Microsoft is starting to release the latest twice-annual update to Windows 10, featuring enhancements to the longstanding Notepad app and a way to find your cursor in a sea of text. Some of the other features include: Faster and easier connections: We're making it easier and faster to pair your Bluetooth devices to your compatible Windows 10 PC. Now you can take care of everything in notifications (instead of Settings) with fewer steps.
Go passwordless: Did you know -- for improved security and a simple sign-in experience, you can sign in with your face, fingerprint, or PIN? It's easier than ever to enable passwordless sign-in for your Microsoft accounts: just go to Settings > Accounts > Sign-in options on your Windows 10 PC and select 'On' under 'Make your device passwordless.' Note that this is hardware dependent.
Name your desktops: Now instead of "Desktop 1" or "Desktop 2" you can give your Virtual Desktops more descriptive, clever, or amusing names. Using Virtual Desktop in Windows 10 allows you to expand your desktop beyond the physical limitations of the space, organize groups of related tasks, and easily switch between them. Tackling what you want to -- when you want to -- just got a whole lot easier. Visit this post to learn more on how to access Virtual Desktop in Windows 10.
See gaming in a whole new light: New DirectX 12 Ultimate features provide smoother graphics with increased detail -- all without sacrificing framerate.
Customization and utility at your fingertips: Xbox Game Bar now supports third-party widgets, helping you customize the overlay experience to fit with the way you game.

Chrome and Firefox are blocking direct access to the movie download pages of popular torrent site YTS. According to Google's safe browsing report, YTS.mx is a "deceptive site" that may trick visitors into doing dangerous things. The warning is likely the result of malicious advertisements. TorrentFreak reports: While the site's homepage can be visited just fine, navigating to a torrent detail page throws up the following warning in Chrome. "Deceptive site ahead. Attackers on yts.mx may trick you into doing something dangerous like installing software or revealing your personal information (for example, passwords, phone numbers, or credit cards)." Firefox shows a similar alert and also prevents people from going directly to the download pages. In both browsers, people can, however, accept the risk and visit the page they were looking for.

It's not clear what the exact problem is but the Chrome warning mentions that YTS was caught phishing. This is also reflected in Google's Safe Browsing report, which states the torrent site recently tried to trick visitors into sharing personal info or downloading software. Whether any of this is intentional remains a question. It seems more likely that the warning was triggered by some type of malicious advertisement.

An anonymous reader quotes a report from Ars Technica: A Norwegian infosec firm discovered a new Android vulnerability, which they've dubbed Strandhogg 2.0. Security firm Promon says "Strandhogg" is an old Norse strategy for coastline raids and abductions, and today's vulnerability is the "evil twin" of a similar one discovered in 2019. The original Strandhogg used an Android feature called taskAffinity to hijack applications -- by setting the taskAffinity of one of its activities to match the packageName of any other app, then setting allowTaskReparenting="true" in its own manifest, the Strandhogg app would be launched in place of the target app. Strandhogg's 1.0 major weakness was the need to declare taskAffinity in the Android Manifest. The Manifest is a plain XML file and must be included in the package hosted at the Play Store itself -- it can't simply be downloaded later, after the app is installed. This made it relatively simple to scan the Play store for apps with sketchy-looking taskAffinity declarations. Strandhogg 2.0 doesn't require any special settings in a package's Android Manifest -- meaning the attacking code doesn't need to be present on the Play Store to be scanned at all. Instead, the attacker can download the attack code later, once the trojan app or game is already installed on a user's device.

In addition to the obvious credential-stealing attacks, Strandhogg can be used to trick users into escalating its privileges based on the trust they have for the apps it hijacks. For example, a user tapping Camera is asked if they want to grant it permission to access the camera and microphone -- if the user taps Yes, they've actually given those privileges to the malware app, not the Camera app it covered up on the screen. Strandhogg 2.0 affects all versions of Android prior to 10 -- which translates to roughly 90 percent of the Android userbase. Google rolled out a patch to close the Strandhogg 2.0 vulnerability, CVE-2020-0096, in May's Android Security Update. This is good news for Pixel users -- but as always, carriers and OEMs may delay those upgrades significantly.

