An anonymous reader quotes a report from The Guardian: The British government is helping a controversial Israeli spyware company to market its surveillance technologies at a secretive trade fair visited by repressive regimes, the Guardian can reveal. The government will host the NSO Group, which sells technology that has allegedly been used by autocratic regimes to spy on the private messages of journalists and human rights activists, at the closed Security and Policing trade fair in Hampshire next month. The NSO Group is due to be an exhibitor at the three-day fair, where police and security officials from abroad can browse commercial stalls selling surveillance and crowd-control equipment.

Around 60 foreign delegations are typically hosted by the British government to the fair. In the last four years they have included countries whose human rights records have been criticized such as Saudi Arabia, Egypt, the UAE, Oman, Qatar and Hong Kong. The identities of this year's delegations are not known as they are usually announced on the opening day of the fair. NSO has faced allegations that its technology is used to target human rights activists and reporters around the world. At least three UK residents are among those who are alleged to have been targeted using spyware sold by NSO. Among them is a prominent London-based satirist who is suing Saudi Arabia in the UK courts alleging that the Riyadh regime targeted him using malware developed by the firm. The closed Security and Policing trade fair will take place on March 3 at the Farnborough airport exhibition center.

A ransomware gang is installing vulnerable GIGABYTE drivers on computers it wants to infect. From a report: The purpose of these drivers is to allow the hackers to disable security products so their ransomware strain can encrypt files without being detected or stopped. This new novel technique has been spotted in two ransomware incidents so far, according to UK cybersecurity firm Sophos. In both cases, the ransomware was RobbinHood, a strain of "big-game" ransomware that's usually employed in targeted attacks against selected, high-value targets. In a report published late last night, Sophos described this new technique as follows:
1. Ransomware gang gets a foothold on a victim's network.
2. Hackers install legitimate Gigabyte kernel driver GDRV.SYS.
3. Hackers exploit a vulnerability in this legitimate driver to gain kernel access.
4. Attackers use the kernel access to temporarily disable the Windows OS driver signature enforcement.
5. Hackers install a malicious kernel driver named RBNL.SYS.
6. Attackers use this driver to disable or stop antivirus and other security products running on an infected host.
7. Hackers execute the RobbinHood ransomware and encrypt the victim's files

Jeffrey Ladish writes: I was recently the (unsuccessful) target of a very well-crafted phishing scam. As part of a housing search a few weeks ago, I was trawling craigslist and zillow for rental opportunities in the SF bay area. I reached out to a beautiful looking rental place to inquire about a tour. Despite my experience as a security professional, I didn't realize this was a scam until about the third email! Below I will account the story in excessive detail including screenshots. [...] The phishing team -- and given the work involved and the level of polish I bet it was a team -- ran a pretty tight operation. Their English was perfect, their emails looked professional, and their phishing site looked identical the original Airbnb site. The email domain "engineers-hibernia-chevron [dot] ca" redirected to "hibernia [dot] ca" to add legitimacy for those who took the extra step of looking up the domain.

I'm even more impressed by their subtle psychological tricks. Each step of the way, they left out information which required me to ask for something if I wanted to proceed. It's a lot easier to be on your guard when others are asking you for things. When you're the one doing the asking, it's even harder to say something when things look strange, because you may already feel like you're being a burden on their time. For the initial ad, they left out the phone number so I had to ask. After they told me I could look at their airbnb site, I had to ask for a link. Then, after they sent me to search on Airbnb's site, I had to ask for the link again! That was deliberately planned! Throughout these interactions, they mentioned there were other people looking, maintaining a plausible sense of urgency. Finally, using Airbnb as the phishing site was clever, because it gave the impression of a trusted middleman. I was genuinely thrown off at first, because I couldn't figure out how they were planning to steal my financial information. If they had just asked for bank or credit card information early on, their game would have been easy to spot.

Makers of productivity suite Basecamp have announced Hey, an email product they plan to release this spring. Basecamp founder and CEO, Jason Fried shared the vision for what they are calling a much-improved approach to email in an open letter today on the Hey website: You started getting stuff you didn't want from people you didn't know. You lost control over who could reach you. You were forced to inherit other people's bad communication habits. Then an avalanche of automated emails amplified the clutter. And Gmail, Outlook, Yahoo, Apple, and all the others just let it happen. Now email feels like a chore, rather than a joy. Something you fall behind on. Something you clear out, not cherish. Rather than delight in it, you deal with it. Your relationship with email changed, and you didn't have a say.

