An anonymous reader quotes the International Business Times: At the recent Tianfu cup held in Chengdu, China, Chinese China's top white-hat hackers have converged to test zero-days against top software available in the market today. During the first day of the event, Chinese security researchers were able to break into major browsers such as Safari, Microsoft Edge, and Google Chrome.

Since March 2018, the Chinese government has officially discouraged security researchers from joining hacking competitions outside the county. The recent Tianfu Cup is the venue for hackers to showcase their skills and even earn six-figure bounties for successful exploits. Former Pwn2Own winner Team 360 Vulcan took home $382,500 for successfully hacking the old version of Office 365, Microsoft Edge, Adobe PDF Reader, VMWare Workstation, and gemu+ Ubuntu during the two days event, reports ZDNet... Search engine giant Google has a representative in the event with some members of the Google Chrome security team present on site. Organizers plan to submit a report of all bugs uncovered during the event to all vendors when the competition concludes, says ZDNet.

"What tech skills do U.S. employers want? Researchers at job search site Indeed took a deep dive into its database to answer that question," reports IEEE Spectrum: [A]t least for now, expertise in SQL came out on top of the list of most highly sought after skills, followed by Java. Python and Amazon Web Services (AWS) are coming on fast, and, should trends continue, may take over the lead in the next year or two...

Indeed's team considered U.S. English-language jobs posted on the site between September 2014 and September 2019; those postings encompassed 571 tech skills. Over that period, Docker, the enterprise container platform, sits at number 20 on the list today, but that is the result of a dramatic climb over that five-year period. Demand for proficiency in that platform-as-a-service grew more than 4000 percent, from a barely registering share of 0.1 percent of job post mentions in 2014 to 5.1 percent today. Azure jumped more than 1000 percent during that period, from 0.6 percent to 6.9 percent; and the general category of machine learning climbed 439 percent, closely followed by AWS at 418 percent.

Indeed's researchers note that the big jumps in demand for engineers skilled in Python stems from the boom in data scientist and engineer jobs, which disproportionately use Python.
"Python" has overtaken "Linux" in just the last two years, while in the same period "AWS" overtook C++, C, C# and .net.

An anonymous reader quotes Business Insider: Slack tweeted a video on Thursday comparing a Slack ad and a Microsoft ad, showing the similarities between them and implying the Microsoft ad copied Slack's concept. The video was captioned "ok boomer," a phrase that has turned into a meme for millennials and Gen Z to voice their gripes with the baby boomer generation... Slack is leaning into its status as the young, hip startup by calling out its older, more established competition: Microsoft...

On Tuesday, Microsoft announced that Teams hit 20 million daily users, while Slack most recently announced just 12 million users. Slack's stock took a dive after the announcement. Although it has fewer users, Slack points to its user engagement, saying that users enjoy using the app. Slack CEO Stewart Butterfield said that Microsoft sees the company as an "existential threat."
The Verge notes that "a lot of businesses will opt for Teams simply because it's bundled as part of Office 365."

And ZDNet reports that a partner at one of Slack's early investors even tweeted an image showing Google Trends' top five rising queries for Microsoft Teams. #1 is "how to stop Microsoft teams," and also include "how to turn off Microsoft teams," "how to get rid of Microsoft teams", and "Microsoft teams keeps reinstalling."

"Researchers have discovered a new multi-platform backdoor that infects Windows and Linux systems allowing the attackers to run malicious code and binaries on the compromised machines," reports Bleeping Computer: The malware dubbed ACBackdoor is developed by a threat group with experience in developing malicious tools for the Linux platform based on the higher complexity of the Linux variant as Intezer security researcher Ignacio Sanmillan found. "ACBackdoor provides arbitrary execution of shell commands, arbitrary binary execution, persistence, and update capabilities," the Intezer researcher found.

