Nintendo has almost doubled the number of user accounts compromised by hackers in the past few months. From a report: The Japanese gaming giant originally said that 160,000 Nintendo accounts were compromised, exposing personal information like the account owner's name, email address, date-of-birth and their country of residence. In an updated statement, the company said another 140,000 Nintendo accounts had been compromised. Nintendo said the number increased as a result of its continuing investigation. The company said it reset those passwords and contacted customers. The statement reiterated that fewer than 1% of all accounts were impacted by the breach. News of account compromises came as early as March when users complained that their accounts were charged for digital items without their permission. Nintendo said in a tweet in April that users should enable two-factor authentication on their accounts but without saying why.

A study that analyzed the top 54 open source projects found that security vulnerabilities in these tools doubled in 2019, going from 421 bugs reported in 2018 to 968 last year. From a report: According to RiskSense's "The Dark Reality of Open Source" report, released today, the company found 2,694 bugs reported in popular open source projects between 2015 and March 2020. The report didn't include projects like Linux, WordPress, Drupal, and other super-popular free tools, since these projects are often monitored, and security bugs make the news, ensuring most of these security issues get patched fairly quickly. Instead, RiskSense looked at other popular open source projects that aren't as well known but broadly adopted by the tech and software community. This included tools like Jenkins, MongoDB, Elasticsearch, Chef, GitLab, Spark, Puppet, and others. RiskSense says that one of the main problems they found during their study was that a large number of the security bugs they analyzed had been reported to the National Vulnerability Database (NVD) many weeks after they've been publicly disclosed. The company said it usually took on average around 54 days for bugs found in these 54 projects to be reported to the NVD, with PostgreSQL seeing reporting delays that amounted to eight months.

The following report appeared on Yahoo! Finance: Privacy-focused browser Brave was found to autocomplete several websites and keywords in its address bar with an affiliate code. Shortly after a user published his findings, Brave CEO and co-founder Brendan Eich addressed the incident and called it "a mistake we're correcting." Eich said that while Brave is a Binance affiliate [a cryptocurrency exchange], the browser's autocompleting feature should not have added any new affiliate codes.

"The autocomplete default was inspired by search query clientid attribution that all browsers do, but unlike keyword queries, a typed-in URL should go to the domain named, without any additions," Eich wrote in the thread. "Sorry for this mistake — we are clearly not perfect, but we correct course quickly," he added.
Android Police reports the mistake occured more than 10 weeks ago — and that referrer codes were also included for other cryptocurrency-related sites: The browser's GitHub repository reveals the functionality was first added on March 25th, and the current list of sites includes Binance, Coinbase, Ledger, and Trezor. Brave Software receives a kickback for purchases/accounts made with those services — for example, Coinbase says that when you refer a new customer to the service, you can earn 50% of their fees for the first three months.

The nature of these affiliate programs also allows the referrer — in this case, Brave Software — to view some amount of data about the customers who sign up with the code. Coinbase's program provides "direct access to your campaign's performance data," while Trezor offers a "detailed overview of purchases."
Brave CEO and co-founder Brendan Eich (who also created the JavaScript programming language) tweeted, "For what it's worth there's a setting to disable the autocomplete defaults that add affiliate codes, in brave://settings first page. Current plan is to flip default to off as shown here. You can disable ahead of our release schedule if you want to.

"Good to hear from supporters who'll enable it."

Last month Techcrunch reported that Mozilla had gone "full incubator" by holding a startup lab called Fix the Internet, followed by "a formal program dangling $75,000 investments in front of early-stage companies..."

Fix the Internet had many key themes, including collaboration and decentralization (as well as user-controlled data and privacy-protecting social networks). That event "drew the interest of some 1,500 people in 520 projects, and 25 were chosen to receive the full package and stipend during the development of their minimum viable product (MVP). Below that, as far as pecuniary commitment goes, is the 'MVP Lab,' similar to the spring program but offering a total of $16,000 per team."

And one of those MVP Lab teams is Meething, a new video conferencing and collaboration platform from the innovation lab ERA. Meething "aims to be more secure than existing video conferencing tools and run on a decentralized database engine and leverage peer-to-peer networking" according to ZDNet.

