Scammers try a new way to steal online shoppers’ payment-card data

Skimmers host fraudulent third-party processor that looks just like the real thing.

Scammers try a new way to steal online shoppers’ payment-card data

Enlarge (credit: Daniel Foster / Flickr)

Thieves have devised a new way to steal payment-card data from online shoppers—or at least it's new to the researcher who found it. Rather than infecting a merchant's checkout page with malware that skims the information, the thieves trick users into thinking they've been redirected to an authorized third-party payment processor.

So-called payment-service platforms are common in the world of ecommerce, particularly for smaller sites that don't have the resources to harden their servers against sophisticated attacks. That includes the rash of hacks coming from so-called Magecart groups that target the Magento ecommerce Web platform. Rather than assuming the considerable risk of hacks that steal passwords, payment card details, or other sensitive data, sites can offload the payment card charges to experienced PSPs.

Jérôme Segura, head of threat intelligence at security provider Malwarebytes, said he recently found an attack that targets sites that use this type of arrangement. By infecting the merchant site and adding a line or two of code, the attackers redirect users to a fake PSP rather than the legitimate one, at the time of purchase. The ruse works similarly to a phishing attack. Graphics that mimic real services, custom-created domain names, and other sleights of hand trick end users into thinking they've landed on a genuine third-party processor.

Read 6 remaining paragraphs | Comments

5G: Antrag gegen Huawei auf CDU-Parteitag entschärft

Norbert Röttgen kämpft weiter gegen Huawei in Deutschland. Doch sein Antrag für den laufenden Parteitag wurde von der Parteiführung weitgehend entschärft. (Huawei, Handy)

Norbert Röttgen kämpft weiter gegen Huawei in Deutschland. Doch sein Antrag für den laufenden Parteitag wurde von der Parteiführung weitgehend entschärft. (Huawei, Handy)

Shenmue 3 angespielt: Herr Hazuki zwischen Spielspaß und Staub

Nach 18 Jahren geht das Abenteuer von Ryo Hazuki endlich weiter: Shenmue 3 schickt Spieler in eine Welt voll mit merkwürdigen Figuren, antiquiertem Gameplay und mittelguten Faustkämpfen – für Serienfans ist das trotzdem eine Offenbarung. (Shenmue, Adve…

Nach 18 Jahren geht das Abenteuer von Ryo Hazuki endlich weiter: Shenmue 3 schickt Spieler in eine Welt voll mit merkwürdigen Figuren, antiquiertem Gameplay und mittelguten Faustkämpfen - für Serienfans ist das trotzdem eine Offenbarung. (Shenmue, Adventure)

How Modern Warfare smooths over the horrors of war

The new Call of Duty feels all the more artificial as it grasps for “realism.”

Hadir, how old are you?

Enlarge / Hadir, how old are you? (credit: Activision and Infinity Ward)

It's not that “We need that truck” and “Find a gun" are unusual orders to be given in a video game. Certainly not in a Call of Duty video game. The series has always impelled players forward with extended drills of Sergeant Simon Says (“Man that mortar!” “Plant those charges!” “Take out that sniper!”). So normally, I would hop to it reflexively. I’ve called in airstrikes and breached into rooms of uncounted hostiles just because some grizzled green beret barked at me. It’s not that.

What strikes me when playing the new Call of Duty: Modern Warfare is that the directives are coming from someone who’s 10 years old, tops. He’s telling his sister (no older) to go kill a couple Russian soldiers and steal their truck.

I’m already familiar with these two as adults in the present, where they’re Hadir and Farah, ultracompetent freedom fighters for the nation of Urzikstan. But this is a flashback to what I’m to understand is their first brush with war, when occupying Russian forces gas their village and kill their father.

Read 47 remaining paragraphs | Comments

Rocket Report: Corruption abounds in Vostochny, China winning launch race

“How can you deal with it without declaring war on your own elite?”

A Falcon 9 rocket launches from Vandenberg Air Force Base.

Enlarge / A Falcon 9 rocket launches from Vandenberg Air Force Base. (credit: SpaceX)

Welcome to Edition 2.23 of the Rocket Report! Thank you for your patience last week, and we're now back to business as usual. There's a lot of news to catch up on, including the brave new world in which China now will apparently lead the globe in annual launches on a regular basis.

As always, we welcome reader submissions, and if you don't want to miss an issue, please subscribe using the box below (the form will not appear on AMP-enabled versions of the site). Each report will include information on small-, medium-, and heavy-lift rockets as well as a quick look ahead at the next three launches on the calendar.

Read 24 remaining paragraphs | Comments

Staffsource: Ars staffers’ most wished-for gifts in 2019

No holds barred: what’s your most coveted item this holiday season?

Staffsource: Ars staffers’ most wished-for gifts in 2019

Enlarge (credit: Getty Images / Maurizio Cigognetti)

Now is the time of year when most of us are asked by loved ones "What do you want for X holiday?" Just to add to the anxiety of our staffers, we decided to ask them that question as well—what are the things Ars staffers would most like to receive this holiday season?

But the question was phrased with intention. We were curious not what staffers expect to receive this season, but instead what they'd be most giddy to unwrap during the holidays. We knew that doing so would get us a lot of interesting answers, and our staffers didn't disappoint. Responses ran the gamut of tangible and intangible desirables, some of which are truly shoot-for-the-stars gifts and at least one that doesn't cost any money at all. We wanted to share a sampling of the cool things we've had our eyes on as of late, regardless of if they show up on our doorsteps this year or not. Feel free to add what you'd like most this holiday season in the story comments as well.

Note: Ars Technica may earn compensation for sales from links on this post through affiliate programs.

