An anonymous reader quotes a report from Ars Technica: West Virginia's legislature last week passed legislation allowing disabled voters to cast votes by smartphone, sending the bill to the desk of Governor Jim Justice. Justice is expected to sign the legislation, according to NBC. It's a decision that alarms many computer security experts, who say that the Internet and smartphones are too vulnerable to hackers.

The legislation would require every county in the state to offer smartphone voting. It doesn't specify any particular voting method, but the state has recently been experimenting with software called Voatz that tries to use a blockchain to help secure elections. West Virginia performed a small-scale pilot project with Voatz in the 2018 election, allowing about 150 overseas voters to vote using the technology. A fundamental problem with online voting, experts say, is that modern computing devices have a huge "attack surface." Even if the voting app itself is completely secure, there might still be vulnerabilities in the user's operating system, network, or the servers used to register users and collect votes. And to swing an election, a hacker doesn't need to change anyone's votes -- just preventing some of a candidate's voters from voting can be sufficient to swing a close election. But West Virginia officials have pressed forward, arguing that it's too difficult for some disabled voters to get to a physical polling place to cast votes. Washington is also considering smartphone voting. The King Conservation District, a district of 1.2 million voters encompassing Greater Seattle, may have the option to cast votes online using a smartphone.

An anonymous reader quotes a report from The Verge: Microsoft Teams went down this morning for nearly three hours after Microsoft forgot to renew a critical security certificate. Users of Microsoft's Slack competitor were met with error messages attempting to sign into the service on Monday morning, with the app noting it had failed to establish an HTTPS connection to Microsoft's servers. Microsoft confirmed the Teams service was down just after 9AM ET today, and then later revealed the source of the issue. "We've determined that an authentication certificate has expired causing users to have issues using the service," explains Microsoft's outage notification. Microsoft then started rolling the fix out at 11:20AM ET, and by 12PM ET the service was restored for most affected users.

There is now a special page in the Firefox browser where users can see what telemetry data Mozilla is collecting from their browser. From a report: Accessible by typing about:telemetry in the browser's URL address bar, this new section is a recent addition to Firefox. The page shows deeply technical information about browser settings, installed add-ons, OS/hardware information, browser session details, and running processes. The information is what you'd expect a software vendor to collect about users in order to fix bugs and keep a statistical track of its userbase. A Firefox engineer told ZDNet the page was primarily created for selfish reasons, in order to help engineers debug Firefox test installs. However, it was allowed to ship to the stable branch also as a PR move, to put users' minds at ease about what type of data the browser maker collects from its users.

A German artist illustrated [video] how it is possible to create a virtual traffic jam in Google Maps by walking around the streets of Berlin with 99 cell phones. Qbertino shares a report: Google Maps utilizes GPS and location data from mobile devices to determine if there is traffic congestion on a particular street. The app will then redirect users to less trafficked streets to avoid traffic. Using a hand cart filled with 99 active cell phones connected to Google Maps, artist Simon Weckert showed how he could create fake traffic jams in Google Maps simply by walking around the streets of Berlin. As he would be walking, rather than driving, Google Maps would perceive it to be a traffic jam due to a large number of devices reporting the same slow speed. Google's response to the matter, via blog 9to5Google: Speaking with 9to5Google, a spokesperson from Google has responded to this situation to clarify a few things. In normal usage, Google does use a large number of devices running Maps in a single place as proof of a traffic jam, something this rare and very specific case took advantage of. In the statement below, though, the company does hint that it might use cases like this to further improve how Maps handles traffic data. "Whether via car or cart or camel, we love seeing creative uses of Google Maps as it helps us make maps work better over time."

Only three of the world's Top 100 international airports pass basic security checks, according to a report published last week by cyber-security firm ImmuniWeb. From a report: The three are the Amsterdam Schiphol Airport in the Netherlands, the Helsinki Vantaa Airport in Finland, and the Dublin International Airport in Ireland. According to ImmuniWeb, these three "may serve a laudable example not just to the aviation industry but to all other industries as well." The three are the only airports that passed a long list of security tests that involved checks of their public websites, official mobile applications, and searches for leaks of sensitive airport or passenger data in places like cloud services, public code repositories, or the dark web.

Slashdot reader JustAnotherOldGuy quotes ZDNet: Security experts have published a report Tuesday warning that the new and fast-rising LoRaWAN technology is vulnerable to cyberattacks and misconfigurations, despite claims of improved security rooted in the protocol's use of two layers of encryption.

LoRaWAN stands for "Long Range Wide Area Network." It is a radio-based technology that works on top of the proprietary LoRa protocol. LoRaWAN takes the LoRa protocol and allows devices spread across a large geographical area to wirelessly connect to the internet via radio waves...

