network – Page 2 – Tech Today w/ Ken May

Chrome 62 Released With OpenType Variable Fonts, HTTP Warnings In Incognito Mode

An anonymous reader writes: Earlier today, Google released version 62 of its Chrome browser that comes with quite a few new features but also fixes for 35 security issues. The most interesting new features are support for OpenType variable fonts, the Network Quality Estimator API, the ability to capture and stream DOM elements, and HTTP warnings for the browser’s Normal and Incognito mode. The most interesting of the new features is variable fonts. Until now, web developers had to load multiple font families whenever they wanted variations on a font family. For example, if a developer was using the Open Sans font family on a site, if he wanted a font variation such as Regular, Bold, Black, Normal, Condensed, Expanded, Highlight, Slab, Heavy, Dashed, or another, he’d have to load a different font file for each. OpenType variable fonts allow font makers to merge all these font family variations in one file that developers can use on their site and control via CSS. This results in fewer files loaded on a website, saving bandwidth and improving page load times. Two other features that will interest mostly developers are the Network Quality Estimator and the Media Capture from DOM Elements APIs. As the name hints, the first grants developers access to network speed and performance metrics, information that some websites may use to adapt video streams, audio quality, or deliver low-fi versions of their sites. Developers can use the second API — the Media Capture from DOM Elements — to record videos of how page sections behave during interaction and stream the content over WebRTC. This latter API could be useful for developers debugging a page, but also support teams that want to see what’s happening on the user’s side. Read more of this story at Slashdot.

Read the original:
Chrome 62 Released With OpenType Variable Fonts, HTTP Warnings In Incognito Mode

Australian defense firm was hacked and F-35 data stolen, DOD confirms

Enlarge (credit: Royal Australian Air Force) The Australian Cyber Security Centre noted in its just-issued 2017 Threat Report that a small Australian defense company “with contracting links to national security projects” had been the victim of a cyber-espionage attack detected last November. “ACSC analysis confirmed that the adversary had sustained access to the network for an extended period of time and had stolen a significant amount of data,” the ACSC report stated. “The adversary remained active on the network at the time.” More details of the breach were revealed on Wednesday at an IT conference in Sydney. ASD Incident Response Manager Mitchell Clarke said, “The compromise was extensive and extreme.” The attacker behind the breach has been internally referred to at the Australian Signals Directorate as ” APT Alf ” (named for a character in Australia’s long-running television show Home and Away , not the US television furry alien). Alf stole approximately 30 gigabytes of data, including data related to Australia’s involvement in the F-35 Joint Strike Fighter program, as well as data on the P-8 Poseidon patrol plane, planned future Australian Navy ships, the C-130 Hercules cargo plane, and the Joint Direct Attack Munition (JDAM) bomb. The breach began in July of 2016. A spokesperson for the US Department of Defense’s F-35 Joint Program Office confirmed the breach to Defense News , stating that the Office “is aware” of the breach. The spokesperson reiterated that no classified data was exposed. Read 7 remaining paragraphs | Comments

See the original article here:
Australian defense firm was hacked and F-35 data stolen, DOD confirms

A series of delays and major errors led to massive Equifax breach

Enlarge / A monitor displays Equifax Inc. signage on the floor of the New York Stock Exchange (NYSE) in New York on Friday, September 15, 2017. (credit: Michael Nagle/Bloomberg via Getty Images ) A series of costly delays and crucial errors caused Equifax to remain unprotected for months against one of the most severe Web application vulnerabilities in years, the former CEO for the credit reporting service said in written testimony investigating the massive breach that exposed sensitive data for as many as 143 million US Consumers . Chief among the failures: an Equifax e-mail directing administrators to patch a critical vulnerability in the open source Apache Struts Web application framework went unheeded, despite a two-day deadline to comply. Equifax also waited a week to scan its network for apps that remained vulnerable. Even then, the delayed scan failed to detect that the code-execution flaw still resided in a section of the sprawling Equifax site that allows consumers to dispute information they believe is incorrect. Equifax said last month that the still-unidentified attackers gained an initial hold in the network by exploiting the critical Apache Struts vulnerability . “We at Equifax clearly understood that the collection of American consumer information and data carries with it enormous responsibility to protect that data,” Smith wrote in testimony provided to the US House Subcommittee on Digital Commerce and Consumer Protection . “We did not live up to that responsibility.” Read 6 remaining paragraphs | Comments

Taken from:
A series of delays and major errors led to massive Equifax breach

iOS 11 Released

Today, Apple released the final version of iOS 11, its latest mobile operating system. If you have an iPhone or iPad that was released within the last few years, you should be able to download the new update if you navigate to the Settings panel and check for a software update under the General tab. The Verge reports: OS 11, first unveiled in detail back at Apple’s WWDC in June, is the same incremental annual refresh we’ve come to expect from the company, but it hides some impressive complexity under the surface. Not only does it add some neat features to iOS for the first time, like ARKit capabilities for augmented reality and a new Files app, but it also comes with much-needed improvements to Siri; screenshot capture and editing; and the Control Center, which is now more fully featured and customizable. For iPads, iOS 11 is more of an overhaul. The software now better supports multitasking so you can more easily bring two apps into split-screen mode, or even add a third now. The new drag-and-drop features are also much more powerful on iPad, letting you manage stuff in the Files app more intuitively and even letting you drag and drop photos and text from one app to another. Read more of this story at Slashdot.

