Exploit Derived From EternalSynergy Upgraded To Target Newer Windows Versions

An anonymous reader writes: “Thai security researcher Worawit Wang has put together an exploit based on ETERNALSYNERGY that can also target newer versions of the Windows operating system, ” reports Bleeping Computer. “ETERNALSYNERGY is one of the NSA exploits leaked by the Shadow Brokers hacking group in April this year. According to a Microsoft technical analysis, the exploit can allow an attacker to execute code on Windows machines with SMB services exposed to external connections. The exploit works up to Windows 8. According to Microsoft, the techniques used in the original ETERNALSYNERGY exploit do not work on newer platforms due to several kernel security improvements. Wang says his exploit targets the same vulnerability but uses a different exploitation technique. His method ‘should never crash a target, ‘ the expert says. ‘Chance should be nearly 0%, ‘ Wang adds.” Combining his exploit with the original ETERNALSYNERGY exploit would allow a hacker to target all Windows versions except Windows 10. This is about 75% of all Windows PCs. The exploit code is available for download from Wang’s GitHub or ExploitDB. Sheila A. Berta, a security researcher for Telefonica’s Eleven Paths security unit, has published a step-by-step guide on how to use Wang’s exploit. Read more of this story at Slashdot.

View article:
Exploit Derived From EternalSynergy Upgraded To Target Newer Windows Versions

Media Player Classic Home Cinema (MPC-HC) for Windows Pushes What Could Be Its Last Update

Popular open-source media player for Windows, Media Player Classic Home Cinema — or MPC-HC, has issued what it says could be the last update the app ever receives. The team writes: v1.7.13, the latest, and probably the last release of our project… For quite a few months now, or even years, the number of active developers has been decreasing and has inevitably reached zero. This, unfortunately, means that the project is officially dead and this release would be the last one. … Unless some people step up that is. So, if someone’s willing to really contribute and has C/C++ experience, let me know on IRC or via e-mail. Otherwise, all things come to an end and life goes on. It’s been a nice journey and I’m personally pretty overwhelmed having to write this post. Read more of this story at Slashdot.

More:
Media Player Classic Home Cinema (MPC-HC) for Windows Pushes What Could Be Its Last Update

SoundCloud Has Enough Money To Survive Only 80 Days, Report Claims

Last week, SoundCloud announced it is cutting about 40 percent of its staff and closing two offices. Now, a report from TechCrunch claims “the layoffs only saved the company enough money to have runway ‘until Q4’ — which begins in just 80 days.” From the report: That seems to conflict with the statement Ljung released alongside the layoffs, which noted that, “With more focus and a need to think about the long term, comes tough decisions.” The company never mentioned how short its cash would still last. We reached out to Ljung and SoundCloud for this story and PR responded to the request reiterating Ljung blog post. After being presented with the leaked information from the all-hands, SoundCloud PR admitted that, “We are fully funded into Q4, ” though it says it’s in talks with potential investors. But further funding would require faith in SoundCloud that its own staff lacks. When asked about morale of the remaining team, one employee who asked to remain anonymous told TechCrunch “it’s pretty shitty. Pretty somber. I know people who didn’t get the axe are actually quitting. The people saved from this are jumping ship. The morale is really low.” Read more of this story at Slashdot.

Read More:
SoundCloud Has Enough Money To Survive Only 80 Days, Report Claims

Author of Original Petya Ransomware Publishes Master Decryption Key

An anonymous reader writes: The author of the original Petya ransomware — a person/group going by the name of Janus Cybercrime Solutions — has released the master decryption key of all past Petya versions. This key can decrypt all ransomware families part of the Petya family except NotPetya, which isn’t the work of Janus, but is believed to be the work of a nation-state actor that targeted Ukraine. Most (original) Petya campaigns happened in 2016, and very few campaigns have been active this year. Users that had their files locked have wiped drives or paid the ransom many months before. The key will only help those victims who cloned their drives and saved a copy of the encrypted data. Experts believe that Janus released Petya’s decryption key as a result of the recent NotPetya outbreak, and he might have decided to shut down his operation to avoid further scrutiny, or being accused of launching NotPetya. Read more of this story at Slashdot.

