The Bodleian Libraries at Oxford acquired a recently-discovered map of Middle-earth annotated by JRR Tolkien , “which reveals his remarkable vision of the creatures, topography and heraldry of his imagined world where The Hobbit and The Lord of the Rings take place. The annotated map went unseen for decades until October 2015 when Blackwell’s Rare Books in Oxford put the map on display and offered it for sale.” (Thanks, Gary Price!)
Read the original:
University of Oxford acquires rare map of Middle-earth annotated by Tolkien
Researchers have discovered flaws in Samsung’s Smart Home automation system, which if exploited, allows them to carry a range of remote attacks. These attacks include digitally picking connected door locks from anywhere in the world. The flaws have been documented by researchers from the University of Michigan ahead of the 2016 IEEE Symposium on Security and Privacy. “All of the above attacks expose a household to significant harm — break-ins, theft, misinformation, and vandalism, ” the researchers wrote in a paper. “The attack vectors are not specific to a particular device and are broadly applicable.” Dan Goodin, reports for Ars Technica: Other attacks included a malicious app that was able to obtain the PIN code to a smart lock and send it in a text message to attackers, disable a preprogrammed vacation mode setting, and issue a fake fire alarm. The one posing the biggest threat was the remote lock-picking attack, which the researchers referred to as a “backdoor pin code injection attack.” It exploited vulnerabilities in an existing app in the SmartThings app store that gives an attacker sustained and largely surreptitious access to users’ homes. The attack worked by obtaining the OAuth token that the app and SmartThings platform relied on to authenticate legitimate users. The only interaction it required was for targeted users to click on an attacker-supplied HTTPS link that looked much like this one that led to the authentic SmartThings login page. The user would then enter the username and password. A flaw in the app allowed the link to redirect the credentials away from the SmartThings page to an attacker-controlled address. From then on, the attackers had the same remote access over the lock that users had. Read more of this story at Slashdot. 