Wochenrückblick: Wir hängen in der Luft und bleiben auf der Schiene

Die neuen Ryzen sind schnell, Adblocker legal – und eine Bergseilbahn kann Ziel eines Hackerangriffs werden. Da fahren wir lieber mit dem neuen Brennstoffzellenzug. (Golem-Wochenrückblick, Internet)

Die neuen Ryzen sind schnell, Adblocker legal - und eine Bergseilbahn kann Ziel eines Hackerangriffs werden. Da fahren wir lieber mit dem neuen Brennstoffzellenzug. (Golem-Wochenrückblick, Internet)

Russia hacked DNC as early as 2015, Democrats claim in new lawsuit

“It’s more than a shot over the bow, it’s a shot into the hull of the ship.”

Enlarge / Tom Perez, the head of the DNC, helped orchestrate this new lawsuit. (credit: Gage Skidmore)

The Democratic National Committee has sued Russia, WikiLeaks, the Trump campaign, and a number of other individuals and organizations that the political party believes were affiliated with the now-infamous 2016 hack, whose perpetrators managed to spirit away internal research about then-candidate Donald Trump, as well as private e-mail and messages.

The operation to pilfer vast caches of data, much of which was then published by WikiLeaks, was believed to have been orchestrated by the highest levels of the Russian government.

"It’s pretty serious—it’s more than a shot over the bow, it’s a shot into the hull of the ship," David Bowker, a Washington DC, attorney, told Ars.

Read 20 remaining paragraphs | Comments

Capcom reminds us why “games-as-a-service” suck, announces end of Puzzle Fighter

Will stop working on July 31, giving it eight total months of life.

Enlarge / RIP Puzzle Fighter, 2017-2018. (credit: Capcom)

The games-as-a-service graveyard grew one larger this week, as Capcom's Puzzle Fighter reboot received an official "sunset" announcement on Friday. The iOS and Android port of the '90s puzzle series will have its in-game store shut down on Monday, April 23, and its servers will follow suit on July 31—meaning the game will have been playable for only eight months after its late-November launch.

That's because the new, free-to-play Puzzle Fighter includes an always-online requirement so that players can be subjected to the timers and loot-box systems applied to both its single-player and multiplayer modes. Capcom's announcement did not in any way hint to a patch that would let the game work in a wholly offline mode, nor did it hint to any open-sourcing of its content so that dedicated players could, say, prop the game's bones up via DIY servers.

Friday's announcement also didn't reference the fact that this game's reboot recently received PEGI ratings (Europe's equivalent of the ESRB) for PC and consoles. And the language here doesn't give us much hope for a non-mobile port of the Columns-like, match-gems puzzle update. Instead, the post blames the mobile version's cancellation on Capcom Vancouver "dedicating its focus to our flagship Dead Rising franchise."

Read 3 remaining paragraphs | Comments

Google’s Crostini lets you run GNU/Linux apps on Chromebooks without enabling developer mode

People have been running Ubuntu and other GNU/Linux distributions on Chromebooks for almost as long as Chromebooks have been available. While some folks have replaced Chrome OS altogether or created dual boot systems, the simplest method is to use Crou…

People have been running Ubuntu and other GNU/Linux distributions on Chromebooks for almost as long as Chromebooks have been available. While some folks have replaced Chrome OS altogether or created dual boot systems, the simplest method is to use Crouton, which allows you to install a Linux distribution in a chroot environment, allowing you to […]

The post Google’s Crostini lets you run GNU/Linux apps on Chromebooks without enabling developer mode appeared first on Liliputing.

“Drupalgeddon2” touches off arms race to mass-exploit powerful Web servers

Bug patched in March is still being exploited to take full control of servers.

Enlarge (credit: Torkild Retvedt)

Attackers are mass-exploiting a recently fixed vulnerability in the Drupal content management system that allows them to take complete control of powerful website servers, researchers from multiple security companies are warning.

At least three different attack groups are exploiting "Drupalgeddon2," the name given to an extremely critical vulnerability Drupal maintainers patched in late March, researchers with Netlab 360 said Friday. Formally indexed as CVE- 2018-7600, Drupalgeddon2 makes it easy for anyone on the Internet to take complete control of vulnerable servers simply by accessing a URL and injecting publicly available exploit code. Exploits allow attackers to run code of their choice without having to have an account of any type on a vulnerable website. The remote-code vulnerability harkens back to a 2014 Drupal vulnerability that also made it easy to commandeer vulnerable servers.

