A state-linked Chinese hacking group is using malware to steal SMS text messages from high-ranking military and government targets, according to cybersecurity company FireEye. From a report: The hacking technology, known as MESSAGETAP, "allows China to efficiently steal data from multitudes of sources from one location," Steven Stone, FireEye's director of advanced practices, said in a statement. "Espionage-related theft and intrusions have been long occurring, but what is new is the vast scale due to the use of this tool." The company's finding, released in a blog on Thursday, underscores the growing concerns about China's use of technology for espionage and the theft of intellectual property. Telecommunications pose a special concern, as the U.S. seeks to persuade its allies not to build their next-generation networks with tools from Chinese companies such as Huawei. But even in networks that China hasn't built, sophisticated hacking operations might allow access to data. In 2019 alone, FireEye observed eight attempts to target telecommunications entities by groups with suspected links to the Chinese government. Four of these hacking attempts were conducted by the group known as APT41 that is now using MESSAGETAP.

An anonymous reader quotes a report from The Verge: This week, the developer of the popular text- and code-editing software Notepad++ released a new version update. Nothing seemed particularly strange about it, except maybe the name: Notepad++ v7.8.1 is the "Free Uyghur" edition. In a blog post announcing the updated version, developer Don Ho writes about the plight of the Uyghur people, an ethnic minority in China that's faced persecution from the country's authoritarian government. China operates internment camps that are used to detain Uyghur people throughout the country's Xinjiang region.

Since the announcement, the software's GitHub "issues" page has been bombarded with spam, much of it in the Chinese language. "Stop sending meaningless political-related issues, it just makes you look like an idiot," reads one comment. Another one simply reads, "Bye ! Uninstall." There's a litany of curses, and one asks, "What do you know about China?" Others have moved in to criticize the Chinese government in response. Ho told The Verge that the software's dedicated site was also under a distributed-denial-of-service attack, but that it has been stopped by an anti-DDoS service provided by the site's host. Ho writes in the announcement that he anticipated potential pushback, saying "talking about politics is exactly what software and commercial companies generally try to avoid," but decided to take the step anyway. "The problem is," Ho writes in the announcement of the Free Uyghur edition, "if we don't deal with politics, politics will deal with us."

A bug in Apple's App Store removed more than 20 million ratings from apps both big and small. "The issue began on October 23, 2019 and wasn't resolved until yesterday, October 29," reports TechCrunch. "Apple hasn't yet explained how such a sizable and impactful change to app ratings occurred." From the report: This massive ratings drop was spotted by the mobile app insights platform Appfigures. The firm found that more than 300 apps from over 200 developers were affected by the sweep, which wiped out a total of 22 million app reviews from the App Store. On average, apps saw a 50% decrease in ratings in the affected countries, which included the U.S.

The U.S. was hit the hardest, however, as some 10 million ratings disappeared. But the sweep was global in nature, hitting all 155 countries Apple supports. China, the U.K., South Korea, Russia and Australia also felt a noticeable impact. A few apps were hit harder than others. Hulu, for example, lost a whopping 95% of ratings in the U.S., while Dropbox and Chase lost 85%. Several companies affected by the bug declined to comment, but told us that the rating removals weren't done at their request -- they were just as surprised as everyone else. Of the more than 300 apps that got hit, about half (154) saw a drop of more than 100 ratings, Appfigures said. Some of the impacted companies (and Appfigures) confirmed to TechCrunch the missing ratings were restored as of yesterday.

An anonymous reader quotes a report from Ars Technica: A day after Facebook-owned WhatsApp sued NSO Group, the social media platform has permanently deleted the accounts of employees who work at the Israel-based spyware maker, according to message boards and a security researcher who spoke to one worker. "Your account has been deleted for not following our terms," said a message sent to one employee by Facebook-owned Instagram. "You won't be able to log into this account, and no one else will be able to see it. We're unable to restore accounts that are deleted for these types of violations."

A message board popular in Israel indicated that the deletion was widespread. "I had just personally verified it (I have friends working there)," one person wrote. "Ninety-eight percent of the company employees were blocked." Another person who claimed to work at NSO responded to say he or she hadn't been blocked. Another person claiming to be an NSO employee complained bitterly on LinkedIn. An Israel-based security researcher who spoke to an NSO employee said the deletions affected a much smaller percentage of the company's employees and didn't involve WhatsApp accounts.

