A code repository used by the New York state government's IT department was left exposed on the internet, allowing anyone to access the projects inside, some of which contained secret keys and passwords associated with state government systems. From a report: The exposed GitLab server was discovered on Saturday by Dubai-based SpiderSilk, a cybersecurity company credited with discovering data spills at Samsung, Clearview AI and MoviePass. Organizations use GitLab to collaboratively develop and store their source code -- as well as the secret keys, tokens and passwords needed for the projects to work -- on servers that they control. But the exposed server was accessible from the internet and configured so that anyone from outside the organization could create a user account and log in unimpeded, SpiderSilk's chief security officer Mossab Hussin told TechCrunch. When TechCrunch visited the GitLab server, the login page showed it was accepting new user accounts. It's not known exactly how long the GitLab server was accessible in this way, but historic records from Shodan, a search engine for exposed devices and databases, shows the GitLab was first detected on the internet on March 18.

The storied space telescope that brought you stunning photos of the solar system and enriched our understanding of the cosmos over the past three decades is experiencing a technical glitch. From a report: Scientists at NASA say the Hubble Space Telescope's payload computer, which operates the spacecraft's scientific instruments, went down suddenly on June 13. Without it, the instruments on board meant to snap pictures and collect data are not currently working. Scientists have run a series of tests on the malfunctioning computer system but have yet to figure out what went wrong. "It's just the inefficiency of trying to fix something which is orbiting 400 miles over your head instead of in your laboratory," Paul Hertz, the director of astrophysics for NASA, told NPR. "If this computer were in the lab, we'd be hooking up monitors and testing the inputs and outputs all over the place, and would be really quick to diagnose it," he said. "All we can do is send a command from our limited set of commands and then see what data comes out of the computer and then send that data down and try to analyze it."

At first NASA scientists wondered if a "degrading memory module" on Hubble was to blame. Then on Tuesday the agency said it was investigating whether the computer's Central Processing Module (CPM) or its Standard Interface (STINT) hardware, which helps the CPM communicate with other components, caused the problem. Hertz said the current assumption, though unverified, was that the technical issue was a "random parts failure" somewhere on the computer system, which was built in the 1980s and launched into space in 1990. "They're very primitive computers compared to what's in your cell phone," he said, "but the problem is we can't touch it or see it." Most of Hubble's components have redundant back-ups, so once scientists figure out the specific component that's causing the computer problem, they can remotely switch over to its back-up part.

In a blog post today, Google announced a series of new security enhancements that will make many publicly accessible Google Drive links no longer accessible. The enhancements are being brought to Google Drive on September 23rd, 2021. XDA Developers reports: Once this change goes live, Google says that users will need a "resource key" to access a publicly shared link. However, users won't need an updated link with said resource key appended if they've already accessed that file before in the past. As a result of this change, we can imagine that lots of Google Drive links shared online on forums and other sites will no longer work as their owners neglect to update them, leaving them only accessible to the people that have already clicked the links before.

According to the post made on the Google Workspace blog, this won't affect all files. Users who have shared a file that is affected by this change will get an email from Google informing them of this change and how to opt out of needing those files from being updated. These emails will be sent out to users starting on July 26th. Google shared a copy of a sample email to show end-users what the message they'll get will look like. The company doesn't recommend opting out all files and says that only the files that you want publicly accessible should be opted out. Users have until September 13th to decide if they want the update applied, so if you have no files that are publicly accessible, then you won't need to do anything. YouTube is also making similar changes. "Starting on July 23, Unlisted videos uploaded before the January 1, 2017, system change will be automatically made private," reports 9to5Google. "That said, YouTube creators can decide to opt out of this change. Filling out this form will let you 'keep your Unlisted videos uploaded before 2017 in their current Unlisted state.' Other options include making Unlisted pre-2017 videos public or re-uploading as a new Unlisted video at the expense of stats."

