Carnival Corp. (Holland America / Princess Cruises) Discloses nasty customer Data Breach Amid Covid-19 Panic

Posted on by

Earlier this month, the multibillion-dollar cruise conglomerate Carnival Corp. announced that two of its most popular lines—Holland America and Princess Cruises—were respectively slammed with hacks compromising the sensitive personal intel of cruise-goers and cruise-workers alike. Even though neither announcement makes mention of when each respective breach was disclosed, pulling up the source code for the Princess line’s disclosure reveals that the post happened midday on March 2—just as the U.S. began to learn of the country’s first deaths from covid-19—which is probably why the breach news slipped past most of our radars.

Per Carnival, its cruise companies were hit sometime between April and July of last year, when “an unsanctioned third party gained unauthorized access to some employee email accounts that contained personal information regarding our employees, crew, and guests.”

What kind of information did the “unsanctioned third party” access? All the bad types. Carnival offers a brief rundown:

The types of data potentially impacted varies by individual but can include: name, address, Social Security number, government identification number, such as passport number or driver’s license number, credit card and financial account information, and health-related information.

While neither cruise line has released any hard evidence of any of these details being misused (yet), Holland America’s notice makes sure to mention that guests should consider contacting the major credit bureaus in their respective countries to put fraud alerts on their credit reports. The line also offered to set people up with free credit monitoring and identity protection services to give their guests some “peace of mind.”

Source: Carnival Corp. Discloses Data Breach Amid Covid-19 Panic

139 minor planets were spotted at the outer reaches of our Solar System.

Posted on by

Astronomers have discovered 139 minor planets lurking at the edge of the Solar System after examining a dataset collected to study dark energy in the universe.

Small worlds that circle our Sun in orbits further out than Neptune are labelled trans-Neptunian objects (TNO), with one being the relegated-planet Pluto. Eggheads, led by those at the University of Pennsylvania (UPenn) in the US, identified 316 TNOs in the dark-energy dataset, of which 139 bodies were previously unknown. That’s according to a study published in The Astrophysical Journal this week.

Specifically, the dataset features images snapped by the Dark Energy Survey (DES), a project that used the Victor M. Blanco Telescope at the Cerro Tololo Inter-American Observatory in Chile to study the role of dark energy in the universe’s rate of expansion. The pictures were taken of the southern hemisphere for six years, from 2013 to 2019.

“The number of TNOs you can find depends on how much of the sky you look at and what’s the faintest thing you can find,” said Gary Bernstein, co-author of the study and a Professor of Astronomy and Astrophysics at UPenn.

Unlike stars or supernovas, TNOs don’t emit a lot of light. The trick to spotting TNOs among all the other stuff in the images is to look for things that move. TNOs orbit the Sun whereas stars and distant galaxies appear more fixed. “Dedicated TNO surveys have a way of seeing the object move, and it’s easy to track them down,” said Pedro Bernardinelli, first author of the paper and a graduate student at UPenn. “One of the key things we did in this paper was figure out a way to recover those movements.”

The academics began with seven billion objects in the DES dataset. After they removed static objects – things that appeared in the same spot on multiple nights – they were left with a list of 22 million transient objects.

Each one looks like a dot, and the goal was to track each dot as it traveled across the sky to see if it really was an individual object. That narrowed the list down to 400 candidates that warranted further study and verification.

“We have this list of candidates, and then we have to make sure that our candidates are actually real things,” Bernardinelli said. They then realized 316 of the 400 candidates were TNOs – and 139 of that 316 were previously undetected minor worlds.

The boffins only rifled through four years’ worth of data, and they believe that, by using their method, many more TNOs can be uncovered in the future.

Source: We’re not saying Earth is doomed… but 139 minor planets were spotted at the outer reaches of our Solar System. Just an FYI, that’s all • The Register

900 Million Secrets From 8 Years of ‘Whisper’ App Were Left Exposed Online

Posted on by

Whisper, the secret-sharing app that called itself the “safest place on the Internet,” left years of users’ most intimate confessions exposed on the Web tied to their age, location and other details, raising alarm among cybersecurity researchers that users could have been unmasked or blackmailed.

The data exposure, discovered by independent researchers and shown to The Washington Post, allowed anyone to access all of the location data and other information tied to anonymous “whispers” posted to the popular social app, which has claimed hundreds of millions of users. The records were viewable on a non-password-protected database open to the public Web. A Post reporter was able to freely browse and search through the records, many of which involved children: A search of users who had listed their age as 15 returned 1.3 million results.

The cybersecurity consultants Matthew Porter and Dan Ehrlich, who lead the advisory group Twelve Security, said they were able to access nearly 900 million user records from the app’s release in 2012 to the present day. The researchers alerted federal law-enforcement officials and the company to the exposure.

Shortly after researchers and The Post contacted the company on Monday, access to the data was removed.

Source: 900 Million Secrets From 8 Years of ‘Whisper’ App Were Left Exposed Online – Slashdot

Why are workers getting smaller pieces of the pie?

Posted on by

It’s one of the biggest economic changes in recent decades: Workers get a smaller slice of company revenue, while a larger share is paid to capital owners and distributed as profits. Or, as economists like to say, there has been a fall in labor’s share of gross domestic product, or GDP.

A new study co-authored by MIT economists uncovers a major reason for this trend: Big companies that spend more on capital and less on workers are gaining market share, while smaller firms that spend more on workers and less on capital are losing market share. That change, the researchers say, is a key reason why the labor share of GDP in the U.S. has dropped from around 67 percent in 1980 to 59 percent today, following decades of stability.

“To understand this phenomenon, you need to understand the reallocation of economic activity across firms,” says MIT economist David Autor, co-author of the paper. “That’s our key point.”

To be sure, many economists have suggested other hypotheses, including new generations of software and machines that substitute directly for workers, the effects of international trade and outsourcing, and the decline of labor union power. The current study does not entirely rule out all of those explanations, but it does highlight the importance of what the researchers term “superstar firms” as a primary factor.

“We feel this is an incredibly important and robust fact pattern that you have to grapple with,” adds Autor, the Ford Professor of Economics in MIT’s Department of Economics.

The paper, “The Fall of the Labor Share and the Rise of Superstar Firms,” appears in advance online form in the Quarterly Journal of Economics.

[…]

For much of the 20th century, labor’s share of GDP was notably consistent. As the authors note, John Maynard Keynes once called it “something of a miracle” in the face of economic changes, and the British economist Nicholas Kaldor included labor’s steady portion of GDP as one of his often-cited six “stylized facts” of growth.

