"Software developers, like everyone else, have had to transition to a work-from-home world," writes InfoWorld. For the users of GitHub, the COVID-19 pandemic has meant changes in work cadence and collaboration, along with an increased risk of burnout, a GitHub study of usage patterns on the Microsoft-owned code sharing site has found." In an "Octoverse spotlight" analysis published May 6, 2020, GitHub compared the first three months of 2020 with the first three months of 2019... GitHub said its analysis shows that developers have been resilient to the change wrought by COVID-19, with activity holding consistent or increasing through the crisis.
But their analysis also found:

• Developers are working longer, by "up to an hour per day," seven days a week.

• Slightly more pushes, pull requests, reviewed pull requests, and commented issues.

• More collaboration on open source projects, and less time to merge pull requests into open source projects.

Annual Las Vegas hacker gathering DEF CON has officially called off its physical conference for this year due to the coronavirus pandemic. The Register reports: In what was pretty much a foregone conclusion, the organizing team today said the in-person event would not be held in 2020. It had been slated to take place in August. This comes after the more formal Black Hat USA event, usually scheduled to run the same week as DEF CON in Sin City, was shelved as an in-person shindig, due to the COVID-19 coronavirus pandemic forcing everyone to stay home where possible. Both shows will tentatively take place as web streaming affairs this summer. For DEF CON 28, this means a 'Safe Mode' online gathering, with video streams and a Discord server, between August 6 and 9. "Even if a vaccine were to be discovered tomorrow it would not be soon enough to test, manufacture, distribute and administer in time for people to safely to travel by August," explained Jeff "The Dark Tangent" Moss.

"Too many states have stayed open or are reopening, people partied for far too long, and the lack of federal coordination gives me no hope that things will get back to normal this year. I also worry that the conferences that postponed to later this year will be caught up in the 'second wave' after restrictions start to ease and they will end up having to cancel. Because of this, postponing for DEF CON was not an option."

IT services provider Cognizant said in an earnings call this week that a ransomware incident that took place last month in April 2020 will negatively impact its Q2 revenue. ZDNet reports: "While we anticipate that the revenue impact related to this issue will be largely resolved by the middle of the quarter, we do anticipate the revenue and corresponding margin impact to be in the range of $50 million to $70 million for the quarter," said Karen McLoughlin, Cognizant Chief Financial Officer in an earnings call yesterday. McLoughlin also expects the incident to incur additional and unforeseen legal, consulting, and other costs associated with the investigation, service restoration, and remediation of the breach. The Cognizant CFO says the company has now fully recovered from the ransomware infection and restored the majority of its services.

Speaking on the ransomware attack, Cognizant CEO Brian Humphries said the incident only impacted its internal network, but not customer systems. More precisely, Humphries said the ransomware incident impacted (1) Cognizant's select system supporting employees' work from home setups and (2) the provisioning of laptops that Cognizant was using to support its work from home capabilities during the COVID-19 pandemic. Humphries said staff moved quickly to take down all impacted systems, which impacted Cognizant's billing system for a period of time. Some customer services were taken down as a precaution.

An anonymous reader quotes a report from Bloomberg: Syed Shah usually buys and sells stocks and currencies through his Interactive Brokers account, but he couldn't resist trying his hand at some oil trading on April 20, the day prices plunged below zero for the first time ever. The day trader, working from his house in a Toronto suburb, figured he couldn't lose as he spent $2,400 snapping up crude at $3.30 a barrel, and then 50 cents. Then came what looked like the deal of a lifetime: buying 212 futures contracts on West Texas Intermediate for an astonishing penny each. What he didn't know was oil's first trip into negative pricing had broken Interactive Brokers Group Inc. Its software couldn't cope with that pesky minus sign, even though it was always technically possible -- though this was an outlandish idea before the pandemic -- for the crude market to go upside down. Crude was actually around negative $3.70 a barrel when Shah's screen had it at 1 cent. Interactive Brokers never displayed a subzero price to him as oil kept diving to end the day at minus $37.63 a barrel. At midnight, Shah got the devastating news: he owed Interactive Brokers $9 million. He'd started the day with $77,000 in his account.

