A team of academics from universities across the world, along with vulnerability researchers from Bitdefender, today disclosed a new security flaw in Intel processors. From a report: Named Load Value Injection, or LVI for short, this is a new class of theoretical attacks against Intel CPUs. While the attack has been deemed only a theoretical threat, Intel has released firmware patches to mitigate attacks against current CPUs, and fixes will be deployed at the hardware (silicon design) level in future generations.

Catalin Cimpanu, reporting for ZDNet: Google has removed an Android app from the official Play Store that was developed by the Iranian government to test and keep track of COVID-19 (coronavirus) infections. Before being removed from the Play Store, controversy surrounded the app, and several users accused the Iranian government of using the COVID-19 scare to trick citizens into installing the app and then collecting phone numbers and real-time geo-location data. In hindsight of accusations, ZDNet has asked Lukas Stefanko, an Android malware researcher at ESET, to review the app for any malicious or spyware-like behavior.

"Based on the analysis of the app's APK, the app is not a malicious Trojan or spyware," Stefanko told ZDNet earlier this week. A Google spokesperson did not respond to a request for comment on the reasons the app was removed; however, sources familiar with Play Store policies told ZDNet that the app was most likely taken down because of its misleading claims -- namely that it could detect COVID-19 infections, something that is impossible through an app.

An anonymous reader quotes a report from BuzzFeed News: Sensor Tower, a popular analytics platform for tech developers and investors, has been secretly collecting data from millions of people who have installed popular VPN and ad-blocking apps for Android and iOS, a BuzzFeed News investigation has found. These apps, which don't disclose their connection to the company or reveal that they feed user data to Sensor Tower's products, have more than 35 million downloads. Since 2015, Sensor Tower has owned at least 20 Android and iOS apps. Four of these -- Free and Unlimited VPN, Luna VPN, Mobile Data, and Adblock Focus -- were recently available in the Google Play store. Adblock Focus and Luna VPN were in Apple's App Store. Apple removed Adblock Focus and Google removed Mobile Data after being contacted by BuzzFeed News. The companies said they continue to investigate.

Once installed, Sensor Tower's apps prompt users to install a root certificate, a small file that lets its issuer access all traffic and data passing through a phone. The company told BuzzFeed News it only collects anonymized usage and analytics data, which is integrated into its products. Sensor Tower's app intelligence platform is used by developers, venture capitalists, publishers, and others to track the popularity, usage trends, and revenue of apps. Randy Nelson, Sensor Tower's head of mobile insights, said the company's apps do not collect sensitive data or personally identifiable information and that "the vast majority of these apps listed are now defunct (inactive) and a few are in the process of sunsetting." But, as BuzzFeed points out, most of the apps are no longer available "because they were removed due to policy violations."

An anonymous reader quotes a report from ZDNet: AMD processors manufactured between 2011 and 2019 (the time of testing) are vulnerable to two new attacks, research published this week has revealed (PDF). The two new attacks impact the security of the data processed inside the CPU and allow the theft of sensitive information or the downgrade of security features. The research team said it notified AMD of the two issues in August 2019, however, the company has not released microcode (CPU firmware) updates, claiming these "are not new speculation-based attacks," a statement that the research team disagrees with.

The two new attacks target a feature of AMD CPUs known as the L1D cache way predictor. Introduced in AMD processors in 2011 with the Bulldozer microarchitecture, the L1D cache way predictor is a performance-centric feature that reduces power consumption by improving the way the CPU handles cached data inside its memory. A high-level explanation is available below: "The predictor computes a uTag using an undocumented hash function on the virtual address. This uTag is used to look up the L1D cache way in a prediction table. Hence, the CPU has to compare the cache tag in only oneway instead of all possible ways, reducing the power consumption." The two new attacks were discovered after a team of six academics [...] reverse-engineered this "undocumented hashing function" that AMD processors were using to handle uTag entries inside the L1D cache way predictor mechanism. Knowing these functions, allowed the researchers to recreate a map of what was going on inside the L1D cache way predictor and probe if the mechanism was leaking data or clues about what that data may be. While the attacks can be patched, AMD denies that these two new attacks are a concern, claiming they "are not new speculation-based attacks" and that they should be mitigated through previous patches for speculative execution side channel vulnerabilities.

