Hundreds of millions of phone numbers linked to Facebook accounts have been found online. TechCrunch: The exposed server contained over 419 million records over several databases on users across geographies, including 133 million records on U.S.-based Facebook users, 18 million records of users in the U.K., and another with more than 50 million records on users in Vietnam. But because the server wasn't protected with a password, anyone could find and access the database. Each record contained a user's unique Facebook ID and the phone number listed on the account. A user's Facebook ID is typically a long, unique and public number associated with their account, which can be easily used to discern an account's username. But phone numbers have not been public in more than a year since Facebook restricted access to users' phone numbers. TechCrunch verified a number of records in the database by matching a known Facebook user's phone number against their listed Facebook ID. We also checked other records by matching phone numbers against Facebook's own password reset feature, which can be used to partially reveal a user's phone number linked to their account.

An anonymous reader quotes a report from The Next Web: In March, criminals sought the help of commercially available voice-generating AI software to impersonate the boss of a German parent company that owns a UK-based energy firm. They then tricked the latter's chief executive into urgently wiring said funds to a Hungarian supplier in an hour, with guarantees that the transfer would be reimbursed immediately. The company CEO, hearing the familiar slight German accent and voice patterns of his boss, is said to have suspected nothing, the report said.

But not only was the money not reimbursed, the fraudsters posed as the German CEO to ask for another urgent money transfer. This time, however, the British CEO refused to make the payment. As it turns out, the funds the CEO transferred to Hungary were eventually moved to Mexico and other locations. Authorities are yet to determine the culprits behind the cybercrime operation. The firm was insured by Euler Hermes Group, which covered the entire cost of the payment. The names of the company and the parties involved were not disclosed. According to The Wall Street Journal, which first reported the news, the voice fraud cost the company $243,000.

Catalin Cimpanu, writing for ZDNet: More than 47,000 workstations and servers, possibly more, running on Supermicro motherboards are currently open to attacks because administrators have left an internal component exposed on the internet. These systems are vulnerable to a new set of vulnerabilities named USBAnywhere that affect the baseboard management controller (BMC) firmware of Supermicro motherboards. Patches are available to fix the USBAnywhere vulnerabilities, but Supermicro and security experts recommend restricting access to BMC management interfaces from the internet, as a precaution and industry best practice.

Zerodium, a company which claims it buys and then resells software exploits to government and law enforcement agencies, has updated its price list today, and Android exploits are worth more than iOS exploits for the first time ever. From a report: According to the company, starting today, a zero-click (no user interaction) exploit chain for Android can get hackers and security researchers up to $2.5 million in rewards. A similar exploit chain impacting iOS is worth only $2 million. Zerodium's new price for Android exploits is almost twelve times more when compared to the maximum of $200,000 the company was willing to offer a year ago, and even 100 times more than Zerodium was paying for some of the lower-impact Android exploits. Zerodium has timed its announcement with Google's official release for Android 10, scheduled for later today. Further reading: Exploit Sellers Say There are More iPhone Hacks on the Market Than They've Ever Seen.

intensivevocoder writes: USB4 will be formally published at the USB Developer Days Seattle on September 17, and the USB Implementers Forum (USB-IF) is expected to continue the widely maligned naming scheme for USB speeds introduced in February for USB 3.2, an engineer familiar with the USB-IF's plans told TechRepublic. As a quick recap, USB 3.1 Gen 2, increased the lane speed to 10 Gbps. A second 10 Gbps lane was added in the USB 3.2 standard, which the USB-IF calls "USB 3.2 Gen 2x2." USB4 (which is not written as "USB 4.0") will reach speeds of 40 Gbps, doubling the speeds again. USB4 was first previewed in March, when the USB Promoter Group announced that USB4 would be based on Intel's Thunderbolt 3 specification, though specific details are expected later this month.

Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.

Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.

For years, an enduring mystery has surrounded the Stuxnet virus attack that targeted Iran's nuclear program: How did the U.S. and Israel get their malware onto computer systems at the highly secured uranium-enrichment plant? From a report: The first-of-its-kind virus, designed to sabotage Iran's nuclear program, effectively launched the era of digital warfare and was unleashed some time in 2007, after Iran began installing its first batch of centrifuges at a controversial enrichment plant near the village of Natanz. The courier behind that intrusion, whose existence and role has not been previously reported, was an inside mole recruited by Dutch intelligence agents at the behest of the CIA and the Israeli intelligence agency, the Mossad, according to sources who spoke with Yahoo News.