Both variants share the same command and control (C2) server but the infection vectors they use to infect their victims are different: the Windows version is being pushed through malvertising with the help of the Fallout Exploit Kit while the Linux payload is dropped via a yet unknown delivery system... Besides infecting victims via an unknown vector, the Linux malicious binary is detected by only one of the anti-malware scanning engines on VirusTotal at the time this article was published, while the Windows one is detected by 37 out of 70 engines. The Linux binary is also more complex and has extra malicious capabilities, although it shares a similar control flow and logic with the Windows version...

ACBackdoor can receive the info, run, execute, and update commands from the C2 server, allowing its operators to run shell commands, to execute a binary, and to update the malware on the infected system.
The article warns that the Linux version will disguise itself as the Ubuntu UpdateNotifier utility, renaming its process as the Linux kernel thread [kworker/u8:7-ev].

OnePlus has sent out an email informing recent OnePlus customers of a security issue. "This 'Security Notification' from OnePlus informs customers that an 'unauthorized party' was able to access order information from the company's online store," reports 9to5Google. "OnePlus says that payment information as well as account details were not accessed, but names, addresses, emails, and phone numbers 'may' have been exposed. The company says it will continue to investigate the matter, but obviously this is no small issue." From the report: Speaking to Droid-Life, OnePlus says that they took "immediate steps to stop the intruder and reinforce security," and that they are currently "working with the relevant authorities to further investigate this incident." OnePlus didn't explain what went wrong, but they are apparently working to start a bug bounty program by the end of this year.

This isn't the first time the company's store has fallen victim to a security issue like this. In early 2018, OnePlus customers found evidence of credit card fraud stemming from the Store that triggered OnePlus to shut down credit card payments temporarily. Just a day later, OnePlus' investigation into the matter revealed that 40,000 credit card numbers had been exposed. OnePlus has a thread on its forums with more details about the breach.

JustAnotherOldGuy writes: For well over a decade, identity thieves, phishers, and other online scammers have created a black market of stolen and aggregated consumer data that they used to break into people's accounts, steal their money, or impersonate them. In October, dark web researcher Vinny Troia found one such trove sitting exposed and easily accessible on an unsecured server, comprising 4 terabytes of personal information -- about 1.2 billion records in all. While the collection is impressive for its sheer volume, the data doesn't include sensitive information like passwords, credit card numbers, or Social Security numbers. It does, though, contain profiles of hundreds of millions of people that include home and cell phone numbers, associated social media profiles like Facebook, Twitter, LinkedIn, and Github, work histories seemingly scraped from LinkedIn, almost 50 million unique phone numbers, and 622 million unique email addresses. "It's bad that someone had this whole thing wide open," Troia says. "This is the first time I've seen all these social media profiles collected and merged with user profile information into a single database on this scale. From the perspective of an attacker, if the goal is to impersonate people or hijack their accounts, you have names, phone numbers, and associated account URLs. That's a lot of information in one place to get you started."

hackingbear writes: Microsoft has been granted a license to export [mass market] software to Huawei once again. The software giant was caught up in a long line of US-based technology companies that have been forced to comply with President Trump's executive order to crack down on Chinese tech companies. It's not immediately clear what "mass-market" refers to, but Microsoft sells Windows and Office licenses to Huawei. It's likely that Microsoft is at least able to sell Windows licenses to Huawei once again, which will help with Huawei's server solutions and its Windows-powered laptops. Microsoft is part of a number of US companies that are starting to get licenses to supply goods to Huawei once again. Huawei has been anticipating a fight with the US and prepared and succeed in replacing American (electronic) technologies with its own home-grown replacement for almost two decades after Motorola foolishly rejected the chance of acquiring Huawei, China's most successful hi-tech company worth at least $100 billion today, over a bargaining price of $7.5 billion. "When this decision was made, I told them [Huawei executives], if we continued to work in this sector, we would definitely be in a race against the US in 10 years. We had to prepare", said then Huawei founder Ren Zhengfei after the merger fell through. However, software ecosystems, i.e. Windows and Android, remain Huawei's Achilles' heel.

