disclosures of the personal listening information of plaintiffs and the other unnamed Class members were not only unlawful, they were also dangerous because such disclosures allow for the targeting of particularly vulnerable members of society,” the complaint reads.

“For example, any person or entity could rent a list with the names and addresses of all unmarried, college-educated women over the age of 70 with a household income of over $80,000 who purchased country music from Apple via its iTunes Store mobile application. Such a list is available for sale for approximately $136 per thousand customers listed.”

Source: Apple’s privacy schtick is just an act, say folks suing the iGiant: iTunes ‘purchase histories sold’ to highest bidders • The Register

Mysterious Chinese Dating Apps Targeting US Customers Expose 42.5 Million Records Online

Posted on by

On May 25th I discovered a non password protected Elastic database that was clearly associated with dating apps based on the names of the folders. The IP address is located on a US server and a majority of the users appear to be Americans based on their user IP and geolocations. I also noticed Chinese text inside the database with commands such as:

  •  模型更新完成事件已触发,同步用户到 
  • according to Google Translate: The model update completion event has been triggered, syncing to the user. 

The strange thing about this discovery was that there were multiple dating applications all storing data inside this database. Upon further investigation I was able to identify dating apps available online with the same names as those in the database. What really struck me as odd was that despite all of them using the same database, they claim to be developed by separate companies or individuals that do not seem to match up with each other. The Whois registration for one of the sites uses what appears to be a fake address and phone number. Several of the other sites are registered private and the only way to contact them is through the app (once it is installed on your device).

Finding several of the users’ real identity was easy and only took a few seconds to validate them. The dating applications logged and stored the user’s IP address, age, location, and user names. Like most people your online persona or user name is usually well crafted over time and serves as a unique cyber fingerprint. Just like a good password many people use it again and again across multiple platforms and services. This makes it extremely easy for someone to find and identify you with very little information. Nearly each unique username I checked appeared on multiple dating sites, forums, and other public places. The IP and geolocation stored in the database confirmed the location the user put in their other profiles using the same username or login ID.

Source: Mysterious Chinese Dating Apps Targeting US Customers Expose 42.5 Million Records Online – Security Discovery

Newly Released Amazon Patent Shows Just How Much Creepier Alexa Can Get

Posted on by

A newly revealed patent application filed by Amazon is raising privacy concerns over an envisaged upgrade to the company’s smart speaker systems. This change would mean that, by default, the devices end up listening to and recording everything you say in their presence.

Alexa, Amazon’s virtual assistant system that runs on the company’s Echo series of smart speakers, works by listening out for a ‘wakeword’ that tells the device to turn on its extended speech recognition systems in order to respond to spoken commands.

[…]

In theory, Alexa-enabled devices will only record what you say directly after the wakeword, which is then uploaded to Amazon, where remote servers use speech recognition to deduce your meaning, then relay commands back to your local speaker.

But one issue in this flow of events, as Amazon’s recently revealed patent application argues, is it means that anything you say before the wakeword isn’t actually heard.

“A user may not always structure a spoken command in the form of a wakeword followed by a command (eg. ‘Alexa, play some music’),” the Amazon authors explain in their patent application, which was filed back in January, but only became public last week.

“Instead, a user may include the command before the wakeword (eg. ‘Play some music, Alexa’) or even insert the wakeword in the middle of a command (eg. ‘Play some music, Alexa, the Beatles please’). While such phrasings may be natural for a user, current speech processing systems are not configured to handle commands that are not preceded by a wakeword.”

To overcome this barrier, Amazon is proposing an effective workaround: simply record everything the user says all the time, and figure it out later.

Rather than only record what is said after the wakeword is spoken, the system described in the patent application would effectively continuously record all speech, then look for instances of commands issued by a person.

Source: Newly Released Amazon Patent Shows Just How Much Creepier Alexa Can Get

wow – a continuous spy in your home

Germany thinks about resurrecting the Stasi, getting rid of end-to-end chat app encryption and requiring decrypted plain-text.

Posted on by

Government officials in Germany are reportedly mulling a law to force chat app providers to hand over end-to-end encrypted conversations in plain text on demand.

According to Der Spiegel this month, the Euro nation’s Ministry of the Interior wants a new set of rules that would require operators of services like WhatsApp, Signal, Apple iMessage, and Telegram to cough up plain-text records of people’s private enciphered chats to authorities that obtain a court order.

