An anonymous reader shares a report: Hackers associated with the hacktivist collective Anonymous say they have leaked gigabytes of data from Epik, a web host and domain registrar that provides services to far-right sites like Gab, Parler and 8chan, which found refuge in Epik after they were booted from mainstream platforms. In a statement attached to a torrent file of the dumped data this week, the group said the 180 gigabytes amounts to a "decade's worth" of company data, including "all that's needed to trace actual ownership and management" of the company. The group claimed to have customer payment histories, domain purchases and transfers, and passwords, credentials and employee mailboxes. The cache of stolen data also contains files from the company's internal web servers, and databases that contain customer records for domains that are registered with Epik.

The hackers did not say how they obtained the breached data or when the hack took place, but timestamps on the most recent files suggest the hack likely happened in late February. Epik initially told reporters it was unaware of a breach, but an email sent out by founder and chief executive Robert Monster on Wednesday alerted users to an "alleged security incident." TechCrunch has since learned that Epik was warned of a critical security flaw weeks before its breach. Security researcher Corben Leo contacted Epik's chief executive Monster over LinkedIn in January about a security vulnerability on the web host's website. Leo asked if the company had a bug bounty or a way to report the vulnerability. LinkedIn showed Monster had read the message but did not respond.

An American cybersecurity company was behind a 2016 iPhone hack sold to a group of mercenaries and used by the United Arab Emirates. From a report: When the United Arab Emirates paid over $1.3 million for a powerful and stealthy iPhone hacking tool in 2016, the monarchy's spies -- and the American mercenary hackers they hired -- put it to immediate use. The tool exploited a flaw in Apple's iMessage app to enable hackers to completely take over a victim's iPhone. It was used against hundreds of targets in a vast campaign of surveillance and espionage whose victims included geopolitical rivals, dissidents, and human rights activists.

Documents filed by the US Justice Department on Tuesday detail how the sale was facilitated by a group of American mercenaries working for Abu Dhabi, without legal permission from Washington to do so. But the case documents do not reveal who sold the powerful iPhone exploit to the Emiratis. Two sources with knowledge of the matter have confirmed to MIT Technology Review that the exploit was developed and sold by an American firm named Accuvant. It merged several years ago with another security firm, and what remains is now part of a larger company called Optiv. News of the sale sheds new light on the exploit industry as well as the role played by American companies and mercenaries in the proliferation of powerful hacking capabilities around the world.

An anonymous reader quotes a report from InterestingEngineering: As global carbon emissions that stem from fossil fuels keep adding to our ever-growing climate change issue, energy companies have turned their focus on renewables to generate fuel. One of those companies is Synhelion from Switzerland. The company harnesses the energy of the heat of the sun and converts the collected carbon dioxide into synthetic fuels, in turn offering a green and sustainable solution. The system is quite genius. Synhelion uses a mirror field filled with heliostats to reflect the radiation of solar power. The radiation is then concentrated in the solar receiver and turned into clean, high-temperature process heat at around 2.732F (1.500C). Next, the produced heat is turned into a CO2 and H2O mixture in a thermochemical reactor. The end product, the syngas, is then turned into gasoline, diesel, or jet fuel with a gas-to-liquid technology process. What makes this sustainable is the fact that the company's thermal energy storage (TES) saves the excess heat after each process which keeps the operation going 24/7.

And how does the solar receiver work? The company says the technology is inspired by nature. To reach ultra-high temperatures, the solar receiver mimics Earth's greenhouse gas effect. The chamber is filled with greenhouse gases that are usually water vapor or water and CO2 mixtures. After solar radiation collected with heliostats enters the chamber, the black surface of the chamber absorbs the heat, thermalizes, and re-radiates it. The greenhouse gas then absorbs the thermal radiation, acting as a heat transfer fluid (HTF), which can, later on, be turned into any type of liquid fuel. And liquid fuels are easy to transport which makes them low-cost compared to their solid counterparts. When there's no sun, the HTF flows through the TES in the opposite direction to recover the previously stored thermal energy. The hot HTF from the storage drives the thermochemical processes in the reactor that keeps the operation working. "The company states that through this technology, it can provide fuels at a cheaper price with a 50 to 100 percent lower carbon footprint compared to fossil fuels," the report adds. "In addition to Synhelion's aligned motives with the Paris Agreement's CO2 reduction targets, it is supported by larger industries looking to cut their emissions -- and eventually achieve net-zero -- by 2030."