So good news, the magic's still there. It's just obscured -- buried under a mess of modern day bad habits and neglect. Some from people, some from machines, a lot from email systems. It deserves a dust off. A renovation. Modernized for the way we email today. With HEY, we've done just that. It's a redo, a rethink, a simplified, potent reintroduction of email. A fresh start, the way it should be. For web, iOS, and Android. HEY is our love letter to email, and we're sending it to you. Over 12,000 people have requested early access to Hey since yesterday, said David Heinemeier Hansson, founder of Basecamp, and creator of Ruby on Rails.

Microsoft's PowerToys utilities have always proved popular, and the arrival of a Windows 10 version was met with huge excitement. New utilities have been released over the last few months, and now there is news of a new addition: Keyboard Shortcut Manager. From a report: Despite the name, Keyboard Shortcut Manager does much more than give you control over keyboard shortcuts. On top of this, the PowerToy can be used to remap keys -- something that will be welcomed by power users, developers and people switching from macOS or Linux to Windows. At the moment, Keyboard Shortcut Manager is still in development, and it's not quite clear when there will be a version to download. But judging by how quickly the existing PowerToys have moved from embryonic ideas into fully fledged products, it shouldn't be too long before an installable version appears. When it does, it could be known simply as Keyboard Manager.

An anonymous reader quotes a report from ZDNet: Google has patched this week a critical security flaw in Android's Bluetooth component. If left unpatched, the vulnerability can be exploited without any user interaction and can even be used to create self-spreading Bluetooth worms. Researchers said that exploiting the bug requires no user interaction. All that is required is that the user has Bluetooth enabled on his device. However, while this requirement would have limited the attack surface in past years, it does not today since modern Android OS versions ship with Bluetooth enabled by default and many Android users use Bluetooth-based headphones meaning the Bluetooth service is likely to be enabled on many handsets. The bug can lead to remote code execution and the hijacking of a device. Fixes for the bug are available via the Android February 2020 Security Bulletin, which has been available for download starting this week. Android 9 and earlier are impacted.

A second software problem during a CST-100 Starliner test flight is prompting a NASA safety panel to recommend a review of Boeing's software verification processes. Space News reports: That new software problem, not previously discussed by NASA or Boeing, was discussed during a Feb. 6 meeting of NASA's Aerospace Safety Advisory Panel that examined the December uncrewed test flight of Starliner that was cut short by a timer error. That anomaly was discovered during ground testing while the spacecraft was in orbit, panel member Paul Hill said. "While this anomaly was corrected in flight, if it had gone uncorrected, it would have led to erroneous thruster firings and uncontrolled motion during [service module] separation for deorbit, with the potential for a catastrophic spacecraft failure," he said.

The exact cause of the failure remains under investigation by Boeing and NASA, who are also still examining the timer failure previously reported. Those problems, Hill said, suggested broader issues with how Boeing develops and tests the software used by the spacecraft. "The panel has a larger concern with the rigor of Boeing's verification processes," he said. The panel called for reviews of Boeing's flight software integration and testing processes. "Further, with confidence at risk for a spacecraft that is intended to carry humans in space, the panel recommends an even broader Boeing assessment of, and corrective actions in, Boeing's [systems engineering and integration] processes and verification testing." The panel added that all those investigations and reviews be completed as "required input for a formal NASA review to determine flight readiness for either another uncrewed flight test or proceeding directly to a crewed test flight."

A security firm consulted by ProPublica found that the "IowaReporter" app used to count and report votes from individual precincts in the Iowa Democratic caucuses was vulnerable to hacking. From the report: The IowaReporterApp was so insecure that vote totals, passwords and other sensitive information could have been intercepted or even changed, according to officials at Massachusetts-based Veracode, a security firm that reviewed the software at ProPublica's request. Because of a lack of safeguards, transmissions to and from the phone were left largely unprotected. Chris Wysopal, Veracode's chief technology officer, said the problems were elementary. He called it a "poor decision" to release the software without first fixing them. "It is important for all mobile apps that deal with sensitive data to have adequate security testing, and have any vulnerabilities fixed before being released for use," he said.