This would expand German law, which right now only allows communications to be gathered from a suspect’s device itself, to also include the companies providing encrypted chat services and software. True and strong end-to-end encrypted conversations can only be decrypted by those participating in the discussion, so the proposed rules would require app makers to deliberately knacker or backdoor their code in order to comply. Those changes would be needed to allow them to collect messages passing through their systems and decrypt them on demand.

Up until now, German police have opted not to bother with trying to decrypt the contents of messages in transit, opting instead to simply seize and break into the device itself, where the messages are typically stored in plain text.

The new rules are set to be discussed by the members of the interior ministry in an upcoming June conference, and are likely to face stiff opposition not only on privacy grounds, but also in regards to the technical feasibility of the requirements.

Spokespeople for Facebook-owned WhatsApp, and Threema, makers of encrypted messaging software, were not available to comment.

The rules are the latest in an ongoing global feud between the developers of secure messaging apps and the governments. The apps, designed in part to let citizens, journalists, and activists communicate secured from the prying eyes of oppressive government regimes.

The governments, meanwhile, say that the apps also provide a safe haven for criminals and terror groups that want to plan attacks and illegal activities, making it harder for intelligence and police agencies to perform vital monitoring tasks.

The app developers note that even if governments do try to implement mandatory decryption (aka backdoor) capabilities, actually getting those tools to work properly, without opening up a massive new security hole in the platforms that miscreants and criminals could exploit, would be next to impossible.

Source: Germany mulls giving end-to-end chat app encryption das boot: Law requiring decrypted plain-text is in the works • The Register

Whatever happened to mail confidentiality then?

Google Now Forces Microsoft Edge Preview Users to Use Chrome for the Modern YouTube Experience – a bit like they fuck around with Firefox

Posted on by

Microsoft started testing a new Microsoft Edge browser based on Chromium a little while ago. The company has been releasing new canary and dev builds for the browser over the last few weeks, and the preview is actually really great. In fact, I have been using the new Microsoft Edge Canary on my main Windows machine and my MacBook Pro for more than a month, and it’s really good.

But if you watch YouTube quite a lot, you will face a new problem on the new Edge. It turns out, Google has randomly disabled the modern YouTube experience for users of the new Microsoft Edge. Users are now redirected to the old YouTube experience, which lacks the modern design as well as the dark theme for YouTube, as first spotted by Gustave Monce. And when you try to manually access the new YouTube from youtube.com/new, YouTube simply asks users to download Google Chrome, stating that the Edge browser isn’t supported. Ironically, the same page states “We support the latest versions of Chrome, Firefox, Opera, Safari, and Edge.”

The change affects the latest versions of Microsoft Edge Canary and Dev channels. It is worth noting that the classic Microsoft Edge based on EdgeHTML continues to work fine with the modern YouTube experience.

The weird thing here is that Microsoft has been working closely with Google engineers on the new Edge and Chromium. Both the companies engineers are working closely to improve Chromium and introduce new features like ARM64 support to Chromium. So it’s very odd that Google would prevent users of the new Microsoft Edge browser from using the modern YouTube experience. This is most likely an error on Google’s part, but it could be intentional, too — we really don’t know for now.

Source: Google Now Forces Microsoft Edge Preview Users to Use Chrome for the Modern YouTube Experience – Thurrott.com

See also:
Google isn’t the company that we should have handed the Web over to: why MS switching to Chromium is a bad idea

SpaceX Starlink satellites dazzle but pose big questions for astronomers – Musk thought things out well again, not.

Posted on by

The first batch of satellites were launched from Cape Canaveral, Florida, and deployed to orbit by a Falcon 9 rocket on May 23. Each contains a single solar array, which both captures and bounces sunlight off the satellites and, as a result, can sometimes be seen from Earth. On May 25, as the drifting luminescent army of satellites zoomed overhead, Dutch satellite tracker Marco Langbroek captured their marching, posting a stunning video to Vimeo.

In time, the satellites will drift apart and head to specific orbits so that satellite internet coverage can be beamed to every corner of the globe.

However, as the unusual display in the night sky quickly gathered steam across social media, some astronomers began to point out the potential problems the satellite system may pose for astronomy. At present, only 60 satellites are moving into their orbit, but eventually that number will reach 12,000, and a megaconstellation will encircle the Earth. Practically overnight, our view of the sky has changed.

“We’ve become used to change in space activities as slow and incremental, and suddenly, it’s fast and speeding up,” said Alice Gorman, space archeologist at Flinders University, Australia. “By its very visibility, Starlink has opened up some big questions: who gets to use Earth orbit and what for?”

