Oracle enters race to buy TikTok’s US operations

Found on Ars Technica on Tuesday, 18 August 2020
Browse Internet

The tech company co-founded by Larry Ellison had held preliminary talks with TikTok's Chinese owner, ByteDance, and was seriously considering purchasing the app's operations in the US, Canada, Australia and New Zealand, the people said.

The entry of Oracle into the race provided ByteDance with a credible alternative to Microsoft's offer, said one person with direct knowledge of the matter.

Oracle, really? The same company that drops everything left and right what a user does not pay for?

Facebook begins merging Instagram and Messenger chats in new update

Found on The Verge on Monday, 17 August 2020
Browse Internet

Facebook has started flipping the switch on integrating the chat systems for Instagram and Messenger.

Facebook has made clear its plans to unify the messaging platforms of its hugely popular apps to allow cross-messaging among Messenger, Instagram, and WhatsApp. Facebook was said to be rebuilding the underlying infrastructure so users who were on only one of its apps could connect to others using different Facebook apps.

Once they promised that would never happen. Well, another FB promise got broken.

TikTok collected Android user data using tactic banned by Google

Found on Marketwatch on Sunday, 16 August 2020
Browse Internet

The tactic, which experts in mobile-phone security said was concealed through an unusual added layer of encryption, appears to have violated Google policies limiting how apps track people and wasn’t disclosed to TikTok users. TikTok ended the practice in November, the Journal’s testing showed.

The identifiers collected by TikTok, called MAC addresses, are most commonly used for advertising purposes. The White House has said it is worried that users’ data could be obtained by the Chinese government and used to build detailed dossiers on individuals for blackmail or espionage.

TikTok was caught red handed (no pun intended).

Google Music shutdown starts this month, music deleted in December

Found on Ars Technica on Wednesday, 05 August 2020
Browse Internet

Google Play Music has been given the death sentence by Google, and today the company has announced a bit more detail about how its execution will be carried out. The main message from today's blog post is "back up your music now," as Google says it will wipe out all Google Music collections in December 2020.

Whichever option you choose, make sure you do something before December because, after that, there will be no way to recover your music.

So much for relying on the cloud.

Yahoo News Suspended Its Comment Section, and People Are Freaking Out

Found on Distractify on Tuesday, 28 July 2020
Browse Internet

Recently, Yahoo News announced its strategy for combating toxic comment sections: It has completely suspended commenting. That’s right, Yahoo comments are gone! And some people are not happy.

Anyone who is upset by Yahoo’s so-called “censoring of free speech” should be aware that the First Amendment does not require any outlets to provide comment sections for people to share their thoughts. If you find yourself wanting to share your opinions, you are welcome to do so in other corners of the internet, as well as offline.

Opinions don't go away because they are blocked. They are looking for other places, and that usually just helps to amplify them.

New ‘Meow’ attack has deleted almost 4,000 unsecured databases

Found on Bleepingcomputer on Monday, 27 July 2020
Browse Internet

Hundreds of unsecured databases exposed on the public web are the target of an automated 'meow' attack that destroys data without any explanation.

Diachenko told BleepingComputer that there are not many details about the attacker or the purpose of their actions. He says that the attack appears to be an automated script that “overwrites or destroys the data completely.”

Whoever is behind the 'meow' attacks is likely to keep on targeting unsecured databases, aggressively destroying them. Administrators should make sure that they expose only what needs to be exposed and make sure the assets are properly secured.

Administrators should have made sure right from the start that their databases are not reachable by the public. That's their job. If they cannot even do that, they should quit.

A Security Breach Exposed More Than One Million DNA Profiles On A Major Genealogy Database

Found on Buzzfeed News on Friday, 24 July 2020
Browse Internet

On July 19, genealogy enthusiasts who use the website GEDmatch to upload their DNA information and find relatives to fill in their family trees got an unpleasant surprise. Suddenly, more than a million DNA profiles that had been hidden from cops using the site to find partial matches to crime scene DNA were available for police to search.

A second alarm came on July 21, when MyHeritage, a genealogy website based in Israel, announced that some of its users had been subjected to a phishing attack to obtain their log-in details for the site — apparently targeting email addresses obtained in the attack on GEDmatch just two days before.

If you give your DNA profile to some website, you really do have serious issues.

Day 6 of email wobbles at UK2 after services provider Tucows suffers 'service failure'

Found on The Register on Thursday, 23 July 2020
Browse Internet

Customers of UK2 hosted email services have been complaining of missing emails from clients, as the platform heads into a sixth day of wobbles. Problems appear to have begun on Friday for users connecting via IMAP and POP3 and were said to be due to "a service failure" at the UK company's Canadian service partner Tucows.

"There has been no loss of data and we are providing alternative mailbox facilities to those UK2 customers affected while work continues to resolve the issue. We will keep customers regularly updated on our progress via the status page as we receive further details from Tucows.”

Don't rely on cloud services too much. It's always a good idea to have a local backup of your email in case your service provider goes down. Then you have at least your old emails.

Hackers use recycled backdoor to keep a hold on hacked e-commerce server

Found on Ars Technica on Wednesday, 22 July 2020
Browse Internet

To guard against the possibility of being locked out of the server should the rightful operators ever discover the breach, the attackers left behind a simple but effective script.

The effectiveness of the backdoor is its ease of use. The admin password and everything else the attacker needs is coded into the script. All that’s needed, in the event the hacker is ejected, is to send a Get request to the location of the script file. With that, the attacker has a new admin account that uses the username, password, and email address of their choice.

If you have anything online that has at least a minimal level of importance, you should have a devel/staging system from where you push updates to the prod system. That way, when your prod system gets hacked, you wipe it clean and push the latest stage out and no backdoor will be left behind.

VPN with 'strict no-logs policy' exposed millions of user log files including account passwords

Found on Betanews on Sunday, 19 July 2020
Browse Internet

User of both UFO VPN free and paid services are affected by the data breach which was discovered by the security research team at Comparitech. Despite the Hong Kong-based VPN provider claiming to have a "strict no-logs policy" and that any data collected is anonymized, Comparitech says that "based on the contents of the database, users' information does not appear to be anonymous at all".

Users of the services are advised to change their passwords immediately.

Don't trust a service you're not hosting yourself. "The cloud" is not your friend.