Amazon has asked its employees to delete the Chinese-owned video app TikTok from their cellphones, citing "security risks," according to a company email sent on Friday. From a report: In the email, which was obtained by The New York Times, Amazon officials said that employees must delete the app from any devices that "access Amazon email." Employees had to remove the app by Friday to remain able to obtain mobile access to their Amazon email, the note said. Amazon workers are still allowed to view TikTok from their laptop browser, the company added. Amazon and TikTok did not immediately respond to requests for comment. TikTok, which has been popular with young audiences in the United States, is owned by the Chinese tech company ByteDance. It has been under scrutiny in Washington for security reasons because of its ownership. Mike Pompeo, the Secretary of State, said on Monday that the Trump administration was considering blocking some Chinese apps, which he has called a threat to national security. Updated at 21:01GMT: In a statement, Amazon said the email was sent by accident. "This morning's email to some of our employees was sent in error. There is no change to our policies right now with regard to TikTok."

Pre-installed malware has been discovered on another budget handset connected to Assurance Wireless by Virgin Mobile. ZDNet reports: Back in January, cybersecurity researchers from Malwarebytes discovered unremovable malware bundled with the Android operating systems on the Unimax (UMX) U686CL, a low-end handset sold by Assurance Wireless as part of the Lifeline Assistance program, a 1985 U.S. initiative which subsidizes telephone services for low-income families. There was no way to remove a pair of apps on the handsets which would install other software on the devices without the user's knowledge.

Now, Malwarebytes has uncovered another budget handset with similar security issues. The smartphone in question is the ANS (American Network Solutions) UL40, running Android OS 7.1.1. [...] In the same way as the UMX U686CL, two apps -- a settings app and wireless update app -- are compromised. However, these apps are not infected with the same malware variants; instead, Collier says the "infections are similar but have their own unique infection characteristics." The Settings app is detected as Downloader Wotby, a Trojan that is able to download apps externally. The researchers did not find any evidence of malicious apps in a third-party store linked to the software but noted this doesn't mean that malicious apps could not be added or find their way into the store at a later date. The WirelessUpdate app is considered a Potentially Unwanted Program (PUP) that is also able to automatically install apps without user permission or knowledge. While the app does function as an over-the-air updater for security fixes and as an updater to the operating system itself, the software also installs four variants of HiddenAds, a Trojan family found on Android handsets. Thankfully, Malwarebytes has instructions on how to stop HiddenAds infections.

AI researchers have created a language-model testing tool that discovers major bugs in commercially available cloud AI offerings from Amazon, Google, and Microsoft. Yesterday, a paper detailing the CheckList tool received the Best Paper award from organizers of the Association for Computational Linguistics (ACL) conference. From a report: NLP models today are often evaluated based on how they perform on a series of individual tasks, such as answering questions using benchmark data sets with leaderboards like GLUE. CheckList instead takes a task-agnostic approach, allowing people to create tests that fill in cells in a spreadsheet-like matrix with capabilities (in rows) and test types (in columns), along with visualizations and other resources. Analysis with CheckList found that about one in four sentiment analysis predictions by Amazon's Comprehend change when a random shortened URL or Twitter handle is placed in text, and Google Cloud's Natural Language and Amazon's Comprehend makes mistakes when the names of people or locations are changed in text. "The [sentiment analysis] failure rate is near 100% for all commercial models when the negation comes at the end of the sentence (e.g. 'I thought the plane would be awful, but it wasn't'), or with neutral content between the negation and the sentiment-laden word," the paper reads.

The new lightweight and royalty-free AVIF image format is coming to web browsers. Work is almost complete on adding AVIF support to Google Chrome and Mozilla Firefox. From a report: The new image format is considered one of the lightest and most optimized image compression formats, and has already gained praise from companies such as Netflix, which considers it superior to existing image formats such as JPEG, PNG, and even the newer WebP. The acronym of AVIF stands for AV1 Image File Format. As its name hints, AVIF is based on AV1, which is a video codec that was developed in 2015, following a collaboration between Google, Cisco, and Xiph.org (who also worked with Mozilla). At the time, the three decided to pool their respective in-house video codecs (VPX, Thor, and Daala) to create a new one (AV1) that they planned to offer as an open-source and royalty-free alternative to all the commercial video codecs that had fragmented and clogged the video streaming market in the late 2000s and early 2010s.