An anonymous reader quotes a report from TechCrunch: An amateur radio rig exposed to the internet and discovered by a security researcher was collecting real-time medical data and health information broadcast by hospitals and ambulances across U.K. towns and cities. The rig, operated out of a house in North London, was picking up radio waves from over the air and translating them into readable text. The hobbyist's computer display was filling up with messages about real-time medical emergencies from across the region. For some reason, the hobbyist had set up an internet-connected webcam pointed at the display. But because there was no password on the webcam, anyone who knew where to look could also see what was on the rig's computer display.

Daley Borda, a security researcher and bug bounty hunter, stumbled upon the exposed webcam. The live stream was grainy, and the quality of the images so poor that it was just possible to make out the text on the display. "You can see details of calls coming in -- their name, address, and injury," he told TechCrunch. TechCrunch verified his findings. Messages spilling across the screen appeared to direct nearby ambulances where to go following calls to the 999 emergency services. One message said a 98-year-old man had fallen at his home address. A few moments later, another message said a 49-year-old male was complaining of chest pains at a nearby residence. One after the other, messages were flooding in, describing accidents, incidents and medical emergencies, often including their home addresses. "The hobbyist was picking up and decoding pager communications from a nearby regional National Health Service trust," adds TechCrunch. These devices remain a fixture in UK hospitals and "allow anyone to send messages to one or many pagers at once by calling a dedicated phone number, often manned by an operator, which are then broadcast as radio waves over the pager network."

While the NHS still uses about 130,000 pagers, according to the UK government, it's not clear how many trusts are exposing medical information -- if at all.

Google is facing a backlash over an internal tool for the company's Chrome browser that some employees worry is intended for spying on workers organizing protests and discussing workplace issues. From a report: To get around using the tool, some employees have turned to third-party browsers. That's prompted at least one security engineer at Google to voice concern over the possible vulnerabilities that using outside software could bring. The tool is a software extension for Google's Chrome browser, which is installed on all employee computers. It's designed to activate when workers create calendar events that include more than 100 people or use more than 10 rooms. Google said the tool is a pop-up reminder that asks people to "be mindful" before setting up large meetings. But some employees have accused Google management of trying to keep tabs on big gatherings. Google has called those claims "categorically false" and said the purpose of the tool is to cut down on calendar spam. To avoid the extension, employees are encouraging each other to use browsers other than Chrome, a Google security engineer wrote in an internal forum, screenshots of which were reviewed by CNET. Those browsers include Chromium, the open-source browser foundation on which Google Chrome is built, the engineer wrote, adding that people shifting to other browsers "has an impact on overall security of this fleet."

An anonymous reader quotes a report from the BBC: A huge cyber-attack has knocked out more than 2,000 websites -- as well as the national TV station -- in the country of Georgia. Court websites containing case materials and personal data have also been attacked. In many cases, website home pages were replaced with an image of former President Mikheil Saakashvili, and the caption "I'll be back." The origin of the attack is not yet known. BBC Caucasus correspondent Rayhan Demytrie said people on social media were speculating that Russia might be behind it. She added that she had been told by cyber-security experts that Georgian government websites were "poorly protected and vulnerable to attack." More than 15,000 pages were affected, including the presidential website, non-government organizations and private companies.

North Korea is reportedly behind a cyberattack on India's Kudankulam Nuclear Power Plant. "The malware, identified by researchers as North Korea's Dtrack, was reported by [former analyst for India's National Technical Research Organization (NTRO) Pukhraj Singh] to have gained 'domain controller-level access' at Kudankulam," reports Ars Technica. "The attack has been reported to the government." From the report: The attack likely did not affect reactor controls, but it may have targeted research and technical data. The attack apparently focused on collection of technical information, using a Windows SMB network drive share with credentials hard-coded into the malware to aggregate files to steal. Dtrack was tied to North Korea's Lazarus threat group by researchers based on code shared with DarkSeoul, a malware attack that wiped hard drives at South Korean media companies and banks in 2013.

Singh alluded to the attack in a September 7 tweet, in which he wrote, "I just witnessed a casus belli in the Indian cyberspace and it sucks at every level." He said that he did not discover the intrusion himself but learned of it from "a third party." Singh passed on the information to India's National Cyber Security Coordinator on September 4, and the third party shared the indicators of compromise "over the preceding days." Kaspersky later identified the malware involved as Dtrack, Singh said. Officials at Kudankulam have said that the plant is safe from cyber attack because the control systems network is isolated from the plant's administrative networks, but they have not addressed what data may have been stolen.