The research team says AMD's response is "rather misleading," and that the attacks still work on fully-updated operating systems, firmware, and software even today.

The Brave browser is working on a feature that will randomize its "fingerprint" every time a user visits a website in an attempt to preserve the user's privacy. From a report: Brave's decision comes as online advertisers and analytics firms are moving away from tracking users via cookies to using fingerprints. [...] "The unfortunate truth about all these approaches is that, despite being well-intentioned, none of them are very effective in preventing fingerprinting," the Brave team said of other browser makers' approaches. "The enormous diversity of fingerprinting surface in modern browsers makes these 'block', 'lie' or 'permission' approaches somewhere between insufficient and useless, unfortunately," they added. "Brave's new approach aims to make every browser look completely unique, both between websites and between browsing sessions," Brave developers said.

Jake Voytko, who previously worked at Google, writing in a blog post: [...] Let's move away from Google's competitive advantages. How does DuckDuckGo perform for most of my search traffic? DuckDuckGo does a good job. I haven't found a reason to switch back to Google. I combed through my browser's history of DuckDuckGo searches. I compared it to my Google search history. When I fell back to Google, I often didn't find what I wanted on Google either. Most of my searches relate to my job, which means that most of my searches are technical queries. DuckDuckGo serves good results for my searches. I'll admit that I'm a paranoid searcher: I reformat error strings, remove identifiers that are unique to my code, and remove quotes before searching. I'm not sure how well DuckDuckGo would handle copy/pasted error strings with lots of quotes and unique identifiers. This means that I don't know if DuckDuckGo handles all technical searches well. But it does a good job for me.

There are many domains where Google outperforms DuckDuckGo. Product search and local search are some examples. I recently made a window plug. It was much easier to find which big-box hardware stores had the materials I need with Google. I also recently bought a pair of ANC headphones. I got much better comparison information starting at Google. Google also shines with sparse results like rare programming error messages. If you're a programmer, you know what I'm talking about: imagine a Google search page with three results. One is a page in Chinese that has the English error string, one is a forum post that gives you the first hint that you need to solve the problem, and one is the error string in the original source code in Github. DuckDuckGo often returns nothing for these kinds of searches. Even though Google is better for some specific domains, I am confident that DuckDuckGo can find what I need. When it doesn't, Google often doesn't help either.

DoNotPay, the digital lawyer that shot to prominence for its bot that helps drivers appeal parking tickets, has launched a new product aimed at consumers. With the DoNotPay Subscription Sharing Chrome extension, anyone can share access to their online accounts -- like Spotify, Netflix, Disney+ -- without divulging their password. From a report: To use the service, you need to install the DoNotPay Chrome extension, after which you'll be prompted to verify yourself by entering your mobile number and submitting an access code that is sent by SMS. Then, whenever you're logged into a website that you would like to share, such as Netflix or Spotify, you can tap the little DoNotPay icon at the top of the browser and then hit Generate Link. You'll be able to copy a link to share or enter a recipient's email address and push the Send Invite button. The recipient also needs to install the Chrome extension and verify themselves through DoNotPay, as this enables the sender to maintain control over who has access.

The account owner is able to revoke access at any time Joshua Browder, founder of DoNotPay, said there are no hard limits in terms of how many people you can share a link with. However, it's worth noting that many services automatically restrict the number of devices that can stream content simultaneously. [...] In terms of the underlying technology, DoNotPay effectively enables the secure transfer of a logged-in session by encrypting cookies for the website that is being shared.

Fast Company's Mark Sullivan argues that cancelling this year's tech conferences could have a silver lining -- by encouraging a movement toward virtual conferences: There are developers across the U.S. and around the world who get shut out when the conferences get sold out. Even more of them simply can't afford the admission fee (last year's WWDC was $1599) and travel expenses required to spend time in the Bay Area or Seattle. Apple uses a lottery system to pick registered developers at random, who then get the opportunity to buy a ticket for the event. "Not having a set of 5,000 people who paid to be there, and potentially millions of other people who don't get access to things exclusive to those attending, such as labs and all of the networking, but instead having everyone on the same level can be a good thing," says iOS developer Guilherme Rambo.