Microsoft today published technical details about a new security feature that will soon be part of Windows 10. From a report: Named Kernel Data Protection (KDP), Microsoft says this feature will block malware or malicious threat actors from modifying (corrupting) the operating system's memory. According to Microsoft, KDP works by giving developers access to programmatic APIs that will allow them to designate parts of the Windows kernel as read-only sections. "For example, we've seen attackers use signed but vulnerable drivers to attack policy data structures and install a malicious, unsigned driver," Microsoft's Base Kernel Team said today. "KDP mitigates such attacks by ensuring that policy data structures cannot be tampered with." Microsoft says this new technology was developed with security in mind but that it also has other applications, such as anti-cheat and digital rights management (DRM) software.

Security researchers say a smartwatch, popular with the elderly and dementia patients, could have been tricked into letting an attacker easily take control of the device. From a report: These watches are designed to help patients to easily call their carers and for carers to track the location of their patients. They come with their own cellular connection, so that they work anywhere. But researchers at U.K.-based security firm Pen Test Partners found that they could trick the smartwatch into sending fake "take pills" reminders to patients as often as they want, they said. "A dementia sufferer is unlikely to remember that they had already taken their medication," wrote Vangelis Stykas in a blog post. "An overdose could easily result." The vulnerabilities were found in the back-end cloud system, known as SETracker, which powers the smartwatch.

schwit1 shares a report from Tom's Guide: Using its own analytical software, the [Fraunhofer Institute] tested the most recently available firmware for 117 home Wi-Fi models currently sold in Europe, including routers from ASUS, D-Link, Linksys, Netgear, TP-Link, Zyxel and the small German brand AVM. The models themselves were not physically tested. A full list of the tested models and firmware is on GitHub. The institute was not able to examine the firmware of 10 more models, mostly from Linksys. The report notes (PDF) that many firmware updates are issued without fixing known flaws.

So what can you do? You can make sure that the next router you buy automatically installs firmware updates. You can check to see whether your current router does so, or makes it fairly easy to install firmware updates manually. You should also make sure that the administrative password for your router has been changed from the factory default password. (Check the list of default passwords at https://www.routerpasswords.com.) You should also check its administrative interface to make sure that UPnP and remote access are disabled. And if your router was first released more than 5 years ago, consider buying a newer model unless it meets all of the above criteria. Alternatively, you could try to "flash" your older router to run more secure open-source router firmware such as OpenWrt, DD-WRT or Tomato. "The worst case regarding high severity CVEs [widely known flaws] is the Linksys WRT54GL powered by the oldest kernel found in our study," the report said, noting that this model uses the 2.4.20 kernel from 2002. "There are 579 high severity CVEs affecting this product."

"That particular model last had its firmware updated in January 2016, one of the oldest firmwares in the study," adds Tom's Guide. "The Linksys WRT54GL was first released in 2005 and is still sold today, even though it handles Wi-Fi protocols only up to 802.11g. However, the WRT54G series is possibly the best-selling family of Wi-Fi routers ever..."

An anonymous reader writes: Mozilla has temporarily suspended the Firefox Send file-sharing service as the organization investigates reports of abuse from malware operators and while it adds a "Report abuse" button. The browser maker took down the service today after ZDNet reached out to inquire about Firefox Send's increasing prevalence in current malware operations. Since last year, several malware operations have hosted payloads on the service. This includes ransomware gangs like REvil/Sodinokibi, financial crime crews like FIN7, the Zloader and Ursnif banking trojans operations, and government surveillance groups targeting human rights defenders. Reasons include the fact that Firefox Send doesn't have an Report Abuse mechanism, all file uploads are encrypted (useful to dodge malware scanners), and the Firefox URL is whitelisted in most orgs (useful for bypassing email filters).

