Science

'Useless Specks of Dust' Turn Out To Be Building Blocks of All Vertebrate Genomes (sciencealert.com) 30

An anonymous reader quotes a report from ScienceAlert: Originally, they were thought to be just specks of dust on a microscope slide. Now, a new study suggests that microchromosomes -- a type of tiny chromosome found in birds and reptiles -- have a longer history, and a bigger role to play in mammals than we ever suspected. By lining up the DNA sequence of microchromosomes across many different species, researchers have been able to show the consistency of these DNA molecules across bird and reptile families, a consistency that stretches back hundreds of millions of years. What's more, the team found that these bits of genetic code have been scrambled and placed on larger chromosomes in marsupial and placental mammals, including humans. In other words, the human genome isn't quite as 'normal' as previously supposed.

By tracing these microchromosomes back to the ancient Amphioxus, the scientists were able to establish genetic links to all of its descendants. These tiny 'specks of dust' are actually important building blocks for vertebrates, not just abnormal extras. It seems that most mammals have absorbed and jumbled up their microchromosomes as they've evolved, making them seem like normal pieces of DNA. The exception is the platypus, which has several chromosome sections line up with microchromosomes, suggesting that this method may well have acted as a 'stepping stone' for other mammals in this regard, according to the researchers. A tree chart outlining the presence of similar DNA in snakes, lizards, birds, crocodiles, and mammals. The study also revealed that as well as being similar across numerous species, the microchromosomes were also located in the same place inside cells.
"It's not clear whether there's an evolutionary benefit to coding DNA in larger chromosomes or in microchromosomes, and the findings outlined in this paper might help scientists put that particular debate to rest -- although a lot of questions remain," adds ScienceAlert. "The study suggests that the large chromosome approach that has evolved in mammals isn't actually the normal state, and might be a disadvantage: genes are packed together much more tightly in microchromosomes, for example."

The findings have been published in the journal PNAS.
Microsoft

Microsoft Loop is a Notion Clone for Office Lovers (fastcompany.com) 28

Microsoft isn't standing still as other companies try to reinvent the document editor. From a report: On Tuesday, the company announced Microsoft Loop, a new Office app that takes clear inspiration from online collaborative editors, such as Notion and Coda. There's a sidebar for toggling between pages, interactive elements including charts and task lists, and the ability to move parts of a document around by dragging and dropping. But while those other editors want to eliminate Office files entirely, Microsoft acknowledges their persistence by integrating them with Loop. Users can add links to traditional Word, Excel, and PowerPoint documents, and they'll appear in the sidebar and as stylized thumbnails inside of Loop pages. The idea, self-serving as it may be for Microsoft, is that you might still want to create distinct document files that live alongside Loop's free-flowing pages.

In a blog post, Microsoft 365 General Manager Wangui McKelvey acknowledged that people are looking beyond the confines of Office for their document-editing needs as the world moves to remote and hybrid work. "New kinds of content, formats, and channels demanded more flexible, powerful, and fluid tools to allow everyone to deliver a more impactful message and collaborate at their own pace," McKelvey wrote. "So, Microsoft Office is changing with the times." Microsoft isn't the only one rethinking its approach to the document editor as tools like Notion gain traction. Google is adding similar concepts to Google Docs, including interactive checklists and quick linking to other documents via an @ symbol.

Technology

Nigeria's eNaira Digital Currency Had an Embarrassing First Week (qz.com) 20

The eNaira is supposed to live within a mobile wallet, have the same value and be interchangeable with the physical naira for everyday transactions. Nigerians believe the eNaira, which is governed by a centralized blockchain, is part of the central bank's drive to discourage cryptocurrencies' popularity among Nigeria's youth, just like China's effort with the digital yuan. From a report: And so last week, Nigeria's central bank made two types of eNaira wallets available on Google and Apple stores: one for individuals, and another for merchants. But some users say parts of the wallet for individuals have not worked properly. Fisayo Fosudo, a Nigerian YouTuber who reviews gadgets and apps, said he and three friends initially got error messages that the eNaira app could not match their emails to their bank verification numbers. He would later register successfully but found broken links that did not lead to helpful support pages on the central bank's website. "Was really looking forward to reviewing the eNaira app but it's been hard to get it to work seamlessly. We wait," Fosudo said. After many users left poor reviews for the Android version of the eNaira app for individuals, it was taken down. It had been downloaded 100,000 times before that. The Apple Store version remained available at press time.
Twitter

