Iran has one nuclear power plant. The email system of the company operating it was just breached, according to Iran's civil nuclear arm. The Associated Press reports: An anonymous hacking group claimed responsibility for the attack on Iran's Atomic Energy Organization, demanding Tehran release political prisoners arrested in the recent nationwide protests. The group said it leaked 50 gigabytes of internal emails, contracts and construction plans related to Iran's Russian-backed nuclear power plant in Bushehr and shared the files on its Telegram channel. It was unclear whether the breached system contained classified material.

The hack comes as Iran continues to face nationwide unrest...

Computer science professor Moshe Y. Vardi is the Senior Editor of Communications of the ACM.

And he's concerned about the state of cybersecurity today: In 2017, I wrote: "So here we are, 70 years into the computer age and after three ACM Turing Awards in the area of cryptography (but none in cybersecurity), and we still do not seem to know how to build secure information systems." What would I write today? Clearly, I would write: "75 years," but I would not change a word in the rest of the sentence....

The slow progress in cybersecurity is leading many to conclude the problem is not due to just a lack of technical solution but reflects a market failure, which disincentivizes those who may be able to fix serious security vulnerabilities from doing so. As I argued in 2020, the computing fields tend to focus on efficiency at the expense of resilience. Security usually comes at a cost in terms of performance, a cost that market players seem reluctant to pay. To discuss the market-failure issue and how to address it, the Computing Community Consortium organized in August this year a visioning workshop on Mechanism Design for Improving Hardware Security. The opening talk was given by Paul Rosenzweig, an attorney who specializes in national security law. He argued that technological development is founded, at the end, on human behavior.

So, the key to good cybersecurity is to incentivize humans. Thus, the answer lies in the economics of cybersecurity, which is, mostly, a private domain with lots of externalities, where prices do not capture all costs.... As the philosopher Helen Nissenbaum pointed out in a 1996 article, while computing vendors are responsible for the reliability and safety of their product, the lack of liability results in lack of accountability. She warned us more than 25 years ago about eroding accountability in computerized societies. The development of the "move-fast-and-break-things" culture in this century shows that her warning was on the mark....

If we want to address the cyber-insecurity issue, we should start by welcoming liability into computing.
Thanks to long-time Slashdot reader shanen for sharing the article

The Washington Post spotlights millions of workers newly allowed to work remotely since the pandemic — including the head of Block's global policy partnerships who moved to a tiny town in Michigan to be closer to her grandfather. And on the plus side, there's a 34-year-old who "has spent the last two years jet-setting across Spain, Italy, Greece and her motherland of Romania. She's also thrown herself into road cycling..."

Remote workers say they enjoy connecting with nature, exploring the world and spending more time with family, noting that their outlook on work has changed forever. But it's not rosy all the time: Some say their new lifestyles have introduced complications like time-zone coordination, a different approach to connecting with colleagues, slow internet connectivity, the fear of missing out in-person, and sorting out international health care and travel restrictions....

Mike Cannon-Brookes, co-founder and co-CEO of Australian software company Atlassian, moved to a farm two hours south of the company's Sydney headquarters.... "We decided that ... nobody had to come back to an office," he said. "That reduced pressure." For Cannon-Brookes, allowing his employees to work from anywhere seemed to make the most sense. But he admits Atlassian had to do a lot of retooling to make the policy functional. It had to adjust salaries based on location, coordinate time zones so that teams could work together, create moments for in-person interactions and recruit in areas it hadn't explored. While it's still working social connection, Atlassian now has a larger hiring pool and happier employees, he says. And many got to be with family. "There's a number of people who've sent beautiful, tearful messages, especially older employees who have worked awhile and realized how unusual this is," he said.

Atlassian software developer Christina Bell, 27, says the change allowed her to keep her job to spend time with her grandmother, who was diagnosed with cancer, in her homeland of New Zealand. "We went to the beach, did puzzles together, had quality time," she said of her grandmother who was an early supporter of her engineering interests. "In a good twist of events, my nana is in remission, and she's still with us a year and a half later. I'm making the most of our time." Quality time with family is a common thread among several workers who moved thanks to new work policies....