Even before the coronavirus came along, the major developer conferences were developing more robust online elements. Far more people stream the keynotes than watch them in person. Many conference now stream the developer sessions as well. And an increasing body of sessions from the events is archived online... With all the cancellations this year, big tech companies like Apple may get some time to really think about the value of big events in the age of live streaming. Apple, for one, might think about ways of further virtualizing WWDC.

An anonymous reader shares a report: Last month, a cybersecurity firm discovered the first-ever Android malware that came with the capability to steal the 2FA (two-factor authentication) codes generated by the Google Authenticator app. The malware, discovered by researchers from ThreatFabric, was named Cerberus, and its 2FA OTP code-stealing feature was still under development, yet to have been detected in a real-world attack. According to researchers, the malware was a hybrid between a banking trojan and a remote access trojan (RAT).

Once an Android user got infected, the hacker would use the malware's banking trojan features to steal credentials for mobile banking apps. If an account was protected by 2FA, and namely by the Google Authenticator app, the malware was designed to allow the Cerberus gang to connect to a user's device manually, via its RAT features. Hackers would then open the Authenticator app, generate one-time passcodes, take a screenshot of the codes, and then access the user's account. [...] Nightwatch researchers said that Google could have fixed this issue as early as October 2014, when this misconfiguration was first brought to its attention by someone on GitHub.

Speaking at the RSA security conference last week, Microsoft engineers said that 99.9% of the compromised accounts they track every month don't use multi-factor authentication, a solution that stops most automated account attacks. From a report: The cloud giant said it tracks more than 30 billion login events per day and more than one billion monthly active users. Microsoft said that, on average, around 0.5% of all accounts get compromised each month, a number that in January 2020 was about 1.2 million. While all account hacks are bad, they are worse when the account is for enterprise use. Of these highly-sensitive accounts, only 11% had a multi-factor authentication (MFA) solution enabled, as of January 2020, Microsoft said. In most cases, the account hacks happen after rather simplistic attacks. The primary sources of most hacks of Microsoft accounts was password spraying, a technique during which an attacker picks a common and easy-to-guess password, and goes through a long list of usernames until they get a hit and can access an account using said password.

Ten years ago, David Wang pulled off a remarkable trick, installing Android on the first-generation iPhone. Now Wang and his colleagues at cybersecurity startup Corellium are doing it again with the ostentatiously titled Project Sandcastle. From a report: And Forbes got an exclusive hands-on look at their Android for iPhone product ahead of its public release scheduled for later this Wednesday. The timing is sure to have Apple fanboys rubbernecking: Corellium is in the middle of being sued by Apple. As previously reported by Forbes, in August last year, Corellium was taken to court over Apple claims the startup breached copyright laws by creating software versions of the iPhone for security and testing. The case took a surprise turn late last month when Apple subpoenaed Spanish banking giant Santander and the $50 billion U.S. military and intelligence contractor L3Harris.

But Corellium has lofty ambitions for Project Sandcastle, saying that it'll actually show how Apple's walled garden, which it has fiercely protected since launching its flagship phone in 2007, can be deconstructed and taken over by others' software. "Project Sandcastle is about having fun building something new from the sand -- from the literal silicon of the hardware," said Corellium CEO Amanda Gorton, in a statement sent to Forbes. "Apple restricts iPhone users to operate inside a sandbox, but users own that hardware, and they should be able to use that hardware the way they want. So where sandboxes create limits and boundaries on the hardware that users own, sandcastles provide an opportunity to create something new and wonderful from the limitless bounds of your imagination."

A bipartisan pair of US senators on Thursday introduced long-rumored legislation known as the EARN IT Act. The bill is meant to combat child sexual exploitation online, but if passed, it could hurt encryption as we know it. Matthew Green, a cryptographer and professor at Johns Hopkins University, writes: Because the Department of Justice has largely failed in its mission to convince the public that tech firms should stop using end-to-end encryption, it's decided to try a different tack. Instead of demanding that tech firms provide access to messages only in serious criminal circumstances and with a warrant, the DoJ and backers in Congress have decided to leverage concern around the distribution of child pornography, also known as child sexual abuse material, or CSAM. [...] End-to-end encryption systems make CSAM scanning more challenging: this is because photo scanning systems are essentially a form of mass surveillance -- one that's deployed for a good cause -- and end-to-end encryption is explicitly designed to prevent mass surveillance. So photo scanning while also allowing encryption is a fundamentally hard problem, one that providers don't yet know how to solve.

