america – Page 2 – Tech Today w/ Ken May

Anthem To Pay $115 Million In The Largest Data Breach Settlement Ever

An anonymous reader quotes CNET: Anthem, the largest health insurance company in the U.S., has agreed to settle a class action lawsuit over a 2015 data breach for a record $115 million, according to lawyers for the plaintiffs. The settlement still has to be approved by US District Court Judge Lucy Koh, who is scheduled to hear the case on August 17 in San Jose, California. And Anthem, which didn’t immediately respond to a request for confirmation and comment, isn’t admitting any admitting any wrongdoing, according to a statement it made to CyberScoop acknowledging the settlement. But if approved, it would be the largest data breach settlement in history, according to the plaintiffs’ lawyers, who announced the agreement Friday. The funds would be used to provide victims of the data breach at least two years of credit monitoring and to reimburse customers for breach-related expenses. The settlement would also guarantee a certain level of funding for “information security to implement or maintain numerous specific changes to its data security systems, including encryption of certain information and archiving sensitive data with strict access controls, ” the plaintiff attorneys said. The breach compromised data for 80 million people, including their social security numbers, birthdays, street addresses (and email addresses) as well as income data. The $115 million settlement averages out to $1.43 for every person who was affected. Read more of this story at Slashdot.

Cisco Subdomain Private Key Found in Embedded Executable

Earlier this month, a developer accidentally discovered the private key of a Cisco subdomain. An anonymous reader shares the post: Last weekend, in an attempt to get Sky’s NOW TV video player (for Mac) to work on my machine, I noticed that one of the Cisco executables contains a private key that is associated with the public key in a trusted certificate for a cisco.com sub domain. This certificate is used in a local WebSocket server, presumably to allow secure Sky/NOW TV origins to communicate with the video player on the users’ local machines. I read the Baseline Requirements document (version 1.4.5, section 4.9.1.1), but I wasn’t entirely sure whether this is considered a key compromise. I asked Hanno Bock on Twitter, and he advised me to post the matter to this mailing list. The executable containing the private key is named ‘CiscoVideoGuardMonitor’, and is shipped as part of the NOW TV video player. In case you are interested, the installer can be found here (SHA-256: 56feeef4c3d141562900f9f0339b120d4db07ae2777cc73a31e3b830022241e6). I would recommend to run this installer in a virtual machine, because it drops files all over the place, and installs a few launch items (agents/daemons). The executable ‘CiscoVideoGuardMonitor’ can be found at ‘$HOME/Library/Cisco/VideoGuardPlayer/VideoGuardMonitor/ VideoGuardMonitor.bundle/Contents/MacOS/CiscoVideoGuardMonitor’. Certificate details: Serial number: 66170CE2EC8B7D88B4E2EB732E738FE3A67CF672, DNS names: drmlocal.cisco.com, Issued by: HydrantID SSL ICA G2. The issuer HydrantID has since communicated with the certificate holder Cisco, and the certificate has been revoked. Read more of this story at Slashdot.

Link:
Cisco Subdomain Private Key Found in Embedded Executable

You Can Hack Some Mazda Cars With a USB Flash Drive

An anonymous reader writes: “Mazda cars with next-gen Mazda MZD Connect infotainment systems can be hacked just by plugging in a USB flash drive into their dashboard, thanks to a series of bugs that have been known for at least three years, ” reports Bleeping Computer. “The issues have been discovered and explored by the users of the Mazda3Revolution forum back in May 2014. Since then, the Mazda car owner community has been using these ‘hacks’ to customize their cars’ infotainment system to tweak settings and install new apps. One of the most well-designed tools is MZD-AIO-TI (MZD All In One Tweaks Installer).” Recently, a security researcher working for Bugcrowd has put together a GitHub repository that automates the exploitation of these bugs. The researcher says an attacker can copy the code of his GitHub repo on a USB flash drive, add malicious scripts and carry out attacks on Mazda cars. Mazda said the issues can’t be exploited to break out of the infotainment system to other car components, but researchers disagreed with the company on Twitter. In the meantime, the car maker has finally plugged the bugs via a firmware update released two weeks ago. Read more of this story at Slashdot.

See the original article here:
You Can Hack Some Mazda Cars With a USB Flash Drive

No, Your Phone Didn’t Ring. So Why Voice Mail From a Telemarketer?