Thousands of enterprise systems are believed to have been infected with a cryptocurrency-mining malware operated by a group tracked under the codename of Blue Mockingbird. From a report: Discovered earlier this month by malware analysts from cloud security firm Red Canary, the Blue Mockingbird group is believed to have been active since December 2019. Researchers say Blue Mockingbird attacks public-facing servers running ASP.NET apps that use the Telerik framework for their user interface (UI) component. Hackers exploit the CVE-2019-18935 vulnerability to plant a web shell on the attacked server. They then use a version of the Juicy Potato technique to gain admin-level access and modify server settings to obtain (re)boot persistence. Once they gain full access to a system, they download and install a version of XMRRig, a popular cryptocurrency mining app for the Monero (XMR) cryptocurrency.

Roughly 70% of all serious security bugs in the Chrome codebase are memory management and safety bugs, Google engineers said. From a report: Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components. The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating. The number is identical to stats shared by Microsoft. Speaking at a security conference in February 2019, Microsoft engineers said that for the past 12 years, around 70% of all security updates for Microsoft products addressed memory safety vulnerabilities.

Google last week removed three apps related to the QAnon conspiracy theory from its Play Store digital marketplace. From a report: The apps -- called QMAP, Q Alerts! and Q Alerts LITE -- were taken down for violating Google's policies against "harmful information," the company said. The removal was earlier reported by Media Matters for America, a progressive not-for-profit. The QAnon conspiracy theory has become popular among a group of supporters of President Donald Trump. One claim is that celebrities are involved in child sex trafficking and pedophilia. Another tenet is that Trump is working to take down the so-called "Deep State," a secret network that manipulates and controls government policy. The theory revolves around "Q," an anonymous user who began writing about the conspiracies on imageboard site 4chan.

Thailand's largest cell network AIS has pulled a database offline that was spilling billions of real-time internet records on millions of Thai internet users. From a report: Security researcher Justin Paine said in a blog post that he found the database, containing DNS queries and Netflow data, on the internet without a password. With access to this database, Paine said that anyone could "quickly paint a picture" about what an internet user (or their household) does in real-time. Paine alerted AIS to the open database on May 13. But after not hearing back for a week, Paine reported the apparent security lapse to Thailand's national computer emergency response team, known as ThaiCERT, which contacted AIS about the open database. The database was inaccessible a short time later. AIS spokesperson Sudaporn Watcharanisakorn confirmed AIS owned the data, and apologized for the security lapse.

AmiMoJo shares a report: When visiting the eBay.com site, a script will run that performs a local port scan of your computer to detect remote support and remote access applications. Many of these ports are related to remote access/remote support tools such as the Windows Remote Desktop, VNC, TeamViewer, Ammy Admin, and more. After learning about this, BleepingComputer conducted a test and can confirm that eBay.com is indeed performing a local port scan of 14 different ports when visiting the site.

An anonymous reader quotes Psychology Today's "Boomer's 3.0" blog: More and more companies, especially those in the tech sector, are wisely concluding that the physical infrastructure constructed to put employees together in a building is largely inefficient if not unnecessary. Beyond the potential health risks, office buildings are expensive to construct and maintain, and rents, taxes, and insurance comprise a high percentage of operating costs. It makes simple fiscal sense to bypass these expenses, assuming there is an acceptable alternative with which people can effectively communicate with each other. The internet is that alternative...

Because a person on Zoom or its equivalent has far less physical presence than in real life, managers may be more open to hiring someone past middle age. Likewise, young adults may be more receptive to working with older adults in a virtual setting than in a real one. It may be an odd thing to contemplate, but less attention is paid to a person's physical attributes in a little square box on a screen than if he or she is in the same room.

For tens of millions of baby boomers, the prospect of corporate culture becoming more age-friendly due to advancing technology would be a very welcome development. Rather than end one's career at a predetermined age...most of today's sexagenarians and septuagenarians want to work as long as they possibly can.

SiliconANGLE reports: [C]ode repository management firm GitLab Inc. decided to phish their own employees to see what would happen. The result was not good: One in five employees fell for the fake emails...