There's no evidence that hackers intercepted or tampered with caucus results. An attack would have required some degree of sophistication, but it would have been much easier to pull off had a precinct worker used an open Wi-Fi hotspot to report votes instead of a cell data plan. The U.S. Department of Homeland Security offered to test the app for the Iowa Democratic Party, but the party never took the government up on it, according to a U.S. official familiar with the matter who was not authorized to speak publicly. The official said the party did participate in a dry run, known as a tabletop exercise. The party did not respond to requests for comment on this issue. Gerard Niemira, Shadow's CEO, said in a statement to ProPublica that "we are committed to the security of our products, including the app used during the Iowa caucuses. While there were reporting delays, what was most important is that the data was accurate and the caucus reporting process remained secure throughout."

"Our app underwent multiple, rigorous tests by a third party, but we learned today that a researcher found a vulnerability in our app. As with all software, sometimes vulnerabilities are discovered after they are released." He added that no "hack or intrusion" occurred during the caucuses, and that "the integrity of the vote in Iowa was not compromised in any way." The app is not currently in use, he said.

NBC News is also reporting that the phone number used to report Iowa caucus results was posted on 4chan on Monday night "along with encouragement to 'clog the lines,' an indication that jammed phone lines that left some caucus managers on hold for hours may have in part been due to prank calls."

Software engineer Robert Heaton writes: Last week I set up my tablet on my new laptop. As part of installing its drivers I was asked to accept Wacom's privacy policy. Being a mostly-normal person I never usually read privacy policies. Instead I vigorously hammer the "yes" button in an effort to reach the game, machine, or medical advice on the other side of the agreement as fast as possible. But Wacom's request made me pause. Why does a device that is essentially a mouse need a privacy policy? I wondered. Sensing skullduggery, I decided to make an exception to my anti-privacy-policy-policy and give this one a read.

In Wacom's defense (that's the only time you're going to see that phrase today), the document was short and clear, although as we'll see it wasn't entirely open about its more dubious intentions. In addition, despite its attempts to look like the kind of compulsory agreement that must be accepted in order to unlock the product behind it, as far as I can tell anyone with the presence of mind to decline it could do so with no adverse consequences. With that attempt at even-handedness out the way, let's get kicking. In section 3.1 of their privacy policy, Wacom wondered if it would be OK if they sent a few bits and bobs of data from my computer to Google Analytics, "[including] aggregate usage data, technical session information and information about [my] hardware device." The half of my heart that cares about privacy sank. The other half of my heart, the half that enjoys snooping on snoopers and figuring out what they're up to, leapt. It was a disjointed feeling, probably similar to how it feels to get mugged by your favorite TV magician.

Academics from Israel have detailed and demoed a new method for stealing data from air-gapped computers. From a report: The method relies on making small tweaks to an LCD screen's brightness settings. The tweaks are imperceptible to the human eye, but can be detected and extracted from video feeds using algorithmical methods. This article describes this innovative new method of stealing data, but readers should be aware from the start that this attack is not something that regular users should worry about, and are highly unlikely to ever encounter it. Named BRIGHTNESS, the attack was designed for air-gapped setups -- where computers are kept on a separate network with no internet access. Air-gapped computers are often found in government systems that store top-secret documents or enterprise networks dedicated to storing non-public proprietary information.

In a blog post promoting the capabilities of its commercial security platform -- the Microsoft Defender ATP -- Microsoft said that on a daily basis the company's security team detects and tracks on average around 77,000 active web shells, spread across 46,000 infected servers. From a report: But while the Microsoft blog post goes on to promote Defender ATP's industry-recognized detection capabilities, the nugget in Microsoft's recent marketing material is the 77,000 and 46,000 daily statistics. These two numbers are staggering in terms of size, and especially the 77,000 figure, which is far far larger than any previous reports about web shell prevalence. For example, earlier this month GoDaddy's Sucuri reported on cleaning around 3,600 web shells from hacked websites during all last year, in 2019, a number dwarfed by Microsoft's daily detection count. Microsoft's numbers highlight the prevalence of these tools in the today's hackers' arsenals -- where web shells are considered a must for every threat actor, from lowly hacktivist groups defacing websites to state-sponsored cyber-espionage groups.