Watch this: SpaceX launches first batch of Starlink satellites
7:05

Indeed, Starlink would triple the number of satellites orbiting the Earth. If thousands of satellites are sent into orbit, our view of space changes. Will we find ourselves in a position where it’s impossible to investigate the cosmos from the ground?

The quick answer: not forever, no. SpaceX designed the Starlink satellites to fall back to the Earth after about five years of service..

“The satellites are meant to put themselves in a re-entry orbit at the end of their mission life, and remove themselves from the debris population by burning up,” says Gorman.

But the long answer is: potentially. Astronomers already wrangle with the problems posed by space robots and satellites circling the Earth whenever they turn their ground-based telescopes toward the stars. Bright, reflective surfaces pose a problem because they obstruct our view of the universe.

More satellites equals cloudier vision, and Starlink plans to launch more satellites than ever.

When the sun is reflecting off the satellites’ solar panels, astronomers will have to account for the appearance of the satellites in their images. SpaceX was relatively mum about the design of the satellites leading up to launch, so it’s come as a bit of a surprise to some astronomers just how bright they are. However, the satellites will position their solar panels as they establish themselves in orbit, which should reduce their brightness.

Jonathan McDowell, an astronomer with the Harvard-Smithsonian Center for Astrophysics, perhaps summed it up best in a tweet, saying the satellites are “brighter than we had expected and still a problem, but somewhat less of a sky-is-on-fire problem.”

“Somewhat less of a sky-is-on-fire problem” sounds slightly reassuring, at least. But there do seem to be clear issues for the astronomy community..

Elon Musk, SpaceX CEO, jumped to the defense of his satellite system and noted on Twitter how “potentially helping billions of economically disadvantaged people is the greater good,” while making it clear that SpaceX plans to limit Starlink’s effects on astronomy. “We care a great deal about science,” Musk tweeted. He said he’s sent a note to the Starlink team to reduce albedo — that is, the amount of light the satellites reflect.

In addition, after a user suggested placing space telescopes using Starlink chassis into orbit to appease the astronomers, Musk said he “would love to do exactly that.” That might ease concerns, but will it slow our quickening colonization of Earth’s orbit? Unlikely.

“Space agencies and organizations have been cluttering the sky for decades and taking a very lax attitude to the long-term consequences,” said Gorman.

With a number of satellite constellations on the way, it will be critical for regulatory bodies and satellite providers to adequately manage the space debris and satellite problem, lest all of our space robots collide and lock us on Earth forever (yes, that’s a faint but possible catastrophic scenario)

Source: SpaceX Starlink satellites dazzle but pose big questions for astronomers – CNET

The Asus ZenBook Pro Duo laptop with two 4K screens – for some reason people are comparing to Apples touch bar, but has nothing to do with that.

Posted on by

The ZenBook Pro Duo has not one, but two 4K screens. (At least if you’re counting horizontal pixels.) There’s a 15-inch 16:9 OLED panel where you’d normally find the display on a laptop, then a 32:9 IPS “ScreenPad Plus” screen directly above the keyboard that’s the same width and half the height. It’s as if Asus looked at the MacBook Pro Touch Bar and thought “what if that, but with 32 times as many pixels?”

Unlike the Touch Bar, though, the ScreenPad Plus doesn’t take anything away from the ZenBook Pro Duo, except presumably battery life. Asus still included a full-sized keyboard with a function row, including an escape key, and the trackpad is located directly to the right. The design is very reminiscent of Asus’ Zephryus slimline gaming laptops — you even still get the light-up etching that lets you use the trackpad as a numpad. HP tried something similar recently, too, though its second screen was far smaller.

asus

Asus has built some software for the ScreenPad Plus that makes it more of a secondary control panel, but you can also use it as a full-on monitor, or even two if you want to split it into two smaller 16:9 1080p windows. You can also set it to work as an extension of the main screen, so websites rise up from above your keyboard as you scroll down, which is pretty unnerving. Or you could use it to watch Lawrence of Arabia while you jam on Excel spreadsheets.

The ZenBook Pro Duo has up to an eight-core Intel Core i9 processor with an Nvidia RTX 2060 GPU. There are four far-field microphones designed for use with Alexa and Cortana, and there’s an Echo-style blue light at the bottom edge that activates with voice commands. It has a Thunderbolt 3 port, two USB-A ports, a headphone jack, and a full-sized HDMI port.

