Month: August 2018

Another day, another speculative execution-based attack. Data protected by Intel's SGX—data that's meant to be protected even from a malicious or hacked kernel—can be read by an attacker thanks to leaks enabled by speculative execution.

Since publication of the Spectre and Meltdown attacks in January this year, security researchers have been taking a close look at speculative execution and the implications it has for security. All high-speed processors today perform speculative execution: they assume certain things (a register will contain a particular value, a branch will go a particular way) and perform calculations on the basis of those assumptions. It's an important design feature of these chips that's essential to their performance, and it has been for 20 years.

Enlarge / FCC Chairman Ajit Pai listens during a Senate Appropriations Subcommittee hearing in Washington, DC, on June 20, 2017. (credit: Getty Images | Bloomberg)

Democratic members of Congress want to know when Federal Communications Commission Chairman Ajit Pai knew that the FCC's claims about being hit by a DDoS attack were false.

An FCC Inspector General (IG) investigation found that the FCC lied to members of Congress multiple times in letters that answered questions about DDoS attacks that never happened. Pai's FCC claimed for more than a year that a May 2017 outage in the public comments system was caused by multiple DDoS attacks. In reality, the FCC system crashed because it was unable to handle an influx of comments triggered by comedian John Oliver asking viewers of his program Last Week Tonight to oppose Pai's net neutrality repeal.

Today, four Democrats on the House Energy and Commerce Committee sent a letter to Pai "demanding to know when he and his staff learned that the Commission had provided inaccurate information about why its comment system went down during the net neutrality repeal public comment period," the Democrats said in an announcement.

Greetings, Arsians! Courtesy of our friends at TechBargains, we have another round of deals to share. Today's list is headlined by a deal on Bose's QuietComfort 35 (Series II) wireless noise-cancelling headphones, which are currently down to $299 at Walmart, Amazon, and various other retailers. That's a $50 discount and the lowest non-promo-code price we've seen to date.

We've explained the deal with the QC35s before. While Bose's bass-boosting sound doesn't offer the accuracy or balance of other $300 cans (or even some below that), it's at least smooth. If noise cancellation is your top priority, though, the QC35s are simply stronger at silencing the outside world (particularly low-end frequencies) than their peers. They're also highly comfortable.

The Series II model here is actually a bit less effective at noise-cancellation than the older Series I model mentioned in the link above, but the difference isn't so huge as to be immediately noticeable. Since Bose has discontinued the Series I, you don't have much of a choice anyway. The Series II also adds a shortcut button for quickly accessing Alexa or the Google Assistant, if that's something you'd ever find handy. In any case, we rarely see the Series II on sale, so if you were interested in picking up a pair, today looks like a good opportunity to do so.

Enlarge (credit: Aurich Lawson)

The Department of Justice's attempt to reverse the AT&T/Time Warner merger received some help yesterday from an unexpected source: the Federal Communications Commission.

The FCC previously allowed AT&T to buy Time Warner without having to undergo a lengthy public-interest review, despite pushback from Democrats in the Senate and FCC. The DOJ fought the merger alone, ultimately losing a court ruling that allowed AT&T to complete the acquisition.

But the DOJ appealed that court ruling last month, and yesterday the FCC gave the DOJ's case a small boost. The FCC isn't actually supporting the DOJ's case, but the commission's filing points out an error made by the US District Court for the District of Columbia. In US District Judge Richard Leon's ruling against the DOJ, he said that he was "hesitant to assign any significant evidentiary value" to previous statements that AT&T and the AT&T-owned DirecTV made to the FCC. AT&T's own statements to the FCC, made in the years prior to the AT&T/Time Warner merger, supported the DOJ's case that a merged entity could raise the price of programming. Those AT&T statements were made as part of the FCC's 2010 review of the Comcast/NBCUniversal merger and in other FCC proceedings.

Enlarge / My DEF CON badge, complete with Wall of Sheep add-on. My puzzle quest is far from complete—it may require reprogramming and flipping a component. (credit: Sean Gallagher)

Nearly 30,000 people came to Las Vegas last week for the 26^th edition of DEF CON, the iconic security conference. And no small amount of the mental energy of that vast crowd was spent on one particular thing: the conference badge.

This year's badges, designed by Tymkrs, were elevated works of printed circuit board art with a collection of LED-lit features, including red and green human figures and a color-shifting DEF CON logo. But it quickly becomes apparent that there was a lot more going on here than just blinking lights.

DEF CON alternates year to year between electronic, hackable badges and non-electronic ones; last year's badges were a throwback design intended to celebrate the conference's 25^th anniversary. But every year, the badges include some sort of clue to a cryptographic challenge—three years ago, the badge was an actual vinyl record that required attendees to find a turntable to hear the puzzle clue.