An anonymous reader quotes a report from The New York Times: The Trump administration is moving to begin collecting DNA samples from hundreds of thousands of people booked into federal immigration custody each year for entry into a national criminal database, an immense expansion of the use of technology to enforce the nation's immigration laws. Senior officials at the Department of Homeland Security said Wednesday that the Justice Department was developing a federal regulation that would give immigration officers the authority to collect DNA in detention facilities that are holding more than 40,000 people.

The move would constitute a major expansion of the use of a database maintained by the F.B.I., which has been limited mainly to genetic data collected from people who have been arrested, charged or convicted in connection with serious crimes. Immigrant and privacy advocates said the move raised privacy concerns for an already vulnerable population that could face profiling or discrimination as a result of their personal data being shared among law enforcement authorities. The new rules would allow the government to collect DNA from children, as well as those who seek asylum at legal ports of entry and have not broken the law. They warned that United States citizens, who are sometimes accidentally booked into immigration custody, could also be forced to hand over their private genetic information. Homeland security officials said the new initiative was permitted under the DNA Fingerprint Act of 2005. "Up until now, immigrant detainees have been exempt from the law, they said, because of an agreement between Eric H. Holder Jr. and Janet Napolitano, who served as attorney general and homeland security secretary, respectively, under President Barack Obama," reports The New York Times.

The new program "would provide a comprehensive DNA profile of individuals who are tested, as opposed to the more narrow test that was used only to determine parentage," the report says. "And unlike the testing under the pilot program, the results would be shared with other law enforcement agencies."

An anonymous reader quotes a report from Ars Technica: Monday, AMD announced Ryzen Pro 3000 desktop CPUs would be available in Q4 2019. This of course raises the question, "What's a Ryzen Pro?" The business answer: Ryzen Pro 3000 is a line of CPUs specifically intended to power business-class desktop machines. The Pro line ranges from the humble dual-core Athlon Pro 300GE all the way through to Ryzen 9 Pro 3900, a 12-core/24-thread monster. The new parts will not be available for end-user retail purchase and are only available to OEMs seeking to build systems around them.

From a more technical perspective, the answer is that the Ryzen Pro line includes AMD Memory Guard, a transparent system memory encryption feature that appears to be equivalent to the AMD SME (Secure Memory Encryption) in Epyc server CPUs. Although AMD's own press materials don't directly relate the two technologies, their description of Memory Guard -- "a transparent memory encryption (OS and application independent DRAM encryption) providing a cryptographic AES encryption of system memory" -- matches Epyc's SME exactly. AMD Memory Guard is not, unfortunately, available in standard Ryzen 3000 desktop CPUs. If you want to build your own Ryzen PC with full memory encryption from scratch, you're out of luck for now.

dryriver shares a report from CNN: Sports brand Asics has issued an apology after "objectionable content" played on the screens above its store in Auckland, New Zealand. Pornographic videos were shown on promotional screens for hours outside an Asics store in Auckland, New Zealand on Sunday morning, the New Zealand Herald reported. The Japanese sportswear brand apologized Sunday, saying the material had been played above its central Auckland store due to a hack. "This morning an unknown person gained access to the screens above our Central Auckland store and some objectionable content was displayed on the screens," said the statement published on Asics New Zealand's Facebook page. Security officer Dwayne Hinagano told the New Zealand Herald that an explicit sex video played for hours and was seen by startled passers-by. "The video ran for a long time, maybe two hours from 8am until the shop staff arrived at about 10am. Some people were shocked, but others just stopped and watched," Hinagano told the news outlet, which also cited witnesses who said the video had been running since 1 a.m. Over the weekend, two hackers managed to upload a porn video to an interstate billboard outside Detroit. According to news reports, the pornography played for about 20 minutes before it was removed.