Continue Reading:
Author of Original Petya Ransomware Publishes Master Decryption Key

More progress on carbon nanotube processors: a 2.8GHz ring oscillator

Enlarge (credit: NASA ) Back in 2012, I had the pleasure of visiting the IBM Watson research center. Among the people I talked with was George Tulevski , who was working on developing carbon nanotubes as a possible replacement for silicon in some critical parts of transistors. IBM likes to think about developing technology with about a 10-year time window, which puts us about halfway to when the company might expect to be making nanotube-based hardware. So, how’s it going? This week, there was a bit of a progress report published in Nature Nanotechnology (which included Tulevski as one of its authors). In it, IBM researchers describe how they’re now able to put together test hardware that pushes a carbon nanotube-based processor up to 2.8GHz. It’s not an especially useful processor, but the methods used for assembling it show that some (but not all) of the technology needed to commercialize nanotube-based hardware is nearly ready. Semiconducting hurdles The story of putting together a carbon nanotube processor is largely one of overcoming hurdles. You wouldn’t necessarily expect that; given that the nanotubes can be naturally semiconducting, they’d seem like a natural fit for existing processor technology. But it’s a real challenge to get the right nanotubes in the right place and play nicely with the rest of the processor. In fact, it’s a series of challenges. Read 11 remaining paragraphs | Comments

Excerpt from:
More progress on carbon nanotube processors: a 2.8GHz ring oscillator

US military will finally start encrypting soldiers’ emails

You’d think the military’s email service mail.mil would be more secure than Gmail and other free alternatives, but that’s apparently not the case. A Motherboard investigation in 2015 revealed that while it does have systems in place to protect classified messages, it doesn’t even use STARTTLS — a 15-year-old encryption technology that prevents emails from being intercepted in transit. That exposes unclassified emails to surveillance and leaves them vulnerable as they make their way to recipients. Now, after getting a lot of flak over the lack of security, Pentagon says it will finally start encrypting soldiers’ emails… but not until July 2018. See, Gizmodo discovered that the military’s email service doesn’t use STARTTLS, because it would prevent the Defense Information Systems Agency (DISA) from screening each message for malware, phishing attempts and exploits. A letter from DISA, which oversees the military’s emails, says its detection methods developed using national level intelligence “would be rendered ineffective if STARTTLS were enabled.” To be able to implement the technology and make it a default feature, it would have to migrate to a “new email gateway infrastructure, ” and migration won’t be done until July next year. DISA has revealed its plans to migrate the military’s email service in a letter addressed to Senator Ron Wyden, who questioned the agency for not using a “basic, widely used, easily enabled cybersecurity technology.” Wyden said in a statement that the move is definitely a step in the right direction, but he’s also pretty unhappy that it’ll take DISA a year to migrate. “Protecting the communications of American servicemen and women should be a priority, ” he said, “so I hope the agency accelerates its timeline.” Source: Gizmodo , Motherboard