To conduct the study, the researchers scrutinized data for the U.S. and other countries in the Organization of Economic Cooperation and Development (OECD). The scholars used U.S. Economic Census data from 1982 to 2012 to study six economic sectors that account for about 80 percent of employment and GDP: manufacturing, retail trade, wholesale trade, services, utilities and transportation, and finance. The data includes payroll, total output, and total employment.

The researchers also used information from the EU KLEMS database, housed at the Vienna Institute for International Economic Studies, to examine the other OECD countries.

The increase in market dominance for highly competitive top firms in many of those sectors is evident in the data. In the retail trade, for instance, the top four firms accounted for just under 15 percent of sales in 1981, but that grew to around 30 percent of sales in 2011. In utilities and transportation, those figures moved from 29 percent to 41 percent in the same time frame. In manufacturing, this top-four sales concentration grew from 39 percent in 1981 to almost 44 percent in 2011.

At the same time, the average payroll-to-sales ratio declined in five of those sectors—with finance being the one exception. In manufacturing, the payroll-to-sales ratio decreased from roughly 18 percent in 1981 to about 12 percent in 2011. On aggregate, the labor share of GDP declined at most times except the period from 1997 to 2002, the final years of an economic expansion with high employment.

But surprisingly, labor’s share is not falling at the typical firm. Rather, reallocation of between firms is the key. In general, says Autor, the picture is of a “winner-take-most setting, where a smaller number of firms are accounting for a larger amount of economic activity, and those are firms where workers historically got a smaller share of the pie.”

A key insight provided by the study is that the dynamics within industry sectors has powered the drop in the labor share of GDP. The overall change is not just the result of, say, an increase in the deployment of technology in manufacturing, which some economists have suggested. While manufacturing is important to the big picture, the same phenomenon is unfolding across and within many sectors of the economy.

As far as testing the remaining alternate hypotheses, the study found no special pattern within industries linked to changes in trade policy—a subject Autor has studied extensively in the past. And while the decline in union power cannot be ruled out as a cause, the drop in labor share of GDP occurs even in countries where unions remain relatively stronger than they do in the U.S.

Source: Why are workers getting smaller pieces of the pie?

He then goes on to say:

“We shouldn’t presume that just because a market is concentrated—with a few leading firms accounting for a large fraction of sales—it’s a market with low productivity and high prices,” Autor says. “It might be a market where you have some very productive leading firms.” Today, he adds, “more competition is platform-based competition, as opposed to simple price competition. Walmart is a platform business. Amazon is a platform business. Many tech companies are platform businesses. Many financial services companies are platform businesses. You have to make some huge investment to create a sophisticated service or set of offerings. Once that’s in place, it’s hard for your competitors to replicate.”

With this in mind, Autor says we may want to distinguish whether market concentration is “the bad kind, where lazy monopolists are jacking up prices, or the good kind, where the more competitive firms are getting a larger . To the best we can distinguish, the rise of superstar firms appears more the latter than the former. These firms are in more innovative industries—their productivity growth has developed faster, they make more investment, they patent more. It looks like this is happening more in the frontier sectors than the laggard sectors.”

Still Autor adds, the paper does contain policy implications for regulators.

“Once a firm is that far ahead, there’s potential for abuse,” he notes. “Maybe Facebook shouldn’t be allowed to buy all its competitors. Maybe Amazon shouldn’t be both the host of a market and a competitor in that market. This potentially creates regulatory issues we should be looking at. There’s nothing in this paper that says everyone should just take a few years off and not worry about the issue.”

I’d completely disagree – platform businesses are behaving like monopolists, but you need to look beyond product price to understand that selling at a loss is called undercutting and there are many many other reasons that monopoly is a bad thing, as I explain below.

Engineers rediscover electric control of atomic nuclius, get it working. Means easy quantum computer control among other things.

Posted on by

A happy accident in the laboratory has led to a breakthrough discovery that not only solved a problem that stood for more than half a century, but has major implications for the development of quantum computers and sensors.In a study published today in Nature, a team of engineers at UNSW Sydney has done what a celebrated scientist first suggested in 1961 was possible, but has eluded everyone since: controlling the nucleus of a single atom using only electric fields.

“This discovery means that we now have a pathway to build quantum computers using single-atom spins without the need for any oscillating magnetic field for their operation,” says UNSW’s Scientia Professor of Quantum Engineering Andrea Morello. “Moreover, we can use these nuclei as exquisitely precise sensors of electric and magnetic fields, or to answer fundamental questions in quantum science.”

That a nuclear spin can be controlled with electric, instead of magnetic fields, has far-reaching consequences. Generating magnetic fields requires large coils and high currents, while the laws of physics dictate that it is difficult to confine magnetic fields to very small spaces—they tend to have a wide area of influence. Electric fields, on the other hand, can be produced at the tip of a tiny electrode, and they fall off very sharply away from the tip. This will make control of individual atoms placed in nanoelectronic devices much easier.

[…]

Prof Morello uses the analogy of a billiard table to explain the difference between controlling nuclear spins with magnetic and electric fields.

“Performing magnetic resonance is like trying to move a particular ball on a billiard table by lifting and shaking the whole table,” he says. “We’ll move the intended ball, but we’ll also move all the others.”

[…]

After demonstrating the ability to control the nucleus with electric fields, the researchers used sophisticated computer modelling to understand how exactly the electric field influences the spin of the nucleus. This effort highlighted that nuclear electric is a truly local, microscopic phenomenon: the electric field distorts the atomic bonds around the nucleus, causing it to reorient itself.

“This landmark result will open up a treasure trove of discoveries and applications,” says Prof Morello. “The system we created has enough complexity to study how the classical world we experience every day emerges from the quantum realm. Moreover, we can use its quantum complexity to build sensors of electromagnetic fields with vastly improved sensitivity. And all this, in a simple electronic device made in silicon, controlled with small voltages applied to a metal electrode!”

Source: Engineers crack 58-year-old puzzle on way to quantum breakthrough

US Rule Waiver Will Reduce Empty Planes During Virus Outbreak (after in EU) and then closes US airspace to EU flights after blaming EU for Corona

Posted on by

Federal regulators waived a rule Wednesday that was causing airlines to fly nearly empty planes just to avoid losing takeoff and landing rights at major airports.

The Federal Aviation Administration said it would suspend the rule through May 31 to help airlines that are canceling flights because of the new virus outbreak.

The FAA assigns takeoff and landing rights, or “slots,” at a few big, congested airports. Airlines must use 80% of their highly coveted slots or risk forfeiting them.

That FAA requirement — and especially a similar rule in Europe — led airlines to operate flights using those slots even if there were very few passengers.