In their video interview with CEO Mark Nadal, he outlined the following selling points:

• Browser based video conferencing gives customers better options for security as well as branding.
• Open source architecture is a win and the peer-to-peer networking is more efficient on compute costs.
• Meething doesn't require downloads or apps that increase the security attack surface.
  
  The total addressable market for video conferencing is large and can support multiple players.

Their press release quotes Mark Mayo, a former Chief Product Officer at Mozilla who served as Meething's mentor, arguing that video conferencing on the web "has long promised to enable a whole new world of online collaboration. Frankly, it hasn't delivered. It's been way too hard to build cool products with video and Meething aims to be the zero-barrier-to-entry platform that realizes this future. Soon, video conferencing won't suck!"

"A newly uncovered form of ransomware is going after Windows and Linux systems," reports ZDNet, "in what appears to be a targeted campaign." Named Tycoon after references in the code, this ransomware has been active since December 2019 and looks to be the work of cyber criminals who are highly selective in their targeting. The malware also uses an uncommon deployment technique that helps stay hidden on compromised networks. The main targets of Tycoon are organisations in the education and software industries.

Tycoon has been uncovered and detailed by researchers at BlackBerry working with security analysts at KPMG. It's an unusual form of ransomware because it's written in Java, deployed as a trojanised Java Runtime Environment and is compiled in a Java image file (Jimage) to hide the malicious intentions... [T]he first stage of Tycoon ransomware attacks is less uncommon, with the initial intrusion coming via insecure internet-facing Remote Desktop Protocol servers. This is a common attack vector for malware campaigns and it often exploits servers with weak or previously compromised passwords. Once inside the network, the attackers maintain persistence by using Image File Execution Options (IFEO) injection settings that more often provide developers with the ability to debug software. The attackers also use privileges to disable anti-malware software using ProcessHacker in order to stop removal of their attack...

After execution, the ransomware encrypts the network with files encrypted by Tycoon given extensions including .redrum, .grinch and .thanos — and the attackers demand a ransom in exchange for the decryption key. The attackers ask for payment in bitcoin and claim the price depends on how quickly the victim gets in touch via email.

The fact the campaign is still ongoing suggests that those behind it are finding success extorting payments from victims.

New submitter IBMResearch shares a report from ZDNet: IBM's new toolkit aims to give developers easier access to fully homomorphic encryption (FHE), a nascent technology with significant promise for a number of security use cases. "Today, files are often encrypted in transit and at rest but decrypted while in use, creating a security vulnerability," reports ZDNet. "This often compels organizations to make trade-offs and go through long vetting processes in order to ensure they can keep their valuable data protected while still gaining some value out of it. FHE aims to resolve that issue."

"While the technology holds great potential, it does require a significant shift in the security paradigm," the report adds. "Typically, inside the business logic of an application, data remains decrypted, [Flavio Bergamaschi, FHE pioneer and IBM Researcher] explained. But with the implementation of FHE, that's no longer the case -- meaning some functions and operations will change."

The toolkit is available today in GitHub for MacOS and iOS, and it will soon be available for Linux and Android.

Earlier this week video conferencing service Zoom said it will not offer its forthcoming, complete version of end-to-end encryption to its free users so that it can work better with law enforcement to curb abuse on the platform. Matthew Green, who teaches cryptography at Johns Hopkins, looks at the broader implication of this move: Obviously I don't think you should have to pay for E2E encryption. The thing that's really concerning me is that there's a strong push from the US and other governments to block the deployment of new E2E encryption. You can see this in William Barr's "open letter to Facebook." But this is part of an older trend. Law enforcement and intelligence agencies can't get Congress to ban E2E, so they're using all the non-legislative tools they have to try to stop it. And, it turns out, this works. Not against the big entrenched providers who have already deployed E2E. But against the new upstarts who want to use crypto to solve trust problems.

And the Federal government has an enormous amount of power. Power over tools like Section 230. Power to create headaches for people. But even without Congressional assistance, the executive branch has vast power to make procurement and certification decisions. So if you're a firm that wants to deploy E2E to your customers, even if there's a pressing need, you face the specter of going to war with an immensely powerful government that has very strong negative feelings about broad access to encryption. And this is a huge problem. Because some companies have infrastructure all over the world. Some companies carry incredibly valuable and sensitive corporate data (even at their "free" tiers) and there are people who want that data. Encryption is an amazing tool to protect it. The amazing thing about this particular moment is that, thanks to a combination of the pandemic forcing us all online, more people than ever are directly exposed by this. "Communications security" isn't something that only activists and eggheads care about. Now for companies that are exposed to this corrupt dynamic, there's an instinct to try to bargain. Split the baby in half. Deploy E2E encryption, but only maybe a little of it. E2E for some users, like paying customers and businesses, but not for everyone. And there's some logic to this position.