Performance seemed fine in my brief time using the ZenBook Pro Duo, without any hiccups or hitches even when running an intensive video editing software demo. It’s a fairly hefty laptop at 2.5kg (about 5.5lbs), but that’s to be expected given the gaming laptop-class internals. I would also expect its battery life to fall somewhere close to that particular category of products, though we’ll have to wait and see about that.

While both of the screens looked good, I will say they looked different. Part of that is because of the searing intensity of the primary OLED panel, but the ScreenPad Plus is also coated with a matte finish, and usually looks less bright because of how you naturally view it at an off angle.

asus

Asus is also making a cheaper and smaller 14-inch model called the ZenBook Duo. The design and concept is basically the same, but both screens are full HD rather than 4K, there’s no Core i9 option, and the discrete GPU has been heavily downgraded to an MX250.

Asus hasn’t announced pricing or availability for the ZenBook Pro Duo or the ZenBook Duo, but they’re expected to land in the third quarter of this year.

Source: The Asus ZenBook Pro Duo is an extravagant laptop with two 4K screens – The Verge

Why they see any similtarity to the Apple touch bar is beyond me – this is sprung from a totally different well. The dual screen laptop concept has been around for a lot longer than Apple putting a tiny strip somewhere. This is something that’s actually useful.

Bose headphones spy on listeners, sell that information on without consent or knowledge: lawsuit

Posted on by

Bose Corp spies on its wireless headphone customers by using an app that tracks the music, podcasts and other audio they listen to, and violates their privacy rights by selling the information without permission, a lawsuit charged.

The complaint filed on Tuesday by Kyle Zak in federal court in Chicago seeks an injunction to stop Bose’s “wholesale disregard” for the privacy of customers who download its free Bose Connect app from Apple Inc or Google Play stores to their smartphones.

[…]

After paying $350 for his QuietComfort 35 headphones, Zak said he took Bose’s suggestion to “get the most out of your headphones” by downloading its app, and providing his name, email address and headphone serial number in the process.

But the Illinois resident said he was surprised to learn that Bose sent “all available media information” from his smartphone to third parties such as Segment.io, whose website promises to collect customer data and “send it anywhere.”

Audio choices offer “an incredible amount of insight” into customers’ personalities, behavior, politics and religious views, citing as an example that a person who listens to Muslim prayers might “very likely” be a Muslim, the complaint said.

“Defendants’ conduct demonstrates a wholesale disregard for consumer privacy rights,” the complaint said.

Zak is seeking millions of dollars of damages for buyers of headphones and speakers, including QuietComfort 35, QuietControl 30, SoundLink Around-Ear Wireless Headphones II, SoundLink Color II, SoundSport Wireless and SoundSport Pulse Wireless.

He also wants a halt to the data collection, which he said violates the federal Wiretap Act and Illinois laws against eavesdropping and consumer fraud.

Dore, a partner at Edelson PC, said customers do not see the Bose app’s user service and privacy agreements when signing up, and the privacy agreement says nothing about data collection.

Edelson specializes in suing technology companies over alleged privacy violations.

The case is Zak v Bose Corp, U.S. District Court, Northern District of Illinois, No. 17-02928.

Source: Bose headphones spy on listeners: lawsuit | Article [AMP] | Reuters

First American Financial Corp. Leaked 885 Million Title Insurance Records

Posted on by

The Web site for Fortune 500 real estate title insurance giant First American Financial Corp. [NYSE:FAF] leaked hundreds of millions of documents related to mortgage deals going back to 2003, until notified this week by KrebsOnSecurity. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.

[…]

Earlier this week, KrebsOnSecurity was contacted by a real estate developer in Washington state who said he’d had little luck getting a response from the company about what he found, which was that a portion of its Web site (firstam.com) was leaking tens if not hundreds of millions of records. He said anyone who knew the URL for a valid document at the Web site could view other documents just by modifying a single digit in the link.

And this would potentially include anyone who’s ever been sent a document link via email by First American.

KrebsOnSecurity confirmed the real estate developer’s findings, which indicate that First American’s Web site exposed approximately 885 million files, the earliest dating back more than 16 years. No authentication was required to read the documents.

Many of the exposed files are records of wire transactions with bank account numbers and other information from home or property buyers and sellers.

[…]

“The title insurance agency collects all kinds of documents from both the buyer and seller, including Social Security numbers, drivers licenses, account statements, and even internal corporate documents if you’re a small business. You give them all kinds of private information and you expect that to stay private.”