Intel unveiled Thunderbolt 4 on Wednesday, the next iteration of the I/O specification that provides a high-speed peripheral bus to docks, displays, external storage and eGPUs for PCs. Rather than increase the available bandwidth, however, Thunderbolt 4 provides more clarity and helps create new categories of products. From a report: Thunderbolt 4 will debut later this year as part of Intel's "Tiger Lake" CPU platform, as Intel originally announced during CES in January. We now know it will support 40Gbps throughput, but with tighter minimum specs. Thunderbolt 4 will guarantee that a pair of 4K displays will work with a Thunderbolt dock, and require Thunderbolt 4-equipped PCs to charge on at least one Thunderbolt port. Thunderbolt PCs will be able to connect to either "compact" or "full" docks with up to four Thunderbolt ports. Longer Thunderbolt cables will be possible, too. One thing that doesn't seem to be changing is Thunderbolt's exclusivity. Intel developed Thunderbolt, and perhaps not coincidentally, OEM systems based on rival AMD's CPUs have never had this technology. While AMD has officially dismissed the need for Thunderbolt, with generation 4 Intel appears to have made it even harder for AMD to get it, even if it wanted to. Intel's still pitching Thunderbolt as a single standard to rule them all, but the reality up to now has been complicated. You still have to squint hard at that USB-C-shaped port to determine which of the multitude of USB specifications it meets, including whether it's a USB4 connection that happens to support Thunderbolt. To muddy things further, Thunderbolt also encompasses PCIe, DisplayPort, and USB Power Delivery standards.

schwit1 shares a report from CNN: Some popular home security cameras could allow would-be burglars to work out when you've left the building, according to a study published Monday. Researchers found they could tell if someone was in, and even what they were doing in the home, just by looking at data uploaded by the camera and without monitoring the video footage itself. The international study was carried out by researchers from Queen Mary University of London (QMUL) and the Chinese Academy of Science, using data provided by a large Chinese manufacturer of Internet Protocol (IP) security cameras. Cameras like these allow users to monitor their homes remotely via a video feed on the internet, but the researchers say the traffic generated by the devices can reveal privacy-compromising information.

Study author Gareth Tyson from QMUL told CNN that data uploads of the unencrypted data increase when a camera is recording something moving, so an attacker could tell if the camera was uploading footage of someone in motion, and even different types of motion like running or sitting. The risk is that "someone who is specifically targeting an individual household rocks up outside with a device to try and start passively monitoring traffic," he said. Tyson told CNN that an attacker would require a decent level of technical knowledge to monitor the data themselves, but there is a chance that someone could develop a program that does so and sell it online. Noting that he hasn't seen any direct evidence of this kind of attack taking place, he said one potential use would be if someone wanted to burgle your house. Tyson says companies could randomly inject data into their systems to make it harder for attackers to spot a pattern.

The study has been published at the IEEE International Conference on Computer Communications.

An anonymous reader quotes a report from Motherboard: Authorities in Germany have seized a server used by the organization that published a trove of US police internal documents commonly known as BlueLeaks, according to the organization's founder. On Tuesday, Emma Best, the founder of Distributed Denial of Secrets or DDoSecrets, a WikiLeaks-like website that has published the police data, said that prosecutors in the German town of Zwickau seized the organization's "primary public download server."

"We are working to obtain additional information, but presume it is [regarding] #BlueLeaks," Best added on Twitter. "The server was used ONLY to distribute data to the public. It had no contact with sources and was involved in nothing more than enlightening the public through journalistic publishing." Best shared a screenshot of the email they received from DDoSecrets' hosting provider informing of the server seizure. "Your server has been confiscated," the email reads. "Until now we were not allowed to inform you accordingly." The email then notes that the seizing authority was the Department of Public Prosecution Zwickau. "We're gonna get set up with a new data host and move up our plans to evolve some of our infrastructure," Best told Motherboard. "It's the perfect time for it to fall apart because we were rebuilding it anyway. It's a huge headache and a violates the ideal of press freedom, but we'll survive, even if we have to close Hunter for a time. The equivalent system they mention is blank and unconfigured, and obviously we can't rely on it."