The worst crimes, like distribution of child abuse media, happen in the free accounts. So restricting E2E to paid accounts seems like an elegant compromise, a way to avoid getting stepped on by a dragon. But I personally think this is a mistake. Negotiating with a dragon never ends well. And throwing free-tier users into the dragon's mouth feels even worse. But the real takeaway, and why I hope maybe this issue will matter to you, is that if the Federal government is able to intimidate one company into compromising your security. Then what's going to happen to the next company? And the next? Once the precedent is set that E2E encryption is too "dangerous" to hand to the masses, the genie is out of the bottle. And once corporate America accepts that private communications are too politically risky to deploy, it's going to be hard to put it back. Anyway, this might be an interesting academic debate if we were in normal times. But we're not. Anyone who looks at the state of our government and law enforcement systems -- and feels safe with them reading all our messages -- is living in a very different world than I am.

Apple today informed developers that it has launched a new open source project that's designed to let those who develop password management apps create strong passwords compatible with popular websites. From a report: The new Password Manager Resources open source project allows password management apps to integrate website-specific requirements used by the iCloud Keychain password manager to generate strong, unique passwords. "Many password managers generate strong, unique passwords for people, so that they aren't tempted to create their own passwords by hand, which leads to easily guessed and reused passwords. Every time a password manager generates a password that isn't actually compatible with a website, a person not only has a bad experience, but a reason to be tempted to create their own password. Compiling password rule quirks helps fewer people run into issues like these while also documenting that a service's password policy is too restrictive for people using password managers, which may incentivize the services to change," the company said.

Slack is partnering with Amazon in a multi-year agreement that means all Amazon employees will start to use Slack. The Verge reports: The deal comes just as Slack faces increased competition from Microsoft Teams, and it will also see Slack migrate its voice and video calling features over to Amazon's Chime platform alongside a broader adoption of Amazon Web Services (AWS). Amazon's roll out of Slack to all of its employees is a big part of the deal, thanks to an enterprise-wide agreement. It's not immediately clear how many of Amazon's 840,000 employees will be using Slack, though. Up until today, Slack's biggest customer has been IBM, which is rolling out Slack to its 350,000 employees.

While Slack has long used AWS to power parts of its chat app, it's now committing to using Amazon's cloud services as its preferred partner for storage, compute, database, security, analytics, machine learning, and future collaboration features. The deal means it's unlikely we'll see Slack turn to Microsoft's Azure cloud services or Google Cloud to power parts of its service in the foreseeable future. [...] Slack and Amazon are also promising better product integration and interoperability for features like AWS Chatbot, a service that pushes out Slack channel alerts for AWS instances. In the coming months, Slack and AWS will improve its Amazon AppFlow integration to support bi-directional transfer of data between AWS services and Slack channels.

Websites are still capable of detecting when a visitor is using Chrome's incognito (private browsing) mode, despite Google's efforts last year to disrupt the practice. From a report: It is still possible to detect incognito mode in Chrome, and all the other Chromium-based browsers, such as Edge, Opera, Vivaldi, and Brave, all of which share the core of Chrome's codebase. Furthermore, developers have taken the scripts shared last year and have expanded support to non-Chrome browsers, such as Firefox and Safari, allowing sites to block users in incognito mode across the board. Currently, there is no deadline for a new Chrome update to block incognito mode detections, however, today, Google might be interested more than ever in fixing this issue.

AndroidPolice: Dropbox just unceremoniously dumped a brand new app on the Play Store with no fanfare or formal announcement. The new Dropbox Passwords app, according to its listing, is a password manager available exclusively in an invite-only private beta for some Dropbox customers. Based on screenshots and description, the app seems pretty barebones -- or "minimal," depending on your tastes. Dropbox seems to intentionally avoid calling it a "password manager," though its functionality otherwise appears about the same as other solutions. Like other password managers, Dropbox Password can generate passwords for new accounts as required and sync them remotely so you can access all your passwords on multiple devices. It also uses zero-knowledge encryption to store those passwords remotely.

