An anonymous reader quotes a report from Fast Company: We've all tried to log into a website or submit a form only to be stuck clicking boxes of traffic lights or storefronts or bridges in a desperate attempt to finally convince the computer that we're not actually a bot. For many years, this has been one of the predominant ways that reCaptcha -- the Google-run internet bot detector -- has determined whether a user is a bot or not. But last fall, Google launched a new version of the tool, with the goal of eliminating that annoying user experience entirely. Now, when you enter a form on a website that's using reCaptcha V3, you won't see the "I'm not a robot" checkbox, nor will you have to prove you know what a cat looks like. Instead, you won't see anything at all.

Google is also now testing an enterprise version of reCaptcha v3, where Google creates a customized reCaptcha for enterprises that are looking for more granular data about users' risk levels to protect their site algorithms from malicious users and bots. But this new, risk-score based system comes with a serious trade-off: users' privacy. According to two security researchers who've studied reCaptcha, one of the ways that Google determines whether you're a malicious user or not is whether you already have a Google cookie installed on your browser. It's the same cookie that allows you to open new tabs in your browser and not have to re-log in to your Google account every time. But according to Mohamed Akrout, a computer science PhD student at the University of Toronto who has studied reCaptcha, it appears that Google is also using its cookies to determine whether someone is a human in reCaptcha v3 tests. Akrout wrote in an April paper about how reCaptcha v3 simulations that ran on a browser with a connected Google account received lower risk scores than browsers without a connected Google account. "Because reCaptcha v3 is likely to be on every page of a website, if you're signed into your Google account there's a chance Google is getting data about every single webpage you go to that is embedded with reCaptcha v3 -- and there many be no visual indication on the site that it's happening, beyond a small reCaptcha logo hidden in the corner," the report adds.

A reader shares a report: There have been some bugs and issues with Microsoft's Windows 10 May Update/1903 feature update since Microsoft kicked off its rollout in late May. But the 1903 complaint I've gotten most often (so far) is from users who want to install the update but can't and don't know why. Microsoft has added a new notification which some users whose devices aren't ready or able to install the update are seeing when they attempt to proactively grab the 1903 release. As originally noted last week by Windows Latest, Microsoft has added a new message to its Windows Update page. Users attempting to install 1903 on machines with out-of-date drivers or other issues are seeing this message:

"The Windows 10 May 2019 Update is on its way. We're offering this update to compatible devices, but your device isn't ready for it. Once your device is ready, you'll see the update available on this page. There's nothing you need to do at this time." I confirmed with Microsoft that this notification is part of its 1903 rollout strategy. "The notification started with the latest changes made to improve the quality/transparency of the Windows update process," according to a Microsoft spokesperson. Microsoft officials said in a blog post on May 21 that the company planned to start automatically updating devices running the April 2018 Update and earlier versions of Windows 10 to Windows 10 1903. Last week, via the Windows Update account on Twitter, Microsoft officials communicated that they were building and training machine-learning rollout processes that would enable this to happen.

Hackers working for Western intelligence agencies broke into Russian internet search company Yandex in late 2018 deploying a rare type of malware in an attempt to spy on user accounts, Reuters reported Thursday, citing four people with knowledge of the matter. From the report: The malware, called Regin, is known to be used by the "Five Eyes" intelligence-sharing alliance of the United States, Britain, Australia, New Zealand and Canada, the sources said. Intelligence agencies in those countries declined to comment. Western cyberattacks against Russia are seldom acknowledged or spoken about in public. It could not be determined which of the five countries was behind the attack on Yandex, said sources in Russia and elsewhere, three of whom had direct knowledge of the hack. The breach took place between October and November 2018.

Yandex spokesman Ilya Grabovsky acknowledged the incident in a statement to Reuters, but declined to provide further details. "This particular attack was detected at a very early stage by the Yandex security team. It was fully neutralized before any damage was done," he said.