Twitter says users will finally be able to disable SMS-based two-factor authentication (2FA) for their accounts, and use an alternative method only, such as a mobile one-time code (OTP) authenticator app or a hardware security key. Until this week, this was impossible. From a report: If users wanted to use 2FA for their Twitter account, they had to register a phone number and enable the SMS-based 2FA method, even if they wished it or not. Users who wanted to use an OTP mobile authenticator app or a hardware security key, had to enable the SMS-based 2FA first, and they couldn't disable it. Even if the user chose to use a security key, the SMS-based 2FA method was still active, and exposed the account to attacks known as SIM swaps. Hackers who knew a user's password would perform a SIM swap to temporarily hijack a user's phone number, bypass SMS-based 2FA, and then take over that user's account.

An anonymous reader quotes a report from the Electronic Frontier Foundation: The Pennsylvania Supreme Court issued a forceful opinion today holding that the Fifth Amendment to the U.S. Constitution protects individuals from being forced to disclose the passcode to their devices to the police. In a 4-3 decision in Commonwealth v. Davis, the court found that disclosing a password is "testimony" protected by the Fifth Amendment's privilege against self-incrimination. EFF filed an amicus brief in Davis, and we were gratified that the court's opinion closely parallels our arguments. The Fifth Amendment privilege prohibits the government from coercing a confession or forcing a suspect to lead police to incriminating evidence. We argue that unlocking and decrypting a smartphone or computer is the modern equivalent of these forms of self-incrimination.

Crucially, the court held that the narrow "foregone conclusion exception" to the Fifth Amendment does not apply to disclosing passcodes. As described in our brief, this exception applies only when an individual is forced to comply with a subpoena for business records and only when complying with the subpoena does not reveal the "contents of his mind," as the U.S. Supreme Court put it. The Pennsylvania Supreme Court agreed with EFF. It wrote: "Requiring the Commonwealth to do the heavy lifting, indeed, to shoulder the entire load, in building and bringing a criminal case without a defendant's assistance may be inconvenient and even difficult; yet, to apply the foregone conclusion rationale in these circumstances would allow the exception to swallow the constitutional privilege. Nevertheless, this constitutional right is firmly grounded in the "realization that the privilege, while sometimes a shelter to the guilty, is often a protection to the innocent."

T-Mobile says it has suffered a data breach affecting some prepaid customers. No financial data, social security numbers, or passwords were accessed, but information associated with users' prepaid wireless accounts was obtained, including names, billing addresses, phone numbers, account numbers, rate plans, and features that users have added to their accounts. TmoNews reports: T-Mobile is in the process of notifying all customers that've been affected by this data breach. If you got a notification, you should update the PIN on your T-Mobile account. T-Mo does say that it's possible that some affected customers may not be notified because their contact info isn't up-to-date, so if that's the case with you, you can contact T-Mobile support for more info by dialing 611 from your T-Mo phone or 1-800-TMOBILE from any phone. There's no word yet on exactly how many customers were affected by this security issue, but some Reddit users have chimed in to say that they've been alerted to the breach by T-Mobile. "We take the security of your information very seriously and have a number of safeguards in place to protect your personal information from unauthorized access," T-Mobile says. "We truly regret that this incident occurred and apologize for any inconvenience this has caused you."

Google announced today that it is willing to dish out bug bounty cash rewards of up to $1.5 million if security researchers find and report bugs in the Android operating system that can also compromise its new Titan M security chip. From a report: Launched last year, the Titan M chip is currently part of Google Pixel 3 and Pixel 4 devices. It's a separate chip that's included in both phones and is dedicated solely to processing sensitive data and processes, like Verified Boot, on-device disk encryption, lock screen protections, secure transactions, and more. Google says that if researchers manage to find "a full chain remote code execution exploit with persistence" that also compromises data protected by Titan M, they are willing to pay up to $1 million to the bug hunter who finds it. If the exploit chain works against a preview version of the Android OS, the reward can go up to $1.5 million.

