"In a new paper, Cornell Tech researchers identified a problem that holds the key to whether all encryption can be broken — as well as a surprising connection to a mathematical concept that aims to define and measure randomness," according to a news release shared by Slashdot reader bd580slashdot: "Our result not only shows that cryptography has a natural 'mother' problem, it also shows a deep connection between two quite separate areas of mathematics and computer science — cryptography and algorithmic information theory," said Rafael Pass, professor of computer science at Cornell Tech...

Researchers have not been able to prove the existence of a one-way function. The most well-known candidate — which is also the basis of the most commonly used encryption schemes on the internet — relies on integer factorization. It's easy to multiply two random prime numbers — for instance, 23 and 47 — but significantly harder to find those two factors if only given their product, 1,081. It is believed that no efficient factoring algorithm exists for large numbers, Pass said, though researchers may not have found the right algorithms yet.

"The central question we're addressing is: Does it exist? Is there some natural problem that characterizes the existence of one-way functions?" he said. "If it does, that's the mother of all problems, and if you have a way to solve that problem, you can break all purported one-way functions. And if you don't know how to solve that problem, you can actually get secure cryptography...."

In the paper, Pass and doctoral student Yanyi Liu showed that if computing time-bounded Kolmogorov Complexity is hard, then one-way functions exist. Although their finding is theoretical, it has potential implications across cryptography, including internet security.

PAjamian writes: A recently released Red Hat update for the BootHole Vulnerability (firehose link) is causing systems to become unbootable. It is widely reported that updates to the shim, grub2 and kernel packages in RHEL and CentOS 7 and 8 are leaving various systems that use secure boot unbootable. Current recommendations are to avoid updating your system until the issue is resolved, or at least avoid updating the shim, grub2 and kernel packages. Update, shared by PAjamian: Red Hat is now recommending that users do not apply grub2, fwupd, fwupdate or shim updates until new packages are available.

Twitter said Thursday night that it has "significantly limited" access to its internal tools after it learned that the high-profile hack earlier this month affecting dozens of major accounts was the result of a phishing attack targeting the phones of a "small number of employees." From a report: "This attack relied on a significant and concerted attempt to mislead certain employees and exploit human vulnerabilities to gain access to our internal systems," Twitter said in a tweet. A phishing attack is a type of cyberattack in which hackers try to trick victims into opening malicious emails or links disguised as legitimate web content. In addition to clamping down on access to administrative systems, Twitter said it was also accelerating the rollout of "security work streams" that had already been in progress.

A recent series of malware attacks on U.S.-based merchants suggest thieves are exploiting weaknesses in how certain financial institutions have implemented the technology in chip-based credit and debit cards to sidestep key security features and effectively create usable, counterfeit cards. Brian Krebs reports via Krebs on Security: Traditional payment cards encode cardholder account data in plain text on a magnetic stripe, which can be read and recorded by skimming devices or malicious software surreptitiously installed in payment terminals. That data can then be encoded onto anything else with a magnetic stripe and used to place fraudulent transactions. Newer, chip-based cards employ a technology known as EMV that encrypts the account data stored in the chip. The technology causes a unique encryption key -- referred to as a token or "cryptogram" -- to be generated each time the chip card interacts with a chip-capable payment terminal.

Virtually all chip-based cards still have much of the same data that's stored in the chip encoded on a magnetic stripe on the back of the card. This is largely for reasons of backward compatibility since many merchants -- particularly those in the United States -- still have not fully implemented chip card readers. This dual functionality also allows cardholders to swipe the stripe if for some reason the card's chip or a merchant's EMV-enabled terminal has malfunctioned. But there are important differences between the cardholder data stored on EMV chips versus magnetic stripes. One of those is a component in the chip known as an integrated circuit card verification value or "iCVV" for short -- also known as a "dynamic CVV." The iCVV differs from the card verification value (CVV) stored on the physical magnetic stripe, and protects against the copying of magnetic-stripe data from the chip and the use of that data to create counterfeit magnetic stripe cards. Both the iCVV and CVV values are unrelated to the three-digit security code that is visibly printed on the back of a card, which is used mainly for e-commerce transactions or for card verification over the phone. The appeal of the EMV approach is that even if a skimmer or malware manages to intercept the transaction information when a chip card is dipped, the data is only valid for that one transaction and should not allow thieves to conduct fraudulent payments with it going forward.