The GitLab team behind the exercise purchased the domain name gitlab.company, then used G Suite to facilitate the delivery of the phishing email. ["Congratulations. Your IT Department has identified you as a candidate for Apple's System Refresh Program..."] The domain name and G Suite services were set up to look legitimate, complete with SSL certificates to make the emails look less suspicious to automated phishing site detection and human inspection.

Fifty GitLab employees were targeted with an email that asked them to click on a link to accept an upgrade. The link took them to the fake gitlab.company website where they were asked to enter their login details. On the positive side, only 17 of the 50 targeted employees clicked on the provided link.

However, 10 of those 17 then attempted to log in on the fake site.
Six of the 50 employees reported the email to GitLab's security operations team, the article notes. "Those who logged in on the fake site were then redirected to the phishing test section of the GitLab Handbook."

An anonymous reader quotes IEEE Spectrum: If you're a newly hired software engineer, setting up your development environment can be tedious. If you're lucky, your company will have a documented, step-by-step process to follow. But this still doesn't guarantee you'll be up and running in no time. When you're tasked with updating your environment, you'll go through the same time-consuming process. With different platforms, tools, versions, and dependencies to grapple with, you'll likely encounter bumps along the way.

Austin-based startup Coder aims to ease this process by bringing development environments to the cloud. "We grew up in a time where [Microsoft] Word documents changed to Google Docs. We were curious why this wasn't happening for software engineers," says John A. Entwistle, who founded Coder along with Ammar Bandukwala and Kyle Carberry in 2017. "We thought that if you could move the development environment to the cloud, there would be all sorts of cool workflow benefits."

With Coder, software engineers access a preconfigured development environment on a browser using any device, instead of launching an integrated development environment installed on their computers... To ensure security, all source code and related development activities are hosted on a company's infrastructure — Coder doesn't host any data. Organizations can deploy Coder on their private servers or on cloud computing platforms such as Amazon Web Services or Google Cloud Platform. This option could be advantageous for banks, defense organizations, and other companies handling sensitive data.
One of Coder's customers is the U.S. Air Force, the article points out -- and thats not the only government agency that's interested in their success.

When Coder closed $30 million in Series B funding last month (bringing total funding to $43 million), one of their backers was a venture capital firm with ties to America's Central Intelligence Agency.

"Around 70% of our serious security bugs are memory safety problems," the Chromium project announced this week. "Our next major project is to prevent such bugs at source."

ZDNet reports: The percentage was compiled after Google engineers analyzed 912 security bugs fixed in the Chrome stable branch since 2015, bugs that had a "high" or "critical" severity rating. The number is identical to stats shared by Microsoft. Speaking at a security conference in February 2019, Microsoft engineers said that for the past 12 years, around 70% of all security updates for Microsoft products addressed memory safety vulnerabilities. Both companies are basically dealing with the same problem, namely that C and C++, the two predominant programming languages in their codebases, are "unsafe" languages....

Google says that since March 2019, 125 of the 130 Chrome vulnerabilities with a "critical" severity rating were memory corruption-related issues, showing that despite advances in fixing other bug classes, memory management is still a problem... Half of the 70% are use-after-free vulnerabilities, a type of security issue that arises from incorrect management of memory pointers (addresses), leaving doors open for attackers to attack Chrome's inner components...

While software companies have tried before to fix C and C++'s memory management problems, Mozilla has been the one who made a breakthrough by sponsoring, promoting and heavily adopting the Rust programming language in Firefox... Microsoft is also heavily investing in exploring C and C++ alternatives⦠But this week, Google also announced similar plans as well... Going forward, Google says it plans to look into developing custom C++ libraries to use with Chrome's codebase, libraries that have better protections against memory-related bugs. The browser maker is also exploring the MiraclePtr project, which aims to turn "exploitable use-after-free bugs into non-security crashes with acceptable performance, memory, binary size and minimal stability impact."

And last, but not least, Google also said it plans to explore using "safe" languages, where possible. Candidates include Rust, Swift, JavaScript, Kotlin, and Java.

