The laws of botched supply and demand forecasting are coming home to roost for the semiconductor industry in 2019 with DRAM average sales price set to fall 42.1 per cent. From a report: The latest ladle of doom and gloom was poured onto the sector this morning by Gartner, days after IC Insights delivered its dark prognosis for chip makers. "A weaker pricing environment for memory and some other chip types combined with the US-China trade dispute and lower growth in major applications, including smartphones, servers and PCs is driving the global semiconductor market to its lowest growth level since 2009," said Gartner analyst Ben Lee. [...] The upshot of this is that global semiconductor revenues are expected to drop 9.6 per cent year-on-year to $475bn. This is down 3.4 per cent on Gartner's earlier forecast and likely could be revised again before the end of 2019 is upon us. Given the volumes of DRAM swilling around the supply chain that have forced down price, oversupply is on track to spill into the first and second quarters of the next calendar year.

Slack today announced it's deploying an under-the-hood upgrade for its desktop app to boost performance for companies and teams using the app for workplace collaboration. From a report: The latest version of Slack for desktop and internet browsers is due out in the coming weeks and promises a 33% faster launch time, 10 times faster launch of VoIP calls, and roughly 50% less memory usage. The news comes a month after Slack became a public company, listed as WORK on the New York Stock Exchange. Slack product architect and lead of desktop client rewrite Johnny Rodgers said the upgrade takes advantage of changes to Slack's underlying technology, like modern JavaScript tools and techniques and the React UI framework.

Speaking of Dropbox, the online storage cloud service has enabled support for ZFS and XFS on 64-bit Linux systems, and eCryptFS and Btrfs on all Linux systems. The move comes after it recently pulled support for all file storage systems on Linux except Ext4. From a report: Dropbox stopped supporting folder syncing to drives with filesystems it deemed "uncommon", which on Linux meant anything but Ext4, upsetting quite a few users. The reason cited for this was that "a supported file system is required as Dropbox relies on extended attributes (X-attrs) to identify files in the Dropbox folder and keep them in sync", which doesn't really make sense since there are many filesystems that support xattr (extended attributes) on Linux. After this change was announced, various workarounds started to appear online, including one that I posted on Linux Uprising. There was even a new unofficial, open source Dropbox client developed for this reason (which is also much lighter than the official client by the way). But this didn't last long though, as last week, the Dropbox 77.3.127 beta changelog says that Dropbox has added back support for ZFS (on 64-bit systems only), XFS (on 64bit systems only), Btrfs and eCryptFS.

Equifax has agreed to pay at least $575 million to the US Federal Trade Commission, the Consumer Financial Protection Bureau and all 50 states over its massive 2017 data breach. From a report: If that isn't enough to compensate people impacted by the breach, the credit reporting company could have to pay up to $700 million -- a figure we got hints about on Friday. The settlement includes $300 million for a fund providing affected consumers with credit monitoring services and for those who bought credit or identity monitoring services in the wake of the breach. If that doesn't cover the losses, Equifax will add up to $125 million to the fund. It's also agreed to pay $175 million to 48 states, the District of Columbia and Puerto Rico, as well as $100 million in civil penalties to the CFPB. Hackers stole the personal information -- including Social Security numbers and home addresses -- of nearly 148 million Americans from Equifax's servers in a data breach that ran from May and July 2017. A December 2018 House Oversight Committee report called the breach "entirely preventable," saying Equifax didn't take action to prevent it and wasn't prepared for the aftermath.

Long-time Slashdot reader sfcat quotes Forbes: Almost a decade ago, courts sounded a clear warning bell that Google's culture was tainted by illegal and pervasive age discrimination. Inexplicably, Google didn't listen.

And so the Los Angeles Times recently reported that Google has agreed to pay $11 million to settle a federal lawsuit alleging Google engaged in a systemic practice of discriminating on the basis of age in hiring. Some 227 plaintiffs will collect an average of $35,000 each.

Google actually agreed to settle the case in December but the final settlement agreement was presented to a federal judge on Friday. The lawsuit was filed by Cheryl Fillekes, a software engineer who was interviewed by Google four times from 2007 to 2014, starting when she was 47, but was never hired.

