An anonymous reader quotes a report from Bleeping Computer: A currently unpatched security vulnerability affecting iOS 13.3.1 or later prevents virtual private network (VPNs) from encrypting all traffic and can lead to some Internet connections bypassing VPN encryption to expose users' data or leak their IP addresses. While connections made after connecting to a VPN on your iOS device are not affected by this bug, all previously established connections will remain outside the VPN's secure tunnel as ProtonVPN disclosed.

The bug is due to Apple's iOS not terminating all existing Internet connections when the user connects to a VPN and having them automatically reconnect to the destination servers after the VPN tunnel is established. "Most connections are short-lived and will eventually be re-established through the VPN tunnel on their own," ProtonVPN explains. "However, some are long-lasting and can remain open for minutes to hours outside the VPN tunnel." During the time the connections are outside of the VPN secure communication channels, this issue can lead to serious consequences. For instance, user data could be exposed to third parties if the connections are not encrypted themselves, and IP address leaks could potentially reveal the users' location or expose them and destination servers to attacks. Until Apple provides a fix, the company recommends using Always-on VPN to mitigate this problem. "However, since this workaround uses device management, it cannot be used to mitigate the vulnerability for third-party VPN apps such as ProtonVPN," the report adds.

pgmrdlm writes: A growing group of cybersecurity professionals is volunteering their expertise to help hospitals fight off hackers while doctors and nurses fight the coronavirus. Calling themselves the CTI League -- Countering Threat Intelligence, and a nod to the superhero team the Justice League -- the group has swelled from a handful of professionals to 450 members worldwide in less than two weeks. "If some hospital gets attacked by some ransomware and wouldn't be able to pay, people will die because they wouldn't be able to get the medical services needed," said the group's founder, Ohad Zaidenberg.

A US hospitality provider has recently been the target of an incredibly rare BadUSB attack, ZDNet has learned from cyber-security firm Trustwave. From a report: The attack happened after the company received an envelope containing a fake BestBuy gift card, along with a USB thumb drive.The receiving company was told to plug the USB thumb drive into a computer to access a list of items the gift card could be used for. But in reality, the USB thumb drive was what security experts call a "BadUSB" -- a USB thumb drive that actually functions as a keyboard when connected to a computer, where it emulates keypresses to launch various automated attacks.

Microsoft announced today a new security feature for the Windows operating system. From a report: Named "Hardware-enforced Stack Protection," this feature allows applications to use the local CPU hardware to protect their code while running inside the CPU's memory. As the feature's name suggests, its primary role is to protect the (memory) stack -- where an app's code is stored during execution. "Hardware-enforced Stack Protection" works by enforcing strict management of the memory stack through the use of a combination between (1) modern CPU hardware and (2) shadow stacks. The term shadow stacks is a new one and refers to a copies of a program's intended execution flow (also referred to as the code's execution order). The new "Hardware-enforced Stack Protection" feature plans to use the hardware-based security features in modern CPUs to keep a copy of the app's shadow stack (intended code execution flow) in a hardware-secured environment.

An anonymous reader writes: Hewlett Packard Enterprise (HPE) issued a security advisory last week warning customers about a bug in the firmware of some SAS SSDs (Serial-Attached SCSI solid-state drives) that will fail after reaching 40,000 hours of operation -- which is 4 years, 206 days, and 16 hours after the SSD has been put into operation. HPE says that based on when affected SSDs have been manufactured and sold, the earliest failures are expected to occur starting with October this year. The company has released firmware updates last week to address the issue. HPE warns that if companies fail to install the update, they risk losing both the SSD and the data. "After the SSD failure occurs, neither the SSD nor the data can be recovered," the company explained.

An anonymous reader quotes a report from Bleeping Computer: A new cyber attack is hijacking router's DNS settings so that web browsers display alerts for a fake COVID-19 information app from the World Health Organization that is the Oski information-stealing malware. For the past five days, people have been reporting their web browser would open on its own and display a message prompting them to download a 'COVID-19 Inform App' that was allegedly from the World Health Organization (WHO). After further research, it was determined that these alerts were being caused by an attack that changed the DNS servers configured on their home D-Link or Linksys routers to use DNS servers operated by the attackers. As most computers use the IP address and DNS information provided by their router, the malicious DNS servers were redirecting victims to malicious content under the attacker's control. "If your browser is randomly opening to a page promoting a COVID-19 information app, then you need to login to your router and make sure you configure it to automatically receive its DNS servers from your ISP," the report says. It also recommends you set a strong password for your router and to disable remote administration.

"Finally, if you downloaded and installed the COVID-19 app, you should immediately perform a scan on your computer for malware. Once clean, you should change all of the passwords for sites whose credentials are saved in your browser and you should change the passwords for any site that you visited since being infected."