A security researcher has found an odd issue with how the Nintendo Switch console handles login credentials, potentially making it easier for hackers to figure out peoples' passwords, and raising questions about how Nintendo is storing passwords. From a report: The issue revolves around how users log into the eShop from a Nintendo Switch. As security researcher Runa Sandvik explained it, when logging into the eShop before typing in a password, the 'OK' dialogue box is greyed out. When a user enters their correct password, it lights up and lets the user log in. Expected behaviour, so far. But Sandvik found that the 'OK' box also lights up if the user only enters the first eight characters of their password. The eShop won't let the user actually login -- they still need to enter their complete password -- but it does provide visual feedback to someone trying to guess a password that they're on the right track. Essentially, this could give a hacker a better chance of figuring out your password if they only have to determine what comes after the eighth character, although of course they would still need to get that first section too.

Security researchers and hackers have had access to a leaked early version of iOS 14, the iPhone's next operating system, since at least February, Motherboard reported Friday. From the report: That's almost eight months before the expected official release of iOS 14, given that Apple usually publishes the new iOS in September along with the announcement of new phones. Sometimes, screenshots and descriptions of new features leak before the official reveal. This time, however, an entire version of the operating system has leaked and is being widely circulated among hackers and security researchers. Motherboard has not been able to independently verify exactly how it leaked, but five sources in the jailbreaking community familiar with the leak told us they think that someone obtained a development iPhone 11 running a version of iOS 14 dated December 2019, which was made to be used only by Apple developers. According to those sources, someone purchased it from vendors in China for thousands of dollars, and then extracted the iOS 14 internal build and distributed it in the iPhone jailbreaking and hacking community.

An anonymous reader quotes a report from ZDNet: Academics from Germany and Italy say they developed a new practical attack that breaks the separation between Wi-Fi and Bluetooth technologies running on the same device, such as laptops, smartphones, and tablets. Called Spectra, this attack works against "combo chips," specialized chips that handle multiple types of radio wave-based wireless communications, such as Wi-Fi, Bluetooth, LTE, and others. More particularly, the Spectra attack takes advantage of the coexistence mechanisms that chipset vendors include with their devices. Combo chips use these mechanisms to switch between wireless technologies at a rapid pace. [The new Spectra attack allows attackers to break the barrier between these technologies to launch denial-of-service (DoS), arbitrary code execution (ACE), or information disclosure attacks.] Additional details are not available, but the research team plans to provide a technical rundown during a virtual session at the Black Hat security conference in August. An academic paper will also be available at that time.

One of the world's most prolific hacking groups recently infected several Massively Multiplayer Online game makers, a feat that made it possible for the attackers to push malware-tainted apps to one target's users and to steal in-game currencies of a second victim's players. Ars Technica reports: Researchers from Slovakian security company ESET have tied the attacks to Winnti, a group that has been active since at least 2009 and is believed to have carried out hundreds of mostly advanced attacks. Targets have included Chinese journalists, Uyghur and Tibetan activists, the government of Thailand, and prominent technology organizations. Winnti has been tied to the 2010 hack that stole sensitive data from Google and 34 other companies. More recently, the group has been behind the compromise of the CCleaner distribution platform that pushed malicious updates to millions of people. Winnti carried out a separate supply-chain attack that installed a backdoor on 500,000 ASUS PCs.

The recent attack used a never-before-seen backdoor that ESET has dubbed PipeMon. To evade security defenses, PipeMon installers bore the imprimatur of a legitimate Windows signing certificate that was stolen from Nfinity Games during a 2018 hack of that gaming developer. The backdoor -- which gets its name for the multiple pipes used for one module to communicate with another and the project name of the Microsoft Visual Studio used by the developers -- used the location of Windows print processors so it could survive reboots. In a post published early Thursday morning, ESET revealed little about the infected companies except to say they included several South Korea- and Taiwan-based developers of MMO games that are available on popular gaming platforms and have thousands of simultaneous players.

