Adobe has completely gone to the dark side - new lightroom is completely on the cloud!

I kid you not.

According to Peter Bright at ARS:

New cloud-imprisoned Lightroom has 1TB of photo storage, same UI across desktop and mobile

You can read it yourself, but I'll pull out the best bits (further emphasis mine):

For the time being, the desktop-based Lightroom Classic will continue to be developed.

The current Lightroom CC is being renamed to Lightroom Classic CC, and a new product with an old name, Lightroom CC, will take its place.

The new Lightroom CC offers most of the photo processing features of Lightroom Classic

"likely" contentious feature: it uploads *ALL* your photos to cloud storage.

Adobe is using that cloud storage to perform object detection (and more!) on your pictures

Umm -  WHAT.  THE.  HUCK. ?

Well, CyberReason is one of the good guys!

Their claim to my respect is that they got an actual "legal" threat from a malware company's "lawyers"!  The company is "TargetingEdge", the malware is "OSX.Pirrit", and it runs on Macs.

Nice, this will tell the FBI exactly who to chase :-)

TargetingEdge claims the software isn't malware, but based on the following, this is like claiming Wilbur in Charlottes Web isn't a pig. According to Amit Serper, who wrote the analysis of the code: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters

As for OSX.Pirrit malware, it runs under root privileges, creates autoruns and generates random names for itself on each install. Plus, there are no removal instructions and some of its components mask themselves to appear like they’re legitimate and from Apple. And don’t forget that TargetingEdge used domains that appeared to be generated by some sort of DGA and made many attempts to hide any link between the domains and TargetingEdge.

Slashdot starts a good thread: Maker of Sneaky Mac Adware Sends Security Researcher Cease-and-Desist Letters (zdnet.com)

CyberReason's  analysis of the code can be found here

Amit - If I run into you in Boston area, let me buy you a beer!

Even the AP and the New York Times understand that the FCC is lying about Net Neutrality

Here's the AP article making a point-by-point case why Ajit Pai released "his own incomplete and misleading talking points when he suggested that internet providers had never influenced content available to their customers before neutrality rules took effect in 2015."


The New York times has even weighed in to tell us "The F.C.C. Wants to Let Telecoms Cash In on the Internet"
From Slashdot and Ars Technica - As the FCC builds barricades, they won't delay the vote in spite of outstanding court cases that would affect it stating: 

This is just evidence that supporters of heavy-handed Internet regulations are becoming more desperate by the day as their effort to defeat Chairman Pai's plan to restore Internet freedom has stalled. The vote will proceed as scheduled on December 14.

 [ If the opponents are getting so desperate, why did the FCC wait until Thanksgiving week  to announce that the vote killing net neutrality would be in mid December ?

For those who think that the ISP's ( Along with the politicians they bought and paid for, the only beneficiaries of this mess ), won't abuse their monopoly/duopoly in killing the internet,  here's "A brief history"  of ISP internet abuse from Freepress.net ]

Are the days of the C programming language (finally) ending?

Some would argue that the C language is the biggest cause of data security problems, I disagree, since we all know it's people who are the problem.

That said, the fast and loose nature of C is definitely a big contributer to the vulnerabilities, and  I do think that modern programming environments can fix more of that than they do.

In this Slashdot article, open source guru Eric S Raymond posits that C and specifically C++ are way more trouble than they're worth, and being replaced by languages with Garbage collection, like Java sorta, but more like Go, since it scales way better, and not Rust since it's not complete yet.

Really good read, he has a good style and you don't need to be a foll time developer to understand it

Krebs explains how to block leaking of your salary and employment data

Brian Krebs, consumer privacy and cyber security warrior, writes a series of blog posts exposing more privacy-violating practices of the credit reporting agencies, including Experian and Equifax here: https://krebsonsecurity.com/2017/11/how-to-opt-out-of-equifax-revealing-your-salary-history/#more-41495

Word macroless attack? Well, DDE instead.

According to Ars Technica: https://arstechnica.com/information-technology/2017/11/russia-linked-fancy-bear-attacks-abuse-macro-less-ms-word-to-infect-pcs/

The Russians are sending phishing attacks that use DDE to download malware.

So if you see this - DON'T CLICK THE BOX!

 

You already knew not to click this, so same thing:

 

 

 

So if you're Logitech, the end of the warranty period is the expiration date...

From Bleepingcomputer.com

Logitech Will Intentionally Brick All Harmony Link Devices Next Year 

Updated 11/13/2017 - Free updated hardware for all customers!

