Apple intends to install software on American iPhones to scan for child abuse imagery, Financial Times is reporting citing people briefed on the plans, raising alarm among security researchers who warn that it could open the door to surveillance of millions of people's personal devices. From the report: Apple detailed its proposed system -- known as "neuralMatch" -- to some US academics earlier this week, according to two security researchers briefed on the virtual meeting. The plans could be publicised more widely as soon as this week, they said. The automated system would proactively alert a team of human reviewers if it believes illegal imagery is detected, who would then contact law enforcement if the material can be verified. The scheme will initially roll out only in the US.

The proposals are Apple's attempt to find a compromise between its own promise to protect customers' privacy and ongoing demands from governments, law enforcement agencies and child safety campaigners for more assistance in criminal investigations, including terrorism and child pornography. [...] "This will break the dam -- governments will demand it from everyone," said Matthew Green, a security professor at Johns Hopkins University, who is believed to be the first researcher to post a tweet about the issue. Alec Muffett, a security researcher and privacy campaigner who formerly worked at Facebook and Deliveroo, said Apple's move was "tectonic" and a "huge and regressive step for individual privacy. Apple are walking back privacy to enable 1984," he said.

The U.S. government is enlisting the help of tech companies, including Amazon, Microsoft and Google, to bolster the country's critical infrastructure defenses against cyber threats after a string of high-profile attacks. From a report: The Department of Homeland Security, on Thursday, is formally unveiling the initiative called the Joint Cyber Defense Collaborative. The effort will initially focus on combating ransomware and cyberattacks on cloud-computing providers, said Jen Easterly, director of the DHS's Cybersecurity and Infrastructure Security Agency. Ultimately, she said, it aims to improve defense planning and information sharing between government and the private sector.

"This will uniquely bring people together in peacetime, so that we can plan for how we're going to respond in wartime," she said in an interview. Ms. Easterly was sworn in as CISA's director last month. She was previously a counterterrorism official in the Obama White House, and the commander of the Army's first cyber operations unit at the National Security Agency, America's cyberspy agency. Over the past year, ransomware attacks have disrupted large parts of daily life in the U.S. They have diverted ambulances, caused long lines at gas stations in the southeast, and disrupted the production of hot dogs and other meat products.

An anonymous reader quotes a report from Ars Technica: Cybersecurity at eight federal agencies is so poor that four of them earned grades of D, three got Cs, and only one received a B in a report issued Tuesday by a US Senate Committee. "It is clear that the data entrusted to these eight key agencies remains at risk," the 47-page report stated. "As hackers, both state-sponsored and otherwise, become increasingly sophisticated and persistent, Congress and the executive branch cannot continue to allow PII and national security secrets to remain vulnerable."

The report, issued by the Senate Committee on Homeland Security and Governmental Affairs, comes two years after a separate report found systemic failures by the same eight federal agencies in complying with federal cybersecurity standards. The earlier report (PDF) found that during the decade spanning 2008 to 2018, the agencies failed to properly protect personally identifiable information, maintain a list of all hardware and software used on agency networks, and install vendor-supplied security patches in a timely manner. The 2019 report also highlighted that the agencies were operating legacy systems that were costly to maintain and hard to secure. All eight agencies -- including the Social Security Administration and the Departments of Homeland Security, State, Transportation, Housing and Urban Development, Agriculture, Health and Human Services, and Education -- failed to protect sensitive information they stored or maintained.

Tuesday's report, titled Federal Cybersecurity: America's Data Still at Risk, analyzed security practices by the same agencies for 2020. It found that only one agency had earned a grade of B for its cybersecurity practices last year. "What this report finds is stark," the authors wrote. "Inspectors general identified many of the same issues that have plagued Federal agencies for more than a decade. Seven agencies made minimal improvements, and only DHS managed to employ an effective cybersecurity regime for 2020. As such, this report finds that these seven Federal agencies still have not met the basic cybersecurity standards necessary to protect America's sensitive data." State Department systems, the auditors found, frequently operated without the required authorizations, ran software (including Microsoft Windows) that was no longer supported, and failed to install security patches in a timely manner. The department's user management system came under particular criticism because officials couldn't provide documentation of user access agreements for 60 percent of sample employees that had access to the department's classified network. "This network contains data which if disclosed to an unauthorized person could cause 'grave damage' to national security," the auditors write. "Perhaps more troubling, State failed to shut off thousands of accounts after extended periods of inactivity on both its classified and sensitive but unclassified networks. According to the Inspector General, some accounts remained active as long as 152 days after employees quit, retired, or were fired. Former employees or hackers could use those unexpired credentials to gain access to State's sensitive and classified information, while appearing to be an authorized user. The Inspector General warned that without resolving issues in this category, 'the risk of unauthorized access is significantly increased.'"

