D-Link DWR-932 router is chock-full of security holes

Posted on by
Reply

The documented D-Link DWR-932 vulnerabilities affect the latest available firmware. Kim first responsibly disclosed them to the D-Link Security Incident Response Team in June, but after the company said early this month that they don’t have a schedule for a firmware release, he decided to go public with the details about some of the flaws.

In short, the firmware sports:

Two backdoor accounts with easy-to-guess passwords that can be used to bypass the HTTP authentication used to manage the router
A default, hardcoded Wi-Fi Protected Setup (WPS) PIN, as well as a weak WPS PIN generation algorithm
Multiple vulnerabilities in the HTTP daemon
Hardcoded remote Firmware Over The Air credentials
Lowered security in Universal Plug and Play, and more.

Source: D-Link DWR-932 router is chock-full of security holes – Help Net Security

This was reported in June but still not fixed

Crypto guru Matt Green asks courts for DMCA force field so he can safely write a textbook

Posted on by
Reply

Assistant Professor Matthew Green has asked US courts for protection so that he can write a textbook explaining cryptography without getting sued under the Digital Millennium Copyright Act.

Green, who teaches at Johns Hopkins University in Maryland, is penning a tome called Practical Cryptographic Engineering that examines the cryptographic mechanisms behind the devices we use every day, such as ATM machines, smart cars, and medical devices. But this could lead to a jail sentence if the manufacturers file a court case using Section 1201 of the DMCA.

Section 1201 prohibits the circumvention of copyright protection systems installed by manufacturers, and comes with penalties including heavy fines and possible jail time. As such, the Electronic Frontier Foundation (EFF) has taken up Green’s case, and that of another researcher, to try to get the provision ruled illegal by the courts.

“If we want our communications and devices to be secure, we need to protect independent security researchers like Dr Green,” said EFF staff attorney Kit Walsh.

Source: Crypto guru Matt Green asks courts for DMCA force field so he can safely write a textbook

It’s ridiculous that a textbook writer could be jailed for copyright infringement. Good luck taking down the DMCA!

Criticize Donald Trump, get your site smashed offline from Russia

Posted on by
Reply

It has been an odd day for Newsweek – its main site was taken offline after it published a story claiming a company owned by Republican presidential candidate Donald Trump broke an embargo against doing deals with Cuba.

The magazine first thought that the sheer volume of interest in its scoop was the cause for the outage, but quickly realized that something more sinister was afoot.

The site was being bombarded by junk traffic from servers all around the world, but the majority came from Russia, the editor in chief Jim Impoco has now said.

“Last night we were on the receiving end of what our IT chief called a ‘massive’ DoS [denial of service] attack,” he told Talking Points Memo.

“As with any DDoS [distributed DoS] attack, there are lots of IP addresses, but the main ones are Russian, though that in itself does not prove anything. We are still investigating.”

Source: Criticize Donald Trump, get your site smashed offline from Russia

AI Machine-learning models vulnerable to reverse engineering

Posted on by
Reply

In a paper [PDF] presented in August at the 25th Annual Usenix Security Symposium, researchers at École Polytechnique Fédérale de Lausanne, Cornell University, and The University of North Carolina at Chapel Hill showed that machine learning models can be stolen and that basic security measures don’t really mitigate attacks.

Machine learning models may, for example, accept image data and return predictions about what’s in the image.

Taking advantage of the fact that machine learning models allow input and may return predictions with percentages indicating confidence of correctness, the researchers demonstrate “simple, efficient attacks that extract target ML models with near-perfect fidelity for popular model classes including logistic regression, neural networks, and decision trees.”

That’s a polite way of saying such models can be reverse engineered. The researchers tested their attack successfully on BigML and Amazon Machine Learning, both of which were told of the findings in February.