Twitter Algorithms Amplify Right-leaning Political Content More Than Left-leaning, Company Says Citing Own Research (protocol.com) 137

Twitter is publicly sharing research findings today that show that the platform's algorithms amplify tweets from right-wing politicians and content from right-leaning news outlets more than people and content from the political left. From a report: The research did not identify whether or not the algorithms that run Twitter's Home feed are actually biased toward conservative political content, because the conclusions only show bias in amplification, not what caused it. Rumman Chowdhury, the head of Twitter's machine learning, ethics, transparency and accountability team, called it "the what, not the why" in an interview with Protocol. "We can see that it is happening. We are not entirely sure why it is happening. To be clear, some of it could be user-driven, people's actions on the platform, we are not sure what it is. It's just important that we share this information," Chowdhury said. The META team plans to conduct what she called a "root-cause analysis" to try to discover the "why," and that analysis will likely include creating testable hypotheses about how people use the platform that could help show whether it's the way users interact with Twitter or the algorithm itself that is causing this uneven amplification. Twitter didn't define for itself what news outlets and politicians are "right-leaning" or belong to right-wing political parties, instead using definitions from other researchers outside the company. The study looked at millions of tweets from politicians across seven countries and hundreds of millions of tweets of links from news outlets, not tweets from the outlets themselves.
Government

New FCC Rules Could Force Wireless Carriers To Block Spam Texts (engadget.com) 45

An anonymous reader quotes a report from Engadget: Under Acting Chairwoman Jessica Rosenworcel, the Federal Communications Commission is seeking to create new rules targeting spam text messages. Like another recent proposed rulemaking from the agency, the policy would push wireless carriers and telephone companies to block the spam before it ever gets to your phone.

"We've seen a rise in scammers trying to take advantage of our trust of text messages by sending bogus robotexts that try to trick consumers to share sensitive information or click on malicious links," Rosenworcel said. "It's time we take steps to confront this latest wave of fraud and identify how mobile carriers can block these automated messages before they have the opportunity to cause any harm."

PlayStation (Games)

PS5 Console Plate Makers Provoke Sony, Then Hit Legal Trouble (kotaku.com) 50

Earlier this year, device skin maker Dbrand released a set of black PS5 faceplates and baited Sony to sue them (because that's their shtick -- to come across sassy and harsh). Sony is now obliging. Kotaku reports: As The Verge reports, Dbrand's "Darkplates" have recently been removed from the company's store, and any purchasing links now redirect to a page that only lists all the news articles written about the plates, including [a Gizmodo story]. Why pull them now? Because the company received a cease & desist letter from Sony, part of which says: "It has come to SIE's attention that dbrand has been promoting and selling console accessories in a manner that is deeply concerning to our client. First, dbrand is selling faceplates for the PSS console (in both standard edition and digital edition configurations) that replicate SIE's protected product design. Any faceplates that take the form of our client's PSS product configuration, or any similar configuration, and are: produced and sold without permission from SIE violate our client's intellectual property rights in the distinctive console design. Second, dbrand is selling skins for SIE devices that feature the PlayStation Family Mark Your company may not sell products that bear unauthorized depictions of our client's PlayStation Marks. The below still from one of dbrand's instructional videos shows a dbrand skin bearing a design identical to the PlayStation Family Mark."

For their part, Dbrand have responded with a rambling corporate shitpost on Reddit, which opens with "much like your hopes and dreams, Darkplates are dead" before eventually settling into actual legal defenses of their position, saying the plates don't violate any existing trademarks. Dbrand suspects that Sony's actual motivation here is moving to shut down competitors before revealing its own, first-party replacement panels for the PS5.

Businesses

A New Credit Card Arrives -- With a Silicon Valley Twist (wired.com) 124

An anonymous reader shares a Wired report: When Deepak Rao founded his first startup, in 2011, he put all of his business expenses on two personal credit cards, with a combined credit limit of about $3,000. "They were totally maxed out all the time," he says. "To this date, my credit score has never recovered." Even after four years of working at Twitter with a product manager's salary, Rao still couldn't qualify for credit cards with the kinds of perks he wanted: ones that paid for vacations, or gave him points at the places he liked to shop. With his second startup, Rao is trying to solve that problem. The X1, a new credit card, is designed for people who want premium perks -- with or without premium credit scores. It uses a novel underwriting process, which links with a user's bank account to determine credit limits based on cash flow. The card promises up to five times higher credit limits than the average card.

