McGruber shares a report from Business Insider: Facebook is blocking users from posting some legitimate news articles about the coronavirus in what appears to be a bug in its spam filters. On Tuesday, multiple Facebook users reported on Twitter that they found themselves unable to post articles from certain news outlets including Business Insider, BuzzFeed, The Atlantic, and the Times of Israel. It's not clear exactly what has gone wrong, and Facebook did not respond to a request for comment.

Alex Stamos, an outspoken former Facebook security exec, speculated that it might be caused by Facebook's shift to automated software after it sent its human content moderators home. "It looks like an anti-spam rule at FB is going haywire," he wrote on Twitter. "Facebook sent home content moderators yesterday, who generally can't [work from home] due to privacy commitments the company has made. We might be seeing the start of the machine learning going nuts with less human oversight. In a tweet, VP of Integrity Guy Rosen said: "We're on this -- this is a bug in an anti-spam system, unrelated to any changes in our content moderator workforce. We're in the process of fixing and bringing all these posts back."

This week saw dramatic responses to the coronavirus pandemic. At least two different U.S. states have ordered all bars and restaurants to close, according to the AP, while "officials elsewhere in the country said they were considering similar restrictions." America's Center for Disease Control is now urging the entire country to "cancel or postpone in-person events that consist of 50 people or more." At least two more states have postponed their presidential primary elections -- and lots of people now seem to be avoiding movie theatres.

Meanwhile, earlier this week GitLab released its first "Remote Work Report," arguing that "it's undeniable that the future of work will be remote."

But what are you doing? Are you working remotely? (And is the rest of your company?) Are you buying groceries during off-peak hours? Staying home to watch Frozen 2?

We're all in this together -- so let's hear about the experiences of Slashdot readers. Share your own stories in the comments.

How are you handling the coronavirus?

Malware distributors "have started disseminating real-time, accurate information about global infection rates tied to the Coronavirus/COVID-19 pandemic in a bid to infect computers with malicious software," reports security researcher Brian Krebs: In one scheme, an interactive dashboard of Coronavirus infections and deaths produced by Johns Hopkins University is being used in malicious Web sites (and possibly spam emails) to spread password-stealing malware. Late last month, a member of several Russian language cybercrime forums began selling a digital Coronavirus infection kit that uses the Hopkins interactive map as part of a Java-based malware deployment scheme.

The kit costs $200 if the buyer already has a Java code signing certificate, and $700 if the buyer wishes to just use the seller's certificate. "It loads [a] fully working online map of Corona Virus infected areas and other data," the seller explains. "Map is resizable, interactive, and has real time data from World Health Organization and other sources. Users will think that PreLoader is actually a map, so they will open it and will spread it to their friends and it goes viral...!" The sales thread claims the customer's payload can be bundled with the Java-based map into a filename that most Webmail providers allow in sent messages... The seller says the user/victim has to have Java installed for the map and exploit to work, but that it will work even on fully patched versions of Java...

It's unclear how many takers this seller has had, but earlier this week security experts began warning of new malicious Web sites being stood up that used interactive versions of the same map to distract visitors while the sites tried to foist the password-stealing AZORult malware.

An anonymous reader quotes the "Naked Security" blog of anti-virus company Sophos: Researchers have discovered another big database containing millions of European customer records left unsecured on Amazon Web Services (AWS) for anyone to find using a search engine. A total of eight million records were involved, collected via marketplace and payment system APIs belonging to companies including Amazon, eBay, Shopify, PayPal, and Stripe.

Discovered by Comparitech's noted breach hunter Bob Diachenko, the AWS instance containing the MongoDB database became visible on 3 February, where it remained indexable by search engines for five days. Data in the records included names, shipping addresses, email addresses, phone numbers, items purchased, payments, order IDs, links to Stripe and Shopify invoices, and partially redacted credit cards...

A total of eight million records were involved, collected via marketplace and payment system APIs belonging to companies including Amazon, eBay, Shopify, PayPal, and Stripe.
The article calls it "simply the latest example of how easy it is to leave sensitive data sitting in an unsecured state on cloud storage platforms." They cite two more high-profile databases that Comparitech found exposed on Elasticsearch just in 2020:

• A database containing 309 million Facebook user IDs, phone numbers and names
• A total of 250 million Microsoft customer support records dating back to 2005

Slashdot reader Willy English quotes CNBC: AT&T is asking all of its employees who have the ability to work remotely to do so until further notice, as the coronavirus spreads across the globe.

The company will be announcing new procedures and safeguards for employees who can't work from home, AT&T CEO Randall Stephenson said in a note sent to employees Friday. AT&T is one of the largest employers in the United States, and has 245,000 global employees.
Meanwhile, a local U.S. news station reports: IBM is encouraging all employees in the United States to work from home through the end of March, if possible.

