Verizon is gonna axe its 'unlimited' data hogs

Found on The Register on Monday, 09 January 2017
Browse Internet

Subscribers who average more than 200GB of data downloaded per month have been told they have until February 16 to either move to a different plan or find a new carrier. It's believed atleast 8,200 customers have been sent the letters notifying them of an impending shutdown.

As far back as July of last year, there were reports of a mass-cancellation for those who used extremely high amounts of data on their wireless plans.

For those who think that 200GB is a lot, let's break it down onto a 30 day average: 6.67GB per day. At times where mobile devices make more and more traffic, such limitations should be a problem of the past. Unlimited means that you should be able to saturate your offered bandwidth 24/7 without causing any problems. If you do, your ISP has to invest into its infrastructure instead of kicking you out.

MongoDB Ransomware Impacts Over 10,000 Databases

Found on eWEEK on Friday, 06 January 2017
Browse Internet

The attack against MongoDB is a fairly simple one and is taking advantage of databases that have been misconfigured and left open, without the need for a user to first have proper administrative credentials. Once the attackers log into the open database, the next step is to fully take control and then steal or encrypt the database, offering it back to the victims only on receipt of the Bitcoin ransom payment.

The solution to the MongoDB security risk involves database administrators following the security checklist that MongoDB outlines on its website. The very first item on the checklist is 'enable access control and enforce authentication.'

So a fairly large number of "developers" neglected the most basic security steps after the installation and left not only the database port open to the public, but also failed to set a decent password. Furthermore, the threat is only a threat to those who, additionally to those grave mistakes, don't have backups. You reap what you sow.

U.S. government begins asking foreign travelers about social media

Found on Politico on Saturday, 24 December 2016
Browse Internet

The U.S. government quietly began requesting that select foreign visitors provide their Facebook, Twitter and other social media accounts upon arriving in the country, a move designed to spot potential terrorist threats that drew months of opposition from tech giants and privacy hawks alike.

The new policy comes as Washington tries to improve its ability to spot and deny entry to individuals who have ties to terrorist groups like the Islamic State.

Why not just have a single checkbox saying "Are you a terrorist?" instead of all that? After all, it seems impossible that someone would lie or just enter data especially meant for these papers so they can stay under the radar. Sorry, but security does not work like that.

YouTube star PewDiePie decides against deleting his main channel

Found on BBC News on Sunday, 11 December 2016
Browse Internet

Following an argument with YouTube, PewDiePie had said he'd delete his channel on Friday evening after he got 50 million subscribers.

Most people thought he meant his main channel, PewDiePie, but he actually deleted a different one - Jack Septiceye2.

Big surprise. Not. It was so obvious right after the announcement hit the news that he will never do it and now everybody can see that he just lied. Sure, he can nitpick and say that he did remove a channel; even though it's only some obscure one nobody knows. Now that he had his little soapbox moment, he can vanish again and go by the wayside.

PewDiePie quit plan prompts YouTube reply

Found on BBC News on Thursday, 08 December 2016
Browse Internet

In a video uploaded on Friday, video gamer Mr Kjellberg said he would delete his channel when it reached 50 million subscribers as a result of his frustration with the platform.

Mr Kjellberg is currently producing new episodes of his YouTube-financed series Scare PewDiePie, and on Tuesday topped Forbes' list of highest-paid YouTube stars for the second year in a row.

Of course, he will just close his account from which he makes millions each year. Remember: if you make a threat, don't make it look ridiculous. With all the money he earned by now, he could easily retire; but greed does not work that way.

Millions exposed to malvertising that hid attack code in banner pixels

Found on Ars Technica on Wednesday, 07 December 2016
Browse Internet

The malicious script is concealed in the alpha channel that defines the transparency of pixels, making it extremely difficult for even sharp-eyed ad networks to detect. After verifying that the targeted browser isn't running in a virtual machine or connected to other types of security software often used to detect attacks, the script redirects the browser to a site that hosts three exploits for now-patched Adobe Flash vulnerabilities.

Despite targeting only people using IE and unpatched versions of Flash, Stegano is noteworthy for its concealment of exploit code in the pixels of the banner ads. There's no reason future campaigns—or possibly ongoing ones that have yet to be discovered—couldn't exploit zero-day vulnerabilities that infected a much larger base of people. Until ad networks get much better at detecting malvertising campaigns, the scourge is likely to continue.

Just a friendly reminder why you should always use adblocking in the first place.

Deutsche Telekom fault affects 900,000 customers

Found on BBC News on Monday, 28 November 2016
Browse Internet

"Based on the error pattern, we cannot exclude the possibility that the routers have been targeted by external parties with the result that they can no longer register on the network."

The company, which has 20 million customers in Germany, has issued a software update and is asking affected customers to disconnect their routers.

According to other security news, the reason behind it is a simple exploit attempt against some router models. Basically, port 7547 was available, and the implemented TR-069 protocol allowed code execution. Guessing from the payload, the router not only evaluated backticked code in an NTP-server soap value, but ran it with privileges high enough to cause problems. If all that turns out to be true, it leaves the Telecom red faced, because with even the most basic input validation this would have been a non-issue. Not to mention that TR-069 is a security issue in itself already.

Delete yourself from the internet by pressing this button

Found on The Next Web on Saturday, 26 November 2016
Browse Internet

When logging into the website with a Google account it scans for apps and services you’ve created an account for, and creates a list of them with easy delete links.

Every account it finds gets paired with an easy delete link pointing to the unsubscribe page for that service. Within in a few clicks you’re freed from it, and depending on how long you need to work through the entire list, you can be account-less within the hour.

So, to sum it up, it will only find those accounts you signed up with using your Google email address. Furthermore, it gives all this information to a basically unknown third party. Considering that's it's quite a habit to sign up using throw-away addresss, or special email accounts which will receive all the follow-up spams, this service is, mildly put, quite pointless.

Oracle Just Bought Dyn, the Company That Brought Down the Internet

Found on Wired on Tuesday, 22 November 2016
Browse Internet

Oracle is also in the midst of a reinvention: it wants to become a cloud computing company that can compete with the likes of Amazon and Google. In that case, the acquisition of Dyn just might give Oracle a much-needed asset.

Amazon and Google already offer their own DNS services. So in a sense, Dyn just makes Oracle’s cloud offering more complete.

If Dyn would be open source, we could expect LibreDyn soon. After all, everything that Oracle touches end up as a dirtied wreck that nobody wants to use. Just look at what happened to Solaris and Open Office.

Snapchat: Is it really worth $25bn?

Found on BBC News on Wednesday, 16 November 2016
Browse Internet

Snap, the parent company of messaging app Snapchat, has filed to list on the US stock market, according to several reports.

And while Snap won't comment - it's thought it could be valued at $25bn (£20bn).

No, it is not. However, all the personal information of the users are worth a lot when they are sold.