[…]

A database like this also would give fraudsters a constant feed of new information about upcoming real estate financial transactions — including the email addresses, names and phone numbers of the closing agents and buyers.

Source: First American Financial Corp. Leaked Hundreds of Millions of Title Insurance Records — Krebs on Security

Samsung’s AI animates paintings and photos without 3D modeling

Posted on by

Engineers and researchers from Samsung’s AI Center in Moscow and Skolkovo Institute of Science and Technology have created a model that can generate realistic animated talking heads from images without relying on traditional methods, like 3D modeling.

[…]

“Effectively, the learned model serves as a realistic avatar of a person,” said engineer Egor Zakharov in a video explaining the results.

Well-known faces seen in the paper include Marilyn Monroe, Albert Einstein, Leonardo da Vinci’s Mona Lisa, and RZA from the Wu Tang Clan. The technology that focuses on synthesizing photorealistic head images and facial landmarks could be applied to video games, video conferences, or digital avatars like the kind now available on Samsung’s Galaxy S10. Facebook is also working on realistic avatars for its virtual reality initiatives.

Such tech could clearly also be used to create deepfakes.

Few-shot learning means the model can begin to animate a face using just a few images of an individual, or even a single image. Meta training with the VoxCeleb2 data set of videos is carried out before the model can animate previously unseen faces.

During the training process, the system creates three neural networks: The embedded network maps frames to vectors, a generator network maps facial landmarks in the synthesized video, and a discriminator network assesses the realism and pose of the generated images.

Source: Samsung’s AI animates paintings and photos without 3D modeling | VentureBeat

Beyond the Hype of Lab-Grown Diamonds

Posted on by

Billions of years ago when the world was still young, treasure began forming deep underground. As the edges of Earth’s tectonic plates plunged down into the upper mantle, bits of carbon, some likely hailing from long-dead life forms were melted and compressed into rigid lattices. Over millions of years, those lattices grew into the most durable, dazzling gems the planet had ever cooked up. And every so often, for reasons scientists still don’t fully understand, an eruption would send a stash of these stones rocketing to the surface inside a bubbly magma known as kimberlite.

Source: Beyond the Hype of Lab-Grown Diamonds

This article is an excellent analysis of the market and technologies used in Diamonds

G Suite passwords stored unhashed creds since 2005, and other passwords in plain text for 14 days for troubleshooting

Posted on by

Google admitted Tuesday its paid-for G Suite of cloudy apps aimed at businesses stored some user passwords in plaintext albeit in an encrypted form.

Administrators of accounts affected by the security blunder were warned via email that, in certain circumstances, passwords had not been hashed. Hashing is a standard industry practice that protects credentials by scrambling them using a one-way encryption algorithm.

Google was at pains to stress it was the enterprise non-consumer version of G Suite affected, that there were no signs of misuse of the passwords, and that the passwords were encrypted at rest on disk – though, we note, hashing them would have fully secured the sensitive info.

Before we get to the threat model part of this, there are essentially two security cockups at play here. The first involves a G Suite feature available from 2005 that allowed organizations’ admins to set their G Suite users’ passwords via the Google account admin console. That feature, designed for IT staff to help new colleagues set their passwords and log in, did not hash these passwords.

The second involves recording some user passwords in plaintext on disk, as they logged in, and keeping these unhashed credentials around for 14 days at a time, again encrypted at rest. This practice started in January this year, during attempts by Googlers to troubleshoot their login system, and has been stopped.

Source: G Suite’n’sour: Google resets passwords after storing some unhashed creds for months, years • The Register

Android and iOS devices impacted by new sensor calibration attack – it’s easy to follow your device everywhere online

Posted on by

A new device fingerprinting technique can track Android and iOS devices across the Internet by using factory-set sensor calibration details that any app or website can obtain without special permissions.

This new technique — called a calibration fingerprinting attack, or SensorID — works by using calibration details from gyroscope and magnetometer sensors on iOS; and calibration details from accelerometer, gyroscope, and magnetometer sensors on Android devices.

According to a team of academics from the University of Cambridge in the UK, SensorID impacts iOS devices more than Android smartphones. The reason is that Apple likes to calibrate iPhone and iPad sensors on its factory line, a process that only a few Android vendors are using to improve the accuracy of their smartphones’ sensors.

How does this technique work?