Apple is raising fears about letting users install applications outside the company's App Store, an issue being targeted by lawmakers and regulators that also played a prominent role in its recent trial against Epic Games. From a report: The company said Wednesday on its website that requiring apps to be downloaded from the App Store protects consumers against scams, keeps their privacy secure and provides developers payment for their work. All those benefits could disappear if apps can be downloaded from third-party app stores with lesser protections or users get an app from a website or PC and "sideload" it onto the phone. The timing of Apple's push back isn't coincidental.

The U.S. House Judiciary Committee Wednesday is scheduled to discuss six proposed antitrust bills, including one sponsored by Rhode Island Democrat Representative David Cicilline, a Democrat from Rhode Island and chairman of the antitrust subcommittee that, if passed into law, could call for Apple to open up to third-party app stores and provide all of its iPhone technologies to third-party software makers. "It shall be unlawful for a person operating a covered platform, in or affecting commerce, to restrict or impede the capacity of a business user to access or interoperate with the same platform, operating system, hardware and software features that are available to the covered platform operator's own products, services, or lines of business," according to an early copy of the bill.

"Allowing sideloading would degrade the security of the iOS platform and expose users to serious security risks not only on third-party app stores, but also on the App Store," the Cupertino, California-based technology giant said on its website. "Because of the large size of the iPhone user base and the sensitive data stored on their phones -- photos, location data, health and financial information -- allowing sideloading would spur a flood of new investment into attacks on the platform."

Senior executives at a French spyware firm have been indicted for the company's sale of surveillance software to authoritarian regimes in Libya and Egypt that resulted in the torture and disappearance of dissidents. MIT Technology Review reports: While high-tech surveillance is a multibillion-dollar industry worldwide, it is rare for companies or individuals to face legal consequences for selling such technologies -- even to notorious dictatorships or other dangerous regimes. But charges in the Paris Judicial Court against leaders at Amesys, a surveillance company that later changed its name to Nexa Technology, claim that the sales to Libya and Egypt over the last decade led to the crushing of opposition, torture of dissidents, and other human rights abuses. The former head of Amesys, Philippe Vannier, and three current and former executives at Nexa technologies were indicted for "complicity in acts of torture" for selling spy technology to the Libyan regime. French media report that Nexa president Olivier Bohbot, managing director Renaud Roques, and former president Stephane Salies face the same charges for surveillance sales to Egypt.

The charges were brought by brought by the Crimes Against Humanity and War Crimes unit of the court, but the case began 10 years ago when Amesys sold its system for listening in on internet traffic to the Libyan dictator Muammar Gaddafi. Six victims of the spying testified in France about being arrested and tortured by the regime, an experience that they say is a direct result of these spying tools. In 2014, the company sold surveillance software to Egyptian president Abdel al-Sisi shortly after he took control of the country in a military coup. The complaints, filed by the International Federation for Human Rights, or FIDH, and the French League for Human Rights, allege that the company did not have government permission to sell its technologies to Libya or Egypt because oversight was weak and at times nonexistent. The claims led to an independent judicial investigation against Amesys/Nexa, which is still ongoing. Next, the judges will decide whether to send the case to criminal court or dismiss it if there is not sufficient evidence -- but the indictment is a major step forward and points toward the prospect that the judges will view the evidence as potentially strong enough to support a criminal trial.

An anonymous reader quotes a report from Motherboard: In a short CCTV video, a clerk at a small convenience store can be seen taking a bottle of coffee from a cooler and drinking it. When he returns to the cash register, an unseen person's voice emits from a speaker on the ceiling and interrogates him about whether he scanned and paid for the item. In another video, a cashier is standing behind the counter talking to someone just out of frame. There's a 'ding' sound, and the voice from above questions the cashier about who the other man is -- he's there to give the cashier a ride at the end of his shift -- then orders the man to stand on the other side of the counter.