According to Reuters, elite hackers tried to break into the World Health Organization earlier this month. While the effort was unsuccessful, the agency said there's been a more than two-fold increase in cyberattacks as they battle to contain the coronavirus. From the report: The attempted break-in at the WHO was first flagged to Reuters by Alexander Urbelis, a cybersecurity expert and attorney with the New York-based Blackstone Law Group, which tracks suspicious internet domain registration activity. Urbelis said he picked up on the activity around March 13, when a group of hackers he'd been following activated a malicious site mimicking the WHO's internal email system. "I realized quite quickly that this was a live attack on the World Health Organization in the midst of a pandemic," he said.

Urbelis said he didn't know who was responsible, but two other sources briefed on the matter said they suspected an advanced group of hackers known as DarkHotel, which has been conducting cyber-espionage operations since at least 2007. When asked by Reuters about the incident, the WHO's Security Officer Flavio Aggio confirmed that the site spotted by Urbelis had been used in an attempt to steal passwords from multiple agency staffers. Cybersecurity firms including Romania's Bitdefender and Moscow-based Kaspersky said they have traced many of DarkHotel's operations to East Asia - an area that has been particularly affected by the coronavirus. Specific targets have included government employees and business executives in places such as China, North Korea, Japan, and the United States. Costin Raiu, head of global research and analysis at Kaspersky, could not confirm that DarkHotel was responsible for the WHO attack but said the same malicious web infrastructure had also been used to target other healthcare and humanitarian organizations in recent weeks.

Microsoft says attackers are exploiting a previously undisclosed security vulnerability found in all supported versions of Windows, including Windows 10. From a report: But the software giant said there is currently no patch for the vulnerability. The security flaw, which Microsoft deems "critical" -- its highest severity rating -- is found in how Windows handles and renders fonts, according to the advisory posted Monday. The bug can be exploited by tricking a victim into opening a malicious document. Once the document is opened -- or viewed in Windows Preview -- an attacker can remotely run malware, such as ransomware, on a vulnerable device. The advisory said that Microsoft was aware of hackers launching "limited, targeted attacks," but did not say who was launching the attacks or at what scale.

The personal details of more than 538 million users of Chinese social network Weibo are currently available for sale online, according to ads seen by ZDNet and corroborating reports from Chinese media. From the report: In ads posted on the dark web and other places, a hacker claims to have breached Weibo in mid-2019 and obtained a dump of the company's user database. The database allegedly contains the details for 538 million Weibo users. Personal details include the likes of real names, site usernames, gender, location, and -- for 172 million users -- phone numbers. Passwords were not included, which explains why the hacker is selling the Weibo data for only $250.

Microsoft has announced that it is pausing the rollout of Edge v81, citing the ongoing "global circumstances" surrounding the coronavirus outbreak. From a report: New Edge releases (or any other kind of software updates) usually entail security reviews and compatibility testing to ensure operating systems and internal web applications don't break. Due to the COVID-19 coronavirus outbreak, most system administrators are most likely busy handling the security of employees working from home and taking care of their families in these tough times. Microsoft said it does not want to put an extra strain on system administrators and other IT staff personnel by releasing a new Edge version at this particular time. Redmond's decision comes days after Google announced a similar measure for Chrome v81, postponing the v81 release indefinitely.

This week Politico published predictions from 34 "big thinkers" about what the future will be like after the coronavirus pandemic. (An associate professor of government and politics at the University of Maryland argues that "The Reagan era is over. The widely accepted idea that government is inherently bad won't persist after coronavirus.")

Others predict a future with voting from mobile devices (and possibly higher voter turnout), and one author even predicts a society that accepts "restraints on mass consumer culture as a reasonable price to pay to defend ourselves against future contagions and climate disasters alike."

But several also predict the rise of telemedicine, including the editor-in-chief of Reason, who also argues that the epidemic "will sweep away many of the artificial barriers to moving more of our lives online." The resistance -- led by teachers' unions and the politicians beholden to them -- to allowing partial homeschooling or online learning for K-12 kids has been swept away by necessity. It will be near-impossible to put that genie back in the bottle in the fall, with many families finding that they prefer full or partial homeschooling or online homework. For many college students, returning to an expensive dorm room on a depopulated campus will not be appealing, forcing massive changes in a sector that has been ripe for innovation for a long time.

And while not every job can be done remotely, many people are learning that the difference between having to put on a tie and commute for an hour or working efficiently at home was always just the ability to download one or two apps plus permission from their boss. Once companies sort out their remote work dance steps, it will be harder -- and more expensive -- to deny employees those options. In other words, it turns out, an awful lot of meetings (and doctors' appointments and classes) really could have been an email. And now they will be.
Not everyone agrees. Author Sonia Shah argues that "The hype around online education will be abandoned, as a generation of young people forced into seclusion will reshape the culture around a contrarian appreciation for communal life."

