Apple will now allow push notifications to be used for advertising, so long as users agree to receive the ads first. From a report: Apple updated its App Store guidelines today with a change to its traditionally strict restrictions around push notifications. Apple has long banned apps from using notifications for "advertising, promotions, or direct marketing purposes," but that changes today. Apps can now send marketing notifications when "customers have explicitly opted in to receive them." Users must also be able to opt out of receiving the ads.

rufey writes: The free SSL certificate provider Let's Encrypt is going to revoke 2.6% of the SSL certs issued by them that are currently active, due to a bug in boulder, the Certificate Authority Authorization (CAA) software Let's Encrypt uses. Ars Technica reports: "Let's Encrypt uses Certificate Authority software called Boulder. Typically, a Web server that services many separate domain names and uses Let's Encrypt to secure them receives a single LE certificate that covers all domain names used by the server rather than a separate cert for each individual domain. The bug LE discovered is that, rather than checking each domain name separately for valid CAA records authorizing that domain to be renewed by that server, Boulder would check a single one of the domains on that server n times (where n is the number of LE-serviced domains on that server). Let's Encrypt typically considers domain validation results good for 30 days from the time of validation -- but CAA records specifically must be checked no more than eight hours prior to certificate issuance. The upshot is that a 30-day window is presented in which certificates might be issued to a particular Web server by Let's Encrypt despite the presence of CAA records in DNS that would prohibit that issuance.

Since Let's Encrypt finds itself in the unenviable position of possibly having issued certificates that it should not have, it is revoking all current certificates that might not have had proper CAA record checking on Wednesday, March 4. Users whose certificates are scheduled to be revoked will need to manually force-renewal before then. If an admin does not perform this manual renewal step, browsers reaching their websites will show TLS security warnings due to the revoked certificates. Let's Encrypt certificates are issued for 90-day intervals, and Certbot automatically renews them only when 30 days or less are left on the cert -- so this could mean roughly two months of browser errors if the manual forced renewal isn't performed."

The CAB Forum, which oversees the public CAA space, has a ticket for this specific issue. According to a community post on Let's Encrypt's website, 3,048,289 of the ~116 million overall active Let's Encrypt certificates are affected.

An anonymous reader quotes a report from Ars Technica: Networking giant Cisco is getting into the coronavirus monitoring and mitigation game with its Webex remote meeting property. The company notes that in the wake of mandates issued to employees to halt travel plans and/or work from home, traffic across its Webex backbone has increased significantly. Webex meeting traffic connecting Chinese users to global workplaces has increased by a factor of 22 since the outbreak began; traffic in other Asian countries is up by 400 percent or more, and free signup rates in impacted countries have increased 700 percent or more. In response, Cisco is offering temporarily unlimited usage (with no time restrictions) in all countries where the service is available (full list here), not just the ones worst hit by coronavirus. The company is also offering free 90-day licenses to businesses that are not currently Webex customers and offering free upgrades to customers whose current plan is insufficient to accommodate increased traffic due to the outbreak.

In the worst affected countries, telepresence and remote work software like Webex is currently the only alternative to a complete shutdown of activities. In its press release, Cisco highlights the Nesbitt Center, an organization working with disabled young adults in Hong Kong. All Hong Kong schools, including the Nesbitt Center, have been required to suspend day programs during the outbreak. Webex videoconferencing has allowed the Nesbitt Center to continue delivering educational sessions despite the lockdown. Ars Technica also recommends Jitsi, a "free and open source software, offering video call and screen sharing capabilities." There's also Jitsi Meet for people "who just need to get something done on-the-fly with no setup at all."

Do you have a favorite remote work software?

China's largest cyber-security vendor has published today a report accusing the CIA of hacking Chinese companies and government agencies for more than 11 years. From a report: The report, authored by Qihoo 360, claims the CIA hacked targets in China's aviation industry, scientific research institutions, petroleum industry, Internet companies, and government agencies. CIA hacking operations took place between September 2008 and June 2019, and most of the targets were located in Beijing, Guangdong, and Zhejiang, Qihoo researchers said. Qihoo claims that a large part of the CIA's hacking efforts focused on the civil aviation industry, both in China and in other countries. The Chinese security firm claims the purpose of this campaign was "long-term and targeted intelligence-gathering" for the purpose of tracking "real-time global flight status, passenger information, trade freight and other related information."

