Feds say active exploits of critical Zerologon bug threaten elections orgs

Zerologon gives attackers instant access to all-powerful domain controllers.

Feds say active exploits of critical Zerologon bug threaten elections orgs

Enlarge (credit: Getty Images)

The FBI and the cybersecurity arm of the Department of Homeland Security said they have detected hackers exploiting a critical Windows vulnerability against state and local governments and that in some cases the attacks are being used to breach networks used to support elections.

Members of unspecific APTs—the abbreviation for advanced persistent threats—are exploiting the Windows vulnerability dubbed Zerologon. It gives attackers who already have a toehold on a vulnerable network access to the all-powerful domain controllers that administrators use to allocate new accounts and manage existing ones.

To gain initial access, the attackers are exploiting separate vulnerabilities in firewalls, VPNs, and other products from companies including Juniper, Pulse Secure, Citrix NetScaler, and Palo Alto Networks. All of the vulnerabilities—Zerologon included—have received patches, but as evidenced by Friday’s warning from the DHS and FBI, not everyone has installed them. The inaction is putting governments and elections systems at all levels at risk.

Read 3 remaining paragraphs | Comments

RIP to Crucible, Amazon Games’ first PC shooter: 2020-2020

Server shutdown set for November 9; game will live after servers go dark.

We've previously put these Amazon Games mascots behind prison bars; now, they're in flames. RIP, Crucible. We hardly knew ye.

Enlarge / We've previously put these Amazon Games mascots behind prison bars; now, they're in flames. RIP, Crucible. We hardly knew ye. (credit: Amazon Games / Aurich Lawson)

As it turns out, Amazon's idea of a Crucible couldn't handle the intense heat and pressure of the games industry.

After launching in May of this year, Crucible, Amazon Games' first large-scale shooter title for PC, will stop receiving updates and matchmaking support on November 9, the studio announced on Friday (at the exact end-of-week hour that bad game-news stories are typically sent to pasture). The company is taking the extreme measure of offering a "full refund" for any purchases made during the free-to-play game's lifespan, and it's directing customers to make refund requests through either Steam Support or Amazon's own contact form, depending on where purchases were originally made.

This followed the game's formal delisting from Steam in July, which followed painfully low concurrent player counts (as low as 200) that made it difficult for players to successfully matchmake with each other. Though the game launched with considerable attention, including a promotional blitz on the Amazon-owned game-streaming platform Twitch, it only briefly maintained a player population exceeding 10,000 users.

Read 5 remaining paragraphs | Comments

Informationskrieg über mutmaßliche Nawalny-Vergiftung

Eigentlich müssten nur die in Russland und Deutschland entnommenen Blut- und Urinproben unabhängig geprüft werden. Derweil versinkt die Flaschen-Hypothese des Nawalny-Teams in Fake-News-Dimensionen, während der OPCW-Befund wohl gezielt vage blieb

Eigentlich müssten nur die in Russland und Deutschland entnommenen Blut- und Urinproben unabhängig geprüft werden. Derweil versinkt die Flaschen-Hypothese des Nawalny-Teams in Fake-News-Dimensionen, während der OPCW-Befund wohl gezielt vage blieb

Judge Recommends to Deny $250,000 Claim Against YTS Sites and Apps

The operators of several YTS-branded apps and sites may escape a $250,000 damages claim from Hawaiian anti-piracy lawyer Kerry Culpepper, who accused them of trademark infringement, In a recommendation issued to the court, Magistrate Judge Wes Reber Porter notes that there isn’t sufficient evidence that the defendants purposefully targeted the US.

From: TF, for the latest news on copyright battles, piracy and more.

YTS logoEarlier this year, Hawaiian anti-piracy lawyer Kerry Culpepper turned some of the most popular piracy brands into a powerful anti-piracy tool.

The attorney, who is listed as director of the company ’42 Ventures,’ registered several piracy-related trademarks, including ‘YTS’ and ‘Popcorn Time.’

The company, which was founded last year, legally claimed these marks and uses them on a website that doesn’t draw any significant traffic. What did get people’s attention, however, were the enforcement actions that followed.