To be clear, investors who were long those oil contracts had a brutal day, regardless of what brokerage they had their account in. What set Interactive Brokers apart, though, is that its customers were flying blind, unable to see that prices had turned negative, or in other cases locked into their investments and blocked from trading. Compounding the problem, and a big reason why Shah lost an unbelievable amount in a few hours, is that the negative numbers also blew up the model Interactive Brokers used to calculate the amount of margin -- aka collateral -- that customers needed to secure their accounts. "It's a $113 million mistake on our part," said Thomas Peterffy, the chairman and founder of Interactive Brokers, in an interview Wednesday.

Customers will be made whole, Peterffy said. "We will rebate from our own funds to our customers who were locked in with a long position during the time the price was negative any losses they suffered below zero."

IT services provider Cognizant said in an earnings call this week that a ransomware incident that took place last month in April 2020 will negatively impact its Q2 revenue. From a report: "While we anticipate that the revenue impact related to this issue will be largely resolved by the middle of the quarter, we do anticipate the revenue and corresponding margin impact to be in the range of $50 million to $70 million for the quarter," said Karen McLoughlin, Cognizant Chief Financial Officer in an earnings call yesterday. McLoughlin also expects the incident to incur additional and unforeseen legal, consulting, and other costs associated with the investigation, service restoration, and remediation of the breach. The Cognizant CFO says the company has now fully recovered from the ransomware infection and restored the majority of its services.

A Microsoft executive urged Amazon Web Services to "stand down on its litigation" opposing the award of the military's lucrative JEDI commercial cloud transformation contract, arguing the ongoing legal and administrative challenges are keeping the best tools out of the hands of U.S. warfighters. From a report: The statement from Frank Shaw, Microsoft's corporate vice president for communications, came in response to Amazon's latest attempt to compel a re-evaluation of the potentially $10 billion contract won by Microsoft -- a protest filed Monday directly with the Pentagon. The Defense Department's "decision to source a Joint Enterprise Defense Infrastructure (JEDI) contract to deliver the latest advancements in enterprise cloud could be a great step forward," Shaw said. "But only if Amazon gets out of the way." Shaw repeated Microsoft's now-common refrain against AWS: the cloud market leader bid too high, and it is now looking for a "re-do." "This latest filing -- filed with the DoD this time -- is another example of Amazon trying to bog down JEDI in complaints, litigation and other delays designed to force a do-over to rescue its failed bid," he said.

An anonymous reader quotes a report from Wired: A little after 6 pm ET on Wednesday, the system started blinking red for iOS developer Clay Jones. Like many devs, Jones uses a Google product called Crashlytics to keep tabs on when his app stops working. Out of nowhere, it registered tens of thousands of crashes. It also pointed to the cause: a chunk of code that Jones' app incorporates to let people log in with their Facebook accounts. By 6:30 pm, Jones had filed a bug report about the flaw in Facebook's software development kit on GitHub, the code repository. He wasn't alone. According to widespread reports and the web monitoring service Down Detector, prominent iOS apps like TikTok, Spotify, Pinterest, Venmo, and more experienced issues on Wednesday. Many users found that they crashed whenever they tried to open the apps, whether or not they used Facebook to log in.

"Yesterday, a new release of Facebook included a change that triggered crashes in some apps using the Facebook iOS SDK for some users. We identified the issue quickly and resolved it," Facebook said in a statement. That change was quite small, given its outsized impact. "It was something like a server value -- which was supposed to provide a dictionary of things -- was changed to providing a simple YES/NO instead, without warning," says iOS developer Steven Troughton-Smith. "A change that simple can break an app that isn't prepared for it."

"Pretty much all these apps -- Pinterest, Spotify, a lot of the big ones -- use the Facebook SDK for the login button," says Jones. "You'll see 'Login With Facebook.' Everyone has it, super common, great for sign-up rates because it's just a one-click thing." And lots of apps that don't use Login With Facebook still use the SDK, which is why the issue Wednesday was so widespread. [...] The good news is that Facebook did fix the issue with haste, as far as these things go. Jones says it took about two hours for things to return to normal.

