Internet infrastructure company Cloudflare said this week that it mitigated one of the largest volumetric distributed denial of service (DDoS) attacks that has been recorded to date. From a report: Cloudflare said it detected and mitigated a 15.3 million request-per-second (rps) DDoS attack earlier this month -- making it one of the largest HTTPS DDoS attacks on record. Volumetric DDoS attacks differ from traditional bandwidth DDoS attacks where attackers attempt to exhaust and clog up the victim's internet connection bandwidth. Instead, attackers focus on sending as many junk HTTP requests to a victim's server in order to take up precious server CPU and RAM and prevent legitimate users from using targeted sites. Cloudflare previously announced that it stopped the largest DDoS attack on record in August 2021, when it mitigated a 17.2 million HTTP requests/second (rps) attack, a figure that the company described as almost three times larger than any previous volumetric DDoS attack that was ever reported in the public domain. Earlier this month, the company said it stopped an attack targeting a company in the cryptocurrency space.

An anonymous reader quotes a report from Ars Technica: Vulnerabilities recently discovered by Microsoft make it easy for people with a toehold on many Linux desktop systems to quickly gain root system rights -- the latest elevation of privileges flaw to come to light in the open source OS. [...] Nimbuspwn, as Microsoft has named the EoP threat, is two vulnerabilities that reside in the networkd-dispatcher, a component in many Linux distributions that dispatch network status changes and can run various scripts to respond to a new status. When a machine boots, networkd-dispatcher runs as root. [...] A hacker with minimal access to a vulnerable desktop can chain together exploits for these vulnerabilities that give full root access. [The step-by-step exploit flow can be found in the article. The researcher also was able to gain persistent root access using the exploit flow to create a backdoor.]

The proof-of-concept exploit works only when it can use the "org.freedesktop.network1" bus name. The researcher found several environments where this happens, including Linux Mint, in which the systemd-networkd by default doesn't own the org.freedodesktop.network1 bus name at boot. The researcher also found several processes that run as the systemd-network user, which is permitted to use the bus name required to run arbitrary code from world-writable locations. The vulnerable processes include several gpgv plugins, which are launched when apt-get installs or upgrades, and the Erlang Port Mapper Daemon, which allows running arbitrary code under some scenarios. The vulnerability has been patched, although it's unclear which version of Linux the patch is in.

At least six different Kremlin-linked hacking groups have conducted nearly 240 cyber operations against Ukrainian targets, Microsoft said Wednesday, in data reveal a broader scope of alleged Russian cyberattacks during the war on Ukraine than previously documented. From a report: "Russia's use of cyberattacks appears to be strongly correlated and sometimes directly timed with its kinetic military operations," said Tom Burt, a Microsoft vice president.

The Microsoft report is the most comprehensive public record yet of Russian hacking efforts related to the war in Ukraine. It fills in some gaps in public understanding of where Russia's vaunted cyber capabilities have been deployed during the war. Burt cited a cyberattack on a Ukrainian broadcast company on March 1, the same day as a Russian missile strike against a TV tower in Kyiv, and malicious emails sent to Ukrainians falsely claiming the Ukrainian government was "abandoning" them amid the Russian siege of the city of Mariupol. Suspected Russian hackers "are working to compromise organizations in regions across Ukraine," and may have been collecting intelligence on Ukrainian military partnerships many months before the full-scale invasion in February, the Microsoft report says.