"Police in the suburb of Auburn Hills said in a statement that the unidentified pair, who appear to be young white men, were captured by video shortly before 11 p.m. Saturday breaking into a building at the base of the electronic billboard on Interstate 75," reports NBC News. "The building, which is surrounded by a six-foot fence and is unstaffed, houses the computer that controls the sign, a police official told NBC affiliate WDIV."

Ten hospitals -- three in Alabama and seven in Australia -- have been hit with paralyzing ransomware attacks that are affecting their ability to take new patients, it was widely reported on Tuesday. Ars Technica reports: All three hospitals that make up the DCH Health System in Alabama were closed to new patients on Tuesday as officials there coped with an attack that paralyzed the health network's computer system. The hospitals -- DCH Regional Medical Center in Tuscaloosa, Northport Medical Center, and Fayette Medical Center -- are turning away "all but the most critical new patients" at the time this post was going live. Local ambulances were being instructed to take patients to other hospitals when possible. Patients coming to DCH emergency rooms faced the possibility of being transferred to another hospital once they were stabilized.

"A criminal is limiting our ability to use our computer systems in exchange for an as-yet unknown payment," DCH representatives wrote in a release. "Our hospitals have implemented our emergency procedures to ensure safe and efficient operations in the event technology dependent on computers is not available." At least seven hospitals in Australia, meanwhile, were also feeling the effects of a ransomware attack that struck on Monday. The hospitals in Gippsland and southwest Victoria said they were rescheduling some patient services as they responded to a "cyber health incident." According to news reports, hospital computer systems remained locked down at seven hospitals on Tuesday more than 24 hours after the attack struck. "An official said it would take weeks to secure and restore damaged networks," reports Ars Technica. "The official said there was no indication that patient records had been accessed."

A former Yahoo software engineer pleaded guilty yesterday to hacking into the personal accounts of over 6,000 Yahoo users, in search of sexual images and videos. From a report: Reyes Daniel Ruiz, 34, of Tracy, California, worked for more than ten years for Yahoo!, where he served as a reliability engineer for the company's Yahoo! Mail service, among other roles. According to court documents, Ruiz used the access to Yahoo!'s internal network that his job provided to crack users' passwords and gain access to their email accounts. In total, he accessed about 6,000 accounts, most belonging to younger women, including personal friends and work colleagues. Once in, he searched and downloaded images and videos, which he stored at home on a hard drive. Ruiz also used access to the hacked Yahoo! email inboxes to compromise accounts at services like Apple iCloud, Facebook, Gmail, DropBox, and others, where the victims used the Yahoo! email address to register accounts. He did this by requesting password resets on the third-party sites, which he received inside the victim's Yahoo! inboxes. Ruiz then continued his search of personal images and videos on these new accounts.

In the first nine months of the year, ransomware infections have hit over 500 US schools, according to a report published last week by cyber-security firm Armor. From a report: In total, the company said it found and tracked ransomware infections at 54 educational organizations like school districts and colleges, accounting for disruptions at over 500 schools. To make matters worse, the attacks seem to have picked up in the last two weeks, with 15 school districts (accounting for over 100 K-12 schools) getting hit at the worst time possible -- in the first weeks of the new school year. Of these 15 ransomware incidents, Armos said that five were caused by the Ryuk ransomware, one of today's most active ransomware strains/gangs. Overall, Connecticut saw ransomware infections hit seven school districts throughout 2019, making them the state whose educational institutions were compromised the most by ransomware attacks this year. But while Connecticut saw the most ransomware infections targeting school districts, it was Louisiana who handled the attacks the best when, in July, Governor John Bel Edwards declared a state of emergency in response to a wave of ransomware infections that hit three school districts. The governer's actions rallied multiple state and private incident response teams together and helped impacted school districts recover before the new school year, without paying the hackers' ransom demand.

