An ATM hack and a PIN-pad hack show chip cards aren’t impervious to fraud

The good news? Hacks are limited for now. The bad news? Hackers will get better.

Security researchers are eager to poke holes in the chip-embedded credit and debit cards that have arrived in Americans' mailboxes over the last year and a half. Although the cards have been in use for a decade around the world, more brains trying to break things are bound to come up with new and inventive hacks. And at last week's Black Hat security conference in Las Vegas, two presentations demonstrated potential threats to the security of chip cards. The first involved fooling point-of-sale (POS) systems into thinking that a chip card is a magnetic stripe card with no chip, and the second involved stealing the temporary, dynamic number generated by a chip card and using it in a very brief window of time to request money from a hacked ATM.

Double trouble

Chip card technology—often called EMV for EuroPay, MasterCard, and Visa for the three companies that developed the chip card standard—is supposed to offer significant security benefits over the old magnetic stripe card system. Magnetic stripe cards have a static card number written into their magnetic stripe, and if a POS system is infected with malware, as was the case in the infamous Target and Home Depot hacks, then a malicious actor can take those card numbers and make counterfeit purchases with them. An EMV card, by contrast, uses a chip to transmit a dynamic number that changes with each purchase. That makes it a lot harder to steal a card number and reuse it elsewhere.

But that doesn’t mean it’s impossible. Late last year, security researcher Samy Kamkar demonstrated that he could calculate a replacement American Express card number based on the previous card number, replicate the credit card’s magnetic stripe information on a programmable chip, and use it to make purchases around town, much like the now-defunct Coin card. Kamkar was even able to do this with chip cards—the magnetic stripe on the back of every card has two tracks of data that tell card readers information like cardholder name, the card’s number, its expiration date, etc. Track 2 data will tell a card reader if the card has a chip and needs to be dipped—otherwise it can be swiped. Kamkar’s solution was to alter the Track 2 data and spoof the card reader to tell it that the card only has a magnetic stripe, no chip, thus bypassing the entry of a dynamic number.

Read 16 remaining paragraphs | Comments

You can still upgrade to Windows 10 for free… until you can’t

You can still upgrade to Windows 10 for free… until you can’t

When Microsoft launched Windows 10 last summer, the company said it would be available as a free update for Windows 7 and later for the first year that it was available. The official cut-off date was July 29th, 2016: if you didn’t update by then, Microsoft said you’d have to pay for a full Windows license to upgrade from Windows 7 or Windows 8.1.

But many people have noticed that this isn’t quite true: you can still upgrade using your existing Windows license to activate the newer version of the operating system.

Continue reading You can still upgrade to Windows 10 for free… until you can’t at Liliputing.

You can still upgrade to Windows 10 for free… until you can’t

When Microsoft launched Windows 10 last summer, the company said it would be available as a free update for Windows 7 and later for the first year that it was available. The official cut-off date was July 29th, 2016: if you didn’t update by then, Microsoft said you’d have to pay for a full Windows license to upgrade from Windows 7 or Windows 8.1.

But many people have noticed that this isn’t quite true: you can still upgrade using your existing Windows license to activate the newer version of the operating system.

Continue reading You can still upgrade to Windows 10 for free… until you can’t at Liliputing.

Synology announces two new rackmount storage appliances—one small, one bigger

1U and 2U network storage devices cover businesses from small to large-ish.

(credit: Synology)

Storage vendor Synology this morning announced the availability of two additions to its rack-mounted storage appliance line-up: the 1U RS816, which has room for four internal disks, and the 2U RS3617xs, with 12 internal drive bays and up to 36 disks with additional enclosures.

Although it has been a while since we last did a review, Synology’s network attached storage (NAS) devices are pretty popular with Ars staff and readers. But these new rackmount offerings are meant for data centers, not home server closets—not unless you’re the kind of person with a 19" rack at home (and we know you folks are out there!). The 1U RS816 has a Marvel Armada dual-core CPU and a gigabyte of RAM on board, as well as a pair of gigabit Ethernet ports; the bigger RS3617xs uses a quad-core Intel Xeon E3-1230v2 CPU and comes with 4GB of ECC RAM and four gigabit Ethernet ports. The RS3617xs also has a pair of PCIe 3.0 8-lane slots which can each be filled by a 10Gbps Ethernet card.

On the low end, the RS816 lets you chop up your disks into a number of different redundancy schemes, including RAID 0, 1, 5, 6, and 10, and also Synology’s proprietary Synology Hybrid RAID containerized format (which lets you mix and match different sized disks without sacrificing as much space as with standard RAID layouts). The bigger RES3617xs doesn’t support Synology Hybrid RAID, but it does let you format its disks with the next-gen btrfs file system, which carries a number of advantages over the default ext4 file system.

Read 2 remaining paragraphs | Comments

New Trek series committed to casting diversity, main character won’t be captain

Series is set 10 years before the USS Enterprise‘s five-year mission.

(credit: CBS)

We still don't know much specific information about Star Trek: Discovery, the franchise's return to television after over a decade, but showrunner Bryan Fuller has dropped a few more hints during the Television Critics Association press tour this week.

According to TV Guide, the show's lead character will be a woman, but she won't be the captain of the USS Discovery. All iterations of Star Trek, especially from The Next Generation onward, have had an ensemble cast to some degree, but the commanding officer's perspective has usually been the most important.

"To see a character from a different perspective on a starship, who has a different dynamic [and] relationship with the captain and with subordinates, felt like it was going to give us richer context [and allow us to] have different types of stories with that character," said Fuller.