Apple on Wednesday followed through on its plans to begin publicly releasing repair manuals for some of its products, in addition to selling parts and tools online. The goal, the company said, is to allow iPhone owners an alternative way to repair their devices. From a report: The tech giant's new program, called Self Service Repair, is starting out for US customers with Apple's iPhone 13 line of smartphones, the iPhone 12 and new iPhone SE. Apple said it designed the program to offer adventurous and capable people access to the same parts, tools and instructions it gives to its own certified technicians and partner repair shops, hopefully making it easier for people to repair devices instead of resorting to buying a new one. "We believe we have a responsibility to customers and the environment to offer convenient access to safe, reliable, and secure repairs to help customers get the most out of their devices," the company wrote in a document published Wednesday that outlines its plans. "As the doors open on this new venue, we're underwhelmed, and settling back into our usual skepticism," iFixit posted on Wednesday. The firm adds: The biggest problem? Apple is doubling down on their parts pairing strategy, enabling only very limited, serial number-authorized repairs. You cannot purchase key parts without a serial number or IMEI. If you use an aftermarket part, there's an "unable to verify" warning waiting for you. This strategy hamstrings third-party repair with feature loss and scare tactics and could dramatically limit options for recyclers and refurbishers, short-circuiting the circular economy. As of today, you can buy an official Apple iPhone 12 screen and install it yourself, on your own device, with no fuss. Until now, DIY repairs relied on keeping the Face ID speaker and sensor assembly intact, then very carefully moving it to your new screen, and finally ignoring some gentle warnings. If your assembly was damaged or defective, you were out of luck. The new program will solve that problem -- assuming you've bought an official Apple part.

UnknowingFool writes: In 2020, Paragon Software announced they wanted to upstream their previously proprietary NTFS driver into Linux. After a year of review, the NTFS3 driver was added to the Linux 5.15 kernel. While Paragon pledged to maintain their driver, there have been no major updates to the driver despite a growing list of patches that have submitted. Developer Kari Argillander has raised his concerns on the mailing list that the driver is orphaned, and that the Paragon maintainer has not responded to any messages about fixes. An offer to co-maintain the driver has also been met with "radio silence".

An anonymous reader quotes a report from PC Magazine: European wind-energy companies have reportedly been targeted by hackers -- or been affected by cyberattacks on their suppliers -- since Russia invaded Ukraine in late February. The Wall Street Journal reports that Nordex SE and Deutsche Windtechnik AG have both reported cyber incidents over the last few months. A third German company, Enercon GmbH, told the Journal it was "collateral damage" when Viasat was hacked at the start of the invasion.

The severity of the hacks varies. Nordex SE had to shut down its IT systems; Deutsche Windtechnik AG couldn't remotely control about 2,000 turbines for at least a day; and Enercon GmbH lost remote access to some 5,800 turbines because of the Viasat hack. The notorious Conti ransomware gang has reportedly claimed responsibility for the March hack of Nordex SE; the Journal says that security experts are currently investigating the possibility that it was involved with the April hack of Deutsche Windtechnik AG as well.

Bored Ape Yacht Club's Instagram account and Discord server were both hacked on Monday, with an unofficial "mint" link being sent out to followers. From a report: "There is no mint going on today. It looks like BAYC Instagram was hacked. Do not mint anything, click links, or link your wallet to anything," the NFT project wrote on Twitter. At the time of writing, it is estimated that around 24 Bored Apes and 30 Mutant Apes have been stolen according to recent OpenSea transfers, although some of these may be holders transferring their NFTs for security purposes. The value of the 54 NFTs calculated by floor price is $13.7 million.

CNBC explores the dream of "a future where nobody has to constantly update and change online passwords to stay ahead of hackers and keep data secure." Here's the good news: Some of the biggest names in tech are already saying that the dream of a password-less internet is close to becoming a reality. Apple, Google and Microsoft are among those trying to pave the way... In theory, removing passwords from your cybersecurity equation nixes what former Secretary of Homeland Security Michael Chertoff has called "by far the weakest link in cybersecurity." More than 80% of data breaches are a result of weak or compromised passwords, according to Verizon....

Doing away with passwords altogether is not without risks. First, verification codes sent via email or text message can be intercepted by hackers. Even scarier: Hackers have shown the ability to trick fingerprint and facial recognition systems, sometimes by stealing your biometric data. As annoying as changing your password might be, it's much harder to change your face or fingerprints. Second, some of today's password-less options still ask you to create a PIN or security questions to back up your account. That's not much different from having a password.... Plus, tech companies still need to make online accounts accessible across multiple platforms, not just on smartphones — and also to the people who don't own smartphones at all, roughly 15% of the U.S.
Some data points from the article:

• "Microsoft says 'nearly 100%' of the company's employees use password-less options to log into their corporate accounts."

• "In September, Microsoft announced that its users could go fully password-less to access services like Windows, Xbox, and Microsoft 365."

• "Similarly, Google sells physical security keys, and its Smart Lock app allows you to tap a button on your Android or iOS device to log into your Google account on the web."

