More than two dozen Lenovo notebook models are vulnerable to malicious hacks that disable the UEFI secure-boot process and then run unsigned UEFI apps or load bootloaders that permanently backdoor a device, researchers warned on Wednesday. From a report: At the same time that researchers from security firm ESET disclosed the vulnerabilities, the notebook maker released security updates for 25 models, including ThinkPads, Yoga Slims, and IdeaPads. Vulnerabilities that undermine the UEFI secure boot can be serious because they make it possible for attackers to install malicious firmware that survives multiple operating system reinstallations.

Short for Unified Extensible Firmware Interface, UEFI is the software that bridges a computer's device firmware with its operating system. As the first piece of code to run when virtually any modern machine is turned on, it's the first link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and remove. Typical measures such as wiping the hard drive and reinstalling the OS have no meaningful impact because the UEFI infection will simply reinfect the computer afterward. ESET said the vulnerabilities -- tracked as CVE-2022-3430, CVE-2022-3431, and CVE-2022-3432 -- "allow disabling UEFI Secure Boot or restoring factory default Secure Boot databases (incl. dbx): all simply from an OS." Secure boot uses databases to allow and deny mechanisms. The DBX database, in particular, stores cryptographic hashes of denied keys. Disabling or restoring default values in the databases makes it possible for an attacker to remove restrictions that would normally be in place.

Google has announced that it's making the new Gmail interface the standard experience for users. From a report: The company first released the new interface earlier this year but allowed users to revert back to the original view. Starting this month, users will no longer have the option to go back to the old interface. "The integrated view with Gmail, Chat, Spaces, and Meet on the left side of the window will also become standard for users who have turned on Chat," the company said in a blog post. "Through quick settings, you can customize this new interface to include the apps most important to you, whether it's Gmail by itself or a combination of Gmail, Chat, Spaces, and Meet."

As insurance companies struggle to stay afloat amid rising cyber claims, Swiss Re has recommended a public-private partnership insurance scheme with one option being a government-backed fund to help fill the coverage gap. From a report: Global cyber insurance premiums hit $10 billion in 2021, according to Swiss Re's estimates. In a study published this week, the insurance giant forecasted 20 percent annual growth to 2025, with premiums rising to $23 billion over the next few years.

Meanwhile, annual cyberattack-related losses total about $945 billion globally, and about 90 of that risk remains uninsured, according to insurance researchers at the Geneva Association. While Forrester estimates a typical data breach costs an average $2.4 million for investigation and recovery, only 55 percent of companies currently have cyber insurance policies. Additionally, less than 20 percent have coverage limits in excess of $600,000, which the analyst firm cites as the median ransomware demand in 2021. "The market needs to mature further to ensure enough insurance protection is available," John Coletti, head cyber reinsurance at Swiss Re, told The Register. "Our industry has a key role to play by addressing three issues: improving data and modeling, increasing contract consistency and clarity and identifying new sources of capital."

Microsoft is now promoting some of its products in the sign-out flyout menu that shows up when clicking the user icon in the Windows 11 start menu. BleepingComputer: This new Windows 11 "feature" was discovered by Windows enthusiast Albacore, who shared several screenshots of advertisement notifications in the Accounts flyout. The screenshots show that Microsoft promotes the OneDrive file hosting service and prods users to create or complete their Microsoft accounts.

Those reacting to this on social media had an adverse reaction to Redmond's decision to display promotional messages in the start menu. Some said that Windows 11 is "getting worse in each and every update it gets," while others added that this is a weird choice given that "half of the Start Menu is for recommendations" anyway. BleepingComputer has also tried replicating this on multiple Windows 11 systems, but we didn't get any ads. This hints at an A/B testing experiment trying to gauge the success of such a "feature" on devices running Windows Insider builds or the company pushing such ads to a limited set of customers.

"We serve about 100 million monthly visitors worldwide," says the CEO of Stack Overflow, "making us one of the most popular websites in the world. I think we are in the top 50 of all websites in the world by traffic."

In a new interview, he says the site's been accessed about 50 billion times over the past 14 years — and then shares his thoughts on the notion that programmers could be replaced by no-code, low-code, or AI-driven pair programming: A: Over the years, there have many, many tools, trying to democratize software development. That's a very positive thing. I actually love the fact that programming is becoming easier to do with these onramps. I was speaking at Salesforce recently, and they've got people in sales organizations writing workflows, and that's low code. You've got all these folks who are not software engineers that are creating their own automations and applications.

