Microsoft digital certificates have once again been abused to sign malware

Code-signing is supposed to make people safer. In this case, it made them less so.

A low-angle view on a blue digital key made to resemble a circuit and placed on a surface with encrypted text.

Enlarge (credit: Getty Images)

Microsoft has once again been caught allowing its legitimate digital certificates to sign malware in the wild, a lapse that allows the malicious files to pass strict security checks designed to prevent them from running on the Windows operating system.

Multiple threat actors were involved in the misuse of Microsoft’s digital imprimatur, which they used to give Windows and endpoint security applications the impression malicious system drivers had been certified as safe by Microsoft. That has led to speculation that there may be one or more malicious organizations selling malicious driver-signing as a service. In all, researchers have identified at least nine separate developer entities that abused the certificates in recent months.

The abuse was independently discovered by four third-party security companies, which then privately reported it to Microsoft. On Tuesday, during Microsoft’s monthly Patch Tuesday, the company confirmed the findings and said it has determined the abuse came from several developer accounts and that no network breach has been detected.

Read 14 remaining paragraphs | Comments

Apple could allow third-party app stores on iPhones and iPads to comply with EU regulations

Want to install an app or game on an iPhone or iPad? The only official ways to do that are to get them from the App Store or set up a developer account. And that’s been the case since the App store first launched in 2008. But according to a new …

Want to install an app or game on an iPhone or iPad? The only official ways to do that are to get them from the App Store or set up a developer account. And that’s been the case since the App store first launched in 2008. But according to a new report from Bloomberg’s Mark […]

The post Apple could allow third-party app stores on iPhones and iPads to comply with EU regulations appeared first on Liliputing.

iOS 16.2, macOS 13.1 released with new collaboration features and other updates

Smaller updates for watchOS, tvOS, and HomePod software are also available.

The new Freeform app included in the iOS 16.2 and macOS 13.1 updates.

Enlarge / The new Freeform app included in the iOS 16.2 and macOS 13.1 updates. (credit: Apple)

Apple has released the final versions of macOS 13.1, iOS 16.2, and iPadOS 16.2 to the public after a few weeks of beta testing. In addition to the standard bug fixes and security patches, these updates include the collaborative Freeform app that was announced back at WWDC, increased use of end-to-end encryption for iCloud data, and (for iPhones) the vocal-reducing, karaoke-friendly Apple Music Sing feature.

Freeform uses your AppleID and iCloud to sync changes on a large, bulletin board-esque canvas between multiple users in real time. Input can include typed text, images, files and documents, shapes, and handwritten text or images done with an Apple Pencil, creating something that is similar in form to a shared note or document but with more input flexibility. Users can have multiple boards shared with different groups of people, communicating in real time via Messages or FaceTime.

The iCloud encryption additions are grouped together under the "Advanced Data Protection" banner, and they expand the service's use of end-to-end encryption. Device backups for iPhones and iPads can be fully encrypted, as can Safari bookmarks and data from the Photos, Notes, Voice Memos, Reminders, Shortcuts, and Wallet apps. Calendar and Mail data remain unencrypted "because of the need to interoperate with the global email, contacts, and calendar systems."

Read 4 remaining paragraphs | Comments

Google’s Black Friday deals are back, including that $299 Pixel 6a deal

Get $100-$150 off a Pixel phone, $50 off the watch, $10 off a Chromecast.

Everything except the earbuds are on sale.

Enlarge / Everything except the earbuds are on sale. (credit: Google)

Black Friday might have come and gone, but Google's Black Friday deals are still trucking. Google reimplemented many of the deals this week, which were the first and/or best discounts we've seen for many of Google's new products. The highlight of the group is definitely the Pixel 6a, but you get decent deals on the Pixel 7, Pixel Watch, Chromecasts, and Google's smart speakers, too.

The Pixel 6a, normally $449, is still out there for an incredible $299. Let us remind you this comes with a flagship-class SoC that is every bit as fast as the $900 Pixel 7 Pro. The Pixel 6a is a great deal even at $449, and honestly cannibalizes the more expensive phones quite a bit, but Google seems more interested in trying to grab as much market share as it can right now. (Google is apparently not even happy with this, and the Pixel 7a rumors move the phone even further into the high-end line!)