India may have plans to follow France's footsteps in building a chat app and requiring government employees to use it for official communications. From a report: The New Delhi government is said to be pondering about the need to have homegrown email and chat apps, local news outlet Economic Times reported on Thursday. The rationale behind the move is to cut reliance on foreign entities, the report said, a concern that has somehow manifested amid U.S.'s ongoing tussle with Huawei and China. "We need to make our communication insular," an unnamed top government official was quoted as saying by the paper. The person suggested that by putting Chinese giant Huawei on the entity list, the U.S. has "set alarm bells ringing in New Delhi." India has its own ongoing trade tension with the U.S. Donald Trump earlier this month removed the South Asian nation from a special trade program after India did not assure him that it "unfortunate," and weeks later, increased tariffs on some U.S. exports.

After an emergency alert was accidentally sent to Hawaii residents last year, warning of an impending nuclear ballistic missile attack, researchers at the University of Colorado Boulder were prompted to ask the question: How easy would it be to exploit the nation's emergency alert systems, wreaking havoc on the American public via fake or misleading alerts? In short, they found that it wasn't very difficult at all. Motherboard reports: Their full study was recently unveiled at the 2019 International Conference on Mobile Systems, Applications and Services (MobiSys) in Seoul, South Korea. It documents how spoofing the Wireless Emergency Alert (WEA) program to trick cellular users wasn't all that difficult. To prove it, researchers built a mini "pirate" cell tower using easily-available hardware and open source software. Using isolated RF shield boxes to mitigate any real-world harm, they then simulated attacks in the 50,000 seat Folsom Field at the University. 90 percent of the time, the researchers say they were able to pass bogus alerts on to cell phones within range. The transmission of these messages from the government to the cellular tower is secure. It's the transmission from the cellular tower to the end user that's open to manipulation and interference, the researchers found. The vulnerability potentially impacts not just US LTE networks, but LTE networks from Europe to South Korea.

Less than a week after a first Florida city agreed to pay a whopping $600,000 to get their data back from hackers, now, a second city's administration has taken the same path. On Monday, in an emergency meeting of the city council, the administration of Lake City, a small Florida city with a population of 65,000, voted to pay a ransom demand of 42 bitcoins, worth nearly $500,000. ZDNet reports: The decision to pay the ransom demand was made after the city suffered a catastrophic malware infection earlier this month, on June 10, which the city described as a "triple threat." Despite the city's IT staff disconnecting impacted systems within ten minutes of detecting the attack, a ransomware strain infected almost all its computer systems, with the exception of the police and fire departments, which ran on a separate network.

A ransom demand was made a week after the infection, with hackers reaching out to the city's insurance provider -- the League of Cities, which negotiated a ransom payment of 42 bitcoins last week. City officials agreed to pay the ransom demand on Monday, and the insurer made the payment yesterday, on Tuesday, June 25, local media reported. The payment is estimated to have been worth between $480,000 to $500,000, depending on Bitcoin's price at the time of the payment. The city's IT staff is now working to recover their data after receiving a decryption key.

Speaking of Google, the company is sending out warnings to Microsoft SwiftKey users that the keyboard will no longer be able to access the data in Google Accounts, including Gmail content, starting on July 15th. From a report: In an email, Google is telling SwiftKey users who have integrated the keyboard replacement with Gmail that the integration will no longer work on July 15th, 2019, unless SwiftKey complies with Google's updated data policies. When users install SwiftKey, they can personalize the keyboard by integrating it into email accounts such as Gmail. When integrating in other services, though, the app requests various permissions in how they can access the content in this service.

Security through obscurity is out, security through tomfoolery is in. From a report: That's the basic philosophy sold by Track THIS, "a new kind of incognito" browsing project, which opens up 100 tabs crafted to fit a specific character -- a hypebeast, a filthy rich person, a doomsday prepper, or an influencer. The idea is that your browsing history will be depersonalized and poisoned, so advertisers won't know how to target ads to you. It was developed as a collaboration between mschf (pronounced "mischief") internet studios and Mozilla's Firefox as a way of promoting Firefox Quantum, the newest Firefox browser. [...] Just a warning -- if you use Track THIS it may take several minutes for all 100 tabs to load. (I used Chrome as my browser.) But when as it gradually loads, it's like taking a first-person journey through someone else's consciousness.