An Iranian engineer recruited by the Dutch intelligence agency AIVD provided critical data that helped the U.S. developers target their code to the systems at Natanz, according to four intelligence sources. That mole then provided much-needed inside access when it came time to slip Stuxnet onto those systems using a USB flash drive. The Dutch were asked in 2004 to help the CIA and Mossad get access to the plant, but it wasn't until three years later that the mole, who posed as a mechanic working for a front company doing work at Natanz, delivered the digital weapon to the targeted systems. "[T]he Dutch mole was the most important way of getting the virus into Natanz," one of the sources told Yahoo.

thegarbz writes: It seems not a day goes by without yet another story reflecting poorly on major browsers. Not uncommon are stories that are mixed with a degree of bloat, either discussing rarely used features or directly criticizing memory consumption of major browsers. Unfortunately memory consumption is quite often the result of complete feature implementation of technologies used on the web, including DRM for streaming services and WebRTC. Other times it's the result of security measures, feature creep, or poor coding.

So in 2019 for those of us with slower tablets, what browser do you use as an alternative to the big two? How well does it work with the modern HTML5 internet? Are websites frequently broken does the simplicity of other browsers largely go unnoticed?

In a rare feat, French police have hijacked and neutralized a massive cryptocurrency mining botnet controlling close to a million infected computers. From a report: The notorious Retadup malware infects computers and starts mining cryptocurrency by sapping power from a computer's processor. Although the malware was used to generate money, the malware operators easily could have run other malicious code, like spyware or ransomware. The malware also has wormable properties, allowing it to spread from computer to computer. Since its first appearance, the cryptocurrency mining malware has spread across the world, including the U.S., Russia, and Central and South America. According to a blog post announcing the bust, security firm Avast confirmed the operation was successful. The security firm got involved after it discovered a design flaw in the malware's command and control server. That flaw, if properly exploited, would have "allowed us to remove the malware from its victims' computers" without pushing any code to victims' computers, the researchers said.

"The UK government is requiring all major UK airports to introduce 3D baggage screening equipment before the end of 2022," writes Slashdot reader Hammeh.

The BBC reports: Ministers say the technology will boost security, speed up pre-boarding checks, and could end the restrictions on travelling with liquids and laptops. The equipment, similar to CT scanners used in hospitals, is already being installed at London's Heathrow Airport. It provides a clearer picture of a bag's contents, which staff can zoom in to and rotate for inspection.

Currently, passengers taking liquid in their cabin baggage are restricted to containers holding no more than 100ml, which must be shown to security staff in a single, transparent, resealable plastic bag of about 20cm (8in) x 20cm. The limits have been in place since November 2006. Their introduction ended a ban on liquids in the cabin imposed three months earlier, when British police said they had foiled a plot to blow up as many as 10 planes using explosives hidden in drinks bottles...

The technology is already being used by US airports, including Atlanta's Hartsfield-Jackson and Chicago's O'Hare.

"The unprecedented attack on Apple iPhones revealed by Google this week was broader than first thought," reports Forbes: Multiple sources with knowledge of the situation said that Google's own Android operating system and Microsoft Windows PCs were also targeted in a campaign that sought to infect the computers and smartphones of the Uighur ethnic group in China. That community has long been targeted by the Chinese government, in particular in the Xinjiang region, where surveillance is pervasive.

Google's and Microsoft's operating systems were targeted via the same websites that launched the iPhone hacks, according to the sources, who spoke on the condition of anonymity. That Android and Windows were targeted is a sign that the hacks were part of a broad, two-year effort that went beyond Apple phones and infected many more than first suspected. One source suggested that the attacks were updated over time for different operating systems as the tech usage of the Uighur community changed...

The attacks appear to form part of a mass surveillance operation taking place on Uighur civilians, who've faced various forms of persecution in Xinjiang. Surveillance cameras are scattered across the region and facial recognition is prevalent.

"Businesses are waking up to the skills gamers can bring to the workplace," argues the BBC, adding that "Even the military is hiring gamers." "The ability to assimilate information, react swiftly and co-ordinate actions whilst remaining calm under pressure are often attributes of people that are good at gaming," a Royal Air Force spokesperson tells the BBC. Those skills are part of what the RAF is looking for "in a variety of roles. Skills acquired through gaming can be very relevant to certain areas."

"There are plenty of soft skills that gamers can utilise in a professional setting, such as teamwork, problem solving and strategic planning," says Ryan Gardner, a regional director with Hays recruitment.
They also interview the man who told Kotaku that "If you're playing EVE Online you basically already have an MBA." Matthew Ricci tells the BBC he stands by the sentiment -- and Eve players might understand why. Often made fun of in gaming circles as a "spreadsheet simulator", the economy of the fictional Eve universe is driven by real market principles. If you want to build a new spaceship, the raw material has to be mined by another player. Manufacturing costs come into effect, and commodities fluctuate in price based on demand and haulage distance.

