Month: August 2018

Enlarge (credit: Getty)

Entrenched businesses do not like disruptive new competitors. Perhaps that’s a simplistic generalization, but it certainly seems to be the case in a fight between the rental car industry and car sharing platforms like Turo and Maven. On Tuesday afternoon, Illinois Governor Bruce Rauner vetoed a bill that would have crippled the operations of the peer-to-peer car sharing companies in the state by adding large taxes to those who rented or loaned their cars through such services.

The bill in question started life uncontroversially, changing some rules about damage waivers and rental cars. But late in the legislative session, amendments written by lobbyists for Enterprise Rent-A-Car radically altered its meaning.

Illinois currently applies a five percent tax to car rentals, with extra local taxes of up to 20 percent in cities likes Chicago to pay for local bond issues for things like the convention center. The amendments changed the bill such that all those taxes would now apply to peer-to-peer car sharing, as well as requiring companies like Turo, Maven, and GetAround to comply with regulations about font sizes, physical premises design, having humans to physically inspect drivers licenses, and other rules that make no sense given the distributed nature of Internet-enabled peer-to-peer car sharing.

Here is the alpc bug as 0day: https://t.co/m1T3wDSvPX I don't fucking care about life anymore. Neither do I ever again want to submit to MSFT anyway. Fuck all of this shit.

— SandboxEscaper (@SandboxEscaper) August 27, 2018

A privilege escalation flaw in Windows 10 was disclosed earlier this week on Twitter. The flaw allows anyone with the ability to run code on a system to elevate their privileges to "SYSTEM" level, the level used by most parts of the operating system and the nearest thing that Windows has to an all-powerful superuser. This kind of privilege escalation flaw enables attackers to break out of sandboxes and unprivileged user accounts so they can more thoroughly compromise the operating system.

Microsoft has not exactly acknowledged the flaw exists; instead it offered a vague and generic statement: "Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is to provide solutions via our current Update Tuesday schedule." So, if the flaw is acknowledged (and it's certainly real!) then the company will most likely fix it in a regular update released on the second Tuesday of each month.

The tweet links to a GitHub repository that contains a write-up of the issue and demonstration code to exploit the flaw. The bug lies in the Task Scheduler service: it includes an improperly secured API that allows an attacker to overwrite most files on the system with contents of their choosing. By overwriting a file that's subsequently loaded into a privileged SYSTEM-level process, the attacker can run code of their choosing with SYSTEM privileges. The proof of concept overwrites a file used by Windows' printing subsystem—Windows will then run the attacker's code when an attempt is made to print.

Enlarge / A screen from the Pokemon Essentials interface showing how to build a map with the tool in RPG Maker.

Nintendo has a long history of using legal action to take down fan games based on its popular copyrighted franchises. Now the company is taking aim at one of the tools used to build some of those fan games.

Since 2007, Pokémon Essentials has been a crucial part of the Pokémon fan game community. As a free mod for the paid RPG Maker software, Pokémon Essentials offers all the graphics, music, maps, and tilesets a fan game maker needs to craft their own Poké-adventure.

Fans of the tool congregated around the PokeCommunity forums and a dedicated Pokémon Essentials wiki to download files, share creations, and discuss the scene. Earlier this week, however, PokéCommunity forum moderator Marin announced that "the Pokémon Essentials wikia and all downloads for it have been taken down due to a copyright claim by Nintendo of America." That means "we will not allow Pokémon Essentials or any of its assets to be hosted or distributed on PokéCommunity," the announcement reads. "We sincerely apologise that we have to do this, but there is no going around it."

Enlarge / SAN FRANCISCO, CA - APRIL 05: Used cooking oil is sucked out of a drum into a grease collection truck on April 5, 2013 in San Francisco, California. (Photo by Justin Sullivan/Getty Images) (credit: Getty Images)

On Monday, the Department of Justice announced the sentence of Gregory Schnabel, an Ohio man who had been illegally acquiring biofuel credits from the Environmental Protection Agency (EPA) and reselling them. Schnabel is just the latest to be sentenced: filings from Southern Ohio's district court (PDF) detail a handful of co-conspirators, many of whom have been sentenced over the last three years.

The claims against Schnabel outline a complicated inter-state scheme to earn credits from the EPA for producing biofuel that was never produced, that was minimally processed, or that was re-sold for another round of credits. The ill-gotten credits were then sold to buyers under the pretense that the credits were legitimately earned. In Schnabel's case, the Justice Department claims that he helped generate a staggering $47 million in fraudulent credits and more than $12 million in fraudulent tax credits from the IRS.

Schnabel was sentenced to 63 months in prison and was required to pay more than $26 million in restitution.