A free master decryptor for the REvil ransomware operation has been released, allowing all victims encrypted before the gang disappeared to recover their files for free. BleepingComputer reports: The REvil master decryptor was created by cybersecurity firm Bitdefender in collaboration with a trusted law enforcement partner. While Bitdefender could not share details about how they obtained the master decryption key or the law enforcement agency involved, they told BleepingComputer that it works for all REvil victims encrypted before July 13th. "As per our blog post, we received the keys from a trusted law enforcement partner, and unfortunately, this is the only information we are at liberty to disclose right now," Bitdefender's Bogdan Botezatu, Director of Threat Research and Reporting, told BleepingComputer. "Once the investigation progresses and will come to an end, further details will be offered upon approval." REvil ransomware victims can download the master decryptor from Bitdefender (instructions) and decrypt entire computers at once or specify specific folders to decrypt.

Microsoft's new, flat-price version of its Office productivity software will arrive on Oct. 5 -- the same day Windows 11 begins rolling out, according to a company blog post Thursday. From a report: Microsoft previously emphasized that while its main focus remains in its subscription offering, Microsoft 365, it will release the one-time purchase Office 2021 for those who aren't ready to move to the cloud. Office 2021 arrives in two versions: one for commercial users, called Office LTSC (which stands for Long Term Servicing Channel), and one for personal use. Office LTSC is generally available today, the post said, and includes enhanced accessibility features, performance improvements across Word, Excel and PowerPoint, and visual improvements, like dark mode support across apps. It's meant for specialty situations, as opposed to for an entire organization, such as process control devices on the manufacturing floor that are not connected to the internet. Meanwhile, Office 2021 for personal use will arrive on Oct. 5, though Microsoft has not yet announced pricing information.

An anonymous reader shares a report: In January, Google's parent company, Alphabet, shut down Project Loon, an initiative exploring using stratospheric helium balloons to distribute wireless internet (an attempt to use solar-powered drones folded in 2017). However, some technology developed as a part of the Loon project remained in development, specifically the Free Space Optical Communications (FSOC) links that were originally meant to connect the high flying balloons -- and now that technology is actively in use providing a high-speed broadband link for people in Africa.

Sort of like fiber optic cables without the cable, FSOC can create a 20Gbps+ broadband link from two points that have a clear line of sight, and Alphabet's moonshot lab X has built up Project Taara to give it a shot. They started by setting up links in India a few years ago as well as a few pilots in Kenya, and today X revealed what it has achieved by using its wireless optical link to connect service across the Congo River from Brazzaville in the Republic of Congo and Kinshasa in the Democratic Republic of Congo. In 20 days, Project Taara lead Baris Erkmen says the link transmitted nearly 700TB of data, augmenting fiber connections used by local telecom partner Econet and its subsidiaries.

The justice ministry of the South African government is working on restoring its operations after a recent ransomware attack encrypted all its systems, making all electronic services unavailable both internally and to the public. As a consequence of the attack, the Department of Justice and Constitutional Development said that child maintenance payments are now on hold until systems are back online. BleepingComputer reports: The incident happened on September 6 and the department activated the contingency plan for such events to ensure the continuation of some activity in the country. Last week, [Steve Mahlangu, spokesperson for the Department of Justice and Constitutional Development] said that court sittings continued after a switch into manual mode for recording the hearings. A manual process has also been adopted for issuing various legal documents. However, the ransomware attack impacted monthly child maintenance payments, which have been delayed until the systems are restored.