Source: How to steal the mind of an AI: Machine-learning models vulnerable to reverse engineering

Non Root systemd bug crashes systems

Posted on by
Reply

systemd fails an assertion in manager_invoke_notify_message when a zero-length message is received over /run/systemd/notify. This allows a local user to perform a denial-of-service attack against PID 1.Proof-of-concept:NOTIFY_SOCKET=/run/systemd/notify systemd-notify “”

Source: Assertion failure when PID 1 receives a zero-length message over notify socket · Issue #4234 · systemd/systemd · GitHub

China Confirms Its Space Station Is Falling Back to Earth

Posted on by
Reply

In a press conference on Wednesday, Chinese officials appear to have confirmed what many observers have long suspected: that China is no longer in control of its space station.

China’s Tiangong-1 space station has been orbiting the planet for about 5 years now, but recently it was decommissioned and the Chinese astronauts returned to the surface. In a press conference last week, China announced that the space station would be falling back to earth at some point in late 2017.

Source: China Confirms Its Space Station Is Falling Back to Earth

Stop Piracy? Legal Alternatives Beat Legal Threats, Research Shows

Posted on by
Reply

Threatening file-sharers with high fines or even prison sentences is not the best way to stop piracy. New research published by UK researchers shows that perceived risk has no effect on people’s file-sharing habits. Instead, the entertainment industries should focus on improving the legal options, so these can compete with file-sharing.

Source: Stop Piracy? Legal Alternatives Beat Legal Threats, Research Shows – TorrentFreak

The movie industry understood this better than the music industry. The music industry decided to try to sue everyone on the planet (including, funnily enough, themselves). The movie industry solution involved releasing movies on the same day globally, going to DVD faster after movies were out of the cinema and decreasing the price of DVDs (with them going on sale fairly quickly after). Netflix etc are also part of this flexible policy.

Microsoft deletes Windows 10 nagware from Windows 7 and 8

Posted on by
Reply

“This update removes the Get Windows 10 app and other software related to the Windows 10 free upgrade offer that expired on July 29, 2016,” Microsoft’s article says, advising that no action other than a restart will be required to do the deed.

Source: Microsoft deletes Windows 10 nagware from Windows 7 and 8

phew! I can start just updating my windows again now, without worrying about it suddenly becoming spyware for MS.

Some Lenovo PCs can’t run Linux

Posted on by
Reply

Linux users are worried that some of Lenovo’s PCs, such as variants of the Yoga 710 and Yoga 900, aren’t allowing them to install their preferred operating system. They note that the systems’ solid-state drives use a RAID mode that Linux doesn’t understand. That’s unpleasant enough, but Lenovo’s initial handling of complaints didn’t help. Its staff locked support forum threads discussing the topic, and a Lenovo Product Expert on Best Buy claims that a Yoga 900’s use of a pure, Signature Edition take on Windows 10 Home meant that it was “locked per our agreement with Microsoft.” If that was true, it’d be pretty damning — it’d suggest that at least some Signature Edition systems are purposefully set up to exclude non-Windows platforms.

Source: Some Lenovo PCs can’t run Linux (update: Microsoft response)

Ouch Lenovo!

MOD orders UK-designed mini missile decoy for RAF

Posted on by
Reply

The UK Ministry of Defence (MOD) has placed a £2.5 million order for UK-designed and built miniature decoys which will help to protect combat jets from missiles.

BriteCloud, which is similar in size and appearance to a beverage can, can be fired from an aircraft’s flare dispenser without the need for modification to the aircraft. Once deployed, it uses powerful radar emissions to disrupt systems within radar-guided air-to-air and surface-to-air missiles.

Source: MOD orders UK-designed mini missile decoy for RAF – News stories – GOV.UK

System can read closed books

Posted on by
Reply

MIT researchers and their colleagues are designing an imaging system that can read closed books.

In the latest issue of Nature Communications, the researchers describe a prototype of the system, which they tested on a stack of papers, each with one letter printed on it. The system was able to correctly identify the letters on the top nine sheets.