Robinhood on Tuesday reported technical issues for a second day following an outage that kept clients from trading on a historic market rally. From a report: As U.S. stocks traded actively again in wake of a surprise Fed rate cut, Robinhood reported a "major outage" for trading across its platform. Earlier updates on the site said that all trading was "operational," but Twitter users posted screenshots of error messages as U.S. markets opened Tuesday. "We are experiencing a system-wide outage," a message on Robinhood's website read. Technical issues began Monday morning and lasted throughout the trading day, leaving users with their hands tied as the Dow Jones Industrial Average's biggest one-day point gain in history. In a volatile session Tuesday, stocks surged off their lows after the Federal Reserve cut interest rates in an effort to stem slower economic growth from the coronavirus outbreak.

theodp writes: On its Careers page, zero-commission online broker Robinhood explains its founders "decided it was more important to build products that would provide everyone with access to the financial markets, not just the wealthy. Two years after heading to New York, they moved back to California and built Robinhood -- a company that leverages technology to encourage everyone to participate in our financial system." But on Monday, at least, the advantage went to the wealthy. Bloomberg reports that Robinhood suffered an outage that lasted the entire U.S. trading day and prevented customers from making trades as stocks surged after last week's rout (status). Just another reminder that we're all just one technology fail away from chaos.

Troy Hunt, the owner and founder of the well-known and respected data breach notification website "Have I Been Pwned," announced in a blog post today that his website is no longer being sold and will continue running independently. The news comes several months after Hunt announced he was actively looking for a buyer.

Last June, Hunt wrote: "To date, every line of code, every configuration and every breached record has been handled by me alone. There is no 'HIBP team,' there's one guy keeping the whole thing afloat. It's time for HIBP to grow up. It's time to go from that one guy doing what he can in his available time to a better-resourced and better-funded structure that's able to do way more than what I ever could on my own."

Now, according to Hunt, "unexpected changes" with the business model of the party believed to be the purchaser of the service "made the deal infeasible." "It wasn't something I could have seen coming nor was it anything to do with HIBP itself, but it introduced a range of new and insurmountable barriers," writes Hunt in today's blog post. Hunt goes on to explain what's been happening since April 2019 and how the service will operate in the future.

Microsoft will retire MCSA, MCSD and MCSE certifications on June 30, 2020, according to a new post by Alex Payne, GM, Global Technical Learning at Microsoft Worldwide Learning, on the Microsoft Learning Blog. twocows shares a report: Microsoft shifted its focus to role-based training and certifications in September 2018 and has added 34 different certifications since then to its portfolio "across Azure, Modern Workplace, and Business Applications". Since Microsoft is now focusing on role-based training and certifications, it will retire all remaining Microsoft Certified Solutions Associate (MCSA), Microsoft Certified Solutions Developer (MCSD) and Microsoft Certified Solutions Expert (MCSE) certifications on June 30, 2020.

Malware developers are always trying to outdo each other with creations that are stealthier and more advanced than their competitors'. At the RSA Security conference last week, a former hacker for the National Security Agency demonstrated an approach that's often more effective: stealing and then repurposing a rival's code. From a report: Patrick Wardle, who is now a security researcher at the macOS and iOS enterprise management firm Jamf, showed how reusing old Mac malware can be a smarter and less resource-intensive approach for deploying ransomware, remote access spy tools, and other types of malicious code. Where the approach really pays dividends, he said, is with the repurposing of advanced code written by government-sponsored hackers. "There are incredibly well-funded, well-resourced, very motivated hacker groups in three-letter agencies that are creating amazing malware that's fully featured and also fully tested," Wardle said during a talk titled "Repurposed Malware: A Dark Side of Recycling." "The idea is: why not let these groups in these agencies create malware and if you're a hacker just repurpose it for your own mission?" he said.

To prove the point, Wardle described how he altered four pieces of Mac malware that have been used in in-the-wild attacks over the past several years. The repurposing caused the malware to report to command servers belonging to Wardle rather than the servers designated by the developers. From there, Wardle had full control over the recycled malware. The feat allowed him to use well-developed and fully featured applications to install his own malicious payloads, obtain screenshots and other sensitive data from compromised Macs, and carry out other nefarious actions written into the malware.

