9to5Mac writes: Amid pushback regarding Apple's plans to return to in-person work this fall, Mark Gurman at Bloomberg reports that Apple is "ramping up efforts to decentralize out of Silicon Valley." In the latest edition of his Power On newsletter, Gurman reports that Apple has faced a variety of problems recruiting and retaining talent because of its emphasis on Silicon Valley.

Gurman writes that Apple has been "losing talent" because of the high-cost of living in the San Francisco Bay Area. "Many engineers lamented that they couldn't balance living expenses with other pursuits like college tuition for their children and long-term savings," Gurman says.

Furthermore, Apple has struggled to diversify its workforce because of its focus on Silicon Valley. It also competes with a variety of companies for talent, including Amazon, Google, and Netflix. The cost of operations is also high, and Gurman writes that "Apple could get the same work out of employees demanding far lower salaries in less pricey regions." For these reasons, Apple is reportedly looking to decentralize out of Silicon Valley.
From Bloomberg's report: Decentralization across the company is entering full swing, and Apple has engaged in a costly expansion from the sunny coasts of LA and San Diego to the Pacific Northwest of Oregon and Washington, the Rocky Mountains of Colorado, Iowa's Midwest, the Eastern Seaboard of Massachusetts, Miami and New York. Notably, it's also spending $2 billion on building new campuses in Austin, Texas, and North Carolina. That's in addition to hiring engineers in Canada, Germany, New Zealand, Spain and the U.K. Altogether, the moves will add tens of thousands of jobs outside of Silicon Valley.

As it keeps moving beyond Silicon Valley, Apple will pilot a hybrid office and remote work arrangement globally when it forces nearly all staff back to its offices in September.

A massive REvil ransomware attack affects multiple managed service providers and their clients through a reported Kaseya supply-chain attack. Bleeping Computer reports: Starting this afternoon, the REvil ransomware gang targeted approximately eight large MSPs, with thousands of customers, through what appears to be a Kaseya VSA supply-chain attack. Kaseya VSA is a cloud-based MSP platform that allows providers to perform patch management and client monitoring for their customers. Huntress Labs' John Hammond has told BleepingComputer that all of the affected MSPs are using Kaseya VSA and that they have proof that their customers are being encrypted as well. "We have 3 Huntress partners that are impacted with roughly 200 businesses encrypted," Hammond told BleepingComputer. Kasey issued an security advisory on their help desk site warniong all VSA customers to immediately shut down their VSA server to prevent the attack's spread while they investigate. In a statement to BleepingComputer, Kaseya stated that they have shut down their SaaS servers and are working with other securty firms to investigate the incident.

A sample of the REvil ransomware used in one of these attacks has been shared with BleepingComputer. However, it is unknown if this is the sample used for every victim or if each MSP received its own ransom demand. The ransomware gang is demanding a $5,000,000 ransom to receive a decryptor from one of the samples. While REvil is known to steal data before deploying the ransomware and encrypting devices, it is unknown if the attackers exfiltrated any files.

The US Department of Homeland Security on Thursday announced that it is onboarding nearly 300 cybersecurity professionals and has extended job offers to 500 others in what it refers to as "the most successful cybersecurity hiring initiative in DHS history." From a report: The hiring spree is part of the department's 60-day cybersecurity workforce sprint that aimed to add 200 new cybersecurity personnel by July 1. As The Record reported in May, DHS Secretary Alejandro Mayorkas told attendees of a US Chamber of Commerce event that one of the department's most significant priorities was building out its cybersecurity expertise with an emphasis on diversity.

An anonymous reader shares a report: Two weeks ago, World Wide Web creator Tim Berners-Lee sent an NFT of the web's original source code to the auction block with a starting bid of just $1,000. Yesterday, Sotheby's announced that the crypto asset sold for $5.4 million. The sum makes Berners-Lee's work one of the priciest NFTs of all time. The digital package included not just the source code but also a letter from Berners-Lee reflecting on the creation of the web, some original HTML documents, an SVG "poster" of thousands of lines of code, and a 30-minute visualization of the code being typed on a screen.

