MSI has confirmed it suffered a data breach after a ransomware gang claimed it stole files from the PC maker. The company published a Taiwanese stock exchange filing about experiencing a âoecyber attack,â although the company is thin on details. From a report: "After detecting some information systems being attacked by hackers, MSI's IT department has initiated information security defense mechanism and recovery procedures," the PC maker said. The company also reported the incident to authorities. MSI didn't immediately respond to a request for comment, making it unclear whether customer data is affected. But in the stock exchange filing, the PC maker says it anticipates the breach having "no significant impact" on its financials or operations. A new ransomware group called Money Message claims it breached the PC maker to steal the company's source code, including the framework for the BIOS used in MSI products.

Amazon has banned the sale of the Flipper Zero portable multi-tool for pen-testers as it no longer allows its sale on the platform after tagging it as a card-skimming device. From a report: The Flipper Zero is a compact, portable, and programmable pen-testing tool that can help experiment with and debug various digital and hardware devices via various protocols, including RFID, radio, NFC, infrared, Bluetooth, and others. Since its launch, users have showcased Flipper Zero's capabilities demonstrating its capacity to activate doorbells, conduct replay attacks to unlock cars and open garage doors, and clone a wide range of digital keys. According to notices sent to sellers on Thursday evening, Amazon has now banned Flipper Zero on its platform, tagging it as a "restricted product." Card-skimming devices are listed on Amazon's Seller Central portal under the Lock Picking & Theft Devices restricted product category, next to key duplicating devices and shoplifting devices, such as sensormatic detachers. Currently, some links to previously available Amazon pages selling Flipper Zero tools are dead and displaying "Sorry, we couldn't find that page. Try searching or go to Amazon's home page." errors, while others list it as "Unavailable."

Academics in the US have developed an attack dubbed NUIT, for Near-Ultrasound Inaudible Trojan, that exploits vulnerabilities in smart device microphones and voice assistants to silently and remotely access smart phones and home devices. The Register reports: The research team -- Guenevere Chen, an associate professor at the University of Texas at San Antonio, her doctoral student Qi Xia, and Shouhuai Xu, a professor at the University of Colorado Colorado Springs -- found Apple's Siri, Google's Assistant, Microsoft's Cortana, and Amazon's Alexa are all vulnerable to NUIT attacks, albeit to different degrees. In an interview with The Register this month, Chen and Xia demonstrated two separate NUIT attacks: NUIT-1, which emits sounds to exploit a victim's smart speaker to attack the same victim's microphone and voice assistant on the same device, and NUIT-2, which exploits a victim's speaker to attack the same victim's microphone and voice assistant on a different device. Ideally, for the attacker, these sounds should be inaudible to humans.

The attacks work by modulating voice commands into near-ultrasound inaudible signals so that humans can't hear them but the voice assistant will still respond to them. These signals are then embedded into a carrier, such as an app or YouTube video. When a vulnerable device picks up the carrier, it ends up obeying the hidden embedded commands. Attackers can use social engineering to trick the victim into playing the sound clip, Xia explained. "And once the victim plays this clip, voluntarily or involuntarily, the attacker can manipulate your Siri to do something, for example, open your door."

For NUIT-1 attacks, using Siri, the answer is yes. The boffins found they could control an iPhone's volume so that a silent instruction to Siri generates an inaudible response. The other three voice assistants -- Google's, Cortana, and Alexa -- are still susceptible to the attacks, but for NUIT-1, the technique can't silence devices' response so the victim may notice shenanigans are afoot. It's also worth noting that the length of malicious commands must be below 77 milliseconds -- that's the average reaction time for the four voice assistants across multiple devices.

In a NUIT-2 attack, the attacker exploits the speaker on one device to attack the microphone and associated voice assistant of a second device. These attacks aren't limited by the 77-millisecond window and thus give the attacker a broader range of possible action commands. An attacker could use this scenario during Zooms meeting, for example: if an attendee unmutes themself, and their phone is placed next to their computer, an attacker could use an embedded attack signal to attack that attendees phone. The researchers will publish their research and demonstrate the NUIT attacks at the USENIX Security Symposium in August.

An anonymous reader quotes a report from CBS News: Americans have grown so fond of working from home that many are are willing to sacrifice pay for the privilege of skipping the office. So found a recent survey by recruiting firm Robert Half, which polled thousands of U.S. employees and hiring managers about their attitudes toward remote work. Some workers said they're willing to take a pay cut -- with an average reduction of 18% -- to remain fully remote, Paul McDonald, a Robert Half senior executive director, told CBS News. Overall, roughly one in three workers who go into the office at least one day a week said they were willing to earn less for the opportunity to work remotely.

