Tag: privacy-rights

Seattle utility wants $17,500 refund after failure to scrub negative search results

John Tregoning Seattle’s publicly-owned electrical utility, City Light, is now demanding  a refund for the $17,500 that it paid to Brand.com  in a botched effort to boost the online reputation of its highly-paid chief executive, Jorge Carrasco. The project was concocted by the CEO’s chief of staff, Sephir Hamilton . In an interview with Ars, Hamilton said that the agency may even file a lawsuit to enforce this refund. “We’re leaving our options open,” he said. “I hope that they’ll see that what we signed up for was not the service that they delivered. We were sold one bill of goods and we were given another.” Read 26 remaining paragraphs | Comments

Link:
Seattle utility wants $17,500 refund after failure to scrub negative search results

Judge orders unmasking of Amazon.com “negative” reviewers

A federal judge has granted a nutritional supplement firm’s request to help it learn the identities of those who allegedly left “phony negative” reviews of its products on Amazon.com. The decision means that Ubervita may issue subpoena’s to Amazon.com and Cragslist to cough up the identities of those behind a “campaign of dirty tricks against Ubervita in a wrongful effort to put Ubervita at a competitive disadvantage in the marketplace .” (PDF). According to a lawsuit by the maker of testosterone boosters, multivitamins and weight loss supplements, unknown commenters  had placed fraudulent orders “to disrupt Ubervita’s inventory,” posted a Craigslist ad “to offer cash for favorable reviews of Ubervita products,” and posed “as dissatisfied Ubervita customers in posting phony negative reviews of Ubervita products, in part based on the false claim that Ubervita pays for positive reviews.” Read 2 remaining paragraphs | Comments

More:
Judge orders unmasking of Amazon.com “negative” reviewers

Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates

Microsoft has issued an emergency update for most supported versions of Windows to prevent attacks that abuse recently issued digital certificates impersonating Google and Yahoo. Company officials warned other undiscovered fraudulent credentials for other domains may still be in the wild. Thursday’s unscheduled update revokes 45 highly sensitive secure sockets layer (SSL) certificates that hackers managed to generate after compromising systems operated by the National Informatics Centre (NIC) of India, an intermediate certificate authority (CA) whose certificates are automatically trusted by all supported versions of Windows. Millions of sites operated by banks, e-commerce companies, and other types of online services use the cryptographic credentials to encrypt data passing over the open Internet and to prove the authenticity of their servers. As Ars explained Wednesday , the counterfeit certificates pose a risk to Windows users accessing SSL-protected sections of Google, Yahoo, and any other affected domains. “These SSL certificates could be used to spoof content, perform phishing attacks, or perform man-in-the-middle attacks against Web properties,” a Microsoft advisory warned. “The subordinate CAs may also have been used to issue certificates for other, currently unknown sites, which could be subject to similar attacks.” Read 4 remaining paragraphs | Comments

View post:
Emergency Windows update revokes dozens of bogus Google, Yahoo SSL certificates

Crypto weakness in smart LED lightbulbs exposes Wi-Fi passwords

Context In the latest cautionary tale involving the so-called Internet of things, white-hat hackers have devised an attack against network-connected lightbulbs that exposes Wi-Fi passwords to anyone in proximity to one of the LED devices. The attack works against LIFX smart lightbulbs , which can be turned on and off and adjusted using iOS- and Android-based devices. Ars Senior Reviews Editor Lee Hutchinson gave a good overview here of the Philips Hue lights, which are programmable, controllable LED-powered bulbs that compete with LIFX. The bulbs are part of a growing trend in which manufacturers add computing and networking capabilities to appliances so people can manipulate them remotely using smartphones, computers, and other network-connected devices. A 2012 Kickstarter campaign raised more than $1.3 million for LIFX, more than 13 times the original goal of $100,000. According to a blog post published over the weekend , LIFX has updated the firmware used to control the bulbs after researchers discovered a weakness that allowed hackers within about 30 meters to obtain the passwords used to secure the connected Wi-Fi network. The credentials are passed from one networked bulb to another over a mesh network powered by 6LoWPAN , a wireless specification built on top of the IEEE 802.15.4 standard . While the bulbs used the Advanced Encryption Standard (AES) to encrypt the passwords, the underlying pre-shared key never changed, making it easy for the attacker to decipher the payload. Read 4 remaining paragraphs | Comments

More here:
Crypto weakness in smart LED lightbulbs exposes Wi-Fi passwords

$1,099 iMac review: lose 50% of your performance to save 18% of the money

Technically, this is the $1,299 iMac, not that you’d be able to tell the difference. Andrew Cunningham Apple’s new $1,099 iMac will undoubtedly be a popular computer. People in the know who want the most computing bang for their buck would be smarter to step up to a higher-end model, but there are plenty of people—casual users, schools, businesses—who just want an iMac that’s “fast enough,” not one that’s “as fast as it could possibly be.” For those people, we obtained one of the new entry-level iMacs so we could evaluate its performance. On paper, it sounds like a big step down—you’re going from a quad-core desktop processor and GPU to a dual-core Ultrabook processor and GPU. This new iMac and the base MacBook Air models in fact use the exact same processor, even though historically there’s been a big performance gap between MacBook Airs and iMacs. In practice, the story is more complicated. Let’s talk about what the new low-end iMac changes, and then we’ll spend some time looking at processor performance. Read 29 remaining paragraphs | Comments

Follow this link:
$1,099 iMac review: lose 50% of your performance to save 18% of the money