The videos are just a few examples that Washington-based Live Eye Surveillance uses to demonstrate its flagship product: a surveillance camera system that keeps constant watch over shops and lets a remote human operator intervene whenever they see something they deem suspicious. For enough money -- $399 per month according to one sales email Motherboard viewed -- a person in Karnal, India will watch the video feed from your business 24/7. The monitors "act as a virtual supervisor for the sites, in terms of assuring the safety of the employees located overseas and requesting them to complete assigned tasks," according to a job posting on the company's website. [...] On its website, the company claims several major corporations as customers, including 7-Eleven, Shell, Dairy Queen, and Holiday Inn. Many of those businesses are franchised, and it isn't clear from Live Eye's materials whether the corporations have purchased the surveillance systems or if they've been bought by individual franchise owners.

An anonymous reader quotes a report from BleepingComputing: The Ragnar Locker ransomware gang have published download links for more than 700GB of archived data stolen from Taiwanese memory and storage chip maker ADATA. A set of 13 archives, allegedly containing sensitive ADATA files, have been publicly available at a cloud-based storage service, at least for some time. [...] Two of the leaked archives are quite large, weighing over 100GB, but several of them that could have been easily downloaded are less than 1.1GB large. Per the file metadata published by the threat actor, the largest archive is close to 300GB and its name gives no clue about what it might contain. Another large one is 117GB in size and its name is just as nondescript as in the case of the first one (Archive#2). Judging by the names of the archives, Ragnar Locker likely stole from ADATA documents containing financial information, non-disclosure agreements, among other type of details.

The ransomware attack on ADATA happened on May 23rd, 2021, forcing them to take systems offline, the company told BleepingComputer. As the Ragnar Locker leak clearly shows, ADATA did not pay the ransom and restored the affected systems on its own. The ransomware actor claims stealing 1.5TB of sensitive files before deploying the encryption routine, saying that they took their time in the process because of the poor network defenses. The recently leaked batch of archives is the second one that Ragnar Locker ransomware publishes for ADATA. The previous one was posted earlier this month and includes four small 7-zip archives (less than 250MB together) that can still be downloaded.

Mark Wilson writes: Just a few days ago -- before it has even been officially announced -- Windows 11 leaked online and remains available to download from numerous sites. The Windows 11 ISO torrent spread like wildfire, and now Microsoft is fighting back. The company has issued a slew of DMCA takedown notices to various sites it says are distributing "a leaked copy of the unreleased Windows 11." Unsurprisingly, an article entitled "How to Download and Install Windows 11 Right Now" caught the eyes of Microsoft lawyers. The company has issued a slew of DMCA takedown notices to various sites it says are distributing "a leaked copy of the unreleased Windows 11." Unsurprisingly, an article entitled "How to Download and Install Windows 11 Right Now" caught the eyes of Microsoft lawyers.

"In 2016 North Korean hackers planned a $1bn raid on Bangladesh's national bank," reports the BBC, "and came within an inch of success — it was only by a fluke that all but $81m of the transfers were halted, report Geoff White and Jean H Lee...

"It all started with a malfunctioning printer..." It was located inside a highly secure room on the 10th floor of the bank's main office in Dhaka, the capital. Its job was to print out records of the multi-million-dollar transfers flowing in and out of the bank. When staff found it wasn't working, at 08:45 on Friday 5 February 2016, "we assumed it was a common problem just like any other day," duty manager Zubair Bin Huda later told police. "Such glitches had happened before." In fact, this was the first indication that Bangladesh Bank was in a lot of trouble. Hackers had broken into its computer networks, and at that very moment were carrying out the most audacious cyber-attack ever attempted. Their goal: to steal a billion dollars.

To spirit the money away, the gang behind the heist would use fake bank accounts, charities, casinos and a wide network of accomplices.... When the bank's staff rebooted the printer, they got some very worrying news. Spilling out of it were urgent messages from the Federal Reserve Bank in New York — the "Fed" — where Bangladesh keeps a US-dollar account. The Fed had received instructions, apparently from Bangladesh Bank, to drain the entire account — close to a billion dollars. The Bangladeshis tried to contact the Fed for clarification, but thanks to the hackers' very careful timing, they couldn't get through... The bank's HQ in Dhaka was beginning two days off. And when the Bangladeshis began to uncover the theft on Saturday, it was already the weekend in New York... And the hackers had another trick up their sleeve to buy even more time. Once they had transferred the money out of the Fed, they needed to send it somewhere. So they wired it to accounts they'd set up in Manila, the capital of the Philippines. And in 2016, Monday 8 February was the first day of the Lunar New Year, a national holiday across Asia...