But broadcasting data from devices via radio waves is not a secure approach. However, the protocol's creators anticipated this issue. Since its first version, LoRaWAN has used two layers of 128-bit encryption to secure the data being broadcast from devices — with one encryption key being used to authenticate the device against the network server and the other against a company's backend application. In a 27-page report published Tuesday, security researchers from IOActive say the protocol is prone to misconfigurations and design choices that make it susceptible to hacking and cyber-attacks. The company lists several scenarios it found plausible during its analysis of this fast-rising protocol.
Some examples:

• "Encryption keys can be extracted from devices by reverse engineering the firmware of devices that ship with a LoRaWAN module."
• "Many devices come with a tag displaying a QR code and/or text with the device's identifier, security keys, or more."

This week a remotely-exploitable vulnerability (granting root privileges) was discovered in OpenSMTPD (OpenBSD's implementation of server-side SMTP).

ZDNet notes that the library's "portable" version "has also been incorporated into other OSes, such as FreeBSD, NetBSD, and some Linux distros, such as Debian, Fedora, Alpine Linux, and more." To exploit this issue, an attacker must craft and send malformed SMTP messages to a vulnerable server... OpenSMTPD developers have confirmed the vulnerability and released a patch earlier Wednesday -- OpenSMTPD version 6.6.2p1...

The good news is that the bug was introduced in the OpenSMTPD code in May 2018 and that many distros may still use older library versions, not affected by this issue. For example, only in-dev Debian releases are affected by this issue, but not Debian stable branches, which ship with older OpenSMTPD versions.

Technical details and proof of concept exploit code are available in the Qualys CVE-2020-7247 security advisory.
Hackaday has a more detailed description of the vulnerability, while the Register looks at the buggy C code.

Interestingly, Qualys researchers exploited this vulnerability using a technique from the Morris Worm of 1988.

Slashdot reader SpaceForceCommander shared Dice's new annual report on America's tech industry salaries based on a survey of over 12,800 "technologists": Columbus and St. Louis enjoyed double-digit year-over-year growth in salaries (14.2 percent and 13.6 percent, respectively), and other cities such as Denver [7 percent] and Atlanta [10 percent] also experienced an ideal mix of growth and high salaries. These up-and-comers benefitted from the presence of key employers such as Amazon and IBM; in addition, a lower cost of living and plentiful amenities have made them increasingly attractive to technologists, even those coming from well-established tech hubs such as Silicon Valley.

Silicon Valley remains a world of high salaries — but the cost of living in the Bay Area remains extraordinarily high, which chews into that higher-than-average paycheck. And that's before we factor in issues such as grinding commutes. In Seattle, New York City (also known as "Silicon Alley"), and other well-established tech hubs, costs are similarly high, which only makes up-and-coming tech hubs more potentially attractive to technologists.
Silicon Valley is still #1 on Dice's ranking of average annual salaries (at $123,826), followed by Seattle, San Diego, Boston, Baltimore, Portland, Denver, and then New York. (And while St. Louis ranks #9, Columbus is #17.)

But the average annual tech-industry salary rose just 1.3 percent last year, according to the survey, with Dice arguing that what made salaries vary was supply and demand. They then ranked the highest-paying skills, starting with Apache Kafka (with average reported salaries of $134,557), followed by HANA (High performance ANalytic Appliance), Cloudera, and MapReduce: Newer skills don't necessarily draw higher salaries; with many older skills, the number of proficient technologists is relatively low, which means employers are willing to pay more in order to secure their services. (That's a key reason why the handful of technologists who still know their way around an ancient mainframe can score six-figure salaries from companies that haven't given up decades-old hardware....) In the case of programming languages such as Swift, which enjoyed significant year-over-year growth and high salaries, a large number of technologists might have mastered it — but the market is huge and white-hot, ensuring that compensation will only rise.

"The WireGuard VPN protocol will be included into the next Linux kernel as Linus Torvalds has merged it into his source tree for version 5.6," reports TechRadar:
While there are many popular VPN protocols such as OpenVPN, WireGuard has made a name for itself by being easy to configure and deploy as SSH... The WireGuard protocol is a project from security researcher and kernel developer Jason Donenfeld who created it as an alternative to both IPsec and OpenVPN. Since the protocol consists of around just 4,000 lines of code as opposed to the 100,000 lines of code that make up OpenVPN, it is much easier for security experts to review and audit for vulnerabilities.

