WordPress plugin with 10,000+ installations being exploited in the wild

No fix available for critical flaw that’s been under attack since last week.

A growing number of WordPress websites have been infected by attackers exploiting a vulnerability that remains unpatched in a widely used plugin called WP Mobile Detector, security researchers warned.

The attacks have been under way since last Friday and are mainly being used to install porn-related spamming scripts, according to a blog post published Thursday. The underlying vulnerability in WP Mobile Detector came to light on Tuesday, and the plugin has since been removed from the official WordPress plugin directory. As of Wednesday, the plugin reportedly had more than 10,000 active installations, and it appears many remained active at the time this post was being prepared.

The security flaw stems from the plugin's failure to remove malicious input submitted by website visitors. Because the WP Mobile Detector performs no security checks, an attacker can feed malicious PHP code into requests received by websites that use the plugin.

Read 3 remaining paragraphs | Comments

1-star Yelp review says “Gordy” the pet fish was overfed, attracts $1M lawsuit

Company’s terms of service require customers “not to make negative comments.”

"Gordy" the betta fish survived his care and appears svelte. He's under surveillance cam watch. (credit: YouTube)

A Texas pet-sitting business is seeking up to $1 million in damages from a couple who gave a one-star review on Yelp and criticized the company's treatment of their tiny blue tropical Betta fish "Gordy" while the family was away on vacation. The company, Prestigious Pets of Dallas, claims the review is a breach of a non-disparagement clause and defamation.

Paul Alan Levy, a Public Citizen lawyer who is defending the couple, summarized the company's revised suit (PDF) targeting the couple.

The new lawsuit, however, specifies one statement from the review in particular: that the company’s assigned pet-sitter had potentially caused serious harm to the couple’s fish by putting too much food in a fish-bowl while the couple were away on vacation for a few days. The complaint alleges that a charge of overfeeding a fish is libel per se because it amounts to the criminal offense of animal cruelty under Texas law (if giving too much food to a pet fish were really a crime, I expect there would be thousands of Texas second-graders facing jail time every year!)

Levy's defense, filed Thursday in a local Dallas court, is that the family's review was truthful and protected by the First Amendment.

Read 9 remaining paragraphs | Comments

Coming to Windows 10: Unlock your PC using a wearable

Coming to Windows 10: Unlock your PC using a wearable

Windows Hello is a security feature built into Windows 10 that lets you prevent unauthorized people from logging into your device… but which lets you login without entering a PIN or password.

Right now Windows Hello lets you do that via fingerprint, iris, or facial recognition, assuming your device has hardware to support those features.

Eventually you may be able to unlock your device just by wearing a wristband or other wearable device.

Continue reading Coming to Windows 10: Unlock your PC using a wearable at Liliputing.

Coming to Windows 10: Unlock your PC using a wearable

Windows Hello is a security feature built into Windows 10 that lets you prevent unauthorized people from logging into your device… but which lets you login without entering a PIN or password.

Right now Windows Hello lets you do that via fingerprint, iris, or facial recognition, assuming your device has hardware to support those features.

Eventually you may be able to unlock your device just by wearing a wristband or other wearable device.

Continue reading Coming to Windows 10: Unlock your PC using a wearable at Liliputing.

The Google/Oracle decision was bad for copyright and bad for software

Op-ed: APIs are creative enough to justify copyright, but not all uses are fair uses.

Former Oracle CEO Larry Ellison, pictured here speaking at a conference in 2006, was one of many former execs to take the stand in Oracle v. Google (credit: Justin Sullivan / Getty Images)

Despite a final verdict, the recent Oracle v. Google trial leaves plenty of questions about the future of APIs, fair use, copyright, development, and more. While their views do not necessarily represent those of Ars Technica as a whole, our staffers wanted to take a look at the outcome and potential ramifications from both sides. Below, Peter Bright argues that software is about to suffer. Elsewhere, Joe Mullin says Google's win sends a powerful message against a familiar legal tactic. You can also find guest op-eds from professor Pamela Samuelson (pro-Google) and attorney Annette Hurst (pro-Oracle).