Slashdot reader midwestsilentone tipped us off to a growing problem. Lifehacker reports: New technology allows telemarketers to leave ringless voicemail messages, and it’s a method that’s gaining traction. While there are laws to regulate businesses when they call consumers, some groups argue that ringless voicemail shouldn’t count. The New York Times reports, “ringless voicemail providers and pro-business groups…argue that these messages should not qualify as calls and, therefore, should be exempt from consumer protection laws that ban similar types of telephone marketing”… After receiving a petition from a ringless voicemail provider, the Federal Trade Commission has started to collect public comments on this issue. So what can you do about it? First, you can head here to leave your public comment and if you’re getting these voicemails, you can file a complaint with the FCC here. Presumably that only applies if you’re in the U.S. But I’d be curious to hear how many Slashdot readers have experienced this. Read more of this story at Slashdot.

Russian Malware Communicates Using Britney Spears’s Instagram Account

JustAnotherOldGuy writes: A key weakness in malicious software is the “Command and Control” (C&C) system — a central server that the malware-infected systems contact to receive updates and instructions, and to send stolen data. Anti-malware researchers like to reverse engineer malicious code, discover the C&C server’s address, and then shut it down. Turla is an “advanced persistent threat” hacking group based in Russia with a long history of attacking states in ways that advance Russian state interests. A new analysis by Eset shows that Turla is solving its C&C problems by using Britney Spears’ Instagram account as a cut-out for its C&C servers. Turla moves the C&C server around, then hides the current address of the server in encrypted comments left on Britney Spears’s image posts. The compromised systems check in with Spears’ Instagram whenever they need to know where the C&C server is currently residing. Read more of this story at Slashdot.

Continue reading here:
Russian Malware Communicates Using Britney Spears’s Instagram Account

Verizon is forced to fix 15,000 “double poles” and other network problems

Enlarge / Dangling bits of old poles hanging off new poles, from a union complaint against Verizon in October 2015. (credit: CWA ) Verizon and a union representing its workers have reached a settlement requiring the company to fix thousands of problems in areas of Pennsylvania where it hasn’t upgraded its copper network to fiber. The settlement of the union’s complaint “will require the company to repair and replace bad cable, defective equipment, faulty back-up batteries, and to take down 15,000 double telephone poles,” the Communications Workers of America (CWA) said Friday . Double poles occur when “Verizon has failed to move its equipment from an old pole that was replaced with a new one by another utility (e.g., the electric company),” the CWA said. “In many cases, these are dangerous conditions—poles are falling, leaning, rotting, partially cut off, etc.” Read 12 remaining paragraphs | Comments

Read the article:
Verizon is forced to fix 15,000 “double poles” and other network problems

Reddit Users Lose Real Money After Meme Currency Bot Dies

Another day, another cryptocurrency clusterfuck. This week, the creator of the tipping bot “dogetipbot”—a service that let Reddit users “tip” each other in Dogecoin— announced that his company is broke, he’s broke, and the bot is broke because he spent all the coins, after he himself ran out of money. Read more…

Taken from:
Reddit Users Lose Real Money After Meme Currency Bot Dies

Reddit Users Lose Real Money After Meme Currency Bot Dies

Another day, another cryptocurrency clusterfuck. This week, the creator of the tipping bot “dogetipbot”—a service that let Reddit users “tip” each other in Dogecoin— announced that his company is broke, he’s broke, and the bot is broke because he spent all the coins, after he himself ran out of money. Read more…

Reddit Users Lose Real Money After Meme Currency Bot Dies

Another day, another cryptocurrency clusterfuck. This week, the creator of the tipping bot “dogetipbot”—a service that let Reddit users “tip” each other in Dogecoin— announced that his company is broke, he’s broke, and the bot is broke because he spent all the coins, after he himself ran out of money. Read more…

NIST’s Draft To Remove Periodic Password Change Requirements Gets Vendors’ Approval

An anonymous reader writes: A recently released draft of the National Institute of Standards and Technology’s digital identity guidelines has met with approval by vendors. The draft guidelines revise password security recommendations and altering many of the standards and best practices security professionals use when forming policies for their companies. The new framework recommends, among other things: “Remove periodic password change requirements.” There have been multiple studies that have shown requiring frequent password changes to actually be counterproductive to good password security, said Mike Wilson, founder of PasswordPing. NIST said this guideline was suggested because passwords should be changed when a user wants to change it or if there is indication of breach. Read more of this story at Slashdot.