Month: August 2019

Enlarge / The "warshipping" rig, exposed, with solar recharging panel. (credit: Sean Gallagher)

LAS VEGAS—Penetration testers have long gone to great lengths to demonstrate the potential chinks in their clients' networks before less friendly attackers exploit them. But in recent tests by IBM's X-Force Red, the penetration testers never had to leave home to get in the door at targeted sites, and the targets weren't aware they were exposed until they got the bad news in report form. That's because the people at X-Force Red put a new spin on sneaking in—something they've dubbed "warshipping."

Using less than $100 worth of gear—including a Raspberry Pi Zero W, a small battery, and a cellular modem—the X-Force Red team assembled a mobile attack platform that fit neatly within a cardboard spacer dropped into a shipping box or embedded in objects such as a stuffed animal or plaque. At the Black Hat security conference here last week, Ars got a close look at the hardware that has weaponized cardboard.

We've looked at such devices, typically referred to as "drop boxes," before. Ars even used one in our passive surveillance of an NPR reporter, capturing his network traffic and routing a dump of his packets across the country for us to sift through. Covert drop boxes (once a specialty of Pwnie Express) have taken the form of "wall wart" device chargers, Wi-Fi routers, and even power strips. And mobile devices have also been brought to play, allowing "war walking"—attacks launched remotely as a device concealed in a bag, suitcase, or backpack is carried nonchalantly into a bank, corporate lobby, or other targeted location.

Enlarge / A monitor seen on the floor of the New York Stock Exchange on Tuesday, Sept. 4, 2018. (credit: Getty Images | Bloomberg)

Verizon has sued the City of Rochester, N.Y., in order to avoid paying fees for deploying 5G equipment and fiber lines.

Verizon's lawsuit, filed in US District Court for the Western District of New York on Thursday, claims that the fees are higher than those allowed by federal law. As proof, Verizon points to a Federal Communications Commission preemption order from last year that attempts to limit the fees and aesthetic requirements cities and towns impose on carrier deployments. Rochester imposed its new fees in February of this year.

Verizon may have a good chance of winning its lawsuit if that FCC preemption order stands. But the FCC is being sued by cities from Washington, Oregon, California, and Arizona, which which claim that the preemption is illegal. (Cities from Florida, Colorado, Nevada, and New York also intervened in the lawsuit to support the case against the FCC.) The outcome of that case could affect the Verizon suit against Rochester and any similar lawsuits filed against cities in the future.

Enlarge (credit: Frank Lindecke / Flickr)

Microsoft is warning of a four new Windows vulnerabilities that are “wormable,” meaning they can be exploited to spread malware from one vulnerable computer to another without any user action in much the way the self-replicating WannaCry and NotPetya outbreaks did in 2017.

Similar to the so-called BlueKeep vulnerability Microsoft patched in May, the four bugs the company patched on Tuesday reside in Remote Desktop Services, which allow a user to take control of a remote computer or virtual machine over a network connection. The bugs—indexed as CVE-2019-1181, CVE-2019-1182, CVE-2019-1222, and CVE-2019-1226—make it possible to for unauthenticated attackers to execute malicious code by sending a specially crafted message when a protection known as Network Level Authentication is turned off, as many administrators in large organizations often do.

In such networks, it’s possible for exploits to ricochet from computer to computer. Leaving NLA on makes it harder for attacks to spread, since attackers must first have network credentials. The growing use of hacking tools such as Mimikatz, however, often enables attackers to surreptitiously obtain the needed credentials.

Enlarge / Hydrodynamic "invisibility cloaks" would hide objects from fluid flows and surface waves so that no wake is visible. (credit: J. Park et al., Phys. Rev. Lett. (2019))

Two separate teams of scientists have devised novel hydrodynamic "invisibility cloaks"—instead of shielding objects from light, the cloacks would shield them from fluid flows. The scientists described their work in two new papers in Physical Review Letters. These kinds of cloaking structures could one day help reduce drag on ships or submarines, or protect ships at a port or wharf from potential damage from strong waves.

Most so-called "invisibility cloaks" created thus far work in the electromagnetic regime and rely on metamaterials. A "metamaterial" is any material whose microscopic structure can bend light in ways light doesn't normally bend—a property called "the index of refraction." Natural materials have a positive index of refraction; certain manmade metamaterials—first synthesized in the lab in 2000—have a negative index of refraction, meaning they interact with light in such a way as to bend light around even very sharp angles.

Metamaterials typically involve a highly conductive metal like gold or copper arranged in carefully layered periodic lattice structures. When light passes through the material, it bends around the cloaked object, rendering it "invisible." You can see an object directly behind it but can't see the cloaked object itself. However, the effect is typically limited to specific wavelengths: microwaves, infrared light, or certain frequencies of sound or heat waves.

Enlarge / Why is this particular product Amazon's "Choice" when you search for a can opener, instead of an alternate item? Outside of Amazon, nobody actually knows. (credit: Amazon.com)

Amazon is a gigantic international marketplace filled with all sorts of goods from countless manufacturers and vendors—a selection so broad, it can easily overwhelm shoppers. Though the company doesn't really curate what's sold on its platform, it does do the equivalent of showing off certain products in the window with its "Amazon's Choice" label. The problem is, nobody outside Amazon knows how those choices get chosen... and some of those "choice" products are basically crap.

Several media outlets have tried and failed to learn how it all works, but this week members of the Senate have come knocking on Amazon's metaphorical door with some pointed questions. Democrats Bob Menendez of New Jersey and Richard Blumenthal of Connecticut are calling on Amazon to explain why certain products get that coveted Amazon's Choice badge to determine if the moniker "deceives consumers into purchasing products of inferior quality."

A search for a product like dish detergent returns more than 20,000 results, Blumenthal and Menendez write in a letter (PDF) addressed to Amazon CEO Jeff Bezos. Given that volume, consumers "look for distinctive product features to help narrow the extensive search results," and those shoppers "reasonably rely" on the Amazon's Choice label "to guide their final purchasing decisions."

Enlarge (credit: Govt. of Alberta / Flickr)

Science has struggled to increase the diversity of the research community, trying to ensure that everyone has an equal opportunity to contribute to humanity's advances. But science's struggles are nothing compared to those of the financial industry, where only about 1% of fund managers are women or minorities. While there have been some efforts made to increase diversity, finance stubbornly remains the domain of white males, even though firms run by women and minorities have, on average, produced equivalent returns.

To find out why this disparity exists, a group of Stanford researchers collaborated with a diverse financial firm to perform a relatively simple experiment. They created fake financial firms, swapped in headshots of black and white "managers," and asked actual asset managers to rate the firm's performance. The results showed that when performance was good, having black managers led to lower ratings than when the same performance was supposedly delivered by a white-led firm. While there were some differences when performance wasn't as high, the likely reasons for those differences aren't reassuring.

Assets and allocators

For everything from hedge funds to retirement investments, it's rare to have direct ownership of stocks. Instead, investments tend to go into funds that focus on specific aspects of the market, like energy or small capitalization firms. But these funds often don't invest in the stocks directly, either. Instead, financial specialists called "asset allocators" identify firms that have funds with the right mix of performance and targets, and these allocators invest in a number of them.