An anonymous reader quotes a report from the BBC: EasyJet has admitted that a "highly sophisticated cyber-attack" has affected approximately nine million customers. It said email addresses and travel details had been stolen and that 2,208 customers had also had their credit card details "accessed". The firm has informed the UK's Information Commissioner's Office while it investigates the breach. EasyJet first became aware of the attack in January. It told the BBC that it was only able to notify customers whose credit card details were stolen in early April. Stolen credit card data included the three digital security code -- known as the CVV number -- on the back of the card itself. EasyJet added that it had gone public now in order to warn the nine million customers whose email addresses had been stolen to be wary of phishing attacks. It said that it would notify everyone affected by 26 May.

Microsoft is releasing a new Spotlight-like launcher app for Windows 10 today. Designed to replace and modernize the existing Win + R shortcut, the new PowerToys Run launcher includes quick search for apps and files across Windows, plugins like a calculator, and the ability to find running processes. From a report: This early version will support basic search tasks that are typically handled by the built-in Windows Start menu search functionality. But there are plans to make this a more powerful launcher that's similar to Alfred on macOS and more functional than Apple's Spotlight search. The current Win + R functionality is basic and used by Windows power users to launch cmd prompts, regedit, powershell instances, and even shortcuts to areas in Windows like the Control Panel. This new PowerToys Run launcher will support all of the same commands that Run does currently in Windows, but Microsoft is collaborating with an open-source community that's contributing to make it far more powerful. Also read: Microsoft Debuts Windows Package Manager for Your Dev Environment.

New submitter xhonza writes: New OpenBSD version. String of good news. Some of the new changes, as highlighted by Phoronix, include:
- FFS2 file-system improvements including using 64-bit timestamps and block numbers by default for new installs.
- Support for the Raspberry Pi 4 on ARM64 while improving the Raspberry Pi 3 support too. Raspberry Pi 2/3 support has also improved for OpenBSD ARMv7.
- Better support for Rockchip systems like the Pinebook Pro.
- Various SMP improvements including better AMD SMT/Core/Package detection.
- A wide variety of different hardware driver improvements, including Intel AX200 WiFi device support.
- A FIDO driver introduced for FIDO/U2F security keys support.
- Fixed handling of USB 2.0 devices when in use on different USB 3.0 controllers.
- The PowerPC OpenBSD build switched over to Clang as its default code compiler.
- Various dhclient fixes.
- Various security improvements.

The changelog, announcement, and list of mirrors can be found at their respective links.

Microsoft CEO Satya Nadella warns that making remote work permanent could have serious consequences for workers' social interaction and mental health. Times of India reports: Nadella said that an all-remote setup would be "replacing one dogma with another dogma." "What does burnout look like? What does mental health look like? What does that connectivity and the community building look like? One of the things I feel is, hey, maybe we are burning some of the social capital we built up in this phase where we are all working remote. What's the measure for that?" Nadella was quoted as saying. His comments came after Twitter, and most recently Square, announced that its employees will be able to work from home even after the COVID-19 shelter-in-place orders end.

stikves shares a report from Engadget: Last December, a Saudi Arabian cadet training with the U.S. military opened fire at Naval Air Station Pensacola, killing three soldiers and wounding eight others. The FBI recovered two iPhones, and after failing to access their data, asked Apple to unlock them. The company refused, but eventually the FBI unlocked at least one of them without Apple's help, and discovered substantial ties between the shooter and terrorist group al Qaeda. U.S. Attorney General Barr suggests forcing Apple to take action in the future, saying "...if not for our FBI's ingenuity, some luck, and hours upon hours of time and resources, this information would have remained undiscovered. The bottom line: our national security cannot remain in the hands of big corporations who put dollars over lawful access and public safety. The time has come for a legislative solution."

