Kaspersky VPN blabbed domain names of visited websites – and gave me a $0 reward, says chap

Found on The Register on Friday, 10 August 2018
Browse Various

The antivirus giant duly fixed up the blunder when a researcher reported it via the biz's bug bounty program – for which he received zero dollars and zero cents as a reward.

A spokesperson for Kaspersky Lab has been in touch to say the VPN tool is completely outside the scope of the bug bounty.

Obviously that bug was realistic and serious enough to get patched; yet Kaspersky still claims that it's not worth a single cent. That leads to a pretty simple conclusion: it's better to try and sell bugs and exploits (at least for Kaspersky products) to blackhats instead who do value your discoveries.

Make It So! 'Star Trek's' Capt. Picard Returns in New CBS Series

Found on Space on Monday, 06 August 2018
Browse Various

An incredible 28 years after "The Next Generation" (TNG) finished its television run, star Patrick Stewart announced he will reprise his role as Captain Jean-Luc Picard in a new CBS series.

Kurtzman appeared unexpectedly at the "Star Trek" Convention Las Vegas this past weekend, along with Stewart, to confirm the rumors were true, according to ComicBook.com. No details were released about when the series will debut or how many episodes it will run.

Hopefully the new series will be as good as TNG was.

Web doc iCliniq plugs leaky S3 bucket stuffed full of medical records

Found on The Register on Friday, 03 August 2018
Browse Various

iCliniq locked down the online silo earlier this week only after the slip-up was brought to its attention by German security researcher Matthias Gliwka. He approached El Reg after failing to get any response to notification emails he sent to the firm.

iCliniq stored these private medical documents in a misconfigured wide-open AWS S3 bucket that could have been potentially pored over by anyone.

He said iCliniq had failed to check for permissions in its web app so every user was able to see every question asked by other members – simply by guessing the ID number of the question.

Yet "The cloud!" is still a common argument in marketing and amongst clueless bosses and developers where nobody realizes (or admits) how insecure it is usually.

More than 60% of tech workers feel they're underpaid

Found on CNBC on Monday, 30 July 2018
Browse Various

"This is in an industry," Quartz reports, "where interns can make over $50 an hour, new grads can get $100,000 signing bonuses, and the average employee makes more than double the national average in the U.S."

Cisco, Intel, Expedia, VMware and Microsoft employees were the most likely to say that they did not make enough money. Cisco had the highest percentage of dissatisfied employees, with 80 percent telling Blind that they did not feel adequately compensated.

It's suprising that it's not 100% who feel underpaid.

364 Idaho Inmates Hacked Their Prison Tablets for Free Credits

Found on Bleeping Computer on Saturday, 28 July 2018
Browse Various

Idaho prison officials announced yesterday in a press release that they've identified 364 inmates who have exploited a vulnerability in their prison-issued tablets and have used it to assign nearly $225,000 worth of digital credits to their tablet accounts.

Spokespersons for both companies said the vulnerability inmates exploited was identified and fixed. Officials from the Idaho Department of Correction (IDC) said there was no loss of state funds as a result of the hack, as inmates transferred only JPay-managed (fictitious) digital credits to their accounts.

Somwhow, prisons are not what they used to be. They sound more like hotels now.

Facebook stock dives nearly 20% on warning of slow revenue growth

Found on Ars Technica on Thursday, 26 July 2018
Browse Various

Facebook has shown that it cannot sail forever forward while facing various storms, including Cambridge Analytica and the Russian government's use of the social media platform to sow divisions amongst Americans during the 2016 presidential campaign.

Wall Street didn’t take too kindly to that: Facebook’s stock price dropped nearly 20 percent in after-hours trading.

It's about time.

Microsoft: The Kremlin's hackers are already sniffing, probing around America's 2018 elections

Found on The Register on Saturday, 21 July 2018
Browse Various

Speaking at an event in Aspen, Colorado, earlier this week, Microsoft vice president of security and trust Tom Burt revealed that the FancyBear hacking group has already begun setting up the infrastructure to perform targeted phishing attacks on multiple candidates.

The report notes that the government has created a task force, including multiple agencies and states attorney generals, that will focus on detecting and prosecuting attempts to affect the outcome of the mid-term vote.

It's not like the US is all innocent and would never ever try anything similar. Pretty much every country plays dirty; some just care less if others know about it.

The 5,000% price hike that made Martin Shkreli infamous is no longer paying off

Found on Ars Technica on Friday, 20 July 2018
Browse Various

As founder and CEO of Turing, Shkreli bought the rights to the cheap, off-patent drug and—without any generic competitors—abruptly raised its price from $13.50 a pill to $750 a pill in the fall of 2015.

Turing, meanwhile changed its name and tried to distance itself from Shkreli—without lowering Daraprim’s price. In light of the dwindling profits, the company is reportedly considering changing its name once again, this time to “Phoenixus.”

There should be a law that should make such price changes flat out illegal and invalid the patent so everybody can freely produce the drug for a fair price.

Hackers Breach Russian Bank and Steal $1 Million Due to Outdated Router

Found on Bleeping Computer on Thursday, 19 July 2018
Browse Various

"The router had tunnels that allowed the attackers to gain direct access to the bank’s local network," Group-IB experts said. "This technique is a characteristic of MoneyTaker. This scheme has already been used by this group at least three times while attacking banks with regional branch networks."

On July 3, MoneyTaker used this system to transfer funds from PIR Bank's account at the Bank of Russia to 17 accounts they created in advance. Moments after the stolen funds landed in these accounts, money mules withdrew it from ATMs across Russia.

It has to be a quite organized group to pull that off. Looks like people can make a living out of that.

What's in a name? For Cambridge Analytica, about a quid apparently

Found on The Register on Tuesday, 17 July 2018
Browse Various

The firms – Cambridge Analytica, SCL Elections, SCL Group, SCL Commercial, SCL Social and SCL Analytics – were all too heavily associated with the furore surrounding an app that sucked up information on 87 million Facebook users to continue operating. Similarly, Cambridge Analytica US and SCL US both filed for bankruptcy.

The administrators said that the initial plan was to try and sell off the firm, sending an "email taster" to about 18,000 prospective buyers, along with marketing pushes on social media. Sales details were sent out to 13 parties and four offers were received.

Nobody will buy anything from this massive failure; you'd have to put money on top to make someone take it.