An anonymous reader quotes a report from Bloomberg: The messages began arriving in World Health Organization employees' inboxes in early April, seemingly innocuous emails about the coronavirus from news organizations and researchers. But a close examination revealed that they contained malicious links, and some security experts have traced the emails to a hacking group in Iran believed to be sponsored by the government. The hacking effort, which began on April 3, was an attempt to steal passwords and possibly install malware on WHO computers, according to three people familiar with the matter, who requested anonymity because they aren't authorized to talk to the news media. The incident was one of several suspected state-sponsored hacks targeting WHO officials in recent weeks, the people said.

Two of the messages sent to the WHO, which were reviewed by Bloomberg News, were designed to look like coronavirus newsletters from the British Broadcasting Corporation. A third message was tailored to look like an interview request from the American Foreign Policy Council, a conservative think tank based in Washington. It encouraged recipients to click on what looked to be a shortened Google link, which diverted to a malicious domain. Ohad Zaidenberg, lead cyber intelligence researcher at Clearsky Cyber Security, reviewed the messages for Bloomberg News, and said he believed they were sent by a group of state-sponsored Iranian hackers known as "Charming Kitten," which has been active since 2014 and previously targeted Iranian dissidents, academics, journalists and human rights activists. Flavio Aggio, the WHO's chief information security officer, confirmed the "very clever attacks" but said they'd so far been unsuccessful. "We are dealing with an information war and a cyberwar at the same time," he added.

A hacker claims to have stolen over 500GB of data from Microsoft's private GitHub repositories, BleepingComputer reports. From the report: This evening, a hacker going by the name Shiny Hunters contacted BleepingComputer to tell us they had hacked into the Microsoft GitHub account, gaining full access to the software giant's 'Private' repositories. The individual told us that they then downloaded 500GB of private projects and initially planned on selling it, but has now decided to leak it for free. Based on the file stamps in the leaked files, the breach may have occurred on March 28th, 2020.

Google Authenticator, the company's code-based authentication app, has received its first update in three years, updating the app's interface for larger screens with more modern aspect ratios and delivering one of the platform's most-needed features. From a report: The Android version was last updated on August 22nd, 2017, while the iOS one was updated around a year ago to adjust it for iPhone X screens. Now, for the first time, Authenticator users will be able to easily transfer their account from one device to another without needing to manually transfer each code or disable and reenable two-factor authentication (2FA) on each account. The update introduces this feature through an import / export tool that lets you choose which accounts to include and transfer using a single QR code scan. It's a feature that competitor Authy has provided for quite some time, so it's refreshing to see it come to Authenticator, even if it's years late.

Zoom announced this morning that it has acquired Keybase, a startup with encryption expertise. From a report: Keybase, which has been building encryption products for several years including secure file sharing and collaboration tools, should give Zoom some security credibility as it goes through pandemic demand growing pains. The company has faced a number of security issues in the last couple of months as demand as soared and exposed some security weaknesses in the platform. As the company has moved to address these issues, having a team of encryption experts on staff should help the company build a more secure product. In a blog post announcing the deal, CEO Eric Yuan said they acquired Keybase to give customers a higher level of security, something that's increasingly important to enterprise customers as more operations are relying on the platform, working from home during the pandemic.

Stephenmg writes: The smart home hub Wink, which was purchased by Will.i.am in 2017, is giving users until May 13th to opt into a subscription for $4.99 per month. If users do not opt-in, the hub becomes a brick. "Long term costs and recent economic events" prompted the move, according to Wink, and the company didn't want to sell user data to offset the costs of running services for free.

An anonymous reader quotes a report from ZDNet: The details of 44 million Pakistani mobile subscribers have leaked online this week, ZDNet has learned. The leak comes after a hacker tried to sell a package containing 115 million Pakistani mobile user records last month for a price of $2.1 million in bitcoin. Data contains names, phone numbers, national IDs, and home addresses among others, and is believed to have originated from Jazz, a local mobile provider. According to our analysis of the leaked files, the data contained both personally-identifiable and telephony-related information. This includes the likes of: Customer full names; Home addresses (city, region, street name); National identification (CNIC) numbers; Mobile phone numbers; Landline numbers; and Dates of subscription.