However, for EMV's security protections to work, the back-end systems deployed by card-issuing financial institutions are supposed to check that when a chip card is dipped into a chip reader, only the iCVV is presented; and conversely, that only the CVV is presented when the card is swiped. If somehow these do not align for a given transaction type, the financial institution is supposed to decline the transaction. More recently, researchers at Cyber R&D Labs published a paper detailing how they tested 11 chip card implementations from 10 different banks in Europe and the U.S. The researchers found they could harvest data from four of them and create cloned magnetic stripe cards that were successfully used to place transactions. There are now strong indications the same method detailed by Cyber R&D Labs is being used by point-of-sale (POS) malware to capture EMV transaction data that can then be resold and used to fabricate magnetic stripe copies of chip-based cards.

Microsoft announced this week plans to remove all Windows-related file downloads from the Microsoft Download Center that are cryptographically signed with the Secure Hash Algorithm 1 (SHA-1). From a report: The files will be removed next Monday, on August 3, the company said on Tuesday. The OS maker cited the security of the SHA-1 algorithm for the move. "SHA-1 is a legacy cryptographic hash that many in the security community believe is no longer secure. Using the SHA-1 hashing algorithm in digital certificates could allow an attacker to spoof content, perform phishing attacks, or perform man-in-the-middle attacks," it said. Most software companies have recently begun abandoning the SHA-1 algorithm after a team of academics broke the SHA-1 hashing function at a theoretical level in February 2016.

A disinfo operation broke into the content management systems of Eastern European media outlets in a campaign to spread misinformation about NATO. Wired reports: On Wednesday, security firm FireEye released a report on a disinformation-focused group it's calling Ghostwriter. The propagandists have created and disseminated disinformation since at least March 2017, with a focus on undermining NATO and the US troops in Poland and the Baltics; they've posted fake content on everything from social media to pro-Russian news websites. In some cases, FireEye says, Ghostwriter has deployed a bolder tactic: hacking the content management systems of news websites to post their own stories. They then disseminate their literal fake news with spoofed emails, social media, and even op-eds the propagandists write on other sites that accept user-generated content. That hacking campaign, targeting media sites from Poland to Lithuania, has spread false stories about US military aggression, NATO soldiers spreading coronavirus, NATO planning a full-on invasion of Belarus, and more.

"They're spreading these stories that NATO is a danger, that they resent the locals, that they're infected, that they're car thieves," says John Hultquist, director of intelligence at FireEye. "And they're pushing these stories out with a variety of means, the most interesting of which is hacking local media websites and planting them. These fictional stories are suddenly bona fide by the sites that they're on, and then they go in and spread the link to the story."

FireEye itself did not conduct incident response analyses on these incidents and concedes that it doesn't know exactly how the hackers are stealing credentials that give them access to the content management systems that allow posting and altering news stories. Nor does it know who is behind the string of website compromises, or for that matter the larger disinformation campaign that the fake stories are a part of. But the company's analysts have found that the news site compromises and the online accounts used to spread links to those fabricated stories, as well as the more traditional creation of fake news on social media, blogs, and websites with an anti-US and anti-NATO bent, all tie back to a distinct set of personas, indicating one unified disinformation effort. FireEye's Hultquist points out that the campaign doesn't seem financially motivated, indicating a political or state backer, and notes that the focus on driving a wedge between NATO and citizens of Eastern Europe hints at possible Russian involvement.

An anonymous reader quotes a report from The New York Times: Chinese hackers infiltrated the Vatican's computer networks in the past three months , a private monitoring group has concluded, in an apparent espionage effort before the beginning of sensitive negotiations with Beijing. The attack was detected by Recorded Future, a firm based in Somerville, Mass. The Chinese Communist Party has been waging a broad campaign to tighten its grip on religious groups, in what government leaders have periodically referred to as an effort to "Sinicize religions" in the country.