Shortly after the trademarks were granted, Culpepper managed to suspend the Twitter account of a popular Popcorn Time fork. He offered to return it in exchange for a Popcorn Time licensing deal, which failed.

Trademark Lawsuits Against YTS Sites and Apps

In addition, the attorney also filed a trademark infringement lawsuit on behalf of 42 Ventures. The lawsuit targeted the operators of yst.lt, ytsag.me, yts.ae, ytsmovies.cc, yts.ms, as well as apps such as “Y Movies,” “YTS Movies Library” and “YTS movies.”

The people behind these sites, who are believed to be from India, China and Egypt, used the YTS brand as a promotional tool. This isn’t uncommon, as YTS has been a popular pirate brand for years, after originally belonging to a long-defunct release group.

Over the past weeks, one of the site operators agreed to settle the trademark infringement matter for $200,000, on paper. The other four didn’t respond to the allegations at all, which prompted the lawyer to request default judgments of $250,000 against all defendants.

“Defendants purposefully utilize Plaintiff’s YTS mark in their domain registrations and app names in order to mislead consumers about the origins of its goods and services as connected to Plaintiff, resulting in a substantial loss of income, profits, and goodwill,” Culpepper informed the court.

42 Ventures Requests Default Judgment

Since none of the defendants showed up in court there was little to stop a victory, except for the court itself, it now appears.

In a ‘findings and recommendations’ issued this week, US Magistrate Judge Wes Reber Porter recommends the court to deny the $250,000 damages request and dismiss the complaint because the court lacks personal jurisdiction.

For a court to decide over a defendant, it should have the right to do so. This is usually not a problem when a US citizen is taken to court in the US but, in this case, the defendants are foreigners. That changes everything.

The court can only issue a judgment when it’s shown that the defendants “purposefully directed their activities towards the United States.” Here, Judge Porter is not convinced that this is the case.

According to Culpepper, the trademark-infringing YTS sites and apps were available in the US, used US-based services including domain registrars, and used US-based payment providers, among other things.

Judge Doesn’t Believe Court Has Jurisdiction

Judge Porter doesn’t dispute these facts but doesn’t agree that this is sufficient to show that the court has personal jurisdiction.

“The Court finds that Defendants’ use of United States-based companies for webhosting and domain name services and for paying for those services is insufficient to show that Defendants aimed their allegedly infringing acts at the United States,” Porter writes.

The Judge notes that in some cases people simply choose to work with US-based companies because they are the biggest brands in their industries, or have a monopoly. Not because they’re from the US.

“Indeed, as other district courts have recognized ‘it is more accurate to say that [the defendant] utilized Apple and Google because they arguably have a virtual monopoly on the channels in which developers can distribute application-based software—not because they have offices in [the United States]’.”

If this logic indeed applies, then all foreigners with a Gmail account would subject themselves to the jurisdiction of US courts, which is something Judge Porter doesn’t agree with.

Two of the defendants also used advertising services, cookies and web beacons, to gather information about individual visitors, some of whom are from the US. Culpepper brought this in as another argument to show that the court has jurisdiction but that was disregarded as well.

“Finally, the Court finds that Plaintiff’s allegations regarding Defendants Mav and Shan collecting information about users on their websites is insufficient to show that these Defendants have done engaged in ‘conduct directly targeting the forum’.”

Judge Recommends Dismissal

All in all, Judge Porter concludes that the court lacks personal jurisdiction over the defendants. He therefore recommends denying the motion for a $250,000 default judgment and suggests a dismissal of the entire case.

This recommendation has yet to be adopted by the court in a final ruling and can be contested by Culpepper. However, the first signs don’t look positive for the trademark owner.

In closing, it is worth pointing out that YTS.mx, which is by far the most popular YTS site, wasn’t targeted in this trademark case. However, the same lawyer previously negotiated copyright infringement settlements with the site’s owner, totaling well over a million dollars.

A copy of the findings and recommendations published by US Magistrate Judge Wes Reber Porter is available here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.