But the president of Vassar College even wonders if the pandemic will be a boon to virtual reality, hoping for a program that helps self-isolated people socialize. "Imagine putting on glasses, and suddenly you are in a classroom or another communal setting, or even a positive psychology intervention."

"Red faces in Red Square, again," writes a Forbes cybersecurity correspondent: Last July, I reported on the hacking of SyTech, an FSB contractor working on internet surveillance tech. Now, reports have emerged from Russia of another shocking security breach within the FSB ecosystem. This one has exposed "a new weapon ordered by the security service," one that can be used to execute cyber attacks on IoT devices. The goal of the so-called "Fronton Program" is to exploit IoT security vulnerabilities en masse — remember, these technologies are fundamentally less secure than other connected devices in homes and offices...

The security contractors highlight retained default "factory" passwords as the obvious weakness, one that is easy to exploit... The intent of the program is not to access the owners of those devices, but rather to herd them together into a botnet that can be used to attack much larger targets — think major U.S. and European internet platforms, or the infrastructure within entire countries, such as those bordering Russia.
But the article also notes that targetted devices for the exploits include cameras, adding that compromising such devices in foreign countries by a nation-state agency "carries other surveillance risks as well." It also points out that the FSB "is the successor to the KGB and reports directly to Russia's President Vladimir Putin," and its responsibilities include electronic intelligence gathering overseas.

"The fact that these kind of tools are being contracted out for development given the current geopolitical climate should give us all serious pause for thought."

"The dramatic expansion of teleworking by U.S. schools, businesses and government agencies in response to the coronavirus is raising fresh questions about the capacity and security of the tools many Americans use to connect to vital workplace systems and data," reports CNN: As of last week the Air Force's virtual private networking software could only support 72,000 people at once, according to a federal contractor who was also not authorized to speak on the record, and telework briefing materials viewed by CNN. The Air Force employs over 145,000 in-house civilian workers, and over 130,000 full-time contractors.

As they increasingly log on from home, Americans are having to meld their personal technology with professional tools at unprecedented scale. For employers, the concern isn't just about capacity, but also about workers introducing new potential vulnerabilities into their routine — whether that's weak passwords on personal computers, poorly secured home WiFi routers, or a family member's device passing along a computer virus.
Long-time Slashdot reader Lauren Weinstein also worries about a world where "doctors switch to heavy use of video office visits, and in general more critical information than ever is suddenly being thrust onto the Internet..." For example, the U.S. federal government is suspending key aspects of medical privacy laws to permit use of "telemedicine" via commercial services that have never been certified to be in compliance with the strict security and privacy rules associated with HIPAA (Health Insurance Portability and Accountability Act).

The rush to provide more remote access to medical professionals is understandable, but we must also understand the risks of data breaches that once having occurred can never be reversed.

Linus Torvalds tells ZDNet what he's learned about working remotely: Torvalds admits that when he started, "I worried about missing human interaction -- not just talking to people in the office and hallways, but going out to lunch etc. It turns out I never really missed it."

Of course, just saying "'don't be social' isn't much of a great tip, is it?" Nor, as many extroverts are now finding out, is working from home necessarily at all comfortable. So, Torvalds suggests that you take "advantage of the 'real' upside of working from home: flexibility... Torvalds says, "if you make your new life a '9-5, but from home' kind of thing, I think you're just going to hate your home, yourself and your life. All the downsides, none of the upsides...." He believes that instead of using "video conferencing instead to recreate exactly what we used to do before, you should" try to really change how you work. Use asynchronous communication models: messaging, email, shared calendars, whatever.
Torvalds also recommends carefully tracking the things that you need to do, but argues that if you're spending hours in online meetings from home instead of hours in real-world meetings, "you've just taken the worst part of office life, and brought it home, and made it even worse..."

And the article also includes some tips from James Bottomley, an IBM Research Distinguished Engineer and senior Linux kernel developer who works closely with Torvald. For videoconferencing Bottomley uses NextCloud Talk and Zoom, which he calls a "horrible proprietary app" -- but notes that it does have binaries for every Linux distro.

Russian hacker group Digital Revolution claims to have breached a contractor for the FSB -- Russia's national intelligence service -- and discovered details about a project intended for hacking Internet of Things (IoT) devices. From a report: The group published this week 12 technical documents, diagrams, and code fragments for a project called "Fronton." ZDNet has not seen the documents first hand since they are still password-protected; however, the hackers provided the files to BBC Russia earlier this week. According to screenshots shared by the hacker group, which ZDNet asked security researchers to analyze, and based on BBC Russia's report from earlier this week, we believe the Fronton project describes the basics of building an IoT botnet. The technical Fronton documents were put together following a procurement order placed by one of the FSB's internal departments, unit No. 64829, which is also known as the FSB Information Security Center.

