Gamers Warned of High-Severity Intel, Nvidia Flaws
Chip giants Intel and Nvidia have stomped out high-severity flaws in two popular products, both commonly used by gamers. Impacted are the Nvidia Shield TV and Intel NUC (short for Next Unit of Computing) mini-PC kit. Nvidia Shield TV is a media streaming box (powered by Nvidia’s Tegra X1 system-on-chip) that runs on the Android operating system and can be used for gaming and media streaming. Intel’s NUC mini-PC kit offers processing, memory and storage capabilities for applications like gaming, digital signage and media centers.
ACSC Releases Small Business Cybersecurity Guide
The Australian Cyber Security Centre (ACSC) has released a cybersecurity guide for small businesses. The guide provides checklists to help small businesses protect themselves against common cybersecurity incidents. The Cybersecurity and Infrastructure Security Agency (CISA) encourages small business owners and administrators to review ACSC’s Small Business Cyber Security Guide and CISA’s Resources for Business page to learn how to defend against cyberattacks.
#SecTorCa: Millions of Phones Leaking Information Via Tor
There is a privacy threat lurking on perhaps hundreds of millions of devices, that could enable potential attackers to track and profile users, by using information leaked via the Tor network, even if the users never intentionally installed Tor in the first place. In a session at the SecTor security conference in Toronto, Canada on October 10, researchers Adam Podgorski and Milind Bhargava from Deloitte Canada outlined and demonstrated previously undisclosed research into how they were able to determine that personally identifiable information (PII) is being leaked by millions of mobile users every day over Tor.
Ransomware gang uses iTunes zero-day
The operators of the BitPaymer ransomware have been spotted using a zero-day in iTunes for Windows as a mechanism to bypass antivirus detection on infected hosts. The attacks and the zero-day were found by cyber-security firm Morphisec on the network of an enterprise in the automotive industry that got hit by BitPaymer in August. Apple patched the zero-day this week, in both iTunes for Windows and iCloud for Windows. The actual bug resided in the Bonjour updater component that ships with both products.
Ireland to join Nato cyberintelligence sharing agency
Ireland has applied to join a cyberintelligence sharing organisation run by the North Atlantic Treaty Organisation (Nato) in the face of increasing online attacks on Irish businesses and key infrastructure. The Nato Cooperative Cyber Defence Centre of Excellence (CCDCOE) is a military organisation based in Tallinn, Estonia, designed to increase co-operation and intelligence-sharing among Nato members and allies. The centre was set up in the face of increasing cyber threats from Russia, China and individual hackers. Ireland is the fourth non-Nato country to apply to join the CCDCOE since it was established in 2008.
Finfisher malware authors fire off legal threats to silence German journos
“Our reporting on the criminal complaint [we filed] against the producers of the state trojan-horse spyware software FinFisher has resulted in mail from the law firm Schertz-Bergmann. We were urged to sign a cease-and-desist declaration,” said the site’s Markus Beckedahl in a recent post. He told El Reg that Finfisher’s authors allege that Netzpolitik broke German media laws by not asking them to comment on the allegations against them. Beckedahl said that for years he and his colleagues had been asking Finfisher for comment, without reply, including for the disputed articles.
How Photos of Your Kids Are Powering Surveillance Technology
The pictures of Chloe and Jasper Papa as kids are typically goofy fare: grinning with their parents; sticking their tongues out; costumed for Halloween. Their mother, Dominique Allman Papa, uploaded them to Flickr after joining the photo-sharing site in 2005. None of them could have foreseen that 14 years later, those images would reside in an unprecedentedly huge facial-recognition database called MegaFace. Containing the likenesses of nearly 700,000 individuals, it has been downloaded by dozens of companies to train a new generation of face-identification algorithms, used to track protesters, surveil terrorists, spot problem gamblers and spy on the public at large. The average age of the people in the database, its creators have said, is 16.
Twitter, Facebook, WhatsApp and Instagram restricted in southern Turkey
Network data from the NetBlocks internet observatory confirm that Turkey has blocked access to social media and messaging platforms in the southern cities of Gaziantep, Şanlıurfa and Hatay, as the country launches military operation Peace Spring into northern Syria. Internet performance metrics show that Twitter, Facebook, WhatsApp and Instagram are currently blocked by leading internet service provider TTNet, corroborating reports emerging from users based in in the affected region. Access remains possible via other fixed-line and mobile providers, and VPN tools are effective in circumventing the blocks.
DHS cyber unit wants to subpoena ISPs to identify vulnerable systems
Homeland Security’s cybersecurity division is pushing to change the law that would allow it to demand information from internet providers that would identify the owners of vulnerable systems, TechCrunch has learned. Sources familiar with the proposal say the Cybersecurity and Infrastructure Security Agency (CISA), founded just less than a year ago, wants the new administrative subpoena powers to lawfully obtain the contact information of the owners of vulnerable devices or systems from internet providers.
A bug in Indian local search app exposed over 156 million accounts
A major flaw in an Indian local search app, Justdial, allowed hackers to log in to any of its 156 million users accounts. Apart from accessing user information such as names, phone numbers, and email addresses, the vulnerability allowed them to peek into financial details including balance and transactions of an account through JustDial Pay, the company’s payment service. First reported by MoneyControl, the bug was discovered by security researcher Ehraz Ahmed last month. It exploited the site’s Register API used for sign-ups.
Yahoo could owe you $358 or more as part of a privacy breach settlement
If you had a Yahoo account any time between 2012 and 2016, you can now take part in a class action settlement to compensate you for losses. Over several years, hackers were able to gain access to Yahoo user accounts, and steal private emails, calendars and contacts in at least three separate attacks. The breaches ranged in scope from two in 2012 where Yahoo said no data was taken, to a 2013 breach where hackers were able to gain access to all of the more than 3 billion Yahoo accounts and steal names, email addresses, telephone numbers, birth dates, passwords and answers to security questions.
An IRS employee stole identities and went on a 2-year spending spree
An IRS employee stole multiple people’s identities, and used them to open illicit credit cards to fund vacations and shop for shoes and other goods, according to a complaint unsealed last week in federal court. The complaint accuses the 35-year-old federal worker of racking up almost $70,000 in charges over the course of two years, illegally using “the true names, addresses, dates of birth, and Social Security numbers” of at least three people.
Smart cities: This city runs on its own operating system
Hull has just added its name next to Las Vegas, Copenhagen and Jaipur on the list of smart cities around the world, as the Yorkshire port city begins using what it is calls its own operating system to centralise data management and manage resources more efficiently. Using Internet of Things (IoT) sensors distributed around the city to provide data in real-time data, Hull City Council says it will be able to better control street lighting, refuse collection, parking and traffic congestion, with the goal of providing better services at a reduced cost.