• Apple's devices have used Touch ID and Face ID features for several years."

A former NSA computer scientist is disgusted with the current state of security practices, writes ITWire. Slashdot reader samuel_the_fool shares their report: Patching of vulnerabilities is the security industry's equivalent of thoughts and prayers, a prominent American security expert has said during a debate on the topic "Patching is useless" at a recent online conference named Hack At The Harbor. Dave Aitel, 46, a former NSA computer scientist who ran his own security shop, Immunity, for many years, said the remedies proposed by security vendors and big technology companies had served to lull people into a false sense of security all these years and ensure that all the old problems still remained.... Aitel pointed out that if there were vulnerable devices on a network, then they should be removed and substituted with others, rather than being continuously patched....

Aitel was no less severe on Linux, noting that the biggest contributor to the kernel was the Chinese telecommunications vendor Huawei Technologies, which he claimed had been indicted by the US, and asking how one could rest content if so many patches were coming from a company of this kind.

On the positive side, he had praise for ChromeOS, an operating system that is produced by Google, and recommended the use of Chromebooks rather Windows machines.

Aitel called for vulnerability management, advocating the government as the best entity to handle this. His argument was that no other entity had sufficient power to push back against the lobby of the big software vendors and the security industry.

An anonymous reader shares a report: According to 9to5Google, a recent bug in Google's Messages app on Android phones left the camera running in the background -- a great way to both heat up your phone and run down your battery. The Google Messages app allows you to easily take a photo directly from the app and attach it to a chat message. According to the article in 9to5Google, the camera app would occasionally keep running, even when you did not have it on screen.

joshuark shares a report: Microsoft's Windows 10 operating system already disables by default SMB (Server Message Block) version 1, the 30-year-old file-sharing protocol. Now the company is doing the same with Windows 11 Home Dev Channel test builds, announced officials on April 19. SMB1 is considered outdated and not secure. However, some users with very old equipment may be in for a surprise if their Windows 11 laptops can't connect to an old networked hard drive, as officials said in a blog post about the SMB1 phase out plan. "There is no edition of Windows 11 Insider that has any part of SMB1 enabled by default anymore. At the next major release of Windows 11, that will be the default behavior as well," said Ned Pyle, Principal Program Manager. "Like always, this doesn't affect in-place upgrades of machines where you were already using SMB1. SMB1 is not gone here, an admin can still intentionally reinstall it," Pyle added.

European Union lawmakers have taken a step closer to agreeing rules to standardize how a range of mobile gadgetry is charged. From a report: Today MEPs in the European Parliament's internal market and consumer protection (IMCO) committee adopted their position on a Commission proposal announced last fall, ahead of a full vote by the parliament next month to confirm how it will negotiate with Member State governments on the detail of the legislation. The Council adopted its position on the common charger proposal back in January. The IMCO committee voted 43:2 in favor of a negotiation position that will push to standardize charger ports for a range of mobile devices on USB Type-C, including smartphones, tablets, handheld games consoles, e-readers, digital cameras, electronic toys and more -- with MEPs voting to expand the original proposal to cover laptops, among other additional products.

FaceTime users are getting bombarded with group calls from numbers they've never seen before, often as many as 20 times in short succession during late hours of the night. From a report: Griefers behind the pranks call as many as 31 numbers at a time. When a person receiving one of the calls hangs up, a different number will immediately call back. FaceTime doesn't have the ability to accept only FaceTime calls coming from people in the user's address book. It also requires that all numbers in a group call must be manually blocked for the call to be stopped. "I got my first facetime spam starting 4 days ago," one user reported to an Apple support forum earlier this month. "It has been non-stop, over 300 numbers blocked so far. My 3 year old daughter has been accidentally answering them and going on video without a t-shirt on." The high volume of callbacks appears to be the result of other people receiving the call dialing everyone back when the initial call fails shortly after answering. As more and more people receive follow-on calls, they too begin making callbacks. Apple provides surprisingly few ways for users to stop the nuisance calls. As noted earlier, users can block numbers, but this requires manually blocking each individual person on the group call. That's not an effective solution for people receiving dozens of group calls, often to a different group of people in a short period of time, often in the wee hours.