The FAA’s decision affects flights at John F. Kennedy and LaGuardia airports in New York and Reagan Washington National Airport outside Washington, D.C.

The FAA said it also would not punish airlines that cancel flights through May 31 at four other airports where the agency approves schedules: Chicago’s O’Hare International Airport, Newark Liberty International Airport in New Jersey; Los Angeles International Airport and San Francisco International Airport.

The FAA waiver covers U.S. and foreign airlines. The agency’s announcement came a day after the European Commission promised to move quickly to waive its similar rule.

It could take weeks or even months for the European Commission to adopt the proposal, but it is likely to have immediate effect. It is a signal to airlines that they can stop flying mostly empty planes and still be confident that the emergency rules change will be approved before airport slots are allotted again.

Source: Rule Waiver Will Reduce Empty Planes During Virus Outbreak | Time

Donald Trump has suspended all travel to the US from Europe for 30 days to try and tackle the coronavirus crisis.

The draconian measures come into effect from midnight Friday, but do not apply to the United Kingdom. Trump revealed his plans in a rare Oval Office address on Wednesday night while criticizing the European Union for allowing the virus to take hold.

He said: ‘The European Union failed to take the same precautions (as the US) and restrict travel from China and other hotspots. As a result, a large number of new clusters in the United States were seeded by travelers from Europe.

‘After consulting with our top government health officials I have decided to take several strong but necessary actions to protect the health of all Americans. To stop new cases from entering our shores we will be suspending all travel from Europe to our shores for 30 days.’

Source: Donald Trump bans all travel from Europe to US for 30 days to stop coronavirus

Blasting Airplane With Lasers Makes It Harder For Ice to Stick

Posted on by

researchers from Fraunhofer Institute for Material and Beam Technology IWS, aircraft manufacturer Airbus, and the Dresden University of Technology in Germany have co-developed a better way to keep planes free of ice and snow. It uses a technology called Direct Laser Interference Patterning (DLIP), where a laser is split into multiple beams that overlap each other creating complex etched patterns on a surface where the beams are focused.

Illustration for article titled Blasting Airplanes With Lasers Makes It Much Harder For Ice to Stick to Wings
Photo: Fraunhofer Institute

By adapting the DLIP technique to create three-dimensional structures at the microscopic level, the laser etching technique is able to turn an airplane’s wing into a material with reduced surface area that ice simply has a hard time holding onto. As a result, after reaching a certain thickness and weight, built up ice simply falls off a wing all on its own. It could not only reduce the need for de-icing procedures at airports, but it could also remove the need for antifreeze and other chemical agents altogether.

Waiting for ice to spontaneously fall off on its own isn’t always an option, like when you’re cruising along at 500+ miles per hour, 30,000 feet in the air. So additional testing by the researchers found that while it took over a minute for ice to melt off a wing surface with 60 watts of heat applied, the same material, treated with the laser etching process, saw ice completely vanish after just five seconds with the same amount of heat. Not only does it mean an aircraft could be cleared of ice much faster without the use of chemicals, but it also means that aircraft manufacturers could include smaller heating systems that were just as effective, but with drastically reduced fuel consumption.

The new use for the DLIP technology isn’t only useful for keeping aircraft safe and free of ice, it could be applied to everything from the blades on giant power-generating windmills, to the hulls of ships braving icy waters. The biggest benefit could be applying it to the windows of a car, making scraping them clean on a cold winter’s morning as easy as wiping away raindrops—assuming, of course, that the etching process still lets you actually see through the glass.

Source: Blasting Airplane With Lasers Makes It Harder For Ice to Stick

Banjo, the company that will use an AI to spy on all of Utah through all their cams Used a Secret Company and Fake Apps to Scrape Social Media

Posted on by

Banjo, an artificial intelligence firm that works with police used a shadow company to create an array of Android and iOS apps that looked innocuous but were specifically designed to secretly scrape social media, Motherboard has learned.

The news signifies an abuse of data by a government contractor, with Banjo going far beyond what companies which scrape social networks usually do. Banjo created a secret company named Pink Unicorn Labs, according to three former Banjo employees, with two of them adding that the company developed the apps. This was done to avoid detection by social networks, two of the former employees said.

Three of the apps created by Pink Unicorn Labs were called “One Direction Fan App,” “EDM Fan App,” and “Formula Racing App.” Motherboard found these three apps on archive sites and downloaded and analyzed them, as did an independent expert. The apps—which appear to have been originally compiled in 2015 and were on the Play Store until 2016 according to Google—outwardly had no connection to Banjo, but an analysis of its code indicates connections to the company. This aspect of Banjo’s operation has some similarities with the Cambridge Analytica scandal, with multiple sources comparing the two incidents.

“Banjo was doing exactly the same thing but more nefariously, arguably,” a former Banjo employee said, referring to how seemingly unrelated apps were helping to feed the activities of the company’s main business.

[…]

Last year Banjo signed a $20.7 million contract with Utah that granted the company access to the state’s traffic, CCTV, and public safety cameras. Banjo promises to combine that input with a range of other data such as satellites and social media posts to create a system that it claims alerts law enforcement of crimes or events in real-time.

“We essentially do most of what Palantir does, we just do it live,” Banjo’s top lobbyist Bryan Smith previously told police chiefs and 911 dispatch officials when pitching the company’s services.

[…]

Motherboard found the apps developed by Pink Unicorn Labs included code mentioning signing into Facebook, Twitter, Instagram, Russian social media app VK, FourSquare, Google Plus, and Chinese social network Sina Weibo.

[…]

One of the former employees said they saw one of the apps when it was still working and it had a high number of logins.

“It was all major social media platforms,” they added. The particular versions of the apps Motherboard obtained, when opened, asked a user to sign-in with Instagram.

Business records for Pink Unicorn Labs show the company was originally incorporated by Banjo CEO Damien Patton. Banjo employees worked directly on Pink Unicorn Labs projects from Banjo’s offices, several of the former employees said, though they added that Patton made it clear in recent years that Banjo needed to wind down Pink Unicorn Labs’ work and not be linked to the firm.

“There was something about Pink Unicorn that was important for Damien to distance himself from,” another former employee told Motherboard.

[…]

ome similar companies, like Dataminr, have permission from social media sites to use large amounts of data; Twitter, which owns a stake in Dataminr, gives the firm exclusive access to its so-called “fire hose” of public posts.

Banjo did not have that sort of data access. So it created Pink Unicorn Labs, which one former employee described as a “shadow company,” that developed apps to harvest social media data.