Ars Technica adds that the Social Security Administration "suffered many of the same shortcomings, including a lack of authorization for many systems, use of unsupported systems, failure to Compile an Accurate and Comprehensive IT Asset Inventory, and Failure to Provide for the Adequate Protection of PII."

An anonymous reader shares a report: It has been over three months since Click Studios, the Australian software house behind the enterprise password manager Passwordstate, warned its customers to "commence resetting all passwords." The company was hit by a supply chain attack that sought to steal the passwords from customer servers around the world. But customers tell TechCrunch that they are still without answers about the attack. Several customers say they were met with silence from Click Studios, while others were asked to sign strict secrecy agreements when they asked for assurances about the security of the software. One IT executive whose company was compromised by the attack said they felt "abandoned" by the software maker in the wake of the attack.

Passwordstate is a standalone web server that enterprise companies can use to store and share passwords and secrets for their organizations, like keys for cloud systems and databases that store sensitive customer data, or "break glass" accounts that grant emergency access to the network. Click Studios says it has 29,000 customers using Passwordstate, including banks, universities, consultants, tech companies, defense contractors and U.S. and Australian government agencies, according to public records seen by TechCrunch.

At the Black Hat security conference Wednesday, two security researchers have disclosed a security issue impacting hosted DNS service providers that can be abused to hijack the platform's nodes, intercept some of the incoming DNS traffic, and then map customers' internal networks. From a report: Discovered by Shir Tamari and Ami Luttwak from cloud security company Wiz, the vulnerability highlights the amount of sensitive information collected by managed DNS platforms and their attractiveness from a cyber-espionage and intelligence data collection standpoint.

Also known as DNS-as-a-Service providers, these companies effectively rent DNS servers to corporate entities. While it's not hard to run your own DNS name server, the benefit of using a service like AWS Route53 or the Google Cloud Platform is that companies can offload managing DNS server infrastructure to a third-party and take advantage of better uptime and top-notch security. Companies that sign up for a managed DNS provider typically have to onboard their internal domain names with the service provider. This typically means companies have to go to a backend portal and add their company.com and other domains to one of the provider's name servers (i.e., ns-1611.awsdns-09.co.uk). Once this is done, when a company employee wants to connect to an intranet app or an internet website, their computer will query the third-party DNS server for the IP address it needs to connect. What the Wiz team discovered was that several managed DNS providers did not blacklist their own DNS servers inside their backends.

An anonymous reader shares a report: Late last year, researchers at the Los Angeles-based cybersecurity company Resecurity stumbled across a massive trove of stolen data while investigating the hack of an Italian retailer. Squirreled away on a cloud storage platform were five gigabytes of data that had been stolen during the previous three and half years from foreign ministries and energy companies by hacking their on-premises Microsoft Exchange servers. In all, Resecurity researchers found documents and emails from six foreign ministries and eight energy companies in the Middle East, Asia and Eastern Europe.

The attacks, which haven't been previously reported, served as a prequel to a remarkably similar, widely publicized hack of Microsoft Exchange servers from January to March of this year, according to Resecurity. A person familiar with the investigation into the 2021 attack, who wasn't authorized to speak publicly and requested anonymity, made a similar allegation, saying the data theft discovered by Resecurity followed the same methods. The 2021 hack was extraordinary for its scope, infecting as many as 60,000 global victims with malware. Microsoft quickly pinned the 2021 cyberattack on a group of Chinese state-sponsored hackers it named Hafnium, and the U.S., U.K., and their allies made a similar claim last month, attributing it to hackers affiliated with the Chinese government. Resecurity can't say for sure the attacks were perpetrated by the same group. Even so, the cache of documents contained information that would have been of interest to the Chinese government, according to Gene Yoo, Resecurity's chief executive officer. The person familiar said the victims selected by the hackers and type of intelligence gathered by attackers also pointed to a Chinese operation.

