parsely-root – Page 5 – Tech Today w/ Ken May

FTC: Windows tech support scams took another $120 million from PC users

Beware, scammer! Aurich Lawson Windows tech support scams have been conning PC users out of money for years, and there’s seemingly no end in sight. The Federal Trade Commission today announced that “a federal court has temporarily shut down two massive telemarketing operations that conned tens of thousands of consumers out of more than $120 million by deceptively marketing computer software and tech support services.” This is the third in a series of actions against such operations, the FTC said, and if the past is any indication, it won’t be the last. The FTC announced a big crackdown in late 2012 and another in late 2013 . But PC users continued to hand over money to nearly identical scammers, according to the latest FTC complaints. Today’s FTC press release described a method that has tricked PC users time and again: According to the FTC’s complaints, each scam starts with computer software that purports to enhance the security or performance of consumers’ computers. Typically, consumers download a free trial version of software that runs a computer system scan. The defendants’ software scan always identifies numerous errors on consumers’ computers, regardless of whether the computer has any performance problems. The software then tells consumers that, in order to fix the identified errors, they will have to purchase the paid version of the software. In reality, the FTC alleges, the defendants pitching the software designed these highly deceptive scans to identify hundreds or even thousands of “errors” that have nothing to do with a computer’s performance or security. After consumers purchase the “full” version of the software at a cost of $29 to $49, the software directs them to call a toll-free number to “activate” the software. When consumers call the activation number, however, they are connected to telemarketers who try to sell computer repair services and computer software using deceptive scare tactics to deceive consumers into paying for unneeded computer support services. According to the FTC, the telemarketers tell consumers that, in order to activate the software they have just purchased, they must provide the telemarketers with remote access to their computers. The telemarketers then launch into a scripted sales pitch that includes showing consumers various screens on their computers, such as the Windows Event Viewer, and falsely claiming that these screens show signs that consumers’ computers have significant damage. After convincing consumers that their computers need immediate help, the telemarketers then pitch security software and tech support services that cost as much as $500. The FTC teamed up with the State of Florida on the latest cases, winning federal court orders against the companies that “also temporarily freeze the defendants’ assets and place the businesses under the control of a court-appointed receiver.” The complaints say the defendants have been scamming consumers since at least 2012. Read 2 remaining paragraphs | Comments

Visit site:
FTC: Windows tech support scams took another $120 million from PC users

Netflix takes up 9.5% of upstream traffic on the North American Internet

Netflix We’ve written a lot about how Netflix takes up a gigantic share of Internet traffic. During peak viewing hours, Netflix accounts for about a third of all bits sent to Internet users in North America on “fixed” connections—that is, cable, DSL, fiber, or satellite, but not cellular. But Netflix users also send a ton of data upstream, so much so that Sandvine’s latest Internet Phenomena Report puts Netflix at 9.48 percent of all peak upstream traffic on North American fixed Internet services, second only to BitTorrent’s 25.49 percent. Sandvine, a maker of equipment that helps consumer broadband providers manage network congestion, defines “peak” hours as those when network usage is within 95 percent of its daily maximum, typically from 7 to 11 p.m. It isn’t new that Netflix is both an upload and download monster. But for some reason, its share of uploads went up substantially in the latest measurement while downloads remained level. The twice-annual report had Netflix accounting for 6.44 of peak upstream traffic and 34.21 percent of downstream traffic in the first half of this year , while the newest report has Netflix at 9.48 percent of upstream and 34.89 percent of downstream: Read 17 remaining paragraphs | Comments

More:
Netflix takes up 9.5% of upstream traffic on the North American Internet

16-cent E-rate phone fee hike will fund $1.5 billion in school broadband

The head of the Federal Communications Commission is proposing an extra $1.5 billion in annual spending on broadband for schools and libraries, all to be funded by a 16-cent increase on the monthly bills of phone customers. Under Chairman Tom Wheeler’s plan , announced yesterday and scheduled for a vote on December 11, the E-rate program’s annual spending cap would rise from $2.4 billion to $3.9 billion. Wheeler tried to make the increased cost to ratepayers sound as small as possible. “If the FCC reaches the maximum cap recommended, the estimated additional cost to an individual rate payer would be approximately 16 cents a month, about a half a penny per day, or about $1.90 a year—less than a medium-sized soda at a fast food restaurant or a cup of coffee,” a fact sheet released yesterday says . Read 5 remaining paragraphs | Comments