An anonymous reader quotes Ars Technica: John Strand breaks into things for a living. As a penetration tester, he gets hired by organizations to attack their defenses, helping reveal weaknesses before actual bad guys find them. Normally, Strand embarks on these missions himself or deploys one of his experienced colleagues at Black Hills Information Security. But in July 2014, prepping for a pen test of a South Dakota correctional facility, he took a decidedly different tack. He sent his mom.

In fairness, it was Rita Strand's idea. Then 58, she had signed on as chief financial officer of Black Hills the previous year after three decades in the food service industry. She was confident, given that professional experience, that she could pose as a state health inspector to gain access to the prison. All it would take was a fake badge and the right patter. "She approached me one day and said 'You know, I want to break in somewhere," says Strand, who is sharing the experience this week at the RSA cybersecurity conference in San Francisco. "And it's my mom, so what am I supposed to say...?"

To help get her in the door, Black Hills made Rita a fake badge, a business card, and a "manager's" card with John's contact info on it. Assuming she got inside, she would then take photos of the facility's access points and physical security features. Rather than have her try to hack any computers herself, John equipped Rita with so-called Rubber Duckies, malicious USB sticks that she would plug into every device she could. The thumb drives would beacon back to her Black Hills colleagues and give them access to the prison's systems. Then they could work on the digital side of the pen test remotely while Rita continued her rampage.
It's a fascinating story, though Strand also points out that "Prison cybersecurity is crucial for obvious reasons.

"If someone could break into the prison and take over computer systems, it becomes really easy to take someone out of the prison."

Leading CIOs, CTOs and technology executives on the "Forbes Technology Council" just made some predictions for the future: Now that the business world has seen the power of automation, the question has become, "What's next?" The members of Forbes Technology Council are constantly looking out for new tech trends, and they believe the next jobs to be impacted by automation might not be the ones people expect...

#1. Reminders, Notifications And Reporting
Christy Johnson, AchieveIt: I think as workflow technology expands, any kind of oversight-related job will be delegated to the bots. No human will be taking the time to manually build reports, see who they're missing data from and send those employees a reminder email/plea for a status update. The tech is already around, but I think it still has a long way to go to reach human-level logic and function....

#3. App Development

Katherine Kostereva, Creatio (formerly bpm'online): In the next five years, everyone will become a developer thanks to low-code/no-code technology. It allows users to build apps and processes in a visual integrated development environment with drag and drop features. Hand-coding isn't likely to become obsolete in five years, but we are moving towards a far future where little to no coding is involved in development.

Remember when Tulsa, Oklahoma offered $10,000 to remote workers who'd relocate to their city?

It was an immensely popular program. "You have better odds of getting into Harvard or Yale than you do of getting into the Tulsa Remote program," the city's mayor told CityLab: All of the Remoters get a free one-year membership to the coworking space, though others prefer to work at home, perhaps because for some of them, home is a luxury apartment building downtown where they receive subsidized rent — another part of their welcome package...

A year after Tulsa Remote launched, the first participants — a mix of expats from expensive coastal cities, wanderlusty young adults, and those with roots in the region — say they've found many of the things they were looking for: a more comfortable and affordable quality of life, new neighbors they like, enough of an economic cushion to ease the stress of buying new furniture, and a fresh start. Many say they'll stick around past the end of the one-year program. More than that: Some of them tell stories of positive personal transformation that are so dramatic, they might appear too perfect, almost canned. But after checking in with participants over the course of eight months, I found that many of them remained just as effusive. Maybe it's something about Tulsa. Or maybe it's something about Tulsa Remote...

One "Remoter," as they're called in the Tulsa program, is a Harlem Globetrotter. Another runs an online finance site, helping people maximize their credit points. Others work in education, and online marketing, and consulting, and media. Of the 100 participants who were originally selected, 70 accepted [program director] Bolzle's offer, and two left within a few months of arriving to the city...