Intel is working with rival Arm to create a new industry standard for an important issue in the Internet of Things market: making sure that devices are properly configured and connected to the cloud. From a report: The Santa Clara, Calif.-based chipmaker announced on Wednesday that the company is a founding member of the new IoT Technical Working Group within the FIDO Alliance, an industry consortium founded by PayPal, Lenovo and others in 2012 to develop standards for password-less authentication. The goal of FIDO's IoT Technical Working Group, which will also include experts from Microsoft, Google and Amazon, is to create a standard specification for "large-scale IoT onboarding," the process in which devices are configured and connected to IoT cloud management services at the time of installation. Lorie Wigle, the executive in charge of Intel's platform security efforts, told CRN that it is important to create a standard around IoT onboarding because many companies currently face challenges with the practice when it comes to handling large-scale deployments and security. [...] Once FIDO develops the standard, market forces will compel companies to adhere and participate, according to Wigle, who said it will also increase device variety, lower costs and accelerate deployments.

The invasion exploited weaknesses in those companies, their customers, and the Western system of technological defense, Reuters reported on Wednesday. From the report: Hacked by suspected Chinese cyber spies five times from 2014 to 2017, security staff at Swedish telecoms equipment giant Ericsson had taken to naming their response efforts after different types of wine. Pinot Noir began in September 2016. After successfully repelling a wave of attacks a year earlier, Ericsson discovered the intruders were back. And this time, the company's cybersecurity team could see exactly how they got in: through a connection to information-technology services supplier Hewlett Packard Enterprise. Teams of hackers connected to the Chinese Ministry of State Security had penetrated HPE's cloud computing service and used it as a launchpad to attack customers, plundering reams of corporate and government secrets for years in what U.S. prosecutors say was an effort to boost Chinese economic interests.

The hacking campaign, known as "Cloud Hopper," was the subject of a U.S. indictment in December that accused two Chinese nationals of identity theft and fraud. Prosecutors described an elaborate operation that victimized multiple Western companies but stopped short of naming them. A Reuters report at the time identified two: Hewlett Packard Enterprise and IBM. Yet the campaign ensnared at least six more major technology firms, touching five of the world's 10 biggest tech service providers. Also compromised by Cloud Hopper, Reuters has found: Fujitsu, Tata Consultancy Services, NTT Data, Dimension Data, Computer Sciences Corporation and DXC Technology. HPE spun-off its services arm in a merger with Computer Sciences Corporation in 2017 to create DXC.

Telecommunications gear made by China's Huawei is far more likely to contain flaws that could be leveraged by hackers for malicious use than equipment from rival companies, according to new research by cybersecurity experts that top U.S. officials said appeared credible. From a report: Over half of the nearly 10,000 firmware images encoded into more than 500 variations of enterprise network-equipment devices tested by the researchers contained at least one such exploitable vulnerability, the researchers found. Firmware is the software that powers the hardware components of a computer. The tests were compiled in a new report that has been submitted in recent weeks to senior officials in multiple government agencies in the U.S. and the U.K., as well as to lawmakers. The report is notable both for its findings and because it is circulating widely among Trump administration officials who said it further validated their policy decisions toward Huawei.

"This report supports our assessment that since 2009, Huawei has maintained covert access to some of the systems it has installed for international customers," said a White House official who reviewed the findings. "Huawei does not disclose this covert access to customers nor local governments. This covert access enables Huawei to record information and modify databases on those local systems." The report, reviewed by The Wall Street Journal, was prepared by Finite State, a Columbus, Ohio-based cybersecurity firm.

A new strain of malware is wiping the firmware of IoT devices in attacks reminiscent of the old BrickerBot malware that destroyed millions of devices back in 2017. From a report: Named Silex, this malware began operating earlier today, about three-four hours before this article's publication. The malware had bricked around 350 devices when this reporter began investigating its operations, and the number quickly spiked to 2,000 wiped devices by the time we published, an hour later. Attacks are still ongoing, and according to an interview with the malware's creator, they are about to intensify in the coming days. According to Akamai researcher Larry Cashdollar, who first spotted the malware earlier today, Silex works by trashing an IoT device's storage, dropping firewall rules, removing the network configuration, and then halting the device. It's as destructive as it can get without actually frying the IoT device's circuits. To recover, victims must manually reinstall the device's firmware, a task too complicated for the majority of device owners.