But there's a twist. An eagle-eyed researcher pointed out on Twitter that the animation initially posted on the Sotheby's site had errors in the code, possibly introduced when the person making the video fed the Objective-C code through an app or web service to produce the typing effect in the animation. Instead of angle brackets that are present in the code (), the HTML codes for the symbols ( & lt; and & gt;) appeared instead. On the poster, which was made by a Python script created by Berners-Lee, the brackets appear correct. Presumably, they are also correct in the code itself. The code was corrected in later animations, raising questions about this particular NFT and NFTs as a whole.

While it will come as no comfort to those who had their Western Digital My Book Live NAS drives wiped last week, it seems they were attacked by a combination of two exploits, and possibly caught in the fallout of a rivalry between two different teams of hackers. Tom's Hardware reports: Initially, after the news broke on Friday, it was thought a known exploit from 2018 was to blame, allowing attackers to gain root access to the devices. However, it now seems that a previously unknown exploit was also triggered, allowing hackers to remotely perform a factory reset without a password and to install a malicious binary file. A statement from Western Digital, updated today, reads: "My Book Live and My Book Live Duo devices are under attack by exploitation of multiple vulnerabilities present in the device ... The My Book Live firmware is vulnerable to a remotely exploitable command injection vulnerability when the device has remote access enabled. This vulnerability may be exploited to run arbitrary commands with root privileges. Additionally, the My Book Live is vulnerable to an unauthenticated factory reset operation which allows an attacker to factory reset the device without authentication. The unauthenticated factory reset vulnerability [has] been assigned CVE-2021-35941."

Analysis of WD's firmware suggests code meant to prevent the issue had been commented out, preventing it from running, by WD itself, and an authentication type was not added to component_config.php which results in the drives not asking for authentication before performing the factory reset. The question then arises of why one hacker would use two different exploits, particularly an undocumented authentication bypass when they already had root access through the command injection vulnerability, with venerable tech site Ars Technica speculating that more than one group could be at work here, with one bunch of bad guys trying to take over, or sabotage, another's botnet. Western Digital advises users to disconnect their device(s) from the internet. They are offering data recovery services beginning in July, and a trade-in program to switch the obsolete My Book Live drives for more modern My Cloud devices.

An anonymous reader writes: Following in the footsteps of browsers like Mozilla Firefox and Microsoft Edge, Google Chrome is also in line to receive an HTTPS-Only Mode that will upgrade all unencrypted HTTP connections to encrypted HTTPS alternatives, where possible.

Currently, the new Chrome HTTPS-Only Mode is still under development in Chrome Canary distributions. Work is being done to add specific settings in the browser's interface, and no actual HTTP-to-HTTPS functionality is currently present. The feature is expected to be ready for Chrome 93, set to be released later this fall.

The US government has filed a superseding indictment against Paige A. Thompson, a former Amazon engineer accused of hacking Capital One and stealing the personal data of more than 100 million Americans. From a report: According to court documents filed earlier this month and obtained by The Record, the US Department of Justice has added seven new charges on top of the original two it filed in August 2019. The new charges -- six counts of computer fraud and abuse, and one count of access device fraud -- come as investigators have made headway in analyzing data seized from Thompson's computers and servers.

German authorities thwarted a cyberattack on a data service provider used by federal agencies and pushed back on a report that a broad assault targeted critical infrastructure and banks. From a report: The attempt was quickly dealt with and impact on service was "very marginal," Interior Ministry spokesman Steve Alter told reporters on Wednesday, adding that it was likely criminally motivated. He was queried about a report by Bild newspaper, which cited unidentified intelligence sources saying that a hacker group linked to the Kremlin had carried out an attack on German infrastructure and the country's banking system. Bild identified the group as "Fancy Lazarus" after earlier referencing "Fancy Bear," a group controlled by Russia's GRU military intelligence agency that was behind the hacking of Hillary Clinton's staff before the 2016 election, according to a 2018 U.S. Department of Justice indictment. Authorities haven't detected an increase in cyber activities in recent days, Alter said.