By Catalin Cimpanu

Logitech will intentionally brick all Harmony Link universal hubs next year, on March 16, 2018. The company has emailed all Harmony Link customers with the bad news.
There is nothing wrong with Harmony Link devices.

The company says a "technology certificate license" will expire next year, which they don't intend to extend.

The supposed license is crucial for Harmony Link devices, which means the company will have to shut down all products or face a legal battle with the unnamed certificate license owner.
In simpler words, Logitech has decided to give up on a product it advertised for the past few years just to cut some costs and will ship a firmware update on March 16, 2018, that will render all Harmony Link devices unusable.

https://www.bleepingcomputer.com/news/hardware/logitech-will-intentionally-brick-all-harmony-link-devices-next-year/

I guess I dodged a bullet on that one - it's more than $100 for the hub and controller.  

I guess there's a reason that Logitech is known as the place "good technology goes to die"

So Logitech just figured out how to get me to pay monthly for one of their products.  Either make it disposable like a $15 mouse, or divide the product by its life in months. The $180 hub should last 5 years, so I'll pay $3 per month.  Plus, they'll have to update its software to get me to keep paying after 5 years anyway.

Sony did the opposite on my Blu-ray player.  They added Pandora for free after I already owned it, but a couple of years later I bought a $1700 camera.

I'll just leave this here...

Jason Scott‏ @textfiles  23h23 hours ago

AND FOR OUR NEXT TRICK: An Apple II Emulator Running in a Mac Emulator Running In Your Browser https://archive.org/details/2InaMac 

18 replies177 retweets461 likes

 

 

 

Ethereum! The continuous train wreck!

https://motherboard.vice.com/en_us/article/ywbqmg/parity-multi-signature-wallet-vulnerability-300-million-hard-fork

Someone ‘Accidentally’ Locked Away $300M Worth of Other People's Ethereum Funds

And a hard fork is on the table.

Jordan Pearson

Nov 7 2017, 11:24am

Image: Shutterstock

On Tuesday, a single user permanently locked down dozens of digital wallets containing nearly $300 million dollars worth of ether, the unit of exchange on the Ethereum platform, allegedly by accident.

Now, some in the Ethereum community are considering the possibility of a risky network split, known as a "hard fork," to fix it.

The affected wallets—known as "multisignature" wallets because they require multiple people to sign off before funds are moved, making them popular with companies—were all created with Parity, a popular program for digital wallets. Parity multisignature wallets experienced a bug in July that allowed a hacker to steal $32 million in funds before the Ethereum community scrambled to band together to hack back and secure the rest of the vulnerable ether.

According to a blog post released by Parity on Tuesday, the code that fixed the July bug contained another vulnerability. That vulnerability allowed a user known as "devops199" on GitHub, a site for developers to collaborate on open source code, to allegedly accidentally trigger a function that turned the contract governing Parity multisignature wallets into a regular wallet address and made him or her the owner. Devops199 then killed this wallet contract, or, as Parity put it, "suicided" it. This made all multisignature wallets tied to that contract instantly useless, their funds locked away with no way to access them.

Facebook Australia's solution to revenge porn? Send all your nude selfies to us!

No kidding.  If you send your potentially embarrassing photos to them, they'll create a special "hash signature", and throw the picture away.  That way, if a miscreant, malcontent, or any other all around bad person tries to upload it, they'll tell in a flash, delete the picture, and see that the varlet gets their justice!

http://www.abc.net.au/news/2017-11-02/facebook-offers-revenge-porn-solution/9112420

Update:  Well, I do stand corrected.  This isn't the dumbest thing in the world, although it does seem that way.  They have worked with actual experts in law enforcement and mental health, and have spent some serious thought on the problem, and it looks like if it's not a solution of part of the problem, it's a genuine Good Try. 

The files to send to Facebook are actual ones that have either escaped to the web, or are expected to go, and Facebook will match them using fuzzy hashes, which can survive past some image manipulation like cropping,  resizing, and re-rezzing ( I think ).

To Facebook, you have my actual respect for actually trying something bold against a really hard problem.

Responses to Comcast's "We're friends with net neutrality - Honest!"

Do you keep seeing this from Comcast?

Comcast Supports net neutrality...

There are plenty more here:
https://twitter.com/comcast/status/885165857810386946?lang=en

Really?