Microsoft launched its new cloud PC Windows 365 service earlier this week, and the company has already had to pause free trials due to demand. From a report: Windows 365 lets you rent a cloud PC -- with a variety of CPU, RAM, and storage options -- and then stream Windows 10 or Windows 11 via a web browser. The service reached max capacity after only a day of signups. "Following significant demand, we have reached capacity for Windows 365 trials," reads a statement from the Microsoft 365 Twitter account. "We have seen unbelievable response to Windows 365 and need to pause our free trial program while we provision additional capacity," explains Scott Manchester, director of Windows 365 program management.

Google Chrome will no longer show whether a site you are visiting is secure and only show when you visit an insecure website. Bleeping Computer reports: To further push web developers into only using HTTPS on their sites, Google introduced the protocol as a ranking factor. Those not hosting a secure site got a potentially minor hit in their Google search results rankings. It has appeared to have worked as according to the 'HTTPS encryption on the web' of Google's Transparency Report, over 90% of all browser connections in Google Chrome currently use an HTTPS connection.

Currently, when you visit a secure site, Google Chrome will display a little locked icon indicating that your communication with the site is encrypted, as shown below. As most website communication is now secure, Google is testing a new feature that removes the lock icon for secure sites. This feature is available to test in Chrome 93 Beta, and Chrome 94 Canary builds by enabling the 'Omnibox Updated connection security indicators' flag. With this feature enabled, Google Chrome will only display security indicators when the site is not secure. For businesses who wish to have continued HTTPS security indicators, Google has added an enterprise policy for Chrome 93 named 'LockIconInAddressBarEnabled' that can be used to enable the lock icon again on the address bar.

Three-and-half months after launching the Magic Keyboard with Touch ID, Apple is finally breaking it out from its iMac bundle. The accessory is now available as a standalone through Apple Stores and the company's site. From a report: There are two versions: the standard and a longer model with a numeric keypad (pretty much what the company offers with all of its Magic Keyboards), running $149 and $179, respectively. There's also a $99 version that keeps the new rounded, compact design, but drops the Touch ID in favor of a key that locks the system. But where's the fun in that? All of the models have keys devoted to Spotlight, Dictation, Do Not Disturb and Emoji.

Facebook is bulking up a team of artificial intelligence researchers, including a key hire from Microsoft, to study ways of analyzing encrypted data without decrypting it, the company confirmed to the Information. From the report: The research could allow Facebook to target ads based on encrypted messages on its WhatsApp messenger, or to encrypt the data it collects on billions of users without hurting its ad-targeting capabilities, outside experts say. Facebook is one of several technology giants, including cloud computing providers Microsoft, Amazon and Google, now researching an emerging field known as homomorphic encryption. Researchers hope the technology will allow companies to analyze personal information, including medical records and financial data, while keeping the information encrypted and protected from cybersecurity threats or, in Facebook's case, leaks to advertisers or other parties.

French intelligence investigators have confirmed that Pegasus spyware has been found on the phones of three journalists, including a senior member of staff at the country's international television station France 24. Pegasus is the hacking software -- or spyware -- that is developed, marketed and licensed to governments around the world by NSO Group. The malware has the capability to infect billions of phones running either iOS or Android operating systems. It enables operators of the spyware to extract messages, photos and emails, record calls and secretly activate microphones. The Guardian reports: It is the first time an independent and official authority has corroborated the findings of an international investigation by the Pegasus project -- a consortium of 17 media outlets, including the Guardian. Forbidden Stories, a Paris-based nonprofit media organization, and Amnesty International initially had access to a leaked list of 50,000 numbers that, it is believed, have been identified as those of people of interest by clients of Israeli firm NSO Group since 2016, and shared access with their media partners.