An anonymous reader writes: I have met approximately two bullies in my career so far in which I have had about 15 bosses. One of them I was able to spot during the interview itself but I took the job (I shouldn't have) and left five months later. The other boss only revealed his bully persona to me in secret and only to me in one-on-one meetings. I had to announce I am starting to record all meetings and he promptly fired me the next meeting, after my first month on the job. I got my old no-bully job back last month and I am happy as always, but I wish I could have detected the bully during the interview itself and avoided them.

How do you spot bullies? What commonalities have you noticed? Fun fact: I have noticed bullies start their bullying when they see you doing something they cannot do.

An anonymous reader quotes a report from ZDNet: Over the past six months, a new Android malware strain has made a name for itself after popping up on the radar of several antivirus companies, and annoying users thanks to a self-reinstall mechanism that has made it near impossible to remove. Named xHelper, this malware was first spotted back in March but slowly expanded to infect more than 32,000 devices by August (per Malwarebytes), eventually reaching a total of 45,000 infections this month (per Symantec). The malware is on a clear upward trajectory. Symantec says the xHelper crew is making on average 131 new victims per day and around 2,400 new victims per month. Most of these infections have been spotted in India, the U.S., and Russia.

According to Malwarebytes, the source of these infections is "web redirects" that send users to web pages hosting Android apps. These sites instruct users on how to side-load unofficial Android apps from outside the Play Store. Code hidden in these apps downloads the xHelper trojan. The good news is that the trojan doesn't carry out destructive operations. According to both Malwarebytes and Symantec, for most of its operational lifespan, the trojan has shown intrusive popup ads and notification spam. The ads and notifications redirect users to the Play Store, where victims are asked to install other apps -- a means through which the xHelper gang is making money from pay-per-install commissions. What's interesting about xHelper is that it gains access to an Android device via an initial app and installs itself as a separate self-standing service. Furthermore, you can't remove the app, as the trojan reinstalls itself every time, even after users perform a factory reset.

Facebook on Tuesday sued Israeli cyber surveillance firm NSO Group, alleging it hacked users of its messaging platform WhatsApp earlier this year. From a report: The hacking spree targeted journalists, diplomats, human rights activists, political dissidents, senior government officials and others, Facebook said in its lawsuit, filed in U.S. District Court in San Francisco. Facebook-owned WhatsApp, which is also a plaintiff in the lawsuit, said in a statement that it believed the attack "targeted at least 100 members of civil society, which is an unmistakable pattern of abuse." Facebook is seeking to have NSO barred from accessing or attempting to access WhatsApp and Facebook's services and is seeking unspecified damages. NSO's alleged use of a flaw in WhatsApp to hijack phones caused international consternation when it was made public in May of this year. NSO at the time said in a statement that it would investigate any "credible allegations of misuse" of its technology. WhatsApp said the attack exploited its video calling system in order to send malware to the mobile devices of a number of users. Further reading: Will Cathcart, head of WhatsApp, elaborates why WhatsApp is pushing back on NSO Group hacking.

Google has announced that it will stop indexing Flash content in Search as the internet prepares to bid a (not so fond) farewell to the multimedia software platform next year. From a report: "In web pages that contain Flash content, Google Search will ignore the Flash content," said Google engineering manager Dong-Hwi Lee in a blog post. "Google Search will stop indexing standalone SWF files." It is no secret that Adobe Flash is well and truly on its way out -- two years ago, a consortium of internet companies (including Adobe itself) committed to killing Flash by 2020. Preceding that, Steve Jobs' famous Thoughts on Flash letter from 2010 helped set the wheels in motion for the proprietary software's eventual demise, with the Apple cofounder citing numerous reasons why his company's hardware would not support Flash, including performance on mobile and poor security.

A startup that makes replicas of the iPhone that help hackers find vulnerabilities is accusing Apple of suing it in an attempt to shut it down. Corellium also fired back at Apple and claimed the company owes it $300,000. From a report: On Monday, Corellium, the startup that was sued by Apple for alleged copyright infringement in August, filed its response to the lawsuit. Apple alleged that Corellium's product is illegal, and helps researchers sell hacking tools based on software bugs found in iOS to government agencies that then use them to hack targets. The cybersecurity world was shocked by Apple's lawsuit, which was seen as an attempt to use copyright as an excuse to control the thriving, and largely legal, market for software vulnerabilities. The lawsuit was filed just a few days after Apple announced it would give researchers special "pre-hacked" devices to allow them to find and report more bugs to the company.