Not so much

Verizon isn't spamming my twitter feed, but still...( From Techdirt who's following this well)
Verizon Lobbies FCC To Block States From Protecting Broadband Privacy, Net Neutrality

Since the FCC is trying to kill Net Neutrality, many (30 atp)  states are passing their own net neutrality and privacy laws and the ISP's are freaking out, and the lies are coming at broadband speed.  And you guessed it, Comcast was right there, although hiding behind the name "Internet Association"



This set of pop up lies was played on TV in California, and And EFF's blog is a good place to find the shenanigan here,  or here - the pop-ups they're talking about are the ones the ISP's are saying they'll have to put in themselves every time they want to sell your data, unless you opt-out.  They will, however, have to notify you every time they change their terms of service, which they don't want.



We can act now by supporting the EFF

Update (11/6/2017) :  And they just keep on giving - and crying to the FCC to make the states stop hurting their feelings: Comcast Urges FCC To Ban States From Protecting Broadband Privacy, Net 

Just remember - Nobody Cares!  and These are not the droids you're looking for...

According to G Clueley, Mailchimp has jumped the shark

https://www.grahamcluley.com/can-no-longer-recommend-mailchimp/

Apparently until recently they were defaulting to double-opt-in, asking the recipients of newsletters  whether they had really signed up for a service, and were, well, kinda preachy about it. (Good!)

Inexplicably, they have moved to single opt-in where anyone can sign up anyone else for services provided by Mailchimp.

Also inexplicably, they are going against the GDPR for mailing to europeans, and have no clue about it.

Verizon Again, not really data security, just data.

Verizon Again, not really data security, just data, and well, fraud.

From slashdot:

Verizon Will Stop Throttling Video On Unlimited Plans If You Pay An Extra $10 Per Month (theverge.com)

Apparently Verizon has recognized a market opportunity, where they found that customers want to stream HDTV ( like 720p, 1080p, and 4K ), which is impossible on their capped, limited "unlimited" plan.

Jumping into action, the marketing department has created a new "beyond unlimited" plan and is only charging the bargain rate of $10 per month per line so their customers can get what they really want, HDTV.

The irony seems completely lost on them and the FCC, that the limited "unlimited plan" needs to be opened up to "beyond unlimited".

Update:  Plus, in even more arrogance, after their customers, their providers are paying them too (like Netflix)

New bill allows "hacking back"?!?!

Apparently, yes

According to thehill.com:

Reps. Tom Graves (R-Ga.) and Kyrsten Sinema (D-Ariz.) introduced a bill Friday that would allow hacking victims to "hack back" when attacked.
The Active Cyber Defense Certainty Act allows individuals and companies to hack hackers if the goal is to disrupt, monitor or attribute the attack, or destroy stolen files.
“While it doesn’t solve every problem, [the legislation] brings some light into the dark places where cybercriminals operate,” Graves said in a statement.
“The certainty the bill provides will empower individuals and companies [to] use new defenses against cybercriminals," he said. "I also hope it spurs a new generation of tools and methods to level the lopsided cyber battlefield, if not give an edge to cyber defenders."
The bill does not allow counterattackers to destroy anything other than their own stolen files and requires that someone "hacking back" under the bill's provisions notify the FBI National Cyber Investigative Joint Task Force. (more...) http://thehill.com/policy/cybersecurity/355305-hack-back-bill-hits-house

Well, rumor is that there are commercial that are already close to doing this, and doing it well, but want to be able to CYA if things go non-linear ( read: hit the press ), and the snippet above says they " notify the FBI National Cyber Investigative Joint Task Force".  This means it's not allowing every script kiddy or wannabee to become legal, as if these jokers would wait for permission anyway.

They've been talking about it for a while now, so I wouldn't be surprised if it really goes through, won't change for the maturity of mature companies - attribution is still hard, and ops are risky.

PS.  Not data security, but as the Trump meltdown continues, thehill.com has a great article http://thehill.com/opinion/white-house/355569-juan-williams-trump-is-becoming-a-failed-president

Yes, folks, supply chain risks through third party libraries is a thing...

Yes, folks, supply chain risks through third parties is a thing... 

And at a banking site to boot: https://www.bankinfosecurity.com/equifax-transunion-websites-served-up-adware-malware-a-10379

Well, not really banking, credit reporting services, like Equifax or Transunion,  are using code for web reporting.

It's kinda malvertising, where the site has links that go outside, but I think it's include files, that go to a site on the fly, which is compromised, and serving up fake flash malware, which in this case is Adware.Eorezo.