Lilbits: The iPhone 12 is coming (in four versions)

Apple is holding its iPhone 12 launch event on October 13.  But the company isn’t just launching one iPhone 12. According to recent leaks, there will be four different models with starting prices ranging from $699 to $1099. The company may also …

Apple is holding its iPhone 12 launch event on October 13.  But the company isn’t just launching one iPhone 12. According to recent leaks, there will be four different models with starting prices ranging from $699 to $1099. The company may also introduce a $99 HomePod Mini, which would be more of a direct competitor with […]

The post Lilbits: The iPhone 12 is coming (in four versions) appeared first on Liliputing.

Microsoft thumbs its nose at Apple with new “app fairness” policy

The software giant has picked a side, and it’s with Epic and Spotify.

Microsoft sign at the entrance of their Silicon Valley campus in Mountain View, California.

Enlarge / Microsoft sign at the entrance of their Silicon Valley campus in Mountain View, California. (credit: Nicolas McComber | Getty Images)

Microsoft this week adopted a whole slew of "fairness principles" for its Windows app store. The list of principles does look like a decent set of guidelines for both consumers and developers—but it also looks a whole lot like Microsoft is taking the metaphorical ball, throwing it at Apple's face, and daring their iCompetitor to make the next move.

The principles, which Microsoft listed in a corporate blog post, essentially promise that Windows will keep on doing what it already does with regard to app distribution, interoperability, payment systems, and everything else.

The first item, for example, promises that developers may choose whether to distribute Windows programs through the Microsoft Store or through their own competing app storefronts. This has always been the case, and it's why Steam, the Epic Games store, and every other Windows software distribution method exist. Windows also promises not to block an app from Windows "based on a developer's choice of which payment system to use" for processing in-app purchases which, again, is why and how both Web-based and app-based digital software storefronts for Windows exist.

Read 10 remaining paragraphs | Comments

Liveblog: All the news from Apple’s October 13 “Hi, Speed” event

Follow our liveblog at 1pm ET on October 13 for updates on Apple’s new iPhones.

An Apple logo is surrounded by colorful concentric circles.

Enlarge / The promotional key art graphic Apple sent out with its announcement about its October 13, 2020, product launch event. (credit: Apple)

At 10:00am Pacific time (1pm Eastern) on Tuesday, October 13, Apple will hold its second live event in less than a month—almost certainly to announce new iPhones this time, after the previous event focused on iPads and the Apple Watch.

Ars Technica will be liveblogging the event and publishing the major announcements in real time as usual. Return to this page when the event starts to follow the updates.

This event carries the tagline "Hi, Speed," which could refer to any number of things: 5G modems in new phones, the faster A14 chip that was already introduced last month, or even Apple Silicon in the first non-Intel Mac in many years.

Read 3 remaining paragraphs | Comments

PlayStation 5 will only leave 10 old PS4 games in the back-compat dust

As suggested, it’s PS4 only. Which 10 games didn’t make the cut?

PlayStation 5 will only leave 10 old PS4 games in the back-compat dust

Enlarge (credit: Aurich Lawson / Sony)

After tearing the PlayStation 5's guts apart earlier this week, Sony confirmed nearly everything we'd like to know on Friday about how its new console, launching November 12, will interface with PS4 games via backward compatibility.

We should probably start with the big news that Sony has not cleared up just yet.

Today, we received our first indication that PlayStation 5 will ship with something known as "Game Boost," which its Friday news post suggests "may make [select] PS4 games run with a higher or smoother frame rate." This suggestion doesn't come with a handy footnote pointing us to a list of affected games or features, however.

Read 11 remaining paragraphs | Comments

Daily Deals (10-09-2020)

Amazon Prime Day begins on October 13, as does Best Buy’s Black Friday in October or whatever the company is calling its not-Prime sale. But you can already score some early Prime Day deals on Echo, Fire, and other products. You will need a Prim…

Amazon Prime Day begins on October 13, as does Best Buy’s Black Friday in October or whatever the company is calling its not-Prime sale. But you can already score some early Prime Day deals on Echo, Fire, and other products. You will need a Prime membership to get most of the deals, but you can […]

The post Daily Deals (10-09-2020) appeared first on Liliputing.