Based on the dates of subscription, the oldest entries in the leaked files are from late 2013, suggesting that hackers either got their hands on an older backup file, or the breach took place in 2013, and only now surfaced online. The vast majority of entries in the leaked files contained mobile phone numbers belonging to Jazz (formerly Mobilink), a Pakistani mobile operator. However, ZDNet also identified phone numbers that appeared to belong to other mobile operators. [...] The incident is already under investigation in Pakistan, where the Pakistan Telecommunication Authority (PTA) and the Federal Investigation Agency (FIA) are looking into the matter since last month when the hacker first tried to sell the entire 115 million batch on a hacker forum.

In one of the most complex and innovative hacking campaigns detected to date, a hacker group created a fake icons hosting website in order to disguise malicious code meant to steal payment card data from hacked websites. From a report: The operation is what security researchers refer to these days as a web skimming, e-skimming, or a Magecart attack. Hackers breach websites and then hide malicious code on its pages, code that records and steals payment card details as they're entered in checkout forms. Web skimming attacks have been going on for almost four years, and as security firms are getting better at detecting them, attackers are also getting craftier. In a report published today, US-based cybersecurity firm Malwarebytes said it detected one such group taking its operations to a whole new level of sophistication with a new trick.

CAM4, a popular adult platform that advertises "free live sex cams," misconfigured an ElasticSearch production database so that it was easy to find and view heaps of personally identifiable information, as well as corporate details like fraud and spam detection logs. According to Wired, the database exposed 7 terabytes of names, sexual orientations, payment logs, and email and chat transcripts -- 10.88 billions records in all. From the report: First of all, very important distinction here: There's no evidence that CAM4 was hacked, or that the database was accessed by malicious actors. That doesn't mean it wasn't, but this is not an Ashley Madison-style meltdown. It's the difference between leaving the bank vault door wide open (bad) and robbers actually stealing the money (much worse). [...] The list of data that CAM4 leaked is alarmingly comprehensive. The production logs Safety Detectives found date back to March 16 of this year; in addition to the categories of information mentioned above, they also included country of origin, sign-up dates, device information, language preferences, user names, hashed passwords, and email correspondence between users and the company.

Out of the 10.88 billion records the researchers found, 11 million contained email addresses, while another 26,392,701 had password hashes for both CAM4 users and website systems. A few hundred of the entries included full names, credit card types, and payment amounts. Who's Affected? It's hard to say exactly, but the Safety Detectives analysis suggests that roughly 6.6 million US users of CAM4 were part of the leak, along with 5.4 million in Brazil, 4.9 million in Italy, and 4.2 million in France. It's unclear to what extent the leak impacted both performers and customers. The report says CAM4's parent company, Granity Entertainment, took the server offline within a half hour of being contacted by the researchers.

Last year, Apple accused a cybersecurity startup based in Florida of infringing its copyright by developing and selling software that allows customers to create virtual iPhone replicas. Critics have called the Apple's lawsuit against the company, called Corellium, "dangerous" as it may shape how security researchers and software makers can tinker with Apple's products and code. From a report: The lawsuit, however, has already produced a tangible outcome: very few people, especially current and former customers and users, want to talk about Corellium, which sells the eponymous software that virtualizes iPhones and Android devices. During the lawsuit's proceedings, Apple has sought information from companies that have used the tool, which emulates iOS on a computer, allowing researchers to probe potential iPhone vulnerabilities in a forgiving and easy-to-use environment.

"Apple has created a chilling effect," a security researcher familiar with Corellium's product, who asked to remain anonymous because he wasn't allowed to talk to the press, told Motherboard. "I don't know if they intended it but when they name individuals at companies that have spoken in favor [of Corellium], I definitely believe retribution is possible," the researcher added, referring to Apple's subpoena to the spanish finance giant Santander Bank, which named an employee who had Tweeted about Corellium. Several other cybersecurity researchers expressed fear of retribution from Apple for using Corellium.

Mozilla today launched Firefox 76 for Windows, Mac, and Linux. Firefox 76 includes new Firefox Lockwise password functionality, Zoom improvements, and a handful of developer features. From a report: Lockwise, the password management service formerly known as Firefox Lockbox, is getting smarter. The Firefox feature already lets you generate, manage, and protect all those passwords for streaming services, grocery deliveries, and anything else that helps during the pandemic. If you share your device with family or roommates, Lockwise in Firefox 76 can now protect your saved passwords. When you try to view or copy a password from your "Logins and Passwords" page, you will be prompted for your device's account password.