Oracle's long-running lawsuit against Google has raised two contentious questions. The first is whether application programming interfaces (APIs) should be copyrightable at all. The second is whether, if they are copyrightable, repurposing portions of those APIs can be done without a license in the name of "fair use."

In the first trial between the companies, the court ruled that Google had copied portions of Java but that these copied portions were mere APIs; as such, they were not protected by copyright law. An appeals court later reversed this part of the decision, asserting that the "structure, sequence, and organization" of an API was in fact protectable by copyright. The case was then returned to the trial court to ascertain whether the (previously acknowledged) copying of (now copyright-protected) Oracle material was an infringement of copyright.

Read 42 remaining paragraphs | Comments

How Oracle’s fanciful history of the smartphone failed at trial

Op-ed: Learning patent troll newspeak: success is cheating, invention is theft.

(credit: Aurich Lawson)

Despite a final verdict, the recent Oracle v. Google trial leaves plenty of questions about the future of APIs, fair use, copyright, development, and more. While their views do not necessarily represent those of Ars Technica as a whole, our staffers wanted to take a look at the outcome and potential ramifications from both sides. Below, Joe Mullin says Google's win sends a powerful message against a familiar legal tactic. Elsewhere, Peter Bright argues that software is about to suffer. You can also find guest op-eds from professor Pamela Samuelson (pro-Google) and attorney Annette Hurst (pro-Oracle).

We may never know with certainty why the jury in Oracle v. Google decided in Google's favor, but I can make a pretty good guess.

Like the jury, I'm no expert. I've been reporting on technology law for years, but becoming an experienced journalist is really just mastering the fine art of non-expertise. I have a pretty good conceptual idea of what an API is, derived entirely from listening to more knowledgeable people talk about this case. But if you showed me a block of code, I couldn’t pick out the APIs or "declaring code" at issue.

Read 37 remaining paragraphs | Comments

Google’s fair use victory is good for open source

Op-ed: No, Google’s win won’t gut the GPL.

(credit: Ron Amadeo)

Pamela Samuelson is a longtime professor of IP and cyberlaw at the University of California-Berkeley, and she also chairs the board of the Authors Alliance. Her views do not necessarily represent those of Ars Technica, and they've been republished here with her permission.

Oracle and Google have been fighting for six years about whether Google infringed copyright by its use of 37 of the 166 packages that constitute the Java API in the Android software platform for smart phones. Last week, Google won a jury trial verdict that its reuse of the Java API elements was fair use.

Let me first explain the main facts and claims in the lawsuit, and then why Google's fair use victory is a good thing not only for Google but also for open source developers, for software developers more generally, and for the public.

Read 9 remaining paragraphs | Comments

Ballistix TX3: Microns erste NVMe-M.2-SSD nutzt einen SMI-Controller

Ballistix statt Crucial: Micron vermarktet die TX3 genannte M.2-SSD mit PCIe-3.0-x4-Anschluss mit eigenständigem Brand. Das Drive nutzt 3D-Flash-Speicher und Silicon Motions SM2260-Controller. (Solid State Drive, Speichermedien)

Ballistix statt Crucial: Micron vermarktet die TX3 genannte M.2-SSD mit PCIe-3.0-x4-Anschluss mit eigenständigem Brand. Das Drive nutzt 3D-Flash-Speicher und Silicon Motions SM2260-Controller. (Solid State Drive, Speichermedien)

DVD Release Delays Boost Piracy and Hurt Sales, Study Shows

A new academic paper from Carnegie Mellon University examines the link between international DVD release delays and piracy. The study shows that release delays give rise to increased piracy, hurting sales in the process. In addition, the researchers conclude that the movie industry should consider minimizing or eliminating the unneeded delays.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

piratkeybAfter a film premiers in theaters, movie fans usually have to wait a few months before they can get their hands on a DVD or Blu-Ray copy, depending on the local release strategy.

This delay tactic helps movie theaters to maximize their revenues. However, it might not be the best option for aftermarket sales, which typically account for the largest chunk of a movie’s revenues.

