data – Tech Today w/ Ken May

Accenture left four servers of sensitive data completely unprotected

UpGuard has yet again uncovered a trove of corporate data left unprotected, this time from major consulting and management firm Accenture . The data — contained on four cloud-based storage servers — were discovered by UpGuard Director of Cyber Risk Research Chris Vickery in mid-September and weren’t protected by a password. Anyone with the servers’ web addresses could download the stored information, which included decryption keys, passwords and customer info. And Accenture’s client list includes a number of large companies. On its website , Accenture says its clients “span the full range of industries around the world and include 94 of the Fortune Global 100 and more than three-quarters of the Fortune Global 500.” UpGuard says that the information stored on the unprotected servers could have been used to attack Accenture itself as well as a number of its clients and Vickery told ZDNet that the data amounted to the “keys to the kingdom.” In a blog post about the exposure, UpGuard said, “Taken together, the significance of these exposed buckets is hard to overstate. In the hands of competent threat actors, these cloud servers, accessible to anyone stumbling across their URLs, could have exposed both Accenture and its thousands of top-flight corporate customers to malicious attacks that could have done an untold amount of financial damage.” This data exposure is just the latest to be sniffed out by cybersecurity firm UpGuard. Other recent discoveries by the company include Election Systems & Software’s exposure of 1.8 million Chicago residents’ personal information, Deep Root Analytics’ leak of nearly 200 million US citizens’ data, the release of 14 million Verizon customers’ info by Nice Systems and exposure of classified intelligence data by a US defense contractor. In light of these repeated mishandlings of sensitive data, it’s becoming increasing clear that major companies need to take a serious look at their cybersecurity practices. UpGuard quickly notified Accenture after discovering the exposed data and the company secured the servers soon thereafter. Accenture also said that UpGuard was the only non-authorized visitor to access the servers. Accenture told ZDNet , “We closed the exposure when the Amazon Web Services S3 issue was first reported. As we continue our forensic review we may learn more but, the email and password information in the database is more than two and a half years old and for Accenture users of a decommissioned system.” Source: UpGuard

Read the article:
Accenture left four servers of sensitive data completely unprotected

Equifax CEO Richard Smith suddenly decides to ‘retire’

Equifax has been in the news lately for all the wrong reasons, following a chain of blunders and mismanagement after it revealed that a security breach leaked the personal data of 143 million people . This morning, the CEO of Equifax and chairman of its board, Richard Smith, retired effective immediately. In a release, Equifax stated that it has appointed Paulino do Rego Barros, Jr., as interim CEO. He’s been with the company for seven years and most recently was the president of Equifax’s Asia Pacific division. Smith will stay on as an unpaid advisor to oversee a smooth transition. He cites the reason for his departure as the data breach: “At this critical juncture, I believe it is in the best interests of the company to have new leadership to move the company forward, ” he said. Smith is the latest casualty of the epic breach (their Chief Security Officer and Chief Information Officer also “retired” ), which has been catastrophically mishandled by Equifax. The company’s failure to patch a well-known security hole is the reason hackers were able to gain access to the data. The company’s executives are also under DOJ investigation for suspiciously timed stock sales that occurred after Equifax realized the breach had occurred but before it disclosed information to the public. And their credit freeze pins had security issues of their own . It’s unclear whether new management will ease Equifax’s woes, after how mishandled this entire breach has been from the start. Senators have called for credit report changes , allowing for consumers to have more power over their information. It makes sense; credit agencies should be held accountable when they make terrible errors in judgment and don’t take action to protect the sensitive personal data they handle every day. Via: CNBC Source: Equifax

Data leak exposed millions of Time Warner Cable customers

Verizon isn’t the only big US telecom whose corporate ally left customer data out in the open . MacKeeper developer Kromtech has discovered that BroadSoft, a frequent partner to service providers, was storing over 4 million Time Warner Cable customer records on Amazon cloud servers without a password. The records, which stemmed from the MyTWC mobile app, date as far back as November 2010 — years before Charter bought TWC . The information included email addresses, user names, financial transactions (though there’s no indication of credit card data) and billing addresses. There was even closed-circuit camera footage from BroadSoft’s Indian offices, as if to rub salt in the wound. You might not need to panic. BroadSoft tells Gizmodo that it locked down its Amazon data (Charter says it was taken down) and hasn’t seen evidence that intruders accessed the information. Both BroadSoft and Charter say they’re investigating and will take extra steps to address the situation if necessary. To be on the safe side, though, Charter is recommending that MyTWC owners change their user names and passwords. The exposure didn’t include extremely sensitive info like credit card data or social security numbers, so the potential damage is relatively limited. However, it’s not so much the specific threat as that the data was left exposed in the first place. It shows that companies are still making rookie mistakes when handling data, and suggests that they need to implement more stringent (and importantly, continuous) oversight of their partners to keep your data secure. Via: Gizmodo Source: Kromtech

