Elon Musk's rocket company SpaceX has banned its employees from using video conferencing app Zoom, citing "significant privacy and security concerns," according to a memo seen by Reuters, days after U.S. law enforcement warned users about the security of the popular app. From a report: SpaceX's ban on Zoom Video illustrates the mounting challenges facing aerospace manufacturers as they develop technology deemed vital to national security while also trying to keep employees safe from the fast-spreading respiratory illness. In an email dated March 28, SpaceX told employees that all access to Zoom had been disabled with immediate effect. "We understand that many of us were using this tool for conferences and meeting support," SpaceX said in the message. "Please use email, text or phone as alternate means of communication."

NASA, one of SpaceX's biggest customers, also prohibits its employees from using Zoom, said Stephanie Schierholz, a spokeswoman for the U.S. space agency. The Federal Bureau of Investigation's Boston office on Monday issued a warning about Zoom, telling users not to make meetings on the site public or share links widely after it received two reports of unidentified individuals invading school sessions, a phenomenon known as "zoombombing."

After an inquiry from The New York Times reporters, Zoom said it would disable a data-mining feature that could be used to snoop on participants during meetings without their knowledge. From a report: For Americans sheltering at home during the coronavirus pandemic, the Zoom videoconferencing platform has become a lifeline, enabling millions of people to easily keep in touch with family members, friends, students, teachers and work colleagues. But what many people may not know is that, until Thursday, a data-mining feature on Zoom allowed some participants to surreptitiously access LinkedIn profile data about other users -- without Zoom asking for their permission during the meeting or even notifying them that someone else was snooping on them. The undisclosed data mining adds to growing concerns about Zoom's business practices at a moment when public schools, health providers, employers, fitness trainers, prime ministers and queer dance parties are embracing the platform. An analysis by The New York Times found that when people signed in to a meeting, Zoom's software automatically sent their names and email addresses to a company system it used to match them with their LinkedIn profiles.

Microsoft President Brad Smith took a break from responding to the COVID-19 outbreak this week to praise Washington state's landmark facial recognition regulations. Washington Gov. Jay Inslee signed a bill Tuesday that establishes rules specifically governing facial recognition software. From a report: Smith called the law an "early and important model" and "a significant breakthrough" in a blog post published Tuesday. Some cities have enacted their own facial recognition rules, but Washington is the first to establish statewide regulations. "This balanced approach ensures that facial recognition can be used as a tool to protect the public, but only in ways that respect fundamental rights and serve the public interest," Smith said. The new law requires public agencies to regularly report on their use of facial recognition technology and test the software for fairness and accuracy. Law enforcement agencies must obtain a warrant before using facial recognition software in investigations unless there is an emergency. The bill also establishes a task force to study the use of facial recognition by government agencies. Under the bill, public entities using facial recognition software to make decisions that produce "legal effects" must ensure a human reviews the results. That category includes decisions that could affect a person's job, financial services, housing, insurance, and education.

Cloudflare introduced today '1.1.1.1 for Families,' a privacy-focused DNS resolver designed to help parents in their efforts to safeguard their children's online security and privacyââââââ by automatically filtering out bad sites. From a report: This new tool makes it simple for parents to add protection from malware and adult content to the entire home network, allowing them to focus on working from home instead of worrying about their kids' online safety. "1.1.1.1 for Families leverages Cloudflare's global network to ensure that it is fast and secure around the world," Cloudflare's CEO Matthew Prince said in an announcement published today.

An anonymous reader shares a report: Reyna is a teenager in Florida whose family is strapped for cash amid the economic slowdown caused by the coronavirus. When the uber-popular beauty influencer Jeffree Star tweeted that he'd be giving out $30,000 via payment service Cash App to a random person who retweeted him, she did just that. Star's offer seems to have been legitimate -- and drummed up a lot of attention for the influencer. A woman actually won the $30,000, and Reyna missed out. But then another Twitter user messaged Reyna asking whether she wanted to get $250, she told Quartz. "My goal is to help those in need or need emergency cash," the person said. The catch was that she'd have to pay $25 first. "Your deposit along with our other earnings allows us to immediately send you your payment," the person said. Reyna sent the cash, and that's when the Twitter user blocked her, and her money was gone, she said.

What happened to Reyna is a popular Cash App scam called "cash-flipping," according to Satnam Narang, researcher at the cybersecurity company Tenable. Con artists are taking advantage of the coronavirus by pretending they are helping the needy. While Reyna simply got a direct message to lure her in after she expressed interest in a legitimate giveaway, other scammers have been promoting fake giveaways in public tweets adding "#coronavirus" in order to reach more people. Sometimes they will request money through Cash App pretending that it's a verification mechanism. "They'll say, you won this giveaway, send us $10 to verify to win 500 bucks," Narang said. The scammers say they have a special way of modifying the transactions through payment applications like Cash App, Paypal, Zelle, Venmo, or Apple Pay, Narang wrote in a blog post explaining the scams. "All they ask for is that the recipient share the initial cut with them for providing them this so-called service." This, of course, is all made up.

