Researchers find Russian “VPNfilter” malware was a Swiss Army hacking knife

Router malware had nine different tools for exploiting networks.

Article intro image

Enlarge / VPNfilter had a total of nine modular tools discovered thus far by researchers, potentially turning thousands of routers into a versatile attack platform.

Researchers at Cisco's Talos have discovered that VPNfilter—the malware that prompted Federal Bureau of Investigation officials to urge people to reboot their Internet routers—carried an even bigger punch than had previously been discovered. While researchers already found that the malware had been built with multiple types of attack modules that could be deployed to infected routers, further research uncovered seven additional modules that could have been used to exploit the networks routers were attached to, thus stealing data and creating a covert network for command and control over future attacks. The malware appeared to be primarily intended to attack Ukraine on the anniversary of the NotPetya attack, but VPNfilter was clearly built for long-term use as a network exploitation and attack platform.

The initial discovery of the malware may have prevented the attackers from meeting their primary objective, but there are still thousands of routers worldwide that are affected by VPNfilter—including vulnerable Mikrotik routers that were heavily targeted by the attackers. This latest research points once again to the danger posed by the ever-increasing number of vulnerable and often unpatchable Internet and wireless routers and other "Internet of Things" devices.

VPNfilter, attributed, based on code elements, to APT 28 (also known as "Fancy Bear"), had been detected on a half million routers in 54 countries. The malware affects devices from Linksys, MikroTik, Netgear, and TP-Link and network-attached storage devices from QNAP, according to Cisco Talos researchers. Craig Williams, director of outreach at Talos, told Ars that the malware targeted known vulnerabilities in unpatched products—and it seemed to focus heavily on a remote configuration protocol for Mikrotik devices.

Read 6 remaining paragraphs | Comments

HTTPS: BSI vergisst Zertifikatswechsel

Die Webseite des Bundesamts für Sicherheit in der Informationstechnik ist zur Zeit nicht erreichbar. Dort hat man offenbar vergessen, sich rechtzeitig um ein neues TLS-Zertifikat zu kümmern. (BSI, Technologie)

Die Webseite des Bundesamts für Sicherheit in der Informationstechnik ist zur Zeit nicht erreichbar. Dort hat man offenbar vergessen, sich rechtzeitig um ein neues TLS-Zertifikat zu kümmern. (BSI, Technologie)

Windows 10 passes 700 million devices, 1 billion still far off

200 million users have been added in about 16 months.

Article intro image

Everywhere Windows 10 can be. And on the server, too, though there it gets a different branding. (credit: Microsoft)

Windows 10 is now on 700 million devices, according to executives speaking at the Ignite conference this week, reports Neowin.

Windows 10 has been the fastest-growing version of Windows, hitting 700 million in about three years on the market, but this nonetheless represents a big shortfall from Microsoft's original ambitions for the operating system. At its launch, the company said that it hoped to have one billion Windows 10 users within two to three years of release. At the time, the Windows 10 strategy covered not only desktop systems (and a number of Windows 10 variants, such as those used on HoloLens, Surface Hub, and Xbox), but also smartphones, with handsets expected to contribute hundreds of millions of users. With the abandonment of the smartphone market, Microsoft acknowledged that it wouldn't hit the user target on the original timeline.

The importance of that number was part of Microsoft's sales pitch to developers: the large potential market was intended to motivate developers to develop UWP applications that could run on desktops, tablets, phones, and Xboxes. While UWP still has benefits (for developers it provides an easier to use, more modern framework; for end-users, it gives easier and safer installation and updating), the reduced market reach and omission of the smartphone form factor has arguably diminished its appeal.

Read 2 remaining paragraphs | Comments

Vive’s wireless adapter gives the best VR experience lots of money can buy

For $300, HTC will cut that annoying tether tying you to your VR-ready PC.

Any consumer-grade VR headset you buy these days has its share of compromises. Buying a self-contained or phone-based headset (e.g. Oculus Go or Samsung's Gear VR) means giving up the power of a full-scale PC GPU and, usually, the freedom of full-scale head and hand motion tracking. But buying a tethered headset (e.g. Oculus Rift or HTC Vive) means being permanently tied to a bulky computer tower via an obtrusive cable.

HTC's new Vive Wireless Adapter does a fine job fixing that last particular compromise for Vive owners. With it, you can get the immersive graphical power of a high-end gaming PC and the freedom of being able to move around in a large VR space unencumbered by wires (or a bulky backpack laptop). It's a best-of-both-worlds solution that we recommend highly—if you can spare the $300 in additional cost, that is.