New submitter BeerF writes: This past year has been chock full of uncomfortable revelations about Ring, the surveillance social network and home security hardware company acquired by Amazon for a reported $800 million, including reports of potentially disastrous internal security practices, an apparent disregard for user privacy, and wave after wave of detail on secret partnerships with local police. Today, in a letter addressed to Amazon CEO Jeff Bezos, five Democratic senators are asking for an explanation, citing potential threats to U.S. national security.

Much of the letter focuses on allegations that Ring's Ukrainian office, where it conducts much of its research and development operation, allowed employees across the company to access customer video data whether they had any real need to or not. In January, The Intercept reported that this loose security atmosphere at Ring meant "if [someone] knew a reporter or competitor's email address, [they] could view all their cameras," per one source, who also recalled Ring engineers casually spying on and "teasing each other about who they brought home" after dates. "If hackers or foreign agents were to gain access to this data," the letter states, "it would not only threaten the privacy and safety of the impacted Americans; it could also threaten U.S. national security."

Password data and other personal information belonging to as many as 2.2 million users of two websites -- one a cryptocurrency wallet service and the other a gaming bot provider -- have been posted online, according to Troy Hunt, the security researcher behind the Have I Been Pwned breach notification service. Ars Technica reports: One haul includes personal information for as many as 1.4 million accounts from the GateHub cryptocurrency wallet service. The other contains data for about 800,000 accounts on RuneScape bot provider EpicBot. The databases include registered email addresses and passwords that were cryptographically hashed with bcrypt, a function that's among the hardest to crack.

The person posting the 3.72GB Gatehub database said it also includes two-factor authentication keys, mnemonic phrases, and wallet hashes, although GateHub officials said an investigation suggested wallet hashes were not accessed. The EpicBot database, meanwhile, purportedly included usernames and IP addresses. Hunt said he selected a representative sample of accounts from both databases to verify the authenticity of the data. All of the email addresses he checked were registered to accounts of the two sites. [...] While there were 2.2 million unique addresses in the two dumps, it's possible that corresponding password hashes or other data isn't included with each one.

Many Disney+ users who have had their accounts stolen and put up for sale on the dark web say that Disney has yet to sort their problems. The firm says it does not believe its systems have been compromised, suggesting that members' details have been stolen by other means. The BBC reports: On November 12, its first day live, people had technical problems and many complained on social media. Others said they were locked out of their accounts, and since they contacted Disney they have not heard back. According to an investigation by ZDNet, thousands of user accounts went on sale on the dark web. Only hours after the service launched, hackers were selling Disney+ accounts for as little as $3. A subscription to the service costs $7 a month. With the help of a cyber-security researcher, the BBC also found several hacked customer accounts for sale on the dark web.

Many say they used unique userIDs and passwords to access the streaming platform. But Jason Hill, a lead researcher with CyberInt, says it looks like many were stolen because people use the same passwords for different sites. Mr Hill said that hackers can lift someone's password from a different site which has previously been hacked and then try it on a new site, like Disney+. If it works, they steal the account. The streaming service does not have two-factor authentication. Others are concerned because they can use their Disney+ login to access other products the company provides, like the Disney store and its recreation parks.

Ten organizations today announced the creation of the Coalition Against Stalkerware, the first global initiative of its kind, with the sole purpose of fighting against stalkerware. From a report: Also known as spouseware, stalkerware is a smaller category of the spyware class. Stalkerware refers to apps that abusive partners install on the devices of their loved ones without their knowledge or consent. They contain features that allow the abuser to track their significant other's geographical location, web browsing habits, social media activity, log keystrokes inside instant messaging apps, retrieve photos, or even record audio and video without the owner's knowledge. Stalkerware apps are available for both mobile and desktop operating systems and are often sold commercially under the guise of child trackers, pet trackers, phone-finding apps, remote access toolkits, and so on. This kind of apps live in a gray area of the current app ecosystem where they can be used for both legitimate and criminal purposes, giving app makers an easy excuse when confronted with abuse reports from victims -- albeit some apps are more blatant and advertise themselves as a way to catch cheating girlfriends, although, these cases are rare.