A second massive LinkedIn breach reportedly exposes the data of 700M users, which is more than 92% of the total 756M users. The database is for sale on the dark web, with records including phone numbers, physical addresses, geolocation data, and inferred salaries. 9to5Mac reports: RestorePrivacy reports that the hacker appears to have misused the official LinkedIn API to download the data, the same method used in a similar breach back in April: "On June 22nd, a user of a popular hacker advertised data from 700 Million LinkedIn users for sale. The user of the forum posted up a sample of the data that includes 1 million LinkedIn users. We examined the sample and found it to contain the following information: Email Addresses; Full names; Phone numbers; Physical addresses; Geolocation records; LinkedIn username and profile URL; Personal and professional experience/background; Genders; and Other social media accounts and usernames."

With the previous breach, LinkedIn did confirm that the 500M records included data obtained from its servers, but claimed that more than one source was used. PrivacyShark notes that the company has issued a similar statement this time: "While we're still investigating this issue, our initial analysis indicates that the dataset includes information scraped from LinkedIn as well as information obtained from other sources. This was not a LinkedIn data breach and our investigation has determined that no private LinkedIn member data was exposed. Scraping data from LinkedIn is a violation of our Terms of Service and we are constantly working to ensure our members' privacy is protected."

Microsoft has released a visually "refreshed" version of its Office desktop apps for both Windows 10 and 11. Microsoft officials said this new Office refresh will "shine" on Windows 11 but still work on Windows 10. Microsoft also is releasing its first publicly available test build of 64-bit Office for Windows on Arm today. From a report: The updated Office uses Fluent design across Word, Excel, PowerPoint, OneNote, Outlook, Access, Project, Publisher, and Visio. The updated apps are meant to look similar to the Windows 11 OS, design-wise. Via the updated Office interface, Office is set to match users' Windows themes, including black (Dark Mode), white, colorful, or dark gray. The Quick Access toolbar is hidden by default in the name of simplifying the interface. The refreshed Office is available to Office Insider testers running Beta Channel builds. Those who don't want it can turn off the "Coming Soon" feature at the top right hand corner of the menu. Testers can toggle between the new and existing interface to move between the current and newly updated Office apps.

An anonymous reader shares a report: In early 2020, security researchers were baffled to discover that a ransomware gang had come up with an innovative trick that allowed it to run its payload inside virtual machines on infected hosts as a technical solution that bypassed security software. One year later, that technique has spread among the cybercrime underground and is now used by multiple ransomware operators. Initially seen with the Ragnar Locker gang in May 2020, the technique was also adopted by a Maze ransomware subgroup later in the year and has been recently spotted in attacks where the Conti and MountLocker ransomware strains were deployed. In hindsight, it should be no surprise that this technique is becoming more popular, as it has tangible benefits for any threat actor. The general idea behind such an attack is that a ransomware gang that has a small foothold on an infected host can download and install VM software. The ransomware gang will then start a VM instance, share the host computer's storage space with the VM, and then proceed to encrypt the victim's files from within the VM, where the host's antivirus software cannot reach and detect the ransomware during execution.

"Linus Torvalds has just released the Linux 5.13 kernel as stable," reports Phoronix: Linux 5.13 brings initial but still early support for the Apple M1 with basic support but not yet accelerated graphics and a lot more to iron out moving ahead. There are also new Linux 5.13 security features like the Landlock security module, Clang control flow integrity support, and optionally randomizing the kernel stack offset at each system call. There is also AMD fun this cycle around FreeSync HDMI support, initial Aldebaran bring-up, and more. Intel has more work on Alder Lake, a new cooling driver, and more discrete graphics bring-up. There are also other changes for Linux 5.13 around faster IO_uring, a generic USB display driver, and other new hardware enablement.
"5.13 overall is actually fairly large," Linus Torvalds posted on the Linux Kernel Mailing List, calling it "one of the bigger 5.x releases, with over 16,000 commits (over 17k if you count merges), from over 2,000 developers. But it's a "big all over" kind of thing, not something particular that stands out as particularly unusual..."

