We found 6 critical PayPal vulnerabilities – and PayPal punished us for it

Found on Cybernews on Monday, 24 February 2020
Browse Internet

Ever since PayPal moved its bug bounty program to HackerOne, its entire system for supporting bug bounty hunters who identify and report bugs has become more opaque, mired in illogical delays, vague responses, and suspicious behavior.

When we pushed the HackerOne staff for clarification on these issues, they removed points from our Reputation scores, relegating our profiles to a suspicious, spammy level. This happened even when the issue was eventually patched, although we received no bounty, credit, or even a thanks.

Lesson learned? Either sell your PayPal exploits on underground markets, or make them immediately public as 0-days and let them deal with it that way. No good deed goes unpunished when it comes to PayPal.

Google Is Letting People Find Invites to Some Private WhatsApp Groups

Found on Motherboard on Sunday, 23 February 2020
Browse Internet

Google is indexing invite links to WhatsApp group chats whose administrators may want to be private. This means with a simple search, random people can discover and join a wide range of WhatsApp group chats.

App reverse-engineer Jane Wong added in a tweet that Google has around 470,000 results for a simple search of "chat.whatsapp.com," part of the URL that makes up invites to WhatsApp groups.

So people post links to "secret" groups somewhere on the Internet and are supposed to be surprised because Google indexes them? People are dumber than you would think.

CTO calls for patience after devs complain promised donations platform has stalled

Found on The Register on Saturday, 22 February 2020
Browse Software

At the end of August, JavaScript package registry NPM Inc said it intended "to finalize and launch an Open Source funding platform by the end of 2019."

Funding has also been a concern for NPM Inc, which was said last year to be running short on cash. Asked about the financial state of the biz, Schlueter didn't get into specifics but suggested things have been going well.

If you intend to put money into npm, you should see a doctor.

Hackers can trick a Tesla into accelerating by 50 miles per hour

Found on Technology Review on Friday, 21 February 2020
Browse Technology

The researchers stuck a tiny and nearly imperceptible sticker on a speed limit sign. The camera read the sign as 85 instead of 35, and in testing, both the 2016 Tesla Model X and that year’s Model S sped up 50 miles per hour.

Tesla has since moved to proprietary cameras on newer models, and Mobileye EyeQ3 has released several new versions of its cameras that in preliminary testing were not susceptible to this exact attack.

So every time a bug is found, you're supposed to either have parts of your car replaced, or just buy a new one? When such cars get more common, such pranks will increase.

Leaked Document Shows How Big Companies Buy Credit Card Data on Millions of Americans

Found on Vice on Thursday, 20 February 2020
Browse Various

Yodlee, the largest financial data broker in the U.S., sells data pulled from the bank and credit card transactions of tens of millions of Americans to investment and research firms, detailing where and when people shopped and how much they spent. The company claims that the data is anonymous, but a confidential Yodlee document obtained by Motherboard indicates individual users could be unmasked.

"Let me be blunt. This is bullshit 'anonymization,'" Nicholas Weaver, a senior researcher at the International Computer Science Institute at UC Berkeley, told Motherboard in an email after reviewing a section of the document.

Anonymization does not work for any suffiently large set of data. It's just marketing speak to attempt and soothe people.

YouTube Gaming's Most-Watched Videos Are Dominated by Scams and Cheats

Found on Wired on Wednesday, 19 February 2020
Browse Various

In January, all seven of the most-watched YouTube Gaming channels weren’t run by happy gamers livestreaming the game du jour. They were instead recorded, autoplaying videos advertising videogame cheats and hacks, sometimes attached to sketchy, credential-vacuuming websites, according to one analytics firm. The trend has continued into this month, with five of the top seven most-watched YouTube Gaming channels last weekend advertising cheats.

Queen PSH, has been active since October 2016, and appears to engage in a common form of scamming, says Zack Allen, director of threat intelligence at security firm ZeroFox. After you fill in your personal information—anything from your address to your credit card number—these types of sites will often turn around and sell it. Other times, sites that promise cheats or in-game money will download malware onto your computer.

It really looks like the younger generation, those so-called "digital natives" are much easier to scam than older people. So much for the theory that growing up with a new technology makes you better at handling it.

The Paywalled Garden: iOS is Adware

Found on Steve Streza on Tuesday, 18 February 2020
Browse Various

Over the years, Apple has built up a portfolio of services and add-ons that you pay for. Starting with AppleCare extended warranties and iCloud data subscriptions, they expanded to Apple Music a few years ago, only to dramatically ramp up their offerings last year with TV+, News+, Arcade, and Card.

All that money comes from the wallets of 480 million subscribers, and their goal is to grow that number to 600 million this year. But to do that, Apple has resorted to insidious tactics to get those people: ads. Lots and lots of ads, on devices that you pay for.

If you don’t subscribe to these services, you’ll be forced to look at these ads constantly, either in the apps you use or the push notifications they have turned on by default.

Luckily there is a very simple solution: just don't buy these overpriced gadgets.

Why Did Twitter Just "Lockdown" WikiLeaks Account?

Found on Zerohedge on Monday, 17 February 2020
Browse Censorship

Just hours after a secret meeting with Silicon Valley tech giants to discuss censorship of "misinformation" surrounding coronavirus, and just days before Julian Assange's extradition hearings are set to continue, Kristin Hrafnsson - a WikiLeaks' journalist - reports that the WikiLeaks' Twitter account has been locked-down...

As The Washington Examiner noted as far back at 2016, Twitter lit up in late July with allegations that it tried to suppress news that secret-leaking website Wikileaks exposed thousands of emails obtained from the servers of the Democratic National Committee.

Just a "happy little accident", you bet.

Mark Zuckerberg: Facebook boss urges tighter regulation

Found on BBC News on Sunday, 16 February 2020
Browse Internet

Facebook boss Mark Zuckerberg has called for more regulation of harmful online content, saying it was not for companies like his to decide what counts as legitimate free speech.

The Facebook founder urged governments to come up with a new regulatory system for social media, suggesting it should be a mix of existing rules for telecoms and media companies.

It's too expensive for Facebook and does not generate any revenue, but only bad PR because of the censoring, so naturally Zuck wants to offload these decisions to the governments. Sure he would not want tighter regulations for the (ab)use of the users' most private and personal data for advertising, profiling and sales, because that is something completely different.

“I was just shaking”—new documents reveal details of fatal Tesla crash

Found on Ars Technica on Saturday, 15 February 2020
Browse Technology

The case attracted wide attention because Banner had engaged Tesla's Autopilot technology. Not only that, the circumstances of Banner's death were almost identical to the first Autopilot-related death in the United States: the death of Josh Brown in 2016. Brown was also killed when Autopilot failed to stop for a semi truck crossing in front of him on a Florida highway.

The momentum of Banner's Model 3 carried the vehicle far down the road—apparently so far that Wood didn't see it when he got out of his truck. Wood says it was only a few minutes later, as he saw the lights of emergency vehicles in the distance, that he realized the awful truth.

Maybe some day it might be possible for a car to drive automatically, without making any mistakes; but it's just not worth it. If you do not want to drive, use public transport.