An anonymous reader quotes a report from Motherboard: Soon it may be easier to get your hands on a cable that looks just like a legitimate Apple lightning cable, but which actually lets you remotely take over a computer. The security researcher behind the recently developed tool announced over the weekend that the cable has been successfully made in a factory. MG is the creator of the O.MG Cable. It charges phones and transfers data in the same way an Apple cable does, but it also contains a wireless hotspot that a hacker can connect to. Once they've done that, a hacker can run commands on the computer, potentially rummaging through a victim's files, for instance.

After demoing the cable for Motherboard at the Def Con hacking conference this summer, MG said "It's like being able to sit at the keyboard and mouse of the victim but without actually being there." At the time, MG was selling the handmade cables at the conference for $200 each. Now that production process has been streamlined. This doesn't necessarily mean that factories are churning out O.MG Cables right now, but it shows that their manufacture can be fully outsourced, and MG doesn't have to make the cables by hand.

New submitter xack shares a report: Microsoft has annoyed some of its 900 million Windows 10 device users after apparently removing the 'Use offline account' as part of its effort to herd users towards its cloud-based Microsoft Account. The offline local account is specific to one device, while the Microsoft Account can be used to log in to multiple devices and comes with the benefit of Microsoft's recent work on passwordless authentication with Windows Hello. The local account doesn't require an internet connection or an email address -- just a username and password that are stored on the PC. But Windows 10 users are annoyed that Microsoft has hidden the local account option when setting up a new PC or reinstalling Windows 10. A user on a popular Reddit thread notes that the local account option is now invisible if the device is connected to the internet. "Either run the setup without being connected to the internet, or type in a fake phone number a few times and it will give you the prompt to create a local account," Froggyowns suggested as a solution.

Windows ships with a full volume encryption tool called BitLocker. The feature used to trust any SSD that claimed to offer its own hardware-based encryption, but that changed in the KB4516071 update to Windows 10 released on September 24, which now assumes that connected SSDs don't actually encrypt anything. From a report: "SwiftOnSecurity" called attention to this change on September 26. The pseudonymous Twitter user then reminded everyone of a November 2018 report that revealed security flaws, such as the use of master passwords set by manufacturers, of self-encrypting drives. That meant people who purchased SSDs that were supposed to help keep their data secure might as well have purchased a drive that didn't handle its own encryption instead. Those people were actually worse off than anticipated because Microsoft set up BitLocker to leave these self-encrypting drives to their own devices. This was supposed to help with performance -- the drives could use their own hardware to encrypt their contents rather than using the CPU -- without compromising the drive's security. Now it seems the company will no longer trust SSD manufacturers to keep their customers safe by themselves. Here's the exact update Microsoft said it made in KB4516071: "Changes the default setting for BitLocker when encrypting a self-encrypting hard drive. Now, the default is to use software encryption for newly encrypted drives. For existing drives, the type of encryption will not change." People can also choose not to have BitLocker encrypt these drives, too, but the default setting assumes they don't want to take SSD manufacturers at their word.

"In April 2013, I received via U.S. mail more than a gram of pure heroin as part of a scheme to get me arrested for drug possession," writes security reserch Brian Krebs. "But the plan failed and the Ukrainian mastermind behind it soon after was imprisoned for unrelated cybercrime offenses.

"That individual recently gave his first interview since finishing his jail time here in the states, and he's shared some select (if often abrasive and coarse) details on how he got into cybercrime and why... Vovnenko claims he never sent anything and that it was all done by members of his forum... "They sent all sorts of crazy shit. Forty or so guys would send. When I was already doing time, one of the dudes sent it...." In an interview published on the Russian-language security blog Krober.biz, Vovnenko said he began stealing early in life, and by 13 was already getting picked up for petty robberies and thefts... "After watching movies and reading books about hackers, I really wanted to become a sort of virtual bandit who robs banks without leaving home," Vovnenko recalled...