While WireGuard was initially released for the Linux kernel, the protocol is now cross-platform and can be deployed on Windows, macOS, BSD, iOS and Android.
Ars Technica notes that with Linus having merged WireGuard into the source tree, "the likelihood that it will disappear between now and 5.6's final release (expected sometime in May or early June) is vanishingly small." WireGuard's Jason Donenfeld is also contributing AVX crypto optimizations to the kernel outside the WireGuard project itself. Specifically, Donenfeld has optimized the Poly1305 cipher to take advantage of instruction sets present in modern CPUs. Poly1305 is used for WireGuard's own message authentication but can be used outside the project as well — for example, chacha20-poly1305 is one of the highest-performing SSH ciphers, particularly on CPUs without AES-NI hardware acceleration.

Other interesting features new to the 5.6 kernel will include USB4 support, multipath TCP, AMD and Intel power management improvements, and more.

An anonymous reader quotes a report from TechCrunch: A social media boosting startup, which bills itself as a service to increase a user's Instagram followers, has exposed thousands of Instagram account passwords. The company, Social Captain, says it helps thousands of users to grow their Instagram follower counts by connecting their accounts to its platform. Users are asked to enter their Instagram username and password into the platform to get started. But TechCrunch learned this week Social Captain was storing the passwords of linked Instagram accounts in unencrypted plaintext. Any user who viewed the web page source code on their Social Captain profile page could see their Instagram username and password in plain sight, so long as they had connected their account to the platform.

Making matters worse, a website bug allowed anyone access to any Social Captain user's profile without having to log in -- simply plugging in a user's unique account ID into the company's web address would grant access to their Social Captain account -- and their Instagram login credentials. Because the user account IDs were for the most part sequential, it was possible to access any user's account and view their Instagram password and other account information with relative ease. The security researcher who reported the vulnerability provided a spreadsheet of about 10,000 scraped user accounts to TechCrunch.

"The spreadsheet contained about 4,700 complete sets of Instagram usernames and passwords," the report says. "The rest of the records contained just the user's name and their email address."

Lindsey Graham (R-SC) is working on a bill that would reduce legal protections for apps and websites, potentially jeopardizing online encryption. The Verge reports: The draft bill would form a "National Commission on Online Child Exploitation Prevention" to establish rules for finding and removing child exploitation content. If companies don't follow these rules, they could lose some protection under Section 230 of the Communications Decency Act, which largely shields companies from liability over users' posts. Reports from Bloomberg and The Information say that Sen. Lindsey Graham (R-SC) is behind the bill, currently dubbed the Eliminating Abusive and Rampant Neglect of Interactive Technologies (or EARN IT) Act. It would amend Section 230 to make companies liable for state prosecution and civil lawsuits over child abuse and exploitation-related material, unless they follow the committee's best practices. They wouldn't lose Section 230 protections for other content like defamation and threats.

The bill doesn't lay out specific rules. But the committee -- which would be chaired by the Attorney General -- is likely to limit how companies encrypt users' data. Large web companies have moved toward end-to-end encryption (which keeps data encrypted for anyone outside a conversation, including the companies themselves) in recent years. Facebook has added end-to-end encryption to apps like Messenger and Whatsapp, for example, and it's reportedly pushing it for other services as well. U.S. Attorney General William Barr has condemned the move, saying it would prevent law enforcement from finding criminals, but Facebook isn't required to comply. Under the EARN IT Act, though, a committee could require Facebook and other companies to add a backdoor for law enforcement.

The creator of one of the world's most famous mysteries is giving obsessive fans a new clue. From a report: Kryptos, a sculpture in a courtyard at the headquarters of the Central Intelligence Agency in Langley, Va., holds an encrypted message that has not fully yielded to attempts to crack it. It's been nearly 30 years since its tall scroll of copper with thousands of punched-through letters was set in place. Three of the four passages of the sculpture have been decrypted (the first, though unacknowledged at the time, was solved by a team from the National Security Agency). But after nearly three decades, one brief passage remains uncracked. And that has been a source of delight and consternation to thousands of people around the world. The sculptor, Jim Sanborn, has been hounded for decades by codebreaking enthusiasts. And he has twice provided clues to move the community of would-be solvers along, once in 2010 and again in 2014. Now he is offering another clue. The last one, he says. It is a word: "NORTHEAST."