At least 25 participants from the first Tulsa Remote cohort have purchased property in the city, Bolzle says. One bought a $700,000 house... The endgame of Tulsa Remote is that these residents will help build a flourishing new economic ecosystem in town; they'll start families and launch start-ups and tell their friends to come join them. There's a "multiplier effect" expected of a project like this, even if the workers aren't employed by Tulsa-based companies, said Pamela Loprest, a senior fellow and labor economist in the Income and Benefits Policy Center at the Urban Institute. "They'll create other jobs and [draw] other people into that area..."

Even a few participants who had initially told me they wanted to leave when the program ended have now changed their minds.
Other states are trying variations on the idea, including Vermont, northwest Alabama, and Topeka, Kansas. "It used to be that talent went where the jobs were," the program's executive director tells them, but "That's shifting." The article notes that new development downtown -- including a $465 million riverfront park -- "seems engineered to look like a Millennial playground. The problem, says Tulsa Mayor G.T. Bynum, is there just aren't enough people to play in it..."

"Now, the program's executive director says, it's the responsibility of cities to create a community that someone would want to call home, and make sure people know to move there..."

Apache Tomcat servers released in the last 13 years are vulnerable to a bug named Ghostcat that can allow hackers to take over unpatched systems. From a report: Discovered by Chinese cybersecurity firm Chaitin Tech, Ghostcat is a flaw in the Tomcat AJP protocol. AJP stands for Apache JServ Protocol and is a performance-optimized version of the HTTP protocol in binary format. Tomcat uses AJP to exchange data with nearby Apache HTTPD web servers or other Tomcat instances. Tomcat's AJP connector is enabled by default on all Tomcat servers and listens on the server's port 8009. Chaitin researchers say they discovered a bug in AJP that can be exploited to either read or write files to a Tomcat server.

9Game.com, a portal for downloading free Android games, was the mobile app store hosting the most malicious apps in 2019. From a report: 9Game ranked number one on the list of app stores with the most "new" malicious app uploads, but also number one on the list of app stores with the highest concentration of malicious apps overall. According to RiskIQ's 2019 Mobile App Threat Landscape report, 61,669 new malicious apps were uploaded on 9Game in 2019. In this ranking, 9Game was followed at a considerable distance by the official Android app store -- the Google Play Store -- with 25,647 new malicious apps. Completing the top 5 are Qihoo 360's Zhushou store, the Feral app store, and Huawei's Vmall app store. But while the Play Store ranked second on the list of new malware uploads, its sheer size diluted the impact these malicious apps had on Android users. The Play Store didn't rank at all in the top 5 app stores with the highest concentration of malicious apps, which included (1) 9Game, (2) the Feral app store, (3) the Vmall app store, (4) the Xiaomi app store, and (5) Qihoo 360's Zhushou store.

Let's Encrypt, writing in a blog post: We issued our billionth certificate on February 27, 2020. We're going to use this big round number as an opportunity to reflect on what has changed for us, and for the Internet, leading up to this event. In particular, we want to talk about what has happened since the last time we talked about a big round number of certificates - one hundred million. One thing that's different now is that the Web is much more encrypted than it was. In June of 2017 approximately 58% of page loads used HTTPS globally, 64% in the United States. Today 81% of page loads use HTTPS globally, and we're at 91% in the United States! This is an incredible achievement. That's a lot more privacy and security for everybody.

Another thing that's different is that our organization has grown a bit, but not by much! In June of 2017 we were serving approximately 46M websites, and we did so with 11 full time staff and an annual budget of $2.61M. Today we serve nearly 192M websites with 13 full time staff and an annual budget of approximately $3.35M. This means we're serving more than 4x the websites with only two additional staff and a 28% increase in budget. The additional staff and budget did more than just improve our ability to scale though - we've made improvements across the board to provide even more secure and reliable service.

A jury on Tuesday convicted a former Microsoft worker of wire fraud and other charges in what prosecutors described as a scheme to steal $10 million in digital currency. From a report: The U.S. Attorney's Office in Seattle said 25-year-old Ukrainian citizen Volodymyr Kvashuk helped test Microsoft's online retail sales platform. He was accused of stealing digital currency such as gift cards that could be redeemed for Microsoft products, then reselling them on the internet and using the proceeds to buy a $160,000 Tesla vehicle and a $1.7 million lakefront home. He was fired in June 2018 after the scheme came to light. Prosecutors said that during the seven months of his activity, $2.8 million in bitcoin was transferred into his bank accounts.