[...] Firefox 76 adds support for Audio Worklets, which run custom JavaScript audio processing code for applications like VR and gaming on the web. Unlike their predecessor, ScriptProcessorNode, worklets run off the main thread in a similar way to web workers. Mozilla also notes Audio Worklets are "being adopted by some of your favorite software programs." The company specifically called out Zoom, which has become a phenomenon of its own during the pandemic. In short, you now join Zoom calls in Firefox without having to download or install the Zoom client.

The inside story of 'ILOVEYOU' and two other viruses from two decades ago. Steven Sinofsky, who worked at Microsoft from 1989-2012 and oversaw the Office (1998-2006) and Windows (2006-2012) teams, writes (shared by reader harrymcc): One morning during the first week of May of the new millennium, I received a call at my apartment while I was getting ready for work. I heard a female reporter tell me her name, and then basically listened to her hyperventilating and proclaiming her love for me repeatedly: "I love you. I love you." That's what I heard, anyway. The call. A reporter. Early morning. It was all weird. In reality, LOVE broke out all over the internet. Over the span of a weekend, inboxes around the world of Outlook and Exchange email users were inundated with dozens of copies of email messages with the subject line, "ILOVEYOU."

I learned from the reporter that the LOVE email incident was deemed so serious that the PR lead gave her my home number and simultaneously sent me a briefing via email. In the era of dial-up, I could not read the email and talk on the phone because I only had one analog phone line at home. I had no idea what was going on, so I agreed to return the call after I dialed up and downloaded my email. That's when I realized the magnitude of the issue.

As predicted, the proprietary locking system Apple rolled out with its 2018 MacBook Pros is hurting independent repair stores, refurbishers, and electronics recyclers. A combination of secure software locks, diagnostic requirements, and Apple's new T2 security chip are making it hard to breathe new life into old MacBook Pros that have been recycled but could be easily repaired and used for years were it not for these locks. From a report: It's a problem that highlights Apple's combative attitude towards the secondhand market and the need for national right to repair legislation. "The irony is that I'd like to do the responsible thing and wipe user data from these machines, but Apple won't let me," John Bumstead, a MacBook refurbisher and owner of the RDKL INC repair store, said in a tweet with an attached picture of two "bricked" MacBook Pros. "Literally the only option is to destroy these beautiful $3,000 MacBooks and recover the $12/ea they are worth as scrap."

As Motherboard has reported previously, without official Apple diagnostic software, newer MacBooks cannot be repaired or reset. "By default you can't get to recovery mode and wipe the machine without a user password, and you can't boot to an external drive and wipe that way because it's prohibited by default," Bumstead told Motherboard in an email. "Because T2 machines have no removable hard drive, and the drive is simply chips on the board, this default setting means that a recycler (or anyone) can't wipe or reinstall a T2 machine that has default settings unless they have the user password."

coondoggie writes: A glimpse into what that future means for IT networking professionals can be found in Cisco's 2020 Global Networking Trends Report. It was completed before COVID-19 changed the way company's do business, but the predicted impacts have been hastened by the pandemic's impact. From the networking study, Cisco put forward a number of new or developing roles it expects to see in the future, including:

Business translator: The business translator works to better turn the needs of business into service-level, security and compliance requirements that can be applied and monitored across the network. The translator also works to use network and network data for business value and innovation, and their knowledge of networking and application APIs will help them glue the business to the IT landscape.
Network guardian: A network guardian works to bridge network and security architectures. They build the distributed intelligence of the network into security architecture and the SecOps process. This is where networking and security meet, and the guardian is at the center of it all, pulling in and pushing out vast amounts of data, distilling it and then taking action to identify faults or adapt to shutdown attackers.
Network commander: Intent-based networking builds on controller-based automation and orchestration processes. The network commander takes charge of these processes and practices that ensure the health and continuous operation of the network controller and underlying network.
Network orchestrator: This position translates business needs into network policy. It focuses on policy translation and automation, and policy alignment across network and IT domains.
Network detective: A network detective uses and tunes network assurance tools that employadvanced analytics and AI to ensure that the network delivers on business intent. They work with IT service-management processes and SecOps teams to identify network anomalies and close potential security holes. Like the network guardian, they use data proactively to identify faults and attacks.