Category: Uncategorised

If you don’t pay $99 each year for an Amazon Prime membership, which promises two-day shipping on all orders, regular shipping on Amazon purchases might be slower than it was last year, according to a study from customer service metrics company StellaService.

In an interview with Forbes, StellaService vice president of research Kevon Hills said the company tracks how quickly orders from 40 companies are fulfilled. Amazon fell outside of the top 10 fastest companies for the first time this year, losing ground to companies like BestBuy and Apple.

Hills said the speed of shipments to Prime customers is unchanged, indicating that Amazon is throwing considerable investment at serving its rapidly growing Prime base—which increased by 51 percent in 2015. Although Amazon does not reveal numbers about how many customers are Prime members, analysts have estimated that Prime membership totals at least 46 million people and could be as high as 80 million.

Websites that rely on the Tor anonymity service to cloak their server address may be leaking their geographic location and other sensitive information thanks to a setting that's turned on by default in many releases of Apache, the world's most widely used Web server.

The information leak has long been known to careful administrators who take the time to read Tor documentation, but that hasn't prevented some Tor hidden services from falling victim to it. To plug the hole, darkweb sites that run Apache must disable the mod_status module that by default sets up a server status page displaying a variety of potentially sensitive information about the servers. Details include the number of requests per second sent to the server, the most recent HTTP requests received, CPU usage, and in some cases the approximate longitude of the server.

It would appear some hidden services still haven't figured out that many Apache installations display the data by default. In a blog post published over the weekend, an anonymous poster wrote:

Who needs crypto backdoors when Barbie can spy on you? (credit: Mike Licht)

The so-called "going dark" problem—which various government officials claim will be the death knell to the US because Silicon Valley won't bake crypto backdoors into its wares—is greatly overblown. That's because crime fighters are not in the dark, at least technologically, and are now presented with a vast array of spy tools at their disposal. Specifically, modern espionage is piggybacking on the Internet of Things (IoT) tools, from televisions to toasters, that enable wanton spying.

"The audio and video sensors on IoT devices will open up numerous avenues for government actors to demand access to real-time and recorded communications," according to a Berkman Center for Internet & Society report published Monday.

The report added:

(credit: Matt Wade)

Privacy researcher Ashkan Soltani, who worked on several Washington Post stories regarding the Snowden leaks, has been barred from working at the White House.

In December, Soltani was hired to be senior adviser to White House Chief Technology Officer Megan Smith. On Friday, Soltani said on Twitter that to his disappointment, the White House Office of Personnel Security denied him a security authorization to work there.

"I'm told this is something that happens from time to time and I won't speculate on the reasons," said Soltani in a statement. "I do want to say that I am proud of my work, I passed the mandatory drug screening some time ago, and the FBI background check was still underway. There was also no allegation that it was based on the quality or integrity of my work."

A Google Titan drone.

If a report from The Guardian is to be believed, Google has yet another Internet-in-the-sky program in the works. This one is called "Project Skybender" and aims to outfit drones with millimeter wave transceivers—radios that work in a slice of the spectrum that could be used in next-generation "5G" networks.

Apparently, Google currently has drones whizzing around the airspace of Spaceport America in New Mexico, where the project shares a hangar with Virgin Galactic. Currently, the drone hardware seems to be an "optionally piloted" commercial aircraft called the "Centaur," along with the solar-powered drones from Google Titan. Both aircraft are "plane like" drones with wings and front-facing propellers.

The report says that Google is using the drones to "experiment with millimeter-wave radio transmissions" and that the project "ultimately envisages thousands of high altitude 'self-flying aircraft' delivering Internet access around the world." The FCC has said that 5G millimeter wave networks could hit speeds between 1Gbps and 10Gbps. Currently engineers are working around natural distance and signal propagation issues inherent in the lower frequency. While millimeter-wave transceivers might eventually be integrated into a smartphone, Google is presently using several stationary antennas around Spaceport America.

One of the thousands of e-mails from Hillary Clinton's personal mail server that have been publicly released by the State Department. Now, 22 have been labeled with a Top Secret or higher classification.

The US State Department has declared 22 of the e-mails stored on former Secretary of State Hillary Clinton's personal mail server to contain information classified as "top secret." In some cases, those e-mails were related to "special access programs"—the highest level of classification for government secrets, reserved for protected intelligence and other information kept closely protected because of its sensitivity. The State Department did not reveal whether the messages were all sent to Clinton or if she authored any of them.

Clinton has maintained that she never sent any classified information using her personal e-mail—a hosted Exchange server that initially was operated from her own home.

The messages were "upgraded at the request of the intelligence community," State Department spokesperson John Kirby told the Associated Press, indicating that they had not been marked with that level of classification initially. There is no indication whether the information was sent or received by Clinton or whether it bore any classification mark to begin with.

A Comcast customer who is dissatisfied with Internet speeds set up a Raspberry Pi to automatically tweet at Comcast each time speeds are much lower than advertised.

"I pay for 150Mbps down and 10Mbps up," Reddit user AlekseyP wrote over the weekend. "The Raspberry Pi runs a series of speed tests every hour and stores the data. Whenever the down[load] speed is below 50Mbps the Pi uses a Twitter API to send an automatic tweet to Comcast listing the speeds. I know some people might say I should not be complaining about 50Mbps down, but when they advertise 150 and I get 10-30 I am unsatisfied."

AlekseyP made the Twitter bot's code available on Pastebin. "I am by no means some fancy programmer so there is no need to point out that my code is ugly or could be better," the Redditor wrote. AlekseyP set the tweeting threshold at 50Mbps in part because the Raspberry Pi's Ethernet port tops out at 100Mbps.

Enlarge (credit: shodan.io)

One of the benefits of the next-generation Internet protocol known as IPv6 is the enhanced privacy it offers over its IPv4 predecessor. With a staggering 2¹²⁸ (or about 3.4×10³⁸) theoretical addresses available, its IP pool is immune to the types of systematic scans that criminal hackers and researchers routinely perform to locate vulnerable devices and networks with IPv4 addresses. What's more, IPv6 addresses can contain regularly changing, partially randomized extensions. Together, the IPv6 features cloak devices in a quasi anonymity that's not possible with IPv4.

Now, network administrators have discovered a clever way that scanners are piercing the IPv6 cloak of obscurity. By setting up an IPv6-based network time protocol service most Internet-connected devices rely on to keep their internal clocks accurate, the operators can harvest huge numbers of IPv6 addresses that would otherwise remain unknown. The server operators can then scan hundreds or thousands of ports attached to each address to identify publicly available surveillance cameras, unpatched servers, and similar vulnerabilities.

Shodan—the vulnerability search engine that indexes Internet-connected devices—has been quietly contributing NTP services for months to the cluster of volunteer time servers known as the NTP Pool Project. To increase the number of connections to three recently identified Shodan-run servers, each one had 15 virtual IP addresses. The added addresses effectively multiplied the volume of traffic they received by 15-fold, increasing the odds that Shodan would see new devices. Within seconds of one of the Shodan's NTP servers receiving a query from an IPv6 device, Shodan's main scanning engine would scan more than 100 ports belonging to the device. The Shodan scanner would then revisit the device roughly once a day.