Law enforcement officials across the U.S. have already revealed that they will leverage facial recognition technology to retroactively target protesters following the killing of George Floyd, with police asking the public for footage and photos. Against this backdrop, Signal is introducing a new feature that can automatically obfuscate faces shared within the encrypted messaging app, as the company says it's "working hard to keep up with the increased traffic" from protesters. From a report: Moving forward, Signal users will be able to activate a feature in the main photo editing toolbox that will automatically blur all faces it identifies in an image. As with many automated computer vision tools, Signal doesn't claim that its face-blurring smarts are 100% effective. It may not identify all faces in a photo, which is why users can manually obscure faces by drawing the blur brush across each face with their finger.

An anonymous reader quotes a report from the BBC: Cyber-attacks against anti-racism organizations shot up in the wake of the death of George Floyd, a leading provider of protection services says. Cloudflare, which blocks attacks designed to knock websites offline, says advocacy groups in general saw attacks increase 1,120-fold. Mr Floyd's death, in police custody, has sparked nationwide civil unrest in the US. Government and military websites also saw a notable increase in attacks. Cloudflare says that after Mr Floyd's death and the ensuing violent clashes between police and protesters, it saw a noticeable jump in the amount of requests it blocked -- an extra 19 billion (17%) from the corresponding weekend the previous month. That equates to an extra 110,000 blocked requests every second, it said.

The problem was particularly acute for certain types of organizations. One single website belonging to an unnamed advocacy group dealt with 20,000 requests a second. Anti-racism groups which belong to Cloudflare's free program for at-risk organizations saw a large surge in the past week, from near-zero to more than 120 million blocked requests. Attacks on government and military websites were also up — by 1.8 and 3.8 times respectively.

schwit1 shares news that UK Prime Minister Boris Johnson said he would be willing to allow more than 2.8 million people from Hong Kong to live and work in the country if China implements a controversial proposed national security law on the former British colony. The law could take effect as soon as this month, and would expand mainland China's control over Hong Kong. NPR reports: Johnson wrote in a column that appeared in The Times of London that the law would infringe on the "one country, two systems" agreement China reached with Britain in 1997 when Britain ceded control of the territory. He added that the law "would curtail [Hong Kong's] freedoms and dramatically erode its autonomy."

If China were to implement the law, Johnson wrote, Britain is prepared to take in around 350,000 people from Hong Kong who already have British National (Overseas) passports and 2.5 million who would be eligible to apply for them. He also noted that the U.K. would be making "one of the biggest changes in our visa system in history." It would allow Hong Kongers with these passports to come to the U.K. for a renewable period of a year. The current system allows them to come without a visa for up to six months. The potential new system would include a right to work and, potentially, a path to citizenship. Johnson did not elaborate in the column about how the 2.5 million people eligible for a British passport would be able to attain one, or how arrivals from Hong Kong would attain citizenship. "Many people in Hong Kong fear that their way of life -- which China pledged to uphold -- is under threat," Johnson wrote. "If China proceeds to justify their fears, then Britain could not in good conscience shrug our shoulders and walk away... I still hope that China will remember that responsibilities go hand in glove with strength and leadership."

The law would authorize mainland China to prevent "secession, subversion, terrorism and foreign interference" in the semi-autonomous city. "One part that has got people worried is the suggestion that China could set up its own institutions in Hong Kong responsible for security," reports the BBC.

"Hong Kong was handed back to China from British control in 1997, but under a unique agreement -- a mini-constitution called the Basic Law and a so-called 'one country, two systems' principle," the report adds. "They are supposed to protect certain freedoms for Hong Kong: freedom of assembly and speech, an independent judiciary and some democratic rights -- freedoms that no other part of mainland China has." People in Hong Kong believe the law will result in a loss of these freedoms and could see Beijing punish people for criticizing the country, as happens in mainland China.