An anonymous reader writes: Whether you think cryptocurrency is a scam or a salvation, those digital coins can store real-world value. The safest place to keep them is in what's known as a "hardware wallet," a device like a USB drive that stores your currency and private keys locally, without connecting to the internet. But "safest" doesn't mean "perfect," which new research into two popular hardware wallets reinforces all too well. Researchers from Ledger -- a firm that makes hardware wallets itself -- have demonstrated attacks against products from manufacturers Coinkite and Shapeshift that could have allowed an attacker to figure out the PIN that protects those wallets. The vulnerabilities have been fixed, and both hacks would have required physical access to the devices, which minimizes the danger to begin with. But Ledger argues that it's still worth holding hardware wallets to the highest standards, just as you would a closet safe. Shapeshift's fix can be found here. Meanwhile, Coinkite's Coldcard Mk2 flaw has been fixed in the company's current Coldcard model Mk3, which started shipping in October.

After months of trying, the FBI successfully broke into iPhones belonging to the gunman responsible for a deadly shooting at Pensacola Naval Air Station in December 2019, and it now claims he had associations with terrorist organization al-Qaeda. Investigators managed to do so without Apple's help, but Attorney General William Barr and FBI director Christopher Wray both voiced strong frustration with the iPhone maker at a press conference on Monday morning. From a report: Both officials say that encryption on the gunman's devices severely hampered the investigation. "Thanks to the great work of the FBI -- and no thanks to Apple -- we were able to unlock Alshamrani's phones," said Barr, who lamented the months and "large sums of tax-payer dollars" it took to get into devices of Mohammed Saeed Alshamrani, who killed three US sailors and injured eight other people on December 6th.

Apple has said it provided investigators with iCloud data it had available for Alshamrani's account but did not provide any assistance bypassing iOS's device encryption. Without that help, authorities spent many weeks trying to break in on their own. Wray chastised Apple for wasting the agency's time and resources to unlock the devices. "Public servants, already swamped with important things to do to protect the American people -- and toiling through a pandemic, with all the risk and hardship that entails -- had to spend all that time just to access evidence we got court-authorized search warrants for months ago," he said.

The source code for "smart car" components installed in Mercedez-Benz vans has been leaked online over the weekend, ZDNet has learned. From the report: The leak occurred after Till Kottmann, a Swiss-based software engineer, discovered a Git web portal belonging to Daimler AG, the German automotive company behind the Mercedes-Benz car brand. Kottmann told ZDNet that he was able to register an account on Daimler's code-hosting portal, and then download more than 580 Git repositories containing the source code of onboard logic units (OLUs) installed in Mercedez vans. According to the Daimler website, the OLU is a component that sits between the car's hardware and software, and "connects vehicles to the cloud." Daimler says the OLU "simplifies technical access and the management of live vehicle data" and allows third-party developers to create apps that retrieve data from Mercedes vans. These apps are usually employed for features such as tracking vans while on the road, tracking a van's internal status, or for freezing vans in case of theft.

SoftBank Group said its Vision Fund business lost 1.9 trillion yen ($17.7 billion) last fiscal year after writing down the value of investments, including WeWork and Uber. From a report: The company posted an overall operating loss of 1.36 trillion yen in the 12 months ended March and a net loss of 961.6 billion yen, according to a statement on Monday. The Tokyo-based conglomerate released figures in two preliminary earnings statements last month. The losses are the worst ever in the company's 39-year history. SoftBank founder Masayoshi Son's $100 billion Vision Fund went from the group's main contributor to profit a year ago to its biggest drag on earnings. Uber's disappointing public debut last May was followed by the implosion of WeWork in September and its subsequent rescue by SoftBank. Now Son is struggling with the impact of the coronavirus on the portfolio of startups weighted heavily toward the sharing economy. 50 of the Vision Fund's 88 portfolio companies had a cut in valuation in the 12 months to March 31, 2020, said Son, adding that 15 could soon file for bankruptcy.