“The Metropolitan Museum in New York showed a lot of interest in this, because they want to, for example, look into some antique books that they don’t even want to touch,”
[..]
The system uses terahertz radiation, the band of electromagnetic radiation between microwaves and infrared light, which has several advantages over other types of waves that can penetrate surfaces, such as X-rays or sound waves. Terahertz radiation has been widely researched for use in security screening, because different chemicals absorb different frequencies of terahertz radiation to different degrees, yielding a distinctive frequency signature for each. By the same token, terahertz frequency profiles can distinguish between ink and blank paper, in a way that X-rays can’t.

Terahertz radiation can also be emitted in such short bursts that the distance it has traveled can be gauged from the difference between its emission time and the time at which reflected radiation returns to a sensor. That gives it much better depth resolution than ultrasound.

The system exploits the fact that trapped between the pages of a book are tiny air pockets only about 20 micrometers deep. The difference in refractive index — the degree to which they bend light — between the air and the paper means that the boundary between the two will reflect terahertz radiation back to a detector.

Source: Judging a book through its cover | MIT News

Azure is on fire, your DNS is terrified

Posted on by
Reply

Microsoft Azure is wobbling all around the world at the moment, especially Azure DNS.

According to a status update on Microsoft’s site, the issues began around lunchtime, although there is no mention of when they are likely to be fixed.

Customers using Azure DNS in multiple regions are experiencing difficulties connecting to their goodies at the moment due to the mysterious issues affecting Microsoft’s cloud computing and infrastructure platform.

Azure proudly advertises itself as a global network of name servers using Anycast routing to provide “outstanding performance and availability” though such is not visible at the moment.

Engineers had only managed to identify “a possible underlying cause” as of the update and “are working to determine mitigation options.”

Azure DNS, which currently is still in preview, and is supported through community forums, allows customers to host their DNS domain in Azure, so they can manage their DNS records using the same credentials, billing and support contract as their other Azure services.

Also affected are users of SQL Database, App Service/Web Apps, API Management, Service Bus and Visual Studio Team services. ®

Source: Azure is on fire, your DNS is terrified

Ubuntu Torrent Removed from Google for ‘Infringing’ Transformers Movie – OMG! Ubuntu!

Posted on by
Reply

Cited in a DMCA takedown request filed against Google on behalf of Paramount Pictures, and spotted by TorrentFreak (and tipped to us by reader ~nonanonymous) is an innocuous link to a 32-bit alternate install image Ubuntu 12.04.2 LTS.

The takedown request seeks to remove links to a number of torrent URLS that are alleged to infringe on Paramount movie ‘Transformers: Age of Extinction‘.

Ubuntu clearly doesn’t. All it takes is a quick glance at the URL in question to see that. It’s very much a stock iso of an old Ubuntu release.

And yet Google has complied with the request and scrubbed the link to the page in question from its search index.

Source: Ubuntu Torrent Removed from Google for ‘Infringing’ Transformers Movie – OMG! Ubuntu!

The writers of this article don’t blame Google for this, citing the amounts of DMCA takedowns Google has to cope with, but Google did manage to not take down Warner Brothers automated DMCA

Lightweight, wearable tech efficiently converts body heat to electricity

Posted on by
Reply

Researchers have developed a new design for harvesting body heat and converting it into electricity for use in wearable electronics. The experimental prototypes are lightweight, conform to the shape of the body, and can generate far more electricity than previous lightweight heat harvesting technologies

Source: Lightweight, wearable tech efficiently converts body heat to electricity — ScienceDaily

Over 6 million ClixSense users compromised by data breach

Posted on by
Reply

ClixSense, a site which pays users to view ads and take surveys, was the victim of a massive data breach compromising around 6.6 million user accounts.

Usually when there’s a data breach of this size, the information stolen contains usernames, passwords, and some other personal information, but due to the nature of ClixSense and the service it provided, home addresses, payment histories, and other banking details have also been compromised.

Source: Reset those passwords — again: Over 6 million ClixSense users compromised by data breach

Russian Hackers Get Into World Anti-Doping Agency Data, Find Nothing Incriminating

Posted on by
Reply

Perhaps feeling a little bent out of shape about how much shit their country caught for running a massive, Cold War-style doping program for Olympic athletes, a group of Russian hackers have obtained confidential documents that they claim prove American Olympians are also big fat cheaters. The only problem is that the leaked documents don’t actually contain any evidence of cheating.