However, there is this trade-off. If you're making software easier to build, you're sacrificing things like customizability and a deeper understanding of how this code actually works. Back in the day, you might remember Microsoft FrontPage [an early HTML web page editor] as an example of that. You were limited to certain basic things, but you could get web work done. So similarly, these tools will work for general use cases. But, if they do that, without learning the fundamental principles of code, they will inevitably have some sort of a limit. For example, having to fix something that broke, I think they're going to be really dumbfounded.

Still, I think it's important, and I'm a believer. It's a great way to get people engaged, excited, and started. But you got to know what you're building. Access to sites like Stack Overflow help, but with more people learning as they're building, it's essential to make learning resources accessible at every stage of their journey....

Q: Is Stack Overflow considering any kind of certification? Particularly, as you just mentioned, since it's so easy now for people to step in and start programming. But then there's that big step from "Yes, I got it to work," but now "I have to maintain it for users using it in ways I never dreamed of."

A: "It's very much part of our vision for our company. We see Stack Overflow going from collective knowledge to collective learning. Having all the information is fine and dandy, but are you learning? Now, that we're part of Prosus's edtech division, we're very much looking forward to offering educational opportunities. Just as today, we can get knowledge to developers at the right place and time, we think we can deliver learning at just the right place and time. We believe we can make a huge impact with education and by potentially getting into the certification game.

Q: Some of the open-source nonprofits are moving into education as well. The Linux Foundation, in particular, has been moving here with the LF Training and Certification programs. Are you exploring that?

A: This is very much part of our vision....
Stack Overflow's CEO adds that the site's hot topics now include blockchain, machine learning, but especially technical cloud questions, "rising probably about 50% year over year over the past 10 years.... Related to this is an increase in interest in containerization and cloud-native services."

An anonymous reader quotes a report from TechCrunch: Pharmaceutical giant AstraZeneca has blamed "user error" for leaving a list of credentials online for more than a year that exposed access to sensitive patient data. Mossab Hussein, chief security officer at cybersecurity startup SpiderSilk, told TechCrunch that a developer left the credentials for an AstraZeneca internal server on code sharing site GitHub in 2021. The credentials allowed access to a test Salesforce cloud environment, often used by businesses to manage their customers, but the test environment contained some patient data, Hussein said. Some of the data related to AZ&ME applications, which offers discounts to patients who need medications. TechCrunch provided details of the exposed credentials to AstraZeneca, and the GitHub repository containing the credentials was inaccessible hours later. In a statement, AstraZeneca spokesperson Patrick Barth told TechCrunch: "The protection of personal data is extremely important to us and we strive for the highest standards and compliance with all applicable rules and laws. Due to an [sic] user error, some data records were temporarily available on a developer platform. We stopped access to this data immediately after we have been [sic] informed. We are investigating the root cause as well as assessing our regulatory obligations."

It's unclear if anyone was able to access the data, or if any data was exfiltrated.

Cherry, the original mechanical switch maker, is continuing to tap the mechanical keyboard community for new product ideas. From a report: Its new mechanical switch, the Cherry MX Black Clear-Top, is a nod to enthusiasts who would love to turn in their modern-day clacker for an old-school terminal keyboard with extra-smooth typing. Before Cherry's Thursday announcement of plans to release the MX Black Clear-Top, the switch was known to hobbyists as the Nixie switch.

Cherry made the switch in the 1980s for German office machine-maker Nixdorf Computer AG. The German switch maker was tasked with creating a version of its linear MX Black switch with "milky" upper housing, a 63.5 g actuation force rather than 60 g, and "the relatively rare solution at the time of having a diode integrated into the switch for n-key rollover," Cherry's announcement explained.The linear switch ended up being used primarily in Nixdorf's CT06-CT07/2 M Softkeys keyboards targeted at terminals, servers, and minicomputers.

An anonymous reader shares a report: Yesterday, a company called Rewind AI announced a self-titled software product for Macs with Apple Silicon that reportedly keeps a highly compressed, searchable record of everything you do locally on your Mac and lets you "rewind" time to see it later. If you forget something you've "seen, said, or heard," Rewind wants to help you find it easily. Rewind AI claims its product stores all recording data locally on your machine and does not require cloud integration. Among its promises, Rewind will reportedly let you rewind Zoom meetings and pull information from them in a searchable form. In a video demo on Rewind.AI's site, the app opens when a user presses Command+Shift+Space. The search bar suggests typing "anything you've seen, said, or heard." It also shows a timeline at the bottom of the screen that represents previous actions in apps.

