An anonymous reader quotes a report from ZDNet: Adobe has released security patches to resolve 36 vulnerabilities present in DNG, Reader, and Acrobat software. On Tuesday, the software giant issued two security advisories (1, 2) detailing the bugs, the worst of which can be exploited by attackers to trigger remote code execution attacks and information leaks. The first set of patches relate to Adobe Acrobat and Reader for Windows and macOS, including Acrobat / Acrobat Reader versions 2015 and 2017, as well as Acrobat and Acrobat Reader DC.

In total, 12 critical security flaws have been resolved. Six of the bugs, a single heap overflow problem (CVE-2020-9612), two out-of-bounds write errors (CVE-2020-9597, CVE-2020-9594), two buffer overflow issues (CVE-2020-9605, CVE-2020-9604), and two use-after-free vulnerabilities (CVE-2020-9607, CVE-2020-9606) can all lead to arbitrary code execution in the context of the current user. The remaining problems, now patched, include a race condition error (CVE-2020-9615) and four security bypass bugs (CVE-2020-9614, CVE-2020-9613, CVE-2020-9596, CVE-2020-9592). 12 vulnerabilities, deemed important, were also disclosed in Acrobat and Reader. Null pointer, stack exhaustion, out-of-bounds read, and invalid memory access issues have been patched. If exploited, the bugs can be weaponized for information disclosure and application denial-of-service.

Adobe's DNG Software Development Kit (SDK), versions 1.5 and earlier, is the subject of the second security advisory. The worst vulnerabilities are four heap overflow issues (CVE-2020-9589, CVE-2020-9590 , CVE-2020-9620, CVE-2020-9621) that can all lead to remote code execution attacks. In addition, eight out-of-bounds read problems in the software have also been fixed (CVE-2020-9622, CVE-2020-9623, CVE-2020-9624, CVE-2020-9625, CVE-2020-9626, CVE-2020-9627, CVE-2020-9628, CVE-2020-9629). If exploited, these issues can lead to information disclosure.

An anonymous reader quotes a report from The Register: Privacy pressure group Noyb has filed a legal complaint against Google on behalf of an Austrian citizen, claiming the Android Advertising ID on every Android device is "personal data" as defined by the EU's GDPR and that this data is illegally processed. Based in Vienna, Austria, Noyb is a nonprofit founded by Max Schrems, a lawyer and privacy advocate, to focus on "commercial privacy and data protection violations." It says that "the core task of the office is to work on our enforcement projects and to engage in the necessary research for strategic litigation."

The complaint against Google, which was filed with the Austrian Data Protection Authority, is based on the claim that Google's Android operating system generates the advertising ID without user choice as required by GDPR. "In essence, you buy a new Android phone, but by adding a tracking ID they ship you a tracking device," said Noyb lawyer Stefano Rossetti. [...] The complaint can be viewed here [PDF] and raises key questions about privacy, choice, and tracking. It states that the complainant (the name is redacted) completed a Google contact form to withdraw consent to use of the advertising ID (if consent had been given, which is disputed), and to object to its processing. Article 7 of the GDPR states that "the data subject shall have the right to withdraw his or her consent at any time." Article 21 is a "right to object at any time to processing of personal data concerning him or her" for marketing and profiling, following which the law states that "the personal data shall no longer be processed for such purposes."

The complaint says that there is no opt-in "consent button" for the advertising ID. Although users have to agree to the general Google privacy policy, according to the complaint this consent "was neither informed, specific (the data subject has to agree to all Google services in a single step), nor free (the user cannot use a 800-euro phone without agreeing)." [...] The complaint requests that Google is ordered to "permanently delete the advertising ID", provide access to the data collected, and be fined based on various GDPR breaches.

Google today announced that Chrome will soon start blocking resource-heavy ads. From a report: The company ads that mine cryptocurrency, are poorly programmed, or are unoptimized for network usage because they "drain battery life, saturate already strained networks, and cost money." There are three possible thresholds an ad can hit to be blocked: 4MB of network data, 15 seconds of CPU usage in any 30 second period, or 60 seconds of total CPU usage. Google will be experimenting with this change "over the next several months" and will roll it out on Chrome stable "near the end of August."