"Through its invitation-only research device program and this lawsuit, Apple is trying to control who is permitted to identify vulnerabilities, if and how Apple will address identified vulnerabilities, and if Apple will disclose identified vulnerabilities to the public at all," Corellium argues in its response, echoing arguments made by the security research community. In its response, Corellium essentially argues that using Apple's code in Corellium is fair use and its product makes the world a better place by helping security researchers inspect the iPhone's operating system, find flaws in it, and help Apple fix them. With Corellium, researchers can more easily find bugs by creating virtual instances of iOS and test them more quickly, as opposed to having to use actual physical devices. Corellium attempts to illustrate this by including "before" and "after" images in its response that demonstrate what it was like to try to hack the iPhone before it released its software.

During his Open Source Summit Europe keynote speech, Greg Kroah-Hartman, the stable Linux kernel maintainer, said Intel CPU's security problems "are going to be with us for a very long time" and are "not going away." He added: "They're all CPU bugs, in some ways they're all the same problem," but each has to be solved in its own way. "MDS, RDDL, Fallout, Zombieland: They're all variants of the same basic problem." ZDNet reports: And they're all potentially deadly for your security: "RIDL and Zombieload, for example, can steal data across applications, virtual machines, even secure enclaves. The last is really funny, because [Intel Software Guard Extensions (SGX)] is what supposed to be secure inside Intel ships" [but, it turns out it's] really porous. You can see right through this thing." To fix each problem as it pops up, you must patch both your Linux kernel and your CPU's BIOS and microcode. This is not a Linux problem; any operating system faces the same problem.

OpenBSD, a BSD Unix devoted to security first and foremost, Kroah-Hartman freely admits was the first to come up with what's currently the best answer for this class of security holes: Turn Intel's simultaneous multithreading (SMT) off and deal with the performance hit. Linux has adopted this method. But it's not enough. You must secure the operating system as each new way to exploit hyper-threading appears. For Linux, that means flushing the CPU buffers every time there's a context switch (e.g. when the CPU stops running one VM and starts another). You can probably guess what the trouble is. Each buffer flush takes a lot of time, and the more VMs, containers, whatever, you're running, the more time you lose. "The bad part of this is that you now must choose: Performance or security. And that is not a good option," Kroah-Hartman said. He added: "If you are not using a supported Linux distribution kernel or a stable/long term kernel, you have an insecure system."

Microsoft said in a blog post today that it has tracked "significant" cyberattacks coming from a group it calls "Strontium" or "Fancy Bear," targeting anti-doping authorities and global sporting organizations. Reuters reports: The group, also called APT28, has been linked to the Russian government, Microsoft said in a blog post. At least 16 national and international sporting and anti-doping organizations across three continents were targeted in the attacks which began on Sept. 16, according to the company. The company said some of these attacks had been successful, but the majority had not. Microsoft has notified all customers targeted in these attacks.

Strontium, one of the world's oldest cyber espionage groups, has also been called Sofancy and Pawn Storm by a range of security firms and government officials. Security firm CrowdStrike has said the group may be associated with the Russian military intelligence agency GRU. Microsoft said Strontium reportedly released medical records and emails taken from sporting organizations and anti-doping officials in 2016 and 2018, resulting in an indictment in a federal court in the United States in 2018. Strontium's methods include spear-phishing, password spray, exploiting internet-connected devices and the use of both open-source and custom malware, it added.

When it comes to firewalls, most system administrators prefer to use a graphical user interface (GUI) rather than a command-line interface (CLI), a new academic study published over the summer has revealed. From a report: Despite the many preconceptions that system administrators are almost all ardent CLI users, firewall GUIs won by a pretty large margin in a survey compiling results from more than 300 respondents. Almost 60% of sysadmins said they "preferred" GUIs over CLIs, and 70% said they "used" GUIs on a daily basis. The survey showed that while CLIs might be popular in some circles, they are not the most ideal interface for managing a complex security software suite like a firewall. The survey, which included more than 15 questions that also sought to discover the reasoning behind each answer, revealed that "usability" was the main reason why system administrators tended to prefer and use firewalls more than CLIs.