They had had plenty of time to plan all of this, because it turns out the Lazarus Group had been lurking inside Bangladesh Bank's computer systems for a year... Once inside the bank's systems, Lazarus Group began stealthily hopping from computer to computer, working their way towards the digital vaults and the billions of dollars they contained... But they still had one final hurdle to clear — the printer on the 10th floor. Bangladesh Bank had created a paper back-up system to record all transfers made from its accounts. This record of transactions risked exposing the hackers' work instantly. And so they hacked into the software controlling it and took it out of action.

With their tracks covered, at 20:36 on Thursday 4 February 2016, the hackers began making their transfers — 35 in all, totalling $951m, almost the entire contents of Bangladesh Bank's New York Fed account.
There's more to the story — it's a whole episode on a 10-episode BBC World Service podcast which they're calling an example of "the new front line in a global battleground: a murky nexus of crime, espionage and nation-state power-mongering. And it's growing fast."

The story has a surprise ending — but alongo the way, the BBC's article points out that the consequences for the bank's governor were almost instant. "He was asked to resign," says U.S.-based cyber-security expert Rakesh Asthana. "I never saw him again."

"On January 15, a hacker tried to poison a water treatment plant that served parts of the San Francisco Bay Area," reports NBC News: It didn't seem hard. The hacker had the username and password for a former employee's TeamViewer account, a popular program that lets users remotely control their computers, according to a private report compiled by the Northern California Regional Intelligence Center in February and seen by NBC News. After logging in, the hacker, whose name and motive are unknown and who hasn't been identified by law enforcement, deleted programs that the water plant used to treat drinking water.

The hack wasn't discovered until the following day, and the facility changed its passwords and reinstalled the programs. "No failures were reported as a result of this incident, and no individuals in the city reported illness from water-related failures," the report, which did not specify which water treatment plant had been breached, noted.

The incident, which has not been previously reported, is one of a growing number of cyberattacks on U.S. water infrastructure that have recently come to light. The Bay Area attack was followed by a similar one in Oldsmar, Florida, a few weeks later. In that one, which made headlines around the world, a hacker also gained access to a TeamViewer account and raised the levels of lye in the drinking water to poisonous levels. An employee quickly caught the computer's mouse moving on its own, and undid the hacker's changes... The usernames and passwords for at least 11 Oldsmar employees have been traded on the dark web, said Kent Backman, a researcher at the cybersecurity company Dragos...

[A] number of facilities have been hacked in the past year, though most draw little attention. In Pennsylvania, a state water warning system has reportedly alerted its members to two recent hacks at water plants in the state. In another previously unreported hack, the Camrosa Water District in Southern California was infected with ransomware last summer. Whether hacks on water plants have recently become more common or just more visible is impossible to tell, because there is no comprehensive federal or industry accounting of water treatment plants' security... Unlike the electric grid, which is largely run by a smaller number of for-profit corporations, most of the more than 50,000 drinking water facilities in the U.S. are nonprofit entities.

Some that serve large populations are larger operations with dedicated cybersecurity staff. But rural areas in particular often get their water from small plants, often run by only a handful of employees who aren't dedicated cybersecurity experts, said Bryson Bort, a consultant on industrial cybersecurity systems. "They're even more fragmented at lower levels than anything we're used to talking about, like the electric grid," he said. "If you could imagine a community center run by two old guys who are plumbers, that's your average water plant."
NBC News also a spokesperson for America's Cybersecurity and Infrastructure Security Agency, who shared an internal survey conducted earlier this year. As many as 1 in 10 water and wastewater plants reported they'd recently found a critical cybersecurity vulnerability — and more than 80% of their major vulnerabilities were software flaws discovered before 2017.