Microsoft seems to be getting a kick out seeing users struggle to find Windows 10 features these days. After moving the Fresh Start feature in the latest version, 2004, and reducing the number of days Windows 10 Pro, Enterprise, and Education users can manually delay updates, the company is now experimenting with moving key Control Panel features, including System information, to Settings, Windows Latest blog spotted. From a report: It's a change that some long-time Windows users might not take to easily. If you're like me and have been using the Control Panel for decades, getting accustomed to this feature will be as arduous as unlearning a bad habit. To be fair, it's a bit redundant to have information on your system's specs located in three different places, not to mention all three don't show the exact same information. Currently, Windows 10 users can access hardware information about their PC in several places, but the main ways are: Control Panel > System and Security > System, and Settings > System > About, or by typing 'system information' into the search bar.

System and About show nearly the same info, what processor you have and how much RAM you have installed, for instance, except About will show you what version of Windows you have. System Information shows more detailed information about your PC, including your motherboard, GPU, and other hardware. Microsoft is trying to centralize this information, and moving forward, it seems likely that Control Panel will be killed off entirely.

Microsoft has obtained a court order this month allowing the company to seize control of six domains that were used in phishing operations against Office 365 customers, including in campaigns that leveraged COVID-19 lures. From a report: According to court documents obtained by ZDNet, Microsoft has targeted a two-person phishing operation that has been targeting the company's customers since December 2019. The duo operated by sending emails to companies that hosted email servers and enterprise infrastructure on Microsoft's Office 365 cloud service. The emails were spoofed to look like they came from fellow employees or a trusted business partner. This particular phishing operation was unique because attackers didn't redirect users to phishing sites that mimicked the Office 365 login page. Instead, hackers touted an Office document. When users tried to open the file, they were redirected to install a malicious third-party Office 365 app created by the hackers.

Andy Greenberg writes via Wired: Late last week, government agencies, including the United States Computer Emergency Readiness Team and Cyber Command, sounded the alarm about a particularly nasty vulnerability in a line of BIG-IP products sold by F5. The agencies recommended security professionals immediately implement a patch to protect the devices from hacking techniques that could fully take control of the networking equipment, offering access to all the traffic they touch and a foothold for deeper exploitation of any corporate network that uses them. Now some security companies say they're already seeing the F5 vulnerability being exploited in the wildâ"and they caution that any organization that didn't patch its F5 equipment over the weekend is already too late.

The F5 vulnerability, first discovered and disclosed to F5 by cybersecurity firm Positive Technologies, affects a series of so-called BIG-IP devices that act as load balancers within large enterprise networks, distributing traffic to different servers that host applications or websites. Positive Technologies found a so-called directory traversal bug in the web-based management interface for those BIG-IP devices, allowing anyone who can connect to them to access information they're not intended to. That vulnerability was exacerbated by another bug that allows an attacker to run a "shell" on the devices that essentially lets a hacker run any code on them that they choose. The result is that anyone who can find an internet-exposed, unpatched BIG-IP device can intercept and mess with any of the traffic it touches. Hackers could, for instance, intercept and redirect transactions made through a bank's website, or steal users' credentials. They could also use the hacked device as a hop point to try to compromise other devices on the network. Since BIG-IP devices have the ability to decrypt traffic bound for web servers, an attacker could even use the bug to steal the encryption keys that guarantee the security of an organization's HTTPS traffic with users, warns Kevin Gennuso, a cybersecurity practitioner for a major American retailer. While only a small minority of F5 BIG-IP devices are directly exploitable, Positive Technologies says that still includes 8,000 devices worldwide. "About 40 percent of those are in the U.S., along with 16 percent in China and single-digit percentages in other countries around the globe," reports Wired.