If you really want the more expensive Pixels with their bigger, high-refresh-rate displays and newer cameras, you can still get deals on those, too. The 90 Hz, 6.3-inch Pixel 7, normally $599, can be had for $499, and the 120 Hz, 6.7-inch Pixel 7 Pro is down to $749 from the normal $899 price. Google's fine print actually says all these Pixel phone deals will be around until Christmas day.

Read 5 remaining paragraphs | Comments

GXMO U58 mini PC features Ryzen 7 5800U and support for up to three 4K displays

The GXMO U58 is a small desktop computer with the guts of a decent laptop from 2021… plus a few extra full-sized ports and room for more storage than you’ll find in most laptops. Available from AliExpress for $537 and up, the mini PC featu…

The GXMO U58 is a small desktop computer with the guts of a decent laptop from 2021… plus a few extra full-sized ports and room for more storage than you’ll find in most laptops. Available from AliExpress for $537 and up, the mini PC features an AMD Ryzen 7 5800U processor, 16GB of RAM and […]

The post GXMO U58 mini PC features Ryzen 7 5800U and support for up to three 4K displays appeared first on Liliputing.

Marvel’s Midnight Suns gets a big boost on PC when 2K’s launcher is removed

One PC gaming pro gained more than 60 percent in frames per second by killing it.

Image of 2K's launcher for Midnight Suns

Enlarge / 2K's launcher does the important work of halting Midnight Suns from launching after you click "Play" on a green button in Steam so you can acknowledge their brand and click "Play" on a red button. (credit: Kevin Purdy)

Publisher-made game launchers are usually just a minor annoyance, a speed bump for those who just want to play the game they bought. 2K's launcher, popping up by default when you launch Firaxis' newest XCOM-meets-superhero-friendship Marvel's Midnight Suns, does something worse, hindering performance significantly for some players.

RockPaperShotgun's James Archer measured his higher-end PC's performance while playing Midnight Suns, both with the default 2K launcher left in place and with it bypassed through a Steam command option. Archer saw a nearly 62 percent improvement in average frames per second without the 2K launcher active. On a system with a Core i9-10900K, RTX 3090, and 32GB of DDR4 memory, running at 1400p with ray tracing and the graphic quality set to "Epic," Archer's average frames per second jumped from 90 fps to 146. The only difference was disabling a launcher that essentially reminds you who published the game, markets other titles to you, and requires more clicks.

I'm playing through Midnight Suns myself and had noticed some aggravating stutter, especially when streaming the game for couch-based TV play. I turned on Steam's built-in FPS counter, then compared performance between sessions both with and without the 2K launcher running. I'm running a decidedly lower-end system than the one tested by RockPaperShotgun: AMD Ryzen 7 3800X, RTX 3050, and 16GB of DDR4 memory. I am, however, playing at 3840×2160 resolution, with graphics set to "High."

Read 3 remaining paragraphs | Comments

Marvel’s Midnight Suns gets a big boost on PC when 2K’s launcher is removed

One PC gaming pro gained more than 60 percent in frames per second by killing it.

Image of 2K's launcher for Midnight Suns

Enlarge / 2K's launcher does the important work of halting Midnight Suns from launching after you click "Play" on a green button in Steam so you can acknowledge their brand and click "Play" on a red button. (credit: Kevin Purdy)

Publisher-made game launchers are usually just a minor annoyance, a speed bump for those who just want to play the game they bought. 2K's launcher, popping up by default when you launch Firaxis' newest XCOM-meets-superhero-friendship Marvel's Midnight Suns, does something worse, hindering performance significantly for some players.

RockPaperShotgun's James Archer measured his higher-end PC's performance while playing Midnight Suns, both with the default 2K launcher left in place and with it bypassed through a Steam command option. Archer saw a nearly 62 percent improvement in average frames per second without the 2K launcher active. On a system with a Core i9-10900K, RTX 3090, and 32GB of DDR4 memory, running at 1400p with ray tracing and the graphic quality set to "Epic," Archer's average frames per second jumped from 90 fps to 146. The only difference was disabling a launcher that essentially reminds you who published the game, markets other titles to you, and requires more clicks.