An anonymous reader shares a report: One of the most interesting details from the yesterday's Joshua Schulte trial involved how the FBI obtained the Vault 7 and Vault 8 materials they entered into evidence yesterday. Because the FBI did not want to download the files onto an existing FBI computer (in part, out of malware concerns) and because they didn't want to use an FBI IP address, they got a new computer and downloaded all the files at Starbucks.

An anonymous reader shares a report: Four years ago, security researchers showed how a flying drone could hack an entire room full of Philips Hue smart light bulbs from outside a building, by setting off a virus-like chain reaction that jumped from bulb to bulb. Today, we're learning that vulnerability never got fully fixed -- and now, researchers have figured out a way to exploit that very same issue to potentially infiltrate your home or corporate network, unless you install a patch. That's the word from cybersecurity research firm Check Point Software, and the good news is you should already be safe from the worst part of the hack. If the Philips Hue Hub that controls your bulbs is connected to the internet, it should have automatically updated itself to version 1935144040 by now, which contains the patch you want. (Check Point informed Philips in November, and a patch was issued mid-January.)

An anonymous reader quotes a report from Ars Technica: Sudo, a utility found in dozens of Unix-like operating systems, has received a patch for a potentially serious bug that allows unprivileged users to easily obtain unfettered root privileges on vulnerable systems. The vulnerability, tracked as CVE-2019-18634, is the result of a stack-based buffer-overflow bug found in versions 1.7.1 through 1.8.25p1. It can be triggered only when either an administrator or a downstream OS, such as Linux Mint and Elementary OS, has enabled an option known as pwfeedback. With pwfeedback turned on, the vulnerability can be exploited even by users who aren't listed in sudoers, a file that contains rules that users must follow when using the sudo command.

"Exploiting the bug does not require sudo permissions, merely that pwfeedback be enabled," an advisory published by sudo developers said. "The bug can be reproduced by passing a large input to sudo via a pipe when it prompts for a password." The advisory lists two flaws that lead to the vulnerability. The first: pwfeedback isn't ignored as it should be when reading from something other than a terminal. As a result, the saved version of a line erase character remains at its initialized value of 0. The second contributor is that the code that erases the line of asterisks doesn't properly reset the buffer position if there is an error writing data. Instead, the code resets only the remaining buffer length. As a result, input can write past the end of the buffers. Systems with unidirectional pipe allow an attempt to write to the read end of the pipe to result in a write error. Because the remaining buffer length isn't reset correctly when write errors result from line erasures, the stack buffer can be overflowed. The report notes the vulnerability was introduced in 2009 and remained active until 2018, with the release of 1.8.26b1. "Systems or software using a vulnerable version should move to version 1.8.31 as soon as practical," reports Ars. "Those who can't update right away can prevent exploits by making sure pwfeedback is disabled."

Amazon's Ring doorbell has rolled out a new update that lets users add and remove shared users on an account, restrict third-party access, view two-factor authentication settings, and (perhaps, most importantly) opt out of all video request notifications from law enforcement. Mashable reports: Uncovered in reporting by Motherboard and Gizmodo in 2019, the scale of Amazon's Neighbor Portal program is much larger than originally believed -- and its various affiliations with law enforcement has raised alarming ethical questions. In the new update, users will be able to see an "Active Law Enforcement Map" clarifying which local institutions are part of the Neighbor Portal network. They will also be able to disable requests for video from officials, whether or not they have received one in the past. (This feature was available previously, but an account had to have received one request for the opt-out option to appear.)

That said, Ring is suggesting users allow video request notifications -- citing specific instances where such evidence helped solve criminal cases. According to Ring's official press release, the control center update will be made available to all Android and iOS users within "the next few days." Per the same release, this is the first of numerous security and privacy updates planned for the system.