“They were shitty little apps that took advantage of some of the data that we had but the catch was that they had a ton of OAuth providers,” one of the former employees said. OAuth providers are methods for signing into apps or websites via another service, such as Facebook’s “Facebook Connect,” Twitter’s “Sign In With Twitter,” or Google’s “Google Sign-In.” These providers mean a user doesn’t have to create a new account for each site or app they want to use, and can instead log in via their already established social media identity.

But once users logged into the innocent looking apps via a social network OAuth provider, Banjo saved the login credentials, according to two former employees and an expert analysis of the apps performed by Kasra Rahjerdi, who has been an Android developer since the original Android project was launched. Banjo then scraped social media content, those two former employees added. The app also contained nonstandard code written by Pink Unicorn Labs: “The biggest red flag for me is that all the code related to grabbing Facebook friends, photos, location history, etc. is directly from their own codebase,” Rahjerdi said.

[…]

“Banjo was secretly farming peoples’ user tokens via these shadow apps,” one of the former employees said. “That was the entire point and plan,” they added when asked if the apps were specifically designed to steal users’ login tokens.

[…]

The apps request a wide range of permissions, such as access to location data, the ability to create accounts and set passwords, and find accounts on the device.

Multiple sources said Banjo tried to keep Pink Unicorn Labs a secret, but Motherboard found several links between the two. An analysis of the Android apps revealed all three had code that contained web links to Banjo’s website; each app contained a set of identical data that appeared to be pulled from social network sites, including repeatedly the Twitter profile of Jennifer Peck, who works for Banjo and is also married to Banjo’s Patton. In registration records for the two companies, both Banjo and Pink Unicorn Labs shared the same address in Redwood, California; and Patton is listed as the creator of Pink Unicorn Labs in that firm’s own public records.

Source: Surveillance Firm Banjo Used a Secret Company and Fake Apps to Scrape Social Media – VICE

US Navy flies two EA-18G Growlers autonomously; third Growler used as controller

Posted on by

The US Navy (USN) flew two Boeing EA-18G Growlers as autonomous unmanned air vehicles (UAVs), using a third Growler as a flight controller.

In total, four flights were conducted at Naval Air Station Patuxent River, with tests starting in September 2019, says manufacturer Boeing on 4 February. The aircraft demonstrated 21 missions during flights that took place toward the end of 2019, says Boeing. The type of missions were not disclosed.

Two US Navy EA-18G Growlers over Afghanistan

Source: US Air Force

Two US Navy EA-18G Growlers fly over Afghanistan in January 2020

The flights are a forerunner to using the EA-18G as a mission-controlling platform for autonomous Loyal Wingman UAVs. Unmmaned-manned teaming is a new US Department of Defense concept in aerial combat where some work would be offloaded to UAVs, especially dangerous missions.

“This demonstration allows Boeing and the Navy the opportunity to analyse the data collected and decide where to make investments in future technologies,” says Tom Brandt, Boeing manned-unmanned teaming demonstration lead. “It could provide synergy with other US Navy unmanned systems in development across the spectrum and in other services.”

Boeing says the flights were conducted during the USN Warfare Development Command’s annual fleet experiment exercises.

[…]

The USN has said previously that it is planning on upgrading some, if not all, of its 160-example Growler fleet to a Block II configuration, which includes an advanced cockpit system, conformal fuel tanks, improved sensors and an upgraded electronic attack package. The upgrades would also include the ability to control Loyal Wingman aircraft, Boeing said.

Boeing Airpower Teaming System flying with EA-18G Growler

Source: Boeing

Rendering of Boeing Airpower Teaming System flying with EA-18G Growler

Boeing has not said previously that the Block II upgrade package would include the ability to fly the EA-18G autonomously.

“This technology allows the Navy to extend the reach of sensors while keeping manned aircraft out of harm’s way,” Brandt of Boeing says. “It’s a force multiplier that enables a single aircrew to control multiple aircraft without greatly increasing workload. It has the potential to increase survivability as well as situational awareness.”

The EA-18Gs were modified over summer 2019, says Boeing.

”Three Growlers were modified to support an open architecture processor and advanced networking, which allowed for two of the Growlers to be transformed into unmanned air system surrogate aircraft,” the company says. Those two pieces of technology were prototypes that are also planned as part of Boeing’s Block III upgrades for the Super Hornet, the Distributed Targeting Processor-Networked and the Rockwell Collins Tactical Targeting Network Technology radio.

Source: US Navy flies two EA-18G Growlers autonomously; third Growler used as controller | News | Flight Global

a tiny swarm 🙂

Whisper App Exposes Entire History of Chat Logs, personal details and location

Posted on by

Whisper, the anonymous messaging app beloved by teens and tweens the world over, has a problem: it’s not as anonymous as we’d thought. The platform is only the latest that brands itself as private by design while leaking sensitive user data into the open, according to a damning Washington Post report out earlier today. According to the sleuths that uncovered the leak, “anonymous” posts on the platform—which tackle everything from closeted homosexuality, to domestic abuse, to unwanted pregnancies—could easily be tied to the original poster.

As is often the case, the culprit was a leaky bucket, that housed the platform’s entire posting history since it first came onto the scene in 2012. And because this app has historically courted a ton of teens, a lot of this data can get really unsavory, really fast. The Post describes being able to pull a search for users that listed their age as fifteen and getting more than a million results in return, which included not only their posts, but any identifying information they gave the platform, like age, ethnicity, gender, and the groups they were a part of—including groups that are centered around delicate topics like sexual assault.

Whisper told the Post that they’d shut down the leak once being contacted—a point that Gizmodo independently confirmed. Still, the company has yet to come around to cracking down on its less-than-satisfying policies surrounding location data. In 2014, Whisper was caught sharing this data with federal researchers as part of research on personnel stationed at military bases. In the years since then, it looks like a lot of this data is still up for grabs. While some law enforcement officials might need to get their hands on it, Gizmodo’s own analysis found multiple targeted advertising partners that are scooping up user location data as recently as this afternoon.

Source: Whisper App Exposes Entire History of Chat Logs: Report

Intel CPUs vulnerable to new LVI attacks, allows information injection

Posted on by

Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs.

While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.

A reverse Meltdown attack

To understand what an LVI attack is, users must first be aware of the Meltdown and Spectre attacks, and more particularly Meltdown.

Disclosed in January 2018, the Meltdown attack allowed an attacker running code on a CPU to read data from the CPU’s memory, while the CPU was processing “speculative” operations.