An anonymous reader quotes a report from Ars Technica: A market-leading garage door controller is so riddled with severe security and privacy vulnerabilities that the researcher who discovered them, Sam Sabetan, is advising anyone using one to immediately disconnect it until they are fixed. Each $80 device, used to open and close garage doors and control home security alarms and smart power plugs, employs the same easy-to-find universal password to communicate with Nexx servers. The controllers also broadcast the unencrypted email address, device ID, first name, and last initial corresponding to each one, along with the message required to open or shut a door or turn on or off a smart plug or schedule such a command for a later time.

The result: Anyone with a moderate technical background can search Nexx servers for a given email address, device ID, or name and then issue commands to the associated controller. (Nexx controllers for home security alarms are susceptible to a similar class of vulnerabilities.) Commands allow a door to be opened, a device connected to a smart plug to be turned off, or an alarm to be disarmed. Worse still, over the past three months, personnel for Texas-based Nexx haven't responded to multiple private messages warning of the vulnerabilities.

"Nexx has consistently ignored communication attempts from myself, the Department of Homeland Security, and the media," Sabetan wrote in a post published on Tuesday. "Device owners should immediately unplug all Nexx devices and create support tickets with the company requesting them to remediate the issue." Sabetan estimates that more than 40,000 devices, located in residential and commercial properties, are impacted, and more than 20,000 individuals have active Nexx accounts.

eFile.com, an IRS-authorized e-file software service provider used by many for filing their tax returns, has been caught serving JavaScript malware. BleepingComputer reports: eFile.com was caught serving malware, as spotted by multiple users and researchers. The malicious JavaScript file in question is called 'popper.js'. The development comes at a crucial time when U.S. taxpayers are wrapping up their IRS tax returns before the April 18th due date. BleepingComputer can confirm, the malicious JavaScript file 'popper.js' was being loaded by almost every page of eFile.com, at least up until April 1st. As of today, the file is no longer seen serving the malicious code.

On March 17th, a Reddit thread surfaced where multiple eFile.com users suspected the website was "hijacked." At the time, the website showed an SSL error message that, some suspected, was fake and indicative of a hack. Turns out that's indeed the case. [...] The malicious JavaScript file 'update.js', further attempts to prompt users to download next stage payload, depending on whether they are using Chrome [update.exe - VirusTotal] or Firefox [installer.exe - VirusTotal]. Antivirus products have already started flagging these executables as trojans.

BleepingComputer has independently confirmed these binaries establish a connection to a Tokyo-based IP address, 47.245.6.91, that appears to be hosted with Alibaba. The same IP also hosts the illicit domain, infoamanewonliag[.]online associated with this incident. Security research group, MalwareHunterTeam further analyzed these binaries, and stated that these contain Windows botnets written in PHP -- a fact that the research group mocked. Additionally, the group called out eFile.com for leaving the malicious code on its website for weeks: "So, the website of [efile.com]... got compromised at least around middle of March & still not cleaned," writes MalwareHunterTeam.

Atlassian customers' eleven-year quest for custom domains continues, with the Australian upstart's proposed solution failing to satisfy. The Register: As The Register reported in 2022, Atlassian floated the idea of custom domains for its custom apps in 2011. Yes, 2011. The ticket for the change is called "CLOUD 6999" and has become infamous for the length of time it has remained unresolved. An unidentified wag has even made t-shirts bearing the CLOUD 6999 name. Atlassian promised last year to sort it out some time in 2023, and in February posted an update on its initial designs.

It hasn't gone down well. Atlassian's proposed solution requires "a company-branded domain name, a list of options for the 1st-level subdomain keyword, and a 2nd-level subdomain at your own choice." Atlassian cloud admin experience chap Luke Liu explained that structure as delivering URLs such as internal.support.acme.com or people.knowledge.acme.org. One of Atlassian's stated company values is "Don't #@!% the customer." But plenty of Atlassian customers feel well and truly #@!%ed by the custom domain plan. "The cloud roadmap specifically uses an example of 1 level," wrote one commenter on the 1,445-item thread discussing CLOUD 6999. "The team managing this seems to be completely lost and disconnected from the user base."

Google is backtracking on its decision to put a file creation cap on Google Drive. From a report: Around two months ago, the company decided to cap all Google Drive users to 5 million files, even if they were paying for extra storage. The company did this in the worst way possible, rolling out the limit as a complete surprise and with no prior communication. Some users logged in to find they were suddenly millions of files over the new limit and unable to upload new files until they deleted enough to get under the limit. Some of these users were businesses that had the sudden file cap bring down their systems, and because Google never communicated that the change was coming, many people initially thought the limitation was a bug.