Drupalgeddon2 "is under active attack, and every Drupal site behind our network is being probed constantly from multiple IP addresses," Daniel Cid, CTO and founder of security firm Sucuri, told Ars. "Anyone that has not patched is hacked already at this point. Since the first public exploit was released, we are seeing this arms race between the criminals as they all try to hack as many sites as they can."

Read 6 remaining paragraphs | Comments

Avira releases free Privacy Pal tool for Windows

Anti-virus company Avira’s latest application isn’t so much about protecting your computer from viruses as it is about giving you more control over the personal data collected by your web browser and other apps. It’s a free application called Privacy P…

Anti-virus company Avira’s latest application isn’t so much about protecting your computer from viruses as it is about giving you more control over the personal data collected by your web browser and other apps. It’s a free application called Privacy Pal that lets you delete the cookies, cache, browsing history, download history, and other data […]

The post Avira releases free Privacy Pal tool for Windows appeared first on Liliputing.

When you go to a security conference, and its mobile app leaks your data

RSA Conference attendee contact data extracted using hard-coded API data.

Enlarge / Screenshots of the RSA Conference application from the Google Play Store. The app's Web interface leaked attendee data when supplied with a token obtained by registering the app. (credit: Google Play Store )

A mobile application built by a third party for the RSA security conference in San Francisco this week was found to have a few security issues of its own—including hard-coded security keys and passwords that allowed a researcher to extract the conference's attendee list. The conference organizers acknowledged the vulnerability on Twitter, but they say that only the first and last names of 114 attendees were exposed.

The vulnerability was discovered (at least publicly) by a security engineer who tweeted discoveries during an examination of the RSA conference mobile app, which was developed by Eventbase Technology. Within four hours of the disclosure, Eventbase had fixed the data leak—an API call that allowed anyone to download data with attendee information.

Accessing the attendee list required registering an account for the application, logging in, and then grabbing a token from an XML file stored by the application. Since registration for the application only required an email address, anyone who could dump the files from their Android device could obtain the token and then insert it into a Web-based application interface call to download attendee names. While the SQLite database downloaded was encrypted, another API call provided that key.

Read 2 remaining paragraphs | Comments

Here are the types of marijuana best for stress and anxiety, according to users

For depression, use may exacerbate symptom severity over time.

Enlarge / Inventory including "Merry N'Berry" is on display at a medical marijuana dispensary (credit: Getty | Tom Williams)

By passively monitoring user-generated data from medical cannabis patients, researchers have glimpsed the types and amounts of marijuana that seem effective for relieving symptoms of stress, anxiety, and depression. The findings could direct more detailed research into the best strains for specific conditions. But the data also hints at a danger of using marijuana to manage depression symptoms in the long term.

The study, published this week in the Journal of Affective Disorders by researchers at Washington State University, is based on data from a medical cannabis app called Strainprint, which lets patients track symptom severity after medical cannabis use. Before that, users enter detailed information about the strain of marijuana used, including selecting specific products from a list of those sold by licensed medical cannabis distributors in Canada. Health Canada has uniquely strict production and quality control guidelines for products sold there. But if a patient is using a product not on the list, they can manually input information about the strain, including cannabinoid content.

The researchers looked at data from nearly 1,400 medical cannabis users, analyzing outcomes from almost 12,000 inhalation sessions. The researchers kept their analysis just to sessions involving inhalation (smoking, vaping, concentrates, dab bubbler, dab portable), to try to control—at least a little—for efficacy and timing of the onset of effects.

Read 15 remaining paragraphs | Comments

Facebook Privacy Fiasco Sees Congress Urged on Anti-Piracy Action

Coalitions representing more than 670 companies and 240,000 members from the entertainment sector has written to Congress urging a strong response to the Facebook privacy fiasco. The groups, which include all the major Hollywood studios and key players from the music industry, are calling for Silicon Valley as a whole to be held accountable for whatever appears on their platforms.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

It has been a tumultuous few weeks for Facebook, and some would say quite rightly so. The company is a notorious harvester of personal information but last month’s Cambridge Analytica scandal really brought things to a head.

With Facebook co-founder and Chief Executive Officer Mark Zuckerberg in the midst of a PR nightmare, last Tuesday the entrepreneur appeared before the Senate. A day later he faced a grilling from lawmakers, answering questions concerning the social networking giant’s problems with user privacy and how it responds to breaches.