The Iowa caucus debacle represents one of the most stunning failures of information security ever. From a column: This failure was delivered by the same Iowa Democratic Party officials who have said for the last four years they were "ramping up" their technology capabilities, convening seemingly endless security task forces to ensure foreign powers did not disenfranchise voters, and collaborating with federal agencies like the Department of Homeland Security to make sure everyone was in the loop on voting security. Voters will be paying close attention to how party leaders ensure that votes going forward have clear contingency plans in place, not just to protect against hackers, but from all types of technology failures, including applications that might not work.

Iowa officials counting the results coming in Monday from the caucusing app reported irregularities that required them to switch from the app to counting votes manually. Party officials said the "underlying data" put into the app was fine, but it is unclear as of yet how they know this or even what they consider "underlying data." "Last night, more than 1,600 precinct caucuses gathered across the state of Iowa and at satellite caucuses around the world," the Iowa Democratic Party said in a statement Tuesday. "As precinct caucus results started coming in, the IDP ran them through an accuracy and quality check. It became clear that there were inconsistencies with the reports. The underlying cause of these inconsistencies was not immediately clear, and required investigation, which took time."

Google security engineers said last week they have successfully cut down the "patch gap" in Google Chrome from 33 days to only 15 days. From a report: The term "patch gap" refers to the time it takes from when a security bug is fixed in an open source library to when the same fix lands in software that uses that particular library. In today's software landscape where many apps rely on open source components, the "patch gap" is considered a major security risk. The reason is because when a security bug is fixed in an open source library, details about that bug become public, primarily due to the public nature and openness of most open source projects. Hackers can then use details about these security flaws to craft exploits and launch attacks against software that relies on the vulnerable component, before the software maker has a chance to release a patch. If the software maker is on a fixed release schedule, with updates coming out every few weeks or months, the patch gap can provide hackers with an attack window that most software projects can't deal with.

If you used Google Takeout to download an archive of your Google Photos content, there's a chance that someone else may have ended up with your videos. From a report: The company has admitted that for a few days in November last year, "some videos in Google Photos were exported to unrelated users' archives." This means that not only could your videos have ended up on a stranger's computer, but also that you may have received random videos belonging to someone else. Google is not making much of the "technical issue" which it says has now been resolved. But the company apologizes for the "inconvenience" that may have been caused for people downloading their Google Photos archive between November 21 and 25, 2019.

An anonymous reader quotes a report from Ars Technica: A 21-year-old California man has pleaded guilty to hacking Nintendo's servers multiple times since 2016, using phishing techniques to gain early access to information about the company's plans. Ryan S. Hernandez, who went by RyanRocks online, worked with an unnamed associate to phish employee login credentials for proprietary Nintendo servers, according to an indictment filed in Washington state federal court in December and unsealed over the weekend. Hernandez used that unauthorized access to "download thousands of files, including proprietary developer tools and non-public information" about upcoming Nintendo products and "access pirated and unreleased video games."

That information (and discussion of Nintendo's internal server vulnerabilities) was leaked to the public via Twitter, Discord, and a chat room called "Ryan's Underground Hangout," prosecutors said. At one point, "RyanRocks" drew at least a little infamy in the Nintendo hacking community for allegedly leaking a Nintendo Software Development Kit that had a piece of hidden Remote Access Tool malware added to it. FBI agents confronted Hernandez about his hacking in 2017, according to a prosecution press release, and secured a promise from Hernandez "to stop any further malicious activity." But the hacking continued in 2018 and 2019, according to the indictment, until a June 2019 FBI raid that obtained hard drives with thousands of proprietary Nintendo files. The seized hard drives also included sexually explicit images of minors in a folder labeled "BAD STUFF," according to prosecutors. Hernandez has agreed to pay almost $260,000 to Nintendo as part of a plea agreement. Prosecutors are recommending a jail term of three years for Hernandez's crimes when sentencing is decided in April.

Rei writes: On Twitter yesterday evening, Elon Musk announced an upcoming AI party/hackathon to be held at his house, and that invites will be going out soon. Asked whether a person needs to have a Ph.D to attend, Musk replied no: "All that matters is a deep understanding of AI & ability to implement NNs in a way that is actually useful (latter point is what's truly hard). Don't care if you even graduated high school." The hackathon appears to be Musk's latest attempt to accumulate AI talent. Last fall, Tesla acquired AI startup DeepScale in order to bring its engineers into its team, while days ago Musk posted an AI job ad on his Twitter page.