I'm playing through Midnight Suns myself and had noticed some aggravating stutter, especially when streaming the game for couch-based TV play. I turned on Steam's built-in FPS counter, then compared performance between sessions both with and without the 2K launcher running. I'm running a decidedly lower-end system than the one tested by RockPaperShotgun: AMD Ryzen 7 3800X, RTX 3050, and 16GB of DDR4 memory. I am, however, playing at 3840×2160 resolution, with graphics set to "High."

Read 3 remaining paragraphs | Comments

Bill Nelson came to NASA to do two things, and he’s all out of bubblegum

Working with Congress? “It’s easy as pie.”

NASA Administrator Bill Nelson has been a steady hand for the space agency.

Enlarge / NASA Administrator Bill Nelson has been a steady hand for the space agency. (credit: NASA)

Not for the first time, I was wrong. And heading into an interview earlier this month with NASA Administrator Bill Nelson, I knew it.

"Before I ask any questions, I just want to say something," I said at the outset of our discussion. "I wrote some critical things about you at the time you were nominated to be the administrator. And I was just wrong about them."

Nelson chuckled in response.

Read 18 remaining paragraphs | Comments

MPA v. SmoothStreams IPTV: Server Photos & Shutdown Details Emerge

Six months ago MPA-Canada, ACE, and Rogers Media teamed up to shut down IPTV provider SmoothStreams in Canada. The lawsuit already lists 224 records but no trial is expected anytime soon, even if it gets that far. In the meantime, photos of the service’s servers and new details of the shutdown operation have appeared in a Federal Court order.

From: TF, for the latest news on copyright battles, piracy and more.

smoothstreamsWhen users of popular IPTV provider SmoothStreams.tv began reporting issues with the service mid-July, few could’ve predicted events to follow.

Our previous report covers events in finer detail, but essentially SmoothStreams had been under investigation since 2018 and the time had arrived to take it down.

With permission from the court and everything planned down to the finest detail, on July 16, 2022, plaintiffs’ representatives, independent court-appointed supervising solicitors, private investigators, and sundry others set out to secure vital evidence.

Since SmoothStreams’ alleged operator lives in Canada, local companies Bell Media and Rogers Media naturally lead the list of plaintiffs in the underlying lawsuit. Beyond that, it’s the familiar cascade of MPA/MPA-Canada members Columbia, Disney, Paramount, Universal, and Warner. Netflix is a notable absentee and all except Rogers Media are MPA and/or ACE members.

Execution of Interim Order

On June 17, 2022, around a month before alleged SmoothStreams operators Marshall Macciacchera and Antonio Macciacchera were targeted in person, the plaintiffs filed a statement of claim detailing their copyright infringement allegations.

Following an ex parte motion at the Federal Court, on June 28 Justice Vanessa Rochester granted an Interim Order consisting of an interim injunction against the defendants, an Anton Piller order authorizing zero-warning searches and evidence seizures, plus other ancillary orders.

Since Anton Piller orders and controversy are rarely far apart, the plaintiffs were required to pay a deposit of CAD$100,000 (US$73,100), recoverable once lawful execution of the Interim Order had been confirmed.

Plaintiffs Demand More

The Interim Order was served on the defendants on July 14 and on July 19, the plaintiffs sought a declaration that their execution was lawful and filed a request for the return of their deposit.

Since execution was allegedly complicated by the defendants, the plaintiffs sought additional relief, including an order charging Marshall with contempt of court and an order compelling the defendants to reveal the identity of a mysterious third-party involved in SmoothStreams’ operations.

The defendants’ motion in opposition was supported by video footage documenting the execution of the order. It was taken by the plaintiffs’ videographer who works as a private detective. Further support came from a transcript of the defendants’ cross-examination of Daniel Drapeau, a court-appointed supervising solicitor.

Drapeau is a leading authority on Anton Piller orders, he was involved in the TVAddons case and has pressed Canada’s government on numerous piracy-related issues, including statutory damages and anti-camming legislation. He’s certainly no stranger to cases like these.