Some workers found relief leaving their cities for nature. That was the case for Naomi Barnett of Spotify and Helen Prowse of Block.... Tempe, Ariz., resident Devin Miller, who works in Yelp's people operations department, says the permanent shift to remote work made room for a new ritual: occasionally working from a cabin in the mountainous town of Pinetop-Lakeside, Ariz. There, he can watch a herd of elk parade across the front yard and take a conference call from a swinging hammock — assuming his internet signal isn't weak. "It's a total refresh for both of us," he said, referring to his partner.

"Being stuck in our house put a lot of pressure on our relationship."

First released in 1998, the BSD-licensed software Zeek (originally named "Bro") is about to get more widely adopted, writes long-time Slashdot reader skinfaxi: Zeek, the open source network security monitoring platform, is being integrated into Windows and "is now deployed on more than one billion global endpoints," according to an announcement from Corelight.
From Corelight's press release: Corelight, the leader in open network detection and response, today announced the integration of Zeek, the world's most popular open source network security monitoring platform, as a component of Microsoft Windows and Defender for Endpoint. The integration will help security teams respond to the most challenging attacks by providing "richer signals for advanced threat hunting, complete and accurate discovery of IoT devices, and more powerful detection and response capabilities."

Originally created by Corelight co-founder and chief scientist Dr. Vern Paxson while at Lawrence Berkeley National Laboratory, Zeek transforms network traffic into compact and high-fidelity logs, file content, and behavioral analytics to accelerate security operations. Vital funding for Zeek came initially from the National Science Foundation and the US Department of Energy's Office of Science. As adoption increased, Corelight was founded to provide a financial model and corporate sponsor for the project....

"Microsoft is strongly committed to supporting open source projects and ecosystems," said Rob Lefferts, corporate vice president for Microsoft. "We're proud to be working with Zeek and are thrilled to bring this level of network intelligence and monitoring to our customers."

"This is an amazing development for Zeek and its community of contributors and users," said Paxson. "I never imagined that the tool I developed for network monitoring would find broader application in defending endpoints — but that's part of the creative magic of open source development.

"We are grateful for Microsoft's contributions and support, and we are excited that the project's impact, and that of the community of contributors, will increase so dramatically."

French police said Friday they're investigating multiple cuts to fiber-optic cables in France's second-largest city. Operators said the cables link Marseille to other cities in France and Europe and that internet and phone services were severely disrupted. From a report: The disruptions in Marseille were a taste of what analysts warn could be far larger problems in other cases if cables are systematically attacked. The vulnerability of fiber-optic cables, especially those underwater, and other key infrastructure was highlighted by the sabotage last month in the Baltic Sea of natural gas pipelines from Russia. The damage in the city in southern France also appeared to resemble suspected acts of sabotage to other cables in the country earlier this year. French cable operator and internet service provider Free said its repair teams were mobilized before dawn Wednesday to deal with "an act of vandalism on our fiber infrastructure." It said the attacks were simultaneous and on multiple spots of its fiber network near Marseille. Photos that Free published on Twitter showed multiple cables completely severed in their concrete housings buried in the ground. It said the cuts led to major disruptions to its network and phone services in the Marseille area.

The Biden administration said it will launch a cybersecurity labeling program for consumer Internet of Things devices starting in 2023 in an effort to protect Americans from "significant national security risks." TechCrunch reports: Inspired by Energy Star, a labeling program operated by Environmental Protection Agency and the Department of Energy to promote energy efficiency, the White House is planning to roll out a similar IoT labeling program to the "highest-risk" devices starting next year, a senior Biden administration official said on Wednesday following a National Security Council meeting with consumer product associations and device manufacturers. Attendees at the meeting included White House cyber official Anne Neuberger, FCC chairwoman Jessica Rosenworcel, National Cyber Director Chris Inglis and Sen. Angus King, alongside leaders from Google, Amazon, Samsung, Sony and others.