After searching for "tps reports," the video depicts a grid view of every time Rewind has encountered the phrase "tps reports" as audio or text in any app, including Zoom chats, text messages, emails, Slack conversations, and Word documents. It describes filtering the results by app -- and the ability to copy and paste from these past instances if necessary. Founded by Dan Siroker and Brett Bejcek, Rewind AI is composed of a small remote team located in various cities around the US. Portions of the company previously created Scribe, a precursor to Rewind that received some press attention in 2021. In an introductory blog post, Rewind AI co-founder Dan Siroker writes, "What if we could use technology to augment our memory the same way a hearing aid can augment our hearing?" Rewind AI provides few details about the app's back-end technology but describes "mind-boggling compression" that can reportedly compress recording data up to 3,750 times "without a major loss of quality," giving an example of 10.5GB of data squeezed down to just 2.8MB.

An anonymous reader quotes a report from the Associated Press: The International Committee of the Red Cross said Thursday it is seeking support to create a "digital red cross/red crescent emblem" that would make clear to military and other hackers that they have entered the computer systems of medical facilities or Red Cross offices. The Geneva-based humanitarian organization said it was calling on governments, Red Cross and Red Crescent societies, and IT experts to join forces in developing "concrete ways to protect medical and humanitarian services from digital harm during armed conflict."

For over 150 years, symbols such as the red cross have been used to make clear that "in times of armed conflict, those who wear the red cross or facilities and objects marked with them must be protected from harm," the ICRC said. That same obligation should apply online, the organization said, noting that hacking operations in conflicts were likely to increase as more militaries develop cyber capabilities. The organization said that for the proposed "digital emblem" to become reality, nations worldwide would have to agree on its use and make it part of international humanitarian law alongside existing humanitarian insignia. It hopes the emblem would identify the computer systems of protected facilities much as a red cross or crescent on a hospital roof does in the real world. "The International Committee of the Red Cross said that it has identified three technical possibilities: a DNS-based emblem that would use a special label to link it to a domain name; an IP-based emblem; and an ADEM, or authenticated digital emblem, system that would use certificate chains to signal protection," adds the report.

It has been almost three years since Chromebook users got word that Steam support is coming to ChromeOS. We're still not totally there yet, but today Google announced that it's ready to enter beta testing. From a report: In a blog post, Zach Alcorn, Google product manager, announced that Steam on Chromebooks is available as a beta with ChromeOS 108.0.5359.24 and later. Steam on ChromeOS entered alpha in March, and Alcorn said the updates announced today are based on "thousands of gameplay reports." The Steam on ChromeOS alpha required not just an Intel CPU, but also an Intel 11th-gen Core i5 chip with Intel's Iris Xe graphics. The beta supports Intel's latest 12th-gen chips and extends support to Team Red. Alcorn said the beta supports AMD's Ryzen 5000 C-Series CPUs.

Encrypted messaging app Signal will soon have an ephemeral "stories" feature, with video, pictures or text that disappear after 24 hours. From a report: Signal, often used by journalists, activists and privacy minded individuals, plans to roll out the feature on Monday, the nonprofit's president Meredith Whittaker told Axios at the Web Summit in Lisbon, Portugal Thursday. Signal has been beta-testing the feature since last month.

User updates that last on profiles for 24 hours, often called "stories," are something popularized by Snapchat and Instagram, both companies with targeted advertising based business models who also monetize the feature, something Signal is vehemently opposed to. "The short answer is that people want [stories]," Whittaker told Axios in an exclusive interview when asked why the privacy-focused app is rolling out such a feature.

Geopolitics such as Russia's invasion of Ukraine has led to more damaging and widespread cybersecurity attacks in the year to July, EU cybersecurity agency ENISA said in its annual report on Thursday. From a report: ENISA's study follows concerns about the role of state actors and the growing range of threats to governments, companies and essential sectors such as energy, transport, banking and digital infrastructure. The agency said geopolitical situations - in particular the Russian invasion of Ukraine - were game-changers during the period under review. Zero-day exploits in which hackers exploit software vulnerabilities before developers have a chance to fix the flaws, as well as artificial intelligence-enabled disinformation and deepfakes resulted in more malicious and widespread attacks with more damaging impact, it said.

joshuark shares a report from BleepingComputer, written by Ax Sharma: Searching for 'GIMP' on Google as recently as last week would show visitors an ad for 'GIMP.org,' the official website of the well known graphics editor, GNU Image Manipulation Program. This ad would appear to be legitimate as it'd state 'GIMP.org' as the destination domain. But clicking on it drove visitors to a lookalike phishing website that provided them with a 700 MB executable disguised as GIMP which, in reality, was malware.

