Greenpeace leaks TTIP texts, reveals strained negotiations

Found on The Register on Tuesday, 03 May 2016
Browse Politics

The documents have been posted at www.ttip-leaks.org, and in the main they've been picked over for their impact on environmental regulation.

The UN's Food and Agriculture Organisation would also get control over resolving disputes over issues like food safety and pesticide residue regulation.

America also wants Europe to give it input into electrotechnical standards (for example, electrical product safety).

For a partnership that is supposed to benefit every citizens (if you believe the politicians), you always had to wonder why everything about it is so top secret. Looks like we now have the reasons.

Samsung Smart Home flaws let hackers make keys to front door

Found on Ars Technica on Monday, 02 May 2016
Browse Technology

The researchers said the attacks were made possible by two intrinsic design flaws in the SmartThings framework that aren't easily fixed. They went on to say that consumers should think twice before using the system to connect door locks and other security-critical components.

According to the researchers, the design of the SmartThings framework was a key contributor to that threat. So far, Samsung has provided no details on plans to fix it.

Another day, another massive IoT failure. It's the new Flash.

It's 2016 and now your internet-connected bathroom scales can be hacked

Found on The Register on Sunday, 01 May 2016
Browse Technology

Fitbit is right now pushing out the critical patch, and folks are advised to update their Aria scale firmware as soon as possible to prevent attacks. The scales should automatically get the update within the next few days, though their owners can also check for updates through the FitBit dashboard tool.

With more companies hooking their appliances up to the internet, security researchers are finding tons of new holes in connected devices that allow for everything from the remote control of appliances to the ability to siphon off personal information.

In a few years, you will have billions of badly designed IoT devices which can launch attacks on a scale much greater than today.

Pop goes the weasel! Large Hadron Collider blown up by critter chomping 66kV cable

Found on The Register on Saturday, 30 April 2016
Browse Science

CERN's search for exotic particles has been put on hold for a couple of weeks – after a small mammal gnawed through a power cable, incinerated itself and killed current to the world's most expensive scientific instrument.

It's not the first time the LHC has run into trouble from wildlife. In 2009 The Reg broke the story of a bird shutting down the LHC after a bird dropped a piece of bread into one of the LHC's outside substation, temporarily disabling it.

You would think that a bunch of scientists could come up with ways to protect they expensive hardware.

'Ghostbusters' trailer ranks among 'most disliked' videos on YouTube

Found on CNet News on Friday, 29 April 2016
Browse Various

A trailer for the upcoming reboot of "Ghostbusters" received a noticeable amount of criticism when it was released in March. It's only gotten worse since then and it's led to a dubious honor that may be the beginning of the end times for director Paul Feig's film.

As of Friday, it ranks 23rd on the list with more than 499,000 dislikes, making it the most disliked movie trailer on YouTube.

No surprise. It's such an obvious try to be so politically correct with an all female cast, covering all major groups that it hurts. You have your colored member, your overweight member and all are tough women; and for the basis they take such a classic movie.

Slack bot token leakage exposing business critical information

Found on Detectify on Thursday, 28 April 2016
Browse Internet

The problem is that many developers tend to include Slack tokens – credentials tied to their personal Slack account – directly in the code when building Slack bots. These projects are also shared publicly on GitHub. Now, because the code contains these tokens, the developer is actually giving anyone – that finds the token – access to the developer’s company’s internal chats and files on Slack.

People check all and everything into GitHub. Private SSH keys are there, password list, and lots of other interesting information.

Former Top Gear team sets sights on domination of the four-wheeled Internet

Found on Ars Technica on Wednesday, 27 April 2016
Browse Internet

When things ended badly with the BBC, Clarkson, May, and Hammond were snapped up by Amazon with a budget reported to be $7 million (£4.5 million) per episode. But they evidently want more. On Monday Variety revealed that the gang, together with a tech entrepreneur called Ernesto Schmitt, want to create a digital home on the Internet for car people.

Meanwhile, over at the BBC Top Gear lives on, recreating itself for at least the third time. Headed by UK radio and TV presenter Chris Evans, and joined by a massive cast that includes Matt LeBlanc, Sabine Schmitz, and Chris Harris, the show has been dogged by negative coverage in the UK's newspapers and a bit of a controversy involving someone drifting near the Cenotaph (a war memorial in London).

Au contraire. Top Gear died on the day when the three left the BBC.

Blizzard: Allowing pirate WoW servers would “damage [our] rights”

Found on Ars Technica on Tuesday, 26 April 2016
Browse Legal-Issues

Weeks after forcing the shutdown of a popular, fan-run "pirate" server that ran a classic version of World of Warcraft, Blizzard now says it basically had no choice but to go after Nostalrius to protect its legal rights.

In his post, Brack goes on to say that Blizzard has looked into running a Nostalrius-style "classic" server on its own, but that "none could be executed without great difficulty. If we could push a button and all of this would be created, we would. However, there are tremendous operational challenges to integrating classic servers, not to mention the ongoing support of multiple live versions for every aspect of WoW."

Funny how a couple of fans have more knowledge about WoW servers than Blizzard and were able to maintain it for years, for hundreds of thousands of users. Blizzard could simply give Nostalrius a special license and all would be good. Fans would be happy, legal rights would be protected.

Website extortionists rake in over $100,000 without lifting a finger

Found on The Register on Monday, 25 April 2016
Browse Internet

"Our attacks are extremely powerful – sometimes over 1Tbps per second. And we pass CloudFlare and others' remote protections! So, no cheap protection will help," the email warns.

"Our conclusion was a bit of a surprise: we've been unable to find a single incident where the current incarnation of the Armada Collective has actually launched a DDoS attack," said Matthew Prince, CEO of CloudFlare.

There are groups out there performing actual attacks if they don't get a ransom, he said, but this isn't one of them. So if you get an email from the Armada Collective, there's no reason to pay up.

It's actually an easy way to make some money: just claim you are someone else and demand to be paid.

Ransomware Poses a Rising Threat to Hospital Operations

Found on eWEEK on Sunday, 24 April 2016
Browse Various

Health care organizations, such as HPMC, are under attack by cyber-criminals looking for easy money and nation-state actors seeking data. More than half of all midsize hospitals have signs of malware infections, according to data collected by the Health Information Trust Alliance (HITRUST). Much of the activity, however, has gone unreported.

Ransomware has evolved into a serious threat. Starting with early programs that locked Windows systems more than a decade ago, the increasing use of encryption-enabled malware shows how ransomware has become more sophisticated.

Part of the blame has to go to the hospitals too though. They should be able to roll back to a previous backup with maybe a loss of a day, or just a few hours.