8,500 Verizon Customers Disconnected Because of ‘Substantial’ Data Use

An anonymous reader quotes a report from Ars Technica: Verizon is disconnecting another 8, 500 rural customers from its wireless network, saying that roaming charges have made certain customer accounts unprofitable for the carrier. The 8, 500 customers have 19, 000 lines and live in 13 states (Alaska, Idaho, Iowa, Indiana, Kentucky, Maine, Michigan, Missouri, Montana, North Carolina, Oklahoma, Utah, and Wisconsin), a Verizon Wireless spokesperson told Ars today. They received notices of disconnection this month and will lose access to Verizon service on October 17. Verizon said in June that it was only disconnecting “a small group of customers” who were “using vast amounts of data — some as much as a terabyte or more a month — outside of our network footprint.” But one customer, who contacted Ars this week about being disconnected, said her family never used more than 50GB of data across four lines despite having an “unlimited” data plan. We asked Verizon whether 50GB a month is a normal cut-off point in its disconnections of rural customers, but the company did not provide a specific answer. “These customers live outside of areas where Verizon operates our own network, ” Verizon said. “Many of the affected consumer lines use a substantial amount of data while roaming on other providers’ networks and the roaming costs generated by these lines exceed what these consumers pay us each month. We sent these notices in advance so customers have plenty of time to choose another wireless provider.” Read more of this story at Slashdot.

Read this article:
8,500 Verizon Customers Disconnected Because of ‘Substantial’ Data Use

Backdoor Found In WordPress Plugin With More Than 200,000 Installations

According to Bleeping Computer, a WordPress plug that goes by the name Display Widgets has been used to install a backdoor on WordPress sites across the internet for the past two and a half months. While the WordPress.org team removed the plugin from the official WordPress Plugins repository, the plugin managed to be installed on more than 200, 000 sites at the time of its removal. The good news is that the backdoor code was only found between Display Widgets version 2.6.1 (released June 30) and version 2.6.3 (released September 2), so it’s unlikely everyone who installed the plugin is affected. WordPress.org staff members reportedly removed the plugin three times before for similar violations. Bleeping Computer has compiled a history of events in its report, put together with data aggregated from three different investigations by David Law, White Fir Design, and Wordfence. The report adds: The original Display Widgets is a plugin that allowed WordPress site owners to control which, how, and when WordPress widgets appear on their sites. Stephanie Wells of Strategy11 developed the plugin, but after switching her focus to a premium version of the plugin, she decided to sell the open source version to a new developer who would have had the time to cater to its userbase. A month after buying the plugin in May, its new owner released a first new version — v2.6.0 — on June 21. Read more of this story at Slashdot.

See the original post:
Backdoor Found In WordPress Plugin With More Than 200,000 Installations

Nearly 3,000 Bitcoin Miners Exposed Online Via Telnet Ports, Without Passwords

An anonymous reader quotes a report from Bleeping Computer: Dutch security researcher Victor Gevers has discovered 2, 893 Bitcoin miners left exposed on the internet with no passwords on their Telnet port. Gevers told Bleeping Computer in a private conversation that all miners process Bitcoin transactions in the same mining pool and appear to belong to the same organization. “The owner of these devices is most likely a state sponsored/controlled organization part of the Chinese government, ” Gevers says, basing his claims on information found on the exposed miners and IP addresses assigned to each device. “At the speed they were taken offline, it means there must be serious money involved, ” Gevers added. “A few miners is not a big deal, but 2, 893 [miners] working in a pool can generate a pretty sum.” According to a Twitter user, the entire network of 2, 893 miners Gevers discovered could generate an income of just over $1 million per day, if mining Litecoin. Read more of this story at Slashdot.