Until recently, weaknesses in Android camera apps from Google and Samsung made it possible for rogue apps to record video and audio and take images and then upload them to an attacker-controlled server -- without any permissions to do so. Camera apps from other manufacturers may still be susceptible. From a report: The weakness, which was discovered by researchers from security firm Checkmarx, represented a potential privacy risk to high-value targets, such as those preyed upon by nation-sponsored spies. Google carefully designed its Android operating system to bar apps from accessing cameras and microphones without explicit permission from end users. An investigation published Tuesday showed it was trivial to bypass those restrictions. The investigation found that an app needed no permissions at all to cause the camera to shoot pictures and record video and audio. To upload the images and video -- or any other image and video stored on the phone -- to an attacker-controlled server, an app needed only permission to access storage, which is among one of the most commonly given usage rights.

The weakness, which is tracked as CVE-2019-2234, also allowed would-be attackers to track the physical location of the device, assuming GPS data was embedded into images or videos. Google closed the eavesdropping hole in its Pixel line of devices with a camera update that became available in July. Checkmarx said Samsung has also fixed the vulnerability, although it wasn't clear when that happened. Checkmarx said Google has indicated that Android phones from other manufacturers may also be vulnerable. The specific makers and models haven't been disclosed.

An anonymous reader shares an excerpt from a report via the BBC: According to a 2015 survey of the most annoying office noises by Avanta Serviced Office Group, conversations were rated the most vexing, closely followed by coughing, sneezing and sniffing, loud phone voices, ringing phones and whistling. Why do we find it so hard to be around these everyday noises? What is it about them that allows them to lodge in our brains and make it impossible to think? [...] Back in 2011, researchers from University College London and the University of London decided to find out. First of all, the researchers asked 118 female secondary school students to complete a questionnaire, which revealed how extroverted or introverted each was -- essentially, whether they thrive on socializing and being immersed in the outside world or if they find these experiences exhausting. Next the students were subjected to a battery of cognitive challenges -- and to add extra difficulty, they were asked to complete them while listening to British garage music, or the clamor of a classroom. A control group completed them in silence.

As the researchers suspected, all the students performed better in silence. But they also found that, in general -- with the exception of one test -- the more extroverted they were, the less they were affected by noise. A person's level of extroversion is thought to be a key aspect of their personality -- one of the so-called 'Big Five' factors that determines who we are, along with things like how open we are to new experiences. According to one prominent theory, extroverts are inherently "understimulated," so they tend to seek out situations which increase their level of arousal -- like noisy environments. Meanwhile, introverts have the opposite problem; as the famous poet, novelist and introvert Charles Bukowski put it: "People empty me. I have to get away to refill." With this in mind, it makes sense that more introverted workers would be more affected by the background noise, since anything that increases their level of arousal, like music or the chatter of colleagues, could be overwhelming.

An anonymous reader quotes a report from Motherboard: On Sunday, Motherboard reported that the hacker or hackers known as Phineas Fisher targeted a bank, stole money and documents, and is offering other hackers $100,000 to carry out politically motivated hacks. Now, the bank Phineas Fisher targeted, Cayman National Bank from the Isle of Man, confirmed it has suffered a data breach. "It is known that Cayman National Bank (Isle of Man) Limited was amongst a number of banks targeted and subject to the same hacking activity," Cayman National told Motherboard in a statement issued Monday.