The card itself is made of stainless steel -- the kind of objet d'art that's advertised as making a pleasant clang when you drop it -- but it's meant to be used digitally, like the Apple Card. It has a sleek app that gives users the ability to create disposable "virtual" cards, cancel subscriptions with one click, and make anonymous transactions without giving out a real name or card number. Its points are redeemable at a list of merchants frequented by the stereotypical tech bro: Peloton, Patagonia, Allbirds, and Airbnb. Perhaps for that reason, the X1 has become something of a Silicon Valley darling, with a waitlist of more than 350,000 people, the startup says. Its investors include Affirm CEO Max Levchin, Box CEO Aaron Levie, and Yelp CEO Jeremy Stoppelman. "I think of it as Silicon Valley's answer to American Express, which is really for the old guard at this point," says David Sacks, the venture capitalist and PayPal alumnus, who sits on the X1's board and uses the card himself.

Microsoft

Security Threat Analyst Accuses Microsoft of Hosting Malware on Office365's OneDrive (itwire.com) 52

Slashdot reader juul_advocate quotes ITWire: A British tech researcher, who quit working as a security threat analyst with Microsoft a few months back, has called on his former employer to act speedily to remove links to ransomware on its Office365 platform. In a tweet sent on Friday, Beaumont said: "Microsoft cannot advertise themselves as the security leader with 8,000 security employees and trillions of signals if they cannot prevent their own Office365 platform being directly used to launch Conti ransomware. OneDrive abuse has been going on for years. Fix it...."

An overwhelming majority of ransomware attacks only Windows, with an analysis by staff of the Google-owned VirusTotal database last Thursday showing that 95% of 80 million samples analysed — all the way back to January 2020 — were aimed at Windows... Beaumont, who has a well-earned reputation as a researcher who is quick to admit faults in his own industry, acknowledged that other technology companies also played a big role in hosting malware. Quoting a tweet from a Swiss researcher [given below], he said: "And yes, it's not just Microsoft. Tech companies have got to do better."

Facebook

Facebook, Instagram, WhatsApp, and Oculus Have Been Suffering Global Outage For More Than 3 Hours Now [Update] (arstechnica.com) 252

Facebook -- and all the major services that Facebook owns -- are down today. ArsTechnica: We first noticed the problem at about 11:30 am Eastern time, when some Facebook links stopped working. Investigating a bit further showed major DNS failures at Facebook: "Google anycast DNS returns SERVFAIL for Facebook queries; querying http://a.ns.facebook.com directly times out."

The problem goes deeper than Facebook's obvious DNS failures, though. Facebook-owned Instagram was also down, and its DNS services -- which are hosted on Amazon rather than being internal to Facebook's own network -- were functional. Instagram and WhatsApp were reachable but showed HTTP 503 (no server is available for the request) failures instead, an indication that while DNS worked and the services' load balancers were reachable, the application servers that should be feeding the load balancers were not. A bit later, Cloudflare VP Dane Knecht reported that all BGP routes for Facebook had been pulled. With no BGP routes into Facebook's network, Facebook's own DNS servers would be unreachable -- as would the missing application servers for Facebook-owned Instagram, WhatsApp, and Oculus VR.
UPDATE 10/4/2021 22:15 UTC: Facebook is coming back online after a six-hour outage due to DNS routing problems.

"Inside Facebook, the outage broke internal systems as well, leaving employees unable to get into offices and communicate easily with each other," reports The Verge. "Some told The Verge they were using work-provided Outlook email accounts, allowing Facebook workers to email each other but unable to send or receive emails from external addresses."

Not only was it a rough day for Facebook and their stockholders, but it was especially hard on CEO Mark Zuckerberg. According to Bloomberg, Zuckerberg's personal wealth has fallen by more than $6 billion in just a few hours.
Encryption

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension (therecord.media) 48

The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development.

No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever.

Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections.

From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode.

With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition.

The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."
Youtube

Discord Starts Testing YouTube Integration (theverge.com) 16

An anonymous reader quotes a report from The Verge: Discord is starting to test YouTube integration, just weeks after Google-owned YouTube forced two popular Discord music bots offline. YouTube integration has started appearing in a small number of Discord servers today as part of what appears to be a new test of a collaboration between Discord and YouTube. The feature is called Watch Together, and as the name implies, it allows Discord members to watch YouTube videos together. A test of a similar Discord feature started 10 months ago before disappearing and resurfacing as Watch Together today, and we understand the company has re-prioritized this particular feature due to the recent music bot shutdowns.