Read this article:
16-cent E-rate phone fee hike will fund $1.5 billion in school broadband

Prosecutors drop key evidence at trial to avoid explaining “stingray” use

p | m In a Baltimore trial courtroom on Monday, a local judge threatened to hold a police detective in contempt of court for refusing to disclose how police located a 16-year-old robbery suspect’s phone. Once the Baltimore Police were able to locate Shemar Taylor’s phone, they then searched his house and found a gun as well. But rather than disclose the possible use of a stingray, also known as a cell site simulator, Detective John L. Haley cited a non-disclosure agreement, likely with the Harris Corporation, since the company is one of the dominant manufacturers of such devices. Stingrays can be used to determine a phone’s location, and they can also intercept calls and text messages. Baltimore Circuit Judge Barry G. Williams retorted, “You don’t have a nondisclosure agreement with the court,” according to the Baltimore Sun . Read 8 remaining paragraphs | Comments

See original article:
Prosecutors drop key evidence at trial to avoid explaining “stingray” use

High-res Rosetta pics catch little Philae lander bouncing across comet

The European Space Agency’s decade-old Rosetta mission managed to do what no mission has done before—successfully rendezvous a probe with a comet and then land on it . Even if things didn’t go entirely as planned with the landing, the lion’s share of the mission’s science was always slated to be carried out by the Rosetta probe itself rather than by the Philae lander, so plenty of experiments will still be carried out over the next year. A mosaic assembled by ESA scientists showing Philae’s first bounce across Comet 67P. ESA In fact, one of the Rosetta probe’s instruments managed to capture some remarkable imagery last week during Philae’s landing. In a blog post that went live this morning, the ESA posted pictures from the spacecraft’s OSIRIS imager (that’s Optical, Spectroscopic, and Infrared Remote Imaging System) showing Philae’s initial approach and first “bounce” off of Comet 67P/Churyumov–Gerasimenko on November 12. Philae was supposed to have anchored itself to Comet 67P with a pair of harpoons, but those harpoons didn’t fire on touchdown. Philae actually rebounded away from the comet (67P has a small but appreciable amount of gravity, although its escape velocity is only 0.5 meters per second). It was during the first of two “bounces” that Rosetta’s OSIRIS imager captured a series of frames showing the lander’s parabolic journey across the comet’s face. The exact location of Philae’s final resting place remains as yet undetermined. Read 1 remaining paragraphs | Comments

“DarkHotel” uses bogus crypto certificates to snare Wi-Fi-connected execs

DeviantArt user: Tincho555 Researchers have uncovered a seven-year-old malware operation that combines advanced cryptographic attacks, zero-day exploits, and well-developed keyloggers to target elite executives staying in luxury hotels during business trips. The attackers behind “DarkHotel,” as the advanced persistent threat has been dubbed, appear to know in advance when a targeted exec will check in and check out of a hotel. Victims are infected through a variety of methods, including bogus software updates for Adobe Flash, Google Toolbar, or other trusted software that are presented when the exec uses the hotel’s Wi-Fi or wired Internet access. In many cases, the attack code is signed with a trusted digital certificate that the attackers were able to clone by factoring the underlying 512-bit private key. While factoring weak 512-bit keys has been practical for several years, the crypto attack nonetheless is an “advanced” capability, particularly a few years ago. Taken together, the characteristics are an indication the operators have some sophistication, said researchers from Kaspersky Lab, the Russia-based security firm that disclosed the campaign. “The fact that most of the time the victims are top executives indicates the attackers have knowledge of their victims whereabouts, including name and place of stay,” the researchers wrote in a report published Monday . “This paints a dark, dangerous web in which unsuspecting travelers can easily fall. While the exact reason why some hotels function as an attacker vector are unknown, certain suspicions exist, indicating possibly a much larger compromise. We are still investigating this aspect of the operation and will publish more information in the future.” Read 6 remaining paragraphs | Comments

See the original article here:
“DarkHotel” uses bogus crypto certificates to snare Wi-Fi-connected execs

All US Postal Service employees’ personal data exposed by hackers

Barbara Krawcowicz All United States Postal Service (USPS) employees’ personal data—including names, addresses, social security numbers—has been exposed as the result of a hack believed to have originated from China. According to its own tally, USPS employs over 600,000 people. “We began investigating this incident as soon as we learned of it, and we are cooperating with the investigation, which is ongoing,” David Partenheimer, a USPS spokesman, wrote in a statement (PDF) on Monday. “The investigation is being led by the Federal Bureau of Investigation and joined by other federal and postal investigatory agencies. The intrusion is limited in scope and all operations of the Postal Service are functioning normally.” The USPS does not believe that in-store customer data was exposed, but customers who contacted the agency via e-mail or phone between January 1 and August 16, 2014 may have been. Read 4 remaining paragraphs | Comments