Microsoft officials said the company's Azure Sphere microcontroller (MCU) and associated cloud security service will be generally available in February 2020. From a report: Microsoft also introduced new branding today for the ThreadX RTOS technology it acquired when it bought Express Logic in April 2019. Going forward, this product will be known as Azure RTOS. ThreadX is one of the most-deployed real-time operating systems in the world. Today, Microsoft said that Renesesas, a major microcontroller manufacturer, announced that Azure RTOS will be be broadly available across its products, including the Synergy and RA MCU families. Microsoft has been working for at least a couple of years to secure low-cost Internet-connected devices. Microsoft Research's "Project Sopris" was all about creating a highly secure microcontroller. That project morphed into Azure Sphere, which Microsoft announced in April 2018. The first Azure Sphere chip was the MediaTek MT3620, which included an onboard security subsystem MIcrosoft christened "Pluton." The Azure Sphere OS included a Microsoft-developed custom Linux kernel, plus secured application containers.

An anonymous reader quotes the CEO of Doist: Study after study after study into remote work has made one thing clear: Remote workers are more productive than their office-bound counterparts. What's not entirely clear is why. Yes, people gain back time (and sanity) by avoiding rush hour commutes. They avoid the distractions of the office. They regain a sense of control over their workdays. They have more time to dedicate to family, friends, and hobbies. But apart from the commute, all of those benefits aren't necessarily the result of location independence, but rather the byproduct of asynchronous communication -- giving employees control over when they communicate with their teammates.

Many company leaders are asking themselves if they should embrace remote work. Very few are asking themselves if they should embrace a more asynchronous workstyle. While I think remote work is the future, I believe that asynchronous communication (or async, for short) is an even more important factor in team productivity, whether your team is remote or not. Not only does async produce the best work results, but it also lets people do more meaningful work and live freer, more fulfilled lives.
Asynchronous communication helps workers avoid "collaborative overload" and the distractions of near-constant communication, the article argues. "We know that we are challenging the status quo and that calm, asynchronous communication isn't the current norm.

"It's going to take a paradigm shift to change things."

nickwinlund77 shares this story from ZDNet: A recently patched security flaw in modern versions of the PHP programming language is being exploited in the wild to take over servers, ZDNet has learned from threat intelligence firm Bad Packets. The vulnerability is a remote code execution (RCE) in PHP 7, the newer branch of PHP, the most common programming language used to build websites.

The issue, tracked as CVE-2019-11043, lets attackers run commands on servers just by accessing a specially-crafted URL. Exploiting the bug is trivial, and public proof-of-concept exploit code has been published on GitHub earlier this week. Only NGINX servers with PHP-FPM enabled are vulnerable. PHP-FPM, or FastCGI Process Manager, is an alternative PHP FastCGI implementation with some additional features, and according to reports, a common server configuration option.

Sparrowvsrevolution writes: In a lengthy article, Wired tells a newly detailed narrative of the cyberattack on the 2018 Winter Olympic games, which hit the Olympics network during the opening ceremony. The piece details how the malware used in that attack was designed to incorporate multiple sophisticated false flags, and how forensic analysts overcame those red herrings to eventually trace the attack to a specific unit of Russia's GRU military intelligence agency.
It's a good read. Wired calls it "perhaps the most deceptive hacking operation in history," but they finally get an answer from a 28-year-old former anarchist punk turned security researcher at the Reston, Virginia, office of the security and private intelligence firm FireEye. The tell-tale clue: the malware used "a certain common set of hacking tools called PowerShell Empire." He soon deduced that the source of that signal in the noise was a common tool used to create each one of the booby-trapped documents. It was an open source program, easily found online, called Malicious Macro Generator. Michael Matonis speculated that the hackers had chosen the program in order to blend in with a crowd of other malware authors, but it had ultimately had the opposite effect, setting them apart as a distinct set... When he looked at the command and control servers that the malware connected back to -- the strings that would control the puppetry of any successful infections -- all but a few of the IP addresses of those machines overlapped too...

Matonis began painstakingly checking every IP address his hackers had used as a command and control server in their campaign of malicious Word document phishing; he wanted to see what domains those IP addresses had hosted... At the end of his long chain of internet-address connections, Matonis had found a fingerprint that linked the Olympics attackers back to a hacking operation that directly targeted the 2016 US election. Not only had he solved the whodunit of Olympic Destroyer's origin, he'd gone further, showing that the culprit had been implicated in the most notorious hacking campaign ever to hit the American political system.