China officially recognizes five religions, including Catholicism, but the authorities often suspect religious groups and worshipers of undermining the control of the Communist Party and the state, and of threatening the country's national security. Chinese hackers and state authorities have often used cyberattacks to try to gather information on groups of Buddhist Tibetans, Muslim Uighurs and Falun Gong practitioners outside China. But this appears to be the first time that hackers, presumed by cybersecurity experts at Recorded Future to be working for the Chinese state, have been publicly caught directly hacking into the Vatican and the Holy See's Study Mission to China, the Hong Kong-based group of de facto Vatican representatives who have played a role in negotiating the Catholic Church's status. The Vatican and Beijing are expected to start talks in September over control of the appointment of bishops and the status of houses of worship as part of a renewal of a provisional agreement signed in 2018 that revised the terms of the Catholic Church's operations in China. One of the attacks, which began in early May, was hidden inside a document that appeared to be a legitimate letter from the Vatican to Msgr. Javier Corona Herrera, the chaplain who heads the study mission in Hong Kong," reports The New York Times.

"It was an artful deception: an electronic file that looked as if it was on the official stationery of Archbishop Edgar Pena Parra. The letter carried a message from Cardinal Pietro Parolin, the Vatican's secretary of state, the pope's second in command and an old China hand who has defended the deal. In his message, Cardinal Parolin expressed the pope's sadness about the death of a bishop. It is unclear whether the letter was fabricated or a real document that the attackers had obtained and then linked to malware that gave them access to the computers of the Hong Kong church offices and the Vatican's mail servers. Recorded Future concluded that the attack was most likely connected to negotiations over the extension of the 2018 agreement."

An anonymous reader quotes a report from TechCrunch: Online alcohol delivery startup Drizly has told customers that it was hit by a data breach. In an email to customers obtained by TechCrunch, the company said that a hacker "obtained" some customer data. The hacker took customer email addresses, date-of-birth, hashed passwords, and in some cases delivery addresses, the email read. Some 2.4 million Drizly accounts are believed to have been stolen. TechCrunch obtained a portion of the data, including several accounts of Drizly staff members. We verified the data against public records. The portion of data we obtained also contains user phone numbers, IP addresses, and geolocation data associated with the user's billing address.

Drizly did not say when the hack occurred or how many accounts were affected, but did advise users to change their passwords. The company said that no financial data was taken in the breach. But a listing on a dark web marketplace from a well-known seller of stolen data claims otherwise. The listing, which we are not linking to, claims to have "fresh hacked" [sic] Drizly accounts. The data is on sale for $14, at the time of writing . The seller did not say when the breach took place, but the listing appears to have been posted on February 13. Although no sample of data was offered, the listing claims to have valid Drizly credit card numbers and users' order history.

whh3 writes: The Wall Street Journal has an "exclusive" scoop about a report detailing that several counties host their own mail servers using a version of Exim that is vulnerable to exploitation (Warning: source paywalled; alternative source), exposing electing officials to potential interference during the upcoming cycle. "[Cybersecurity vendor Area 1 Security Inc.] found that officials in six small jurisdictions in Michigan, Missouri, Maine and New Hampshire, for example, were using a buggy version of a free software product called Exim, which has been linked to online attacks conducted by the Russian intelligence service known as the GRU," reports The Wall Street Journal. The report itself is online here. "The report, compiled by cybersecurity group Area 1 Security, found that over 50 percent of election administrators have 'only rudimentary or non-standard technologies' to protect against malicious emails from cyber criminals, with less than 30 percent using basic security controls to halt phishing emails," adds The Hill. "The study also found that around 5 percent of election administrators use personal emails, which are seen as less secure than government emails."

The researchers wrote in the report: "The disparate approaches to cybersecurity by state, local and county officials is such that should a cybersecurity incident occur in one small town, whether in a 'battleground state' or not, even if statistically insignificant, could cause troubling ripple effects that erode confidence in results across the entire country." They noted that 90 percent of cyberattacks begin with a phishing email.