During the lockdowns I edited dozens of Slashdot posts from the front-passenger seat of my car (using a cellphone for a mobile hotspot).

But according to CNBC, I wasn't the only person working from a vehicle... When Erica Horn received a work email in May 2020 saying her company would be fully remote for the next year, she knew right away it was time to live out her long-held dream of living out of a van... Horn is not alone. Many workers with jobs that let them work remotely during the pandemic left behind their sedentary housing situations and moved full-time into vans. These remote workers drive from location to location in their homes, working from internet hotspots in their vans and spending their free time in nature and exploring new places. As vaccines roll out and states start to open up, some workers are returning to their offices.

But many workers who've adopted the van life don't want to give it up...

Like overseas backpacking, van life appeals to those with a love for travel or the outdoors who have the privilege to work remotely and the budget to spend thousands of dollars buying and setting up their vans. They can shift the money from rent and car payments toward a lifestyle of endless travel... For some, working out of a van is less about travel and more of an alternative to leasing an office. Kenzo Fong, CEO of tech start-up Rock, began working out of his van in May 2020 after his children began doing their schoolwork at home during the pandemic. Fong still lives in his San Francisco home, but during the days, he gets into his van and picks a new location in the city...

Some van lifers only need a laptop. Others have more elaborate set ups complete with multiple monitors. But most carry at least two hot spots from different network providers so they can catch signal from at least one of the services as they hit new locations... Despite the challenges of life on the road, those who spoke with CNBC said they plan to continue their nomadic lifestyle until their companies stop allowing remote work or until they get burnt out. Horn said she originally planned to live on the road for at least a year, but that's now changed.

"At six months, I still feel like I'm just learning this, just getting the hang of it and just getting started," she said. "I could actually see myself doing it for closer to two years, and who knows, maybe longer."

CBS News reports: A mysterious and puzzling email with the subject line of "Integration Test Email #1" landed in the boxes of some HBO Max subscribers on Thursday. Just hours later, the company said that the message was intended to be an empty test email, and "yes, it was the intern." The unnamed intern quickly became the new star of HBO Max on social media, as hundreds of encouraging messages poured in to reassure the intern that mistakes happen, in all phases of careers... And instead of subscribers responding with angry messages about an inconvenience, they used the opportunity to tell their own stories of work snafus...

One individual wrote about how they "once globally took down Spotify." It almost happened twice," they wrote. "...You managed to find something broken in the way integration tests are done. It's a good thing and will help improve things...."

"When I was 25 I made a PDF assigning each employee to the Muppet they reminded me of the most," another wrote. "I meant to send it to my work friend, but I accidentally sent it to the entire company. My supervisor (Beaker) wanted to fire me, but the owners (Bert & Ernie) intervened."
Dozens of news outlets, from the Huffington Post to media wire services, soon began covering the funny stories shared in support:

• "Don't feel bad Integration Test Email #1 intern...when I was an intern once I accidentally powered off every device during a complicated laser experiment at MIT."
• "In the first month of my new HR job with a major defense contractor, I sent out an email about shirt orders that included the division president and several corporate leaders. Title of email: Your Shit is in the HR Office..."

But my favorite reply of all?

"Dear intern, welcome to Systems Engineering."

Share your own thoughts and stories of support in the comments...

McAfee has discovered a vulnerability "that allows hackers to access Peloton's bike screen," reports CNN, "and potentially spy on riders using its microphone and camera."

"However, the threat most likely affects only the $2,495 bike used in public spaces, such as in hotels or gyms, because the hacker needs to physically access the screen using a USB drive containing a malicious code." According to McAfee's Advanced Threat Research team, a hacker can discreetly control the stationary bike's screen remotely and interfere with its operating system. That means hackers could, for example, install apps that look like Netflix or Spotify and steal the users' log-in information. Perhaps more alarmingly, the cybersecurity team was able spy on users via the camera and microphone, which is normally used for video chats with other users.