The department is still in the process of returning to regular operations but it is cannot say when the activity will become normal again. Part of this effort was setting up a new email system, to which some staff has already migrated. Coupled with the long time needed for network restoration, this is a sign that the hackers did not get paid. It is unclear who is behind this attack. Many ransomware gangs also steal data before encrypting it, to force the victim into paying the ransom under the pressure of a public leak. Mahlangu said last week that the Department's IT experts have found "no indication of data compromise." Until now, the attack has not been claimed by any of the gangs with a data leak site.

An anonymous reader quotes a report from Ars Technica: Travis CI is a popular software-testing tool due to its seamless integration with GitHub and Bitbucket. As the makers of the tool explain: "When you run a build, Travis CI clones your GitHub repository into a brand-new virtual environment and carries out a series of tasks to build and test your code. If one or more of those tasks fail, the build is considered broken. If none of the tasks fail, the build is considered passed and Travis CI can deploy your code to a web server or application host." But this month, researcher Felix Lange found a security vulnerability that caused Travis CI to include secure environment variables of all public open source repositories that use Travis CI into pull request builds. Environment variables can include sensitive secrets like signing keys, access credentials, and API tokens. If these variables are exposed, attackers can abuse the secrets to obtain lateral movement into the networks of thousands of organizations.

Tracked as CVE-2021-41077, the bug is present in Travis CI's activation process and impacts certain builds created between September 3 and September 10. As a part of this activation process, developers are supposed to add a ".travis.yml" file to their open source project repository. This file tells Travis CI what to do and may contain encrypted secrets. Another place encrypted secrets may be defined is Travis' web UI. But, these secrets are not meant to be exposed. In fact, Travis CI's docs have always stated, "Encrypted environment variables are not available to pull requests from forks due to the security risk of exposing such information to unknown code." Ideally, Travis is expected to run in a manner that prevents public access to any secret environment variables specified. [...] This vulnerability caused these sorts of secrets to be unexpectedly exposed to just about anyone forking a public repository and printing files during a build process. Fortunately, the issue didn't last too long -- around eight days, thanks to Lange and other researchers who notified the company of the bug on September 7. But out of caution, all projects relying on Travis CI are advised to rotate their secrets.

The presence and relatively quick patching of the flaw aside, Travis CI's concise security bulletin and overall handling of the coordinated disclosure process has infuriated the developer community. In a long Twitter thread, Peter Szilagyi details the arduous process that his group endured as it waited for Travis CI to take action and release a brief security bulletin on an obscure webpage. "After 3 days of pressure from multiple projects, [Travis CI] silently patched the issue on the 10th. No analysis, no security report, no post mortem, not warning any of their users that their secrets might have been stolen," tweeted Szilagyi. After Szilagyi and Lange asked GitHub to ban Travis CI over its poor security posture and vulnerability disclosure processes, an advisory showed up. "Finally, after multiple ultimatums from multiple projects, [they] posted this lame-ass post hidden deep where nobody will read it... Not even a single 'thank you.' [No] acknowledgment of responsible disclosure. Not even admitting the gravity of it all," said Szilagyi, while referring to the security bulletin -- and especially its abridged version, which included barely any details. Szilagyi was joined by several members of the community in criticizing the bulletin. Boston-based web developer Jake Jarvis called the disclosure an "insanely embarrassing 'security bulletin.'" "Travis CI implemented a series of security patches starting on Sept 3rd that resolves this issue," concluded Mendy on behalf of the Travis CI team. "As a reminder, cycling your secrets is something that all users should do on a regular basis. If you are unsure how to do this, please contact Support."