Watch Together is very similar to the experience of someone broadcasting their screen in Discord, and the button to launch it even appears alongside the video and screen sharing options. It's designed specifically with YouTube in mind, allowing Discord server members to create a playlist of YouTube videos by searching or pasting in YouTube links. You can even toggle a remote button that lets other Discord server members share the ability to control playback. While it's not identical to the popular Rythm and Groovy Discord music bots, you can use Watch Together to listen to music through YouTube in Discord. You may end up hearing or seeing ads, though. Discord warns, when you first use the Watch Together feature, that "you may see ads during YouTube videos." [...] If you're interested in testing the feature, it's currently live in Discord's Game Labs server.

China

China Tells Its Tech Giants To Stop Blocking Rivals' Links (usnews.com) 27

"China fired a fresh regulatory shot at its tech giants on Monday," writes Reuters, "telling them to end a long-standing practice of blocking each other's links on their sites or face consequences." The comments, made by the Ministry of Industry and Information Technology (MIIT) at a news briefing, mark the latest step in Beijing's broad regulatory crackdown that has ensnared sectors from technology to education and property and wiped billions of dollars off the market value of some of the country's largest companies.

China's internet is dominated by a handful of technology giants which have historically blocked links and services by rivals on their platforms. Restricting normal access to internet links without proper reason "affects the user experience, damages the rights of users and disrupts market order," said MIIT spokesperson Zhao Zhiguo, adding that the ministry had received reports and complaints from users since it launched a review of industry practices in July. "At present we are guiding relevant companies to carry out self-examination and rectification," he said, citing instant messaging platforms as one of the first areas they were targeting.

He did not specify what the consequences would be for companies that failed to abide by the new guidelines.

China

Tencent Opens WeChat To Rivals' Links as App Walls Crumble (bloomberg.com) 11

Tencent allowed users of its main WeChat social media service to link to rivals' content for the first time in years, taking initial steps to comply with Beijing's call to dismantle walls around platforms run by the country's online giants. From a report: From Friday, users who upgrade to the latest version of the messaging service can access external services such as Alibaba's Taobao online mall or ByteDance's video app Douyin, both of which were previously walled off from WeChat's billion-plus members. That applies however only to one-on-one messaging, not group chats nor Facebook-like Moments pages.

While it's unclear whether the social giant has opened up more of its scores of online services, it's a major step for Tencent, which along with Alibaba and ByteDance controls vast swathes of China's internet. In a statement announcing the move Friday, Tencent said it will also provide ways for its users to report suspicious content, and work on features for sharing links in wider group discussions. China's top technology regulator has warned internet firms to stop blocking links to rival services, prising open so-called walled gardens in a broader campaign to curb their growing monopoly on data and protect consumers. The government has accused a handful of companies of unfairly protecting their respective spheres: Tencent in social media via WeChat, Alibaba in e-commerce with Taobao and Tmall and, more recently, ByteDance in video via TikTok-cousin Douyin.

Google

Alphabet's Project Taara Laser Tech Beamed 700TB of Data Across Nearly 5km (theverge.com) 34

An anonymous reader shares a report: In January, Google's parent company, Alphabet, shut down Project Loon, an initiative exploring using stratospheric helium balloons to distribute wireless internet (an attempt to use solar-powered drones folded in 2017). However, some technology developed as a part of the Loon project remained in development, specifically the Free Space Optical Communications (FSOC) links that were originally meant to connect the high flying balloons -- and now that technology is actively in use providing a high-speed broadband link for people in Africa.

Sort of like fiber optic cables without the cable, FSOC can create a 20Gbps+ broadband link from two points that have a clear line of sight, and Alphabet's moonshot lab X has built up Project Taara to give it a shot. They started by setting up links in India a few years ago as well as a few pilots in Kenya, and today X revealed what it has achieved by using its wireless optical link to connect service across the Congo River from Brazzaville in the Republic of Congo and Kinshasa in the Democratic Republic of Congo. In 20 days, Project Taara lead Baris Erkmen says the link transmitted nearly 700TB of data, augmenting fiber connections used by local telecom partner Econet and its subsidiaries.