The New York Times reports: When Yahoo banned working from home in 2013, the reason was one often cited in corporate America: Being in the office is essential for spontaneous collaboration and innovation. "It is critical that we are all present in our offices," wrote Jacqueline Reses, then a Yahoo executive, in a staff memo. "Some of the best decisions and insights come from hallway and cafeteria discussions, meeting new people and impromptu team meetings." Today, Ms. Reses, now chief executive of Post House Capital, an investment firm, has a different view. "Would I write that memo differently now?" she said. "Oh yeah." She still believes that collaboration can benefit from being together in person, but over the last year, people found new, better ways to work.

As the pandemic winds down in the United States, however, many bosses are sounding a note similar to Ms. Reses' in 2013. "Innovation isn't always a planned activity," said Tim Cook, chief executive of Apple, about post-pandemic work. "It's bumping into each other over the course of the day and advancing an idea you just had." Jamie Dimon, chief executive of JPMorgan Chase, said working from home "doesn't work for spontaneous idea generation, it doesn't work for culture." Yet people who study the issue say there is no evidence that working in person is essential for creativity and collaboration. It may even hurt innovation, they say, because the demand for doing office work at a prescribed time and place is a big reason the American workplace has been inhospitable for many people...

"There's credibility behind the argument that if you put people in spaces where they are likely to collide with one another, they are likely to have a conversation," said Ethan S. Bernstein, who teaches at Harvard Business School and studies the topic. "But is that conversation likely to be helpful for innovation, creativity, useful at all for what an organization hopes people would talk about? There, there is almost no data whatsoever. All of this suggests to me that the idea of random serendipity being productive is more fairy tale than reality," he said....

Professor Bernstein found that contemporary open offices led to 70 percent fewer face-to-face interactions. People didn't find it helpful to have so many spontaneous conversations, so they wore headphones and avoided one another.
The chief people officer at real estate marketplace Zillow believes this always-in-the-office culture is what's ultimately lead to problems like long hours, the lack of representation, and burnout, according to the New York Times, which notes Zillow, Salesforce, and Ford are now reconfiguring their offices with fewer rows of desks and more places for informal gatherings.

"Some experts have suggested a new idea for the office: not as a headquarters people go to daily or weekly, but as a place people go sometimes, for group hangouts."

I sometimes talk about "the family of geeks" — how our shared experiences can bring us together.

But if that's true, there's been a death in the family.... Manatee County Administrator Scott Hopes, who is also an epidemiologist, said six unvaccinated employees, including five in the IT department, tested positive for the virus within a two-week period.

The two IT employees who died last week were identified in local media and obituaries as Mary Knight, 58, and Alphonso Cox, 53.

Hopes said that the one IT employee, 23, exposed to the virus who was vaccinated did not get infected. "This particular outbreak demonstrates the effectiveness, I believe, with the vaccine," he said to reporters Monday. "All of the cases were non-vaccinated. They were unvaccinated." He added in a news release, "Individual employees in the IT Department who were known to be fully vaccinated and who were in close proximity of those who were infected did not contract COVID-19."

But even with the outbreak, masks will remain optional for staffers returning this week, with unvaccinated workers being "encouraged but not required, to follow covid-19 prevention measures...." Manatee County, located in southwest Florida, has fully vaccinated 43 percent of its eligible population. The Manatee Board of County Commissioners repealed coronavirus safety requirements last month and strongly recommended that people visiting the County Administration Building "use their best judgment" to protect themselves from a potential spread of the virus...

When the second employee died Thursday, the decision was made to shut down the building the next day so it could be disinfected. "When you have that many cases, and you have a 40 percent fatality rate, you have to worry," Hopes said to Florida Politics. "I would prefer not to have any more employee funerals." Yet the county announced over the weekend that "face masks will be optional for the public and employees inside the facility...."