An anonymous reader quotes a report from the BBC: The American GPS and fitness-tracker company Garmin is dealing with the aftermath of a ransomware attack, the BBC has confirmed. Owners of its products had been unable to use its services since Thursday. However, some of its online tools are now being provided in a "limited" state, according to its online dashboard. Garmin has said it was "the victim of a cyber-attack that encrypted some of our systems." But the statement it released avoided any reference to a ransom demand.

"Many of our online services were interrupted including website functions, customer support, customer-facing applications, and company communications," it said. "We have no indication that any customer data, including payment information from Garmin Pay, was accessed, lost or stolen." The firm added that it expected all its systems to return to normal operation within a few days, but warned that there might be a "backlog" of user data to process. It is not known if the firm paid the blackmailers, but a source told the BBC it was in the "final stage of recovery." Some customers have already reported that Garmin's services appear to be "partially" working again.

If you've ever wanted to build a real and working Windows 95 PC inside Minecraft, now is the time. From a report: A new VM Computers mod has been created for Minecraft that allows players to order computer parts from a satellite orbiting around a Minecraft world and build a computer that actually boots Windows 95 and a variety of other operating systems. The mod uses VirtualBox, free and open-source virtual machine software, to run operating systems like Windows 95. Within Minecraft you simply place a PC case block and then use it to create virtual hard drives to install operating systems from ISO files. Naturally, the Minecraft community has been experimenting with the VM Computers mod, and someone has managed to get Doom running within Minecraft as a result.

An anonymous reader quotes a report from Ars Technica: A massive leak of apparent Nintendo source code is giving gamers a rare, unauthorized look at Nintendo's development process dating back to the Super NES era. The massive trove of files, first posted to 4chan Friday and quickly dubbed the "Gigaleak" by the community, includes compilable code and assets for Super NES, Game Boy, and N64 games in the Mario, Mario Kart, Zelda, F-Zero, and Pokemon series. Hidden among that code is a bevy of pre-release art and sound files that have never seen the light of day, as well as fully playable prototype versions of some games. Modders and homebrew developers have been digging through the trove of data over the weekend and taking to Twitter and YouTube with their discoveries. Among the most interesting findings:

- A version of Super Mario 64 including data for a 3D model of Luigi (likely for the scrapped two-player mode). Players have inserted that model into the ROM to create video of Luigi running around. The leak also includes few unused test rooms for the game.
- A Yoshi's Island prototype featuring differences in the map screen, interface, music (and including the prefix "Super Mario Bros. 5" in Japanese). The prototype also features two apparently unused mini-games (No. 1, No. 2) and some unused test levels.
- Pokemon prototypes featuring early and unused sprite designs for many monsters.
- An original prototype named "Super Donkey" featuring a Rayman-style character in a Yoshi's Island-styled world [Update: A previous version of this post mischaracterized the music in this video. Ars regrets the error].
- Sprite data for Luigi giving an apparent middle finger and Bowser outside of his clown-copter in Super Mario World. The code also contains multiple early designs for Yoshi (some of which match art previously revealed in interviews with Nintendo developers) and a completely new map screen design (which also matches previously revealed screenshots).
- A version of Star Fox 2 with previously unseen characters.
- High-quality voice samples from Star Fox 64, F-Zero X and Super Mario 64 before they were compressed to fit on relatively small N64 cartridges.
- Graphics for a Pilotwings prototype called Dragonfly, previously seen only in grainy magazine screenshots.

Waydev, an analytics platform used by software companies, has disclosed a security breach that occurred earlier this month. From a report: The company says that hackers broke into its platform and stole GitHub and GitLab OAuth tokens from its internal database. Waydev, a San Francisco-based company, runs a platform that can be used to track software engineers' work output by analyzing Git-based codebases. To do this, Waydev runs a special app listed on the GitHub and GitLab app stores. When users install the app, Waydev receives an OAuth token that it can use to access its customers' GitHub or GitLab projects. Waydev stores this token in its database and uses it on a daily basis to generate analytical reports for its customers. Waydev CEO and co-founder Alex Circei told ZDNet today in a phone call that hackers used a blind SQL injection vulnerability to gain access to its database, from where they stole GitHub and GitLab OAuth tokens. The hackers then used some of these tokens to pivot to other companies' codebases and gain access to their source code projects.