An anonymous reader quotes a report from Motherboard: ExpressVPN, a popular VPN company, said it was aware of the "key facts" of its chief information officer Daniel Gericke's previous employment before hiring him. On Wednesday, the Department of Justice disclosed in court records that Gericke worked on Project Raven, a surveillance operation for the United Arab Emirates government that involved hacking of Americans, activists, and heads of state. "We've known the key facts relating to Daniel's employment history since before we hired him, as he disclosed them proactively and transparently with us from the start. In fact, it was his history and expertise that made him an invaluable hire for our mission to protect users' privacy and security," ExpressVPN told Motherboard in a statement. "Daniel has a deep understanding of the tools and techniques used by the adversaries we aim to protect users against, and as such is a uniquely qualified expert to advise on defense against such threats. Our product and infrastructure have already benefited from that understanding in better securing user data," the statement continued.

On Tuesday, unsealed court filings described how Gericke as well as Marc Baier and Ryan Adams faced charges for their part in working on Project Raven. The court records say that the three violated the International Traffic in Arms Regulations and conspired to commit access device fraud and computer hacking offenses. The court records say that the three took a zero-click exploit, which allows takeover of a device without any user interaction, and implemented that into Karma, the hacking system used by the UAE's Project Raven. Project Raven involved the hiring of former U.S. intelligence hackers who then worked on behalf of the UAE government, Reuters reported in 2019. The court records also describe other uses and purchases of exploits by the group. The court filings detailed that prosecutors will drop the charges if the three men cooperate with U.S. authorities, pay a financial penalty, and agree to a list of unspecified restrictions on their employment. Earlier this week, ExpressVPN was sold to Kape Technologies in a deal worth $936 million.

Emergency software patches, in which users are pushed to immediately update phones and computers because hackers have figured out some novel way to break in, are becoming more common. From a report: Researchers raised the alarm Monday about a big one: The Israeli spyware company NSO Group, which sells programs for governments to remotely take over people's smartphones and computers, had figured out a new way into practically any Apple device by sending a fake GIF through iMessage. The only way to guard against it is to install Apple's emergency software update. Such emergency vulnerabilities are called "zero days" -- a reference to the fact that they're such an urgent vulnerability in a program that software engineers have zero days to write a patch for it. Against a hacker with the right zero day, there is nothing consumers can do other than wait for software updates or ditch devices altogether.

Once considered highly valuable cyberweapons held mostly by elite government hackers, publicly disclosed zero-day exploits are on a sharp rise. Project Zero, a Google team devoted to identifying and cataloging zero days, has tallied 44 this year alone where hackers had likely discovered them before researchers did. That's already a sharp rise from last year, which saw 25. The number has increased every year since 2018. Katie Moussouris, founder and CEO of Luta Security, a company that connects cybersecurity researchers and companies with vulnerabilities, said that the rise in zero days is thanks to the ad hoc way that software is usually programmed, which often treats security as an afterthought. "It was absolutely inevitable," she said. "We've never addressed the root cause of all of these vulnerabilities, which is not building security in from the ground up." But almost paradoxically, the rise in zero days reflects an online world in which certain individuals are more vulnerable, but most are actually safer from hackers.

Microsoft said it has hired a former Amazon cloud executive to run its cybersecurity operations, potentially setting in motion a legal battle between the two tech giants. From a report: Charlie Bell, who long reported to former Amazon Web Services chief Andy Jassy and oversaw the engineering teams working on AWS's main software services, will become an executive vice president reporting to Microsoft Chief Executive Officer Satya Nadella. "Cybersecurity is one of the most challenging issues of our time -- for every person and organization on the planet -- and it is core to our mission," Nadella wrote in an email to employees obtained by Bloomberg. Securing customers' digital technology platforms, devices, and clouds "is a bold ambition we are going after and is what attracted Charlie to Microsoft."

[...] Bell's departure to a direct rival is a major blow for Amazon, and Microsoft said it's committed to continuing "constructive discussions" with the cloud leader about Bell's role. "We're sensitive to the importance of working through these issues together, as we've done when five recent Microsoft executives moved across town to work for Amazon," Microsoft said in a statement. Amazon, which has a history of seeking to enforce non-compete agreements vigorously, didn't immediately comment on the move. Bell will officially start his role once "a resolution is reached with his former employer," Nadella wrote in the email.