"Owners of those devices have had since June 30, when F5 first revealed the bug along with its patch, to update," adds Wired. "But many may not have immediately realized the seriousness of the vulnerability. Others may have been hesitant to take their load balancing equipment offline to implement an untested patch, points out Gennuso, for fear that critical services might go down, which would further delay a fix."

Technology firm Fujitsu announced a new "Work Life Shift" program that will offer unprecedented flexibility to its 80,000 workers in Japan. "Staff will be able to work flexible hours, and working from home will be standard wherever possible," reports the BBC. From the report: In a statement sent to the BBC, Fujitsu said it "will introduce a new way of working that promises a more empowering, productive, and creative experience for employees that will boost innovation and deliver new value to its customers and society." Under the plan employees will "begin to primarily work on a remote basis to achieve a working style that allows them to flexibly use their time according to the contents of their work, business roles, and lifestyle." The company also said the program would allow staff to choose where they worked, whether that was from home, a major corporate hub or a satellite office. Fujitsu believes that that the increased autonomy offered to its workers will help to improve the performance of teams and increase productivity.

The US Secret Service sent out a security alert last month to the US private sector and government organizations warning about an increase in hacks of managed service providers (MSPs). From a report: MSPs provide remote management software for companies. MSPs can be simple services like file-sharing systems to complete solutions that manage a customer's entire computer fleet. Most MSP services are built around a server-client software architecture. The server part can be remotely hosted with the MSP inside a clout infrastructure, or installed on-premise with the client. Usually, getting access to the server component of an MSP grants an attacker full control of all software clients. In a security alert sent out on June 12, Secret Service officials said their investigations team (GIOC -- Global Investigations Operations Center) has been seeing an increase in incidents where hackers breach MSP solutions and use them as a springboard into the internal networks of the MSP's customers. Secret Service officials said they've been seeing threat actors use hacked MSPs to carry out attacks against point-of-sale systems, to perform business email compromise (BEC) scams, and to deploy ransomware.

Long-time Slashdot reader dhammabum writes: As reported in the recent slashdot story, starting in September we system admins will be forced into annually updating TLS certificates because of a decision by Apple, abetted by Google and Mozilla. Supposedly this measure somewhat rectifies the current ineffective certificate revocation list system by limiting the use of compromised certificates to one year... But in an attempt to prevent this pathetic measure, could we instead use DNS to replace the current certificate revocation list system?

Why not create a new type of TXT record, call it CRR (Certificate Revocation Record), that would consist of the Serial Number (or Subject Key ID or thumbprint) of the certificate. On TLS connection to a website, the browser does a DNS query for a CRR for the Common Name of the certificate. If the number/key/thumbprint matches, reject the connection. This way the onus is on the domain owner to directly control their fate. The only problem I can see with this is if there are numerous certificate Alternate Names — there would need to be a CRR for each name. A pain, but one only borne by the hapless domain owner.

Alternatively, if Apple is so determined to save us from ourselves, why don't they fund and host a functional CRL system? They have enough money. End users could create a CRL request via their certificate authority who would then create the signed record and forward it to this grand scheme.

Otherwise, are there any other ideas?

"A security researcher was able to access files on a Axon body-worn camera he purchased from eBay that had video files of Fort Huachuca Military Police officers conducting investigations and filling out paperwork," reports the Arizona Mirror: The files were able to be extracted after the researcher, who goes by KF on Twitter, was able to remove a microSD card from the body-worn camera. KF was then able to extract the un-encrypted files, which were not protected by a password, using a tool called Foremost. KF shared screenshots of the footage he was able to pull from the cards that appeared to show members of the Fort Huachuca Military Police entering a person's home and filling out paperwork.