Continue reading here:
All US Postal Service employees’ personal data exposed by hackers

400 Tor-anonymized domains tracked down and seized in global crackdown

Thursday’s takedown of the Silk Road 2.0 drug website was part of a much bigger crackdown by police in a dozen countries that seized more than 400 darknet domains, it was widely reported Friday. Operation Onymous, as the coordinated international effort was dubbed, confiscated $1 million in bitcoins, $250,000 in cash, and a variety of drugs, gold, and silver, the Associated Press reported . In all, according to Wired , police seized 414 .onion domains, the Web addresses that use the Tor anonymity service to hide the physical location where they’re hosted. At least 17 people were arrested. Sites besides Silk Road 2.0 that were taken down included Hydra, Cloud Nine, Pandora, and Blue Sky. In all, some 55 different markets will be shut down once Operation Onymous is completed. Sites Agora and Evolution aren’t among them. The rise of underground bazaars selling illicit drugs and services has continued despite last year’s arrest of Ross William Ulbricht, the alleged mastermind of the original Silk Road who has pleaded not guilty and continues to fight the criminal charges in court. Read 1 remaining paragraphs | Comments

Link:
400 Tor-anonymized domains tracked down and seized in global crackdown

GM’s next-gen infotainment system to run Android—not Android Auto—in 2016

The 2015 Cadillac ATS coupe with integrated LTE. It’s basically a big red smartphone. Ron Amadeo Harman International, the car infotainment manufacturer, recently spilled the beans on a “next-gen” infotainment system it is building for General Motors. Automotive News has quotes from the company’s CEO, Dinesh Paliwal, who describes an Android-based system with an app store and “instant” boot up. The report says that Harman is “working closely” with Google to make the system a reality. This system isn’t Android Auto. Unlike regular Android, Android Wear, and Android TV, Android Auto isn’t an operating system. It doesn’t live on the car’s computer, it doesn’t control peripherals, and it doesn’t have an app store. Like Apple’s CarPlay, Android Auto is just a “casted” interface. Your plugged-in smartphone sends a custom interface to the car’s screen and receives touch events, but the car still has to run some other operating system. Harman won a $900 million contract from GM to build the system, and judging by the Harman CEO’s description, this is an actual embedded Android system that will power the entire infotainment setup. That typically includes the audio system, air conditioning, navigation, voice recognition, phone calls, reverse cameras, and Internet access. Read 3 remaining paragraphs | Comments

Visit site:
GM’s next-gen infotainment system to run Android—not Android Auto—in 2016

Crypto attack that hijacked Windows Update goes mainstream in Amazon Cloud

Underscoring just how broken the widely used MD5 hashing algorithm is, a software engineer racked up just 65 cents in computing fees to replicate the type of attack a powerful nation-state used in 2012 to hijack Microsoft’s Windows Update mechanism. Nathaniel McHugh ran open source software known as HashClash to modify two separate images—one of them depicting funk legend James Brown and the other R&B singer/songwriter Barry White—that generate precisely the same MD5 hash, e06723d4961a0a3f950e7786f3766338. The exercise—known in cryptographic circles as a hash collision—took just 10 hours and cost only 65 cents plus tax to complete using a GPU instance on Amazon Web Service. In 2007, cryptography expert and HashClash creator Marc Stevens estimated it would require about one day to complete an MD5 collision using a cluster of PlayStation 3 consoles . The MD5 hash for this picture—e06723d4961a0a3f950e7786f3766338—is precisely the same for the one below. Such “collisions” are a fatal flaw for hashing algorithms and can lead to disastrous attacks. The practical ability to create two separate inputs that generate the same hash is a fundamental flaw that makes MD5 unsuitable for most purposes. (The exception is password hashing. Single iteration MD5 hashing is horrible for passwords but for an entirely different reason that is outside the scope of this post.) The susceptibility to collisions can have disastrous consequences, potentially for huge swaths of the Internet. Read 4 remaining paragraphs | Comments

Visit site:
Crypto attack that hijacked Windows Update goes mainstream in Amazon Cloud