France's national agency for information systems security (Anssi) identified digital traces of NSO Group's hacking spyware on the television journalist's phone and relayed its findings to the Paris public prosecutor's office, which is overseeing the investigation into possible hacking. Anssi also found Pegasus on telephones belonging to Lenaig Bredoux, an investigative journalist at the French investigative website Mediapart, and the site's director, Edwy Plenel. Forbidden Stories believes at least 180 journalists worldwide may have been selected as people of interest in advance of possible surveillance by government clients of NSO.

Le Monde reported that the France 24 journalist, based in Paris, had been selected for "eventually putting under surveillance." Police experts discovered the spyware had been used to target the journalist's phone three times: in May 2019, September 2020 and January 2021, the paper said. Bredoux told the Guardian that investigators had found traces of Pegasus spyware on both her and Plenel's mobile phones. She said the confirmation of long-held suspicions that they had been targeted contradicted the repeated denials of those who were believed to be behind the attempt to spy on them.

An anonymous reader quotes a report from the BBC: Every jobseeker welcomes an invitation to a second interview, because it signals a company's interest. A third interview might feel even more positive, or even be the precursor to an offer. But what happens when the process drags on to a fourth, fifth or sixth round -- and it's not even clear how close you are to the 'final' interview? That's a question Mike Conley, 49, grappled with earlier this year. The software engineering manager, based in Indiana, US, had been seeking a new role after losing his job during the pandemic. Five companies told him they had to delay hiring because of Covid-19 -- but only after he'd done the final round of interviews. Another three invited him for several rounds of interviews until it was time to make an offer, at which point they decided to promote internally. Then, he made it through three rounds of interviews for a director-level position at a company he really liked, only to receive an email to co-ordinate six more rounds. "When I responded to the internal HR, I even asked, 'Are these the final rounds?,'" he says. "The answer I got back was: 'We don't know yet.'"

That's when Conley made the tough decision to pull out. He shared his experience in a LinkedIn post that's touched a nerve with fellow job-seekers, who've viewed it 2.6 million times as of this writing. Conley says he's received about 4,000 public comments of support, and "four times that in private comments" from those who feared being tracked by current or prospective employers. [...] In fact, the internet is awash with similar stories jobseekers who've become frustrated with companies -- particularly in the tech, finance and energy sectors -- turning the interview process into a marathon. That poses the question: how many rounds of interviews should it take for an employer to reasonably assess a candidate before the process veers into excess? And how long should candidates stick it out if there's no clear information on exactly how many hoops they'll have to jump through to stay in the running for a role? Google recently determined that four interviews was enough to make a hiring decision with 86% confidence, noting that there was a diminishing return on interviewer feedback thereafter.

"John Sullivan, a Silicon Valley-based HR thought leader, says companies should nail down a hire-by date from the start of the recruitment process, because the best candidates only transition the job market briefly," reports the BBC. "According to a survey from global staffing firm Robert Half, 62% of US professionals say they lose interest in a job if they don't hear back from the employer within two weeks -- or 10 business days -- after the initial interview. That number jumps to 77% if there is no status update within three weeks. "

Hackers have attacked and shut down the IT systems of the company that manages COVID-19 vaccination appointments for the Lazio region surrounding Rome, the regional government said on Sunday. From a report: "A powerful hacker attack on the region's CED (database) is under way," the region said in a Facebook posting. It said all systems had been deactivated, including those of the region's health portal and vaccination network, and warned the inoculation programme could suffer a delay. "It is a very powerful hacker attack, very serious... everything is out. The whole regional CED is under attack," Lazio region's health manager Alessio D'Amato said.

An anonymous reader shares a report: When three Chinese nationals were jailed in Beijing almost a decade ago and accused of selling fake Hewlett-Packard networking gear, it looked like an example of U.S. companies getting what they'd long demanded: aggressive protection of intellectual property in the world's most populous nation. A drawn-out court case heading to trial in Massachusetts paints a much muddier picture. The three, exonerated in China, accuse the former Silicon Valley icon of setting them up. They argue that it was H-P units that conspired to sell counterfeit gear, and then pinned the blame on them. H-P disputes the claims, and is asking a U.S. federal judge to dismiss the lawsuit, saying the story was concocted by Integrated Communications & Technologies Inc., the Massachusetts-based company that employed the three Chinese nationals, to cover up its own criminal behavior. U.S. District Judge Leo T. Sorokin may rule on the dismissal request at any time. If he lets the case continue, a trial is scheduled for February.