Continued here:
US military will finally start encrypting soldiers’ emails

Healbe’s GoBe 2 calorie tracker teases the future of wearables

Shortly before Apple’s most recent developer conference, rumors began to circulate about the next generation of its watch. Sources suggested that the device would demonstrate a form of noninvasive glucose monitoring — a way to check blood sugar levels without breaching the skin. If possible, the Apple Watch Series 3 would become an essential product for 29 million American diabetics, overnight. It came to nothing, of course, but people are still wondering if there’s a way for smartwatches to sniff our blood and tell us their findings. Thing is, there’s already a watch that professes to do a similar task: the controversial Healbe GoBe . In order to see what the future of medical wearables could be like, I’ve spent the past few weeks with the new GoBe 2 strapped to my wrist. The device was soft-launched to a group of pre-order customers a few months ago, with more going on sale at some point this fall. If the name tickles a synapse at the back of your brain, it’s because Healbe burst onto the scene in 2014. The company launched an Indiegogo campaign to build a watch that could track how many calories you’d eaten each day. Not your blood sugar, but close enough. Imagine it: You’d never have to think about logging your calorie intake again; your watch would do it all for you. The claim was ridiculous, but the company managed to secure more than $1 million in backing. Medical professionals and journalists weighed in, saying that the idea was about as feasible as capturing a unicorn fart. Thanks to sites like PandoDaily , the name Healbe became synonymous with companies that tried to sell you a dream and run off with your cash. A post shared by Healbe (@healbe) on Apr 11, 2017 at 2:37am PDT The device finally launched a year later, with its signature tracking feature kinda sorta working, but not very well. When we reviewed it , we felt that the watch had too many rough edges to justify people buying it, despite its vastly superior sleep and fitness tracking features. Perhaps the company rushed its first release in response to public pressure, which ostensibly explains why it failed. Now, Healbe believes that its second-generation device is finally ready for prime time and able to do what was promised. As for the science, Healbe claims that it uses a piezoelectric impedance sensor to push high- and low-frequency signals through your wrist. Shortly after eating, the cells in your bloodstream begin releasing water as they absorb the new glucose. The device, so the company says, can use the impedance signals to look at the size and shape of the cells, and track the change in water. From there, it’s just a case of using fancy math to calculate the amount of food you’ve noshed in a sitting. One thing that Healbe’s representatives went to great pains to explain is that the human body isn’t as simple as you may expect. The initial pitch mistakenly hinted that, at some point after you’d eaten a sandwich, the watch would simply ping and tell you that you’d consumed 233 calories. But most meals take between four and six hours to digest as the slurry of chewed food churns through our bodies. Rather than looking at the micro, I was told, I needed to see the GoBe 2 as a way of understanding the macro . The device itself is a little more elegant than its predecessor, although that’s not saying much. It still just fits under a shirt sleeve, although you’ll be unable to pretend it’s anything but a clunky-looking wearable. The new model’s case is all black, and gone is the top layer of metal that demarcated the display in the first generation. A single button activates the display and cycles through the various screens, from telling the time to measuring your calorie balance. Most of the interesting bits are contained within its companion app, which elegantly shows off your vital statistics. It’s broken down into five subsections: “Energy Balance, ” Hydration, Heart Rate, Sleep and Stress. The first one combines activity tracking and calorie monitoring to provide you with a single figure, showing whether you’re in calorie credit or deficit each day. It’s calculated by subtracting the activity you’ve completed against the food you’ve consumed, so, depending on how good you’ve been, it’ll be a plus or minus figure. The Healbe GoBe 2 Dashboard Daniel Cooper As for the calorie counting itself, you get a series of figures breaking down the calories taken in, and how many are fat, carbs and protein. A graph then shows you absorption over the past day, running from midnight to midnight. It’s good to note that you’ll see spikes in calorie burn in the small hours of the morning too, as your body works through the day’s food. Unlike the first-generation GoBe, you don’t need to tell the device when you’re going to eat; it does it all automatically. So looking at the graph for an average day, there’s a lot of burning as I sleep, and then a big spike shortly after I eat breakfast. Then the graph spikes shrink through the morning before shooting back up again at lunchtime, and so forth. While I wasn’t expecting a constant and precise record of my consumption, I found the tracking to be pretty close to my handwritten notes. Hydration is another issue, and the watch is obsessed with ensuring that I get enough fluids, even though I thought I was a good drinker. It will often buzz at me, instructing me to take on more water, even if I’m on the cusp of falling asleep — at least until I’d set its reminder window to remind me to drink only during daylight hours. After all, at one point I was full to bursting after I chain-drank the better part of three liters of green tea, and I was still being advised that I needed to drink more. Similarly, the sleep tracking is some of the most accurate I’ve seen, outlining periods of REM sleep, stress and anxiety through the night. Similarly, it’s the first “stress”-counting wearable that has actually worked, vibrating with the warning “Emotion” during a particularly fractious conversation with my other half. It all adds up to a device that actually kinda does what was promised, which is probably the biggest surprise of all of this. The questions that linger are simple: whether Apple will adopt a technology like this in a future version of its watch, and if it can be tweaked to calculate blood sugar. On the first point, the biggest obstacle to its use would be the GoBe’s atrocious battery life — it lasts 24 hours between charges. The Watch itself has an even shorter lifespan, and it would take a radical redesign to make it practical. As for whether the technology could be used to track blood sugar levels, that will come down to how well the algorithms can be tweaked. If Healbe’s Flow technology is legitimate, and it does turn out to be capable of tracking food consumption, then it’s entirely plausible and possible. Although Apple will be held to a vastly higher standard than Healbe, especially given the latter company’s lack of credibility. Testing this device, I expected very little from it, believing that its signature feature was simply too impossible to work. But the Healbe GoBe 2 is a very good health and fitness tracker, offering insights and proactive advice that I appreciate in a wearable device. It offers lifestyle metrics that other companies would dream of being able to offer, and reading my stats has become a mild obsession. As a consequence, the company has earned a second chance at a first impression. Source: Healbe

