Up to 1,500 businesses infected in one of the worst ransomware attacks ever

Supply chain attack is having cascading effects around the world.

The word ransom dominates a menacing, red computer monitor.

Enlarge (credit: Suebsiri Srithanyarat / EyeEm / Getty Images)

As many as 1,500 businesses around the world have been infected by highly destructive malware that first struck software maker Kaseya. In one of the worst ransom attacks ever, the malware, in turn, used that access to fell Kaseya’s customers.

The attack struck on Friday afternoon in the lead-up to the three-day Independence Day holiday weekend in the US. Hackers affiliated with REvil, one of ransomware’s most cutthroat gangs, exploited a zero-day vulnerability in the Kaseya VSA remote management service, which the company says is used by 35,000 customers. The REvil affiliates then used their control of Kaseya’s infrastructure to push a malicious software update to customers, who are primarily small-to-midsize businesses.

Continued escalation

In a statement posted on Monday, Kaseya said that roughly 50 of its customers were compromised. From there, the company said, 800 to 1,500 businesses that are managed by Kaseya’s customers were infected. REvil’s site on the dark web claimed that more than 1 million targets were infected in the attack and that the group was demanding $70 million for a universal decryptor.

Read 13 remaining paragraphs | Comments

GameStop’s Summer Sale is live with a number of good Switch and PS5 deals

Dealmaster also has deals on MacBooks, the OnePlus 9, Xbox gamepads, and more.

GameStop’s Summer Sale is live with a number of good Switch and PS5 deals

Enlarge (credit: Ars Technica)

Today's edition of the Dealmaster is heavy on gaming deals: surfing the ongoing wave of PC game discounts from Steam's summer sale, we also have a new batch of PlayStation and Switch deals from GameStop's midyear sale, which began on Monday and runs through July 10.

While many of the deals in this latest promotion aren't worth the plunge—and while GameStop, the company, continues to be a bit of a meme—we have found numerous offers worth noting, which we've rounded up for you in our video games deals section below. As of this writing, many of the offers have also been price-matched at Amazon, if you already pay for a Prime membership and would prefer to shop there.

Among the standout offers here are Switch exclusives Super Mario Odyssey and Fire Emblem: Three Houses for $35 each. While these aren't the absolute lowest discounts we've seen in either game's case, discounts below $40 for first-party Switch games have been rare outside of Black Friday season. Odyssey remains one of the better entries in the Mario library, while Three Houses is a tense tactical RPG couched in a surprisingly layered (if deeply anime) political thriller. Note that GameStop says these two deals will only last through July 6, after which they'll bump back up to a more typical sale price for $40.

Read 4 remaining paragraphs | Comments

Pentagon kills Microsoft’s $10B JEDI cloud contract, says tech is now outdated

Amazon’s legal stall tactics seem to have paid off.

Pentagon kills Microsoft’s $10B JEDI cloud contract, says tech is now outdated

Enlarge (credit: US Department of Defense)

Following years of controversy and intrigue, the Pentagon canceled its JEDI cloud computing contract with Microsoft today.

Microsoft was awarded the contract in October 2019, but work stalled as Amazon, the other finalist, mounted a legal challenge. Now, the Department of Defense has scrapped the entire project, saying that it’s out of date.

“The Department has determined that, due to evolving requirements, increased cloud conversancy, and industry advances, the JEDI Cloud contract no longer meets its needs,” a Pentagon spokesperson said in a statement.

Read 7 remaining paragraphs | Comments

ACE/MPA Seize Dozens Of Pirate Streaming Domains, Demand Data on Dozens More

The Alliance for Creativity and Entertainment and partners the MPA have seized dozens of pirate-streaming related domains. In addition, the anti-piracy giants are demanding information that will allow them to identify the operators of dozens more pirate streaming sites, including the massive Streamtape.com and others involved in the supply of IPTV packages.

From: TF, for the latest news on copyright battles, piracy and more.