Funerals and celebration-of-life events for Knight and Cox are scheduled to take place later this week.
Thanks to Slashdot reader luis_a_espinal (a Florida-based software engineer) for sharing the story. Country administrator Hopes is concerned, reports the Sarasota Herald-Tribune, because "Of the first five cases, all were sick enough to be hospitalized or died. That's not the normal COVID variant that we saw last year." And yet... As officials work to control the outbreak, questions have been raised about how far the county can go to keep employees safe — including whether it can inquire about employees' vaccination status, since the recent victims so far have not been fully vaccinated... "We are allowed to ask," Hopes said. "But they don't have to tell us, and whatever their response is, we are not to ask any further." Manatee County School District General Counsel Mitch Teitelbaum said the school district had the same understanding of privacy laws...

[The county-owned seaport] Port Manatee had reported three new cases of COVID-19 on Monday, spurring fears that the virus was continuing to spread among the county's workforce. On Tuesday, port spokeswoman Virginia Zimmerman said the three cases had been an "aberration" and that there are not any additional cases to report. Zimmerman said the port does not inquire about employees' vaccination status, and that the port "encourages, but does not require, staff to be vaccinated."

While the county scrambles to mitigate the spread of the virus, Hopes said many county employees are grieving the loss of their coworkers.

"These weren't just colleagues," Hopes said. "These people have basically lived at work together for 20 years, and this happened quickly."

"Every Sony PlayStation 3 ID out there was compromised, provoking bans of legit players on the network," Threatpost is reporting, calling it "just the latest in a shocking spike in attacks on unsuspecting gamers."

tlhIngan (Slashdot user #30,335) shares Threatpost's report: Sony reportedly left a folder with every PS3 console ID online unsecured, and it was discovered and reported by a Spanish YouTuber with the handle "The WizWiki" in mid-April... Now, several weeks later, players on PlayStation Network message boards are complaining that they can't sign on and are receiving the error message 8071006. After enabling two-factor authentication (2FA), one player was able to sign back in without issue, according to posts on the PS3 subreddit, which includes a link to instructions on how to opt into 2FA on the PS3.

It appears threat actors have started using the stolen PS3 console IDs for malicious purposes, causing the legitimate players to get banned... Sony has not responded to Threatpost's request for comment or confirmed a connection between the PS3 ID breach and player reports of being locked out of the platform...

Sony is hardly the only gaming company leaking data like a sieve. A report from January found a half a million credentials stolen from the Top 25 gaming companies on caches of breached data for sale in criminal marketplaces. In June, the "Battle of the Galaxy" mobile game leaked 6 million gamer profiles, and attackers are working out how to use gaming platforms like Steam to host or deliver malware.

The New York Times tells the story of Fayçal Ziraoui, a 38-year-old French-Moroccan business consultant who "caused an online uproar" after saying he'd cracked the last two unsolved ciphers of the four attributed to the Zodiac killer in California "and identified him, potentially ending a 50-year-old quest." Maybe because he said he cracked them in just two weeks. Many Zodiac enthusiasts consider the remaining ciphers — Z32 and Z13 — unsolvable because they are too short to determine the encryption key. An untold number of solutions could work, they say, rendering verification nearly impossible.

But Mr. Ziraoui said he had a sudden thought. The code-crackers who had solved the [earlier] 340-character cipher in December had been able to do so by identifying the encryption key, which they had put into the public domain when announcing their breakthrough. What if the killer used that same encryption key for the two remaining ciphers? So he said he applied it to the 32-character cipher, which the killer had included in a letter as the key to the location of a bomb set to go off at a school in the fall of 1970. (It never did, even though police failed to crack the code.) That produced a sequence of random letters from the alphabet. Mr. Ziraoui said he then worked through a half-dozen steps including letter-to-number substitutions, identifying coordinates in numbers and using a code-breaking program he created to crunch jumbles of letters into coherent words...