"As a result, an unsuspecting gym-goer taking the Peloton Bike+ for a spin could be in danger of having their personal data compromised and their workout unknowingly watched," the report said. It also warned the hacker could configure this spyware at any point, including during the supply chain or delivery process, without the owner knowing... Peloton released a mandatory software update that fixes the issue to users earlier this month.

The security risk doesn't affect the lower-priced Peloton Bike because it uses a different type of touchscreen....

This report marks the second security concern for Peloton in two months. In May, the fitness firm released a security update that sealed a leak that was revealing personal account information, such as a user's age, city and weight.

Boston-headquartered security firm Cybereason's study has found that the majority of organizations that chose to pay ransom demands in the past were not immune to subsequent ransomware attacks, often by the same threat actors. From a report: In fact, 80% of organizations that paid the ransom were hit by a second attack, and almost half were hit by the same threat group. This study offers insight into the business impact of ransomware attacks across key industry verticals and reveals data that can be leveraged to improve ransomware defenses. For example, after an organization experienced a ransomware attack, the top two solutions implemented included security awareness training (48%) and security operations (48%). This research underscores that prevention is the best strategy for managing ransomware risk and ensuring your organization does not fall victim to a ransomware attack in the first place.

The Polish government said that a recent wave of cyberattacks that have targeted the email accounts of local political figures originated from Russia. From a report: The attacks have targeted some of the most important Polish officials, ministers, and deputies from various political parties, said Jaroslaw Kaczynski, Poland's deputy prime minister, citing sources from the Polish Internal Security Agency and the Military Counterintelligence Service. "The analysis of our services and the special services of our allies allows for a clear statement that the cyber attack was carried out from the territory of the Russian Federation," Kaczynski said in a press release today. "Its scale and range are wide," the Polish official said. The announcement today comes after Polish local news outlets reported last week hackers broke into the email inbox of Michal Dworczyk, head of the Chancellery of the Polish Prime Minister's. Throughout the course of the last week, the hackers leaked emails and documents from Dworczyk's inbox on a Telegram channel, according to Polish online news outlet Onet. Other documents were also leaked through the Facebook account of Dworczyk's wife.

Google has open-sourced a collection of C++ libraries for implementing Fully Homomorphic Encryption (FHE) in modern applications. From a report: Fully homomorphic encryption, or simply homomorphic encryption, is a form of data encryption that allows users/applications to perform mathematical computations on encrypted data without decrypting it first, keeping the data's privacy intact. While the concept of homomorphic encryption has been around since 1978, when it was first described at a theoretical level, and 2009, when it was first implemented in practice, it has not been broadly adopted in software due to its complexity, advanced cryptography techniques, and lack of open-source code and public documentation. However, despite this, today, FHE is a hot technology in software design.

FHE allows software vendors to work on encrypted data without sharing the encryption/decryption keys with untrustworthy systems such as client-side apps or publicly-hosted web servers, where the keys could be stolen or intercepted by malware or malicious human operators. FHE allows developers to keep data secure, encrypted, and private, all at the same time, and Google hopes that developers will use its FHE libraries as the first step into adopting this new type of encryption technology within their applications.

Police in Ukraine said this week they arrested members of a major ransomware gang. From a report: The arrests mark the first time a law enforcement agency has announced a mass arrest of a prolific hacker group that had extorted Americans by either encrypting an organization's files or threatening to leak them to the public. The gang, known as Cl0p, has hacked a number of American targets, including the University of Miami, Florida, Stanford University, University of Maryland, and University of Colorado, demanding a payment to either keep their systems functional or to not publish material they were able to steal. The bust comes as ransomware has gone from a quietly pervasive cybersecurity problem to a broadly discussed national security issue, thanks to a series of high-profile attacks that have threatened to cripple some U.S. supply chains.