One factor that comes into play here is piracy. Due to artificial delays which vary across different parts of the world, pirates can often get their hands on a high quality rip of a movie before the DVD is officially released in their country.

A new study published by Carnegie Mellon University researchers has looked into this piracy “window of opportunity,” and found that release delays are actually hurting DVD and Blu-Ray sales.

Using real-world data the researchers investigated to what degree the availability of pirated movies during international release delays impact subsequent sales and found a clear positive relation.

“Our results suggest that an additional 10-day delay between the availability of digital piracy and the legitimate DVD release date in a particular country is correlated with a 2-3% reduction in DVD sales in that country,” the researchers write.

The results are robust and the researchers controlled for a variety of alternative explanations.

For example, a longer delay itself doesn’t have a significant effect on sales. Revenue is only impacted if this also results in a longer “piracy window.”

More proof that the effect is driven by piracy is that the sales drops are proportional to piracy levels in a country.

Data shared by various movie studios reveals that movie piracy in Spain is about six times larger than in other countries, an effect that’s also visible in the researchers’ analysis.

“When we run our regressions on Spain and Italy alone, we observe a 10% drop in sales for every 10-day delay in legal availability, as compared to a 2% drop in sales for every 10-day delay in the entire sample,” the paper reads.

Faced with these results, the paper suggests that besides going after pirates, Hollywood can also tweak its own business strategies to target the problem.

The researchers note that thanks to the interconnected nature of the Internet, a pirated film is shared all over the world within seconds of its release. This means that, as opposed to 15 years ago, delayed international movie releases may do more harm than good.

“Our results suggest that studios and exhibitors should reconsider delayed international movie releases in the presence of global piracy,” the paper reads, adding that shorter delays “may have positive spillover effects in the form of reduced piracy in the DVD window.”

The research was carried out as part of Carnegie Mellon University’s Initiative for Digital Entertainment Analytics, which receives significant funding from the MPAA. However, the researchers state that their work is carried out independently.

Whether the MPAA will take up the advixe has yet to be seen, but it’s good to see that the study confirms that movie studios themselves can also do more to address the piracy issue.

Source: TF, for the latest info on copyright, file-sharing, torrent sites and ANONYMOUS VPN services.

Verfassungsschutz: “Mit Handynummern kann man keinen töten”

Die US-Streitkräfte töten bekanntlich Terrorverdächtige auf Basis von Metadaten. Nach Ansicht des Verfassungsschutzes reicht eine weitergegebene Handynummer dafür aber nicht aus. (NSA, Internet)

Die US-Streitkräfte töten bekanntlich Terrorverdächtige auf Basis von Metadaten. Nach Ansicht des Verfassungsschutzes reicht eine weitergegebene Handynummer dafür aber nicht aus. (NSA, Internet)

Where do dogs come from? Genetic evidence offers a new origin story

Widely separated groups in Europe and Asia adopted dogs around the same time.

Such DNA. Paleogenetic. Wow. Very archaeological evidence. (credit: Doge)

Dogs were some of the first animals that humans domesticated. These furry pals were living with people for thousands of years before we invented agriculture and started keeping other animals like goats and pigs. Though we have archaeological evidence of dog bones within human communities dating back 15,000 years, scientists still aren't sure where humans began the process of converting wild wolves into snuggly companions. Now, a new study suggests that dogs were domesticated twice—once in Europe and once in Asia, probably around the same time.

A large group of researchers with expertise in everything from archaeology to paleogenetics has collaborated on a paper in Science explaining how it reached this conclusion. The group began by sequencing DNA from ancient and modern dogs to measure genetic drift. The linchpin of the study was a well-preserved bone from a dog that lived 4,800 years ago in Ireland, roughly around the time that Stonehenge was being constructed. By comparing this dog's DNA with that of more than 600 modern dogs and snippets of DNA from other ancient dogs, the team could determine that this Western dog belonged to a genetic group that diverged from Asian dogs between 14,000 and 6,400 years ago.

Evolutionary biologist Greger Larson told Science's David Grimm, "I was like, ‘Holy shit!’ We never saw this split before because we didn’t have enough samples."

Read 5 remaining paragraphs | Comments