After two weeks of intense code-cracking, he deciphered the sentence, "LABOR DAY FIND 45.069 NORT 58.719 WEST." The message referred to coordinates based on the earth's magnetic field, not the more familiar geographic coordinates. The sequence zeroed in on a location near a school in South Lake Tahoe, a city in California referred to in another postcard believed to have been sent by the Zodiac killer in 1971.

An excited Mr. Ziraoui said he immediately turned to Z13, which supposedly revealed the killer's name, using the same encryption key and various cipher-cracking techniques. [The mostly un-coded letter includes a sentence which says "My name is _____," followed by a 13-character cipher.] After about an hour, Mr. Ziraoui said he came up with "KAYR," which he realized resembled the last name of Lawrence Kaye, a salesman and career criminal living in South Lake Tahoe who had been a suspect in the case. Mr. Kaye, who also used the pseudonym Kane, died in 2010.

The typo was similar to ones found in previous ciphers, he noticed, likely errors made by the killer when encoding the message. The result that was so close to Mr. Kaye's name and the South Lake Tahoe location were too much to be a coincidence, he thought. Mr. Kaye had been the subject of a report by Harvey Hines, a now-deceased police detective, who was convinced he was the Zodiac killer but was unable to convince his superiors. Around 2 a.m. on Jan. 3, an exhausted but elated Mr. Ziraoui posted a message entitled "Z13 — My Name is KAYE" on a 50,000-member Reddit forum dedicated to the Zodiac Killer.

The message was deleted within 30 minutes.

"Sorry, I've removed this one as part of a sort of general policy against Z13 solution posts," the forum's moderator wrote, arguing that the cipher was too short to be solvable.

Bleeping Computer reports: Microsoft has now confirmed signing a malicious driver being distributed within gaming environments. This driver, called "Netfilter," is in fact a rootkit that was observed communicating with Chinese command-and-control IPs.

G Data malware analyst Karsten Hahn first took notice of this event last week and was joined by the wider infosec community in tracing and analyzing the malicious drivers bearing the seal of Microsoft... This incident has once again exposed threats to software supply-chain security, except this time it stemmed from a weakness in Microsoft's code-signing process.
G Data writes: We forwarded our findings to Microsoft who promptly added malware signatures to Windows Defender and are now conducting an internal investigation. At the time of writing it is still unknown how the driver could pass the signing process.
In a Friday blog post, Microsoft said it was contacting other antivirus software vendors "so they can proactively deploy detections," but also emphasized the attack's limited scope: The actor's activity is limited to the gaming sector specifically in China and does not appear to target enterprise environments. We are not attributing this to a nation-state actor at this time. The actor's goal is to use the driver to spoof their geo-location to cheat the system and play from anywhere. The malware enables them to gain an advantage in games and possibly exploit other players by compromising their accounts through common tools like keyloggers.

It's important to understand that the techniques used in this attack occur post exploitation, meaning an attacker must either have already gained administrative privileges in order to be able to run the installer to update the registry and install the malicious driver the next time the system boots or convince the user to do it on their behalf.

We will be sharing an update on how we are refining our partner access policies, validation and the signing process to further enhance our protections. There are no actions customers should take other than follow security best practices and deploy Antivirus software such as Windows Defender for Endpoint.

An anonymous reader quotes a report from Reuters: Microsoft said on Friday an attacker had won access to one of its customer-service agents and then used information from that to launch hacking attempts against customers. The company said it had found the compromise during its response to hacks by a team it identifies as responsible for earlier major breaches at SolarWinds and Microsoft. Microsoft said it had warned the affected customers. "A sophisticated Nation-State associated actor that Microsoft identifies as NOBELLIUM accessed Microsoft customer support tools to review information regarding your Microsoft Services subscriptions," the warning reads in part. The U.S. government has publicly attributed the earlier attacks to the Russian government, which denies involvement.