Reddit user ZachIngram04 earlier shared the development stating that the ad previously took users to a Dropbox URL to serve malware, but was soon "replaced with an even more malicious one" which employed a fake replica website 'gilimp.org' to serve malware. BleepingCompuer observed another domain 'gimp.monster' related to this campaign. To pass off the trojanized executable as GIMP in a believable manner to the user, the threat actor artificially inflated the malware, that is otherwise under 5 MB in size, to 700 MB by a simple technique known as binary padding. It still isn't clear if this instance was a slip up caused by a potential bug in Google Ad Manager that allowed malvertising.

Hawaii is implementing one of the most ambitious electronic waste recycling plans in the country, but some Hawaii retailers are afraid it will mean higher prices and less selection. From a report: Ironically, Hawaii has no ability to recycle electronic devices. Instead, the material has to be collected and shipped to processing centers elsewhere. The goal of the new law is to have manufacturers collect and ship out more and more of the used-up products. But industry lobbyist Walter Alcorn, with the Consumer Technology Association, said the law sets goals that cannot be met. "On the industry side, it's been a scramble." Alcorn said. "Particularly for the computer and printer manufacturers that previously did not have to have this type of a program."

State Rep. Nicole Lowen, chair of the Energy and Environmental Protection Committee, was among the lead advocates for the law. She said putting the full responsibility on the manufacturers will incentivize them to pay more attention to the waste their industry is generating. "We are pushing them to rethink the design packaging, distribution systems of their products and create more efficiency, for the reuse and recycling of those products or the materials that they contain," Lowen said. The law required 49 manufacturers, from Apple to Samsung, to report how much product has been shipped in by weight and how they would set up systems to collect discarded devices and ship them to recycling locations. There are none in Hawaii so all the products would have to be shipped out.

An OpenSSL vulnerability once signaled as the first critical-level patch since the Internet-reshaping Heartbleed bug has just been patched. It ultimately arrived as a "high" security fix for a buffer overflow, one that affects all OpenSSL 3.x installations, but is unlikely to lead to remote code execution. From a report: OpenSSL version 3.0.7 was announced last week as a critical security fix release. The specific vulnerabilities (now CVE-2022-37786 and CVE-2022-3602) had been largely unknown until today, but analysts and businesses in the web security field hinted there could be notable problems and maintenance pain. Some Linux distributions, including Fedora, held up releases until the patch was available. Distribution giant Akamai noted before the patch that half of their monitored networks had at least one machine with a vulnerable OpenSSL 3.x instance, and among those networks, between 0.2 and 33 percent of machines were vulnerable. But the specific vulnerabilities -- limited-circumstance, client-side overflows that are mitigated by the stack layout on most modern platforms -- are now patched, and rated as "High." And with OpenSSL 1.1.1 still in its long-term support phase, OpenSSL 3.x is not nearly as widespread. Malware expert Marcus Hutchins points to an OpenSSL commit on GitHub that details the code issues: "fixed two buffer overflows in puny code decoding functions." A malicious email address, verified within an X.509 certificate, could overflow bytes on a stack, resulting in a crash or potentially remote code execution, depending on the platform and configuration.

US financial institutions spent nearly $1.2 billion on likely ransomware-related payments last year, most commonly in response to breaches originating with Russian criminal groups, according to the Treasury Department. From a report: The payments more than doubled from 2020, underscoring the pernicious damage that ransomware continues to wreak on the private sector. The Financial Crimes Enforcement Network, or FinCEN, said its analysis "indicates that ransomware continues to pose a significant threat to U.S. critical infrastructure sectors, businesses and the public." Financial institutions filed 1,489 incidents related to ransomware in 2021, up from 487 the year before, according to data collected under the Bank Secrecy Act. FinCEN's analysis included extortion amounts, attempted transactions and payments that were unpaid. FinCEN said the top five highest-grossing ransomware variants from the second half of 2021 are connected to Russian cybercriminals. The damage from Russian-related ransomware during that period totaled more than $219 million, according to the data.

An anonymous reader quotes a report from the Associated Press: The White House is bringing together three dozen nations, the European Union and a slew of private-sector companies for a two-day summit starting Monday that looks at how best to combat ransomware attacks. The second International Counter Ransomware Summit will focus on priorities such as ensuring systems are more resilient to better withstand attacks and disrupt bad actors planning such assaults. A senior Biden administration official cited recent attacks such as one that targeted the Los Angeles school district last month to underscore the urgency of the issue and the summit. The official previewed the event on the condition of anonymity.

