Code-execution flaws threaten users of routers, Linux, and other OSes

Bugs in widely used Dnsmasq give attackers remote control of vulnerable systems.

Enlarge (credit: Christiaan Colen)

Google researchers have discovered at least three software bugs in a widely used software package that may allow hackers to execute malicious code on vulnerable devices running Linux, FreeBSD, OpenBSD, NetBSD, and macOS, as well as proprietary firmware.

Dnsmasq, as the package is known, provides code that makes it easier for networked devices to communicate using the domain name system and the Dynamic Host Configuration Protocol. It's included in Android, Ubuntu, and most other Linux distributions, and it can also run on a variety of other operating systems and in router firmware. A blog post published Monday by security researchers with Google said they recently found seven vulnerabilities in Dnsmasq, three of which were flaws that allowed the remote execution of malicious code.

One of the code-execution flaws, indexed as CVE-2017-14493, is a "trivial-to-exploit, DHCP-based, stack-based buffer overflow vulnerability." Combined with a separate information leak bug Google researchers also discovered, attackers can bypass a key protection known as address space layout randomization, which is designed to prevent malicious payloads included in exploits from executing. As a result, exploits result in a simple crash, rather than a security-compromising hack. By chaining the code-execution and information leak exploits together, attackers can circumvent the defense to run any code of their choosing.

Read 2 remaining paragraphs | Comments

Windows Mixed Reality: Samsungs VR-Headset Odyssey löst am höchsten auf

Während Microsofts bisherige fünf Partner für Windows Mixed Reality die gleiche Basis-Hardware verwenden, setzt Samsung auf andere Technik: Das Odyssey genannte VR-Headset unterscheidet sich beim Display und integriert Kopfhörer. (VR, Microsoft)

Während Microsofts bisherige fünf Partner für Windows Mixed Reality die gleiche Basis-Hardware verwenden, setzt Samsung auf andere Technik: Das Odyssey genannte VR-Headset unterscheidet sich beim Display und integriert Kopfhörer. (VR, Microsoft)

Porn Copyright Trolls Terrify 60-Year-Old But Age Shouldn’t Matter

As people get used to the wave of copyright trolling that has flooded the Internet in recent years, fewer cases hit the headlines. Every now and again, however, a special case appears, such as the one in Canada where a 60-year-old woman has been accused of downloading porn several times. She’s reportedly terrified, but should age be the only defense against these scare tactics?

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Of all the anti-piracy tactics deployed over the years, the one that has proven most controversial is so-called copyright-trolling.

The idea is that rather than take content down, copyright holders make use of its online availability to watch people who are sharing that material while gathering their IP addresses.

From there it’s possible to file a lawsuit to obtain that person’s identity but these days they’re more likely to short-cut the system, by asking ISPs to forward notices with cash settlement demands attached.

When subscribers receive these demands, many feel compelled to pay. However, copyright trolls are cunning beasts, and while they initially ask for payment for a single download, they very often have several other claims up their sleeves. Once people have paid one, others come out of the woodwork.

That’s what appears to have happened to a 60-year-old Canadian woman called ‘Debra’. In an email sent via her ISP, she was contacted by local anti-piracy outfit Canipre, who accused her of downloading and sharing porn. With threats that she could be ‘fined’ up to CAD$20,000 for her alleged actions, she paid the company $257.40, despite claiming her innocence.

Of course, at this point the company knew her name and address and this week the company contacted her again, accusing her of another five illegal porn downloads alongside demands for more cash.

“I’m not sleeping,” Debra told CBC. “I have depression already and this is sending me over the edge.”

If the public weren’t so fatigued by this kind of story, people in Debra’s position might get more attention and more help, but they don’t. To be absolutely brutal, the only reason why this story is getting press is due to a few factors.

Firstly, we’re talking here about a woman accused of downloading porn. While far from impossible, it’s at least statistically less likely than if it was a man. Two, Debra is 60-years-old. That doesn’t preclude her from being Internet savvy but it does tip the odds in her favor somewhat. Thirdly, Debra suffers from depression and claims she didn’t carry out those downloads.

On the balance of probabilities, on which these cases live or die, she sounds believable. Had she been a 20-year-old man, however, few people would believe ‘him’ and this is exactly the environment companies like Canipre, Rightscorp, and similar companies bank on.

Debra says she won’t pay the additional fines but Canipre is adamant that someone in her house pirated the porn, despite her husband not being savvy enough to download. The important part here is that Debra says she did not commit an offense and with all the technology in the world, Canpire cannot prove that she did.

“How long is this going to terrorize me?” Debra says. “I’m a good Canadian citizen.”