All of this brings us to EARN IT. The new bill, out of Lindsey Graham's Judiciary committee, is designed to force providers to either solve the encryption-while-scanning problem, or stop using encryption entirely. And given that we don't yet know how to solve the problem -- and the techniques to do it are basically at the research stage of R&D -- it's likely that "stop using encryption" is really the preferred goal. EARN IT works by revoking a type of liability called Section 230 that makes it possible for providers to operate on the Internet, by preventing the provider for being held responsible for what their customers do on a platform like Facebook. The new bill would make it financially impossible for providers like WhatsApp and Apple to operate services unless they conduct "best practices" for scanning their systems for CSAM. Since there are no "best practices" in existence, and the techniques for doing this while preserving privacy are completely unknown, the bill creates a government-appointed committee that will tell technology providers what technology they have to use. The specific nature of the committee is byzantine and described within the bill itself. Needless to say, the makeup of the committee, which can include as few as zero data security experts, ensures that end-to-end encryption will almost certainly not be considered a best practice.

Investors and clients of the facial recognition start-up freely used the app on dates and at parties -- and to spy on the public. From a report: One Tuesday night in October 2018, John Catsimatidis, the billionaire owner of the Gristedes grocery store chain, was having dinner at Cipriani, an upscale Italian restaurant in Manhattan's SoHo neighborhood, when his daughter, Andrea, walked in. She was on a date with a man Mr. Catsimatidis didn't recognize. After the couple sat down at another table, Mr. Catsimatidis asked a waiter to go over and take a photo. Mr. Catsimatidis then uploaded the picture to a facial recognition app, Clearview AI, on his phone. The start-up behind the app has a database of billions of photos, scraped from sites such as Facebook, Twitter and LinkedIn. Within seconds, Mr. Catsimatidis was viewing a collection of photos of the mystery man, along with the web addresses where they appeared: His daughter's date was a venture capitalist from San Francisco.. Ms. Catsimatidis said she and her date had no idea how her father had identified him so quickly.

Clearview was unknown to the general public until this January, when The New York Times reported that the secretive start-up had developed a breakthrough facial recognition system that was in use by hundreds of law enforcement agencies. The company quickly faced a backlash on multiple fronts. Facebook, Google and other tech giants sent cease-and-desist letters. Lawsuits were filed in Illinois and Virginia, and the attorney general of New Jersey issued a moratorium against the app in that state. [...] The Times, however, has identified multiple individuals with active access to Clearview's technology who are not law enforcement officials. And for more than a year before the company became the subject of public scrutiny, the app had been freely used in the wild by the company's investors, clients and friends.

Tens of millions of merchants and users in India are struggling to make online transactions and use several popular services after the nation's central bank seized control of Yes Bank, the fourth largest lender in the country. From a report: The emergency takeover of the private sector bank has taken off several financial startups that rely on it for facilitating services such as processing QR codes, point-of-sale terminals as well as transactions of UPI-based payments. Leading payments app PhonePe, owned by e-commerce giant Walmart, has been inaccessible to tens of millions of its users since Thursday evening (local time). The startup said in a statement that it was working to restore its services, and has solved some of the issues for its merchant partners. [...]

New Delhi took over Yes Bank midnight on Thursday, after the Reserve Bank of India said it had no alternative but to implement measures to replace the private sector firm's board and temporarily restrict withdrawals and suspend all other transactions for 30 days. Yes Bank has struggled for months to raise capital to improve its financials. According to NPCI, Yes Bank is the technology banking partner for ticketing platforms Cleartrip, MakeMyTrip, and RedBus, telecom operator Airtel, food-delivery startup Swiggy, movie ticketing business BookMyShow and PVR, Microsoft's chat service Kaizala, as well as several other Flipkart properties including the marquee service, fashion platforms Jabong, and Myntra.

Facebook filed a lawsuit this week against Namecheap, claiming the domain name registrar has refused to cooperate in an investigation into a series of malicious domains that have been registered through its service and which impersonated the Facebook brand. ZDNet reports: Christen Dubois, Director and Associate General Counsel at Facebook, said today that Facebook engineers tracked down 45 suspicious Facebook lookalike domains registered through Namecheap, which had the owners' details hidden through the company's WhoisGuard side-service. Some of the sample domains included the likes of instagrambusinesshelp.com, facebo0k-login.com, and whatsappdownload.site. Dubois said lookalike domains like these -- which abuse the Facebook brand -- are often used for phishing, fraud, and scams.