Science

Study Links Too Much Free Time To Lower Sense of Wellbeing (theguardian.com) 107

Research shows there is a 'sweet spot' and subjective wellbeing drops off after about five hours. The Guardian: The lesson of Goldilocks, that one can have too much of a good thing, even when it comes to the size of a chair, has applied in fields from astrobiology to economics. Now, it seems it may even govern our free time. Researchers have found that while levels of subjective wellbeing initially rise as free time increases, the trend does not necessarily hold for very high levels of leisure. "The sweet spot is a moderate amount of free time," said Dr Marissa Sharif, a co-author of the study from the University of Pennsylvania. "We found that having too much time was associated with lower subjective wellbeing due to a lacking sense of productivity and purpose."

Writing in the Journal of Personality and Social Psychology, Sharif and colleagues reported how they analysed results from two large-scale surveys, involving a combined total of more than 35,000 participants. One was the American Time Use Survey, which was carried out between 2012 and 2013 and asked participants what they had done in the past 24 hours. After crowdsourcing opinions on which activities would be equated with leisure time and then calculating this time for participants, the team found that while subjective wellbeing rose with the amount of free time up to about two hours, it began to drop once it exceeded five hours. Meanwhile data from the National Study of the Changing Workforce, carried out between 1992 and 2008, revealed that beyond a certain point, having more free time was no longer linked to greater subjective wellbeing, but it did not dip -- possibly because few of the participants reported having more than five hours of free time a day.

Apple

Judge in Epic Suit Says Apple Restrictions Anti-Competitive (theverge.com) 161

A U.S. judge on Friday issued a ruling in "Fortnite" creator Epic Games' antitrust lawsuit against Apple's App Store, labelling Apple's conduct in enforcing anti-steering restrictions as anticompetitive. From a report: The case may determine whether Apple is allowed to retain control over what apps appear on its iPhones and whether it is allowed to charge commissions to developers. The Verge adds: Judge Yvonne Gonzalez-Rogers issued a permanent injunction in the Epic v. Apple case on Friday morning, handing a major setback to Apple's App Store model. Under the new order, Apple is: "permanently restrained and enjoined from prohibiting developers from including in their apps and their metadata buttons, external links, or other calls to action that direct customers to purchasing mechanisms, in addition to In-App Purchasing and (ii) communicating with customers through points of contact obtained voluntarily from customers through account registration within the app."
The Internet

The 'Dead Internet' Theory Posits Forums are Now Almost Entirely Overrun By AI (theatlantic.com) 147

Ideas from 4chan (including its paranormal section) have percolated into the "dead internet" theory, writes the Atlantic, with a seminal post on another forum by "IlluminatiPirate" now arguing that the internet is almost entirely overrun by artificial intelligence: Like lots of other online conspiracy theories, the audience for this one is growing because of discussion led by a mix of true believers, sarcastic trolls, and idly curious lovers of chitchat... Peppered with casually offensive language, the post suggests that the internet died in 2016 or early 2017, and that now it is "empty and devoid of people," as well as "entirely sterile." Much of the "supposedly human-produced content" you see online was actually created using AI, IlluminatiPirate claims, and was propagated by bots, possibly aided by a group of "influencers" on the payroll of various corporations that are in cahoots with the government. The conspiring group's intention is, of course, to control our thoughts and get us to purchase stuff... He argues that all modern entertainment is generated and recommended by an algorithm; gestures at the existence of deepfakes, which suggest that anything at all may be an illusion; and links to a New York story from 2018 titled "How Much of the Internet Is Fake? Turns Out, a Lot of It, Actually."

"I think it's entirely obvious what I'm subtly suggesting here given this setup," the post continues. "The U.S. government is engaging in an artificial intelligence powered gaslighting of the entire world population." So far, the original post has been viewed more than 73,000 times...

The theory has become fodder for dramatic YouTube explainers, including one that summarizes the original post in Spanish and has been viewed nearly 260,000 times. Speculation about the theory's validity has started appearing in the widely read Hacker News forum and among fans of the massively popular YouTube channel Linus Tech Tips. In a Reddit forum about the paranormal, the theory is discussed as a possible explanation for why threads about UFOs seem to be "hijacked" by bots so often. The theory's spread hasn't been entirely organic. IlluminatiPirate has posted a link to his manifesto in several Reddit forums that discuss conspiracy theories... Anyway ... dead-internet theory is pretty far out-there. But unlike the internet's many other conspiracy theorists, who are boring or really gullible or motivated by odd politics, the dead-internet people kind of have a point... [Y]ou could even say that the point of the theory is so obvious, it's cliché — people talk about longing for the days of weird web design and personal sites and listservs all the time. Even Facebook employees say they miss the "old" internet. The big platforms do encourage their users to make the same conversations and arcs of feeling and cycles of outrage happen over and over, so much so that people may find themselves acting like bots, responding on impulse in predictable ways to things that were created, in all likelihood, to elicit that very response.