Australia's competition regulator on Monday accused Alphabet's Google of misleading consumers to get permission for use of their personal data for targeted advertising, seeking a fine "in the millions" and aiming to establish a precedent. From a report: The move comes as scrutiny grows worldwide over data privacy, with U.S. and European lawmakers recently focusing on how tech companies treat user data. In court documents, the Australian Competition and Consumer Commission (ACCC) accused Google of not explicitly getting consent or properly informing consumers of a 2016 move to combine personal information in Google accounts with browsing activities on non-Google websites. "This change ... was worth a lot of money to Google," said commission chairman Rod Sims. "We allege they've achieved it through misleading behaviour." The change allowed Google to link the browsing behaviour of millions of consumers with their names and identities, providing it with extreme market power, the regulator added. "We consider Google misled Australian consumers about what it planned to do with large amounts of their personal information, including internet activity on websites not connected to Google," Sims said.

"Digital banking app and tech unicorn Dave.com confirmed today a security breach," reports ZDNet, "after a hacker published the details of 7,516,625 users on a public forum." In an email to ZDNet today, Dave said the security breach originated on the network of a former business partner, Waydev, an analytics platform used by engineering teams... The company said it has already plugged the hacker's point of entry and is in the process of notifying customers of the incident. Dave app passwords are also being reset after being exposed.

"As soon as Dave became aware of this incident, the company immediately initiated an investigation, which is ongoing, and is coordinating with law enforcement, including with the FBI around claims by a malicious party that it has 'cracked' some of these passwords and is attempting to sell Dave customer data," Dave said. The company also brought in cyber-security firm CrowdStrike to assist the investigation...

The data includes a wealth of information, such as real names, phone numbers, emails, birth dates, and home addresses.

An anonymous reader writes: An unknown vigilante hacker has been sabotaging the operations of the recently-revived Emotet botnet by replacing Emotet payloads with animated GIFs, effectively preventing victims from getting infected. The sabotage, which started on July 21, has grown from a simple joke to a serious issue impacting a large portion of the Emotet operation, reducing the biggest malware botnet today to a quarter of its daily capabilities.

Since the attack started, the vigilante has replaced Emotet payloads with this Blink 182 "WTF" GIF, a James Franco GIF, and the Hackerman GIF from the Kung Fury movie.
The article points out this is all possible because Emotet stashes its malware on Wordpress sites they've breached with web shells — all of which have the exact same password.

A digital nomad describes what no one ever warns you about after selling everything and then travelling to Singapore, Malaysia, Vietnam, and Thailand "before doing the Working Holiday Visa thing in Australia and New Zealand." It was the greatest solo travel adventure of my life and I loved it. That said, I've had some time to reflect on my experience and there are some things I wish I'd known before diving in headfirst... [I]n reality, you're working just as hard, only from a different place. You still have deadlines...and you still have to hound clients who take forever to pay you after your project is done.

Did I mention that this is all done in a completely different time zone from the people you're working with? This can also be tricky when it comes to conference calls but nothing you can't figure out and plan for.

While you may have given yourself a more beautiful backdrop to work with, you're still going to spend a decent amount of time behind your laptop wherever you go, though on the bright side, you will also have the opportunity to work alongside the locals, hear different accents, taste new and amazing food and check out your new surroundings whenever you're off, so it's all good...
I once spent six months living "on the road" as a digital nomad, which felt like a nice long extended trip (rather than settling for an exotic one-week vacation). But it'd be interesting to hear anecdotes from Slashdot's readers — so share your own thoughts and experiences in the comments.

And is work easier for digital nomads?