In an email sent to employees and provided to KIMT, the technology company says the recommendation is in response to the global coronavirus pandemic.

The tech jobs marketplace at Hired.com crunched their data on more than 400,000 interview requests and job offers over the last year to produce their annual "State of Software Engineers" report. Among its surprising insights: software engineers with more than 10 years of experience get 20% fewere interview requests than engineers with 4 to 10 years of experience.

Other insights: Demand for AR/VR talent is up by 1400%, mirroring blockchain's 517% demand growth last year... In large U.S. tech hubs AR/VR engineer salaries range from $135k - $150k... 46% of software engineers rank AR/VR as one of the top 3 technologies they'd like to learn in 2020... If you work in AR/VR, you may want to move to San Francisco, where they pay $150k/year on average.
The next-highest growth in demand came for "gaming engineers" and "computer vision engineers" -- with both positions seeing a 146% increase in demand over 2018. The next-highest demand growth was for "search engineers" (increasing 137%) and for "machine learning engineers" (increasing 89%). Demand for "blockchain engineers" increased by just 9%.

But they also report that demand for frontend and backend engineers "grew steadily by 17%, which shows that all companies -- not just Silicon Valley tech giants -- are evolving into being tech companies..." The worldwide process of digital transformation, while something of a buzzword, reflects a critical truth: every company is now a technology company. Whether the company is Bank of America, Alaska Airlines, Sainsbury's, or Tesla, investment in top software engineering talent isn't a future ambition, it's a matter of survival.
And the #1 most-desired coding skill was Go (for the second year in a row), "garnering an average of 9.2 interview requests for every Go-skilled candidate..." But there may be a larger trend. All told, the number of interview requests across all languages remained nearly constant year-over-year, with only minor fluctuations in average requests, and zero change in how each language ranked against others. This could suggest that supply for these skills has not yet caught up with demand...

According to Robert Half, 67% of IT managers plan to expand their teams in areas such as security, cloud computing and business intelligence, but 89% reported challenges in recruiting that talent. Those challenges in hiring are even greater for roles related to machine learning, artificial intelligence, and blockchain.
Their analysis concludes the most in-demand programming languages are Go, Scala, Ruby, TypeScript, Kotlin, Objective C, JavaScript, Swift, PHP, Java, HTML, and then Python -- though Python, JavaScript, and Java are engineers' favorite coding languages, "largely because of their useful and well-maintained libraries and packages..."

"Ruby, PHP and Objective C are ranked the least favorite (and least fun) languages for software engineers."

Long-time Slashdot reader AmiMoJo shares a startling report from the Washington Post: Whisper, the secret-sharing app that called itself the "safest place on the Internet," left years of users' most intimate confessions exposed on the Web tied to their age, location and other details, raising alarm among cybersecurity researchers that users could have been unmasked or blackmailed.

The data exposure, discovered by independent researchers and shown to The Washington Post, allowed anyone to access all of the location data and other information tied to anonymous "whispers" posted to the popular social app, which has claimed hundreds of millions of users. The records were viewable on a non-password-protected database open to the public Web. A Post reporter was able to freely browse and search through the records, many of which involved children: A search of users who had listed their age as 15 returned 1.3 million results.

The cybersecurity consultants Matthew Porter and Dan Ehrlich, who lead the advisory group Twelve Security, said they were able to access nearly 900 million user records from the app's release in 2012 to the present day. The researchers alerted federal law-enforcement officials and the company to the exposure.

Shortly after researchers and The Post contacted the company on Monday, access to the data was removed.

The Transportation Security Administration (TSA) will now allow passengers to bring on board hand sanitizer containers up to 12 ounces in size, which is much larger than the standard 3.4 ounces (100 milliliters) previously allowed. The Verge reports: There are some caveats, though. The updated policy only applies to hand sanitizer. And larger containers will be subject to additional screening by TSA agents, which will likely lead to increased wait times. So ask yourself before heading out to the airport: how much sanitizer do you really need? Airports are said to be stocking up on disinfectants and other cleaning equipment. Passengers are likely to see hand sanitizer stations everywhere at airports reflecting this new reality, so no worries for those who don't feel like lugging a huge bottle of the stuff on the plane with them.

Microsoft said this week that it will support Visual Basic on .NET 5.0 but will no longer add new features or evolve the language. From a report: "Starting with .NET 5, Visual Basic will support Class Library, Console, Windows Forms, WPF, Worker Service, [and] ASP.NET Core Web API ... to provide a good path forward for the existing VB customer who want [sic] to migrate their applications to .NET Core," the .NET team wrote in a post to the Microsoft DevBlogs. "Going forward, we do not plan to evolve Visual Basic as a language ... The future of Visual Basic ... will focus on stability, the application types listed above, and compatibility between the .NET Core and .NET Framework versions of Visual Basic."