Why do people care so much about a puzzle cut into a sheet of copper in a courtyard after so much time? It's not just that the piece itself has a kind of brooding, powerful beauty, or the fact that it has been referred to in novels by the thriller writer Dan Brown. It is something deeper, something that involves the nature of the human mind, said Craig Bauer, a professor of mathematics at York College of Pennsylvania and a former scholar in residence at the N.S.A.'s Center for Cryptologic History. "We have many problems that are difficult to resolve -- intimidating, perhaps even scary," he said. "It gives people great pleasure to pick up on one that they think they have a chance of solving." [...] Why now? Did we mention Mr. Sanborn is 74? Holding on to one of the world's most enticing secrets can be stressful. Some would-be codebreakers have appeared at his home. Many felt they had solved the puzzle, and wanted to check with Mr. Sanborn. Sometimes forcefully. Sometimes, in person. NPR spoke with Sanborn (4-min).

Jacob Hoffman-Andrews, writing for EFF: If you follow security on the Internet, you may have seen articles warning you to "beware of public Wi-Fi networks" in cafes, airports, hotels, and other public places. But now, due to the widespread deployment of HTTPS encryption on most popular websites, advice to avoid public Wi-Fi is mostly out of date and applicable to a lot fewer people than it once was. The advice stems from the early days of the Internet, when most communication was not encrypted. At that time, if someone could snoop on your network communications -- for instance by sniffing packets from unencrypted Wi-Fi or by being the NSA -- they could read your email. Starting in 2010 that all changed. Eric Butler released Firesheep, an easy-to-use demonstration of "sniffing" insecure HTTP to take over people's accounts. Site owners started to take note and realized they needed to implement HTTPS (the more secure, encrypted version of HTTP) for every page on their site. The timing was good: earlier that year, Google had turned on HTTPS by default for all Gmail users and reported that the costs to do so were quite low. Hardware and software had advanced to the point where encrypting web browsing was easy and cheap.

However, practical deployment of HTTPS across the whole web took a long time. One big obstacle was the difficulty for webmasters and site administrators of buying and installing a certificate (a small file required in order to set up HTTPS). EFF helped launch Let's Encrypt, which makes certificates available for free, and we wrote Certbot, the easiest way to get a free certificate from Let's Encrypt and install it. Meanwhile, lots of site owners were changing their software and HTML in order to make the switch to HTTPS. There's been tremendous progress, and now 92% of web page loads from the United States use HTTPS. In other countries the percentage is somewhat lower -- 80% in India, for example -- but HTTPS still protects the large majority of pages visited. [...] What about the risk of governments scooping up signals from "open" public Wi-Fi that has no password? Governments that surveill people on the Internet often do it by listening in on upstream data, at the core routers of broadband providers and mobile phone companies. If that's the case, it means the same information is commonly visible to the government whether they sniff it from the air or from the wires.

Prosecutors have dropped criminal charges against two security professionals who were arrested and jailed last September for breaking into an Iowa courthouse as part of a contract with Iowa's judicial arm. From a report: The dismissal, which was announced on Thursday, is a victory not only for Coalfire Labs, the security firm that employed the two penetration testers, but the security industry as a whole and the countless organizations that rely on it. Although employees Gary DeMercurio and Justin Wynn had written authorization to test the physical security of the Dallas County Courthouse in Iowa, the men spent more than 12 hours in jail on felony third-degree burglary charges. The charges were later lowered to misdemeanor trespass. The case cast a menacing cloud over an age-old practice that's crucial to securing buildings and the computers and networks inside of them. Penetration testers are hired to hack or break into sensitive systems or premises and then disclose the vulnerabilities and techniques that made the breaches possible. Owners and operators then use the information to improve security. "I'm very glad to hear this," said a professional pentester when I told him the charges were dropped (he prefers to use only his handle: Tink). "Clients and security firms have an obligation to protect their pentesters and consultants. Pentesters are not criminals. Pentesters help organizations protect against criminals."

nickwinlund77 shares a report from Reuters: The FBI is investigating the role of Israeli spyware vendor NSO Group Technologies in possible hacks on American residents and companies as well as suspected intelligence gathering on governments, according to four people familiar with the inquiry. The probe was underway by 2017, when Federal Bureau of Investigation officials were trying to learn whether NSO obtained from American hackers any of the code it needed to infect smartphones, said one person interviewed by the FBI then and again last year.

The FBI conducted more interviews with technology industry experts after Facebook filed a lawsuit in October accusing NSO itself of exploiting a flaw in Facebook's WhatsApp messaging service to hack 1,400 users, according to two people who spoke with agents or Justice Department officials. Part of the FBI probe has been aimed at understanding NSO's business operations and the technical assistance it offers customers, according to two sources familiar with the inquiry. Suppliers of hacking tools could be prosecuted under the Computer Fraud and Abuse Act (CFAA) or the Wiretap Act, if they had enough knowledge of or involvement in improper use, said James Baker, general counsel at the FBI until January 2018. The CFAA criminalizes unauthorized access to a computer or computer network, and the Wiretap Act prohibits use of a tool to intercept calls, texts or emails. NSO is known in the cybersecurity world for its "Pegasus" software other tools that can be delivered in several ways. The software can capture everything on a phone, including the plain text of encrypted messages, and commandeer it to record audio."