South Korean phone manufacturer LG has released a security update last month to fix a vulnerability that impacts its Android smartphones sold over the past seven years. From a report: The vulnerability, tracked under the identifier of CVE-2020-12753, impacts the bootloader component that ships with LG smartphones. In March this year, US software engineer Max Thomas discovered a vulnerability in the bootloader component that had been added to LG smartphones starting with the LG Nexus 5 series. In a technical breakdown of the vulnerability published on Tuesday, Thomas says the bootloader component's graphics package contains a bug that lets attackers sneak in their own code to run alongside the bootloader's graphics under certain conditions, such as when the battery dies out and when the device is in the bootloader's Download Mode. Thomas says that threat actors who perfectly time an attack can gain the ability to run their own custom code, which could allow them to take over the bootloader, and inherently the entire device.

Microsoft is starting to roll out its new Edge browser through Windows Update. The new Chromium-based version of Edge launched in January, but Windows users had to specifically download it. From a report: A Microsoft support article notes that it's now available on Windows Update, meaning it will soon arrive on the more than 1 billion Windows 10 devices in use. It appears that Edge will be automatically installed through Windows Update on Windows 10 version 1803 and higher. That covers the vast majority of versions of Windows 10 that are currently supported, meaning it should start showing up in Windows Update for everyone soon. As always, this is a gradual rollout, so you might not see it immediately on Windows Update just yet.

If you're a free Zoom user, and waiting for the company to roll out end-to-end encryption for better protection of your calls, you're out of luck. From a report: Free calls won't be encrypted, and law enforcement will be able to access your information in case of 'misuse' of the platform. Zoom CEO Eric Yuan today said that the video conferencing app's upcoming end-to-end encryption feature will be available to only paid users.

Hackers who obtained personal data on users of Canadian cryptocurrency exchange Coinsquare say they plan to use the information to perform so-called SIM swapping attacks, according to one of the hackers. Motherboard: The news shows hackers' continued interest in trying to leverage security issues with telecom-based forms of authentication. In a SIM swapping attack, a hacker takes control of a target's phone number, which then gives them the ability to request password resets for some websites or a victim's two-factor authentication code. Often, SIM swappers will use these techniques to steal cryptocurrency. The breach also signals the continued risk of insider access, with Coinsquare telling Motherboard a former employee was responsible for stealing the data. "The original intent was to sell it [the data] but we figured we would make more money by SIM swapping the accounts," a pseudonymous hacker who provided the Coinsquare data to Motherboard said in an online chat.

An anonymous reader writes: Mozilla today launched Firefox 77 for Windows, Mac, and Linux. Firefox 77 includes faster JavaScript debugging, optional permissions for extensions, and Pocket recommendations in the U.K. You can download Firefox 77 for desktop now from Firefox.com, and all existing users should be able to upgrade to it automatically. According to Mozilla, Firefox has about 250 million active users, making it a major platform for web developers to consider. [...] Other than Pocket recommendations arriving in the U.K. (they've been in Canada, Germany, and the U.S. since April 2018), this is primarily a developer release. Firefox's Debugger is now better at handling large web apps with all their bundling, live reloading, and dependencies. Mozilla is promising performance improvements that speed up pausing and stepping, as well as cutting down on memory usage over time. Source maps should also see performance boosts -- some inline source maps load 10 times faster -- and improved reliability for many configurations. The debugger will now also respect the currently selected stack when stepping, which is useful when you've stepped into a function call or paused in a library method further down in the stack.

Well-known leaker Universe Ice on Twitter, along with dozens of other users, have discovered that simply setting an image as wallpaper on your phone could cause it to crash and become unable to boot. Android Authority reports: Based on user reports, many models from Samsung and Google are affected, while we've also seen some reports from users of OnePlus, Nokia, and Xiaomi devices (it's not clear if these latter devices ran stock software or custom ROMs). From our own testing and looking at user reports, Huawei devices seem to be less exposed to the wallpaper crash issue. There are a few solutions, depending on how hard the phone is hit. Some users were able to change the wallpaper in the short interval between crashes. Others had success deleting the wallpaper using the recovery tool TWRP. But in most cases, the only solution was to reset the phone to factory settings, losing any data that's not backed up.

The issue affects up-to-date phones running Android 10, but as it turns out, it's not actually new. Users have been reporting similar problems for a couple of years, and just last month Android Police reported on what appears to be a closely related issue specifically impacting Pixel phones running the Google Wallpapers app. [...] An issue with a very similar description has been reported in Google's Android issue tracker back in 2018. At the time, Google developers said they were unable to reproduce the issue and closed it out (Hat tip: inverimus on Reddit).