Apple's native iOS password manager may be getting an overhaul later this year with the presumed release of iOS 14 that will make it more competitive with third-party options like 1Password and LastPass, reports 9to5Mac. From a report: Right now, iCloud Keychain can store your passwords and help autofill them on the iPhone, where copying and pasting long strings of letters and numbers or manually doing so has been a headache since the advent of the mobile touchscreen. But it doesn't have reminders for changing those passwords like competitors do, and it doesn't support two-factor authentication (2FA) options. That means users are still stuck using potentially insecure methods like SMS or email in the event that they do have 2FA set up.

Zoom's troubled year just got worse. From a report: Now that a large portion of the world is working from home to ride out the coronavirus pandemic, Zoom's popularity has rocketed, but also has led to an increased focus on the company's security practices and privacy promises. Hot on the heels of two security researchers finding a Zoom bug that can be abused to steal Windows passwords, another security researcher found two new bugs that can be used to take over a Zoom user's Mac, including tapping into the webcam and microphone. Patrick Wardle, a former NSA hacker and now principal security researcher at Jamf, dropped the two previously undisclosed flaws on his blog Wednesday, which he shared with TechCrunch. The two bugs, Wardle said, can be launched by a local attacker -- that's where someone has physical control of a vulnerable computer. Once exploited, the attacker can gain and maintain persistent access to the innards of a victim's computer, allowing them to install malware or spyware.

Dan Goodin writes via Ars Technica: For almost three years, OpenWRT -- the open source operating system that powers home routers and other types of embedded systems -- has been vulnerable to remote code-execution attacks because updates were delivered over an unencrypted channel and digital signature verifications are easy to bypass, a researcher said. Security researcher Guido Vranken, however, recently found that updates and installation files were delivered over unencrypted HTTPs connections, which are open to attacks that allow adversaries to completely replace legitimate updates with malicious ones. The researcher also found that it was trivial for attackers with moderate experience to bypass digital-signature checks that verify a downloaded update as the legitimate one offered by OpenWTR maintainers. The combination of those two lapses makes it possible to send a malicious update that vulnerable devices will automatically install.
[...]
The researcher said that OpenWRT maintainers have released a stopgap solution that partially mitigates the risk the bug poses. The mitigation requires new installations to be "set out from a well-formed list that would not sidestep the hash verification. However, this is not an adequate long-term solution because an attacker can simply provide an older package list that was signed by the OpenWRT maintainers." From there, attackers can use the same exploits they would use on devices that haven't received the mitigation. OpenWRT maintainers didn't immediately respond to questions asking why installation and update files are delivered over HTTP and when a longer-term fix might be available. In the meantime, OpenWRT users should install either version 18.06.7 or 19.07.1, both of which were released in February. These updates provide the stopgap mitigation.

An anonymous reader quotes a report from CNET: Marriott International said Tuesday that names, mailing addresses, loyalty account numbers and other personal information of an estimated 5.2 million guests may've been exposed in a data breach. This is the second major security incident to hit the hotel group in less than two years. Marriott said it spotted that an "unexpected amount" of guest information may've been accessed at the end of February using the login credentials of two employees at a franchise property. The hotel group said information exposed may include names, addresses, emails, phone numbers and birthdays as well as loyalty account details and information like room preferences. Marriott said the investigation is ongoing but that it doesn't believe credit card numbers, passport information or driver's license numbers were exposed. In 2018, Marriott announced that hackers compromised the reservation database for its Starwood division, exposing records of up to 383 million guests and more than 5 million passport numbers.

The Federal Communications Commission voted Tuesday to finalize rules requiring phone companies to use the Shaken/Stir protocol to automatically block calls to fight illegal robocalls. The new rules mandate the use of the technology by all voice providers by the end of June of 2021. From a report: The rules come after Congress passed and President Donald Trump signed into law the Traced Act last year. The law, which makes Shaken/Stir compliance mandatory for all voice service providers, directed the FCC to develop rules within 18 months. The FCC has said previously that eliminating the wasted time and the nuisance caused by illegal scam robocalls could save the US economy $3 billion annually.

Popular video-conferencing Zoom is leaking personal information of at least thousands of users, including their email address and photo, and giving strangers the ability to attempt to start a video call with them through Zoom. From a report: The issue lies in Zoom's "Company Directory" setting, which automatically adds other people to a user's lists of contacts if they signed up with an email address that shares the same domain. This can make it easier to find a specific colleague to call when the domain belongs to an individual company. But multiple Zoom users say they signed up with personal email addresses, and Zoom pooled them together with thousands of other people as if they all worked for the same company, exposing their personal information to one another.