The smart home company Insteon has vanished. The entire company seems to have abruptly shut down just before the weekend, breaking users' cloud-dependent smart-home setups without warning. From a report: Users say the service has been down for three days now despite the company status page saying, "All Services Online." The company forums are down, and no one is replying to users on social media. As Internet of Things reporter Stacey Higginbotham points out, high-ranking Insteon executives, including CEO Rob Lilleness, have scrubbed the company from their LinkedIn accounts. In the time it took to write this article, Lilleness also removed his name and picture from his LinkedIn profile. It seems like that is the most communication longtime Insteon customers are going to get.

Insteon is (or, more likely, "was") a smart home company that produced a variety of Internet-connected lights, thermostats, plugs, sensors, and of course, the Insteon Hub. At the core of the company was Insteon's proprietary networking protocol, which was a competitor to more popular and licensable alternatives like Z-Wave and Zigbee. Insteon's "unique and patented dual-mesh technology" used both a 900 MHz wireless protocol and powerline networking, which the company said created a more reliable network than wireless alone. The Insteon Hub would bridge all your gear to the Internet and enable use of the Insteon app.

Lenovo has released security updates for more than 100 laptop models to fix critical vulnerabilities that make it possible for advanced hackers to surreptitiously install malicious firmware that can be next to impossible to remove or, in some cases, to detect. Ars Technica reports: Three vulnerabilities affecting more than 1 million laptops can give hackers the ability to modify a computer's UEFI. Short for Unified Extensible Firmware Interface, the UEFI is the software that bridges a computer's device firmware with its operating system. As the first piece of software to run when virtually any modern machine is turned on, it's the initial link in the security chain. Because the UEFI resides in a flash chip on the motherboard, infections are difficult to detect and even harder to remove.

Two of the vulnerabilities -- tracked as CVE-2021-3971 and CVE-2021-3972 -- reside in UEFI firmware drivers intended for use only during the manufacturing process of Lenovo consumer notebooks. Lenovo engineers inadvertently included the drivers in the production BIOS images without being properly deactivated. Hackers can exploit these buggy drivers to disable protections, including UEFI secure boot, BIOS control register bits, and protected range register, which are baked into the serial peripheral interface (SPI) and designed to prevent unauthorized changes to the firmware it runs. After discovering and analyzing the vulnerabilities, researchers from security firm ESET found a third vulnerability, CVE-2021-3970. It allows hackers to run malicious firmware when a machine is put into system management mode, a high-privilege operating mode typically used by hardware manufacturers for low-level system management. "All three of the Lenovo vulnerabilities discovered by ESET require local access, meaning that the attacker must already have control over the vulnerable machine with unfettered privileges," notes Ars Technica's Dan Goodin. "The bar for that kind of access is high and would likely require exploiting one or more critical other vulnerabilities elsewhere that would already put a user at considerable risk."

Still, it's worth looking to see if you have an affected model and, if so, patch your computer as soon as possible.

Bosses are hellbent on getting their staff back into the office. It's just that the rules don't necessarily apply to them. Bloomberg reports: While 35% of non-executive employees are in the office five days a week, only 19% of executives can say the same thing, according to a survey conducted by Future Forum, a research consortium supported by the Slack messaging channel. Of the percentage of employees who move to work, more than half say they would like to have at least some flexibility, and non-executive workers generally say that work-life balance is much worse than that of their bosses. Moreover, the disparity is increasing. In the fourth quarter of 2021, non-executive employees were approximately 1.3 times more likely than their bosses to be completely in the office. Now, the probability is almost twice as high, and the proportion of non-executives working from the office five days a week is the highest since the survey began in June 2020, according to the more than 10,000 administrative workers surveyed in the United States, Australia and France, Germany, Japan and the United Kingdom.

The gap points to a double standard in back-to-office messaging: executives, from Bank of America Corp. to Alphabet Inc.'s Google, urge their workers to return in part to increase face-to-face collaboration, but the bosses themselves are somewhat exempt. Companies are also trying to justify long-term office leases or state-of-the-art locations like Apple Park in Cupertino, California. [...] As the back-to-office policy debate evolves, Future Forum recommends flexible schedules and location to retain top talent, even if it means breaking cultural traditions and developing new workflows. "People being in the office gives the illusion of control, but it's just an illusion," [Brian Elliott, executive director of Future Forum] said. "It doesn't mean they're being productive."