The initiative, described by White House officials as "Energy Star for cyber," will help Americans to recognize whether devices meet a set of basic cybersecurity standards devised by the National Institute of Standards and Technology (NIST) and the Federal Trade Commission (FTC). Though specifics of the program have not yet been confirmed, the administration said it will "keep things simple." The labels, which will be "globally recognized" and debut on devices such as routers and home cameras, will take the form of a "barcode" that users can scan using their smartphone rather than a static paper label, the administration official said. The scanned barcode will link to information based on standards, such as software updating policies, data encryption and vulnerability remediation.

The Federal Aviation Administration is investigating the cause of mysterious GPS interference that, over the past few days, has closed one runway at the Dallas-Fort Worth International Airport and prompted some aircraft in the region to be rerouted to areas where signals were working properly. From a report: The interference first came to light on Monday afternoon when the FAA issued an advisory over ATIS (Automatic Terminal Information Service). It warned flight personnel and air traffic controllers of GPS interference over a 40-mile swath of airspace near the Dallas-Fort Worth airport. The advisory read in part: "ATTN ALL AIRCRAFT. GPS REPORTED UNRELIABLE WITHIN 40 NM OF DFW." An advisory issued around the same time by the Air Traffic Control System Command Center, meanwhile, reported the region was "experiencing GPS anomalies that are dramatically impacting" flights in and out of Dallas-Fort Worth and neighboring airports. It went on to say that some of the airports were relying on the use of navigation systems that predated GPS.

Microsoft says that an unspecified amount of customer data, including contact info and email content, was recently left exposed to potential access over the internet as a result of a server configuration error. From a report: Cybersecurity vendor SOCRadar, which reported the data leak to Microsoft, said in a blog post that data belonging to more than 65,000 companies was affected. Microsoft, however, said in its own post that SOCRadar "has greatly exaggerated the scope of this issue." Microsoft didn't disclose specifics around the number of companies whose data may have been exposed in the leak or the amount of data involved. The server misconfiguration was reported on Sept. 24, and the impacted server was "quickly secured" after that, according to Microsoft. Due to the configuration error, there was a potential that certain "business transaction data" could have been accessed without a need for authentication, Microsoft said. The data corresponds to "interactions between Microsoft and prospective customers," including around the planning and implementation of Microsoft services, the company said in its post.

What secrets does the inside of the Pixel Watch hold? iFixit -- Google's new repair partner -- tore down Google's first self-branded smartwatch to see exactly how this thing was put together. From a report: Like us, iFixit came away with strong "first generation" vibes. The good news is that it does not look impossible to replace the display. The usual bit of heat and prying pops the top off, but the less-than-ideal layout means you'll have to remove the battery, too, since the connector is buried under the soft battery pouch. A display replacement is a real concern here, considering the entire top half of the watch is glass. If you bang the watch against something or drop it, there's a good chance you'll shatter the all-glass corners. [...] iFixit took a good amount of time in the four-minute video to call Google's internal construction "ugly." After cracking open the front, iFixit's Sam Goldheart noted, "Right away, it's obvious we're in Android country. The silver battery pouch and Kapton tape are almost a shock after all our Apple teardowns," later adding that the welds holding together the haptic feedback buzzer were "kind of ugly."

An anonymous reader shares a report: We've said it before, and we'll say it again: USB-C is confusing. A USB-C port or cable can support a range of speeds, power capabilities, and other features, depending on the specification used. Today, USB-C can support various data transfer rates, from 0.48Gbps (USB 2.0) all the way to 40Gbps (USB4, Thunderbolt 3, and Thunderbolt 4). Things are only about to intensify, as today the USB Implementers Forum (USB-IF) published the USB4 Version 2.0 spec. It adds optional support for 80Gbps bidirectional bandwidth as well as the optional ability to send or receive data at up to 120Gbps.

The USB-IF first gave us word of USB4 Version 2.0 in September, saying it would support a data transfer rate of up to 80Gbps in either direction (40Gbps per lane, four lanes total), thanks to a new physical layer architecture (PHY) based on PAM-3 signal encoding. For what it's worth, Intel also demoed Thunderbolt at 80Gbps but hasn't released an official spec yet. USB4 Version 2.0 offers a nice potential bump over the original USB4 spec, which introduced optional support for 40Gbps operation. You just have to be sure to check the spec sheets to know what sort of performance you're getting. Once USB4 Version 2.0 products come out, you'll be able to hit 80Gbps with USB-C passive cables that currently operate at 40Gbps, but you'll have to buy a new cable if you want a longer, active 80Gbps.