“Our approach works by carefully analysing the data from sensors which are accessible without any special permissions to both websites and apps,” the research team said in a research paper published yesterday.

“Our analysis infers the per-device factory calibration data which manufacturers embed into the firmware of the smartphone to compensate for systematic manufacturing errors [in their devices’ sensors],” researchers said.

This calibration data can then be used as a fingerprint, producing a unique identifier that advertising or analytics firms can use to track a user as they navigate across the internet.

Furthermore, because the calibration sensor fingerprint is the same when extracted using an app or via a website, this technique can also be used to track users as they switch between browsers and third-party apps, allowing analytics firms to get a full view of what users are doing on their devices.

Source: Android and iOS devices impacted by new sensor calibration attack | ZDNet

How the World’s First Digital Circuit Breaker Could Completely Change Our Powered World

Posted on by

This week the world’s first and only digital circuit breaker was certified for commercial use. The technology, invented by Atom Power, has been listed by Underwriters Laboratories (UL), the global standard for consumer safety. This new breaker makes power easier to manage and 3000 times faster than the fastest mechanical breaker, marking the most radical advancement in power distribution since Thomas Edison.

Picture the fuse box in your basement, each switch assigned to different electrical components of your home. These switches are designed to break a circuit to prevent the overloaded wires in your wall from overheating and causing a fire. When this happens, you plod down to your mechanical room and flick the switches on again.

[…]

His experienced based inquiry has revolved around a central assertion that analog infrastructure doesn’t allow us to control our power the way we should be able to. That idea has led to some pretty critical questions: “What would it take to make power systems controllable?” and “Why shouldn’t that control be built in to the circuit breaker itself

[…]

Instead of using mechanics to switch the power, we apply digital inputs,” Kennedy told Popular Mechanics. “Now I have no moving parts. Now I have the ability to connect things like iPhones and iPads for remote power management, which increases safety and improves efficiency. I can set the distribution panel to a schedule so the flow of power is seamless, unlimited, and shifts between sources automatically. You literally wouldn’t notice. The lights wouldn’t even flicker.”

[…]

For a grid-connected solar home, for example, residents sometimes have to disconnect their solar input because traditional power systems (including the circuit breakers) aren’t advanced enough to properly manage multiple power sources that change.

In short, “the modern world has outgrown the risks and constraints of traditional circuit breakers”—a company claim, but also a compelling fact when you consider these inefficiencies and the dangers of a system that requires manual remediation of power surges and failures.

“Old school breakers simply can’t operate as fast as the flow of power,” says Kennedy. “When things go wrong in larger buildings, they go really wrong because you typically have a much bigger source feeding that demand.”

[…]

Poor energy management results in 30,000 electrical hazard accidents per year. Arc flash events can take out an entire building for weeks. Due to their ability to interrupt 100,000 amps with unprecedented speed, digital breakers effectively eliminate these risks, resulting in “the safest, fastest, most intelligent system to date.”

Source: How the World’s First Digital Circuit Breaker Could Completely Change Our Powered World

Over 25,000 Linksys Smart Wi-Fi routers kept info on who connected to them and are now leaking this

Posted on by

Using data provided by BinaryEdge, our scans have found 25,617 Linksys Smart Wi-Fi routers are currently leaking sensitive information to the public internet, including:

    • MAC address of every device that’s ever connected to it (full historical record, not just active devices)
    • Device name (such as “TROY-PC” or “Mat’s MacBook Pro”)
    • Operating system (such as “Windows 7” or “Android”)

In some cases additional metadata is logged such as device type, manufacturer, model number, and description – as seen in the example below.

Example metadata leaking by Linksys Smart Wi-Fi routers

Other sensitive information about the router such as the WAN settings, firewall status, firmware update settings, and DDNS settings are also leaked publicly.

Source: Over 25,000 Linksys Smart Wi-Fi routers vulnerable to sensitive information disclosure flaw – Bad Packets Report

Phone makers and carriers receive your location data, friends and more that Facebook pulls from your phone

Posted on by

A confidential Facebook document reviewed by The Intercept shows that the social network courts carriers, along with phone makers — some 100 different companies in 50 countries — by offering the use of even more surveillance data, pulled straight from your smartphone by Facebook itself.

Offered to select Facebook partners, the data includes not just technical information about Facebook members’ devices and use of Wi-Fi and cellular networks, but also their past locations, interests, and even their social groups. This data is sourced not just from the company’s main iOS and Android apps, but from Instagram and Messenger as well. The data has been used by Facebook partners to assess their standing against competitors, including customers lost to and won from them, but also for more controversial uses like racially targeted ads.