Setting it up: It just works

Read 13 remaining paragraphs | Comments

Sony’s walled garden cracks open: Cross-console play comes to PS4

Fortnite today, Sony “now in the planning process… for other titles going forward.”

Article intro image

Enlarge / One of these characters is playing on the PS4. Another on the Nintendo Switch. Amazing!

After what it calls "a thorough analysis of the business mechanics required," Sony announced on Wednesday the first crack in the PlayStation Network's walled garden approach to cross-console functionality. Starting today, Fortnite on the PS4 will allow for "cross-platform gameplay, progression, and commerce" with versions on the Nintendo Switch and Xbox One (in addition the Android, iOS, Windows, and Mac platforms where such support was already integrated).

While the "open beta" cross-console play only applies to Fortnite for now, Sony writes that it is "look[ing] to open up the platform" and is "now in the planning process across the organization to support this change... for other titles going forward." Elsewhere in the announcement, Sony says it has "identified a path toward supporting cross-platform features for select third-party content," suggesting the decision might still apply only on a case-by-case basis.

"For 24 years, we have strived to deliver the best gaming experience to our fans by providing a uniquely PlayStation perspective," Sony writes in the announcement. "Today, the communities around some games have evolved to the point where cross-platform experiences add significant value to players."

Read 4 remaining paragraphs | Comments

What is atrial fibrillation, and why is your watch telling you about it?

We explain why Apple’s decided to go after a condition you may never have heard of.

Image of a cardiac trace showing irregular activity.

Enlarge / See that irregular up-and-down motion right before the big beat? That's atrial fibrillation. (credit: NASA)

What's atrial fibrillation, and why has Apple decided that it's worth screening for it? The first question's much easier to answer, so let's get that out of the way.

Your heart has four chambers, two atria and two ventricles. The atria are smaller chambers at the top of the heart, and their contraction fills the larger ventricles with blood. The ventricles then provide the powerful push that sends the blood either to the lungs to pick up oxygen, or out to the body once it is oxygenated.

Got no rhythm

The proper coordination of the beating of all these parts requires a carefully synchronized spread of electrical signals through the four chambers. Given the complexity involved in getting this to work, it shouldn't be surprising that it sometimes goes wrong. The fault for problems can be anything from a temporary physical change to a permanent problem with your heart's development that started back when you were an embryo. The consequences can range from irrelevant to fatal.

Read 20 remaining paragraphs | Comments

Windows: Microsoft Search ergänzt die Suche um kontextbezogene Daten

Microsoft Search ist eine Erweiterung der Kontextsuche in Windows 10, Office 365 und Bing. Die Suche bezieht nutzerbezogene Daten stärker ein. Das können Dokumente, gespeicherte Kontakte, Einstellungen oder Kollegen innerhalb der Firma sein – je nachde…

Microsoft Search ist eine Erweiterung der Kontextsuche in Windows 10, Office 365 und Bing. Die Suche bezieht nutzerbezogene Daten stärker ein. Das können Dokumente, gespeicherte Kontakte, Einstellungen oder Kollegen innerhalb der Firma sein - je nachdem, in welchem Programm die Suche genutzt wird. (Bing, Microsoft)

Codemasters: Simulationslastiges Rennspiel Dirt Rally 2.0 angekündigt

Auf Strecken in sechs Ländern über Stock und Stein – und zwar so realistisch wie möglich: Codemasters hat das Rennspiel Dirt Rally 2.0 vorgestellt und auch gleich den Erscheinungstermin bekannt gegeben. (Dirt Rally, Rennspiel)

Auf Strecken in sechs Ländern über Stock und Stein - und zwar so realistisch wie möglich: Codemasters hat das Rennspiel Dirt Rally 2.0 vorgestellt und auch gleich den Erscheinungstermin bekannt gegeben. (Dirt Rally, Rennspiel)

Chrome: Google macht Zugeständnisse

Google geht auf die massive Kritik an Chrome 69 ein: Einige Änderungen sollen mit dem nächsten Release rückgängig gemacht oder abgemildert werden. Das www. wird dennoch aus der URL-Leiste verbannt. (Chrome, Google)

Google geht auf die massive Kritik an Chrome 69 ein: Einige Änderungen sollen mit dem nächsten Release rückgängig gemacht oder abgemildert werden. Das www. wird dennoch aus der URL-Leiste verbannt. (Chrome, Google)