Germany's cybersecurity chief has been fired after allegations of being excessively close to Russia through an association he helped set up. The BBC reports: Arne Schonbohm had led the Federal Cyber Security Authority (BSI) -- charged with protecting government communications -- since 2016. German media have accused him of having had links with people involved with Russian intelligence services. The interior ministry is investigating allegations made against him. But it confirmed he had been fired with immediate effect.

Mr Schonbohm had come under scrutiny after his potential links to a Russian company through a previous role were highlighted by Jan Bohmermann, the host of one of Germany's most popular late-night TV shows. Before leading the BSI, Mr Schonbohm had helped set up and run the Cyber Security Council Germany, a private association which advises business and policymakers on cybersecurity issues. He is said to have maintained close ties to the association and attended their 10th anniversary celebrations in September. One of the association's members was a cybersecurity company called Protelion, which was a subsidiary of a Russian firm reportedly established by a former member of the KGB honored by President Vladimir Putin. Protelion was ejected from the association last weekend, and Cyber Security Council Germany says the allegations of links to Russian intelligence are untrue.

DuckDuckGo is rolling out its web browsing app for Mac users as an open beta test. Designed for privacy, the app was announced back in April as a closed beta, but is now available for all Mac users to try before its official public launch. From a report: The desktop browser includes the same built-in protections we've seen already featured in DuckDuckGo's mobile apps, combining DuckDuckGo's search engine, defenses against third-party tracking, cookie pop-up protection, and its popular one-click data clearing 'Fire Button.' Some additional features have been added to the browser (version 0.30) since its original announcement.

Now users can try Duck Player, a feature that protects users from targeted ads and cookies while watching YouTube content. Ads viewed within the Duck Player will not be personalized, which DuckDuckGo claims actually removed most YouTube ads as a result during testing. YouTube will still register your views, but content watched through Duck Player won't contribute to your YouTube advertising profile. Pinned tabs and a new bookmarks bar have been included to address feedback from early beta testing, as well as a way to view your locally stored browsing history. DuckDuckGo's Cookie Consent Pop-Up Manager is also available which works on about 50 percent of sites (with more to come) to automatically choose the most private option and spare users from the annoying pop-up messages. The app also lets you activate DuckDuckGo Email Protection on the desktop to better protect your inbox with email tracker blocking.

An anonymous reader quotes a report from BleepingComputer: Over 45,000 VMware ESXi servers inventoried by Lansweeper just reached end-of-life (EOL), with VMware no longer providing software and security updates unless companies purchase an extended support contract. Lansweeper develops asset management and discovery software that allows customers to track what hardware and software they are running on their network. As of October 15, 2022, VMware ESXi 6.5 and VMware ESXi 6.7 reached end-of-life and will only receive technical support but no security updates, putting the software at risk of vulnerabilities.

The company analyzed data from 6,000 customers and found 79,000 installed VMware ESXi servers. Of those servers, 36.5% (28,835) run version 6.7.0, released in April 2018, and 21.3% (16,830) are on version 6.5.0, released in November 2016. In total, there are 45,654 VMware ESXi servers reaching End of Life as of today. The findings of Lansweeper are alarming because apart from the 57% that enter a period of elevated risk, there are also another 15.8% installations that run even older versions, ranging from 3.5.0 to 5.5.0, which reached EOL quite some time ago.

In summary, right now, only about one out of four ESXi servers (26.4%) inventoried by Lansweeper are still supported and will continue to receive regular security updates until April 02, 2025. However, in reality, the number of VMware servers reaching EOL today, is likely far greater, as this report is based only on Lansweeper's customers. The technical guidance for ESXi 6.5 and 6.7 will carry on until November 15, 2023, but this concerns implementation issues, not including security risk mitigation. The only way to ensure you can continue to use older versions securely is to apply for the two-year extended support, which needs to be purchased separately. However, this does not include updates for third-party software packages. For more details about EOL dates on all VMware software products, check out this webpage.