The FBI has issued an alert on Monday about state-sponsored hackers using the Kwampirs malware to attack supply chain companies and other industry sectors as part of a global hacking campaign. From a report: This marks the third alert about this particular group sent this year, in as many months, after the FBI sent alerts on January 6 and February 5. This time around, the FBI highlighted that some of the group's targets are organizations in the healthcare industry, currently grappling with the coronavirus (COVID-19) outbreak. Besides sending out a PIN (Private Industry Notification), the FBI has also published two Flash alerts, one containing YARA rules to identify the group's Kwampirs malware on infected networks, and the second containing a technical report, complete with IOCs (indicators of compromise).

An anonymous reader shares a report: Zoom, the video conferencing service whose use has spiked amid the Covid-19 pandemic, claims to implement end-to-end encryption, widely understood as the most private form of internet communication, protecting conversations from all outside parties. In fact, Zoom is using its own definition of the term, one that lets Zoom itself access unencrypted video and audio from meetings. With millions of people around the world working from home in order to slow the spread of the coronavirus, business is booming for Zoom, bringing more attention on the company and its privacy practices, including a policy, later updated, that seemed to give the company permission to mine messages and files shared during meetings for the purpose of ad targeting.

Still, Zoom offers reliability, ease of use, and at least one very important security assurance: As long as you make sure everyone in a Zoom meeting connects using "computer audio" instead of calling in on a phone, the meeting is secured with end-to-end encryption, at least according to Zoom's website, its security white paper, and the user interface within the app. But despite this misleading marketing, the service actually does not support end-to-end encryption for video and audio content, at least as the term is commonly understood. Instead it offers what is usually called transport encryption. Further reading: Regarding Zoom.

Comcast said that internet traffic has risen 32% because of the coronavirus, but the company said it has the capacity to handle peak traffic demands in the U.S. From a report: Tony Werner, Comcast president of technology, said in a press briefing that the company normally adds capacity 12-18 months ahead of time, with typical plans targeting 45% a year increases in traffic. "First and foremost, I think it's important to know that the network is performing well," Werner said. "And people are able to -- both business and customers working from home -- do the things they need to do with a great deal of proficiency." He said the company engineers the networks for "peak traffic" and that traffic is up more than 32% overall as of last week. Some parts of the country are up 60%, including Seattle, San Francisco, and now Chicago. [...] Video conference calls using the voice-over-internet-protocol on Comcast are up 212% since March 1.

Houseparty, a video conferencing desktop and mobile application, said it would pay a $1 million bounty to anyone who could unmask the entity behind what the company described as "a paid commercial smear campaign." From a report: The company's apparent anger comes after Houseparty has been at the center of media reports published yesterday by three British tabloids. The Sun, the Express, and Mirror Online reported on Monday on a large number of Houseparty users claiming they had social media accounts hacked and taken over after installing the video conferencing app on their smartphones. Users reported having Netflix, eBay, Instagram, Snapchat, and Spotify accounts taken over; however, very few were able to provide details about what really happened. Houseparty officials feel they're now being defamed unjustly in a game of dirty politics.

Microsoft today announced upcoming features for its Edge browser based on Google's Chromium open source project, the same browser Google's Chrome is based on. Consumer features like Vertical Tabs, Smart Copy, and Password Monitor are coming soon. Microsoft also shared a few updates for existing or already announced features like Collections, InPrivate mode, and Immersive Reader.

An anonymous reader quotes VentureBeat: Ashley Madison's tagline has taken on a new ring amid the COVID-19 pandemic — "Life's short. Have an affair." And the "married dating" site, used to conduct clandestine affairs, has found itself in the midst of a boom. Despite the fact that it's harder than ever to physically meet up with a fellow cheater, Ashley Madison is seeing a surge in users. Some are just looking to chat with someone other than a spouse, some are seeking emotional validation or the fantasy of pursuing a secret sex life...

The company became a household name in July 2015, when hackers stole data on 32 million cheating spouses. The leak of sensitive data led to spouses discovering that their significant others were cheating. Divorces, breakups, and suicides ensued. The hackers also exposed that Ashley Madison used bots posing as attractive young women to lure men into engaging more with the site. The company says it has since beefed up its security and rid itself of the bots. And now it's more than double the size it was at the time of the hack, with over 65 million members last year. During 2019, the company added 15,500 new members a day. More recently, in the midst of the COVID-19 pandemic, it has been adding 17,000 new members a day.
Its chief strategy officer tells them that after their massive data breach "we were signing up more than 100,000 people a day... [W]e also saw revenues jump during that small time frame." (And the site also acquired "a whole new security team...")