Hackers broke into the systems of more than a dozen global telecom firms and stole huge amounts of data in a seven-year spying campaign, researchers from a cyber security company said, identifying links to previous Chinese cyber-espionage activities. From a report: Investigators at U.S.-Israeli cyber firm Cybereason said on Tuesday the attackers compromised companies in more than 30 countries and aimed to gather information on individuals in government, law-enforcement and politics. The hackers also used tools linked to other attacks attributed to Beijing by the United States and its Western allies, said Lior Div, chief executive of Cybereason. "For this level of sophistication it's not a criminal group. It is a government that has capabilities that can do this kind of attack," he told Reuters. Div later presented a step-by-step breakdown of the breach at a cybersecurity conference in Tel Aviv in the same session that the heads of U.S. and British cyber intelligence units and the head of Israel's Mossad spy agency spoke.

During the social network's heyday, multiple Myspace employees abused an internal company tool to spy on users, in some cases including ex-partners, Motherboard reported on Monday. From the report: Named 'Overlord,' the tool allowed employees to see users' passwords and their messages, two former employees said. While the tool was originally designed to help moderate the platform and allow MySpace to comply with law enforcement requests, multiple sources said the tool was used for illegitimate purposes by employees who accessed Myspace user data without authorization to do so. "It was basically an entire backdoor to the Myspace platform," one of the former employees said of Overlord. (Motherboard granted five former Myspace employees anonymity to discuss internal Myspace incidents.) The abuse happened about a decade ago, closer to the height of the platform's popularity, according to multiple sources. In fall 2006, the platform signed up its 100 millionth user. Around this time, Myspace was the second most popular website in the U.S., and ranked higher than Google search. Further reading: MySpace Has Reportedly Lost All Photos, Videos and Songs Uploaded Over 12 Years Due To Data Corruption During a Server Migration Project (March, 2019).

The US has responded to a recent rise in Iranian cyber-activity and the shooting of an unarmed drone last week by launching cyber-attacks against Iran's military IT systems. From a report: The cyber-attacks were carried out by US Cyber Command with the direct approval of US President Donald Trump, the Associated Press reported on Sunday, citing two inside sources, and confirming the report through a third Pentagon official. US Cyber Command targeted the Iran military's computer systems used to control some of the country's rocket and missile launchers. The systems are managed by Iran's Islamic Revolutionary Guard Corps (IRGC), a branch of Iran's Armed Forces, which the US Presidency designated as a terrorist organization last year. The AP reported that the US cyber-attacks were the second go-to measure after President Trump backed off from launching a military strike against Iranian military and radar bases last week, on Thursday.

You can now download a preview version of the new Windows Terminal app from the Store on Windows 10. From a report: Microsoft released this application on the evening of June 21 after a listing showed up earlier that day. After downloading the Windows Terminal app from the Store, you can take advantage of all the new features-- including tabs, finally! You can combine tabs from the traditional Command Prompt, Linux Bash instances, and PowerShell in the same window. It's a deeply customizable environment, too.

Apple today seeded the first beta versions of upcoming macOS Catalina update, iOS 13 update, and iPadOS update to its public beta testing group, giving non-developers a chance to try out the software ahead of their fall public release. Beta testers who have signed up for Apple's beta testing program will be able to download the macOS Catalina beta through the Software Update mechanism in System Preferences after installing the proper profile. Those who want to be a part of Apple's beta testing program can sign up to participate through the beta testing website, which gives users access to iOS, macOS, and tvOS betas. Similarly, beta testers who have signed up for Apple's beta testing program will receive the iOS 13 beta update over-the-air after installing the proper certificate on an iOS device. New features in macOS Catalina update includes: macOS Catalina eliminates the iTunes app, which has been a key Mac feature since 2001. In Catalina, iTunes has been replaced by Music, Podcasts, and TV apps. The new apps can do everything that iTunes can do, so Mac users aren't going to be losing any functionality, and device management capabilities are now handled by the Finder app. macOS Catalina has a useful new Sidecar feature, designed to turn the iPad into a secondary display for the Mac. For those with an Apple Watch set up to unlock the Mac, there's now an option to approve security prompts in Catalina by tapping on the side button of the watch. Macs with a T2 chip in them also support Activation Lock, making them useless to thieves much as it does on the iPhone. There's a new Find My app that lets you track your lost devices, and previously, this functionality was only available via iCloud on the Mac. There's even a new option to find your devices even when they're offline by leveraging Bluetooth connections to other nearby devices, something that's particularly handy on the Mac because it doesn't have a cellular connection. For developers, a "Project Catalyst" feature lets apps designed for the iPad be ported over to the Mac with just a few clicks in Xcode and some minor tweaks. Apple's ultimate goal with Project Catalyst is to bring more apps to the Mac.