An anonymous reader quotes a report from Reuters: A former Wall Street Journal reporter is accusing a major U.S. law firm of having used mercenary hackers to oust him from his job and ruin his reputation. In a lawsuit filed late Friday, Jay Solomon, the Journal's former chief foreign correspondent, said Philadelphia-based Dechert LLP worked with hackers from India to steal emails between him and one of his key sources, Iranian American aviation executive Farhad Azima. Solomon said the messages, which showed Azima floating the idea of the two of them going into business together, were put into a dossier and circulated in a successful effort to get him fired.

The lawsuit, filed in federal court in Washington, said Dechert "wrongfully disclosed this dossier first to Mr. Solomon's employer, the Wall Street Journal, at its Washington DC bureau, and then to other media outlets in an attempt to malign and discredit him." It said the campaign "effectively caused Mr. Solomon to be blackballed by the journalistic and publishing community." Dechert said in an email that it disputed the claim and would fight it in court. The lawsuit is the latest in a series of legal actions related to hired hackers operating out of India, notes Reuters. "In June, Reuters reported on the activities of several hack-for-hire shops, including Delhi area-companies BellTroX and CyberRoot, that were involved in a decade-long series of espionage campaigns targeting thousands of people, including more than 1,000 lawyers at 108 different law firms."

Solomon said in a statement Saturday that the hack-and-leak he suffered was an example of "a trend that's becoming a great threat to journalism and media, as digital surveillance and hacking technologies become more sophisticated and pervasive. This is a major threat to the freedom of the press."

Drew DeVault, prolific FOSS blogger and hacker behind SourceHut, Sway, wlroots, and many other projects, writes in a blog post: I have relied on ffmpeg for many tasks and for many years. It has always been there to handle any little multimedia-related task I might put it to for personal use -- re-encoding audio files so they fit on my phone, taking clips from videos to share, muxing fonts into mkv files, capturing video from my webcam, live streaming hacking sessions on my own platform, or anything else I can imagine. It formed the foundation of MediaCrush back in the day, where we used it to optimize multimedia files for efficient viewing on the web, back when that was more difficult than "just transcode it to a webm."

ffmpeg is notable for being one of the first large-scale FOSS projects to completely eradicate proprietary software in its niche. Virtually all multimedia-related companies rely on ffmpeg to do their heavy lifting. It took a complex problem and solved it, with free software. The book is now closed on multimedia: ffmpeg is the solution to almost all of your problems. And if it's not, you're more likely to patch ffmpeg than to develop something new. The code is accessible and the community are experts in your problem domain.

ffmpeg is one of the foremost pillars of achievement in free software. It has touched the lives of every reader, whether they know it or not. If you've ever watched TV, or gone to a movie, or watched videos online, or listened to a podcast, odds are that ffmpeg was involved in making it possible. It is one of the most well-executed and important software projects of all time.

The Federal Trade Commission is investigating whether Visa and Mastercard's security tokens restrict debit-card routing competition on online payments, WSJ reported Monday, citing people familiar with the matter. From the report: The FTC for the past few years has already been probing whether Visa and Mastercard block merchants from routing payments over other debit-card networks. The networks acknowledged an FTC probe in regulatory filings in recent years. In recent months, the FTC expanded its focus to routing challenges that stem from the networks' security tokens, the people familiar with the matter said. It isn't clear if the investigation is a new probe or part of the previous one.

Visa and Mastercard are by far the two biggest card networks in the U.S., building and maintaining the plumbing that allows Americans to use credit and debit cards at stores and online. Their lion's share of that market has drawn increasing scrutiny from regulators and fueled tension with merchants, which pay fees set by the networks when a customer pays via card. A Justice Department investigation on whether Visa has unlawfully maintained a dominant market share in debit cards is ongoing, according to people familiar with the matter. Federal law requires that merchants have the ability to choose from at least two unaffiliated debit-card networks to route transactions. That is supposed to give merchants the option to send debit-card payments over the network that sets lower fees. In most cases, when a person stores a card in a digital wallet such as Apple Pay, the 16-digit card number gets replaced by a "security token" -- essentially a line of random numbers. The token is typically provided by the network listed on the card -- often Visa or Mastercard.