ArchieBunker writes: Members of the hacktivist collective Anonymous claim to have hacked web registration company Epik, allegedly stealing 'a decade's worth of data,' including reams of information about its clients and their domains. Epik is controversial, having been known to host a variety of rightwing clients, including ones that previous web hosting providers, like GoDaddy, have dropped for various reasons. Its users have included conservative social media networks Parler and Gab, as well as conspiracy-theory-laden YouTube wannabe Bitchute and former President Trump fansite, The Donald. The company recently hosted prolifewhistleblower.com -- the website designed to help people snitch on Texas residents who want abortions -- but later forcibly removed the tip-collecting platform after determining that it had violated Epik's terms by nonconsensually collecting third-party information.

Anyone with a Microsoft account can now remove their password from the account entirely to enable better security. From a report: "For the past couple of years we've been saying that the future is passwordless, and today I am excited to announce the next step in that vision," Microsoft corporate vice president Vasu Jakkal writes in the announcement post. "Beginning today, you can now completely remove the password from your Microsoft account." As for the "why" of this change, Microsoft points to the fact that passwords are insecure and are the focus of over 18 billion attacks every year, or 579 attacks every second. Before you can go passwordless, you'll need the Microsoft Authenticator app on your smartphone. Then, you can use Windows Hello, a security key, or a verification code that's sent to an email address, your phone, or a compatible app or service like Outlook, OneDrive, Microsoft Family Safety, and more to sign-in, depending on the location.

The Securities and Exchange Commission announced Tuesday that it's charging App Annie, the mobile app data provider, with securities fraud, accusing the company of "engaging in deceptive practices" and misrepresenting the origins of its data. From a report: App Annie will pay a $10 million settlement, according to the announcement, although the company has not admitted to any of the SEC's findings. According to the SEC, the company, which sells estimates on app downloads, usage and revenue, assured app businesses that the performance data they shared with App Annie would only be used in an anonymized way and run through an algorithm to generate performance estimates. But the SEC accuses App Annie and its former CEO and Chairman Bertrand Schmitt of reneging on that promise and using actual performance data to tweak its estimate models between 2014 and 2018. Then, the SEC alleges, the company sold that confidential data to trading firms, and misled those customers into thinking that the data was compliant with federal securities laws.

An anonymous reader writes: Facebook unveiled a new compression technique they call 'Superpack compression.' In a blog post written by software engineer Sapan Bhatia, they claim that their compression improves Android app size by 20% over the default Zip compression used by Android. The post gives an overview of the compression ideas. The basis of these ideas is called out to be a key insight in Kolmogorov Complexity, that any data can be represented in the form of programs that generate that data. Facebook's tool, Superpack, mines out such small programs and optimizes them using compiler techniques.

IT executives see the talent shortage as the most significant adoption barrier to 64% of emerging technologies, according to a new Gartner survey. From a report: Across compute infrastructure and platform services, network, security, digital workplace, IT automation, and storage and database, respondents cited a lack of qualified candidates as a leading factor impeding tech deployment at their companies. "The ongoing push toward remote work and the acceleration of hiring plans in 2021 has exacerbated IT talent scarcity, especially for sourcing skills that enable cloud and edge, automation, and continuous delivery," Gartner research VP Yinuo Geng said in a press release.

"As one example, of all the IT automation technologies profiled in the survey, only 20% of them have moved ahead in the adoption cycle since 2020. The issue of talent is to blame here." The talent gaps are particularly acute for IT automation and digital workplace solutions, according to the executives surveyed -- a reflection of the demand for these technologies. According to McKinsey, nearly half of executives say their embrace of automation has accelerated, while digital and technology adoption is taking place about 25 times faster than before the pandemic. For example, Brain Corp reported that the use of robots to clean retail stores in the U.S. rose 24% in Q2 2020 year-over-year, and IBM has seen a surge in new users of its AI-driven customer service platform Watson Assistant.