When Microsoft released the .NET version of Visual Basic, originally called Visual Basic .NET, alongside C# at the beginning of the .NET era, the two languages were evolved together and had roughly identical feature sets. But this changed over time, with professional developers adopting C# and many fans of classic VB simply giving up on the more complex but powerful .NET versions of the environment. Today, virtually all of Microsoft's relevant developer documentation is in C# only, with VB source code examples ever harder to find.

Proton Technologies, the company behind encrypted email provider ProtonMail, has announced plans to circumvent censorship by routing connections to its servers through third-party infrastructure, which may include Google -- a company that ProtonMail has long been critical of over its privacy practices. From a report: Proton, which was founded out of Switzerland in 2013 by academic researchers working on particle physics projects at CERN, promises ProtonMail users full privacy via client-side encryption, meaning that nobody can intercept and read their emails -- it has frequently positioned itself as the antithesis of Gmail, which serves as a vital cog in Google's advertising wheel. ProtonMail, on the other hand, has emerged as a prominent privacy-focused alternative, used by companies and individuals -- including White House staffers and activists -- wishing to sidestep snoopers.

Thus, ProtonMail has faced its fair share of censorship, with the likes of Turkey, Belarus, and Russia all blocking the service in recent times. This is something that Proton is now pushing harder to counter with its new backup solution. The new tool, which will be deployed over the next few weeks in the ProtonMail desktop and mobile apps, is designed to sidestep any blocks imposed by network administrators, internet service providers (ISPs), or governments.

The Brno University Hospital in the city of Brno, Czech Republic, has been hit by a cyber-attack right in the middle of a COVID-19 outbreak that is picking up steam in the small central European country. From a report: Hospital officials have not revealed the nature of the security breach; however, the incident was deemed severe enough to postpone urgent surgical interventions, and re-route new acute patients to nearby St. Anne's University Hospital, local media reported. The hospital was forced to shut down its entire IT network during the incident, and two other of the hospital's branches, the Children's Hospital and the Maternity Hospital, were also impacted. The Czech National Cyber Security Center (NCSC) tweeted today that "the incident was resolved on the spot," together with the hospital's IT staff and members of Czech police (NCOZ). The incident was considered a severe one and treated with the utmost urgency because the Brno University Hospital is one of the Czech Republic's biggest COVID-19 testing laboratories.

An anonymous reader quotes a report from ZDNet: According to new research published today, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack. But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh," a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.

Microsoft today released a patch for a vulnerability in the SMBv3 protocol that accidentally leaked online earlier this week during the March 2020 Patch Tuesday preamble. From a report: The fix is available as KB4551762, an update for Windows 10, versions 1903 and 1909, and Windows Server 2019, versions 1903 and 1909. The update fixes CVE-2020-0796, a vulnerability in Server Message Block, a protocol for sharing files, printers, and other resources on local networks and the Internet. The bug allows attackers to connect to remote systems where the SMB service is enabled and run malicious code with SYSTEM privileges, allowing for remote takeovers of vulnerable systems. Earlier this week, due to what looks like a miscommunication between Microsoft and some antivirus vendors, details about this bug leaked online.

An anonymous reader writes: According to new research published this week, modern RAM cards are still vulnerable to Rowhammer attacks despite extensive mitigations that have been deployed by manufacturers over the past six years. These mitigations, collectively referred to as Target Row Refresh (TRR), are a combination of software and hardware fixes that have been slowly added to the design of modern RAM cards after 2014 when academics disclosed the first-ever Rowhammer attack.

But in a new research paper titled today and titled "TRRespass: Exploiting the Many Sides of Target Row Refresh" a team of academics from universities in the Netherlands and Switzerland said they developed a generic tool named TRRespass that can be used to upgrade the old Rowhammer attacks to work on the new-and-improved TRR-protected RAM cards. The new upgraded attacks work on both DIMM and LPDDR4 memory types, and can be used to retrieve encryption keys from memory, or escalate an attacker's access right to sudo/SYSTEM-level.

A vulnerability in version 3.1.1 of the Server Message Block (SMB) -- the service that's used to share files, printers, and other resources on local networks and over the internet -- can allow attacks to execute code of their choice on both servers and end-user computers that use the vulnerable protocol, Microsoft said in an advisory. Ars Technica reports: The flaw, which is tracked as CVE-2020-0796, affects Windows 10, versions 1903 and 1909 and Windows Server versions 1903 and 1909, which are relatively new releases that Microsoft has invested huge amounts of resources hardening against precisely these types of attacks. Patches aren't available, and Tuesday's advisory gave no timeline for one being released. Asked if there was a timeline for releasing a fix, a Microsoft representative said, "Beyond the advisory you linked, nothing else to share from Microsoft at this time."