Motiv crammed a full fitness tracker into a ring

Fitness trackers are a dime a dozen at this point, with Fitbit dominating the market. But as long as wearable gadgets have been in vogue, the concept of a “smart ring” has made the rounds in various forms. Here at CES, it looks like Motiv is the closest yet to cracking the puzzle of building a ring that’s worth wearing. Motiv’s ring is basically a tiny Fitbit: it packs in a heart rate sensor and can track your steps, sleep and “active minutes” with a goal of getting its users to be active for at least 150 minutes per week. The ring itself is very light, fairly unobtrusive and comes in grey and rose gold. Motiv says its has an “ultralight titanium shell” that felt a little cheap to me — hopefully it’ll prove to be durable. The battery is charged with an included magnetic charging dock that plugs into any standard USB port; Motiv is actually including two so you can throw one on your keychain and forget about it. Naturally, the ring syncs to a smartphone app where you can get data on what it measures. The ring has heart rate tracking built-in; that’s how it knows when you’re working out hard enough to count minutes towards your daily activity goal. A Motiv spokesperson said that the ring uses active minutes because it’s a less abstract goal than 10, 000 steps or a certain amount of calories burned, and it does seem like something with the potential to encourage slightly more active exercise. But it also works as a pedometer if you’re used to tracking steps over other metrics. All this data is stored in the app, which uses a card interface to keep you updated on your goals, showing you high-level overviews of your day and week. If you want to dig down into the data, though, the app lets you scan minute by minute to see exactly what were you up to, whether you were awake or asleep. My big question about the Motiv is its manufacturing feasibility — we’ve been burned by smart rings before that just couldn’t figure out the battery tech necessary to work. Motiv’s spokesperson told me that the company designed its curved battery itself; he also said that the device is in production after a lengthy beta period. The model he was wearing appeared to be functional, so it seems like the ring should make it onto the market this spring as planned. If you’re interested and willing to take a bit of a gamble on an unproven company, pre-orders for the $199 Motiv started today. To get the sizing right, Motiv will send buyers a kit with fake rings in it so you can try them on and see what fits best. The Motiv may not do anything differently than the Fitbit, but if you’re interested in having an extremely low-profile device this may be worth a look. Of course, we’ll need to put one through a full review to really recommend it, but on the surface the Motiv is intriguing at the very least. Click here to catch up on the latest news from CES 2017.

More:
Motiv crammed a full fitness tracker into a ring

Singularity Watch: This AI Taught Itself to Read Lips Better Than Humans

A team of researchers at Oxford University have coaxed an artificial intelligence program into an impressive leap forward and towards our own obsolescence. The program, known as LipNet, is showing particularly promising ability to read lips in video clips, thanks to machine learning and a novel way of approaching the data. The key difference is that rather than try to teach the AI the mouth shapes of single words and phonemes, the LipNet is asked to interpret whole sentences. Using GRID, a huge bank of 3 second videos featuring brightly lit forward facing speakers, LipNet has learned to translate speech to text with a 93.4% accuracy rate. Compare that to humans’ 52.3%. It doesn’t look good. To accomplish this, the team ran over 28, 000 videos of actors speaking syntactically similar sentences through a neural network. Each contained a command, color, letter, number, preposition, and adverb, in the same order. When tested using 300 of the same sentence types, human lip reading translators had an error rate of 47.7%, whereas LipNet netted just 6.6%. With this kind of accuracy, we might see better automation of closed captioning on news and entertainment videos, and some speculate it may be a feature in more personal communication as well. Imagine realtime translation of a Skype or FaceTime conversation with poor audio quality. I want that already. Detractors are quick to point out the structural limitations of the data set used, since apparently most movies, news and YouTube videos don’t only feature well lit actors speaking directly into a camera in short sentences. However, given incrementally useful data sets, the LipNet framework appears capable of learning enough to do good, even if it won’t be stealing jobs any time soon. Check out the testing data and paper here .