Mr Ricci, who had always dreamed of being the boss of his own company, ran an in-game corporation comprising hundreds of players. Eventually, he realised he could transfer his skills to real-life business -- instead of doing it for free. He restructured Zentech, once a taxation vehicle for his father's business, and it is now in its fourth year helping international brands enter the Canadian market... He credits his success to his family, his obsession with running his own business -- and "a damn good company in Iceland that made a damn good game".
The BBC also spoke to a radiotherapy physicist who says old-school games like Palace of Magic, on his father's Acorn Electron [released in 1983] not only exposed him to computers, but encouraged a competitive streak which he believes translates to his work today. "When creating treatment plans, the aim is to optimise the radiation dose to the tumour and restrict it as much as possible to healthy surrounding tissue and organs... Most videogames are essentially puzzles to solve," he says. "And problem-solving is a big part of my job."

Last week Forbes ran an article by writer/data scientist Kurt Cagle arguing that Agile software development "was becoming less and less relevant." Within five days it had racked up 300,000 hits, and "I'm still digging out from the deluge of email, Tweets and Linked In messages," he wrote this week.

But in a new follow-up, Cagle looks back over his 40 years of programming, remembering successful six-month development cycles in the 1990s that used "a home-grown methodology which I've since dubbed the Studio Model, because it reflected the way that you create movies, television programs, orchestrated concerts, video games, and to be honest, most intellectual property." He then attempts a 12-point manifesto for this Agile alternative, which emphasizes things like a clear vision, good design, redundancy, flexibility, and remembering that as a project moves forward changes become "exponentially expensive". All too often, proponents of certain methodologies want to claim that their methodologies are the reason for success, when in reality, the deciding factor was the skill and tenaciousness of the people involved, the presence of a clearly articulated vision that could be changed as needed but that was not written in jello, and on recognizing the distinction between providing flexibility and fueling failures.

Agile is not, by itself, a methodology. The Agile Manifesto is a wish-list, written primarily by programmers, in response to the incessant micro-management by non-technical managers who were in general too incompetent to learn about the technology that they managed. I cheered when I first read it... Agile legitimized the idea that all stakeholders must be involved in the process of shaping the product's constraints and parameters (something that even now is still more preached than practiced). It gave a voice to developers and (some) others in the production process who up until then often had little say, and its message to managers in particular about the need to trust in the competence of the people they manage is one that cannot be stressed loudly enough. Its emphasis on change management has spurred a lot of thought about the nature of change, experimentation and development costs in the field. And for all that I think that certain Agile tools are a bit on the cheesy size, the idea of formalizing the process of development in such a way as to give creatives both the opportunities and the tools to shape and push back on design decisions is invaluable.

Yet, there are two key sets of problems that the Agile community faces. The first, and foremost, is that it decentralizes responsibility too much -- it essentially punts on the whole issue of governance or editorial guidance. This is that whole vision thing all over again... Agile empowers autonomous teams, but those teams still need to be able to pull together towards a common set of goals, and this means sacrificing some autonomy for cohesiveness. Agile also does not (ironically) distribute very well for precisely that same reason...

Agile may be everywhere, as several readers suggested, but scratch the surface a bit and you'll find that most of those successful agile projects were ones where you had a strong architect or steward, a culture that was already primed to work in a more Studio-Model like manner, a strong design in the first place as a foundation, and exceptional team-members that used agile in the way it should be used -- as a scaffold, rather than a crutch. There are good things to take out of the last twenty years of Agile, but this is not 2000, and it's well past time to acknowledge what's worked with Agile ... and what hasn't.

Long-time Slashdot reader theodp writes: For nearly 20 years," writes WIRED's Alex Davies in How Anthony Levandowski Put Himself at the Center of an Industry, "the French-American Levandowski has played a kind of purposeful Forrest Gump for the world of autonomous driving. Rather than stumbling into the center of one momentous event after another, Levandowski has put himself there. And he has left a mixed trail in his wake: Former colleagues have described him as brilliant, engaging, motivating, fast-charging, inconsiderate, a weasel, and just plain evil. None, though, deny that whether for good or ill, the benefit of society or himself, Levandowski has played a propulsive role in the development of self-driving tech."

But that's of little comfort to Levandowski, who was charged by the Feds earlier this week with stealing driverless-vehicle technology from Alphabet Inc.'s Waymo unit, prompting the New Yorker's Charles Duhigg to explain How the Anthony Levandowski Indictment Helps Big Tech Stifle Innovation in Silicon Valley. The Economic Espionage Act of 1996, Duhigg notes, "was mostly intended to be used against overseas saboteurs, but it has largely been directed at American citizens -- and, in effect, has made federal prosecutors into heavies operating on behalf of disgruntled tech firms."