"A criminal investigation is ongoing and Cayman National is co-operating with the relevant law enforcement authorities to identify the perpetrators of the data theft. Cayman National takes any breach of data security very seriously and a specialist IT forensic investigation is underway, with appropriate actions being taken to ensure that the clients of Cayman National's Isle of Man bank and trust companies are protected," the statement added. The statement doesn't name Phineas Fisher explicitly, but instead says the bank was the victim of a "criminal hacking group." "I robbed a bank and gave the money away," Phineas Fisher wrote in their most recent manifesto, adding that they breached the bank in 2016. "Computer hacking is a powerful tool to fight economic inequality." In its statement, Cayman National claimed it had found no evidence of financial loss either to its customers or Cayman National itself. Twitter account Distributed Denial of Secrets (DDoSecrets) posted a link to the copies of the servers of Cayman National Bank and Trust. "To make certain files easier to access, the two Athol servers were combined into a single archive. The raw Athol servers will be released next week, along with the launch of the Hunter Memorial Library which will make over 600,000 of the bank's emails searchable online," reads a follow-up tweet.

The total size of data is about 2 terabytes.

New submitter Shad0wz writes: Microsoft's Core Network team just announced they plan on supporting DoH in the Windows resolver. In the blog post, the company writes: Providing encrypted DNS support without breaking existing Windows device admin configuration won't be easy. However, at Microsoft we believe that "we have to treat privacy as a human right. We have to have end-to-end cybersecurity built into technology." We also believe Windows adoption of encrypted DNS will help make the overall Internet ecosystem healthier. There is an assumption by many that DNS encryption requires DNS centralization. This is only true if encrypted DNS adoption isn't universal. To keep the DNS decentralized, it will be important for client operating systems (such as Windows) and Internet service providers alike to widely adopt encrypted DNS. With the decision made to build support for encrypted DNS, the next step is to figure out what kind of DNS encryption Windows will support and how it will be configured. Here are our team's guiding principles on making those decisions:

Windows DNS needs to be as private and functional as possible by default without the need for user or admin configuration because Windows DNS traffic represents a snapshot of the user's browsing history. To Windows users, this means their experience will be made as private as possible by Windows out of the box. For Microsoft, this means we will look for opportunities to encrypt Windows DNS traffic without changing the configured DNS resolvers set by users and system administrators.
Privacy-minded Windows users and administrators need to be guided to DNS settings even if they don't know what DNS is yet. Many users are interested in controlling their privacy and go looking for privacy-centric settings such as app permissions to camera and location but may not be aware of or know about DNS settings or understand why they matter and may not look for them in the device settings.
Windows users and administrators need to be able to improve their DNS configuration with as few simple actions as possible. We must ensure we don't require specialized knowledge or effort on the part of Windows users to benefit from encrypted DNS. Enterprise policies and UI actions alike should be something you only have to do once rather than need to maintain.
Windows users and administrators need to explicitly allow fallback from encrypted DNS once configured. Once Windows has been configured to use encrypted DNS, if it gets no other instructions from Windows users or administrators, it should assume falling back to unencrypted DNS is forbidden.

Microsoft is rolling out new privacy provisions in its Online Services Terms (OST) contracts for all commercial customers after European privacy regulators began investigating it over potential violations of the EU's General Data Protection Regulation (GDPR). From a report: The European Data Protection Supervisor (EDPS) last month said it had "serious concerns" over Microsoft's contracts with European institutions and compliance with GDPR rules. It kicked off an investigation in April after the Dutch Ministry of Justice found that telemetry data Microsoft collected from Office 365 ProPlus and Office 365 users violated GDPR. However, EDPS in October also noted that a new agreement between Microsoft and the Dutch Ministry of Justice (MoJ) for contractual and technical safeguards and measures to mitigate risks to individuals was a "positive step forward". The new OST reflect the contractual changes Microsoft developed with the Dutch MoJ, according to Julie Brill, Microsoft's chief privacy officer and corporate vice president for global privacy and regulatory affairs.