Speculative execution is a feature of all modern CPUs, one in which the CPU computes information in advance in an attempt to guess future results. The entire idea of speculative execution is to have the data ready for the CPU, if it ever needs it, and help improve the CPU’s speed and performance. Once data is not needed, it’s discarded. Meltdown and Spectre attacks target data while in this “transient” state, while waiting to be dismissed.

lvi-transient.png

The Meltdown and Spectre attacks were groundbreaking when they were first revealed in 2018, showing a major flaw in the designs of modern CPUs.

Based on the original attacks, academics around the world later expanded the original research and discovered an entire class of so-called “transient attacks” that also leaked data from CPUs in their “transient” speculative execution states.

Besides Meltdown and Spectre, other transient attacks were eventually discovered during the past two years, including the likes of Foreshadow, Zombieload, RIDL, Fallout, and LazyFP.

lvi-table.png

LVI’s position in all these attacks is, technically, of a reverse-Meltdown. While the original Meltdown bug allowed attackers to read an app’s data from inside a CPU’s memory while in a transient state, LVI allows the attacker to inject code inside the CPU and have it executed as a transient “temporary” operation, giving attackers more control over what happens.

lvi-steps.png

Tests performed by the two research teams — who found the LVI attack independently from one another — have been successful at proving the attack’s broad impact.

[…]

Current LVI attack demos rely on running malicious code on a computer, suggesting that local access is needed — such as delivering malicious code to the target via malware.

However, a remote attack is also possible via JavaScript, by tricking users into accessing a malicious site — similar to the original Meltdown attack, which could also be carried out via JavaScript.

[…]

While a change in the silicon design will eventually come with future CPUs, currently, Intel has prepared software-based mitigations, in the form of CPU firmware (microcode) updates.

However, according to preliminary tests, these mitigations come with a severe performance impacted that may slow down computations from 2 to 19 times, depending on the number of mitigations system administrators decide to apply to their CPUs.

Currently, many administrators are expected to skip these patches, primarily because of the severe performance impact.

Source: Intel CPUs vulnerable to new LVI attacks | ZDNet

New type of pulsating star discovered

Posted on by

A star that pulsates on just one side has been discovered in the Milky Way about 1500 light years from Earth. It is the first of its kind to be found and scientists expect to find many more similar systems as technology to listen inside the beating hearts of stars improves.

[…]

Stars that pulsate have been known in astronomy for a long time. Our own Sun dances to its own rhythms. These rhythmic pulsations of the stellar surface occur in young and in old stars, and can have long or short periods, a wide range of strengths and different causes.

There is however one thing that all these stars had thus far in common: the oscillations were always visible on all sides of the star. Now an international team, including researchers from the University of Sydney, has discovered a star that oscillates largely over one hemisphere.

00:00
-00:15
Artist’s impression of pulsating star. Credit: Gabriel Pérez Díaz (IAC)

The scientists have identified the cause of the unusual single-sided : the star is located in a binary star system with a red dwarf. Its close companion distorts the oscillations with its . The clue that led to its discovery came from citizen scientists poring over public data from NASA’s TESS satellite, which is hunting for planets around distant stars.

The orbital period of the binary system, at less than two days, is so short that the larger star is being distorted into a tear-drop shape by the gravitational pull of the companion.

[…]

To their surprise the team observed that the strength of the pulsations depended on the aspect angle under which the star was observed, and the corresponding orientation of the star within the binary. This means the pulsation strength varies with the same period as that of the binary.

“As the binary stars orbit each other we see different parts of the pulsating star,” said Dr. David Jones at the Instituto de Astrofisica de Canarias and co-author of the study. “Sometimes we see the side that points towards the companion star, and sometimes we see the outer face.”

This is how the astronomers could be certain that the pulsations were only found on one side of the star, with the tiny fluctuations in brightness always appearing in their observations when the same hemisphere of the star was pointed towards the telescope.

Source: New type of pulsating star discovered

Avast’s and AVG AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping

Posted on by

Web researcher David Eade found and reported CVE-2020-8987 to Avast: this is a trio of blunders that, when combined, can be exploited by a snooper to silently intercept and tamper with an AntiTrack user’s connections to even the most heavily secured websites.

This is because when using AntiTrack, your web connections are routed through the proxy software so that it can strip out tracking cookies and similar stuff, enhancing your privacy. However, when AntiTack connects to websites on your behalf, it does not verify it’s actually talking to the legit sites. Thus, a miscreant-in-the-middle, between AntiTrack and the website you wish to visit, can redirect your webpage requests to a malicious server that masquerades as the real deal, and harvest your logins or otherwise snoop on you, and you’d never know.

The flaws affect both the Avast and AVG versions of AntiTrack, and punters are advised to update their software as a fix for both tools has been released.

Eade has been tracking the bug since August last year.

“The consequences are hard to overstate. A remote attacker running a malicious proxy could capture their victim’s HTTPS traffic and record credentials for later re-use,” he said. “If a site needs two factor authentication (such as a one-time password), then the attacker can still hijack a live session by cloning session cookies after the victim logs in.”

Source: Avast’s AntiTrack promised to protect your privacy. Instead, it opened you to miscreant-in-the-middle snooping • The Register

FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more

Posted on by

In fact, the marketing database also contained some subscribers’ requests to block or unblock access to X-rated and gambling websites, unique ID numbers of stolen cellphones, and records of whichever site they were visiting before arriving at the Virgin Media website.

This is according to British infosec shop Turgensec, which discovered the poorly secured Virgin Media info silo and privately reported it to the broadband-and-TV-and-phone provider. The research team today said the extent of the data spill was more extensive, and personal, than Virgin Media’s official disclosure seemed to suggest.

Here, in full, is what Turgensec said it found in the data cache that was exposed from mid-April to this month:

* Full names, addresses, date of birth, phone numbers, alternative contact phone numbers and IP addresses – corresponding to both customers and “friends” referred to the service by customers.

* Requests to block or unblock various pornographic, gore related and gambling websites, corresponding to full names and addresses. IMEI numbers associated with stolen phones.

* Subscriptions to the different aspects of their services, including premium components.

* The device type owned by the user, where relevant.

* The “Referrer” header taken seemingly from a users browser, containing what would appear to be the previous website that the user visited before accessing Virgin Media.

* Form submissions by users from their website.

Those website block and unblock requests were a result of Britain’s ruling class pressuring ISPs to implement filters to prevent kids viewing adult-only material via their parents’ home internet connections. The filters were also supposed to stop Brits from seeing any particularly nasty unlawful content.

Virgin Media today stressed the database held about a thousand subscribers’ filter request inquiries.

