Romain Dillet reports via TechCrunch: Hacker group fail0verflow shared a photo of a Nintendo Switch running Debian, a distribution of Linux. The group claims that Nintendo can’t fix the vulnerability with future firmware patches. According to fail0verflow, there’s a flaw in the boot ROM in Nvidia’s Tegra X1 system-on-a-chip. When your console starts, it reads and executes a piece of code stored in a read-only memory (hence the name ROM). This code contains instructions about the booting process. It means that the boot ROM is stored on the chip when Nvidia manufactures it and it can’t be altered in any way after that. Even if Nintendo issues a software update, this software update won’t affect the boot ROM. And as the console loads the boot ROM immediately after pressing the power button, there’s no way to bypass it. The only way to fix it would be to manufacture new Nvidia Tegra X1 chips. So it’s possible that Nintendo asks Nvidia to fix the issue so that new consoles don’t have this vulnerability. Read more of this story at Slashdot.
An anonymous reader shares a Gizmodo report (condensed for space): For nearly two weeks, the company’s official Twitter account has been directing users to a fake lookalike website. After announcing the breach, Equifax directed its customers to equifaxsecurity2017.com, a website where they can enroll in identity theft protection services and find updates about how Equifax is handing the “cybersecurity incident.” But the decision to create “equifaxsecurity2017” in the first place was monumentally stupid. The URL is long and it doesn’t look very official — that means it’s going to be very easy to emulate. To illustrate how idiotic Equifax’s decision was, developer Nick Sweeting created a fake website of his own: securityequifax2017.com. (He simply switched the words “security” and “equifax” around.) As if to demonstrate Sweeting’s point, Equifax appears to have been itself duped by the fake URL. The company has directed users to Sweeting’s fake site sporadically over the past two weeks. Gizmodo found eight tweets containing the fake URL dating back to September 9th. Read more of this story at Slashdot.
From a CNET report: Next to DJ Tiesto’s loud image on Wet Republic’s website sits a photo of a bikini model with a beard and an eye patch, with a simple message: “It’s all out war.” Not exactly the type of message you’d expect from a spot that advertises itself as a dance club that doubles as a pool party, but when hackers are in town for Defcon, everything seems to be fair game. The hacker convention, which is in its 25th year in Las Vegas, typically has hotels on alert for its three days of Sin City talk, demos and mischief. Guests are encouraged not to pick up any flash drives lying around, and employees are trained to be wary of social engineering — that is, bad guys pretending to be someone innocent and in need of just a little help. Small acts of vandalism pop up around town. At Caesars Palace, where Defcon is happening, the casino’s UPS store told guests it was not accepting any print requests from USB drives or links, and only printing from email attachments. Hackers who saw this laughed, considering that emails are hardly immune from malware. But the message is clear: During these next few days, hackers are going to have their fun, whether it’s through a compromised Wi-Fi network or an open-to-mischief website. Wet Republic’s site had two images vandalized, both for the “Hot 100” party with DJ Shift. The digital graffiti popped up early Friday morning, less than 24 hours after Defcon kicked off. Read more of this story at Slashdot.
An anonymous reader writes: Samsung cellphones used to have a stock app called S Suggest. The company apparently discontinued the app recently, and then forgot to renew a domain that was used to control it. This snafu left millions of smartphone users vulnerable to hackers who could’ve registered the domain and installed malicious apps on the phones. Read more of this story at Slashdot.