What practical measures Zuckerberg and his team will take to calm the storm are yet to unfold but the opportunity to broaden the attack on both Facebook and others in the user-generated content field is now being seized upon. Yes, privacy is the number one controversy at the moment but Facebook and others of its ilk need to step up and take responsibility for everything posted on their platforms.

That’s the argument presented by the American Federation of Musicians, the Content Creators Coalition, CreativeFuture, and the Independent Film & Television Alliance, who together represent more than 650 entertainment industry companies and 240,000 members. CreativeFuture alone represents more than 500 companies, including all the big Hollywood studios and major players in the music industry.

In letters sent to the Senate Committee on the Judiciary; the Senate Committee on Commerce, Science, and Transportation; and the House Energy and Commerce Committee, the coalitions urge Congress to not only ensure that Facebook gets its house in order, but that Google, Twitter, and similar platforms do so too.

The letters begin with calls to protect user data and tackle the menace of fake news but given the nature of the coalitions and their entertainment industry members, it’s no surprise to see where this is heading.

“In last week’s hearing, Mr. Zuckerberg stressed several times that Facebook must ‘take a broader view of our responsibility,’ acknowledging that it is ‘responsible for the content’ that appears on its service and must ‘take a more active view in policing the ecosystem’ it created,” the letter reads.

“While most content on Facebook is not produced by Facebook, they are the publisher and distributor of immense amounts of content to billions around the world. It is worth noting that a lot of that content is posted without the consent of the people who created it, including those in the creative industries we represent.”

The letter recalls Zuckerberg as characterizing Facebook’s failure to take a broader view of its responsibilities as a “big mistake” while noting he’s also promised change.

However, the entertainment groups contend that the way the company has conducted itself – and the manner in which many Silicon Valley companies conduct themselves – is supported and encouraged by safe harbors and legal immunities that absolve internet platforms of accountability.

“We agree that change needs to happen – but we must ask ourselves whether we can expect to see real change as long as these companies are allowed to continue to operate in a policy framework that prioritizes the growth of the internet over accountability and protects those that fail to act responsibly. We believe this question must be at the center of any action Congress takes in response to the recent failures,” the groups write.

But while the Facebook fiasco has provided the opportunity for criticism, CreativeFuture and its colleagues see the problem from a much broader perspective. They suck in companies like Google, which is also criticized for shirking its responsibilities, largely because the law doesn’t compel it to act any differently.

“Google, another major global platform that has long resisted meaningful accountability, also needs to step forward and endorse the broader view of responsibility expressed by Mr. Zuckerberg – as do many others,” they continue.

“The real problem is not Facebook, or Mark Zuckerberg, regardless of how sincerely he seeks to own the ‘mistakes’ that led to the hearing last week. The problem is endemic in a system that applies a different set of rules to the internet and fails to impose ordinary norms of accountability on businesses that are built around monetizing other people’s personal information and content.”

Noting that Congress has encouraged technology companies to prosper by using a “light hand” for the past several decades, the groups say their level of success now calls for a fresh approach and a heavier touch.

“Facebook and Google are grown-ups – and it is time they behaved that way. If they will not act, then it is up to you and your colleagues in the House to take action and not let these platforms’ abuses continue to pile up,” they conclude.

But with all that said, there is an interesting conflict that develops when presenting the solution to piracy in the context of a user privacy fiasco.

In the EU, many of the companies involved in the coalitions above are calling for pre-emptive filters to prevent allegedly infringing content being uploaded to Facebook and YouTube. That means that all user uploads to such platforms will have to be opened and scanned to see what they contain before they’re allowed online.

So, user privacy or pro-active anti-piracy filters? It might not be easy or even legal to achieve both.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

Deals of the Day (4-20-2018)

The Jackery Bolt is a portable battery with enough juice to recharge most smartphones around 2-3 times. But the main reason The WireCutter considers it to be the top battery packs for every day use is that it has built-in cables that let you plug the b…

The Jackery Bolt is a portable battery with enough juice to recharge most smartphones around 2-3 times. But the main reason The WireCutter considers it to be the top battery packs for every day use is that it has built-in cables that let you plug the battery into any device with a microUSB port or […]

The post Deals of the Day (4-20-2018) appeared first on Liliputing.