A major telephone outage hit the Netherlands on Monday, taking down the country's emergency number and leaving many businesses and municipalities unreachable by phone. From a report: Police sent officers onto the streets so that people could approach them for emergency help and issued an alternative emergency phone number an hour after the outage began around 4 p.m. (1400 GMT). "We're appealing to everybody who wants to report an emergency and needs help to ... go onto the street. Police officers with walkie-talkies are taking to the streets as much as possible so they can be spoken to," police spokeswoman Suzanne van de Graaf told national broadcaster NOS. Telecom provider KPN reported on its website that the nationwide outage affected both landlines and mobile services. It said work was underway to find a solution.

An anonymous reader shares a report: While plugging plug a mouse, a phone, or a thumb drive into your computer, you try to stick the USB into its slot, only to find it stopping prematurely. You flip it around, but it still won't go in. So you flip it back to the original position and it slides in without a hitch. We've all been there, and the inventor of the USB sees our pain. Ajay Bhatt, the leader behind the IBM team that gave us the USB in the mid-'90s, revealed in an interview with NPR Friday that he is well aware of the annoyances the public has with USB, or Universal Serial Bus, but there's a reason it's designed the way it is.

"The biggest annoyance is reversibility," Bhatt told NPR. For outsiders, it seems like designing the USB so it can be reversible would be an easy fix to everyone's problems, so no matter which way you stick it in it's a success. Bhatt told NPR that would have doubled the cost of the technology, requiring double the wires and circuits. Another option that the Intel team floated was a round design, but that would have been even more difficult to plug in correctly. Although the rectangle design we all know was ultimately chosen and adopted by pretty much every hardware manufacturer since Apple first put USB ports into its computers in 1998, Bhatt acknowledges that there may have been a better way. "In hindsight, based on all the experiences that we all had, of course it was not as easy as it should be," Bhatt said.

theodp writes: Amazon Future Engineer students across the country are graduating from high school," reports the Amazon Day One blog, "and to celebrate, Amazonians visited select classrooms to meet some of the students and to check out their impressive computer science progress and end of year projects [TV coverage of an 'Amazon graduation'].

Amazon Future Engineer "is a four-part, childhood-to-career program aimed at inspiring and educating 10 million students from underrepresented and underserved communities each year to try computer science and coding. Amazon strives to achieve this by inspiring millions of children through coding camps and Code.org's Hour of Code program, funding computer science courses in high schools across the country, providing 100 students with four-year college scholarships in computer science, and offering Amazon internships to scholarship recipients."

The importance of CS education to Amazon is highlighted in a new Washingtonian story, The Real Story of How Virginia Won Amazon's HQ2, which reports, "Northern Virginia's ultimate proposal was centered around an effort to provide Amazon -- or any other tech firm that wanted to come -- with all the educated workers it needed, now and in the future. [Virginia Economic Development Partnership CEO Stephen] Moret's team proposed increasing tech education from kindergarten through 12th grade, expanding university offerings to produce up to 17,500 new bachelor's degrees in computer science and related fields, and building a tech campus that could produce the same number of master's degrees."

And in a recent Brookings Institution fireside chat, Moret noted, "we analyzed substantially all of the LinkedIn profiles of HQ1 — the Seattle workforce... And if you look at the tech occupations — that was the space they were the most concerned about — literally half of all the people at Amazon Seattle headquarters that are working in some kind of tech occupation, half of them have at least one degree in computer science. So, that was a really big data point for us; and that really shaped a lot of how we built our package.