The lawsuit alleged Google hired younger workers based on "cultural fit."
In the settlement Google also agrees to train its managers about age bias and create an "age diversity in recruiting" committee. Forbes points out that the median age for all Google employees in 2017 was 30, "a decade younger than the median age of U.S. workers."

"On its web page, Google says its mission is to 'organize the world's information and make it universally accessible and useful.' But for some reason Google has failed as a company to organize and use the information that age discrimination is illegal."

Australia-based Atlassian"has implemented a new performance review strategy designed to give their workers a better evaluation of how they're performing," reports Business Insider, adding that Atlassian's global head of talent said the company wants to measure contributions to a larger team effort. "We want people to get rewarded for what they delivered." In 2018 it soft-launched a strategy where most of its performance review process will have nothing to do with the skills in an employee's job, but more to do with how well they are living with the company values. Now, the strategy is being rolled out permanently and will be tied to employee bonuses... "We want to be able to evaluate a whole person and encourage them to bring their full self to work and not just focus on skills itself, but really focus on the way they do their work," said Bek Chee, Atlassian's global head of talent. She added that while workforces have changed over the past 30 years, performance reviews, for the most part, have stayed the same...

With this performance review system, Atlassian aims to throw out the idea of the "brilliant jerk", which Chee describes as someone who is technically-talented, but perhaps at the expense of others. Instead it is focusing on how an employee demonstrates the company values, how they complete their roles and how they contribute to their team. "We really want to enforce the way that values get lived, the way that people impact the team and the way that they also contribute within their role.

GitLab's CEO and co-founder says there was one big takeaway from their recent "2019 Global Developer Report: DevSecOps": that early adopters of a strong Devops model experience greater security. "Security teams in a longstanding DevOps environment reported they are three times more likely to discover bugs before code is merged," according to the GitLab blog, "and 90% more likely to test between 91% and 100% of code than teams who encounter early-stage DevOps."

But after polling over 4,000 software professionals, the survey also found positive results from another workplace arrangement, which they report under the headline "Remote work works." According to our survey respondents, working remotely leads to greater collaboration, better documentation, and transparency.

In fact, developers in a mostly remote environment are 23% more likely to have good insight into what colleagues are working on and rate the maturity of their organization's security practices 29% higher than those who work in a traditional office environment.

"Everyone knows security needs to be baked into the development lifecycle, but that doesn't mean it is," writes ZDNet, reporting on a new survey they say showed that "long-standing friction between security and development teams remain."

The results came from GitLab's "2019 Global Developer Report: DevSecOps" survey of over 4,000 software professionals. Nearly half of security pros surveyed, 49%, said they struggle to get developers to make remediation of vulnerabilities a priority. Worse still, 68% of security professionals feel fewer than half of developers can spot security vulnerabilities later in the life cycle. Roughly half of security professionals said they most often found bugs after code is merged in a test environment.

At the same time, nearly 70% of developers said that while they are expected to write secure code, they get little guidance or help. One disgruntled programmer said, "It's a mess, no standardization, most of my work has never had a security scan." Another problem is it seems many companies don't take security seriously enough. Nearly 44% of those surveyed reported that they're not judged on their security vulnerabilities.
ZDNet also cites Linus Torvalds' remarks on the Linux kernel mailing list in 2017, complaining about how security people celebrate when code is hardened against an invalid access. "[F]rom a developer standpoint, things really are not done. Not even close. From a developer standpoint, the bad access was just a symptom, and it needs to be reported, and debugged, and fixed, so that the bug actually gets corrected. So from a developer standpoint, the end point of hardening is just the starting point, and when you think you're done, we're really only getting started."

Torvalds then pointed out that the user community also has a third set of entirely different expectations, adding that "the number one rule of kernel development is that 'we don't break users'. Because without users, your program is pointless, and all the development work you've done over decades is pointless... and security is pointless too, in the end." Juggling the interest of users and developers, Torvalds suggests security people should adopt "do no harm" as their mantra, and "when adding hardening features, the first step should *ALWAYS* be 'just report it'. Not killing things, not even stopping the access. Report it. Nothing else."

"Microsoft on Wednesday announced that it would give away software designed to improve the security of American voting machines," reports NBC News.