Starting with Windows 10 2004, Microsoft is changing the minimum hardware requirements for the device. The change affects new, not existing PCs from OEMs only. From a report: According to the documentation, Microsoft isn't making available copies of 32-bit Windows 10 media. For now, Microsoft is still allowing users to buy 32-bit Windows 10 at retail and to continue to get updates for their existing 32-bit Windows implementations. Anyone with a 32-bit PC should be fine for as long as their devices remain usable. "Beginning with Windows 10, version 2004, all new Windows 10 systems will be required to use 64-bit builds and Microsoft will no longer release 32-bit builds for OEM distribution. This does not impact 32-bit customer systems that are manufactured with earlier versions of Windows 10; Microsoft remains committed to providing feature and security updates on these devices, including continued 32-bit media availability in non-OEM channels to support various upgrade installation scenarios," Microsoft wrote.

An anonymous reader quotes a report from Paul Thurrott: With the new build of Windows 10 [19628], Microsoft is starting to test DNS over HTTPS. The new build comes with Microsoft's initial support for DNS over HTTPS on Windows, and Insiders will have to manually enable the new feature. If you would like to enable DNS over HTTPS in Windows 10, you will have to first install the latest Insider build. After that, you will have to go into the registry and tweak an entry to first enable the new DNS over HTTPS client, and then update the DNS servers your computer is using. It's not as easy as ticking a checkbox, but Microsoft has shared the instructions to enable the feature in detail, so make sure to check it out here. What is DNS over HTTPS and why is it important? "DNS, to put simply, is the process where an easy-to-read and write domain address is translated into an actual IP address for where a web resource is located," writes Thurrott. "Although most websites already use HTTPS for added privacy, your computer is still making DNS requests and resolving addresses without any encryption. With DNS over HTTPS, your device will perform all the required DNS requests over a secured HTTPS connection, which improves security thanks to the encrypted connection."

An anonymous reader quotes a report from Motherboard: The state of Ohio won't deny unemployment benefits to people who refuse to work during the COVID-19 pandemic after people targeted the website it was using to track these workers, according to officials at the state's Department of Job and Family Services (ODJFS). The state previously set up a "fraud" website encouraging employers to report those who refused to go back on the job, angering workers and labor rights advocates. State officials say they are now reconsidering the policy after Motherboard reported that a hacker created a script to flood the "COVID-19 Fraud" website with junk data, with the goal of making it impossible to process these claims.

"No benefits are being denied right now as a result of a person's decision not to return to work while we continue to evaluate the policy," ODJFS Director Kimberly Hall told Cleveland.com. "Because Ohio is still examining its policies in this area, no adjudications concerning a refusal to return to work have been initiated," Bret Crow, a spokesperson for the department, told Motherboard in an email. "While the hacker's script has since stopped working after changes to Ohio's website, another hacker has taken up the project and plans to release an updated version," adds Motherboard.

Two security researchers have published today details about a vulnerability in the Windows printing service that they say impacts all Windows versions going back to Windows NT 4, released in 1996. From a report: The vulnerability, which they codenamed PrintDemon, is located in Windows Print Spooler, the primary Windows component responsible for managing print operations. The service can send data to be printed to a USB/parallel port for physically connected printers; to a TCP port for printers residing on a local network or the internet; or to a local file, in the rare event the user wants to save a print job for later. In a report published today, security researchers Alex Ionescu & Yarden Shafir said they found a bug in this old component that can be abused to hijack the Printer Spooler internal mechanism. The bug can't be used to break into a Windows client remotely over the internet, so it's not something that could be exploited to hack Windows systems at random over the internet.

Google Chrome is rolling out a new feature to help you better manage all your open tabs. The company announced today the launch of "tab groups" for the beta version of its web browser, which will allow you to organize, label, and even color-code your tabs for easy access. The feature will make its way to the stable release of Chrome starting next week. From a report: To use the new feature, you can right-click on a tab and choose "Add tab to group." You can then select an existing group to move the tab to or create a new one, which you'll also name and label. The company had been testing this solution for several months before today's public release, as some had already spotted. Based on this early research, Google says it found that many people tended to organize their tabs by topic -- like a project they're working on or a set of shopping and review sites, for example. Others, however, would organize tabs by urgency -- labeling them things like "ASAP," "this week," or "later." Google also suggests tab groups can be used to help keep you focused on task progress, by grouping them into areas like "in progress," "need to follow up," and "completed."