ACE logoThe past decade has seen an explosion of illegal streaming sites offering the latest movies and TV shows but despite enforcement efforts in many shapes and sizes, the flood seems never ending.

At the forefront of combating this threat is the Alliance For Creativity and Entertainment (ACE), the world’s largest anti-piracy coalition featuring dozens of the planet’s richest and most powerful entertainment industry groups.

The Motion Picture Association is deeply embedded within ACE and together these groups have shut down a large number of illegal platforms and targeted release groups plus other closely aligned entities.

In advance of some of these actions, the MPA seeks to identify the operators of pirate sites. This is often done under the authority of US courts, which regularly grant the MPA and ACE permission to obtain data held at various internet entities including hosting, CDN and domain companies.

Unprecedented Demands For Information on Pirate Domains

Last week ACE/MPA were back in court again, requesting pirate site operators’ details from CDN company Cloudflare via three separate DMCA subpoenas. In the past these have regularly targeted large numbers of pirate domains but when combined, these three subpoenas target four dozen streaming-related domains, quite a surge for a single week.

The first batch targets a number of familiar names but notably includes at least one giant site. Streamtape.com currently receives 33 million monthly visits according to SimilarWeb, drawing most of its traffic from users in the United States. Several other large platforms are also included, with significant traffic stats listed below:

abcvideo.cc (3M monthly visits, popular in Poland), cloudvideo.tv (5.5M monthly, popular in US), gamovideo.com (11.3M, popular in Spain), playtube.ws (3.9M, popular in Poland), streamplay.to (3M, popular in US), streamplay.cc, streamsb.net (2.8M, populr in US), sbembed2.com, streamtape.com (33M, popular in US), strcloud.link, streamzz.to, streamz.ws (5.8M, popular in Germany), userload.co (4.3M, popular in US), eplayvid.com

The second list has a larger spread in that it appears to tackle pirate sites targeted at a broader international audience. It includes the popular Fmovies (around 6 million visits per month) and MyGully, a linking site that was previously implicated in the operations of Share-Online.biz, Germany’s largest file-hosting site.

Share-Online.biz was shut down in 2019, with MyGully and another site called Movie-Blog accused of helping users to find pirated content on the platform.

The domains of Movie-Blog were later seized by ACE/MPA after its operators were handed suspended sentences of 22 months in Germany. It appears that ACE/MPA have unfinished business at MyGully that Cloudflare may be able to help with.

Domains in the second request to Cloudflare are listed as follows:

cpasfini.com, zonetelechargement.cloud, mygully.com, polishsource.cz, xcine.me, streamingcommunity.co, serieskao.tv, pelishouse.com, peliculaspro.net, openpelis.net, peliculaswarez.net, seriesw.tv, paraveronline.live, dongphym.net, fullphim.net, phephimz.net, 123-hd.com , i-moviehd.com, motphjm.net, 2embed.ru, fmovies.co, 123moviesfree.net, tinyzonetv.to , myflixer.to, bstsrs.one, best-series.me

IPTV Services: Rarely Included in Cloudflare Requests

The vast majority of ACE/MPA requests for Cloudflare to hand over information target web-based streaming platforms that tend to present a Netflix-style interface to users. However, a third request from the MPA and ACE filed last week lists what appears to be a quartet of pirate IPTV services.

They are hehestreams.com ($100 per year subscription, sports broadcasts), comstarservices.com ($79.99 per year, thousands of assorted channels), mywifi.tv and uzzi.tv (both currently down)

In common with the other two requests, the subpoena requires Cloudflare to provide information on the operators of the sites in sufficient quantities to identify the infringers.

“This would include the individuals’ names, physical addresses, IP addresses, telephone numbers, e-mail addresses, payment information, account updates and account history,” the subpoenas read.

ACE/MPA Seize Dozens of Pirate Domains

Two months ago, ACE reported that with backing from prominent members including major Hollywood studios, Netflix, Amazon, and other entertainment giants, it had shut down Cuevana, one of the most popular pirate streaming operations in Latin America.