Source: FYI: When Virgin Media said it leaked ‘limited contact info’, it meant p0rno filter requests, IP addresses, IMEIs as well as names, addresses and more • The Register

NASA declares Starliner mishap a “high visibility close call”

Posted on by

After pondering the totality of issues that arose during a December test flight of Boeing’s Starliner spacecraft this week, NASA chief of human spaceflight Doug Loverro said Friday that he decided to escalate the incident.

So he designated Starliner’s uncrewed mission, during which the spacecraft flew a shortened profile and did not attempt to dock with the International Space Station, as a “high visibility close call.” This relatively rare designation for NASA’s human spaceflight program falls short of “loss of mission” but is nonetheless fairly rare. It was last used by NASA after a spacewalk in 2013 when water began to dangerously pool in the helmet of astronaut Luca Parmitano.

Further Reading

Boeing acknowledges “gaps” in its Starliner software testing

Asked to explain during a conference call with reporters why he did this, Loverro said, “We could have lost a spacecraft twice during this mission.”

In this, Loverro referred to two software errors that occurred during the two-day flight. The first problem occurred when Starliner captured the wrong “mission elapsed time” from its Atlas V launch vehicle—it was supposed to pick up this time during the terminal phase of the countdown, but instead it grabbed data 11 hours off of the correct time. This led to a delayed push to reach orbit. The second error, caught and fixed just a few hours before the vehicle returned to Earth through the atmosphere, was due to a software mapping error that would have caused thrusters on Starliner’s service module to fire in the wrong manner.

NASA and Boeing officials held Friday’s teleconference to announce the conclusion of a report from an Independent Review Team established after December’s flight. These reviewers made 60 recommendations to NASA and Boeing for corrective actions that ranged from fixing these software issues to ferreting out others that may still exist in the spacecraft’s flight code. The investigative team is also still looking into an issue that led to multiple dropouts in communications between the ground and spacecraft during key moments of the flight.

Corrective action plan

By declaring the Starliner mishap a “close call,” Loverro also formally opened a process during which the space agency’s Safety Office will investigate the organization elements that may have led to the incident—likely focusing on why NASA did not detect the errors in Starliner’s flight software.

Loverro said no decisions are close to being made on when Starliner will return to flight or whether Boeing will have to fly another uncrewed demonstration test flight before NASA astronauts fly on Starliner. The next step, he said, is for Boeing to prepare a “corrective action plan” to implement the review team’s findings, and that will include a schedule. NASA will evaluate that plan and then it may be in a position to decide whether another test flight is needed.

Source: NASA declares Starliner mishap a “high visibility close call” | Ars Technica

The Truth About Bioplastic

Posted on by

Bioplastics date back more than 160 years, but they’ve seen a surge in interest and production in the past few decades. In 2018, the world produced 2.6 million tons of bioplastic, according to data from the Institute for Bioplastics and Biocomposites (IFBB). That’s a fraction of the 300 million tons of plastic produced, but IFBB also projects bioplastic production could grow 65 percent by 2023.

More bioplastic isn’t inherently bad. Done right, it could reduce plastic carbon emissions by up to 3.8 gigatons by 2050. But the done right part is the key, and so far, the world has shown little propensity to do that.

Bioplastic actually breaks into two categories: plastics made from plants and algae and plastic that biodegrades over time. The companies producing each of these types of plastic have in some ways banked on the hazy label bioplastic to make their plastic seem more environmentally friendly than regular old plastic made from oil.

“It has been controlled as a marketing arm, not a science one,” Taylor Weiss, an engineering working on algae-based plastics at the Arizona State University, told Earther. “Companies who say ‘this is biodegradable,’ just because it’s possible, it’s not likely.”

The most common form of bioplastic is PLA, a hard plastic that can replace the bottle, cups, and other vessels. It’s biodegradable and companies that sell PLA products often play that up from their names like Planet+ and Repurpose to their green branding. But what the companies don’t advertise as clearly is that while these cups are compostable, they need to go to the proper facilities.

“PLA is biodegradable but it’s biodegradable like wood,” Weiss said. “It will degrade over time but you’ll need industrial facilities.”

Flicking one into your recycling bin won’t get it there. Instead, it “can contaminate and disrupt the recycling stream if intermixed with petroleum-based plastics that are non-compostable,” according to the Environmental Protection Agency. And most municipalities simply don’t have a a curbside compostable plastic pickup. That means your compostable cup will usually end up in a landfill.

In fact, most of your recycling increasingly ends up in landfills owing to the fact that China banned many recyclable items it used to import and U.S. facilities don’t have the capacity to handle that. Once in a landfill, the PLA will breakdown, but like the plants it came from, it will emit greenhouse gases.

“If it’s a section of landfill with open recycling pits, it’s eventually going to become carbon dioxide [as it biodegrades],” Weiss said. “At worst, it could become methane, which is extremely more potent.”

Unlike plants, any benefits from its breakdown will not go back into the soil. Instead, its remnants will fester in a huge pile of garbage. Not exactly regenerative!

In addition, PLA is much like biofuels that can displace food production. The world population is projected to balloon to 9 billion by midcentury, and research has shown we’re going to need all the land we can get.

The algae- and bacteria-based bioplastics known as PHA offer a more effective avenue to reducing the forever-impacts of plastic, getting us closer to a circular economy. But it’s still more expensive to make that type of bioplastic and like PLA they require proper sorting and recycling.

There are a few fixes in the interim like improved bioplastic labeling that makes clear how likely it is to be composted, akin a program in the UK for regular plastics. The industry itself could also be better-regulated and municipalities could do a better job educating residents about what to do with bioplastics in the first place. And perhaps the best fix is to cut down on plastic use, bio-based or otherwise, all together.

“It’s this great big global complicated problem,” Weiss said. “People should be aware there are no silver bullets, there’s a quiver full of arrows.”

Source: The Truth About Bioplastic

Open Source Small Nuclear Reactors Designs

Posted on by

What would happen if everyone in the world had access to nuclear reactor blueprints? We’re about to find out. A mechanical engineer-turned-tech entrepreneur has plans to, well, empower people around the world to build their own 100-megawatt nuclear power reactors. That’s much larger than some of the modular reactors designed by nuclear startups, but still much smaller than operating nuclear power plants in the U.S.

The Energy Impact Center (EIC) is an energy nonprofit that engineer Bret Kugelmass founded in 2017. The organization’s goals are similar to other groups working toward carbon neutrality or negativity, except Kugelmass has decided “cheap nuclear” is the only avenue he wants to pursue. By doing that, he’s essentially operating a startup model, and for his technology to take hold, a new paradigm for nuclear power plants will have to be installed.