An anonymous reader quotes a report from ZDNet: For years, there's been a known security vulnerability hiding in the GNU C Library (glibc). This library, which is critical for Linux and many other operating systems and programs, had a dynamic memory management security hole that could be used for denial of service (DoS) attacks. Now, the security company, Check Point, has issued an open-source patch, which will make it much more difficult to exploit this memory allocation (malloc) problem. Check Point re-encountered this known problem when it discovered that so-called smart light bulbs could be used to hack into networks by exploiting unprotected single-linked-lists. The double-linked-list version of this problem had been fixed back in 2005 with Safe-Unlinking. But, the single-linked-list version, which is present in the memory primitive functions Fast-Bins and Thread Cache (TCache), remained vulnerable.

Now, the fix is in for this problem. This new built-in security mechanism is called Safe-Linking. It protects malloc by signing its single-linked-list pointers with random numbers derived from Linux's Address Space Layout Randomization (ASLR) functionality. Combined with memory chunk alignment integrity checks, it protects the memory pointers from hijacking attempts and thus the system itself. The patch is now being integrated with the most common standard C library implementation, glibc. Safe-Linking will be released in glibc 2.32 in August 2020. It's already up and running in glibc's popular embedded counterpart: uClibc-NG.

theodp writes: Arkansas Governor Asa Hutchinson had an odd way of showing his appreciation for the unemployed computer programmer who pointed out a vulnerability in Arkansas's Pandemic Unemployment Assistance website, framing the programmer's actions as illegal.

The Arkansas Times' Lindsey Millar explains: "Beginning on Saturday at a news conference and continuing Monday, Hutchinson has framed the applicant who sounded the alarm as acting illegally. He announced Monday that the FBI was investigating the matter. He said he understood personal information had been 'exploited.' 'We don't believe that the data was manipulated,' Hutchinson said. 'In other words, where someone would go in and change a bank account number, which is what criminals would do. When you say 'exploited,' I believe that is a technical term of art that includes visual seeing of someone else's data. That is a concern to us and that is what constitutes a breach.' Asked about his rationale for framing the programmer's actions as illegal, the governor said, 'When you go in and manipulate a system in order to gain an access that you're not allowed to have permission to access, that is a violation of the security that we want to have in place in these systems, and it would be a violation of the law as well, I would think (video).'"

Hutchinson is a member of Governors for CS (and a founding co-chair), who "share best practices for computer science and advocate for federal policies to expand computer science instruction" in partnership with tech-backed Code.org. Andrew Morris, a cybersecurity expert with more than a decade of experience and the founder of GreyNoise Intelligence in Washington, D.C., said the governor's framing of the programmer as acting illegally was "the wrongest way" to handle the situation.

"They're shooting the messenger," he said. "There are so many reasons why that is bad. It creates a culture where they're punishing people for doing the right thing and trying to report the vulnerabilities and get them fixed. This person didn't have to say anything."

Secure instant messaging app Signal launched this week a new feature called "Signal PINs" which the company says will help users migrate account data between devices. From a report: Signal says that in the long run, this new feature is the base and the first step towards moving away from using phone numbers as profile IDs. The new Signal profile PIN feature is already live and available for all Signal users. The feature can be enabled in the Signal Settings section, under Privacy, and the Signal PIN option. Once enabled, users will be asked to create a PIN code that will be associated with their account. The PIN can be anything from a four-digit number to a long alpha-numerical string.

Infamous Israeli surveillance firm NSO Group created a web domain that looked as if it belonged to Facebook's security team to entice targets to click on links that would install the company's powerful cell phone hacking technology, according to data analyzed by Motherboard. From the report: It is not uncommon for hackers working for governments to impersonate Facebook, perhaps with a phishing page that displays a Facebook login screen but which secretly steals a target's password. But NSO's approach complicates its ongoing conflict with the tech giant. NSO is currently embroiled in a lawsuit with Facebook, which is suing the surveillance firm for leveraging a vulnerability in WhatsApp to let NSO clients remotely hack phones. Motherboard has also found more evidence that NSO used infrastructure based in the United States; a server used by NSO's system to deliver malware was owned by Amazon. A former NSO employee provided Motherboard with the IP address of a server setup to infect phones with NSO's Pegasus hacking tool.