Interestingly, he also says Facebook won't allow them to buy ads, which seems especially anticompetitive since Facebook runs its own dating site. "They block us but let other dating platforms advertise... We have had multiple conversations with them, and no, it's a fruitless conversation, unfortunately... This is part of the problem with Facebook, in general, in that they get to pick and choose which companies are going to advertise on the second-largest, if not the largest, digital advertising platform in the world. We question the validity of that."

Long-time technology pundit Robert Cringely writes: IT — Information Technology — grew out of something we called MIS — Management Information Systems — but both meant a kid in a white shirt who brought you a new keyboard when yours broke. Well, the kid is now gone, sent home with everyone else, and that kid isn't coming back... ever. IT is near death, fading by the day. But don't blame COVID-19 because the death of IT was inevitable. This novel coronavirus just made it happen a little quicker...

Amazon has been replacing all of our keyboards for some time now, along with our mice and our failed cables, and even entire PCs. IT has been changing steadily from kids taking elevators up from the sub-basement to Amazon Prime trucks rolling-up to your mailbox. At the same time, our network providers have been working to limit their truck rolls entirely. Stop by the Comcast storefront to get your cable modem, because nobody is going to come to install it if you aren't the first person living there to have cable...

Secure Access Service Edge (SASE) extends both the network and a security model end-to-end over any network including 4G or 5G wireless. Some folks will run their applications in their end device, whether it is a PC, phone, tablet, whatever, and some will run their applications in the same cloud as SASE, in which case everything will be that much faster and more secure. That's end end-game if there is one — everything in the cloud with your device strictly for input and output, painting screens compressed with HTML5. It's the end of IT because your device will no longer contain anything so it can be simply replaced via Amazon if it is damaged or lost, with the IT kid in the white shirt becoming an Uber driver.

Since COVID-19 is trapping us in our homes it is forcing this transition to happen faster than it might have. But it was always going to happen.

It's the largest free web hosting provider for dark web services. But remember back in 2018 when its 6,500 sites all went down after attackers accessed its database and deleted all its accounts?

It happened again -- for the second time in 16 months. And this time, ZDNet reports, Daniel's Host won't be coming back online for several months: Almost 7,600 dark web portals have been taken offline following the hack, during which an attacker deleted the web hosting portal's entire database. This happened earlier this month, on March 10, at around 03:30 am UTC, according to a message posted on DH's now-defunct portal by Daniel Winzen, the German software developer behind the service.

Winzen said that an attacker accessed the DH backend and deleted all hosting-related databases. The attacker then deleted Winzen's database account and created a new one to use for future operations. Winzen discovered the hack the next morning, at which time most of the data was already lost.

The service doesn't keep backups by design.

In an email to ZDNet today, Winzen said he has yet to find out how the hacker breached the DH backend. However, since the dark web hosting service was more of a hobby, Winzen didn't look too much into it. "I am currently very busy with my day-to-day life and other projects, I decided to not spend too much time investigating," he told ZDNet...

Winzen said that users should consider the passwords for their DH accounts as "leaked" and change them if they used the same password for other accounts.
Winzen told ZDNet he still hopes to relaunch the service "at a later time" with "new features and improvements."

"Not having to administrate the services all the time will hopefully give me more time for actual development."

An anonymous reader quotes a report from Bloomberg: With so many people working remotely because of the coronavirus, surveillance software is flying off the virtual shelves. "Companies have been scrambling," said Brad Miller, CEO of surveillance-software maker InterGuard. "They're trying to allow their employees to work from home but trying to maintain a level of security and productivity." Along with InterGuard, software makers include Time Doctor, Teramind, VeriClock, innerActiv, ActivTrak and Hubstaff. All provide a combination of screen monitoring and productivity metrics, such as number of emails sent, to reassure managers that their charges are doing their jobs.

ActivTrak's inbound requests have tripled in recent weeks, according to CEO Rita Selvaggi. Teramind has seen a similar increase, said Eli Sutton, vice president of global operations. Jim Mazotas, innerActive's founder, said phones have been ringing off the hook. Managers using InterGuard's software can be notified if an employee does a combination of worrisome behaviors, such as printing both a confidential client list and a resume, an indication that someone is quitting and taking their book of business with them. "It's not because of lack of trust," Miller said, who compared the software to banks using security cameras. "It's because it's imprudent not to do it." The software can also be a way for employers to grant more flexibility to workers to fit their jobs around other parts of their lives. It may also let managers spot areas that are overstaffed or where they may need additional hands. Sutton from software maker Teramind says employers worried about workers' every moves might have a bigger issue to deal with. "It's not about spying on the user," Sutton said. "If you hired them, you should trust them. If you don't, they have no reason to be part of the organization."

Have you been required to use surveillance software while working from home? If so, which software is your employer using?