When Robin Frost called Verizon's customer support last month, she was connected with a rooster. At least that's what it sounded like. The Pennsylvania resident wanted to ask about a problem with the telecom company's app, but the agent on the line said she couldn't hear. Punctuating her words was "the sound of a very authentic, real-sounding rooster," Ms. Frost recalled. From a report: Thousands of call-center employees in the Philippines and India are working from home, often on the outskirts of urban areas or outside them, during their countries' coronavirus lockdowns. That has given cows and pigs -- but mainly roosters -- a chance to chime in. "It was funny but not funny, and also maddening, as I couldn't accomplish my task," Ms. Frost said. Stefaan Smith, 36, who lives outside Phoenix, had a similar encounter when he called a Sprint helpline in March. He wanted to defer billing on his account after a pizza-parlor job fell through and left him with no money in the bank.

"The crowing was so close," he said of what sounded like an angry rooster, though that wasn't the only animal present. "It was like right outside her window. You could hear her pigs grumbling and groaning." After follow-up calls, he received a $50 credit from the provider, he said. Call-center executives say roosters are tough to silence. Americans often make customer-service calls in the late afternoon and evening, just when the sun is rising over countries like the Philippines and the birds are at their loudest. That's when Junela Dumaya's job gets tricky. The 20-year-old works for Open Access BPO, a call center, and lives in a mountainous area a few hours' drive from the Philippine capital, Manila. Her neighbor's cow makes a racket in the mornings, as do her brother-in-law's chickens.

Edison Mail has rolled back a software update that apparently let some users of its iOS app see emails from strangers' accounts. From a report: Several Edison users contacted The Verge to report seeing the glitch after they applied the update, which was meant to allow users to sync data across devices. Reader Matthew Grzybowski said after the update he had more than 100 unread messages from the UK-based email account of a stranger. He didn't have to enter any credentials to see the emails, Grzybowski added. The company said it was a bug, not a security breach, and that the issue appeared limited to users of the iOS app.

Long-time Slashdot reader theodp writes: Microsoft Build kicks off online Tuesday as a free virtual event after plans for an in-person Seattle conference with a $2,395 entry fee and 6,000 or so attendees were shelved due to the coronavirus outbreak. It is just one of many large in-person developer conferences that were canceled in response to the pandemic.

While the deep-pocketed sponsors of Microsoft Build (virtual for 2020), Facebook F8 (canceled for 2020), Google I/O (canceled for 2020), and Apple WWDC (virtual for 2020) won't miss the loss of conference revenue, one wonders what the effect may be on nonprofit-run conferences like the Grace Hopper Celebration. GHC is also going virtual in 2020 (details to be determined) after hosting nearly 25,000 in-person attendees last year — registration fees were $1150 (general), $600 (academic), $450 (students)...

They may be cheaper, more accessible, and have a lower carbon footprint than face-to-face conferences, but are virtual conferences "better" than meeting in person?

An anonymous reader quotes Forbes: In a new report, research firm Gartner says it thinks global tech spending will drop 8% in 2020 based on what it is hearing from tech suppliers and other sources. It's forecasting that $3.46 trillion will be spent on IT products and services this year by businesses and consumers, down from $3.76 trillion in 2019. Gartner's estimate is the latest in a series of predictions by research firms that have become more and more pessimistic as the crisis has deepened. Last month, Enterprise Technology Research, which regularly polls IT leaders about their spending intentions, came up with a forecast suggesting a drop of around 5% in global spend for 2020...

While some companies are cutting big IT projects altogether, others are ploughing ahead but delaying some elements of their plans to save money... The research firm, which isn't betting on a rapid V-shaped economic recovery, reckons IT spending in some of the worst hit sectors such as airlines and hotels could take more than three years to rebound to 2019 levels.

Although Gartner expects all of the major categories of IT investment to drop sharply this year...spending in some sub-categories could still soar as companies accelerate digital transformation strategies. Cloud computing is a good example: Gartner expects money spent on public cloud services to rise by 19%. "Companies have to be more digital than they had planned to be," says John-David Lovelock, Gartner's chief forecaster. Software that automates processes is also likely to benefit as executives push hard for greater efficiencies. A survey of 867 finance chiefs across 24 countries and territories conducted in early May by consulting firm PwC found that almost half of the CFOs expected to increase automation of operations...

wiredmikey writes: An abundance of iOS exploits being submitted to be sold should alarm iPhone/iPad users, according to the CEO of exploit acquisition firm Zerodium. The company announced that it was no longer buying certain types of iOS exploits in the next two to three months [including local privilege escalation, Safari remote code execution, and sandbox escape exploits] due to a surplus. And the company expects prices to drop in the near future.