Ukraine's announcement coincided with President Joe Biden's meeting with Russian President Vladimir Putin in Geneva. Biden is expected to press Putin to take action against ransomware hackers who operate with impunity within Russia's borders. Ransomware has become a significant problem in the United States. Recent ransomware attacks briefly hobbled the Colonial Pipeline, shutting down the country's largest fuel pipeline for five days, and JBS, one of the country's largest meat suppliers. The majority of the most prolific ransomware gangs are believed to operate in Eastern Europe, and Russia in particular. Ukraine's cyber police announced they had arrested six people involved with Cl0p, and seized a number of computers, cars and about 5 million Ukrainian hryvnia ($185,000) in cash.

A weakness in the algorithm used to encrypt cellphone data in the 1990s and 2000s allowed hackers to spy on some internet traffic, according to a new research paper. Motherboard: The paper has sent shockwaves through the encryption community because of what it implies: The researchers believe that the mathematical probability of the weakness being introduced on accident is extremely low. Thus, they speculate that a weakness was intentionally put into the algorithm. After the paper was published, the group that designed the algorithm confirmed this was the case. Researchers from several universities in Europe found that the encryption algorithm GEA-1, which was used in cellphones when the industry adopted GPRS standards in 2G networks, was intentionally designed to include a weakness that at least one cryptography expert sees as a backdoor. The researchers said they obtained two encryption algorithms, GEA-1 and GEA-2, which are proprietary and thus not public, "from a source." They then analyzed them and realized they were vulnerable to attacks that allowed for decryption of all traffic.

When trying to reverse-engineer the algorithm, the researchers wrote that (to simplify), they tried to design a similar encryption algorithm using a random number generator often used in cryptography and never came close to creating an encryption scheme as weak as the one actually used: "In a million tries we never even got close to such a weak instance," they wrote. "This implies that the weakness in GEA-1 is unlikely to occur by chance, indicating that the security level of 40 bits is due to export regulations." Researchers dubbed the attack "divide-and-conquer," and said it was "rather straightforward." In short, the attack allows someone who can intercept cellphone data traffic to recover the key used to encrypt the data and then decrypt all traffic. The weakness in GEA-1, the oldest algorithm developed in 1998, is that it provides only 40-bit security. That's what allows an attacker to get the key and decrypt all traffic, according to the researchers.

Websites of dozens of financial institutions and airlines in Australia and the United States were briefly down on Thursday, in the second major blackout in just over a week caused by a glitch in an important piece of internet infrastructure. From a report: Server-related glitches at content delivery network provider Akamai had hampered services at Australian banks, while many U.S. airlines, including American Airlines and Southwest Airlines, also reported an hour-long outage. The disruption linked to technical issues at Akamai follows an outage at rival Fastly that affected a number of popular websites last week. The impacted platform is now up and running, an Akamai spokesperson said, adding that the company was "continuing to validate services." The outage was caused by a bug in Akamai's software that has since been fixed, and was not caused by a cyber-attack or vulnerability, the spokesperson added.

On Friday, Volkswagen disclosed a data breach that it said affected 3.3 million customers and interested buyers. On Monday, hackers put the data stolen from the car maker on sale on a notorious hacking forum. From a report: In the sales listing reviewed by Motherboard, a hacker that goes by 000 wrote that the data included email addresses and Vehicle Identification Numbers (VIN). The hacker also posted two samples of the data, which included full names, email addresses, mailing addresses, and phone numbers. The type of data seems to align with what Volkwagen admitted was stolen. In a website set up by a cybersecurity vendor on behalf of the car maker, Volkswagen said that "the majority" of affected data included: "first and last name, personal or business mailing address, email address, or phone number. In some instances, the data also included information about a vehicle purchased, leased, or inquired about, such as the Vehicle Identification Number (VIN), make, model, year, color and trim packages."

But for 90,000 victims, the data also included "more sensitive information relating to eligibility for a purchase, loan, or lease. Nearly all of the more sensitive data (over 95%) consists of driver's license numbers," according to the company, which added that the majority of data pertains to Audi customers and interested buyers in the US and Canada only. The company also said it believes the data was left unsecured by a vendor. (Audi is owned by the Volkswagen Group.) "There were also a very small number of dates of birth, Social Security or social insurance numbers, account or loan numbers, and tax identification numbers," the website read.