Among the administration officials planning to participate in the event are FBI Director Christopher Wray, national security adviser Jake Sullivan, Deputy Treasury Secretary Wally Adeyemo and Deputy Secretary of State Wendy Sherman. President Joe Biden is not expected to attend. Participating countries are Australia, Austria, Belgium, Brazil, Bulgaria, Canada, Croatia, the Czech Republic, the Dominican Republic, Estonia, the European Commission, France, Germany, India, Ireland, Israel, Italy, Japan, Kenya, Lithuania, Mexico, the Netherlands, New Zealand, Nigeria, Norway, Poland, the Republic of Korea, Romania, Singapore, South Africa, Spain, Sweden, Switzerland, Ukraine, the United Arab Emirates, the United Kingdom and the United States.

The Federal Trade Commission on Monday cracked down on Chegg, an education technology firm based in Santa Clara, Calif., saying the company's "careless" approach to cybersecurity had exposed the personal details of tens of millions of users. From a report: In a legal complaint, filed on Monday morning, regulators accused Chegg of numerous data security lapses dating to 2017. Among other problems, the agency said, Chegg had issued root login credentials, essentially an all-access pass to certain databases, to multiple employees and outside contractors. Those credentials enabled many people to look at user account data, which the company kept on Amazon Web Services' online storage system.

As a result, the agency said, a former Chegg contractor was able to use company-issued credentials to steal the names, email addresses and passwords of about 40 million users in 2018. In certain cases, sensitive details on students' religion, sexual orientation, disabilities and parents' income were also taken. Some of the data was later found for sale online. Chegg's popular homework help app is used regularly by millions of high school and college students. To settle the F.T.C.'s charges, the agency said Chegg had agreed to adopt a comprehensive data security program.

The White House is bringing together three dozen nations, the European Union and a slew of private-sector companies for a two-day summit starting Monday that looks at how best to combat ransomware attacks. From a report: The second International Counter Ransomware Summit will focus on priorities such as ensuring systems are more resilient to better withstand attacks and disrupt bad actors planning such assaults. A senior Biden administration official cited recent attacks such as one that targeted the Los Angeles school district last month to underscore the urgency of the issue and the summit. The official previewed the event on the condition of anonymity. Among the administration officials planning to participate in the event are FBI Director Christopher Wray, national security adviser Jake Sullivan, Deputy Treasury Secretary Wally Adeyemo and Deputy Secretary of State Wendy Sherman. President Joe Biden is not expected to attend.

Here's the Guardian's report on new cryptographic techniques where "you can share data while keeping that data private" — known by the umbrella term "privacy-enhancing technologies" (or "Pets). They offer opportunities for data holders to pool their data in new and useful ways. In the health sector, for example, strict rules prohibit hospitals from sharing patients' medical data. Yet if hospitals were able to combine their data into larger datasets, doctors would have more information, which would enable them to make better decisions on treatments. Indeed, a project in Switzerland using Pets has since June allowed medical researchers at four independent teaching hospitals to conduct analysis on their combined data of about 250,000 patients, with no loss of privacy between institutions. Juan Troncoso, co-founder and CEO of Tune Insight, which runs the project, says: "The dream of personalised medicine relies on larger and higher-quality datasets. Pets can make this dream come true while complying with regulations and protecting people's privacy rights. This technology will be transformative for precision medicine and beyond."

The past couple of years have seen the emergence of dozens of Pet startups in advertising, insurance, marketing, machine learning, cybersecurity, fintech and cryptocurrencies. According to research firm Everest Group, the market for Pets was $2bn last year and will grow to more than $50bn in 2026. Governments are also getting interested. Last year, the United Nations launched its "Pet Lab", which was nothing to do with the welfare of domestic animals, but instead a forum for national statistical offices to find ways to share their data across borders while protecting the privacy of their citizens.

Jack Fitzsimons, founder of the UN Pet Lab, says: "Pets are one of the most important technologies of our generation. They have fundamentally changed the game, because they offer the promise that private data is only used for its intended purposes...." The emergence of applications has driven the theory, which is now sufficiently well developed to be commercially viable. Microsoft, for example, uses fully homomorphic encryption when you register a new password: the password is encrypted and then sent to a server who checks whether or not that password is in a list of passwords that have been discovered in data breaches, without the server being able to identify your password. Meta, Google and Apple have also over the last year or so been introducing similar tools to some of their products.
The article offers quick explanations of zero-knowledge proofs, secure multiparty computation, and fully homomorphic encryption (which allows the performance of analytics on data by a second party who never reads the data or learns the result).

And "In addition to new cryptographic techniques, Pets also include advances in computational statistics such as 'differential privacy', an idea from 2006 in which noise is added to results in order to preserve the privacy of individuals."