Two million recordings of families imperiled by cloud-connected toys' crappy MongoDB

Found on The Register on Tuesday, 28 February 2017
Browse Internet

CloudPets' internet-facing MongoDB installation, on port 2701 at 45.79.147.159, required no authentication to access, and was repeatedly extorted by miscreants, evidence shows. The database contains links to .WAV files of voice messages hosted in the Amazon cloud, again accessible with no authentication, potentially allowing the mass slurping of more than two million highly personal conversations between families and their little ones.

As proof that CloudPets' security was hopeless, Hunt's informant provided him more than 580,000 records from the CloudPets database, along with screenshots of three attempts to alert the toy manufacturer to the gaping hole. Each warning, we're told, fell on deaf ears.

Hunt concluded: “The CloudPets data was accessed many times by unauthorised parties before being deleted and then on multiple occasions, held for ransom.”

That's not just an unfortunate accident anymore; the company had several chances and still decided with intent to ignore all safety. With such a disregard to data security, CloudPets should be held liable and brought to court. This also shows one of the major problems with the production process: they hired obviously incompetent developers who failed to read the installation instructions of MongoDB, like so many others (and yes, MongoDB should be completely locked down after installation, requiring the admin to configure it). They also failed to efficiently handle and store data. WAV? Seriously?

Website builder Wix acquires art community DeviantArt for $36M

Found on Techcrunch on Saturday, 25 February 2017
Browse Internet

Wix said that it will continue to operate DeviantArt as a standalone site, but it will also use it to boost its own business in a couple of ways.

Wix will open up DeviantArt’s repository of art and creative community to the Wix platform, giving Wix’s users access to that work to use in their own site building.

Next time you upload your artwork to some website, check the small printed TOS; then you might think twice about granting full rights to your work to someone else who can just sell it to another third party which allows users to make Flash-based websites. Flash, seriously?

Google: 99.95% of Recent ‘Trusted’ DMCA Notices Were Bogus

Found on Torrentfreak on Friday, 24 February 2017
Browse Internet

“For example, in January 2017, the most prolific submitter submitted notices that Google honored for 16,457,433 URLs. But on further inspection, 16,450,129 (99.97%) of those URLs were not in our search index in the first place.”

A proactive takedown of a non-existent URL necessarily happens in advance of any determination of whether that URL is infringing, which goes way beyond any legislation currently being demanded.

That is pretty obviously a plain abuse of the system and should result in the termination of the submitter's account.

Router hacker suspect arrested at Luton Airport

Found on BBC News on Friday, 24 February 2017
Browse Internet

"He is accused of being the mastermind behind the attack," Cologne public prosecutor Dr Daniel Vollmert told the Press Association.

Once hijacked, the routers would be used to mount what is known as "distributed denial of service" attacks. These attempt to knock sites and servers offline by sending them more data than they can handle.

Fake news day? Telekom's problem was completely home-made because they decided to expose TR-069 to just everybody on the Internet; and along with a massive input validation failure that allowed an expected hostname string to be replaced by backticked shell commands caused this entire mess. They hype the suspect as a mastermind to distract from their own big mistakes.

Is your child a hacker? Liverpudlian parents get warning signs checklist

Found on The Register on Monday, 20 February 2017
Browse Internet

The programme, which encourages youngsters to develop useful computer skills, is also informing parents of the signs they may encounter if their children are on the path to becoming cybercriminals.

While readers may be unconcerned that their children are doing illegal things online, Warrington told the Echo that "children as young as eight have gotten involved in hacking, and most often it starts with online gaming."

That is by far one of the most retarded list of "signs". Got more than one email address? Then they have some bad news for you.

Not even Donald Trump can save Twitter

Found on CNet News on Thursday, 09 February 2017
Browse Internet

The company said Thursday that the number of people regularly using the service grew by less than 1 percent despite Trump's prolific and often controversial tweeting, a deal with the NFL to broadcast games, and a new push to stream live video.

Twitter's shares plummeted as much as 18 percent and were down 12.4 percent when the market closed Thursday.

Not much of a surprise. 140 overhyped characters and nothing of value to be found in the gigantic pile of useless posts. You're not searching a needle in the haystack there, but a needle in an entire planet of hay.

GitLab.com melts down after wrong directory deleted, backups fail

Found on The Register on Wednesday, 01 February 2017
Browse Internet

Behind the scenes, a tired sysadmin, working late at night in the Netherlands, had accidentally deleted a directory on the wrong server during a frustrating database replication process: he wiped a folder containing 300GB of live production data that was due to be replicated.

"So in other words, out of 5 backup/replication techniques deployed none are working reliably or set up in the first place."

At the time of writing, GitLab says it has no estimated restore time but is working to restore from a staging server that may be “without webhooks” but is “the only available snapshot.” That source is six hours old, so there will be some data loss.

You would think that they at least tested one of the backup techniques, or monitored the backup status to get notified of errors.

Facebook tool protects other accounts when hackers strike email

Found on CNet News on Monday, 30 January 2017
Browse Internet

The tool is part of Facebook's larger push to develop technology that will make passwords unnecessary, Hill wrote.

To use this tool, you'll have to wait for your favorite web services to implement it. Facebook released an open-source protocol that any online service can use to let you prove you are who you say you are with your Facebook account.

In return, you let FB know of all the services you are using, making your profile there even more complete and valuable for advertisers.

Massive networks of fake accounts found on Twitter

Found on BBC News on Tuesday, 24 January 2017
Browse Internet

The largest network ties together more than 350,000 accounts and further work suggests others may be even bigger.

The pair's most recent work had uncovered a bigger network of bots that seemed to include more than 500,000 accounts.

It is actually more suprising that the networks are not bigger. Everybody sells spam followers on Twitter these days for cheap.

China's new 'cleanup' campaign shores up Great Firewall

Found on CNet News on Monday, 23 January 2017
Browse Internet

To have normal access the web, Chinese users have resorted VPNs, which bypass the censorship firewall. But now these services are the target of a new 14-month "cleanup" campaign that cracks down on "unauthorized internet connections."

Apart from VPNs, the campaign also requires all internet service providers, content distribution networks and data centers operated in the country to be licensed by the government.

Companies will only start to think twice about getting involved with China when such problems are created for no valid reason.