But Debra isn’t on her own and she’s positively spritely compared to Christine McMillan, who last year at the age of 86-years-old was accused of illegally downloading zombie game Metro 2033. Again, those accusations came from Canipre and while the case eventually went quiet, you can safely bet the company backed off.

So who is to blame for situations like Debra’s and Christine’s? It’s a difficult question.

Clearly, copyright holders feel they’re within their rights to try and claw back compensation for their perceived losses but they already have a legal system available to them, if they want to use it. Instead, however, in Canada they’re abusing the so-called notice-and-notice system, which requires ISPs to forward infringement notices from copyright holders to subscribers.

The government knows there is a problem. Law professor Michael Geist previously obtained a government report, which expresses concern over the practice. Its summary is shown below.

Advice summary

While the notice-and-notice regime requires ISPs to forward educational copyright infringement notices, most ISPs complain that companies like Canipre add on cash settlement demands.

“Internet intermediaries complain…that the current legislative framework does not expressly prohibit this practice and that they feel compelled to forward on such notices to their subscribers when they receive them from copyright holders,” recent advice to the Minister of Innovation, Science and Economic Development reads.

That being said, there’s nothing stopping ISPs from passing on the educational notices as required by law but insisting that all demands for cash payments are removed. It’s a position that could even get support from the government, if enough pressure was applied.

“The sending of such notices could lead to abuses, given that consumers may be pressured into making payments even in situations where they have not engaged in any acts that violate copyright laws,” government advice notes.

Given the growing problem, it appears that ISPs have the power here so maybe it’s time they protected their customers. In the meantime, consumers have responsibilities too, not only by refraining from infringing copyright, but by becoming informed of their rights.

“[T]here is no legal obligation to pay any settlement offered by a copyright owner, and the regime does not impose any obligations on a subscriber who receives a notice, including no obligation to contact the copyright owner or the Internet intermediary,” government advice notes.

Hopefully, in future, people won’t have to be old or ill to receive sympathy for being wrongly accused and threatened in their own homes. But until then, people should pressure their ISPs to do more while staying informed.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Windows Mixed Reality headsets up for pre-order, most ship Oct 17th

The first sub-$500 headsets designed for Windows Mixed Reality are now up for pre-order, and most models should ship on October 17th. Windows Mixed Reality is a new feature built into Windows 10 Fall Creators Update which brings native support for virtual reality to Microsoft’s desktop operating system. Know what else ships October 17th? The […]

Windows Mixed Reality headsets up for pre-order, most ship Oct 17th is a post from: Liliputing

The first sub-$500 headsets designed for Windows Mixed Reality are now up for pre-order, and most models should ship on October 17th. Windows Mixed Reality is a new feature built into Windows 10 Fall Creators Update which brings native support for virtual reality to Microsoft’s desktop operating system. Know what else ships October 17th? The […]

Windows Mixed Reality headsets up for pre-order, most ship Oct 17th is a post from: Liliputing

LIGO’s gravitational wave detection takes home a Nobel

A theoretician, a hardware builder, and a project organizer share the honor.

A 4km arm of the LIGO interferometer stretches into the foggy distance. (credit: Eric Berger)

From almost the moment their discovery was announced, everyone agreed that the first sighting of gravitational waves was going to win a Nobel Prize. The only questions were when and who would receive the honor. Both of those questions have now been answered. When is now, and who turned out to be three individuals who contributed to the project in very different ways.

Caltech's Kip Thorne, a theoretician who made sure we knew what a gravitational wave would look like when we saw it, was one honoree. He was joined by Rainer Weiss, an MIT scientist who helped build some of the first prototype detectors that would eventually inspire the LIGO design, and Barry Barish, another Caltech physicist who was put in charge of the LIGO collaboration and became instrumental in ensuring that the hardware was built and that a large international collaboration was present to operate it and analyze the results.

While LIGO was a stunning success, its history suggests that there were countless ways it and the entire field of gravitational wave physics might have failed. And those ways all lead back to the very person whose work suggested that space-time itself could experience ripples.

Read 15 remaining paragraphs | Comments

Fully driverless cars could be months away

Google’s self-driving car unit prepares to launch a taxi service near Phoenix.

Enlarge / Waymo is using a fleet of Chrysler Pacifica Hybrid minivans to develop its self-driving technology. (credit: Waymo)

Real driverless cars could come to the Phoenix area this year, according to a Monday report from The Information's Amir Efrati. Two anonymous sources have told Efrati that Google's self-driving car unit, Waymo, is preparing to launch "a commercial ride-sharing service powered by self-driving vehicles with no human 'safety' drivers as soon as this fall."

Obviously, there's no guarantee that Waymo will hit this ambitious target. But it's a sign that Waymo believes its technology is very close to being ready for commercial use. And it suggests that Waymo is likely to introduce a fully driverless car network in 2018 if it doesn't do so in the remaining months of 2017.