"We sent notices to Whoisguard between October 2018 and February 2020, and despite their obligation to provide information about these infringing domain names, they declined to cooperate," Dubois said. "We don't want people to be deceived by these web addresses, so we've taken legal action," the Facebook exec said.

Microsoft has announced that its cross-platform automation tool and configuration framework PowerShell 7 is now generally available. From a report: Available for Windows, macOS and Linux, PowerShell 7 sees Microsoft moving from .NET Core 2.x to 3.1 which enables greater backwards compatibility with existing Windows PowerShell modules thanks to the resurrection of numerous .NET Framework APIs. The cross-platform nature of PowerShell 7 means that Ubuntu, openSUSE, Fedora, Debian and other Linux distro are embraced. Joey Aiello, product manager of PowerShell, says: "If you weren't able to use PowerShell Core 6.x in the past because of module compatibility issues, this might be the first time you get to take advantage of some of the awesome features we already delivered since we started the Core project!"

A major electronics manufacturer for defense and communications markets was knocked offline after a ransomware attack, TechCrunch reported Thursday. From the report: A source with knowledge of the incident told TechCrunch that the defense contractor paid a ransom of about $500,000 shortly after the incident in mid-January, but that the company was not yet fully operational. California-based Communications & Power Industries (CPI) makes components for military devices and equipment, like radar, missile seekers and electronic warfare technology. The company counts the U.S. Department of Defense and its advanced research unit DARPA as customers. The company confirmed the ransomware attack. "We are working with a third-party forensic investigation firm to investigate the incident. The investigation is ongoing," said CPI spokesperson Amanda Mogin. "We have worked with counsel to notify law enforcement and governmental authorities, as well as customers, in a timely manner."

Wolfcom, a company that makes technology for police, is pitching body cameras with live facial recognition to law enforcement groups across the United States, OneZero reported Thursday. From a report: It's a move that pushes against industry norms: Axon, the largest manufacturer of body cameras in the United States, declared last year that it would not put the invasive technology in its hardware, citing "serious ethical concerns." NEC, which sells live facial recognition elsewhere in the world, has also not sold it to U.S. law enforcement. Wolfcom claims to have sold body cameras to at least 1,500 police departments, universities, and federal organizations across the country. It has been developing live facial recognition for the Halo, Wolfcom's newest body camera model, according to documents and a video obtained by OneZero through public records requests. This new initiative makes Wolfcom the first major body camera provider in the United States to pursue live facial recognition, a controversial stance given a nationwide push from privacy advocates to ban the technology.

Security researchers say that a bug in one of Intel's CPU technologies that was patched last year is actually much worse than previously thought. From a report: "Most Intel chipsets released in the last five years contain the vulnerability in question," said Positive Technologies in a report published today. Attacks are impossible to detect, and a firmware patch only partially fixes the problem. To protect devices that handle sensitive operations, researchers recommend replacing CPUs with versions that are not impacted by this bug. Only the latest Intel 10th generation chips are not vulnerable, researchers said. The actual vulnerability is tracked as CVE-2019-0090, and it impacts the Intel Converged Security and Management Engine (CSME), formerly called the Intel Management Engine BIOS Extension (Intel MEBx).

Certain apps are hiding themselves and stealing resources and data from mobile devices, according to a new report by security firm McAfee. From a report: This is a growing threat comprising almost half of all malicious mobile malware, and a 30% increase from 2018, said Raj Samani, chief scientist and McAfee fellow, who authored the Q1 2020 McAfee Mobile Threat Report. "This shows where the focus from criminals [is] on the mobile platform, which is in stark contrast to non-mobile malware,'' Samani said. A new malware family called LeifAccess or Shopper is taking advantage of the accessibility features in Android to create accounts, download apps, and post reviews, according to the report. LeifAccess, "is a broad campaign [and] is using alternate methods to achieve installation but thereafter trying to achieve legitimacy to the user with fake warnings," Samani said. For example, LeifAccess does not create an icon or shortcut, "so it's not immediately obvious that the app is installed ... but for some of the hidden apps within the report, malicious mobile attacks will even masquerade as a legitimate app," he said.