Facial recognition company Clearview AI notified customers that an intruder had gained "unauthorized access" to its entire list of customers, The Daily Beast reports. From a report: Clearview gained widespread attention in recent weeks after a wave of media coverage, starting with The New York Times in January. The company stands out from others due to its use of a database of over 3 billion photos the firm constructed by scraping images from Facebook, Twitter, Instagram, and other social networks and websites. Clearview sells its product to law enforcement clients particularly in the U.S. The company's app allows a customer to point their phone's camera at a subject, or upload a photo into the system. Then, the system provides links to other photos and related social media profiles of the suspected person online.

Billions of devices -- many of them already patched -- are affected by a Wi-Fi vulnerability that allows nearby attackers to decrypt sensitive data sent over the air, researchers said on Wednesday at the RSA security conference. From a report: The vulnerability exists in Wi-Fi chips made by Cypress Semiconductor and Broadcom, the latter a chipmaker Cypress acquired in 2016. The affected devices include iPhones, iPads, Macs, Amazon Echos and Kindles, Android devices, Raspberry Pi 3's, and Wi-Fi routers from Asus and Huawei. Eset, the security company that discovered the vulnerability, said the flaw primarily affects Cyperess' and Broadcom's FullMAC WLAN chips, which are used in billions of devices. Eset has named the vulnerability Kr00k, and it is tracked as CVE-2019-15126.

Manufacturers have made patches available for most or all of the affected devices, but it's not clear how many devices have installed the patches. Of greatest concern are vulnerable wireless routers, which often go unpatched indefinitely. "This results in scenarios where client devices that are unaffected (either patched or using different Wi-Fi chips not vulnerable to Kr00k) can be connected to an access point (often times beyond an individual's control) that is vulnerable," Eset researchers wrote in a research paper published on Wednesday. "The attack surface is greatly increased, since an adversary can decrypt data that was transmitted by a vulnerable access point to a specific client (which may or may not be vulnerable itself)."

An anonymous reader quotes a report from Motherboard: Newly released and previously secret documents explain in greater detail how, and why, a section of the U.S. military decides to publicly release a steady stream of adversarial countries' malware, including hacking tools from North Korea and Russia. Cyber Command, or CYBERCOM, publishes the malware samples onto VirusTotal, a semi-public repository that researchers and defenders can then pore over to make systems more secure. The document provides more insight into how the U.S. military is engaged in an unusually public-facing campaign, and in particular highlights one of the reasons CYBERCOM wants to release other nation's hacking tools: to make it harder for enemy hackers to remain undetected.

A previously secret section of one of the CYBERCOM documents reads "Posting malware to VT [VirusTotal] and Tweeting to bring attention and awareness supports this strategy by putting pressure on malicious cyber actors, disrupting their efforts." Motherboard obtained the redacted documents through a Freedom of Information Act (FOIA) request to CYBERCOM. CYBERCOM started publishing malware in 2018, with one sample coming from Russian-linked hacking group APT28. It has since released malware from North Korean hackers. CYBERCOM also has a dedicated Twitter account for distributing news of the samples. Some tweets even include memes such as "DPRK MALWARE" written onto conversation candy hearts to coincide with a release on Valentines Day. When it originally announced the campaign, CYBERCOM said it "initiated an effort to share unclassified malware samples it has discovered that it believes will have the greatest impact on improving global cybersecurity." But the documents show how the effort has a more offensive slant, too. In a statement a CYBERCOM spokesperson reiterated some of the agency's earlier public comments, writing, "We plan to continue to publicly disclose malware samples, which we believe will have the greatest impact on improving global security."

You can read the documents here.

Mozilla will add a new security sandbox system to Firefox on Linux and Firefox on Mac. The new technology, named RLBox, works by separating third-party libraries from an app's native code. From a report: This process is called "sandboxing," and is a widely used technique that can prevent malicious code from escaping from within an app and executing at the OS level. RLBox is an innovative project because it takes sandboxing to the next level. Instead of isolating the app from the underlying operating system, RLBox separates an app's internal components -- namely its third-party libraries -- from the app's core engine. This technique prevents bugs and exploits found inside a third-party library from impacting another project that uses the same library.