Month: November 2016

Enlarge

Online criminals—at least some of them wielding the notorious Mirai malware that transforms Internet-of-things devices into powerful denial-of-service cannons—have begun exploiting a critical flaw that may be present in millions of home routers.

Routers provided to German and Irish ISP customers for Deutsche Telekom and Eircom, respectively, have already been identified as being vulnerable, according to recently published reports from researchers tracking the attacks. The attacks exploit weaknesses found in routers made by Zyxel, Speedport, and possibly other manufacturers. The devices leave Internet port 7547 open to outside connections. The exploits use the opening to send commands based on the TR-069 and related TR-064 protocols, which ISPs use to remotely manage large fleets of hardware. According to this advisory published Monday morning by the SANS Internet Storm Center, honeypot servers posing as vulnerable routers are receiving exploits every five to 10 minutes.

SANS Dean of Research Johannes Ullrich said in Monday's post that exploits are almost certainly the cause behind an outage that hit Deutsche Telekom customers over the weekend. In a Facebook update, officials with the German ISP said 900,000 customers are vulnerable to the attacks until they are rebooted and receive an emergency patch. Earlier this month, researchers at security firm BadCyber reported that the same one-two port 7547/TR-064 exploit hit the home router of a reader in Poland. They went on to identify D1000 routers supplied by Eircom as also being susceptible and cited this post as support. The Shodan search engine shows that 41 million devices leave port 7547 open, while about five million expose TR-064 services to the outside world.

Enlarge (credit: Stanford University)

Yesterday, the Nikkei news service reported that the Japanese government is expecting the aftermath of the Fukushima nuclear meltdowns to cost nearly double its earlier estimates. Citing government sources, the report says the total expenses will run at least $176 billion and are likely to rise even further in the future.

While the utility that ran the plant, TEPCO, is ostensibly on the hook for damages, the Japanese government is supporting it in part through interest-free loans. The Ministry of Economy, Trade, and Industry is coordinating these loans with the Ministry of Finance, and Nikkei News apparently got ahold of a copy of a report that updates Finance on the expected costs that are going to be incurred. The government's previous official estimates were generated in 2013 and continued to be used in official statements, even though the scale of the challenges became more widely appreciated since.

The new estimates include more than $70 billion for compensation payments to citizens affected by the meltdowns, an increase of nearly 50 percent. Decontamination of the region around the Fukushima site is now pegged at over $40 billion, roughly double the previous estimate.

Enlarge / Walmart is practically throwing free stuff at you to get you to buy an Xbox One S. (credit: Wal-mart)

Don't blame us if you missed all the good deals on video games when Black Friday came around last week. We tried to tell you there were steep discounts to be had, But noooooo, you just wanted to stay in your warm house with your slippers and your leftovers and your Gilmore Girls binge-watching marathon.

Don't worry, you can now get similar (or even better) deals on video game hardware and software from the comfort of your home computing device as part of today's Cyber Monday deals. Even better, some of these discounts are set to last all "Cyber Week" thanks to the never-ending expansion of the holiday price wars. Still, there's reason to act fast—some of these deals may be pulled as they sell out of limited stock, so if you see a price you like, don't wait.

Gaming hardware

Target has the deal to beat for all major purchases today, including video game consoles. You'll get a 15-percent off coupon applied automatically at checkout for anything on the site Monday only. That reduces a $250 video game console bundle to $212.50, a $300 console to $240, a $400 console becomes $340, etc. It's quite the bargain.

The tip of a screwworm fly larvae. (credit: CSIRO)

A deadly, flesh-eating parasite has once again invaded southern Florida and is ravaging animals, sparking a local agricultural emergency. State and federal authorities there are now fighting to zap the invasive infestation before it can cause catastrophic damage to the region.

The New World screwworm fly, which infests open wounds and feasts on living tissue, was last seen in the US during the 1970s, following half-a-century of hard-fought eradication efforts in the Southeast US and Central America.

But this year, state officials in the Florida Keys started seeing grotesque lesions on Key deer—an endangered species that is the smallest of North America’s white-tailed deer. Since July, about 15 percent of the Key deer population (132 animals) have died of the infection, and authorities have found other animals in the area, mostly pets, infected. Authorities confirmed the fly’s return through lab testing in late September.

(credit: Jurgen Appelo)

Reddit has some site rules. A key one is that the site's users must follow the rules or be barred from participating in discussions. Then there's another rule, which we'll call the Prime Directive, because who doesn't like Star Trek. This directive prohibits the site's executives from editing comments to alter the site's community voice. Breaching that directive is perhaps Reddit's ultimate taboo.

But over the Thanksgiving holiday, Reddit CEO Steve Huffman conceded that he violated the directive. Some negative comments directed at his username—"spez"—were substituted with the names of moderators of a pro-Donald Trump subreddit called "r/the_donald."

Hey Everyone,
Yep. I messed with the "fuck u/spez" comments, replacing "spez" with r/the_donald mods for about an hour. It’s been a long week here trying to unwind the r/pizzagate stuff. As much as we try to maintain a good relationship with you all, it does get old getting called a pedophile constantly. As the CEO, I shouldn’t play such games, and it’s all fixed now. Our community team is pretty pissed at me, so I most assuredly won’t do this again.
Fuck u/spez.

Huffman did not immediately respond to a request for comment. His concession generated thousands of comments over the weekend.

Enlarge (credit: DriveTribe)

Earlier this year, we found out that in addition to The Grand Tour, Jeremy Clarkson, James May, and Richard Hammond were looking to take over a slice of the automotive Internet. Meant to be a "digital hub for motoring," DriveTribe is a Facebook-powered social media platform that has in recent weeks swept up a large number of well-known car journalists, including, it seems, most of the staff of Evo magazine. It's also a completely separate venture to the Amazon-funded TV show. This morning, DriveTribe opened its doors to the general public.

The concept, which Hammond described to Clarkson as "like YouPorn, only with cars," is simple enough. After signing in via your Facebook account—so no DriveTribe for you, Lee Hutchinson—you're asked to pick a selection of tribes, or content feeds, that suit your automotive interests. (You can also create your own tribe). These feeds contain all manner of stuff; short, tweet-like messages, a photo (or several), or even a lengthy article. Some tribes, and some members, are also given a blue tick, indicating that these are blessed by the management as being official. Users can bump posts, comment on them, share them, and so on—all the things you'd expect of a social media platform.

By signing up so many content producers before the fact, DriveTribe ought to have a sufficiently steady stream of fresh stuff to look at—lack of content is always a peril with a new Internet venture. Promisingly, the intellectual property rights to all that content remain with whoever posted it; DriveTribe CEO Ernesto Schmitt (one of the founders along with the GT three and their producer Andy Wilman) told Business Insider that the plan is to make money through native advertising.