After commenting on a broader phishing campaign that it said had compromised a small number of entities, Microsoft said it had also found the breach of its own agent, who it said had limited powers. The agent could see billing contact information and what services the customers pay for, among other things. "The actor used this information in some cases to launch highly-targeted attacks as part of their broader campaign," Microsoft said. Microsoft warned affected customers to be careful about communications to their billing contacts and consider changing those usernames and email addresses, as well as barring old usernames from logging in. Microsoft said it was aware of three entities that had been compromised in the phishing campaign. It did not immediately clarify whether any had been among those whose data was viewed through the support agent, or if the agent had been tricked by the broader campaign. Microsoft did not say whether the agent was at a contractor or a direct employee.

An anonymous reader quotes a report from Ars Technica: For years, security researchers and cybercriminals have hacked ATMs by using all possible avenues to their innards, from opening a front panel and sticking a thumb drive into a USB port to drilling a hole that exposes internal wiring. Now, one researcher has found a collection of bugs that allow him to hack ATMs -- along with a wide variety of point-of-sale terminals -- in a new way: with a wave of his phone over a contactless credit card reader. Josep Rodriguez, a researcher and consultant at security firm IOActive, has spent the last year digging up and reporting vulnerabilities in the so-called near-field communications reader chips used in millions of ATMs and point-of-sale systems worldwide. NFC systems are what let you wave a credit card over a reader -- rather than swipe or insert it -- to make a payment or extract money from a cash machine. You can find them on countless retail store and restaurant counters, vending machines, taxis, and parking meters around the globe.

Now Rodriguez has built an Android app that allows his smartphone to mimic those credit card radio communications and exploit flaws in the NFC systems' firmware. With a wave of his phone, he can exploit a variety of bugs to crash point-of-sale devices, hack them to collect and transmit credit card data, invisibly change the value of transactions, and even lock the devices while displaying a ransomware message. Rodriguez says he can even force at least one brand of ATMs to dispense cash -- though that "jackpotting" hack only works in combination with additional bugs he says he has found in the ATMs' software. He declined to specify or disclose those flaws publicly due to nondisclosure agreements with the ATM vendors. "You can modify the firmware and change the price to one dollar, for instance, even when the screen shows that you're paying 50 dollars. You can make the device useless, or install a kind of ransomware. There are a lot of possibilities here," says Rodriguez of the point-of-sale attacks he discovered. "If you chain the attack and also send a special payload to an ATM's computer, you can jackpot the ATM -- like cash out, just by tapping your phone."

Rodriguez says he alerted the affected vendors -- which include ID Tech, Ingenico, Verifone, Crane Payment Innovations, BBPOS, Nexgo, and the unnamed ATM vendor -- to his findings between seven months and a year ago. Even so, he warns that the sheer number of affected systems and the fact that many point-of-sale terminals and ATMs don't regularly receive software updates -- and in many cases require physical access to update -- mean that many of those devices likely remain vulnerable. "Patching so many hundreds of thousands of ATMs physically, it's something that would require a lot of time," Rodriguez says.

AmiMoJo writes: Security researchers have found four major security vulnerabilities in the BIOSConnect feature of Dell SupportAssist, allowing attackers to remotely execute code within the BIOS of impacted devices. According to Dell's website, the SupportAssist software is 'preinstalled on most Dell devices running Windows operating system,' while BIOSConnect provides remote firmware update and OS recovery features. The chain of flaws discovered by Eclypsium researchers comes with a CVSS base score of 8.3/10 and enables privileged remote attackers to impersonate Dell.com and take control of the target device's boot process to break OS-level security controls. "Such an attack would enable adversaries to control the device's boot process and subvert the operating system and higher-layer security controls," Eclypsium researchers explain in a report shared in advance with BleepingComputer. "The issue affects 129 Dell models of consumer and business laptops, desktops, and tablets, including devices protected by Secure Boot and Dell Secured-core PCs," with roughly 30 million individual devices exposed to attacks.