Read 2 remaining paragraphs | Comments

ISPs and FCC Republicans celebrate FCC’s court loss on muni broadband

FCC critics glad that commission can’t preempt state laws.

(credit: Epic Fireworks)

A trade group representing ISPs rejoiced over a court decision that allows states to limit the growth of municipal broadband networks.

The "decision is a victory for the rule of law," said Walter McCormick, president of the United States Telecom Association (USTelecom). "The FCC’s authority is not unbridled; it is limited to powers specifically delegated by the Congress, and it does not extend to preemption of state legislatures’ exercise of jurisdiction over their own political subdivisions."

The best way for the FCC to accelerate broadband deployment is to "eliminat[e] federal regulatory impediments to innovation and investment—where there remains to be much that can and should be done," he said.

Read 20 remaining paragraphs | Comments

Gema: Sharehoster Uploaded.net von Landgericht München verurteilt

Der Schweizer Sharehoster Uploaded.net muss für Urheberrechtsverletzungen über die Plattform zahlen. Die Gema feiert das Urteil als wichtigen Sieg. (Sharehoster, Rechtsstreitigkeiten)

Der Schweizer Sharehoster Uploaded.net muss für Urheberrechtsverletzungen über die Plattform zahlen. Die Gema feiert das Urteil als wichtigen Sieg. (Sharehoster, Rechtsstreitigkeiten)

Brain wiring needed for reading isn’t learned—it’s in place prior to reading

Researchers could predict how kids’ brains would develop before they learned to read.

(credit: ThomasLife)

Our brains are apparently really good at divvying up heavy mental loads. In the decades since scientists started taking snapshots of our noggins in action, they’ve spotted dozens of distinct brain regions in charge of specific tasks, such as reading and speech. Yet despite documenting this delegation, scientists still aren’t sure exactly how slices of our noodle get earmarked for specific functions. Are they preordained based entirely on anatomy, or are they assigned as wiring gets laid down during our development?

A new study, published this week in Nature Neuroscience, adds more support for that latter hypothesis. Specifically, researchers at MIT scanned the brains of kids before and after they learned to read and found that they could pinpoint how the area responsible for that task would develop based on connectivity patterns. In other words, the neural circuitry and hookups laid down prior to reading determined where and how the brain region responsible for reading, the visual word form area, or VWFA, formed.

“Long-range connections that allow this region to talk to other areas of the brain seem to drive function,” Zeynep Saygin, lead study author and researcher at MIT’s McGovern Institute for Brain Research, said in a news release.

Read 8 remaining paragraphs | Comments

HP Stream: Neue Windows-Notebooks mit sehr wenig Speicherplatz

HP hat seine Stream-Serie aktualisiert. Die Rechner sollen sich, wie Googles Chromebooks, vor allem an Cloud-Nutzer richten. Der lokale Speicherplatz ist nur für das System da. Trotzdem gibt es nicht alle Verbindungsoptionen. Dafür sind die Stream-Notebooks günstig. (HP, Notebook)

HP hat seine Stream-Serie aktualisiert. Die Rechner sollen sich, wie Googles Chromebooks, vor allem an Cloud-Nutzer richten. Der lokale Speicherplatz ist nur für das System da. Trotzdem gibt es nicht alle Verbindungsoptionen. Dafür sind die Stream-Notebooks günstig. (HP, Notebook)

Bleeping Computer countersues maker of SpyHunter

Upset over domain name registrations that “libel” Bleeping Computer.

(credit: Wired UK/Shuttershock)

Bleeping Computer, a longstanding popular discussion forum that helps people rid their computers of malware, has now countersued Enigma Software Group (ESG), which makes an antivirus software known as SpyHunter.

Bleeping now claims that ESG has been violating Bleeping’s trademarks by registering new domain names that include “bleepingcomputer” and posting some of the company’s webpage’s source code on other websites without its authorization, among other allegations.

ESG had sued Bleeping for libel earlier this year over a series of messages that it claims disparaged SpyHunter and the company as a whole.

Read 10 remaining paragraphs | Comments

Review: iRobot’s $199 Braava Jet is a robo-Swiffer for small spaces

It gets points for cleanliness and ease of use, but its audience is limited.

(credit: Valentina Palladino)

There are a number of perks to having a robot vacuum, the biggest being you can clean your home without actually having to do anything yourself. You do pay for that convenience, though, as most robo-vacs cost just as much as elite handheld ones do. iRobot decided to try something different with the Braava Jet: it's half the size of its other Roomba vacuums, it costs just $199, and it doesn't actually vacuum—it mops.

The company made the Braava Jet with a certain kind of user in mind, one that likely doesn't live in a huge home, has primarily hardwood or tile floors, and doesn't want to dig deep into their wallets for an automatic vacuum. Though it's ideal for those living in small apartments, others should carefully consider their options before investing in this mopping robot.

Design: A cute, compact cleaner

The Braava Jet might be the cutest robot that iRobot has ever made. Measuring 6.7" × 7.0" × 3.3" and weighing 2.7 pounds, the tiny square mopping robot is slightly smaller than a lunchbox and it even has a handle like one, too. The device is mostly white with a few accents of ocean blue, particularly on the backlit "clean" button that sits prominently on its top. Blue also highlights the precision spray hole, on the side of the robot, where water shoots out to dampen the floor ahead of the Braava Jet's path.

Read 16 remaining paragraphs | Comments