"iOS Security is fucked," Chaouki Bekrar, CEO of Zerodium said on Twitter, noting that they are already seeing many exploits designed to bypass pointer authentication codes and a few zero-day exploits that can help an attacker achieve persistence on all iPhones and iPads. "Let's hope iOS 14 will be better," he added.

Bekrar said that only pointer authentication codes — which provide protection against unexpected changes to pointers in memory — and the difficulty to achieve persistence "are holding [iOS security] from going to zero."

An anonymous reader quotes ZDNet: Multiple supercomputers across Europe have been infected this week with cryptocurrency mining malware and have shut down to investigate the intrusions. Security incidents have been reported in the UK, Germany, and Switzerland, while a similar intrusion is rumored to have also happened at a high-performance computing center located in Spain.

Cado Security, a US-based cyber-security firm, said the attackers appear to have gained access to the supercomputer clusters via compromised SSH credentials... Once attackers gained access to a supercomputing node, they appear to have used an exploit for the CVE-2019-15666 vulnerability to gain root access and then deployed an application that mined the Monero cryptocurrency.

"Doom Eternal has become the latest game to use a kernel-level driver to aid in detecting cheaters in multiplayer matches," reports Ars Technica: The game's new driver and anti-cheat tool come courtesy of Denuvo parent Irdeto, a company once known for nearly unbeatable piracy protection and now known for somewhat effective but often cracked piracy protection. But the new Denuvo Anti-Cheat protection is completely separate from the company's Denuvo Anti-Tamper technology... The new Denuvo Anti-Cheat tool rolls out to Doom Eternal players after "countless hours and millions of gameplay sessions" during a two-year early access program, Irdeto said in a blog post announcing its introduction. But unlike Valorant's similar Vanguard system, the Denuvo Anti-Cheat driver "doesn't have annoying tray icons or splash screens" letting players monitor its use on their system. "This invisibility could raise some eyebrows," Irdeto concedes.

To assuage any potential fears, Irdeto writes that Denuvo Anti-Cheat only runs when the game is active, and Bethesda's patch notes similarly say that "use of the kernel-mode driver starts when the game launches and stops when the game stops for any reason...."

"No monitoring or data collection happens outside of multiplayer matches," Denuvo Anti-Cheat Product Owner Michail Greshishchev told Ars via email. "Denuvo does not attempt to maintain the integrity of the system. It does not block cheats, game mods, or developer tools. Denuvo Anti-Cheat only detects cheats." Greshishchev added that the company's driver has received "certification from renown[ed] kernel security researchers, completed regular whitebox and blackbox audits, and was penetration-tested by independent cheat developers." He said Irdeto is also setting up a bug bounty program to discover any flaws they might have missed.

And because of Denuvo Anti-Cheat's design, Greshishchev says the driver is more secure than others that might have more exposure to the Internet. "Unlike existing anti-cheats, Denuvo Anti-Cheat does not stream shell code from the Web," Greshishchev told Ars. "This means that, if compromised, attackers can't send down arbitrary malware to gamers' machines...."

If a driver exploit is discovered in the wild, Greshishchev told Ars that revocable certificates and self-expiring network keys can be used as "kill switches" to cut them off.

Long-time Slashdot reader bbsguru shares a story from the alternative newsweekly the Arkansas Times. "A computer programmer applying for unemployment on Arkansas's Pandemic Unemployment Assistance program discovered a vulnerability in the system that exposed the Social Security numbers, bank account and routing numbers and other sensitive information of some 30,000 applicants.

"Anyone with basic computer knowledge could have accessed personal information for malicious purposes." Alarmed, the computer programmer called the Arkansas Division of Workforce Services Friday morning and was told by an operator that there was no one available who could talk to him. He then tried someone at the Arkansas State Police Criminal Investigation Division, who told the programmer he would find the person he needed to talk with to fix the situation. The programmer later called the Arkansas Times for advice on whom to call. The Times alerted the Division of Workforce Services to the issue at 4:30 p.m. Soon after a message appeared on the website that said, "The site is currently under maintenance...."