The Electronic Software Association is introducing tighter security measures around press registration for E3, following an incident last year in which sensitive personal information belonging to thousands of journalists, YouTube creators, and Twitch streamers was made public. The Verge reports: A new blog post published today details updates to the conference and its "media registration process," which the company says "received a lot of attention this past summer." "Earning back your trust and support is our top priority," the post reads. "That's why we rebuilt the E3 website with enhanced and layered security measures developed by an outside cybersecurity firm. This included updating our data management processes, including the handling of personally identifiable information, and we will no longer store that data on our site."

Changes to the registration process will also occur this year. The ESA will "collect the minimum information necessary" for attendees registering. The post doesn't state what those specific changes are. Last year's leak, which involved an unprotected file uploaded online and available for anyone to download, led to personal information like home addresses and phone numbers appearing on hateful forums like Kiwi Farms. After data leaked, multiple journalists -- including staff members of The Verge -- received texts and phone calls from complete strangers.

As it struggles to get content from encrypted messenger apps and smartphones, the U.S. government is getting creative in how it tracks down criminal WhatsApp users, according to a search warrant uncovered by Forbes. From the report: Aside from shedding light on police data-trawling operations, these new efforts are "problematic," legal experts tell Forbes. They show that investigators are willing to test the boundaries of legality by demanding content they may not legally be allowed to collect from WhatsApp. And they're then demanding data from a seemingly endless list of tech providers -- from Google to any telecom company imaginable -- that could feasibly help them catch a single WhatsApp user.

In a bid to find an alleged Mexican methamphetamine dealer, the government demanded that WhatsApp hand over basic subscriber details, according to a previously unreported government order filed in Colorado in October. They'd been tipped off that the dealer -- a fugitive on the DEA's most-wanted list -- was a frequent user of WhatsApp and had even used the app to talk with an undercover agent. That WhatsApp data would come from what's known as a "pen-trap." Think of these as tracking tools that collect limited metadata like user phone numbers, IP addresses and call duration, not the content of messages. Forbes has reported on these before and they're fairly common. So far, so normal.

SpiceJet, one of India's largest privately owned airlines, suffered a data breach involving the details of more than a million of its passengers, a security researcher told TechCrunch. From the report: The security researcher, who described their actions as "ethical hacking" but whom we are not naming as they likely fell afoul of U.S. computer hacking laws, gained access to one of SpiceJet's systems by brute-forcing the system's easily guessable password. An unencrypted database backup file on that system contained private information of more than 1.2 million passengers of the budget-carrier last month, TechCrunch has learned. Each record included details such as name of the passenger, their phone number, email address and their date of birth, the researcher told TechCrunch. Some of these passengers were state officials, they said. The database included a rolling month's worth of flight information and details of each commuter, they said, adding that they believe that the database was easily accessible for anyone who knew where to look.

Apple engineers have put forward a proposal today to standardize the format of the SMS messages containing one-time passcodes (OTP) that users receive during the two-factor authentication (2FA) login process. From a report: The proposal comes from Apple engineers working on WebKit, the core component of the Safari web browser. The proposal has two goals. The first is to introduce a way that OTP SMS messages can be associated with an URL. This is done by adding the login URL inside the SMS itself. The second goal is to standardize the format of 2FA/OTP SMS messages, so browsers and other mobile apps can easily detect the incoming SMS, recognize web domain inside the message, and then automatically extract the OTP code and complete the login operation without further user interaction. By doing this, the process of receiving and entering a one-time passcode could be automated, eliminating the risk of a user falling for a scam and entering an OTP code on a phishing site, with the wrong URL.

Starting today, companies across the world have a new free web service at their disposal that will automatically send out email notifications if one of their employees gets phished. From a report: The service is named "I Got Phished" and is managed by Abuse.ch, a non-profit organization known for its malware and cyber-crime tracking operations. Just like all other Abuse.ch services, I Got Phished will be free to use. Any company can sign-up via the I Got Phished website. Signing up only takes a few seconds. Subscribing for email notifications is done on a domain name basis, and companies don't have to expose a list of their employee email addresses to a third-party service. Once a company's security staff has subscribed to the service, I Got Phished will check its internal database for email addresses for the company's email domain. This database contains logs from phishing operations, with emails for phished victims.