View article:
Healbe’s GoBe 2 calorie tracker teases the future of wearables

Hulu Joins Netflix and Amazon In Promoting Royalty-free Video Codec AV1

theweatherelectric writes: Hulu has joined the Alliance for Open Media, which is developing an open, royalty-free video format called AV1. AV1 is targeting better performance than H.265 and, unlike H.265, will be licensed under royalty-free terms for all use cases. The top three over-the-top SVOD services (Netflix, Amazon, and Hulu) are now all members of the alliance. In joining the alliance, Hulu hopes “to accelerate development and facilitate friction-free adoption of new media technologies that benefit the streaming media industry and [its] viewers.” Read more of this story at Slashdot.

See the article here:
Hulu Joins Netflix and Amazon In Promoting Royalty-free Video Codec AV1

With a Single Wiretap Order, US Authorities Listened In on 3.3 Million Phone Calls

US authorities intercepted and recorded millions of phone calls last year under a single wiretap order, authorized as part of a narcotics investigation, ZDNet’s Zack Whittaker reports. From the article: The wiretap order authorized an unknown government agency to carry out real-time intercepts of 3.29 million cell phone conversations over a two-month period at some point during 2016, after the order was applied for in late 2015. The order was signed to help authorities track 26 individuals suspected of involvement with illegal drug and narcotic-related activities in Pennsylvania. The wiretap cost the authorities $335, 000 to conduct and led to a dozen arrests. But the authorities noted that the surveillance effort led to no incriminating intercepts, and none of the handful of those arrested have been brought to trial or convicted. Read more of this story at Slashdot.

Excerpt from:
With a Single Wiretap Order, US Authorities Listened In on 3.3 Million Phone Calls

Equal Rights Center Sues Uber For Denying Equal Access To People Who Use Wheelchairs

The Equal Rights Center is suing Uber, alleging that the company has chosen not to include wheelchair-accessible cars as an option in its standard UberX fleet of vehicles, and excludes people who use wheelchairs in Washington, D.C. According to the lawsuit, Uber is in violation of Title 3 of the Americans with Disabilities Act and the D.C. Human Rights Act. TechCrunch reports: After conducting its own investigation of Uber’s services for people in wheelchairs, the ERC found that passengers had to wait an average of eight times longer for an accessible car to arrive. They also had to pay twice as much in fares, according to the ERC’s study. Ultimately, the ERC wants Uber to integrate wheelchair accessible cars into its UberX fleet so that people who use wheelchairs don’t have to wait longer and pay more to use the car service. Uber said in a statement provided to TechCrunch: “We take this issue seriously and are committed to continued work with the District, our partners, and stakeholders toward expanding transportation options and freedom of movement for all residents throughout the region.” Read more of this story at Slashdot.

View the original here:
Equal Rights Center Sues Uber For Denying Equal Access To People Who Use Wheelchairs