In the meantime, Microsoft said vulnerable servers can be protected by disabling compression to block unauthenticated attackers from exploiting the vulnerability against an SMBv3 server. Users can use the following PowerShell command to turn off compression without needing to reboot the machine: "Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\LanmanServer\Parameters" DisableCompression -Type DWORD -Value 1 -Force." That fix won't protect vulnerable client computers or servers if they connect to a malicious SMB service, but in that scenario, the attacks aren't wormable. Microsoft also recommended users block port 445, which is used to send SMB traffic between machines.

"Motherboard built and analyzed a database of over 500 iPhones seized by law enforcement," writes Slashdot reader em1ly. "It's a deep dive into the ongoing "Going Dark" conversation." Here's an excerpt from the report: Most of all, the records compiled by Motherboard show that the capability to unlock iPhones is a fluid issue, with an ebb and flow of law enforcement sometimes being able to access devices and others not. The data solidifies that some law enforcement officials do have trouble accessing data stored on iPhones. But ultimately, our findings lead experts to circle back to the fundamental policy question: should law enforcement have guaranteed access to iPhones, with the trade-offs in iPhone security that come with that?

Out of 516 analyzed cases, 295 were marked as executed. Officials from the FBI, DEA, DHS, Homeland Security and Investigations, the Bureau of Alcohol, Tobacco, Firearms and Explosives were able to extract data from iPhones in investigations ranging from arson, to child exploitation, to drug trafficking. And investigators executed warrants against modern iPhones, not just older models. In some cases, investigators obtained photos, text messages, call records, browsing data, cookies, and location data from seized iPhones. Some executed search warrants explicitly mention the type of extraction performed, such as so-called "Logical" or "Advanced Logical" extraction. The latter is a term with a meaning that varies between different phone data extraction companies, but generally it relates to creating a device backup as iTunes does normally and obtaining some more data on top of that, Vladimir Katalov, the CEO of iOS forensics firm Elcomsoft, told Motherboard. Katalov said those backups can contain the sorts of pieces of data that investigators obtained, and is available to all models of iPhone.

An anonymous reader quotes a report from Bloomberg: Two cybersecurity company employees who attended an annual industry conference last month in San Francisco have tested positive for the coronavirus. At least one is seriously ill with respiratory issues. One of the workers at Exabeam Inc. is a 45-year-old engineer who began experiencing symptoms when he returned home to Connecticut from California on Feb. 28 after attending the RSA cybersecurity conference, his wife said in an email. His condition deteriorated the following week and he was hospitalized in respiratory distress on March 6, she said. The man was placed into a medically induced coma and is now on a ventilator in "guarded condition."

The individual is predisposed for pneumonia due to an underlying heart condition, his wife said. Bloomberg is withholding the man's name to protect his privacy. The second person, who is unidentified, also worked at Exabeam and attended RSA, the Foster City, California-based company said Tuesday in a statement. "While we cannot confirm whether they contracted COVID-19 prior to, at or after the conference, if you came into contact with our staff, please be vigilant in monitoring yourself for symptoms," Exabeam said. The company said it instituted a work-at-home policy for its offices in Foster City and Atlanta.

Alphabet's Google told its staff in North America to not go into their offices unless they have to, becoming one of the latest companies seeking to protect workers from the spreading coronavirus. From a report: The Mountain View, California-based tech giant is "recommending" workers stay home until at least April 10, according to an internal memo seen by Bloomberg. The company had already sent home its Seattle-area workers, where the virus has had the highest number of cases in the U.S.

The note also told contract workers, which make up as much as half of the company's overall workforce, to work from home if they were able. Google also said last week it would keep paying the thousands of hourly workers who do jobs such as serving food, cleaning offices and providing security, through the crisis. Amazon, Twitter, Microsoft, and a slew of other major tech companies are also encouraging employees to work from home to prevent the spread of the virus.

Mozilla today launched Firefox 74 for Windows, Mac, and Linux. Firefox 74 includes stricter rules for add-ons, TLS 1.0 and TLS 1.1 disabled by default, and a handful of developer features.

Microsoft announced today a coordinated takedown of Necurs, one of the largest spam and malware botnets known to date, believed to have infected more than nine million computers worldwide. From a report: The takedown effort came after Microsoft and industry partners broke the Necurs DGA -- the botnet's domain generation algorithm, the component that generates random domain names. Necurs authors register DHA-generated domains weeks or months in advance and host the botnet's command-and-control (C&C) servers, where bots (infected computers) connect to receive new commands. "We were then able to accurately predict over six million unique domains that would be created in the next 25 months," said Tom Burt, Microsoft Vice President for Customer Security & Trust. Breaking the DGA allowed Microsoft and its industry partners to create a comprehensive list of future Necurs C&C server domains that they can now block and prevent the Necurs team from registering.