Goldman Sachs demands Google unsend one of its e-mails

Goldman Sachs has demanded a court order to get Google to unsend an e-mail that the bank sent in error, according to Reuters’ report Wednesday. The e-mail contained “highly confidential” information addressed to the wrong account, a mistake on Goldman Sachs’ part that Google hasn’t yet been tempted to rectify. Goldman Sachs did not specify to Reuters how many clients were affected in the situation, which occurred on June 23. Reportedly, the mistake happened while a Goldman Sachs contractor was testing internal changes made to Goldman Sachs’ system to meet new requirements from the Financial Industry Regulatory Authority. The contractor prepared a report with sensitive client information, including details on brokerage accounts, and e-mailed it to a gmail.com address, rather than the gs.com one she intended. Reuters says that it tried to “retrieve the report” and contact the owner of the Gmail account without success. Google told Goldman Sachs on June 26 that it couldn’t reach through Gmail and delete the e-mail without a court order. Goldman Sahcs filed with the New York Supreme Court, requesting “emergency relief” to both avoid a privacy violation and “avoid the risk of unnecessary reputational damage to Goldman Sachs.” Read on Ars Technica | Comments

Read the original post:
Goldman Sachs demands Google unsend one of its e-mails

Millions of dymanic DNS users suffer after Microsoft seizes No-IP domains

Microsoft Millions of legitimate servers that rely on dynamic domain name services from No-IP.com suffered outages on Monday after Microsoft seized 22 domain names it said were being abused in malware-related crimes against Windows users. Microsoft enforced a federal court order making the company the domain IP resolver for the No-IP domains. Microsoft said the objective of the seizure was to identify and reroute traffic associated with two malware families that abused No-IP services. Almost immediately, end-users, some of which were actively involved in Internet security, castigated the move as heavy handed, since there was no evidence No-IP officially sanctioned or actively facilitated the malware campaign, which went by the names Bladabindi (aka NJrat) and Jenxcus (aka NJw0rm). “By becoming the DNS authority for those free dynamic DNS domains, Microsoft is now effectively in a position of complete control and is now able to dictate their configuration,” Claudio Guarnieri, co-founder of Radically Open Security, wrote in an e-mail to Ars Technica. “Microsoft fundamentally swept away No-IP, which has seen parts of its own DNS infrastructure legally taken away.” Read 6 remaining paragraphs | Comments

Read the article:
Millions of dymanic DNS users suffer after Microsoft seizes No-IP domains

Serious Android crypto key theft vulnerability affects 10% of devices

Kevlangdo Researchers have warned of a vulnerability present on an estimated 10 percent of Android phones that may allow attackers to obtain highly sensitive credentials, including cryptographic keys for some banking services and virtual private networks, and PINs or patterns used to unlock vulnerable devices. The vulnerability resides in the Android KeyStore , a highly sensitive region of the Google-made operating system dedicated to storing cryptographic keys and similar credentials, according to an advisory published this week by IBM security researchers. By exploiting the bug, attackers can execute malicious code that leaks keys used by banking and other sensitive apps, virtual private network services, and the PIN or finger patterns used to unlock handsets. The advisory said Google has patched the stack-based buffer overflow only in version 4.4, aka KitKat, of Android. The remaining versions, which according to Google figures run 86.4 percent of devices , have no such fix. In an update, IBM said the vulnerability affected only version 4.3, which runs on about 10.3 percent of handsets. There are several technical hurdles an attacker must overcome to successfully exploit the vulnerability. Android is fortified with modern software protections, including data execution prevention and address space layout randomization, both of which are intended to make it much harder for hackers to execute code when they identify security bugs. Attackers would also have to have an app installed on a vulnerable handset. Still, the vulnerability is serious because it resides in KeyStore, arguably one of the most sensitive resources in the Android OS. In an e-mail, Dan Wallach , a professor specializing in Android security in the computer science department of Rice University, explained: Read 5 remaining paragraphs | Comments

See the original article here:
Serious Android crypto key theft vulnerability affects 10% of devices

Verizon Wireless employee stole 900 phones, made $270,000 profit on eBay

A Verizon Wireless account executive who pleaded guilty to stealing more than 900 cell phones and selling them on eBay for a profit of $272,290 was sentenced this week to 27 months in prison. James Hopkins, 35, committed the fraud throughout most of 2009 while working as a business-to-business account executive at a Verizon Wireless branch office in Trevose, PA, according to a criminal complaint. He was charged with mail fraud and sentenced in US District Court in New Jersey, where Verizon is based. “From February through November 2009, Hopkins placed numerous orders for Verizon Wireless cellular telephones, handheld devices and accessories in the names of existing Verizon Wireless customers without their knowledge,” the US Attorney’s office in New Jersey wrote in an announcement. “After arranging for the merchandise to be shipped to the home of a relative in New Jersey, the defendant manipulated Verizon’s computer database to conceal the fraudulent orders and shipments. Hopkins received $328,517 worth of stolen Verizon Wireless merchandise, which he sold on eBay for a profit of $272,290.” That amounts to a profit of about $300 for each stolen phone. Read 2 remaining paragraphs | Comments

More here:
Verizon Wireless employee stole 900 phones, made $270,000 profit on eBay

Burglar logs in to Facebook in victim’s house, forgets to sign off

Nicholas Wig. Dakota County Sheriff’s Office A 27-year-old Minnesota man appears to have violated at least two tenets of the digital age: Never log in to your Facebook account in a stranger’s house you’re burglarizing, and don’t forget to sign off if you do. Such egregious violations have led to the arrest of a South St. Paul man charged with burglary allegations. Nicholas Steven Wig is accused of stealing cash, credit cards, a watch, a checkbook, and other items. When the victim came home last week, he noticed a screen missing from a window and his house in disarray. He also discovered his home computer was open to a Facebook page of one “Nick Dub,” who turned out to be Wig, police said. Read 4 remaining paragraphs | Comments

See the article here:
Burglar logs in to Facebook in victim’s house, forgets to sign off