Former eBay security director Jim Baugh will plead guilty to running a bizarre 2019 cyberstalking campaign against a couple who ran a website critical of the company, Bloomberg reported Tuesday, citing a person familiar with the matter. From a report: Baugh had been scheduled to face trial in late May. In a court filing on Tuesday, his defense attorney, William Fick, asked a federal judge in Boston to allow Baugh to change his plea via videoconference. Five other former eBay employees have already admitted to roles in a cross-country campaign designed to intimidate Ina and David Steiner of Natick, Mass. Several were expected to testify against Baugh. Another eBay employee, former global resiliency director David Harville is scheduled to face trial in May. Ina Steiner's reporting about eBay on the couple's site eCommerce Bytes upset the company's then-Chief Executive Officer Devin Wenig, whose compensation package she revealed. "Take her down," Wenig texted his then-communications chief Steve Wymer, according to prosecutors.

An anonymous reader shares a report: Users of privacy-focused search engine DuckDuckGo have been unable to site search the domains of some well-known pirated media sites recently, as reported by TorrentFreak on Friday. This follows a News Punch article last month calling out DuckDuckGo for "purging" independent media sources from search results, and naming them "Google Lite." DuckDuckGo's CEO Gabriel Weinberg called the News Punch piece "completely made up" in a Twitter thread over the weekend to respond to the public and address both issues.

To observers, it seemed as if DuckDuckGo had de-indexed searches for copyright-flouting media download sites like The Pirate Bay and Fmovies, and even a site search for the open-source tool youtube-dl came up empty. TorrentFreak later updated its report citing a company spokesperson blaming the issue on Bing search data, which DuckDuckGo relies upon. Weinberg insisted the company is not purging any results and said that site search results are not appearing due to the site operator error "Anyone can verify this by searching for an outlet and see it come up in results," Weinberg tweeted.

Many users have started to report that they are seeing suggestions -- such as grammar and spelling fixes -- to improve their writing when using Google Docs. The company made the announcement about this earlier this month. From a report: A purple squiggly line will appear under suggestions to help make your writing more concise, inclusive, active, or to warn you away from inappropriate words. These new Google suggestions have long been available via third-party services like Grammarly, which is able to integrate with Google Docs and aims to help improve the quality of your writing. Depending on the quality of Google's native suggestions, it could vastly reduce the need for these third-party services. Does it count as "sherlocking" when someone other than Apple does it? The catch is that Google isn't rolling out these assistive writing features to all of its Workspace plans. It says the "Tone and Style" suggestions will be available for "Business Standard, Business Plus, Enterprise Standard, Enterprise Plus, [and] Education Plus" subscribers.

Researchers in Beijing have set a new quantum secure direct communication (QSDC) world record of 102.2 km (64 miles), smashing the previous mark of 18 km (11 miles), The Eurasian Times reported. Engadget reports: Transmission speeds were extremely slow at 0.54 bits per second, but still good enough for text message and phone call encryption over a distance of 30 km (19 miles), wrote research lead Long Guilu in Nature. The work could eventually lead to hack-proof communication, as any eavesdropping attempt on a quantum line can be instantly detected. QSDC uses the principal of entanglement to secure networks. Quantum physics dictates that entangled particles are linked, so that if you change the property of one by measuring it, the other will instantly change, too -- effectively making hacking impossible. In theory, the particles stay linked even if they're light-years apart, so such systems should work over great distances.

The same research team set the previous fiber record, and devised a "novel design of physical system with a new protocol" to achieve the longer distance. They simplified it by eliminating the "complicated active compensation subsystem" used in the previous model. "This enables an ultra-low quantum bit error rate (QBER) and the long-term stability against environmental noises." As a result, the system can withstand much more so-called channel loss that makes it impossible to decode encrypted messages. That in turn allowed them to extend the fiber from 28.3km to the record 102.2 km distance. "The experiment shows that intercity quantum secure direct communication through the fiber is feasible with present-day technology," the team wrote in Nature.