Microsoft also said its AccountGuard service has already spotted 781 cyberattacks by foreign adversaries targeting political organizations -- 95% of which were located in the U.S. The company said it was rolling out the free, open-source software product called ElectionGuard, which it said uses encryption to "enable a new era of secure, verifiable voting." The company is working with election machine vendors and local governments to deploy the system in a pilot program for the 2020 election. The system uses an encrypted tracking code to allow a voter to verify that his or her vote has been recorded and has not been tampered with, Microsoft said in a blog post...

Edward Perez, an election security expert with the independent Open Source Election Technology Institute, said Microsoft's move signals that voting systems, long a technology backwater, are finally receiving attention from the county's leading technical minds. "We think that it's good when a technology provider as significant as Microsoft is stepping into something as nationally important as election security," Perez told NBC News. "ElectionGuard does provide verification and it can help to detect attacks. It's important to note that detection is different from prevention."
Microsoft also said its notified nearly 10,000 customers that they've been targeted or compromised by nation-state cyberattacks, according to the article -- mostly from Russia, Iran, and North Korea.

"While many of these attacks are unrelated to the democratic process," Microsoft said in a blog post, "this data demonstrates the significant extent to which nation-states continue to rely on cyberattacks as a tool to gain intelligence, influence geopolitics, or achieve other objectives."

A contractor for Russia's intelligence agency suffered a breach, revealing projects they were pursuing -- including one to deanonymize Tor traffic.

An anonymous reader shared this report from ZDNet: The breach took place last weekend, on July 13, when a group of hackers going by the name of 0v1ru$ hacked into SyTech's Active Directory server from where they gained access to the company's entire IT network, including a JIRA instance. Hackers stole 7.5TB of data from the contractor's network, and they defaced the company's website with a "yoba face," an emoji popular with Russian users that stands for "trolling..." Per the different reports in Russian media, the files indicate that SyTech had worked since 2009 on a multitude of projects.
In February ZDNet reported that Russia disconnected itself from the rest of the internet in a test -- and suggests today that it was a real-world test of one of these leaked "secret projects" from the Russian intelligence agency. But the other projects include:

• Nautilus-S - a project for deanonymizing Tor traffic with the help of rogue Tor servers.
• Nautilus - a project for collecting data about social media users (such as Facebook, MySpace, and LinkedIn).
• Reward - a project to covertly penetrate P2P networks, like the one used for torrents.
• Mentor - a project to monitor and search email communications on the servers of Russian companies.
• Tax-3 - a project for the creation of a closed intranet to store the information of highly-sensitive state figures, judges, and local administration officials, separate from the rest of the state's IT networks.

ZDNet also reports that the Tor-deanonymizing project, started in 2012, "appears to have been tested in the real world," citing a 2014 paper which found 18 malicious Tor exit nodes located in Russia.

Each of those hostile Russian exit nodes used version 0.2.2.37 of Tor -- the same one described in these leaked files.

Cloud hosting provider iNSYNQ says it was hit with a ransomware attack that shut down its network and left customers unable to access their accounting data for the past three days. "Unfortunately for iNSYNQ, the company appears to be turning a deaf ear to the increasingly anxious cries from its users for more information about the incident," reports Krebs On Security." From the report: Gig Harbor, Wash.-based iNSYNQ specializes in providing cloud-based QuickBooks accounting software and services. In a statement posted to its status page, iNSYNQ said it experienced a ransomware attack on July 16, and took its network offline in a bid to contain the spread of the malware. "The attack impacted data belonging to certain iNSYNQ clients, rendering such data inaccessible,"; the company said. "As soon as iNSYNQ discovered the attack, iNSYNQ took steps to contain it. This included turning off some servers in the iNSYNQ environment." iNSYNQ said it has engaged outside cybersecurity assistance and to determine whether any customer data was accessed without authorization, but that so far it has no estimate for when those files might be available again to customers.

Dan Goodin, reporting for ArsTechnica: When we use browsers to make medical appointments, share tax returns with accountants, or access corporate intranets, we usually trust that the pages we access will remain private. DataSpii, a newly documented privacy issue in which millions of people's browsing histories have been collected and exposed, shows just how much about us is revealed when that assumption is turned on its head. DataSpii begins with browser extensions -- available mostly for Chrome but in more limited cases for Firefox as well -- that, by Google's account, had as many as 4.1 million users. These extensions collected the URLs, webpage titles, and in some cases the embedded hyperlinks of every page that the browser user visited. Most of these collected Web histories were then published by a fee-based service called Nacho Analytics, which markets itself as "God mode for the Internet" and uses the tag line "See Anyone's Analytics Account."