"We are aware of this issue and have launched an investigation looking into the matter," a statement from Scottsdale-based Axon said to Arizona Mirror. "We are also reevaluating our processes to better emphasize proper disposal procedures for our customers."

The camera that was purchased by KF was an Axon Body 1, one of the company's earliest generation models that launched in 2013. The company said it stopped the model in 2015. "Our latest generation camera, Axon Body 3, offers enhanced security measures such as storage encryption to protect video from being retrieved from lost or improperly disposed cameras," the statement said.
Friday the original security researcher posted an update on Twitter, saying he'd offered to send the body cam's SD card back to the military police -- an offer that was eventually accepted by Axon itself -- and "I only listened to a few seconds of audio merely to verify its presence. I've since removed all extracted data in full."

In an earlier tweet he'd added, "Those of you asking... NO, I won't dump the card for you. Procure your own BWC (Body Worn Cam), and dump it yourself " But it looks like they already are. Earlier on Twitter, one Security Operations Center analyst posted, "I just ordered two myself.

"I'd actually really like to get a fund going to buy literally all of them and dump them to an open cloud storage bucket... Freedom of Information Act through the secondhand market."

Tuesday Microsoft published two out-of-band security updates to patch two vulnerabilities in the Microsoft Windows Codecs Library, reports ZDNet: Tracked as CVE-2020-1425 & CVE-2020-1457, the two bugs only impact Windows 10 and Windows Server 2019 distributions... Microsoft said the two security flaws can be exploited with the help of a specially crafted image file. If the malformed images are opened inside apps that utilize the built-in Windows Codecs Library to handle multimedia content, then attackers would be allowed to run malicious code on a Windows computer and potentially take over the device. The two bugs -- described as two remote code execution vulnerabilities -- received patches Wednesday.

"Customers do not need to take any action to receive the update," Microsoft said.

This week finally saw the federal sentencing of a former Yahoo software engineer who "admitted to using his access through his work at the company to hack into about 6,000 Yahoo accounts" back in 2018, according to America's Department of Justice: Ruiz admitted to targeting accounts belonging to younger women, including his personal friends and work colleagues. He made copies of images and videos that he found in the personal accounts without permission, and stored the data at his home. Once he had access to the Yahoo accounts, Ruiz admitted to compromising the iCloud, Facebook, Gmail, DropBox, and other online accounts of the Yahoo users in search of more private images and videos. After his employer observed the suspicious account activity, Ruiz admitted to destroying the computer and hard drive on which he stored the images.
He stopped working at Yahoo in July of 2018. The next month the FBI visited his home. He was indicted in April of 2019 and pleaded guilty in September — facing up to five years in prison and a $250,000 fine.

But it was not until this week that a federal court finally handed down its sentence for the "former Yahoo! engineer who hacked 6,000 accounts on a hunt for private sexual videos and pictures," according to one Bay Area newspaper.

The sentence? Five years of probation, with a home confinement condition: Reyes Daniel Ruiz, 35, of Tracy, is allowed to leave his home for "verified employment, medical needs and religious services," according to the sentencing terms. He has also been ordered to pay nearly $125,000 in fines and restitution, court records show...

He also accessed financial information, but his main goal was to steal pornographic files, prosecutors said. Assistant U.S. Attorney Daniel Kaleba asked for Ruiz to be sentenced to "a period of incarceration," arguing he'd violated not only the trust of his employee but the privacy of thousands of people. "By his estimation, he downloaded approximately two terabytes of data, and possessed between 1,000 and 4,000 private images and videos," Kaleba wrote in a sentencing memo.

The defense argued that Ruiz, who has no criminal history, deserved leniency because he accepted responsibility quickly. He admitted to destroying the hard drive where he stored the ill-gotten files when the FBI visited his home in August 2018. Ruiz told federal investigators that he acquired the pictures and videos for his own personal "self-gratification" and that he didn't share them online, a pre-sentence report says.
In October Gizmodo reported that Ruiz was now working for a Silicon Valley company specializing in SSO (single sign-on) solutions.