services – Tech Today w/ Ken May

PC vendors scramble as Intel announces vulnerability in firmware

Enlarge / All the Cores are affected by a major vulnerability in management firmware—as are Xeon servers and Atom, Celeron and Pentium devices. (credit: Intel ) Intel has issued a security alert that management firmware on a number of recent PC, server, and Internet-of-Things processor platforms is vulnerable to remote attack. Using the vulnerabilities, the most severe of which was uncovered by Mark Ermolov and Maxim Goryachy of Positive Technologies Research, remote attackers could launch commands on a host of Intel-based computers, including laptops and desktops shipped with Intel Core processors since 2015. They could gain access to privileged system information, and millions of computers could essentially be taken over as a result of the bug. The company has posted a detection tool on its support website for Windows and Linux to help identify systems that are vulnerable. In the security alert, members of Intel’s security team stated that “in response to issues identified by external researchers, Intel has performed an in-depth comprehensive security review of its Intel® Management Engine (ME), Intel® Trusted Execution Engine (TXE), and Intel® Server Platform Services (SPS) with the objective of enhancing firmware resilience.” Four vulnerabilities were discovered that affect Intel Management Engine firmware versions 11.0 through 11.20. Two were found in earlier versions of ME, as well as two in Server Platform Services version 4.0 firmware and two in TXE version 3.0. Read 3 remaining paragraphs | Comments

See the original article here:
PC vendors scramble as Intel announces vulnerability in firmware

Google rumored to replace 2-factor with ‘Advanced Protection’ keys

According to Bloomberg , Google is close to rolling out a hardware replacement for current 2-factor authentication setups. Right now, adding the need for a constantly changing code is one of the best ways to protect your account beyond just a password, which can be guessed, stolen from another service you reused it on or obtained via phishing. The report describes an “Advanced Protection Program” that replaces two-factor codes with a pair of physical keys, presumably similar to items like a Yubikey . According to the report, users will need both keys, which includes one that plugs in via USB. It doesn’t sound like two-factor systems with codes or push notifications are going away for everyone, however, since this is intended for “corporate executives, politicians and others with heightened security concerns.” As many organizations shift to G Suite for their services, it could be an important add-on for someone who needs security but might not be able to deal with other forms of security. Last year’s DNC hack that took over via the Gmail account of campaign chairman John Podesta provided a clear example of how important added protections are, but many people don’t take advantage because they can seem complicated to setup. Just a few months many users were bombarded with a Google Drive-hosted phishing attack , and that won’t be the last one. Source: Bloomberg

Spotify is in ‘advanced talks’ to buy SoundCloud

Those rumors that SoundCloud is shopping itself around ? They just got more substantial. Financial Times sources understand that Spotify is in “advanced talks” to buy SoundCloud. Details of the terms are still scarce at the moment, but it won’t surprise you to hear that Spotify is declining to comment. We’ve asked SoundCloud for its take as well. A buyout would be expensive for Spotify, which is seeing a surge of paying customers but still isn’t turning a profit . However, it would definitely make a sense from a strategic perspective. Spotify has been expanding to include more than just albums — this would give it a wider catalog of DJ sets, demos and other rough tracks. That, in turn, would give it leverage over Apple Music, Tidal and other services that try to lure you away with artist exclusives . You could listen to an in-development song and check out that artist’s commercially available music immediately afterward. And SoundCloud… well, it may not have much of a choice. Its paid SoundCloud Go service hasn’t exactly taken off, and it can’t really make money from those unofficial mashups and remixes. There’s no saying whether or not SoundCloud as you know it would survive under Spotify, but it would at least have a financial cushion. Source: Financial Times

View article:
Spotify is in ‘advanced talks’ to buy SoundCloud

Twitter locks ‘millions’ of accounts with exposed passwords

While Twitter maintains that its servers have not been hacked, the company now says it has “cross-checked” the account data noted by LeakedSource and is taking pre-emptive measures. Particularly notable in light of hacks that have recently affected accounts from Katy Perry to Mark Zuckerberg to the NFL, the social network said it has identified a number of accounts for extra protection. No matter where the information came from, whether via malware or shared passwords revealed in hacks of other services, any accounts with “direct password exposure” have been locked (similar to pre-emptive moves Netflix and others are using when they see account details floating around), and emails were sent to the owner prompting for a password reset. In light of recent events, learn more about account security on Twitter and what we’re doing to keep yours safe. https://t.co/Hug5cLr6r8 — Twitter (@twitter) June 10, 2016 There’s no word on exactly how many accounts in the database checked out, but Twitter told the Wall Street Journal that “millions” of accounts have been notified. If your account is vulnerable then you should’ve already been notified; so if your inbox is empty and you can still sign in then you don’t have anything (more than usual) to worry about. Still, it’s always a good time to reset your password just in case, use unique passwords on every account (a password manager like 1Password or LastPass can be helpful) and enable two-factor authentication wherever available . Source: Twitter Blog

Excerpt from:
Twitter locks ‘millions’ of accounts with exposed passwords

ComiXology Unlimited offers all of the comics for $6 a month

ComiXology, Amazon’s online comic book service, unveiled a new unlimited content subscription option on Tuesday. The $6 per month ComiXology Unlimited plan gives subscribers unfettered access to the service’s entire archive, which includes titles from Image, Dark Horse, IDW and a bunch more — basically every notable publisher outside of Marvel and DC. ComiXology will continue to sell individual issues from the Big Two, it just won’t offer them on the unlimited plan. Via: Android Central Source: Comixology

See more here:
ComiXology Unlimited offers all of the comics for $6 a month

Amazon is selling its own processors now, too

Amazon’s come a long way since its humble beginnings as an online book store. It sells everything from groceries to its own Kindle and tablet hardware , runs streaming services complete with original shows , and has a huge cloud-computing business among other interests . And now Amazon’s started pushing its own line of processors, plunging its finger into yet another pie. You won’t find its ARM-based “Alpine” chips among the T-shirts and homeware on Amazon’s online store, of course. They are being sold directly to manufacturers and service providers through subsidiary Annapurna Labs , a chip designer Amazon acquired early last year. The Alpine chip range is intended for products like WiFi routers, storage devices and connected home products (internet of things things), with companies including ASUS, Netgear and Synology already counted as customers. As Bloomberg notes, the chips are also a good fit for data centers, but are more suited to storage and networking tasks, not high-performance servers where Intel reigns king. Apart from being an interesting milestone in Amazon’s campaign for world domination, it getting into the processor business will resonate little with us everyday consumers. But, when you finally commit to buying a smart home hub after comparing numerous Amazon reviews, that hardware may well turn up with an Amazon brain inside, too. Via: Bloomberg , The Verge Source: Annapurna Labs

Super Logout Logs You Out of Dozens of Services at Once

Logging out of your account when you’re done using a computer other than your own is just good security. If you use multiple accounts and want to simplify the process, Super Logout can log you out of over 30 major services at once. Read more…

See more here:
Super Logout Logs You Out of Dozens of Services at Once