Waymo plans to launch first in the Phoenix suburbs

Efrati reports that Waymo CEO John Krafcik faces pressure from his boss, Google co-founder and Alphabet CEO Larry Page, to transform Waymo's impressive self-driving technology into a shipping product. Page had been pushing for a launch by the end of 2016. But a major deal with Ford to produce the necessary vehicles fell through, forcing Waymo to scramble and sign a smaller deal with Fiat Chrysler to supply minivans.

Read 9 remaining paragraphs | Comments

Deals of the Day (10-03-2017)

Have an Amazon Prime membership and need a new Kindle? Amazon is selling models for between $30 and $50 off… but only to Prime members. Or if you’re cool with refurbished devices, you can head over to Woot, where recertified tablets are going for as little as $25 and you can pick up a refurbished […]

Deals of the Day (10-03-2017) is a post from: Liliputing

Have an Amazon Prime membership and need a new Kindle? Amazon is selling models for between $30 and $50 off… but only to Prime members. Or if you’re cool with refurbished devices, you can head over to Woot, where recertified tablets are going for as little as $25 and you can pick up a refurbished […]

Deals of the Day (10-03-2017) is a post from: Liliputing

Original Star Fox staffer tells story of sequel’s shelving, surprise launch

Before Dylan Cuthbert founded Q Games, he made 3D magic on Nintendo systems.

Enlarge / Dylan Cuthbert, in a goofy photo sent to Ars by his current company Q Games. (credit: Q Games)

There's a chance—albeit a slim one, thanks to launch-week sellouts—that you've gotten your hands on Nintendo's brand-new Super NES Classic Edition hardware. If you did get one, there's a significant chance you made a beeline for its most interesting game: Star Fox 2, the company's canceled 1996 space shooter. This game's circumstances are incredibly rare for the game industry: a shelved, completely finished game resurfacing 21 years later as a surprise "from the vault" gem.

If you think you were surprised by Star Fox 2's appearance after all this time, though, you have nothing on the sequel's lead programmer, Dylan Cuthbert.

The former Argonaut Software programmer and eventual founder of Q Games (makers of the delightful Pixeljunk series) says he learned about Star Fox 2's retail release the same way everyone else did: via Twitter. "It was one of the greatest days of my life," he told Ars in an e-mail interview about that surprise discovery. He even slapped an ASCII smiley face onto that sentence to drive the point home. Better late than never!

Read 50 remaining paragraphs | Comments

Why some Senate Democrats voted to give Ajit Pai another term on FCC

Pai’s support mostly came from GOP senators, but four Democrats broke ranks.

Enlarge (credit: Getty Images | Nerthuz)

The Senate vote to give Federal Communications Commission Chairman Ajit Pai another term on the FCC yesterday went mostly along party lines, but four Democrats joined with Republicans to approve Pai's re-nomination.

Three of those Democrats explained why to Politico in a report this morning.

"I disagree with [Pai] on net neutrality, but the president has a right to the chairman because he won the election," Sen. Claire McCaskill (D-Mo.) said. McCaskill also said she has a good working relationship with Pai on the Lifeline program, which gives poor people subsidies for phone service or broadband. McCaskill and Pai have both focused on reducing waste and fraud in the program.

Read 14 remaining paragraphs | Comments

Naturopath teaches real doctors something—a new way to cause liver damage

As doctors facepalmed, patient recovered from toxic naturopathic “treatment.”

(credit: Champagne Suki)

In a medical first, a 38-year-old man with gallstones developed severe liver damage and jaundice after following the delusional advice of a practitioner of naturopathy, a pseudoscientific system that eschews evidence-based medicine.

Writing in BMJ Case Reports, doctors report that the naturopath told the man to take an excessive amount of Epsom salt for "stone dissolution." Such overdoses of the salt, aka magnesium sulfate, can cause diarrhea, breathing problems, kidney injury, and cardiac arrhythmias. But this is the first time doctors have ever reported that it caused liver damage.

Epsom salt is known to help with some conditions at lower doses. But, despite naturopathic claims of liver and gallbladder "flushes" and "cleanses," there is no evidence that Epsom salt can dissolve and help remove gallstones. In fact, even the actual medications that break up gallstones—such as ursodeoxycholic acid tablets—don’t work well and aren’t often prescribed. They can take years to dissolve the smallest of gallstones, which are typically little balls of cholesterol that clog up the bile-storing gallbladder. And once a patient stops taking the tablets, stones can form again. The recommended treatment for symptomatic gallstones is surgery to remove the gallbladder, which is a non-essential organ.

Read 5 remaining paragraphs | Comments