“Today, we offer reference plant schematics and a platform to compile ongoing design work. With the help of our partners and the National Labs, these drawings will evolve into a fully detailed, ready-to-build blueprint,” the project website says. It seems like EIC exists to feed new technology into the nuclear startup development pipeline, with the lampshade that nuclear is considered a cleaner power source in the carbon interregnum.

The details of Kugelmass’s plants are exciting. “This standardized pressurized water reactor (PWR) power plant is sized at 100MWe output to fit within project finance and timetable constraints,” he writes. “It is detailed enough for any utility to begin early site studies with +/- 20 [percent] cost predictability. It is abstract enough to allow for site-specific engineering details to be added, with a 50M dollar budget allocated per plant for such efforts.”

Source: Small Nuclear Reactors | Nuclear Reactor Types and Designs

Utah has given all its camera feeds to an AI, turning it Into a Surveillance Panopticon

Posted on by

The state of Utah has given an artificial intelligence company real-time access to state traffic cameras, CCTV and “public safety” cameras, 911 emergency systems, location data for state-owned vehicles, and other sensitive data.

The company, called Banjo, says that it’s combining this data with information collected from social media, satellites, and other apps, and claims its algorithms “detect anomalies” in the real world.

The lofty goal of Banjo’s system is to alert law enforcement of crimes as they happen. It claims it does this while somehow stripping all personal data from the system, allowing it to help cops without putting anyone’s privacy at risk. As with other algorithmic crime systems, there is little public oversight or information about how, exactly, the system determines what is worth alerting cops to.

Source: This Small Company Is Turning Utah Into a Surveillance Panopticon – VICE

Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Posted on by

Clearview AI worked to build a national database of every mug shot taken in the United States during the past 15 years, according to an email obtained by OneZero through a public records request.

The email, sent by a representative for Clearview AI in August 2019, was in response to an inquiry from the Green Bay Police Department in Wisconsin, which had asked if there was a way to upload its own mug shots to Clearview AI’s app.

“We are… working to acquire all U.S. mugshots nationally from the last 15 years, so once we have that integrated in a few months’ time it might just be superfluous anyway,” wrote the Clearview AI employee, whose name was redacted.

Clearview AI is best known for scraping the public internet, including social media, for billions of images to power its facial recognition app, which was first reported on by the New York Times. Some of those images are pulled from online repositories of mug shots, like Rapsheets.org and Arrests.org, according to other emails obtained by OneZero. Acquiring a national mug shot database would make Clearview AI an even more powerful tool for police departments, which would be able to easily match a photograph of an individual against their criminal history.

Clearview AI did not immediately respond to a request for comment from OneZero. It is unclear whether the company ultimately succeeded in acquiring such a database.

Source: Clearview AI: We Are ‘Working to Acquire All U.S. Mugshots’ From Past 15 Years

Clearview AI Let Celebs, Investors Use Facial Recognition App for fun

Posted on by

Creepy facial recognition firm Clearview AI—which claims to have built an extensive database from billions of photos scraped from the public web—allowed the rich and powerful to use its app as a personal plaything and spy tool, according to reporting from the New York Times on Thursday.

Clearview and its founder, Hoan Ton-That, claim that the database is only supposed to be used by law enforcement and “select security professionals” in the course of investigations. Prior reports from the Times revealed that hundreds of law enforcement agencies, including the Department of Justice and Immigration and Customs Enforcement, had used Clearview’s biometric tools, which is alarming enough, given the total lack of any U.S. laws regulating how face recognition can be used and its proven potential in mass surveillance of anyone from minorities to political targets. Clearview also pitched itself and its tools to white supremacist Paul Nehlen, then a candidate for Congress, saying it could provide “unconventional databases” for “extreme opposition research.”

But the Times has now found that Clearview’s app was “freely used in the wild by the company’s investors, clients and friends” in situations ranging from showing off at parties to, in the case of billionaire Gristedes founder John Catsimatidis, correctly identifying a man his daughter was on a date with. More alarmingly, Catsimatidis launched a trial run of Clearview’s potential as a surveillance tool at his chain of grocery stores.

Catsimatidis told the Times that a Gristedes in Manhattan had used Clearview to screen for “shoplifters or people who had held up other stores,” adding, “People were stealing our Häagen-Dazs. It was a big problem.” That dovetails with other reporting by BuzzFeed that found Clearview is developing security cameras designed to work with its face recognition tools and that corporations including Kohl’s, Macy’s, and the NBA had tested it.

Source: Clearview AI Let Celebs, Investors Use Facial Recognition App

DuckDuckGo Made a List of Jerks Tracking You Online

Posted on by

DuckDuckGo, a privacy-focused tech company, today launched something called Tracker Radar—an open-source, automatically generated and continually updated list that currently contains more than 5,000 domains that more than 1,700 companies use to track people online.

The idea behind Tracker Radar, first reported by CNET, is to share the data DuckDuckGo has collected to create a better set of tracker blockers. DuckDuckGo says that the majority of existing tracker data falls into two types: block lists and in-browser tracker identification. The issue is the former relies on crowd-sourcing and manual maintenance. The latter is difficult to scale and also can be potentially abused due to the fact it’s generating a list based on your actual browsing habits. Tracker Radar supposedly gets around some of these issues by looking at the most common cross-site trackers and including a host of information about their behavior, things like prevalence, fingerprinting, cookies, and privacy policies, among other considerations.

This can be weedsy, especially if the particulars of adtech make your eyeballs roll out of their sockets. The gist is, that creepy feeling you get when you see ads on social media for that product you googled the other day? All that is powered by the types of hidden trackers DuckDuckGo is trying to block. On top of shopping data, these trackers can also glean your search history, location data, along with a number of other metrics. That can then be used to infer data like age, ethnicity, and gender to create a profile that then gets shared with other companies looking to profit off you without your explicit consent.

As for how people can actually take advantage of it, it’s a little more roundabout. The average joe mostly benefits by using… DuckDuckGo’s browser mobile apps for iOS and Android, or desktop browser extensions for Chrome, Firefox, and Safari.

As for developers, DuckDuckGo is encouraging them to create their own tracker block lists. The company is also suggesting researchers use Tracker Radar to help them study online tracking. You can find the data set here.

Source: DuckDuckGo Made a List of Jerks Tracking You Online

Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys

Posted on by

Over the past few years, owners of cars with keyless start systems have learned to worry about so-called relay attacks, in which hackers exploit radio-enabled keys to steal vehicles without leaving a trace. Now it turns out that many millions of other cars that use chip-enabled mechanical keys are also vulnerable to high-tech theft. A few cryptographic flaws combined with a little old-fashioned hot-wiring—or even a well-placed screwdriver—lets hackers clone those keys and drive away in seconds.

