Enlarge / A customer in Apple’s store in Auckland, New Zealand, in 2010. A report by a major New Zealand newspaper found Apple hasn’t paid any taxes in New Zealand. (credit: Brendon O’Hagan / AFP / Getty Images ) The big technology story in New Zealand this weekend is about Apple’s tax bill. Or rather, the lack thereof. The electronics giant sold $4.2 billion (NZD) worth of products in New Zealand, but it didn’t pay any local tax at all. That’s according to a Saturday report from the New Zealand Herald . Apple did pay $37 million in income tax based on its New Zealand sales, but it paid that money to the Australian government, since that’s where the New Zealand operation is run from. The arrangement to send the tax on New Zealand profits to Australia has been in place since at least 2007. Experts confirmed the arrangement is legal under New Zealand law. Read 9 remaining paragraphs | Comments
See the original post:
Apple sold $4.2 billion of product in New Zealand, paid $0 local taxes
Security researchers at KU Leuven have discovered an attack technique, dubbed HEIST (HTTP Encrypted Information can be Stolen Through TCP-Windows), which can exploit an encrypted website using only a JavaScript file hidden in a maliciously crafted ad or page. ArsTechnica reports: Once attackers know the size of an encrypted response, they are free to use one of two previously devised exploits to ferret out the plaintext contained inside it. Both the BREACH and the CRIME exploits are able to decrypt payloads by manipulating the file compression that sites use to make pages load more quickly. HEIST will be demonstrated for the first time on Wednesday at the Black Hat security conference in Las Vegas. “HEIST makes a number of attacks much easier to execute, ” Tom Van Goethem, one of the researchers who devised the technique, told Ars. “Before, the attacker needed to be in a Man-in-the-Middle position to perform attacks such as CRIME and BREACH. Now, by simply visiting a website owned by a malicious party, you are placing your online security at risk.” Using HEIST in combination with BREACH allows attackers to pluck out and decrypt e-mail addresses, social security numbers, and other small pieces of data included in an encrypted response. BREACH achieves this feat by including intelligent guesses — say, @gmail.com, in the case of an e-mail address — in an HTTPS request that gets echoed in the response. Because the compression used by just about every website works by eliminating repetitions of text strings, correct guesses result in no appreciable increase in data size while incorrect guesses cause the response to grow larger. Read more of this story at Slashdot.