Buildings in China are shrouded in smog. From a report: China has implemented an unprecedented pollution crackdown in recent months as the country shuts down tens of thousands of factories. The effort is part of a national effort to address China’s infamous pollution and has affected wide swaths of China’s manufacturing sector. In total, it is estimated that 40 percent of all China’s factories have been shut down at some point in order to be inspected by environmental bureau officials. As a result of these inspections over 80, 000 factories have been hit with fines and criminal offenses as a result of their emissions. Safety officials have been moving from province to province (30 in total so far) shutting down factories as well as electricity and gas as they inspect the factories for meeting emissions requirements. This has resulted in late and missed orders, increased costs, and could ultimately result in higher prices on US shelves. Read more of this story at Slashdot.
View original post here:
China Shuts Down Tens Of Thousands Of Factories In Widespread Pollution Crackdown
An anonymous reader quotes BleepingComputer: The Slovak National Security Office (NBU) has identified ten malicious Python libraries uploaded on PyPI — Python Package Index — the official third-party software repository for the Python programming language. NBU experts say attackers used a technique known as typosquatting to upload Python libraries with names similar to legitimate packages — e.g.: “urlib” instead of “urllib.” The PyPI repository does not perform any types of security checks or audits when developers upload new libraries to its index, so attackers had no difficulty in uploading the modules online. Developers who mistyped the package name loaded the malicious libraries in their software’s setup scripts. “These packages contain the exact same code as their upstream package thus their functionality is the same, but the installation script, setup.py, is modified to include a malicious (but relatively benign) code, ” NBU explained. Experts say the malicious code only collected information on infected hosts, such as name and version of the fake package, the username of the user who installed the package, and the user’s computer hostname. Collected data, which looked like “Y:urllib-1.21.1 admin testmachine”, was uploaded to a Chinese IP address. NBU officials contacted PyPI administrators last week who removed the packages before officials published a security advisory on Saturday.” The advisory lays some of the blame on Python’s ‘pip’ tool, which executes arbitrary code during installations without requiring a cryptographic signature. Ars Technica also reports that another team of researchers “was able to seed PyPI with more than 20 libraries that are part of the Python standard library, ” and that group now reports they’ve already received more than 7, 400 pingbacks. Read more of this story at Slashdot. 
Josh Schwartz, Salesforce’s director of offensive security, and John Cramb, a senior offensive security engineer, have been fired by the company after they gave talk at the Defcon security conference talk in Las Vegas last month, reports ZDNet. Schwartz and Cramb were presenting the details of their tool, called Meatpistol, a “modular malware implant framework (PDF)” similar in intent to the Metasploit toolkit used by many penetration testers. The tool, “pitched as taking ‘the boring work’ out of pen-testing to make red teams, including at Salesforce, more efficient and effective”, was anticipated to be released as open source at the time of the presentation, but Salesforce has held back the code. From the report: The two were fired “as soon as they got off stage” by a senior Salesforce executive, according to one of several people who witnessed the firing and offered their accounts. The unnamed Salesforce executive is said to have sent a text message to the duo half an hour before they were expected on stage to not to give the talk, but the message wasn’t seen until after the talk had ended. The talk had been months in the making. Salesforce executives were first made aware of the project in a February meeting, and they had signed off on the project, according to one person with knowledge of the meeting. The tool was expected to be released later as an open-source project, allowing other red teams to use the project in their own companies. But in another text message seen by Schwartz and Cramb an hour before their talk, the same Salesforce executive told the speakers that they should not announce the public release of the code, despite a publicized and widely anticipated release. Later, on stage, Schwartz told attendees that he would fight to get the tool published. Read more of this story at Slashdot. 
An anonymous reader quotes a report from TorrentFreak: Two years ago, academic publisher Elsevier filed a complaint (PDF) against Sci-Hub and several related “pirate” sites. It accused the websites of making academic papers widely available to the public, without permission. While Sci-Hub is nothing like the average pirate site, it is just as illegal according to Elsevier’s legal team, who obtained a preliminary injunction from a New York District Court last fall. The injunction ordered Sci-Hub’s founder Alexandra Elbakyan to quit offering access to any Elsevier content. However, this didn’t happen. Instead of taking Sci-Hub down, the lawsuit achieved the opposite. Sci-Hub grew bigger and bigger up to a point where its users were downloading hundreds of thousands of papers per day. Although Elbakyan sent a letter to the court earlier, she opted not engage in the U.S. lawsuit any further. The same is true for her fellow defendants, associated with Libgen. As a result, Elsevier asked the court for a default judgment and a permanent injunction which were issued this week. Following a hearing on Wednesday, the Court awarded Elsevier $15, 000, 000 in damages, the maximum statutory amount for the 100 copyrighted works that were listed in the complaint. In addition, the injunction, through which Sci-Hub and LibGen lost several domain names, was made permanent. Read more of this story at Slashdot.