The 2020 spring edition of the Pwn2Own hacking contest has come to a close today. This year's winner is Team Fluoroacetate -- made up of security researchers Amat Cama and Richard Zhu -- who won the contest after accumulating nine points across the two-day competition, which was just enough to extend their dominance and win their fourth tournament in a row. From a report: But this year's edition was a notable event for another reason. While the spring edition of the Pwn2Own hacking contest takes place at the CanSecWest cyber-security conference, held each spring in Vancouver, Canada, this year was different. Due to the ongoing coronavirus (COVID-19) outbreak and travel restrictions imposed in many countries around the globe, many security researchers couldn't attend or weren't willing to travel to Vancouver and potentially put their health at risk. Instead, this year's Pwn2Own edition has become the first-ever hacking contest that has been hosted in a virtual setting. Participants sent exploits to Pwn2Own organizers in advance, who ran the code during a live stream with all participants present. During the competition's two-day schedule, six teams managed to hack apps and operating systems like Windows, macOS, Ubuntu, Safari, Adobe Reader, and Oracle VirtualBox. All bugs exploited during the contest were immediately reported to their respective companies.

Mixed reality startup Magic Leap is trying to tempt potential buyers with a package for people stuck working from home. The Verge reports: The "Collaboration Package" is a 45-day trial of four Magic Leap headsets, plus access to Spatial, a virtual collaboration program. It costs $5,000, with the option to extend the license or send the headsets back afterward. Spatial creates avatars of users based on photos, then lets them hold meetings with these avatars and virtual screens. It isn't exclusive to Magic Leap or mixed reality headsets; the software also works across computers and phones. But headsets can (in some ways) more realistically simulate sharing a room with a distant colleague.

According to a 13-page study from IT security vendor Positive Technologies, a whopping 97% of surveyed companies with at least 1,000 employees show evidence of suspicious activity in their network traffic and that 81% of the companies were being subject to malicious activity. TechRepublic reports: "In one in every three companies, there were traces of scans of its internal network, which could potentially mean that hackers are gathering intelligence inside the infrastructure. This includes network scans, multiple failed attempts to connect to hosts, and traces of collecting intelligence on active network sessions on a specific host or in the entire domain." Another alarming statistic from the research showed that 94% of the participating companies in the study suffered from noncompliance with their corporate security policies within their IT infrastructure systems, leaving them more vulnerable to successful cyberattacks, according to the report. Noncompliance with IT security policies "has a direct impact on security deterioration, by practically opening the door for the hackers to exploit," the report continued.

Also worrisome is that 81% of the participating companies are transmitting their sensitive data in clear text, or text that is not encrypted or meant to be encrypted, according to the research. By using only risky clear text, companies can enable potential hackers to search their network traffic for logins and passwords which are moving between and across corporate networks. Meanwhile, some 67% of the companies allow the use of remote access software, such as RAdmin, TeamViewer, and Ammyy Admin, which can also be compromised by attackers to move along the network while remaining undetected by security tools, the report states. In addition, workers in 44% of the companies use BitTorrent for data transfer, which dramatically can increase the risk of malware infection. Ultimately, 92% of these network security threats were detected inside the perimeters of the companies that were surveyed, according to the report, which reveals the depth of the problems and the need for constant internal network monitoring.

Mozilla has announced plans to remove support for the FTP protocol from Firefox. Going forward, users won't be able to download files via the FTP protocol and view the content of FTP links/folders inside the Firefox browser. From a report: "We're doing this for security reasons," said Michal Novotny, a software engineer at the Mozilla Corporation, the company behind the Firefox browser. "FTP is an insecure protocol and there are no reasons to prefer it over HTTPS for downloading resources," he said. "Also, a part of the FTP code is very old, unsafe and hard to maintain and we found a lot of security bugs in it in the past." Novotny says Mozilla plans to disable support for the FTP protocol with the release of Firefox 77, scheduled for release in June this year.

Microsoft Teams, which launched worldwide in March 2017, passed 32 million daily active users (DAUs) this month. From a report: A week later, thanks in part to COVID-19, usage had spiked to 44 million DAUs. That's up from 20 million daily active users in November, a 60-110% jump in just four months. Microsoft used the product's three-year anniversary to share the new figures and announce new Teams features targeting "underserved professionals, including firstline and health care workers." Teams is the company's Office 365 chat-based collaboration tool that competes with Slack (12 million DAUs as of October), Facebook's Workplace (3 million paid users as of October), and Google's Hangouts Chat (no user number shared). It's also Microsoft's fastest-growing business app ever. But the company has been criticized for how it calculates its DAU figure, so today it shared its methodology.