Huawei denied on Monday having any official involvement in an insecure patch submitted to the Linux kernel project over the weekend; patch that introduced a "trivially exploitable" vulnerability. From a report: The buggy patch was submitted to the official Linux kernel project via its mailing list on Sunday. Named HKSP (Huawei Kernel Self Protection), the patch allegedly introduced a series of security-hardening options to the Linux kernel. Big tech companies that heavily use Linux in their data centers and online services, often submit patches to the Linux kernel. Companies like Google, Microsoft, Amazon, and others have been known to have contributed code. On Sunday, the HKSP submission sparked interest in the Linux community as could signal Huawei's wish to possibly contribute to the official kernel. Due to this, the patch came under immediate scrutiny, including from the developers of Grsecurity, a project that provides its own set of security-hardening patches for the Linux kernel. In a blog post published on the same day, the Grsecurity team said that it discovered that the HKSP patch was introducing a "trivially exploitable" vulnerability in the kernel code -- if the patch was to be approved.

An anonymous reader quotes a report from Nextgov: The U.S. Marshals Service suffered a cyberattack that exposed the personal information of approximately 387,000 current and former prisoners at the end of last year, according to an agency official. "The attackers were able to exploit a vulnerability in the system to extract sensitive personally identifiable information on approximately 387,000 individuals," a Marshals Service spokesperson told Nextgov. The spokesperson was referring to a system called DSNet, which is designed to house and transport prisoners within the agency, the federal courts and the Bureau of Prisons. Information extracted included names, addresses, birth dates and Social Security numbers.

Under the Federal Information Security Modernization Act, the data breach qualifies as a "major incident." Justice and Marshals Service alerted the U.S. Computer Emergency Readiness Team, the FBI and Congress, in addition to the affected stakeholders, the spokesperson said, adding "USMS and the JSOC have taken numerous corrective actions to prevent future attacks, including comprehensive code review/correction and testing before returning DSNet to service." The spokesperson said the affected individuals were only now being notified because of the time it took to gather their relevant information and identity and to line up the necessary assistance services. The notification letter advised the affected individuals their identity could be stolen and referred them to resources to freeze their credit and protect themselves from fraud. ZDNet published a copy of the letter the Marshals Service sent to the affected individuals. TechCrunch's Zack Whittaker first reported the breach on Friday,

The US government today released information on three new malware variants used in malicious cyber activity campaigns by a North Korean government-backed hacker group tracked as HIDDEN COBRA. From a report: The new malware is being used "for phishing and remote access by #DPRK cyber actors to conduct illegal activity, steal funds & evade sanctions" according to the information published by Federal Bureau of Investigation (FBI), the Cybersecurity and Infrastructure Security Agency (CISA), and the Department of Defense (DoD). U.S. Cyber Command has also uploaded five samples of the newly discovered malware variants onto the VirusTotal malware aggregation repository. Besides the malware samples shared by the U.S. Cyber Command, CISA has also published detailed malware analysis reports (MARs) on its website containing indicators of compromise (IOCs) and YARA rules for each of the detected samples. The cybersecurity agency also provides mitigation measures in the form of Snort rules, as well as recommendations for system owners and administrators to strengthen the security posture of their organization's systems.

NSO Group, the surveillance vendor best known for selling hacking technology to authoritarian governments, including Saudi Arabia, also tried to sell its products to local U.S. police, Motherboard reported Tuesday, citing internal documents. From the report: The news provides the strongest evidence yet of NSO's attempt to enter the U.S. market, and shows apparent appetite from U.S. police for such tools, with one law enforcement official describing the hacking technology as "awesome." "Turn your target's smartphone into an intelligence gold mine," a brochure for the hacking product, called Phantom, reads. The brochure was made by Westbridge Technologies, "the North American branch of NSO Group," it says. Motherboard obtained the document and related emails through a public records act request. In August 2016, a Westbridge employee emailed the San Diego Police Department (SDPD) offering more information on Phantom, "a mobile intelligence system that would be a great addition to your investigative and special support offices." After remotely hacking the phone, Phantom can siphon a target's emails, text messages, and contact list, as well track their location, turn on the device's microphone and take photos with its camera, according to the brochure.