Researchers from KU Leuven in Belgium and the University of Birmingham in the UK earlier this week revealed new vulnerabilities they found in the encryption systems used by immobilizers, the radio-enabled devices inside of cars that communicate at close range with a key fob to unlock the car’s ignition and allow it to start. Specifically, they found problems in how Toyota, Hyundai, and Kia implement a Texas Instruments encryption system called DST80. A hacker who swipes a relatively inexpensive Proxmark RFID reader/transmitter device near the key fob of any car with DST80 inside can gain enough information to derive its secret cryptographic value. That, in turn, would allow the attacker to use the same Proxmark device to impersonate the key inside the car, disabling the immobilizer and letting them start the engine.

The researchers say the affected car models include the Toyota Camry, Corolla, and RAV4; the Kia Optima, Soul, and Rio; and the Hyundai I10, I20, and I40. The full list of vehicles that the researchers found to have the cryptographic flaws in their immobilizers is below:

a chart of car models and makes
A list of the cars the researchers say are vulnerable to their immobilizer-disabling attack. Although the list includes the Tesla S, Tesla pushed out an update last year to address the vulnerability.

Courtesy of University of Birmingham and KU Leuven

Though the list also includes the Tesla S, the researchers reported the DST80 vulnerability to Tesla last year, and the company pushed out a firmware update that blocked the attack.

Toyota has confirmed that the cryptographic vulnerabilities the researchers found are real. But their technique likely isn’t as easy to pull off as the “relay” attacks that thieves have repeatedly used to steal luxury cars and SUVs. Those generally require only a pair of radio devices to extend the range of a key fob to open and start a victim’s car. You can pull them off from a fair distance, even through the walls of a building.

Source: Hackers Can Clone Millions of Toyota, Hyundai, and Kia Keys | WIRED

More than one billion Android devices at risk of malware threats, no longer being updated

Posted on by

Based on Google data, two in five of Android users worldwide may no longer be receiving updates, and while these devices won’t immediately have problems, without security support there is an increased risk to the user.

Our latest tests have shown how such phones and tablets, including handsets still available to buy from online marketplaces such as Amazon, could be affected by a range of malware and other threats. This could result in personal data being stolen, getting spammed by ads or even signed up to a premium rate phone service.

[…]

Generally speaking, the older the phone, the greater the risk. With the Android versions released in the past five years (Android 5.0 to 10.0), Google put more effort into enhancing security and privacy to give the user greater protection, transparency and control over their data. But smartphones can still be an attractive target, and it’s important to be aware of the threat.

Based on Google’s own data from May 2019, 42.1% of Android active users worldwide are on version 6.0 or earlier: Marshmallow (2015), Lollipop (2014), KitKat (2013), Jellybean (2012), Ice Cream Sandwich (2011) and Gingerbread (2010).

According to the Android Security Bulletin, there were no security patches issued for the Android system in 2019 that targeted Android versions below 7.0 Nougat.

That means more than one billion phones and tablets may be active around the world that are no longer receiving security updates.

[…]

We tasked expert antivirus lab, AV Comparatives, to try to infect them with malware, and it managed it on every phone, including multiple infections on some.

As you can see in the above chart, all the Android phones we used in our test lacked the more modern security features introduced by Google to the latest Android 9.0 or 10.

Source: More than one billion Android devices at risk of malware threats – Which? News

Virgin broadband ISP spills 900,000 punters’ records into wrong hands from insecure database

Posted on by

Virgin Media, one of the UK’s biggest ISPs, on Thursday admitted it accidentally spilled 900,000 of its subscribers’ personal information onto the internet via a poorly secured database.

The cableco said it “incorrectly configured” a storage system so that at least one miscreant was able to access it and potentially siphon off customer records. The now-secured marketing database – containing names, home and email addresses, and phone numbers, and some dates of birth, plus other info – had been left open since mid-April 2019.

Crucially, the information “was accessed on at least one occasion but we do not know the extent of the access,” Virgin Media’s CEO Lutz Schüler said in a statement this evening. Said access, we speculate, could have been from an automated bot scanning the internet, or someone prowling around looking for open gear; at this stage, we don’t know.

In a separate email to subscribers, shared with El Reg by dozens of readers, the telco expanded: “The database was used to manage information about our existing and potential customers in relation to some of our marketing activities. This included: contact details (such as name, home and email address and phone numbers), technical and product information, including any requests you may have made to us using forms on our website. In a very small number of cases, it included date of birth.”

The storage box, we understand, not only contained Virgin Media broadband and fixed-line subscriber records – some 15 per cent of that total customer base – but also info on some cellular users. If a punter referred a friend to Virgin Media, that pal’s details may be in the silo, too.

Source: Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punters’ records into wrong hands from insecure database • The Register

Enable MFA: 1.2 million Azure Active Directory (Office 365) accounts compromised every month, reckons Microsoft

Posted on by

Microsoft reckons 0.5 per cent of Azure Active Directory accounts as used by Office 365 are compromised every month.

The Window giant’s director of identity security, Alex Weinert, and IT identity and access program manager Lee Walker revealed the figures at the RSA conference last month in San Francisco.

“About a half of a per cent of the enterprise accounts on our system will be compromised every month, which is a really high number. If you have an organisation of 10,000 users, 50 will be compromised each month,” said Weinert.

It is an astonishing and disturbing figure. Account compromise means that a malicious actor or script has some access to internal resources, though the degree of compromise is not stated. The goal could be as simple as sending out spam or, more seriously, stealing secrets and trying to escalate access.

Password spray attacks account for 40% of compromised accounts

Password spray attacks account for 40% of compromised accounts

How do these attacks happen? About 40 per cent are what Microsoft calls password spray attacks. Attackers use a database of usernames and try logging in with statistically probable passwords, such as “123” or “p@ssw0rd”. Most fail but some succeed. A further 40 per cent are password replay attacks, where attackers mine data breaches on the assumption that many people reuse passwords and enterprise passwords in non-enterprise environments. That leaves 20 per cent for other kinds of attacks like phishing.

The key point, though, is that if an account is compromised, said Weinert, “there’s a 99.9 per cent chance that it did not have MFA [Multi Factor Authentication]”. MFA is where at least one additional identifier is required when logging in, such as a code on an authenticator application or a text message to a mobile phone. It is also possible (and preferable) to use FIDO2 security keys, a feature now in preview for Azure AD. Even just disabling legacy authentication helps, with a 67 per cent reduction in the likelihood of compromise.

Source: Enable that MF-ing MFA: 1.2 million Azure Active Directory accounts compromised every month, reckons Microsoft • The Register