Around the same time Fly was taking bitcoin donations for a fund to purchase heroin on my behalf, he was also engaged to be married to a nice young woman. But Fly apparently did not fully trust his bride-to-be, so he had malware installed on her system that forwarded him copies of all email that she sent and received. But Fly would make at least two big operational security mistakes in this spying effort: First, he had his fiancée's messages forwarded to an email account he'd used for plenty of cybercriminal stuff related to his various "Fly" identities. Mistake number two was the password for his email account was the same as one of his cybercrime forum admin accounts. And unbeknownst to him at the time, that forum was hacked, with all email addresses and hashed passwords exposed.

Soon enough, investigators were reading Fly's email, including the messages forwarded from his wife's account that had details about their upcoming nuptials, such as shipping addresses for their wedding-related items and the full name of Fly's fiancée. It didn't take long to zero in on Fly's location in Naples. While it may sound unlikely that a guy so immeshed in the cybercrime space could make such rookie security mistakes, I have found that a great many cybercriminals actually have worse operational security than the average Internet user. I suspect this may be because the nature of their activities requires them to create vast numbers of single- or brief-use accounts, and in general they tend to re-use credentials across multiple sites, or else pick very poor passwords -- even for critical resources...

Towards the end, Fly says he's considering going back to school, and that he may even take up information security as a study. I wish him luck in that whatever that endeavor is as long as he can also avoid stealing from people.

"After years of countless reviews, discussions, and code rewrites, Linus Torvalds approved on Saturday a new security feature for the Linux kernel, named 'lockdown'," reports ZDNet: The new feature will ship as a LSM (Linux Security Module) in the soon-to-be-released Linux kernel 5.4 branch, where it will be turned off by default; usage being optional due to the risk of breaking existing systems. The new feature's primary function will be to strengthen the divide between userland processes and kernel code by preventing even the root account from interacting with kernel code -- something that it's been able to do, by design, until now.

When enabled, the new "lockdown" feature will restrict some kernel functionality, even for the root user, making it harder for compromised root accounts to compromise the rest of the OS... "When enabled, various pieces of kernel functionality are restricted," said Linus Torvalds, Linux kernel creator, and the one who put the final stamp of approval on the module yesterday. This includes restricting access to kernel features that may allow arbitrary code execution via code supplied by userland processes; blocking processes from writing or reading /dev/mem and /dev/kmem memory; block access to opening /dev/port to prevent raw port access; enforcing kernel module signatures; and many more others, detailed here.

"Kickstarter's CEO Aziz Hasan sent an email to staff Friday, explaining why the company fired two staff members and laid off another who played an instrumental role in organizing a union at the company..." reports Motherboard: Hasan insisted that the firings were related specifically to job performance issues, not union organizing. "We understood how these firings could be perceived, but it would be unfair to not hold these two employees to the same standards as the rest of our staff," he wrote. "It's worth noting that since March we've given raises to 14 people who have been public about their support for a union, and promoted three of them...."

In his letter, Hasan asserts that management believes a union would hurt the company and that union organizers have not made their complaints clear to the company. "The union framework is inherently adversarial," he writes. "That dynamic doesn't reflect who we are as a company, how we interact, how we make decisions, or where we need to go. We believe that in many ways it would set us back, and that the us vs. them binary already has."

If Kickstarter unionizes, it would be one of the first white collar tech unions in the United States.
The magazine Current Affairs has a different perspective: When the union organizers were fired, Current Affairs happened to be in the middle of a Kickstarter campaign. As a left publication, we were appalled, and didn't want to publicly support an anti-union company. So we got together with our colleagues at Protean Magazine, Pinko Magazine, the Nib, and the Baffler (all of whom had done Kickstarter campaigns in the past) and released a statement condemning the firings and expressing solidarity with the union. We invited other Kickstarter project creators to join us on the statement, which hundreds did, including well-known creators like Neil Gaiman, Anita Sarkeesian, Molly Crabapple, and Richard Herring. Collectively, the creators on our statement have raised millions of dollars on the platform (my estimate is $10 million, but I stopped counting around 5). We were united in (1) appreciating Kickstarter's staff and the great platform they have created and (2) being firmly opposed to the company's anti-union activities and supportive of the workers' rights...