Brian Krebs reports that Diebold Nixdorf, a major provider of ATMs and payment technology to banks and retailers, recently suffered a ransomware attack that disrupted some operations. Thankfully, the intrusion only affected the company's corporate network and not its ATMs or customer networks. From the report: Canton, Ohio-based Diebold is currently the largest ATM provider in the United States, with an estimated 35 percent of the cash machine market worldwide. The 35,000-employee company also produces point-of-sale systems and software used by many retailers. According to Diebold, on the evening of Saturday, April 25, the company's security team discovered anomalous behavior on its corporate network. Suspecting a ransomware attack, Diebold said it immediately began disconnecting systems on that network to contain the spread of the malware. Sources told KrebsOnSecurity that Diebold's response affected services for over 100 of the company's customers. Diebold said the company's response to the attack did disrupt a system that automates field service technician requests, but that the incident did not affect customer networks or the general public.

An investigation determined that the intruders installed the ProLock ransomware, which experts say is a relatively uncommon ransomware strain that has gone through multiple names and iterations over the past few months. Diebold claims it did not pay the ransom demanded by the attackers, although the company wouldn't discuss the amount requested. But Lawrence Abrams of BleepingComputer said the ransom demanded for ProLock victims typically ranges in the six figures, from $175,000 to more than $660,000 depending on the size of the victim network.

An anonymous reader writes: If you take out The Office's physical interactions between characters and try to tell the same jokes over Slack, does The Office still work? It's a question that creative collective MSCHF set to find out, recreating all 201 episodes of the series over Slack. Viewers will join a live Slack, where different channels are dedicated to various departments, including accounting, warehouse, and a general office room. Viewers are requested to avoid posting in the "company" channels, but are encouraged to pop in and out of channels to keep up with the episodes as they don't all play in one. Since it is a live Slack, inappropriate messages and images do pop up, but the MSCHF team has a number of moderators working to keep it as troll-free as possible, a representative told The Verge. It could take roughly two to three weeks for each episode to "air" over Slack, so settle in.

Newton Mail, a subscription-based email client with an impressively large fanbase, is being reincarnated by new owners: long-time fans Maitrik Kataria and Justin Mitchell. From a report: After Newton's owner Essential announced it would be shutting down in February -- for the second time, Kataria and Mitchell reached out to the company to figure out how they could save their favorite email client. And somehow they've done it. Newton, which was originally produced under the name CloudMagic, has been shut down and given new life more times than most companies are afforded. CloudMagic rebranded as Newton in 2016 and did pretty well for itself -- by the time it first shut down in the summer of 2018, the service had more than 40,000 paid subscribers. The purchase of Newton Mail by Kataria and Mitchell brings the mail client back to its roots as a company free of venture capital funding. Newton will need to bank on its long-standing fan base's willingness to pay subscription fees for a mail client if it wants to survive. Otherwise, history is doomed to repeat itself once again.

A new set of flaws discovered in the Intel Thunderbolt port has put millions of machines at risk of local hacking. This new research by Eindhoven University's Bjorn Ruytenberg suggests that if a hacker gains access to a machine for just five minutes, they could bypass login methods to gain full data access. From a report: Thunderbolt ports are present in machines with Windows, Linux, and macOS. So, that covers a lot of computers. Ruytenberg said all Thunderbolt versions and systems shipped between 2011 to 2020 are affected and no software patch can fix these vulnerabilities. So, Intel would need to redesign silicon in order to fix these flaws. There's not much you can do here. However, with open-source software called Thunderspy, developed by Ruytenberg and their team, you can check if you're affected by the Thunderbolt bug.