There's also talk about third party providers in general https://www.pymnts.com/news/b2b-payments/2017/bitsight-financial-services-face-third-party-cybersecurity-risk/


Malwarebytes is quoted multiple times and has a good blog post https://blog.malwarebytes.com/threat-analysis/2017/10/equifax-transunion-websites-push-fake-flash-player/

USB cable has GSM and a microphone?!?!

What's in a cable? The dangers of unauthorized cables

Published: 2017-10-06
Last Updated: 2017-10-06 15:04:51 UTC
by Johannes Ullrich (Version: 1)

0 comment(s)

As data speeds have increased over the last few years, and interface ports have become more and more multi-functioning and integrated, cables have started to pose a very particular and real danger. So far, they often have been ignored and considered "dumb wires". But far from that, many cables these days hold logic chips of their own and in some cases even upgradable (replaceable) firmware.

pcap2curl - replaying URLS from a pcap

Johannes Ullrich of SANS has an interesting tool that uses scapy to read a pcap and emit the curl commands to replay it.  

This has a lot of possibilities, not the least are learning scapy

https://isc.sans.edu/diary/pcap2curl%3A+Turning+a+pcap+file+into+a+set+of+cURL+commands+for+%22replay%22+/22900



Perry

Judge says not enough evidence of harm in D-Link suit by FCC

On Slashdot: Judge Kills FTC Lawsuit Against D-Link for Flimsy Security

Well, consumers weren't harmed, and D-Link doesn't get into trouble.  Well that means that there's no evidence that they've learned a lesson either

So let's all never buy crappy insecure D-Link  gear, huh?  Maybe the market will decide

IOS 11 Control Center, doesn't turn off Wi-Fi or Bluetooth

In the latest "WTF Apple", the weird control center that is accessed by dragging up from the bottom of the screen, even (optionally) while locked, has buttons to turn on off a bunch of things.

IOS control center in 10.3.3

According to a Motherboard article, turning off the RF in the control center:

Apple decided Control Panel should not disable the devices entirely because it wants services including “AirDrop, AirPlay, Apple Pencil, Apple Watch, Location Services, and other features” 

 Apparently it's still turned off correctly in the control panel - but who would know?

Time for a Faraday bag everyone?  (8.99 shipped)

Techdirt: HP is making printers reject third party cartridges again

Well, they tried it a year ago, got whacked, and are trying it again

HP Brings Back Obnoxious DRM That Cripples Competing Printer Cartridges

Think of the customers!  They want this!

Lets not forget Equifax

In a nutshell:

1. Equifax was hacked big time, everybody knows that
2. Came out in September 2017
3. Found out in March?
1.  Slashdot: Equifax Suffered a Hack Almost Five Months Earlier Than the Date It Disclosed
4. Execs sold lots of stock
1.  And even bigger and largely unappreciated, Options!
5. So if you're a responsible person with good credit, you're a target ripe for the picking
1. Equifax will do a credit with themselves for free ( and their PIN isn't even a time stamp )
2. Not sure about the others
3. Is something other than a credit freeze better?
4.  The Equifax Breach: Here's How to Protect Yourself | WIRED
5. There's something on TWIT, they discussed it on Security Now  #62
6. 
   

Update: Continuing this dumpster fire, according to Slashdot,  Equifax Has Been Sending Consumers To a Fake Phishing Site for Almost Two Weeks for theft protection.  They created "EquifaxSecurity2017.com", but were sending people to "securityequifax2017.com" in tweets between September 9 and 20 2017.  in Gizmodo:

Another Update: (9/22/2017)

The 3 executives that made $2mil were a story, but the options that were bought on August 21 for $160K were worth about $10M on Sept 7

https://www.cnbc.com/2017/09/20/house-finance-committee-seeks-information-on-equifax-options-activity.html

Cell Phone Deprioritization is a thing?

 

On Slashdot: T-Mobile To Increase Deprioritization Threshold To 50GB This Week

 
"After raising its deprioritization threshold to 32GB in May, it looks like T-Mobile will bump it up to 50GB on September 20th, according to a TmoNews source. "

Hmm..

Forbes article on stealing bitcoins using phone system flaws.

Forbes has a remarkably good article on stealing bitcoins stored in Coinbase by using SS7 phone system flaws.

These attacks:

1. Have been shown to work by researchers
2. Have been used in the wild to commit crimes
3. Don't seem to be able to be fixed
4. Have the government's attention

For better 2-factor authentication (2FA),  Forbes suggests using an App, like Google Authenticator, or something similar 

Perry