Based on all available evidence, Federal Court Judge Roger R. Lafreniѐre had to decide whether to grant or deny the entertainment industry giants’ motion.

More Shutdown Operation Details Emerge

On the day of the raid, Drapeau was accompanied by a computer forensics expert and yet another private investigator.

Execution at one of the locations began at 08:00 on July 14 and ended 34 hours later at 00:47 on July 16. Hardware found at one of the addresses (below) was allegedly used to supply IPTV content to SmoothStreams (SSTV) users.

smoothstreams-server

Court documents reveal that their purpose was confirmed when Marshall shut down two servers. An investigator viewing SmoothStreams from a remote location noticed that channels including Fight Network and WWE Network behaved differently compared to the night before the operation. As a result, the hardware was seized.

Marshall also had his PC mirrored after Drapeau “observed that it contained financial documents” but SmoothStreams’ alleged operator refused to supply the password. Four hard drives were also seized when Marshall could not provide the passwords to those either.

Whether they held anything vitally important is unclear, but taking them back to base would have been straightforward using the most compact of cars. When the interim order was executed at a second address during the evening of July 14, it wasn’t a question of whether a truck should be called in, but how many.

Second Address, Massive Haul

Court documents reveal that the execution of the order involved the following:

a. The disconnection and removal of multiple television receivers that were receiving (or “capturing”) television content that was being redistributed on the SSTV Services;
b. The disconnection and removal of multiple servers that were connected to those receivers and responsible for transferring the content received by the television receivers to the SSTV Services;
c. The removal of additional receivers, encoders and servers located on the premises but not connected at the time of the execution;
d. The identification, review and copying of documents found on the premises;
e. Requesting information from Marshall on topics listed in the Interim Order.

The main server room at the second location contained nine large server cabinets with at least 65 television receivers connected to 23 servers. Over the years many images of IPTV server rooms have been published by the authorities but none like this.

smoothstreams-server2

A further 23 television receivers, five additional servers, and 29 encoders were also seized. Some of the servers were running WMS Panel for source/stream management and on one a user was logged in. ‘Sam’ is the mystery person the plaintiffs are still trying to identify.

Third Address: Access Denied

Even with an Anton Piller order in hand, execution excludes the use of force. Instead, defendants are advised that failing to comply could be considered contempt of court, with potentially serious consequences.

Antonio Macciacchera’s approach to cooperation failed to meet the court’s expectations. He answered the door when the team arrived and was apparently served, but that’s where progress ended.

When another independent solicitor tried to explain the situation to him, Antonio refused to read or even look at the paperwork, and then repeatedly interrupted the solicitor before calling a lawyer, court documents state.

When he returned, everyone was told to leave his property, which they did. Subsequent telephone conversations came to nothing and execution was aborted.

Defendants’ Objections Rejected

Judge Roger R. Lafreniѐre’s analysis is both detailed and lengthy, but in summary, the defendants failed to convince him that the execution of the order was unlawful.

Claims that health and safety precautions were not adhered to were dismissed, despite the general chaos of the pandemic. Those executing the order (or attempting to) passed antigen tests the previous day, wore N95 masks, and maintained physical distancing. Other allegations failed to match recorded evidence or were dismissed by the Judge for various reasons.

“Based on the evidence before me, which is not challenged by the Defendants, I find that the execution of the Interim Order directly corroborates and bolsters the evidence presented at the ex parte motion before Justice Rochester,” the Judge’s order reads.

Declaring the execution of the Interim Order as “lawfully conducted”, the movie and TV company plaintiffs were granted leave to withdraw their deposit. The defendants were reminded that running any similar service is prohibited by court order, and were told to hand over information related to various accounts, domains and servers.

smoothstreams servers-hosts

The Judge’s order also requires full disclosure of all assets, no matter where in the world they’re located, related to the running of SSTV and/or similar platforms. Bank accounts, safety deposit boxes, investment accounts, cryptocurrency, and other “financial instruments” must all be declared.

The defendants cannot sell their homes, dispose of any other assets, exchange any assets for foreign currency, or convert them into cryptocurrency.

The Federal Court’s order can be found here (pdf)

From: TF, for the latest news on copyright battles, piracy and more.