Western companies have been calling on China for years to combat counterfeiting and take action against those that steal their intellectual property. One of the triggers for former U.S. President Donald Trump's trade war was the technology industry's lobbying of the American government to help protect their IP. A loss for either side in the lawsuit would tarnish its reputation in the world's largest market for computers by marking them as an organization that fraudulently sold counterfeit goods. The Office of the U.S. Trade Representative identified China as the "primary source" of counterfeit goods in a 2020 report. With Hong Kong, the document details, China accounts for 92% of the value of fake goods seized by U.S. Customs and Border Protection in 2019. In this case, the networking gear was made by an affiliate of H-P's in China, exported to India on lease, then sold back into the Chinese market.

The hackers who breached Electronic Arts last month have released the entire cache of stolen data after failing to extort the company and later sell the stolen files to a third-party buyer. From a report: The data, dumped on an underground cybercrime forum on Monday, July 26, is now being widely distributed on torrent sites. According to a copy of the dump obtained by The Record, the leaked files contain the source code of the FIFA 21 soccer game, including tools to support the company's server-side services. The existence of this leak was initially disclosed on June 10, when the hackers posted a thread on an underground hacking forum claiming to be in possession of EA data, which they were willing to sell for $28 million.

A new $500 million startup is now offering high-end apartments for short- and long-term rentals in America's "most vibrant, walkable neighborhoods". (And long-term renters can also avail themselves of its "turn-key homesharing program" to offset some of their rent.)

The Seattle Post-Intelligencer says it's "aimed mainly at tech workers, nomadic independent contractors and other folks whose work is no longer tied to a specific location." [A]menities might include workspaces offering private and collaborative office space. Inside the units themselves, residents might find work-from-home perks like adjustable height desks and ergonomic chairs. And let's not forget that work-life balance: Sentral buildings offer rooftop pools, outdoor kitchens and fire pits, gyms, photo booths, theaters, and more — as well as offering a plethora of curated events to its residents...

The folks behind the idea are savvy: CEO Jon Slavet is formerly of WeWork and Rodan + Fields. Michael Curtis, formerly VP of Engineering at Airbnb is now a strategy advisor at Sentral...

The price to lease at Sentral, given the amenities, isn't much higher than regular rent prices in the major cities it serves. The LIVE program offers designer-furnished homes for stays over 30 days starting at $2,500 a month. For comparison purposes, a studio in downtown Seattle listed on Craigslist (with none of the bling offered at Sentral) is asking $1,890 a month.

Sentral operates now in seven cities: LA, Austin, Chicago, Seattle, Denver, Chicago, Miami. An Atlanta location is next up, with more growth planned.
Sentral's press release calls them seven "vibrant gateway cities... a launchpad to explore the country's most exciting neighborhoods" (assisted by "a world-class onsite team that fosters a true sense of community"). Sentral enables residents to live or visit stylish buildings in the nation's most coveted cities for any period of time, whether a night, a month, or multiple years. Qualifying residents can also monetize their homes through Sentral's managed homeshare program... From the city registration process to logistical details such as housekeeping, insurance, photography, contactless check-in, and around-the-clock service, Sentral's turn-key platform makes homesharing seamless for hosts, enhancing their financial freedom and fueling their ability to travel and explore.
A recent tweet calls it "the future of living," while the company's new web site promises it offers "The comforts you crave + the freedom to travel."

"There has been a massive shift to a 'work-from-anywhere' culture that is blurring the lines among home, work, and travel," argues CEO Jon Slavet in Sentral's press release. And the lavish press release ends by saying that the company "is creating a global community of modern adventurers with the freedom to monetize their homes, explore their passion for travel, and live life on their own terms."