On Thursday long-time Slashdot reader PuceBaboon wrote: Ars Technica is reporting a new attack on unprotected databases which, to date, has deleted all content from over 1,000 ElasticSearch and MongoDB databases across the 'net, leaving the calling-card "meow" in its place.

Most people are likely to find this a lot less amusing than a kitty video, so if you have a database instance on a cloud machine, now would be a good time to verify that it is password protected by something other than the default, install password...
From the article: The attack first came to the attention of researcher Bob Diachenko on Tuesday, when he discovered a database that stored user details of the UFO VPN had been destroyed. UFO VPN had already been in the news that day because the world-readable database exposed a wealth of sensitive user information... Besides amounting to a serious privacy breach, the database was at odds with the Hong Kong-based UFO's promise to keep no logs. The VPN provider responded by moving the database to a different location but once again failed to secure it properly. Shortly after, the Meow attack wiped it out.
"Attacks have continued and are getting closer to 4,000," reports Bleeping Computer. "A new search on Saturday using Shodan shows that more than 3,800 databases have entry names matching a 'meow' attack. More than 97% of them are Elastic and MongoDB."

emil (Slashdot reader #695) writes: The advent of quantum computing poses a well-recognized threat to RSA and other well-known asymmetric cryptosystems. It has been four years since NIST opened the post-quantum cryptography competition, and we are seeing extensive delays compared to AES.

A new and (hopefully) quantum-secure SSH key exchange, based on NTRU Prime, has been present in OpenSSH since January 2019, first implemented in TinySSH shortly before. This key exchange is marked by OpenSSH as experimental, and not enabled by default.

For those ready to evaluate NTRU Prime, or otherwise seeking an SSH server with "state-of-the-art crypto" (as described by TinySSH author Jan Mojí), a complete procedure for a Musl build and Busybox container deployment is presented, with additional focus on supplemental servers and key conversion.

An anonymous reader quotes a report from Ars Technica: President Trump's re-election campaign has accused Verizon, AT&T, and T-Mobile of "suppression of political speech" over the carriers' blocking of spam texts sent by the campaign. The fight was described Wednesday in an in-depth article by Business Insider and other reports. "The Trump campaign has been battling this month with the biggest US cellphone carriers over an effort to blast millions of cell users with texts meant to coax them to vote or donate," Business Insider wrote. "President Donald Trump's adviser and son-in-law, Jared Kushner, didn't appreciate it when AT&T, Verizon, and T-Mobile blocked mass campaign texts to voters. He called the companies to complain, setting off the legal wrangling."

When contacted by Ars, a Trump campaign spokesperson said that "any effort by the carriers to restrict the campaign from contacting its supporters is suppression of political speech. Plain and simple." The Trump campaign statement also said it "stands by the compliance of its texting programs" with the US Telephone Consumer Protection Act (TCPA) and Federal Communications Commission guidelines. Business Insider wrote that "the showdown got serious at the start of July when Trump's team sent a blast of texts to people who hadn't signed up for them," and "a third-party firm hired to screen such messages for the major cellphone companies blocked the texts." The article said that campaign lawyers and the carriers "are still fighting over what kinds of messages the campaign is allowed to send and what the companies have the power to stop." Politico wrote about the dispute on Monday. "People familiar with the chain of events said Verizon, T-Mobile and AT&T flagged potential regulatory problems with the peer-to-peer messaging operation, which differs from robo-texting in that texts are sent individually, as opposed to a mass blast," Politico wrote. "But within Trump's orbit, the episode has further fueled suspicions that big tech companies are looking to influence the election." The Trump campaign has not explained why the texts are legal and shouldn't have been blocked. They also didn't say how many people they tried to send the texts to, or whether the texts were unsolicited or sent to people who had signed up for campaign communications.

Carriers "viewed the texts as a possible violation of federal anti-robocall laws and Federal Communications Commission rules that come with hefty fines," Business Insider reported, citing information provided by "two Republicans familiar with the effort." Trump "campaign operatives" contend that its texting "exists in a legal gray area that allows campaigns to blast cellphone users if the messages are sent manually," Business Insider also wrote.