Source: Russian Hackers Get Into WADA Data, Find Nothing Incriminating

Google’s become an obsessive stalker and you can’t get a restraining order

Posted on by
Reply

The FCC has been formally regulating behavioural advertising since the 1990s. You’d think they’d be all over Google and Facebook, then, right? Actually, no. The FCC is now run by a former Obama fund-raiser, Tom Wheeler, and it can’t do enough for Silicon Valley, whether it’s collectivising songwriters rights or disaggregating TV.

What the FCC did this year, with little fanfare, was cripple telecoms companies and wireless networks from doing what Google and Facebook do. That’s a very odd decision. If behavioural advertising is so bad consumers need an opt-out, how come you can opt out of your ISP’s profiling, but not Google’s. How could that be?

Don’t count on “digital rights” groups to help you, dear citizen, when we discover that Google is funding them. Privacy lawsuits became cosy backroom carve-ups, with privacy NGOs greedy to pocket Google’s cash. Marc Rotenberg at EPIC is one of very few exceptions: the object to the conflict of interests raised by the cy pres settlements, that saw “digital rights” groups raise a privacy class action only to settle. Money laundering might be a better description.

Source: Google’s become an obsessive stalker and you can’t get a restraining order

Oddly enough, I had Google Maps ask me to take pictures of the restaurant I was in as a notification yesterday. That kind of freaked me out, as I wasn’t running maps at the time!

Users have reported battery life issues with the latest Android build, with many pointing the finger at Google Play – Google’s app store – and its persistent, almost obsessive need to check where you are.

Amid complaints that Google Play is always switching on GPS, it appears Google has made it impossible to prevent the app store from tracking your whereabouts unless you completely kill off location tracking for all applications.

You can try to deny Google Play access to your handheld’s location by opening the Settings app and digging through Apps -> Google Play Store -> Permissions, and flipping the switch for “location.” But you’ll be told you can’t just shut out Google Play services: you have to switch off location services for all apps if you want to block the store from knowing your whereabouts. It’s all or nothing, which isn’t particularly nice.

This is because Google Play services pass on your location to installed apps via an API. The store also sends your whereabouts to Google to process. Google doesn’t want you to turn this off.

It also encourages applications to become dependent on Google’s closed-source Play services, rather than use the interfaces in the open-source Android, thus ensuring that people continue to run Google Play on their devices.

Delete Google Maps? Go ahead, says Google, we’ll still track you

NL Gov gets rid of medical confidentiality

Posted on by
Reply

NO, there is no opt out! The Dutch government has passed a law allowing insurance companies to access medical files with a “suspicion of fraud” (whatever that is) and only have to tell the person who’s privacy has been infringed three months later.

Medical privacy is one of the last untouchable bastions of privacy, I would have thought, but no, it’s been smashed. Fuckheads.

Source: De Tweede Kamer heeft het medisch beroepsgeheim gisteren stilletjes afgeschaft

Someone Is Learning How to Take Down the Internet – Lawfare

Posted on by
Reply

Over the past year or two, someone has been probing the defenses of the companies that run critical pieces of the Internet. These probes take the form of precisely calibrated attacks designed to determine exactly how well these companies can defend themselves, and what would be required to take them down. We don’t know who is doing this, but it feels like a large a large nation state. China and Russia would be my first guesses.
[…]

Recently, some of the major companies that provide the basic infrastructure that makes the Internet work have seen an increase in DDoS attacks against them. Moreover, they have seen a certain profile of attacks. These attacks are significantly larger than the ones they’re used to seeing. They last longer. They’re more sophisticated. And they look like probing. One week, the attack would start at a particular level of attack and slowly ramp up before stopping. The next week, it would start at that higher point and continue. And so on, along those lines, as if the attacker were looking for the exact point of failure.

https://www.lawfareblog.com/someone-learning-how-take-down-internet