Slashdot reader storagedude quotes eSecurityPlanet : The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) joined counterparts in the UK and Australia Wednesday to announce the top 30 vulnerabilities exploited since the start of the pandemic.

The list, a joint effort with the Australian Cyber Security Centre (ACSC) and the UK's National Cyber Security Centre (NCSC), details vulnerabilities — primarily Common Vulnerabilities and Exposures (CVEs) — "routinely exploited by malicious cyber actors in 2020 and those being widely exploited thus far in 2021."

Many of the vulnerabilities are known ones for which patches exist, so they can typically be easily fixed. The agencies also recommended a centralized patch management system to prevent such oversights going forward.

Most of the vulnerabilities targeted in 2020 were disclosed during the last two years. "Cyber actor exploitation of more recently disclosed software flaws in 2020 probably stems, in part, from the expansion of remote work options amid the COVID-19 pandemic," said a CISA statement. "The rapid shift and increased use of remote work options, such as virtual private networks (VPNs) and cloud-based environments, likely placed additional burden on cyber defenders struggling to maintain and keep pace with routine software patching."

The vulnerabilities include a number of well publicized ones from major vendors like Citrix, Microsoft, Fortinet, VMware and others, so a good portion of the blame can be placed on those who just aren't being vigilant with patching.

Remote working seems like a boon to smaller cities, Reuters reports: About 30 per cent of remote workers plan on moving, according to two recent surveys: an April poll of 1,000 tech workers by nonprofit One America Works and a June survey of 1,006 national remote workers for MakeMyMove, focused on intentions for the next 18 months... [T]he numbers mean a lot for some towns and cities that have seen "brain drains" to larger metropolitan areas, said Prithwiraj Choudhury, associate professor at the Harvard Business School.
But smaller cities are now also competing with big-tech recruiters, reports the Wall Street Journal: Some of the biggest names in tech aren't just allowing existing workers to relocate out of the Bay Area, they are also starting to hire in places they hadn't often recruited from before. The result is the most geographically distributed tech labor market to date. That's leading to above-market rates for workers in smaller hubs, forcing local companies to raise wages to keep up with the cost of living and fend off deeper-pocketed rivals from California.

Tribune News Services says we're now experiencing the "hottest job market for tech workers since dot-com era" There's an air of desperation among tech employers this summer. Software talent, it seems, is in such high demand that companies are morphing how they hire. And workers are the ones with the power. Good and experienced tech workers are being treated like local celebrities — hounded by recruiters, courted by managers and bestowed a bevy of options before choosing their next boss...

The demand has been attributed to all sorts of things. During the pandemic, businesses that had been slow to adopt enterprise software began rapidly catching up. A tidal wave of productivity software, conferencing and collaboration tools, and e-commerce tech flooded the world. The same was true for consumer tech, with video game development, entertainment tech and social platforms booming. Many of these jobs are going unfilled, as competition for new hires ramps up. Simultaneously, remote work became the status quo in the tech industry. Suddenly, software talent could pick and choose from a massive pool of job opportunities...

To win a bid on a quality engineer, companies are offering things like flexible hours, sign-on bonuses and permanent remote work, the last of which has become a requirement for much of the workforce. Dice, a website and staffing firm that focuses on tech talent, published a report in June that found only 17% of technologists wanted to work in an office full time, while 59% wanted remote and hybrid approaches.

An anonymous reader quotes The Record: A Chinese cyber-espionage group known as APT31 (or Zirconium) has been seen hijacking home routers to form a proxy mesh around its server infrastructure in order to relay and disguise the origins of their attacks.

In a security alert, the French National Cybersecurity Agency, also known as ANSSI (Agence Nationale de la Sécurité des Systèmes d'Information), published a list of 161 IP addresses that have been hijacked by APT31 in recent attacks against French organizations. French officials said that APT31's proxy botnet was used to perform both reconnaissance operations against their targets, but also to carry out the attacks themselves. The attacks started at the beginning of 2021 and are still ongoing...

The Record understands that APT31 used proxy meshes made of home routers as a way to scan the internet and then launch and disguise its attacks against Exchange email servers earlier this year; however, the technique was also used for other operations as well.