Apple has released security updates for a newly discovered zero-day vulnerability that affects every iPhone, iPad, Mac and Apple Watch. Citizen Lab, which discovered the vulnerability and was credited with the find, urges users to immediately update their devices. From a report: The technology giant said iOS 14.8 for iPhones and iPads, as well as new updates for Apple Watch and macOS, will fix at least one vulnerability that it said "may have been actively exploited." Citizen Lab said it has now discovered new artifacts of the ForcedEntry vulnerability, details it first revealed in August as part of an investigation into the use of a zero-day vulnerability that was used to silently hack into iPhones belonging to at least one Bahraini activist.

Last month, Citizen Lab said the zero day flaw -- named as such since it gives companies zero days to roll out a fix -- took advantage of a flaw in Apple's iMessage, which was exploited to push the Pegasus spyware, developed by Israeli firm NSO Group, to the activist's phone. Pegasus gives its government customers near-complete access to a target's device, including their personal data, photos, messages and location.

Olympus said in a brief statement that it is "currently investigating a potential cybersecurity incident" affecting its European, Middle East and Africa computer network. From a report: "Upon detection of suspicious activity, we immediately mobilized a specialized response team including forensics experts, and we are currently working with the highest priority to resolve this issue. As part of the investigation, we have suspended data transfers in the affected systems and have informed the relevant external partners," the statement said. But according to a person with knowledge of the incident, Olympus is recovering from a ransomware attack that began in the early morning of September 8. The person shared details of the incident prior to Olympus acknowledging the incident on Saturday. A ransom note left behind on infected computers claimed to be from the BlackMatter ransomware group.

"Your network is encrypted, and not currently operational," it reads. "If you pay, we will provide you the programs for decryption." The ransom note also included a web address to a site accessible only through the Tor Browser that's known to be used by BlackMatter to communicate with its victims. Brett Callow, a ransomware expert and threat analyst at Emsisoft, told TechCrunch that the site in the ransom note is associated with the BlackMatter group.

Mozilla has quietly made it easier to switch to Firefox on Windows recently. From a reporrt: While Microsoft offers a method to switch default browsers on Windows 10, it's more cumbersome than the simple one-click process to switch to Edge. This one-click process isn't officially available for anyone other than Microsoft, and Mozilla appears to have grown tired of the situation. In version 91 of Firefox, released on August 10th, Mozilla has reverse engineered the way Microsoft sets Edge as default in Windows 10, and enabled Firefox to quickly make itself the default. Before this change, Firefox users would be sent to the Settings part of Windows 10 to then have to select Firefox as a default browser and ignore Microsoft's plea to keep Edge. Mozilla's reverse engineering means you can now set Firefox as the default from within the browser, and it does all the work in the background with no additional prompts. This circumvents Microsoft's anti-hijacking protections that the company built into Windows 10 to ensure malware couldn't hijack default apps. Microsoft tells us this is not supported in Windows.

Long-time Slashdot reader phalse phace quotes NBC News: Most don't have bank passwords. Few have credit scores yet. And still, parts of the internet are awash in the personal information of millions of schoolchildren.

The ongoing wave of ransomware attacks has cost companies and institutions billions of dollars and exposed personal information about everyone from hospital patients to police officers. It's also swept up school districts, meaning files from thousands of schools are currently visible on those hackers' sites.

NBC News collected and analyzed school files from those sites and found they're littered with personal information of children. In 2021, ransomware gangs published data from more than 1,200 American K-12 schools, according to a tally provided to NBC News by Brett Callow, a ransomware analyst at the cybersecurity company Emsisoft.

Some schools contacted about the leaks appeared unaware of the problem. And even after schools are able to resume operations following an attack, parents have little recourse when their children's information is leaked. Some of the data is personal, like medical conditions or family financial statuses. Other pieces of data, such as Social Security numbers or birthdays, are permanent indicators of who they are, and their theft can set up a child for a lifetime of potential identity theft.