Microsoft and Intel have collaborated on a new research project that explores a new approach to detecting and classifying malware. From a report: Called STAMINA (STAtic Malware-as-Image Network Analysis), the project relies on a new technique that converts malware samples into grayscale images and then scans the image for textural and structural patterns specific to malware samples. The Intel-Microsoft research team said the entire process followed a few simple steps. The first consisted of taking an input file and converting its binary form into a stream of raw pixel data. Researchers then took this one-dimensional (1D) pixel stream and converted it into a 2D photo so that normal image analysis algorithms can analyze it.

Long-time Slashdot reader gollum123 quotes CNBC: Nearly 43% of full-time American employees say they want to work remotely more often even after the economy has reopened, according to a survey released by business publishing company getAbstract. Of the more than 1,200 employees surveyed between April 16 and April 17, nearly 20% said their employer is actively discussing how they can make remote work more of an option in the future...

Andrew Savikas, chief strategy officer at getAbstract, says one of the biggest reasons why employees prefer to work remotely is because they get to save time on their daily commute. On average, Americans spent roughly 27 minutes on their one-way commute to work in 2018, according to the Census Bureau. This equates to over 200 hours spent commuting per year... "People like having that time back," Savikas says, while adding that employees also like the flexibility of working remotely because they can "structure the day how they want."

According to a joint CNBC/Change Research survey of more than 5,000 voters in swing states, 47% said the time they would normally spend on commuting has now been used to spend more time with their family. The survey, which gathered responses between April 17 and April 18, also found that employees have been spending the time they save on their commute to sleep more, focus on various hobbies and get more work done.

Cryptocurrency investor Michael Terpin sued AT&T over a SIM card attack in 2018 that lost him control over $23 million.

Now Bloomberg reports that he's suing the "15-year-old hacker and his crew of 'evil computer geniuses'" behind the attack. (Alternate source) Terpin, the founder and chief executive officer of blockchain advisory firm Transform Group, is suing Ellis Pinsky, now 18, for $71 million under a federal racketeering law that allows for triple damages. "Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims' lives and gleefully boast of their multi-million-dollar heists," Terpin said in his complaint filed Thursday in federal court in Manhattan.

Pinsky, of Irvington, New York, couldn't be reached for comment....

According to Terpin. Pinsky's ring identifies people with large cryptocurrency holdings and gains control of their phones by bribing or fooling employees of their wireless carriers. The hackers are then able to intercept authentication messages, gain information and drain the victims' cryptocurrency accounts.

Pinsky has boasted to friends that, starting at age 13, he stole more than $100 million worth of cryptocurrency, hundreds of thousands of dollars of which has been converted into cash stored in his bedroom, the lawsuit alleges. Terpin also claims that, after confronting Pinsky about his alleged role in the theft, the teenager sent him cryptocurrency, cash and a watch with a combined value of $2 million. He claims this was an admission by Pinsky that he had stolen from Terpin.

A Forbes contributor notes that Belkin abruptly announced the end-of-life for its Wemo NetCams, which will discontinued on May 29 2020. But that's just the beginning... Unlike many other end-of-life announcements which simply render products ineligible for support or upgrades, Belkin is literally pulling the plug on its Cloud service, rendering its NetCam range of home security cameras as useless beige bricks...

The question of how Belkin are deliberately bricking their products needs to be called out. When the NetCam was released, users had the option to use the Wemo software (which was lousy) or connect to the cameras using ffmpeg with their favourite NVS platform or even with VLC or equivalent. However, in a firmware update a few years back — Belkin disabled this capability. While workarounds do exist, such as the one published by Vladimir Sobolev in 2018, the whole premise of buying a Belkin product is for ease of use and simplicity. Belkin claim to design 'people inspired products'. All customers of Belkin need to look carefully at these words and see how they match up with their deeds?

How many other Belkin products might be switched off on a whim?

The criticism can be applied to cloud-enabled products as a whole, but in the main — vendors understand that to alienate customers by bricking their possessions is not a viable long term strategy to maintain trust...

Forthcoming European legislation forcing technology companies to make their products easier to repair should go some way to address these concerns.
The article points out that even Microsoft gave Windows 7 users five years of warnings about its 2020 end-of-life.

And it also complains property owners now face two difficult choices: "Either leaving their property with no security system and zero surveillance capability, or breaking the quarantine orders in order to install new equipment."