[…]

Facebook’s cellphone partnerships are particularly worrisome because of the extensive surveillance powers already enjoyed by carriers like AT&T and T-Mobile: Just as your internet service provider is capable of watching the data that bounces between your home and the wider world, telecommunications companies have a privileged vantage point from which they can glean a great deal of information about how, when, and where you’re using your phone. AT&T, for example, states plainly in its privacy policy that it collects and stores information “about the websites you visit and the mobile applications you use on our networks.” Paired with carriers’ calling and texting oversight, that accounts for just about everything you’d do on your smartphone.

[…]

the Facebook mobile app harvests and packages eight different categories of information […] These categories include use of video, demographics, location, use of Wi-Fi and cellular networks, personal interests, device information, and friend homophily, an academic term of art. A 2017 article on social media friendship from the Journal of the Society of Multivariate Experimental Psychology defined “homophily” in this context as “the tendency of nodes to form relations with those who are similar to themselves.” In other words, Facebook is using your phone to not only provide behavioral data about you to cellphone carriers, but about your friends as well.

Source: Facebook’s Work With Phone Carriers Alarms Legal Experts

Millions of Instagram influencers had their private contact data scraped and exposed on AWS

Posted on by

A massive database containing contact information of millions of Instagram influencers, celebrities and brand accounts has been found online.

The database, hosted by Amazon Web Services, was left exposed and without a password allowing anyone to look inside. At the time of writing, the database had over 49 million records — but was growing by the hour.

From a brief review of the data, each record contained public data scraped from influencer Instagram accounts, including their bio, profile picture, the number of followers they have, if they’re verified and their location by city and country, but also contained their private contact information, such as the Instagram account owner’s email address and phone number.

Security researcher Anurag Sen discovered the database and alerted TechCrunch in an effort to find the owner and get the database secured. We traced the database back to Mumbai-based social media marketing firm Chtrbox, which pays influencers to post sponsored content on their accounts. Each record in the database contained a record that calculated the worth of each account, based off the number of followers, engagement, reach, likes and shares they had. This was used as a metric to determine how much the company could pay an Instagram celebrity or influencer to post an ad.

Source: Millions of Instagram influencers had their private contact data scraped and exposed | TechCrunch

Bits of Freedom cries to halt the shocking personal data sent out to everyone using Real Time Bidding advertising

Posted on by

During RTB, personal data such as what you read online, what you watch, your location, your sexual orientation, etc is sent to a whole slew of advertisers so they can select you as an object to show their adverts do. This, together with other profiling information sent, can be used to build up a long term profile of you and to identify you. There is no control about what happens to this data once it has been sent. This is clearly contrary to the spirit of the AVG / GDPR. The two standard RTB frameworks – Google’s Authorized Buyers and IAB’s OpenRTB both refuse to accept any responsibility about personal information, whilst both are encouraging and facilitating the trade of it.

Source: Bits of Freedom: stop met grootschalig lekken van persoonsgegevens bij real time bidding – Emerce

Google Gmail tracks purchase history through gmail, puts them on https://myaccount.google.com/purchases

Posted on by

Google tracks a lot of what you buy, even if you purchased it elsewhere, like in a store or from Amazon.

Last week, CEO Sundar Pichai wrote a New York Times op-ed that said “privacy cannot be a luxury good.” But behind the scenes, Google is still collecting a lot of personal information from the services you use, such as Gmail, and some of it can’t be easily deleted.

A page called “Purchases ” shows an accurate list of many — though not all — of the things I’ve bought dating back to at least 2012. I made these purchases using online services or apps such as Amazon, DoorDash or Seamless, or in stores such as Macy’s, but never directly through Google.

But because the digital receipts went to my Gmail account, Google has a list of info about my buying habits.

[…]

But there isn’t an easy way to remove all of this. You can delete all the receipts in your Gmail inbox and archived messages. But, if you’re like me, you might save receipts in Gmail in case you need them later for returns. There is no way to delete them from Purchases without also deleting them from Gmail — when you click on the “Delete” option in Purchases, it simply guides you back to the Gmail message.

[…]

Google’s privacy page says that only you can view your purchases. But it says “Information about your orders may also be saved with your activity in other Google services ” and that you can see and delete this information on a separate “My Activity” page.