The definition of a 'trade secret' in the statute, Duhigg adds, is so broad that it could very well mean anything. Daniel Olmos, an attorney who has represented individuals accused of stealing trade secrets, once told Duhigg, "I get calls all the time from scared engineers, who once put some work stuff on their home computer so they could work on it after dinner, and now they're worried if they try to jump to another firm they're gonna get sued. And you know what? They're right to be worried.

An anonymous reader quotes a report from ZDNet: Foxit Software, the company behind the Foxit PDF reader app, said today that hackers breached its servers and have made off with some user information. ZDNet learned of the breach from a Foxit customer who shared a copy of the email the company is sending out to affected users, asking them to choose new passwords when logging in the next time.

According to this email, the security breach impacted the company's website, and, namely, information stored in the My Account section. Foxit web accounts are how the company manages its existing customers and is where users can access trial software, download purchased products, and access order histories. Foxit said hackers managed to access MyAccount data such as email addresses, passwords, real names, phone numbers, company names, and IP addresses from which users logged into their accounts. Due to the presence of IP addresses in the data hackers managed to access, this is believed to be a breach of Foxit's backend infrastructure, rather than a credential stuffing attack. The email did not mention if passwords were either hashed or salted. However, Foxit said it did invalidate all passwords for customers who it believed were impacted by the breach.

What's also unknown is when exactly the security incident took place. It could've happened this week, last month, or in previous years.

The co-founder and chief executive of Twitter has had his own account on the service taken over by hackers. From a report: A group referring to itself as the Chuckling Squad said it was behind the breach of Jack Dorsey's account. A spokeswoman for Twitter told the BBC that the site was urgently investigating. The account tweeted out a flurry of highly offensive and racist remarks. The offending tweets appear to have been mostly removed.

An unprecedented iPhone hacking operation, which attacked "thousands of users a week" until it was disrupted in January, has been revealed by researchers at Google's external security team. From a report: The operation, which lasted two and a half years, used a small collection of hacked websites to deliver malware on to the iPhones of visitors. Users were compromised simply by visiting the sites: no interaction was necessary, and some of the methods used by the hackers affected even fully up-to-date phones.

Once hacked, the user's deepest secrets were exposed to the attackers. Their location was uploaded every minute; their device's keychain, containing all their passwords, was uploaded, as were their chat histories on popular apps including WhatsApp, Telegram and iMessage, their address book, and their Gmail database. The one silver lining is that the implant was not persistent: when the phone was restarted, it was cleared from memory unless the user revisited a compromised site. However, according to Ian Beer, a security researcher at Google: "Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device."

Hundreds of dental practice offices in the US have had their computers infected with ransomware this week, ZDNet reported Thursday. From a report: The incident is another case of a ransomware gang compromising a software provider and using its product to deploy ransomware on customers' systems. In this case, the software providers are The Digital Dental Record and PerCSoft, two Wisconsin-based companies who collaborated on DDS Safe, a medical records retention and backup solution advertised to dental practice offices in the US. Over the last weekend, a hacker group breached the infrastructure behind this software, and used it to deploy the REvil (Sodinokibi) ransomware on computers at hundreds of dentist offices across the US. The security breach came to light on Monday, when dentists returned to work, only to find out they couldn't access any patient information. A source impacted by the ransomware tells ZDNet that the two companies opted to pay the ransom demand. The Digital Dental Record and PerCSoft have been sharing a decrypter with impacted dental offices since Monday, helping companies recover encrypted files.

French police, with help from an antivirus firm, took control of a server that was used by cybercriminals to spread a worm programmed to mine cryptocurrency from more than 850,000 computers. Once in control of the server, the police remotely removed the malware from those computers. Motherboard reports: Antivirus firm Avast, which helped France's National Gendarmerie cybercrime center, announced the operation on Wednesday. Avast said that they found that the command and control server, which was located in France, had a design flaw in its protocol that made it possible to remove the malware without "making the victims execute any extra code," as the company explained in its lengthy report.

Cybersecurity firms such as Avast, as well as Trend Micro, had been tracking the worm, called Retadup, since last spring. Most of the infected computers were used by the malware authors to mine the cryptocurrency Monero, but in some cases it was also used to push ransomware and password-stealing malware, according to Avast. As the antivirus firm reported, most Retadup victims were in South America, with Peru, Venezuela, Bolivia and Mexico at the top of the list.