As part of that operation, ACE said it had seized 30 domains. The group did not name them individually but information obtained by TorrentFreak shows that ACE has recently seized dozens of domains that appear to fit the description.

It’s worth noting that despite claims that Cuevano had been shut down, the most popular Cuevana site, Cuevana3.io, is still online. According to SimilarWeb, Cuevana3 had more than 60 million visitors in January, which is twice as much as the combined traffic of the other domains ACE said it had taken down.

The full list of seized domains (which center around the brands cuvana, replis, and pelis) is as follows:

repelisgooo.com, cuevana3.app, repelisgoo.org, repelisgt.com, cuevana.link, pelisplusgo.com, cuevana.wtf, pelisplusgt.com, pelisplus.wtf, cuevana2.app, pelisplus2.live, cuevana.io, pelisplus2.app, repelisgt.net, cuevanaxd.com, cuevanagt.com, repelisgo.net, pelisplushd.app, cuevanaxd.net, pelisplushd.li, repelis2.net, pelisplushd.biz, pelisplusxd.com, cuevana3.li, cuevana.li

The documentation supporting the ACE/MPA subpoenas can be found here (1,2,3,4,5 pdf)

From: TF, for the latest news on copyright battles, piracy and more.

NASA’s helicopter on Mars just keeps flying and flying

For NASA, taking some risk has paid off handsomely.

A helicopter takes a photo of its own shadow.

NASA's Mars helicopter has now completed nine flights. (credit: NASA)

On Monday, NASA's Ingenuity helicopter made its ninth and most ambitious flight yet.

This time, the space agency said, the tiny flier took to the skies for 166.4 seconds and reached a maximum speed of 5 m/s. This is equivalent to 10 mph, or a brisk run. During this flight, Ingenuity covered about 625 meters.

A little more than two months have passed since Ingenuity's first flight, on April 19 of this year. During that initial test, the helicopter hovered to about 3 meters above the ground before landing again. Since then, the engineering team behind the helicopter has pushed the vehicle higher, farther, and faster across the surface of Mars.

Read 4 remaining paragraphs | Comments

“Broadcom is a monopolist”: FTC orders chipmaker to stop illegal tactics

Firm “illegally” dominated set-top box and modem chips, must stop exclusivity deals.

A Broadcom sign outside one of its offices.

Enlarge / A sign in front of a Broadcom office on June 03, 2021, in San Jose, California. (credit: Getty Images | Justin Sullivan )

The Federal Trade Commission on Friday said it charged Broadcom "with illegally monopolizing markets for semiconductor components used to deliver television and broadband Internet services" by preventing customers from purchasing from other vendors. The FTC simultaneously announced that it reached a settlement with Broadcom that requires the company to "stop requiring its customers to source components from Broadcom on an exclusive or near-exclusive basis."

The FTC said that "Broadcom is a monopolist in the sale of three types of semiconductor components, or chips, used in devices that deliver television and broadband Internet services" and that "Broadcom illegally maintained its power in the three monopolized markets by entering long-term agreements with both OEMs and service providers that prevented these customers from purchasing chips from Broadcom's competitors." The contracts required customers to purchase and use "Broadcom's chips on an exclusive or near-exclusive basis," the FTC said. "Broadcom entered these exclusivity and loyalty agreements with at least ten OEMs, including those with the most extensive engineering and design capabilities and the strongest ties to service providers."

Broadcom imposed similar contract requirements on TV and broadband providers, the FTC said. "By entering exclusivity and loyalty agreements with key customers at two levels of the supply chain [device makers and service providers], Broadcom created insurmountable barriers for companies trying to compete with Broadcom," the FTC said. The service providers that use devices with Broadcom chips include AT&T, Charter, Comcast, Dish, and Verizon, the FTC said.