That 2018 article in New York magazine had argued that (at that time) a majority of web traffic was probably coming from bots — including especially high bot traffic on YouTube — while even the engagement metrics for major sites like Facebook had been gamed or inflated.

But whether or not that's changed, the Atlantic shares a compelling argument from a forum poster arguing that their very presence in this discussion proves they must be a bot. "If I was real I'm pretty sure I'd be out there living each day to the fullest and experiencing everything I possibly could with every given moment of the relatively infinitesimal amount of time I'll exist for instead of posting on the internet about nonsense."
Security

In Novel Attack Technique, Salesforce Email Service Used For Phishing Campaign (esecurityplanet.com) 21

Slashdot reader storagedude writes: In a novel attack technique, Israeli security researchers discovered that cybercriminals were subscribing to Salesforce in order to use its email service to launch a phishing campaign and thus bypass corporate security defenses like whitelisting.

The researchers, from email security service provider Perception Point, said bad actors are sending phishing emails via the Salesforce email service by impersonating the Israel Postal Service in a campaign that has targeted multiple Israeli organizations.

In a blog post, security analysts Miri Slavoutsky and Shai Golderman wrote that this is the first time they had seen attackers abuse Salesforce services for malicious purposes.

"Mass Email gives users the option to send an individual, personalized email to each recipient, thus creating the perception of receiving a unique email, created especially for you," Slavoutsky and Golderman wrote. "Spoofing attempts of Salesforce are nothing new to us. Attackers spoof emails from Salesforce for credential theft, is a typical example. In this case, the attackers actually purchased and abused the service; knowing that most companies use this service as part of their business, and therefore have it whitelisted and even allowed in their SPF records."

Shlomi Levin, Perception Point's co-founder and CTO, told eSecurity Planet that given how whitelisting a trusted source can result in security breaches, "it is essential to employ a zero-trust attitude combined with a strong filtering mechanism to any content that enters the organization no matter the source: email, collaboration tools or Instant Messaging."

Stephen Banda, senior manager of security solutions at cybersecurity vendor Lookout, agreed with the researchers that it's a new approach by malicious actors.

"The practice of legitimately signing up for an email service with the full intention of using it for malice is an innovative strategy," Banda said. "This breach should be a warning to all service providers to conduct extensive due diligence into who is requesting access to their services so that this type of scam can be avoided in the future."

"There are ways to detect spoofing but in this case the emails look authentic and are also coming from where they say they are coming from," said Saumitra Das, CTO of cybersecurity firm Blue Hexagon. "This means that attackers have got through the first email firewall both from a threat intelligence signature perspective of blocking known bad sources and also in some sense the instinct of the user themselves to be suspicious of what something is. It is common for attacks to get through email security solutions, but then well-trained or savvy users are the next line of defense. This [use of a legitimate email service] increases the chances of those users also clicking on links or downloading attachments."

Medicine

Largest Study of Its Kind Finds Face Masks Reduce COVID-19 (berkeley.edu) 232

An anonymous reader quotes a report from Berkeley News: Wearing face masks, particularly surgical masks, is truly effective in reducing the spread of COVID-19 in community settings, finds a new study led by researchers from Yale University, Stanford Medical School, the University of California, Berkeley, and the nonprofit Innovations for Poverty Action (IPA). The study, which was carried out among more than 340,000 adults living in 600 rural communities in Bangladesh, is the first randomized trial to examine the effectiveness of face masks at reducing COVID-19 in a real-world setting, where mask use may be imperfect and inconsistent.

The results show that increased mask-wearing -- the result of a community-level mask distribution and in-person promotion campaign -- led to a significant reduction in the percentage of people with COVID-19, based on symptom reporting and SARS-CoV-2 antibody testing. The team tested both cloth and surgical masks and found especially strong evidence that surgical masks are effective in preventing COVID-19. In the study, surgical masks prevented one in three symptomatic infections among community members 60 years and older. The findings come at a crucial time in the U.S., when many in-person events have resumed and children -- including those who are under 12 and do not yet qualify for vaccination -- are returning to in-person school.
The full press release and study can be found at their respective links.

Slashdot Top Deals