View original post here:
Nearly 3,000 Bitcoin Miners Exposed Online Via Telnet Ports, Without Passwords

Verizon’s new unlimited plans throttle video all the time

Verizon’s revival of the unlimited data plan was supposed to be a good thing: it was bringing back worry-free service that let you use your smartphone as much as you like. Unfortunately, the carrier is making things complicated again. In the wake of tests that capped streaming video speeds , Verizon is splitting its unlimited access into multiple plans that face new restrictions. As of August 23rd, the standard Go Unlimited plan costs $5 less than before at $75 per month (if you use AutoPay), but you’re limited to streaming video at 480p on phones and 720p on tablets — shades of T-Mobile , anyone? The $80 prepaid plan and the Business plan cap you at 480p, too. The bigger issue is with the $85 Beyond Unlimited plan. Despite paying a premium, you’re limited to 720p streaming on phones and 1080p on tablets. Yes, that means that 1080p phone streaming (and any streaming higher than 1080p) is off the table regardless of how much you’re willing to pay. The carrier says there’s “no visible difference” in quality at those resolutions, but, well, that’s just not true. It might not be a night-and-day quality change, but you’re bound to notice if you have a large device like a Galaxy S8 Plus or a newer iPad Pro . The basic plan gives you unlimited hotspot access, but only at a pokey 600Kbps. You can spring for the business or Beyond plans to get LTE speeds, but only for the first 10GB or 15GB, respectively. And if you regularly visit Canada or Mexico, you’ll need to go to Beyond to use your service in those countries as you would at home. You’re grandfathered into a previous unlimited plan if you have one, and you’ll actually get 5GB more data at LTE speeds (15GB total) than you did before. However, even those older plans will be subject to the same throttling as new customers, so the only reason to hold on is to save money over the Beyond Unlimited plan. The carrier explains its move to Ars Technica as “managing our network” in a way that lets bring unlimited data “to more people.” That’s not completely unwarranted: OpenSignal found that average LTE speeds on Verizon dropped after the move to unlimited, so it’s clear that some people are using data so often that they’re bogging down the network. It’s still a step backwards for many customers, though, and the throttling at all tiers means you’ll still have to hunt for WiFi to get the best possible quality. It’s technically unlimited service, but it sure won’t feel like that in practice. Via: TechCrunch , The Verge Source: Ars Technica

View post:
Verizon’s new unlimited plans throttle video all the time

Hacker Steals $30 Million Worth of Ethereum From Parity Multi-Sig Wallets

An anonymous reader quotes a report from Bleeping Computer: An unknown hacker has used a vulnerability in an Ethereum wallet client to steal over 153, 000 Ether, worth over $30 million dollars. The hack was possible due to a flaw in the Parity Ethereum client. The vulnerability allowed the hacker to exfiltrate funds from multi-sig wallets created with Parity clients 1.5 and later. Parity 1.5 was released on January 19, 2017. The attack took place around 19:00-20:00 UTC and was immediately spotted by Parity, a company founded by Gavin Wood, Ethereum’s founder. The company issued a security alert on its blog. The Ether stolen from Parity multi-sig accounts was transferred into this Ethereum wallet, currently holding 153, 017.021336727 Ether. Because Parity spotted the attack in time, a group named “The White Hat Group” used the same vulnerability to drain the rest of Ether stored in other Parity wallets that have not yet been stolen by the hacker. This money now resides in this Ethereum wallet. According to messages posted on Reddit and in a Gitter chat, The White Hat Group appears to be formed of security researchers and members of the Ethereum Project that have taken it into their own hands to secure funds in vulnerable wallets. Based on a message the group posted online, they plan to return the funds they took. Their wallet currently holds 377, 116.819319439311671493 Ether, which is over $76 million. Read more of this story at Slashdot.

Elon Musk’s ‘Godot’ machine cuts its first LA tunnel segment

SpaceX and Tesla founder Elon Musk just tweeted that his tunnel-carving operation, The Boring Company, just completed cutting out its first segment with its Beckett-homaging drill, Godot. While the plan is to build an entire subterranean network underneath the streets of Los Angeles, it’s unclear where this first tunnel portion was cut and how far it went. Last we heard, negotiations for permits to start digging under city soil were promising but not concrete. No longer waiting for Godot. It has begun boring and just completed the first segment of tunnel in LA. — Elon Musk (@elonmusk) June 28, 2017 Location is important: Back in February, The Boring Company was safely and legally cutting test tunnels in the SpaceX parking lot, but anything beyond the borders of the organization’s land would require getting permission from the city. The founder tweeted that he’d had “promising conversations ” with LA Mayor Eric Garcetti two weeks ago — and that getting permits was harder than developing the tech for his future tunnel network — but we haven’t seen official confirmation that Musk got the green light to start digging on city grounds. That network isn’t for a new public transit system, mind you: The Boring Company’s tunnels will haul cars, bikes and pedestrians on electric sleds at up to 125 miles per hour, according to a concept video released in April, that will shrink half-hour drives aboveground to five-minute blitzes below. The first leg of the network is slated to run from Los Angeles International Airport (LAX) to Culver City, Santa Monica, Westwood and up to Sherman Oaks. Source: Elon Musk (Twitter)

Read the original:
Elon Musk’s ‘Godot’ machine cuts its first LA tunnel segment