Read 13 remaining paragraphs | Comments

This custom all-in-one is a slick, updated take on luggable PCs

When I first started really getting into computers there were few things I liked more than getting my hands on the latest issue of Computer Shopper. And there were few things I enjoyed spying more in those massive periodicals than the latest “po…

When I first started really getting into computers there were few things I liked more than getting my hands on the latest issue of Computer Shopper. And there were few things I enjoyed spying more in those massive periodicals than the latest “portable” PCs. Back then the sewing machine-sized computers weighed around 18 pounds and […]

The post This custom all-in-one is a slick, updated take on luggable PCs appeared first on Liliputing.

No, open source Audacity audio editor is not “spyware”

The community’s telemetry concerns were received and addressed two months ago.

Familiar to many an at-home podcaster.

Enlarge / Familiar to many an at-home podcaster. (credit: Jim Salter)

Over the fourth of July weekend, several open source news outlets began warning readers that the popular open source audio editing app Audacity is now "spyware."

This would be very alarming if true—there aren't any obvious successors or alternatives which meet the same use cases. Audacity is free and open source, relatively easy to use, cross platform, and ideally suited for simple "prosumer" tasks like editing raw audio into finished podcasts.

However, the negativity seems to be both massively overblown and quite late. While the team has announced that Audacity will begin collecting telemetry, it's neither overly broad in scope nor aggressive in how it acquires the data—and the majority of the real concerns were addressed two months ago, to the apparent satisfaction of the actual Audacity community.

Read 17 remaining paragraphs | Comments

Bitcoin power plant is turning a 12,000-year-old glacial lake into a hot tub

Private equity’s cryptocurrency experiment pushes more costs on the public.

In this aerial photo of Greenidge Generation's power plant outside Dresden, NY, Seneca Lake is visible in the background. The lake receives warm water from Greenidge's operations.

Enlarge / In this aerial photo of Greenidge Generation's power plant outside Dresden, NY, Seneca Lake is visible in the background. The lake receives warm water from Greenidge's operations. (credit: Greenidge Generation LLC)

The fossil fuel power plant that a private equity firm revived to mine bitcoin is at it again. Not content to just pollute the atmosphere in pursuit of a volatile crypto asset with little real-world utility, this experiment in free marketeering is also dumping tens of millions of gallons of hot water into glacial Seneca Lake in upstate New York.

“The lake is so warm you feel like you’re in a hot tub,” Abi Buddington, who lives near the Greenidge power plant, told NBC News.

In the past, nearby residents weren’t necessarily enamored with the idea of a pollution-spewing power plant warming their deep, cold water lake, but at least the electricity produced by the plant was powering their homes. Today, they’re lucky if a small fraction does. Most of the time, the turbines are burning natural gas solely to mint profits for the private equity firm Atlas Holdings by mining bitcoin.

Read 11 remaining paragraphs | Comments

Microsoft’s Surface Duo falls even lower, now almost $1000 off

71 percent off is a sad ending for Microsoft’s first self-branded Android phone.

Poor Microsoft. The company's Surface Duo phone was supposed to be the company's triumphant entry into the Android phone market, but instead, it will probably be remembered as one of the bigger flops in the industry. The latest chapter of Microsoft's dual-screen disaster involves a new low price for the ongoing fire sale: Amazon's Woot is selling the phone for $409, an incredible $990.99 off the $1399.99 MSRP. The one catch is that it's locked to AT&T.

It definitely feels like we've seen this trajectory before. The phone debuted in September 2020 for $1399 with poor reviews and a questionable spec sheet. A month after launch, it had a $200 price drop to $1199, and seven months in, it saw a 50 percent price drop down to $699. Today, at 71 percent off, the Surface Duo can now join the ranks of other market failures that ended up in the bargain bin, like the Amazon Fire Phone, the Essential Phone, and the Google Pixel Slate.

The Surface Duo is (was?) a very unique dual-screen smartphone design. Microsoft equipped the phone with a left 5.6-inch touchscreen and a right 5.6-inch touchscreen, and the whole thing folded up like a small notebook. It was visually beautiful, with an extreme emphasis on thinness and nothing but a flat pane of glass on the inside and outside.

Read 3 remaining paragraphs | Comments