Read 50 remaining paragraphs | Comments

DISH Sues Multiple ‘Pirate’ TV Streaming Sites

DISH Network has filed a new lawsuit against the currently unknown operators of several streaming websites. DISH says that despite numerous demands to cease-and-desist, the sites – which all embed live TV channels from companies around the world – have continued to infringe the broadcaster’s copyrights. DISH is demanding an injunction, millions in damages, and domain seizures.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

When it comes to tackling ‘pirate’ sites and services, US broadcaster DISH Network is one of the most active litigants in the United States.

The company has targeted Kodi add-on repository TVAddons, Kodi add-on developers, IPTV suppliers, IPTV resellers, and players in the satellite card-sharing space.

This week the company filed a new lawsuit in a Texas district court targeting the operators of 15 domains that allegedly stream DISH content to the public without appropriate licensing.

DISH’s complaint says that 15 ‘Doe’ defendants are behind the websites Freetvall.net, Freetvall.xyz, Freetvall.me, Freetvall.live, Livetvcafe.com, Livetvcafe.net, Livetvcafe.me, Time4tv.com, Time4tv.net, Time4tv.me, Cricket-tv.net, Crickettv.me, Tv4embed.com, and A1livetv.com.

Checks against the domains indicate that the Freetvall domains are connected to the same platform, currently operating at Freetvall.xyz. The site is a goldmine of free embedded TV channels, not only from DISH, but from broadcasters around the world including Sky and ESPN, to name just two.

Freetvall.xyz

The second batch of ‘Livetvcafe’ domains appear to redirect to the same website, Livetvcafe.me. It bears a striking similarity to the site located at Freetvall.xyz albeit with slight variations in content. Cricket-tv.net and Crickettv.me triggered malware warnings in our tests, so were skipped.

In respect of streaming, A1livetv is currently non-functioning, likewise Cricket-tv.net and Cricket-tv.me. TV4embed.com currently offers no video content but does display a notice stating the following:

“DMCA: This site only contains links and embeds to TV channels from 3rd party sites which are freely available on all Internet. We are not affiliated in any way with the broadcasted channels nor responsible for their content. All content is copyright of their respective owners.”

Despite the seemingly hopeful position of this apparent disclaimer, the above statement is precisely what DISH considers to be infringing when it comes to these platforms.

“Upon information and belief, Defendants search the Internet for unauthorized sources of the Protected Channels and identify links to that content. Defendants then upload these links for the Protected Channels onto the Free TV Websites,” the broadcaster’s complaint reads.

It appears that DISH has been working since September 2013 to have all of these sites taken down. The company says it directly sent the platforms “at least” 49 notices of infringement demanding that they cease their activities but none were responded to.

DISH also sent the same number of notices to the sites’ hosts, at least some of which were passed on to the defendants. However, even when the service providers acted to remove content, DISH says it faced “interference”, such as the defendants switching hosts or links to content.

As a result, DISH says that the defendants have “actual knowledge” that the transmission of its channels infringes the broadcaster’s exclusive rights so are therefore liable for inducing and materially contributing to copyright infringement.

The company is demanding a permanent injunction against the defendants and anyone working in concert with them from “transmitting, streaming, distributing, publicly performing, linking to, hosting, promoting, advertising or displaying” any of DISH’s protected content in the United States, and/or inducing others in respect of the same.

DISH is also demanding statutory damages of up to $150,000 for each of 112 or more registered works and profits attributable to the infringement of any unregistered works. In addition to attorneys’ fees, the broadcaster also wants to seize all of the domains listed in the lawsuit.

A copy of DISH’s complaint can be found here (pdf).

Source: TF, for the latest info on copyright, file-sharing, torrent sites and more. We also have VPN reviews, discounts, offers and coupons.

Energiewende: Grüner Wasserstoff aus der Zinnschmelze

Wasserstoff ist wichtig für die Energiewende. Er kann als Treibstoff für Brennstoffzellenautos genutzt werden und gilt als sauber. Seine Herstellung ist es aber bislang nicht. Karlsruher Forscher haben nun ein Verfahren entwickelt, bei dem kein schädli…

Wasserstoff ist wichtig für die Energiewende. Er kann als Treibstoff für Brennstoffzellenautos genutzt werden und gilt als sauber. Seine Herstellung ist es aber bislang nicht. Karlsruher Forscher haben nun ein Verfahren entwickelt, bei dem kein schädliches Kohlendioxid entsteht. Ein Bericht von Werner Pluta (Wasserstoff, Technologie)

Störerhaftung: Weiterhin Unsicherheit bei Anbietern offener WLANs

Seit zwei Jahren sollte sich die Furcht vor hohen Abmahnkosten bei offenen WLANs erledigt haben. Doch trotz der gesetzlichen Abschaffung der Störerhaftung bleiben Rechtsunsicherheiten bestehen. (Störerhaftung, WLAN)

Seit zwei Jahren sollte sich die Furcht vor hohen Abmahnkosten bei offenen WLANs erledigt haben. Doch trotz der gesetzlichen Abschaffung der Störerhaftung bleiben Rechtsunsicherheiten bestehen. (Störerhaftung, WLAN)

Leistungsschutzrecht: Französische Verlage reichen Beschwerde gegen Google ein

Zwar ist das französische Leistungsschutzrecht nicht einmal einen Monat in Kraft, doch schon hat die juristische Auseinandersetzung mit Google um dessen Durchsetzung begonnen. (Leistungsschutzrecht, Google)

Zwar ist das französische Leistungsschutzrecht nicht einmal einen Monat in Kraft, doch schon hat die juristische Auseinandersetzung mit Google um dessen Durchsetzung begonnen. (Leistungsschutzrecht, Google)