Russian spies use device code phishing to hijack Microsoft accounts

Overlooked attack method used since last August in a rash of account takeovers.

Researchers have uncovered a sustained and ongoing campaign by Russian spies that uses a clever phishing technique to hijack Microsoft 365 accounts belonging to a wide range of targets, researchers warned.

The technique is known as device code phishing. It exploits “device code flow,” a form of authentication formalized in the industry-wide OAuth standard. Authentication through device code flow is designed for logging printers, smart TVs, and similar devices into accounts. These devices typically don’t support browsers, making it difficult to sign in using more standard forms of authentication, such as entering user names, passwords, and two-factor mechanisms.

Rather than authenticating the user directly, the input-constrained device displays an alphabetic or alphanumeric device code along with a link associated with the user account. The user opens the link on a computer or other device that’s easier to sign in with and enters the code. The remote server then sends a token to the input-constrained device that logs it into the account.

Read full article

Comments

No penalties even when deputies share a woman’s nudes after an illegal phone search

Government agents have “qualified immunity” for 2019 actions.

In 2019, Haley Olson's life in Grant County, Oregon, was upended when people in town appeared to know about private nude photos that Olson kept on her phone. Worse, some of the people appeared to have seen and shared the photos. The incidents all had some relationship to the local sheriff's department, where Olson was dating one of the deputies.

In July, for instance, a stranger in a sheriff's office uniform approached her to say that he had "heard there’s some pretty smokin’ pictures of you going around the sheriff’s office." Someone else saw a married couple, both of whom worked for the sheriff's office, looking at Olson's photos on the husband's phone. Other people also approached Olson with knowledge of her recent out-of-state arrest. One person called her "the drug dealer that likes to f--- cops."

What was going on?

Read full article

Comments

Asus NUC 13 Pro family expands to include models with Raptor Lake-H chips

The NUC 13 Pro is a mini PC that launched in early 2023 back when Intel was still managing the NUC brand. At the time the little computer was available with processor options that included 15-watt Intel Raptor Lake-U and 28-watt Raptor Lake-H chips. Bu…

The NUC 13 Pro is a mini PC that launched in early 2023 back when Intel was still managing the NUC brand. At the time the little computer was available with processor options that included 15-watt Intel Raptor Lake-U and 28-watt Raptor Lake-H chips. But now that Asus has taken over the NUC line the […]

The post Asus NUC 13 Pro family expands to include models with Raptor Lake-H chips appeared first on Liliputing.

Pomera DM250 distraction-free digital typewriter coming to the US Feb 18 for $499

The Pomera DM250 is a portable digital typewriter that combines a keyboard large enough for touch-typing with a 7 inch transflective black and white LCD display. Designed primarily for use as a distraction-free writing tool, it’s basically a port…

The Pomera DM250 is a portable digital typewriter that combines a keyboard large enough for touch-typing with a 7 inch transflective black and white LCD display. Designed primarily for use as a distraction-free writing tool, it’s basically a portable word processor rather than a full-fledged laptop computer. First launched in Japan in 2022, folks in other parts […]

The post Pomera DM250 distraction-free digital typewriter coming to the US Feb 18 for $499 appeared first on Liliputing.

Measles outbreak in undervaccinated Texas area doubles—again

The outbreak now spans four counties.

A measles outbreak in an area of Texas with abysmal vaccination rates continues to mushroom, with cases doubling since Tuesday and expanding into additional counties.

A week ago, officials reported nine confirmed cases in Gaines County, at the border of New Mexico, which has one of the lowest vaccination rates among kindergartners in the state at just about 82 percent. On Tuesday, the cases climbed to 24, all in Gaines. In Friday's update, the state health department reports that the case count has now reached 48 and spread to three nearby counties, which also have vaccination rates below the 95 percent threshold that prevent vaccine-preventable diseases from spreading onward.

Gaines now reports 42 cases. There's one case reported in Lynn County to the northeast, which has a 91 percent vaccination rate. Terry County, with a vaccination rate of 94 percent, reports three cases, and Yoakum County, with a vaccination rate of 92.5 percent, reports two cases. Terry and Yoakum are both directly north of Gaines.

Read full article

Comments

Man offers to buy city dump in last-ditch effort to recover $800M in bitcoins

Bid from man tortured by trashed bitcoins seems unlikely to sway city council.

James Howells, the IT pro who lost about 8,000 bitcoins in a landfill more than a decade ago, thinks he has one last chance to dig up his buried treasure before it's lost forever.

He wants to buy the landfill.

In January, Howells lost a court battle with Newport City Council in Wales, which many expected would be his last shot at excavating the dump. But soon after, the Newport council revealed that it would be closing the landfill, arousing in Howells a new hope that the bitcoins—today worth nearly $800 million—might still be found.

Read full article

Comments

Asahi Linux lead resigns from Mac-based distro after tumultuous kernel debate

Hector Martin cites burnout, and Rust for Linux oppostion, in resigning.

Working at the intersection of Apple's newest hardware and Linux kernel development, for the benefit of a free distribution, was never going to be easy. But it's been an especially hard couple of weeks for Hector Martin, project lead for Asahi Linux, capping off years of what he describes as burnout, user entitlement, and political battles within the Linux kernel community about Rust code.

In a post on his site, "Resigning as Asahi Linux project lead," Martin summarizes his history with hardware hacking projects, including his time with the Wii homebrew scene (Team Twiizers/fail0verflow), which had its share of insistent users desperate to play pirated games. Martin shifted his focus, and when Apple unveiled its own silicon with the M1 series, Martin writes, "I realized that making it run Linux was my dream project." This time, there was no jailbreaking and a relatively open, if tricky, platform.

Support and donations came quickly. The first two years saw rapid advancement of a platform built "from scratch, with zero vendor support or documentation." Upstreaming code to the Linux kernel, across "practically every Linux subsystem," was an "incredibly frustrating experience" (emphasis Martin's).

Read full article

Comments

After 50 years, Ars staffers pick their favorite Saturday Night Live sketches

“Do not taunt Happy Fun Ball.”

The venerable late-night sketch comedy show Saturday Night Live is celebrating its 50th anniversary season this year. NBC will air a special on Sunday evening featuring current and former cast members.

I've long been a big fan of the show, since I was a kid in the late 1980s watching cast members such as Phil Hartman, Dana Carvey, and Jan Hooks. By then, the show was more than a decade old. It had already spawned huge Hollywood stars like Chevy Chase and Eddie Murphy and had gone through some near-death experiences as it struggled to find its footing.

The show most definitely does not appeal to some people. When I asked the Ars editorial team to share their favorite sketches, a few writers told me they had never found Saturday Night Live funny, hadn't watched it in decades, or just did not get the premise of the show. Others, of course, love the show's ability to poke fun at the cultural and political zeitgeist of the moment.

Read full article

Comments

Massenentlassungen: “Low Performer” bei Meta wegen Elternzeit oder Krankheit

Mark Zuckerberg hat bei Meta 3.600 sogenannte Low Performer entlassen. Viele seien in Elternzeit, krankgeschrieben oder im Urlaub gewesen, erklären Betroffene. (Mark Zuckerberg, Wirtschaft)

Mark Zuckerberg hat bei Meta 3.600 sogenannte Low Performer entlassen. Viele seien in Elternzeit, krankgeschrieben oder im Urlaub gewesen, erklären Betroffene. (Mark Zuckerberg, Wirtschaft)