Excerpt from:
Singularity Watch: This AI Taught Itself to Read Lips Better Than Humans

Police complaints drop 93 percent after deploying body cameras

A study from Cambridge University documents an immense drop in complaints against police officers when their departments began using body cameras. But even more surprising is that the data suggests everyone is on their best behavior whether the cameras are present or not. Read More

View the original here:
Police complaints drop 93 percent after deploying body cameras

Amazon Video now lets you download content to Android SD cards

Android users now have another, more convenient option to make use of their Amazon Prime Video subscriptions. Amazon pushed out an update that lets Android users download movies, videos, and other content from its Prime Video service to the SD cards in their handsets. Previously, Amazon only allowed content to be saved to the internal storage on those smartphones. With this update, not only will users be able to save their internal storage for other content, but they could potentially download content to multiple SD cards, switch those cards in and out of their handsets, and watch all of that content offline. In addition to Amazon Prime videos, users can download any videos they’ve purchased to their SD cards. This feature is something only Android users can take advantage of, since iPhones lack the requisite SD card slot. The feature is rolling out on Android tablets and smartphones starting today in the US, UK, Germany, Austria, and Japan. Read on Ars Technica | Comments

View article:
Amazon Video now lets you download content to Android SD cards

20-year-old Windows bug lets printers install malware—patch now

Enlarge (credit: Vectra Networks) For more than two decades, Microsoft Windows has provided the means for clever attackers to surreptitiously install malware of their choice on computers that connect to booby-trapped printers, or other devices masquerading as printers, on a local area network. Microsoft finally addressed the bug on Tuesday during its monthly patch cycle. The vulnerability resides in the Windows Print Spooler, which manages the process of connecting to available printers and printing documents. A protocol known as Point-and-Print allows people who are connecting to a network-hosted printer for the first time to automatically download the necessary driver immediately before using it. It works by storing a shared driver on the printer or print server and eliminates the hassle of the user having to manually download and install it. Researchers with security firm Vectra Networks discovered that the Windows Print Spooler doesn’t properly authenticate print drivers when installing them from remote locations. The failure makes it possible for attackers to use several different techniques that deliver maliciously modified drivers instead of the legitimate one provided by the printer maker. The exploit effectively turns printers, printer servers, or potentially any network-connected device masquerading as a printer into an internal drive-by exploit kit that infects machines whenever they connect. Read 9 remaining paragraphs | Comments

Continue reading here:
20-year-old Windows bug lets printers install malware—patch now

Posing as ransomware, Windows malware just deletes victim’s files

Scammers, via Cisco Talos Ranscam’s “ransom note”: Pay us and then we’ll make everything better. 2 more images in gallery There has been a lot of ingenuity poured into creating crypto-ransomware, the money-making malware that has become the scourge of hospitals, businesses, and home users over the past year. But none of that ingenuity applies to Ranscam, a new ransom malware reported by Cisco’s Talos Security Intelligence and Research Group. Ranscam is a purely amateur attempt to cash in on the cryptoransomware trend that demands payment for “encrypted” files that were actually just plain deleted by a batch command. “Once it executes, it, it pops up a ransom message looking like any other ransomware,” Earl Carter, security research engineer at Cisco Talos, told Ars. “But then what happens is it forces a reboot, and it just deletes all the files. It doesn’t try to encrypt anything—it just deletes them all.” Talos discovered the file on the systems of a small number of customers. In every case, the malware presented exactly the same message, including the same Bitcoin wallet address. The victim is instructed: Read 6 remaining paragraphs | Comments

Taken from:
Posing as ransomware, Windows malware just deletes victim’s files

Windows 10 Anniversary Update nears RTM with bugfixes galore

With its August 2 release date growing closer, the Windows 10 Anniversary Update is nearing completion. A steady stream of new builds for Windows Insiders on the fast track has been released over the past few weeks. The latest build, 14383, came out today and includes a wide range of fixes. As with many of its predecessors, this build has been made available simultaneously for Windows 10 on the desktop and Windows 10 Mobile; Microsoft is intending to ship the Anniversary Update simultaneously for PC, phone, and Xbox One when that release date arrives. Windows Central is reporting that according to its sources, the build one newer than today’s release, 14384, is the first candidate for what would formerly be known as Release To Manufacturing (RTM). With Windows now being delivered “as a service,” the old RTM terminology isn’t favored by Redmond any more—not least because many people will download the update rather than have it preinstalled by a PC manufacturer—but the concept that RTM represents endures. The “RTM” build will be the one released on August 2 to people in the stable channel, and then after several months of regular Patch Tuesday updates, it will be released as the Current Branch for Business. Read 1 remaining paragraphs | Comments

More:
Windows 10 Anniversary Update nears RTM with bugfixes galore