In exploring the website, the computer programmer determined that by simply removing part of the site's URL, he could access the administrative portal of the site, where he had the option of editing the personal information of applicants, including bank account numbers. From the admin portal, he viewed the page's source code and saw that the site was using an API (application programming interface) to connect with a database. That API was also left unencrypted, and he could access all of the applicants' raw data, included Social Security numbers and banking information...

The computer programmer said he thought he could have programmed a script that would gather all of the information from the API in under an hour.

An anonymous reader quotes a report from 9to5Mac: A massive data breach dubbed db8151dd has exposed the records of 22M people -- including addresses, phone numbers, and social media links. But the source of the data is a mystery. I got an email alert this morning from the haveibeenpwned.com site telling me that my details were included. The exposed data appears extensive: "Email addresses, Job titles, Names, Phone numbers, Physical addresses, Social media profiles." However, Troy Hunt, who runs the site, said that nobody has been able to identify where the information came from.

That 'interesting' data appears to come from customer relationship management (CRM) systems, including things like: "Recommended by Andie [redacted last name]. Arranged for carpenter apprentice Devon [redacted last name] to replace bathroom vanity top at [redacted street address], Vancouver, on 02 October 2007." Best guess is it's some kind of aggregated data from a number of sources, but as neither Hunt nor other information security professionals have been able to identify any of them despite attempts lasting almost three months, it appears the details of the privacy breach may remain a mystery. Hunt says there's almost 90GB of personal information in the open database.

"Back in Feb, Dehashed reached out to me with a massive trove of data that had been left exposed on a major cloud provider via a publicly accessible Elasticsearch instance. It contained 103,150,616 rows in total," writes Hunt. "The global unique identifier beginning with 'db8151dd' features heavily on these first lines hence the name I've given the breach. I've had to give it this name because frankly, I've absolutely no idea where it came from, nor does anyone else I've worked on with this."

Samsung and South Korean telecom giant SK Telecom have debuted the Galaxy A Quantum 5G smartphone, sporting a quantum random number generation (RNG) chipset. It's the first commercialization of quantum technology for mobile phones, and it will serve as a significant bellwether for full quantum encryption's chances of going mainstream. Threatpost reports: Quantum encryption in general has been touted as being "unhackable" because it generates random numbers and secure keys that cannot be predicted, via particles that can't be intercepted, eavesdropped upon or spoofed. The very laws of physics themselves prevent successful cracking, the theory goes. However, researchers have proven more than once that this isn't the case -- though hacks so far have required sustained physical access to a device.

In any event, the Samsung phone will provide an interesting test case for the technology -- though details are scant in terms of how the chipset actually works. The Galaxy will use quantum security in a few different scenarios, according to an SK press release (translated with Google Translate). These include logging into carrier accounts on the device; securely storing personal documents via a blockchain-enabled "Quantum Wallet" and for biometric-based mobile payments at retail stores. Online payment protection is also on the roadmap. SK Telecom also plans to roll out open APIs for developers to begin incorporating the technology on an OEM and application basis.

If you've been getting owned in Call of Duty: Warzone a lot before you even hit the ground and thought it would be more fun to play if you could use cheats to see other players through walls, you're not alone. From a report: Last month, the developers of the hugely popular game banned more than 70,000 cheaters and promised to combat the game's cheating problem. "We are watching. We have zero tolerance for cheaters," tweeted the official account of Infinity Ward, the game's developer. This week, Infinity Ward rolled out a new, basic security feature which appears to have had the added bonus of locking out many cheaters: two-factor authentication. Infinity Ward announced that new Warzone players on PC will have to use SMS to login to the free version of the game, "as another step to provide an additional layer of security for players." Infinity Ward and Activision did not immediately respond to a request for comment, but cheaters are currently complaining about the effect this simple move has had on them.