WikiLeaks publishes docs from what it says is trove of CIA hacking tools

Found on Ars Technica on Tuesday, 07 March 2017
Browse Various

This morning, WikiLeaks posted the first of what the organization's spokesperson says is a multi-part series of documents and files from the Central Intelligence Agency. "The first full part of the series, 'Year Zero', comprises 8,761 documents and files from an isolated, high-security network situated inside the CIA's Center for Cyber Intelligence in Langley, Virgina [sic]," WikiLeaks' spokesperson said in a press release.

When reached for comment, a CIA spokesperson told Ars Technica, "We do not comment on the authenticity or content of purported intelligence documents."

They have learned not much from the Snowden and Manning incidents. It will be very interesting to see what journalists and scientists will gather from Vault 7.

Huge database leak reveals 1.37 billion email addresses and exposes illegal spam operation

Found on Betanews on Monday, 06 March 2017
Browse Internet

The database contains more than 1.37 billion email addresses, and for some records there are additional details such as names, real-world addresses, and IP addresses. It's a situation that's described as "a tangible threat to online privacy and security."

It remains to be seen quite what impact this will have on River City Media's operations, and whether there will be an immediate reduction in the amount of spam flying to inboxes around the world.

What gives this "research" a bad taste is the fact that it was done by MacKeeper. A software which is nothing but scareware and belongs to the same group as River City Media.

Dangerous backdoor exploit found on popular IoT devices

Found on Techradar on Sunday, 05 March 2017
Browse Technology

The backdoor is in the Telnet admin interface of DblTek-branded devices, and potentially allows an attacker to remotely open a shell with root privileges on the target device.

However, rather than removing the flaw, the vendor simply made it more difficult to access and exploit. And further correspondence with the Chinese company has apparently fallen on deaf ears.

Surprise! IoT is often an insecure failure. Almost as worrying as the telnet port is the fact that obviously quite a few routers allow incoming traffic.

Trump says Obama wiretapped his phone, offers no evidence

Found on CNet News on Saturday, 04 March 2017
Browse Politics

"Terrible! Just found out that Obama had my 'wires tapped' in Trump Tower just before the victory," tweeted Trump. "Nothing found. This is McCarthyism!"

"How low has President Obama gone to tapp [sic] my phones during the very sacred election process. This is Nixon/Watergate. Bad (or sick) guy!, he sniffed.

This is politics. You never know what to believe. It might look like a perfect example for fake news, but on the other hand, several three-letter-agencies have spied on almost everybody.

How Uber Used Secret Greyball Tool to Deceive Authorities Worldwide

Found on New York Times on Friday, 03 March 2017
Browse Various

Uber has for years engaged in a worldwide program to deceive the authorities in markets where its low-cost ride-hailing service was being resisted by law enforcement or, in some instances, had been outright banned.

Greyball and the broader VTOS program were described to The New York Times by four current and former Uber employees, who also provided documents.

Outside experts said they were uncertain about the legality of the program. Greyball could be considered a violation of the federal Computer Fraud and Abuse Act, or possibly intentional obstruction of justice, depending on local laws and jurisdictions, said Peter Henning, a law professor at Wayne State University, who also writes for The New York Times.

If they want to do it the hard way, drag them to court. Make a few examples by suing drivers for being in violation of public transport laws and disallow Uber from providing its service in the country. If they want to be a competition to taxi drivers that's fine, but they need to play by the same rules.

Public university lays off 79 IT workers after they train outsourced replacements

Found on Ars Technica on Thursday, 02 March 2017
Browse Internet

The union representing the employees, University Professional and Technical Employees CWA Local 9119, says it's the first time a public university has offshored American IT jobs.

Audrey Hatten-Milholin, who earned $127,000 at her job, says other replacements were around for two weeks. "What was shocking is that the system is so complex there’s no way you can learn it in two weeks," she said.

Donald won't be too happy when he hears that; and then, UCSF won't be happy.

AWS's S3 Facility Hit by Outage, Many Services Disrupted

Found on eWEEK on Wednesday, 01 March 2017
Browse Internet

The world's largest and busiest cloud infrastructure provider, Amazon Web Services, was hit by a widespread service interruption Feb. 28 at its northern Virginia data center that took down much of the company's S3 storage and a long list of services with it for several hours.

"Right now they need to wait it out, which is frustrating," Maislos said. "In the future they'd need to replicate the data to multiple regions and multiple cloud providers and it greatly impacts costs and operating complexity.

"Everyone affected should re-evaluate how current their backups are, where they are stored, and how to switch over to alternative locations automatically when an S3 issue is detected in the future."

Yes, "the cloud" can go down; and if you rely on it too much, you will get burned badly.

Two million recordings of families imperiled by cloud-connected toys' crappy MongoDB

Found on The Register on Tuesday, 28 February 2017
Browse Internet

CloudPets' internet-facing MongoDB installation, on port 2701 at 45.79.147.159, required no authentication to access, and was repeatedly extorted by miscreants, evidence shows. The database contains links to .WAV files of voice messages hosted in the Amazon cloud, again accessible with no authentication, potentially allowing the mass slurping of more than two million highly personal conversations between families and their little ones.

As proof that CloudPets' security was hopeless, Hunt's informant provided him more than 580,000 records from the CloudPets database, along with screenshots of three attempts to alert the toy manufacturer to the gaping hole. Each warning, we're told, fell on deaf ears.

Hunt concluded: “The CloudPets data was accessed many times by unauthorised parties before being deleted and then on multiple occasions, held for ransom.”

That's not just an unfortunate accident anymore; the company had several chances and still decided with intent to ignore all safety. With such a disregard to data security, CloudPets should be held liable and brought to court. This also shows one of the major problems with the production process: they hired obviously incompetent developers who failed to read the installation instructions of MongoDB, like so many others (and yes, MongoDB should be completely locked down after installation, requiring the admin to configure it). They also failed to efficiently handle and store data. WAV? Seriously?

Netflix CEO Hastings: In Twenty, Fifty Years, ‘We May Be Entertaining A.I.’

Found on Barron's on Monday, 27 February 2017
Browse Future

“I just can’t emphasize enough how much it’s just beginning,” he repeated. But, pressed Stock, what about ten years out or twenty years out? Hastings said at that point there will be “some serious virtual reality” to contend with.

“Over twenty to fifty years, you get into some serious debate over humans,” mused Hastings. “I don’t know if you can really talk about entertaining at that point. I’m not sure if in twenty to fifty years we are going to be entertaining you, or entertaining A.I.s.”

We all remember what happened with the ants that were entertaining us when we were little kids.

Taliban leader urges Afghans to plant more trees

Found on BBC News on Sunday, 26 February 2017
Browse Nature

In a statement, he called on civilians and fighters to "plant one or several fruit or non-fruit trees for the beautification of Earth and the benefit of almighty Allah's creations".

"Tree plantation plays an important role in environmental protection, economic development and beautification of earth," the Taliban leader said, in a report carried by the Afghan Taliban Voice of Jihad website.

That would be nice and all, if only they would not constantly blow up everything.