Web histories may not sound especially sensitive, but a subset of the published links led to pages that are not protected by passwords -- but only by a hard-to-guess sequence of characters (called tokens) included in the URL. Thus, the published links could allow viewers to access the content at these pages. (Security practitioners have long discouraged the publishing of sensitive information on pages that aren't password protected, but the practice remains widespread.) Further reading: More on DataSpii: How extensions hide their data grabs -- and how they're discovered.

A tiny and relatively unknown TLS library written in Rust, an up-and-coming programming language, outperformed the industry-standard OpenSSL in almost every major category. From a report: The findings are the result of a recent four-part series of benchmarks carried out by Joseph Birr-Pixton, the developer behind the Rustls library. The findings showed that Rustls was 10% faster when setting up and negotiating a new server connection, and between 20 and 40% faster when setting up a client connection. But while handshake speeds for new TLS connections are important, most TLS traffic relies on resuming previously negotiated handshakes. Here, too, Rustls outperformed the aging OpenSSL, being between 10 and 20% in resuming a connection on the server-side, and being between 30 and 70% quicker to resume a client connection. Furthermore, Rustls also fared better in sheer bulk performance -- or the speed at which data is transferred over the TLS connection. Birr-Pixton said Rustls could send data 15% faster than OpenSSL, and receive it 5% faster as well.

Artem S. Tashkinov writes: Starting Wednesday, July 17, 2019, the Kazakhstan government has started intercepting all HTTPS internet traffic inside its borders. Local internet service providers (ISPs) have been instructed by the local government to force their respective users into installing a government-issued certificate on all devices, and in every browser. The certificate, once installed, will allow local government agencies to decrypt users' HTTPS traffic, look at its content, encrypt it again with their certificate, and send it to its destination. Kazakh users trying to access the internet since yesterday have been redirected to web pages that contained instructions on how to install the government's root certificate in their respective browsers, may it be a desktop or mobile device.

By taking strings from an online gaming program and appending them to malicious files, researchers were able to trick Cylance's AI-based antivirus engine into thinking programs like WannaCry and other malware are benign. From a report: AI has been touted by some in the security community as the silver bullet in malware detection. Its proponents say it's superior to traditional antivirus since it can catch new variants and never-before-seen malware -- think zero-day exploits -- that are the Achilles heel of antivirus. One of its biggest proponents is the security firm BlackBerry Cylance, which has staked its business model on the artificial intelligence engine in its endpoint PROTECT detection system, which the company says has the ability to detect new malicious files two years before their authors even create them. But researchers in Australia say they've found a way to subvert the machine-learning algorithm in PROTECT and cause it to falsely tag already known malware as "goodware." The method doesn't involve altering the malicious code, as hackers generally do to evade detection. Instead, the researchers developed a "global bypass" method that works with almost any malware to fool the Cylance engine. It involves simply taking strings from a non-malicious file and appending them to a malicious one, tricking the system into thinking the malicious file is benign.

The benign strings they used came from an online gaming program, which they have declined to name publicly so that Cylance will have a chance to fix the problem before hackers exploit it. "As far as I know, this is a world-first, proven global attack on the ML [machine learning] mechanism of a security company," says Adi Ashkenazy, CEO of the Sydney-based company Skylight Cyber, who conducted the research with CTO Shahar Zini. "After around four years of super hype [about AI], I think this is a humbling example of how the approach provides a new attack surface that was not possible with legacy [antivirus software]."

The Israeli company whose spyware hacked WhatsApp has told buyers its technology can surreptitiously scrape all of an individual's data from the servers of Apple, Google, Facebook, Amazon and Microsoft, Financial Times reported on Friday. [Editor's note: the link may be paywalled; alternative source] From the report: NSO Group's flagship smartphone malware, nicknamed Pegasus, has for years been used by spy agencies and governments to harvest data from targeted individuals' smartphones. But it has now evolved to capture the much greater trove of information stored beyond the phone in the cloud, such as a full history of a target's location data, archived messages or photos, according to people who shared documents with the Financial Times and described a recent product demonstration. The documents raise difficult questions for Silicon Valley's technology giants, which are trusted by billions of users to keep critical personal information, corporate secrets and medical records safe from potential hackers. NSO denied promoting hacking or mass-surveillance tools for cloud services. However, it did not specifically deny that it had developed the capability described in the documents.