Mark Zuckerberg, writing in a Facebook post: WhatsApp is far more private and secure than iMessage, with end-to-end encryption that works across both iPhones and Android, including group chats. With WhatsApp you can also set all new chats to disappear with the tap of a button. And last year we introduced end-to-end encrypted backups too. All of which iMessage still doesn't have.

"Europe is aiming to launch a technology demonstration satellite for secure, quantum-encrypted communications in 2024," reports Space.com, "with a view to developing a larger constellation." The satellite, Eagle-1, will be the first space-based quantum key distribution (QKD) system for the European Union and could lead to an ultrasecure communications network for Europe, according to a statement from the European Space Agency (ESA).

Eagle-1 will spend three years in orbit testing the technologies needed for a new generation of secure communications. The satellite will demonstrate the "feasibility of quantum key distribution technology — which uses the principles of quantum mechanics to distribute encryption keys in such a way that any attempt to eavesdrop is immediately detected — within the EU using a satellite-based system," according to ESA...

"European security and sovereignty in a future world of quantum computing is critical to the success of Europe and its Member States," Steve Collar, CEO of SES, said in the statement. He added that the goal is "to advance quantum communications and develop the Eagle-1 system to support secure and sovereign European networks of the future."
SES will be leading a consortium of more than 20 European countries, according to the ESA's statement: Eagle-1 will demonstrate the feasibility of quantum key distribution technology — which uses the principles of quantum mechanics to distribute encryption keys in such a way that any attempt to eavesdrop is immediately detected — within the EU using a satellite-based system. To do so, the system will build on key technologies developed under ESA's Scylight programme, with the aim of validating vital components supplied within the EU....

It will allow the EU to prepare for a sovereign, autonomous cross-border quantum secure communications network.

The system will initially use an upgraded optical ground terminal from the German Aerospace Centre (DLR) alongside a new optical ground terminal to be developed by a team from the Netherlands. The Eagle-1 platform satellite from Italian company Sitael will carry a quantum-key payload built by Tesat Spacecom of Germany and will be operated by Luxembourg-headquartered SES.

"A researcher from cloud and endpoint protection provider WithSecure has discovered an unpatchable flaw in Microsoft Office 365 Message Encryption," reports VentureBeat. "The flaw enables a hacker to infer the contents of encrypted messages." OME uses the electronic codebook (ECB) block cipher, which leaks structural information about the message. This means if an attacker obtains many emails they can infer the contents of the messages by analyzing the location and frequency of patterns in the messages and matching these to other emails. For enterprises, this highlights that just because your emails are encrypted, doesn't mean they're safe from threat actors. If someone steals your email archives or backups, and accesses your email server, they can use this technique to sidestep the encryption.

The discovery comes shortly after researchers discovered hackers were chaining two new zero-day Exchange exploits to target Microsoft Exchange servers.

WithSecure originally shared its discovery of the Office 365 vulnerability with Microsoft in January 2022. Microsoft acknowledged it and paid the researcher through its vulnerability reward program, but hasn't issued a fix.

"Apple workers in Oklahoma City have voted to form the second-ever labor union at one of the company's US stores," reports CNN, "in the latest sign that organizing efforts are gaining traction inside and outside the tech and retail industries." In a preliminary tally by the National Labor Relations Board on Friday evening, 56 workers, or 64% of those casting ballots at the Penn Square Mall Apple store, voted to be represented the Communication Workers of America, and 32 voted against it. Turnout was strong, with 88 of a potential 95 workers participating in the vote.

The union victory comes four months after Apple store workers in Towson, Maryland, made history by voting to form Apple's first US unionized location.... Workers at both locations have said they're looking to unionize in an effort to have more of a say in how their stores are run. Some also said they were inspired by union pushes this year at Amazon and Starbucks.

Apple did not immediately respond to a request for comment after the late night vote count Friday....

Between January and July of this year there were 826 union elections, up 45% from the number held in the same period of 2021, according to a CNN analysis of data from the NLRB. And the 70% success rate by unions in those votes is far better than the 42% success rate in the first seven months of 2021.