As our campaign took off and started to attract press attention, I received a message from Kickstarter's chief communications officer. He asked me if I would like to talk on the phone so that he could address our concerns.... We did not resolve anything on the conversation, but he said the company was thinking through how to respond and he would be in touch. Saturday, Kickstarter offered its response. The communications officer emailed me, and said he would like to share a statement from the CEO with the project creators. The statement said that Kickstarter:

1. Stood by its decision to fire the organizers, and would be dispatching its lawyers to fight their claims.

2. Would not voluntarily recognize a union even if the vast majority of workers signed in support of one.

3. Would not pledge to remain neutral on unionization, and would continue to actively oppose the effort.

The statement was the most blatant slap in the face imaginable to both the workers and the project creators. It says, in essence: drop dead...

For Current Affairs, it means that we now have to cease using Kickstarter for our fundraising efforts. Who can possibly partner with a company that is actively and proudly trying to union-bust? Why should we give 5 percent of our supporters' money to a corporation that will use it to hire lawyers and P.R. professionals to keep its workers from exercising their rights?

Google's plans to implement DNS over HTTPS in Chrome are being investigated by a committee in the U.S. House of Representatives, while the Justice Department has "recently received complaints" about the practice, according to the Wall Street Journal.

An anonymous reader quotes Engadget: While Google says it's pushing for adoption of the technology to prevent spying and spoofing, House investigators are worried this would give the internet giant an unfair advantage by denying access to users' data. The House sent a letter on September 13th asking if Google would use data handled through the process for commercial purposes... Internet service providers are worried that they may be shut out of the data and won't know as much about their customers' traffic patterns. This could "foreclose competition in advertising and other industries," an alliance of ISPs told Congress in a September 19th letter...

Mozilla also wants to use the format to secure DNS in Firefox, and the company's Marshall Erwin told the WSJ that the antitrust gripes are "fundamentally misleading." ISPs are trying to undermine the standard simply because they want continued access to users' data, Erwin said. Unencrypted DNS helps them target ads by tracking your web habits, and it's harder to thwart DNS tracking than cookies and other typical approaches.

The conventional wisdom that liberal arts majors earn less than compsci majors may be true for the first job, but not necessarily for an entire career, reports the New York Times, in an article shared by jds91md (and republished by Indiana State's College of Arts and Sciences). "By age 40 the earnings of people who majored in fields like social science or history have caught up." This happens for two reasons. First, many of the latest technical skills that are in high demand today become obsolete when technology progresses. Older workers must learn these new skills on the fly, while younger workers may have learned them in school. Skill obsolescence and increased competition from younger graduates work together to lower the earnings advantage for STEM degree-holders as they age.

Second, although liberal arts majors start slow, they gradually catch up to their peers in STEM fields. This is by design. A liberal arts education fosters valuable "soft skills" like problem-solving, critical thinking and adaptability. Such skills are hard to quantify, and they don't create clean pathways to high-paying first jobs. But they have long-run value in a wide variety of careers.
Some other interesting stats from the article:

• STEM salaries grew more slowly -- and the field experienced a higher exit rate. "Between the ages of 25 and 40, the share of STEM majors working in STEM jobs falls from 65 percent to 48 percent. Many of them shift into managerial positions, which pay well but do not always require specialized skills."

• High-paying jobs in management, business and law raise the average salary of all social science/history majors.

An anonymous reader quotes International Business Times: European aerospace giant Airbus has been hit by a series of attacks by hackers targeting its suppliers in search of commercial secrets, sources told AFP, adding they suspected a Chinese link. AFP spoke to seven security and industry sources, all of whom confirmed a spate of attacks in the past 12 months but asked for anonymity because of the sensitive nature of the information they were sharing...