Except you can’t. Google’s activity controls page doesn’t give you any ability to manage the data it stores on Purchases.

Google told CNBC you can turn off the tracking entirely, but you have to go to another page for search setting preferences. However, when CNBC tried this, it didn’t work — there was no such option to fully turn off the tracking. It’s weird this isn’t front and center on Google’s new privacy pages or even in Google’s privacy checkup feature.

Google says it doesn’t use your Gmail to show you ads and promises it “does not sell your personal information, which includes your Gmail and Google Account information,” and does “not share your personal information with advertisers, unless you have asked us to.”

But, for reasons that still aren’t clear, it’s pulling that information out of your Gmail and dumping it into a “Purchases” page most people don’t seem to know exists.

Source: Google Gmail tracks purchase history — how to delete it

Radio signals used for ILS plane landings can easily be spoofed using tools amounting to just $600

Posted on by

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research.

In a paper and demonstration from researchers at Northeastern University in Boston, a software defined radio — a non-traditional radio that uses software instead of hardware for many components — successfully tricks a simulated plane into thinking that the aircraft is traveling off-course. 

Through a process called ‘spoofing’ — a term also applied to scam and robo-callers who fake their numbers — researchers are able to deceive an aircraft’s course deviation indicator into thinking the plane is off-center.

This causes it to misalign or falsely ‘correct’ its trajectory and land adjacent to the runway.

Scroll down for video 

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research. In a scary demonstrations, researchers were able to simulate an attack on the radio signals used by nearly all aircraft

+3

With about $600 and a few tools, hackers could fake the radio signals used by commercial airplanes to navigate and land safely, according to new research. In a scary demonstrations, researchers were able to simulate an attack on the radio signals used by nearly all aircraft

As first reported by Ars Technica, the radio signals spoofed by their device, are the same signals used in almost every aircraft throughout the last 50 years, including those on-board large commercial jetliners.

Because of the technology’s age, radio signals used in Instrument Landing Systems (ILS), are not encrypted or authenticated like other digitally transferred data, they say.

While the tools used by researchers in the demonstration aren’t necessarily new, Ars Technica notes that the cost of such devices have come down, making the type of attack more feasible for hackers than ever before.

Researchers note that an attack using their method is possible, but in many cases, misaligned planes can swiftly be corrected by adept pilots who are able to see their positioning in clear conditions and either adjust or perform a fly-around.

Source: Radio signals used to land planes can easily be HACKED using tools amounting to just $600 | Daily Mail Online

One-Third of Ether Held by 376 People – Bloomberg

Posted on by

Just 376 people hold a third of all Ether, the cryptocurrency that powers the Ethereum blockchain, according to new research by Chainalysis Inc.

Large holders are known in the crypto market as “whales,” which Chainalysis defines as individuals who hold their assets in digital wallets and not on an exchange, Kim Grauer, a senior economist at the company, said in an interview. By comparison, 448 people own 20 percent of all Bitcoin, she said.

Chainalysis also looked at the effect Ether whales have on price, and found that large holders don’t move their cryptocurrency often.

“The majority of whales aren’t traders,” she said. “They’re mostly holding.”

Ether rises amid crypto market rally

The study also found that when a whale moves Ether from a wallet to an exchange, there is a small but statistically significant effect on market volatility.

Investor sentiment and the price of Bitcoin are strong indicators of where Ether will trade, the Chainalysis research found. As Bitcoin rallied 52 percent since the beginning of May, Ether rose 48 percent.

Source: One-Third of Ether Held by 376 People – Bloomberg

Hackers abuse ASUS cloud service to install backdoor on users’ PCs – again

Posted on by

ASUS’ update mechanism has once again been abused to install malware that backdoors PCs, researchers from Eset reported earlier this week. The researchers, who continue to investigate the incident, said they believe the attacks are the result of router-level man-in-the-middle attacks that exploit insecure HTTP connections between end users and ASUS servers, along with incomplete code-signing to validate the authenticity of received files before they’re executed.

Plead, as the malware is known, is the work of espionage hackers Trend Micro calls the BlackTech Group, which targets government agencies and private organizations in Asia. Last year, the group used legitimate code-signing certificates stolen from router-maker D-Link to cryptographically authenticate itself as trustworthy. Before that, the BlackTech Group used spear-phishing emails and vulnerable routers to serve as command-and-control servers for its malware.

Source: Hackers abuse ASUS cloud service to install backdoor on users’ PCs | Ars Technica