The database of Bulgaria's National Revenue Agency (NRA), which was hacked over the weekend and sent to local reporters, is now being shared on hacking forums, ZDNet has learned from sources in the threat intelligence community. From a report: Download links to the hacked database have been shared by a hacked data trader known as Instakilla, believed to be operating out of Bulgaria. ZDNet obtained a copy of the database and verified its authenticity with local sources, and this is a copy of the same database sent to local media over the weekend. The database contains 57 folders, 10.7 GB in size, and holds personal and financial information consistent with what Bulgarian newspapers reported receiving over the weekend. This includes personally identifiable information, tax information, from both the NRA, and from other government agencies who shared their data.

ZDNet: Slack published more details about a password reset operation that ZDNet reported earlier today. According to a statement the company published on its website, the password reset operation is related to the company's 2015 security breach. In March 2015, Slack said hackers gained access to some Slack infrastructure, including databases storing user credentials. Hackers stole hashed passwords, but they also planted code on the company's site to capture plaintext passwords that users entered when logging in. At the time, Slack reset passwords for users who it believed were impacted, and also added support for two-factor authentication for all accounts. But as ZDNet reported earlier today, the company recently received a batch of Slack users credentials, which prompted the company to start an investigation into its source and prepare a password reset procedure. "We immediately confirmed that a portion of the email addresses and password combinations were valid, reset those passwords, and explained our actions to the affected users," Slack said. In a message on its website, Slack said this batch of credentials came via its bug bounty program. The company said it initially believed the data came from users who had their PCs infected with malware, or users who reused passwords across different services.

Uber passengers in multiple cities were startled Wednesday when they were charged 100 times the advertised fare for short trips, a glitch that sparked jokes about surge pricing gone wild. From a report: Riders in cities including Washington and San Diego took to social media to post about the sky-high rates, a problem that Uber confirmed, although it declined to say how widespread the issue was. Some who ordered food for quick delivery said they were also overcharged. One social media user reported that Uber maxed out her husband's card with a charge of $1,905, when it was supposed to be $19.05. "Not cool, especially on his birthday," she added. Another woman posted to social media that she was charged $1,308 for a $13.08 trip. The charge was so high it triggered a fraud alert, according to a screen shot the rider posted on Twitter.

Uber said the glitch has been fixed. The company said the fare would be corrected so riders are charged only the amount for their actual trip, though they may temporarily see an inaccurate trip fare on their credit or debit cards. Passengers won't need to dispute the charges with their banks.

Todd Austin, a professor at the University of Michigan, is working on an approach known as Morpheus that aims to frustrate hackers trying to gain control of microchips by presenting them with a rapidly changing target. At a conference in Detroit this week organized by the U.S. Defense Department's Defense Advanced Research Projects Agency (DARPA), Austin described how the prototype Morpheus chip works. MIT Technology Review reports: The aim is to make it incredibly difficult for hackers to exploit key software that helps govern the chip's operation. Morpheus does this by repeatedly randomizing elements of the code that attackers need access to in order to compromise the hardware. This can be achieved without disrupting the software applications that are powered by the processor. Austin has been able to get the chip's code "churning" to happen once every 50 milliseconds -- way faster than needed to frustrate the most powerful automated hacking tools. So even if hackers find a vulnerability, the information needed to exploit it disappears in the blink of an eye.

There's a cost to all this: the technology causes a slight drop in performance and requires somewhat bigger chips. The military may accept this trade-off in return for greater security on the battlefield, but it could limit Morpheus's appeal to businesses and consumers. Austin said a prototype has already resisted every known variant of a widely-used hacking technique known as a control-flow attack, which does things like tampering with the way a processor handles memory in order to allow hackers to sneak in malware. More tests lie ahead. A team of U.S. national security experts will soon begin probing the prototype chip to see if they can compromise its defenses, and Austin also plans to post some of Morpheus's code online so that other researchers can try to find flaws in it, too.