Many state-backed and independent hackers are known to disguise their tracks, or they may leave clues intended to confuse investigators or lead them to blame someone else. But the sources said they suspected Chinese hackers were responsible, given their record of trying to steal sensitive commercial information and the fact that Beijing has just launched a plane designed to compete with Airbus and US rival Boeing.

State-owned plane-maker Comac has already launched manufacturing of its first mid-range airliner but has struggled to get it certified. Engines and avionics are "areas in which Chinese research and development is weak," one of the sources said.

An anonymous reader quotes ZDNet: A massive wave of account hijacks has hit YouTube users, and especially creators in the auto-tuning and car review community, a ZDNet investigation discovered following a tip from one of our readers. Several high-profile accounts from the YouTube creators car community have fallen victim to these attacks already... But the YouTube car community wasn't the only one targeted. Other YouTube creators also reported having their accounts hijacked last week, and especially over [last] weekend, with tens of complaints flooding Twitter and the YouTube support forum.

The account hacks are the result of a coordinated campaign that consisted of messages luring users to phishing sites, where hackers logged account credentials... Some users reported receiving individual emails, while others said they received email chains that included the addresses of multiple YouTube creators, usually from the same community or niche... Ryan Scott, the owner of the PURE Function YouTube channel confirmed he used two-factor authentication on his account, validating that hackers did bypass 2FA on some of the hacked accounts.

Google did not return a request for comment.
The article includes links to 9 different complaints in YouTube's support forum -- and another 9 complaints from Twitter -- adding that they'd found "many more."

MIT's Technology Review reports that YouTube warned the owners of roughly 23 million channels to boost their security measures.

"Social media platforms based in the U.S. including Facebook and WhatsApp will be forced to share users' encrypted messages with British police under a new treaty between the two countries, " reports Bloomberg, citing "a person familiar with the matter." The accord, which is set to be signed by next month, will compel social media firms to share information to support investigations into individuals suspected of serious criminal offenses including terrorism and pedophilia, the person said.

An anonymous reader quotes a report from Engadget: The voting machines that the U.S. will use in the 2020 election are still vulnerable to hacks. A group of ethical hackers tested a bunch of those voting machines and election systems (most of which they bought on eBay). They were able to crack into every machine, The Washington Post reports. Their tests took place this summer at a Def Con cybersecurity conference, but the group visited Washington to share their findings yesterday. A number of flaws allowed the hackers to access the machines, including weak default passwords and shoddy encryption. The group says the machines could be hacked by anyone with access to them, and if poll workers make mistakes or take shortcuts, the machines could be infiltrated by remote hackers.

An anonymous reader shares a report: A security researcher has today released a new jailbreak that impacts all iOS devices running on A5 to A11 chipsets -- chips included in all Apple products released between 2011 and 2017. This includes iPhone models from 4S to 8 and X. The jailbreak uses a new exploit named Checkm8 that exploits vulnerabilities in Apple's Bootrom (secure boot ROM) to grant phone owners full control over their device. Axi0mX, the security researcher who published Checkm8 today, told ZDNet he'd worked on the jailbreak all year.

An anonymous reader quotes a report from TechCrunch: DoorDash has confirmed a data breach. The food delivery company said in a blog post Thursday that 4.9 million customers, delivery workers and merchants had their information stolen by hackers. The breach happened on May 4, the company said, but added that customers who joined after April 5, 2018 are not affected by the breach. It's not clear why it took almost five months for DoorDash to detect the breach.

DoorDash spokesperson Mattie Magdovitz blamed the breach on "a third-party service provider," but the third-party was not named. "We immediately launched an investigation and outside security experts were engaged to assess what occurred," she said. Users who joined the platform before April 5, 2018 had their name, email and delivery addresses, order history, phone numbers, and hashed and salted passwords stolen. The company also said consumers had the last-four digits of their payment cards was also taken, though full numbers and card verification values (CVV) were not taken. Both delivery workers and merchants had the last four-digits of their bank account numbers stolen. Around 100,000 delivery workers also had their driver's license information stolen in the breach.