Apparently, sunshine really is the best disinfectant. The story made the tech news rounds on Friday, and Ars got Google on the record saying that the file cap was not a bug and was actually "a safeguard to prevent misuse of our system in a way that might impact the stability and safety of the system." After the weekend reaction to "Google Drive's Secret File Cap!" Google announced on Twitter Monday night that it was rolling back the limit. [...] Google told us it initially rolled the limitation out to stop what it called "misuse" of Drive, and with the tweet saying Google wants to "explore alternate approaches to ensure a great experience for all," it sounds like we might see more kinds of Drive limitations in the future.

Microsoft has just officially unveiled the Surface Thunderbolt 4 Dock hours after the device leaked. From a report: Priced at $299.99, the new Surface dock will connect over USB-C instead of the proprietary Surface Connect port. Microsoft is planning to keep selling its Surface Dock 2, complete with the Surface Connect port that's designed for Surface devices that don't have USB-C or Thunderbolt 4. This new Surface Thunderbolt 4 Dock will support devices other than Surface for the first time. You can connect to it via USB-C, and it supports data transfer speeds of up to 40Gbps and 96W charging thanks to Thunderbolt 4. At the front, there is a single USB-C port alongside a USB-A port but sadly no SD card slot. The rear of the Surface Thunderbolt 4 Dock has two USB-C ports, two USB-A ports, a 2.5-gigabit ethernet port, an audio jack, and a security lock slot.

Apple said that some users are experiencing disruptions of its weather app on Tuesday, citing a data provider issue. From a report: The Cupertino, California-based company said on its website that issues for the app were reported at 11 p.m. New York time Monday and continued Tuesday. Apple said that precipitation forecasts for the next hour may be unavailable in Alaska "due to a data provider outage," but disruptions appear to be across various cities. All other services, such as the App Store, Apple TV and FaceTime, appear to be available and working without issue.

Capita, the United Kingdom's largest outsourcing company, confirmed Monday that an IT outage which left staff locked out of their accounts on Friday was caused by "a cyber incident." The Record reports: Staff attempting to login were erroneously told their usual passwords were "incorrect" according to reports, fueling speculation that a cyberattack was to blame, although not all of Capita's 61,000 employees were affected. At the time, a Capita spokesperson said the company was investigating "a technical issue."

In an update on Monday about the incident sent to the Regulatory News Service, the company confirmed it "experienced a cyber incident primarily impacting access to internal Microsoft Office 365 applications." The nature of the incident has not been disclosed. While financially motivated ransomware attacks remain a prevalent threat for organizations in Britain, Capita also provides services to the British government that may be of interest to state-sponsored espionage groups.

Capita's numerous contracts include several with the Ministry of Defence. Last year, a consortium it leads took control over engineering and maintenance support of training simulators for the Royal Navy's nuclear-powered ballistic missile submarines used as part of the U.K.'s nuclear deterrent. In its statement, Capita said: "Immediate steps were taken to successfully isolate and contain the issue," which was "limited to parts of the Capita network."

Researchers from Darktrace have seen a 135% increase in novel social engineering attack emails in the first two months of 2023. IT Pro reports: The cyber security firm said the email attacks targeted thousands of its customers in January and February 2023, an increase which it said matches the adoption rate of ChatGPT. The novel social engineering attacks make use of "sophisticated linguistic techniques," which Darktrace said include increasing text volume, sentence length, and punctuation in emails. Darktrace also found there's been a decrease in the number of malicious emails that are sent with an attachment or link.

The firm said that this behavior could mean that generative AI, including ChatGPT, is being used by malicious actors to construct targeted attacks rapidly. Survey results indicated that 82% of employees are worried about hackers using generative AI to create scam emails which are indistinguishable from genuine communication. It also found that 30% of employees have fallen for a scam email or text in the past. Darktrace asked survey respondents what the top-three characteristics are that suggest an email is a phish and found:

- 68% said it was being invited to click a link or open an attachment
- 61% said it was due to an unknown sender or unexpected content
- Poor use of spelling and grammar was chosen by 61% too

In the last six months, 70% of employees reported an increase in the frequency of scam emails. Additionally, 79% said that their organization's spam filters prevent legitimate emails from entering their inbox. 87% of employees said they were worried about the amount of their personal information online which could be used in phishing or email scams.

Google is bringing Android's "Nearby Share" feature to the desktop with a new Windows app. Google says the new program will make sharing between Windows and Android easier, letting you send files over in just a few clicks and taps. From a report: Google's Nearby Share has been built into Android for a few years now and allows you to locally transfer files over Wi-Fi, with the initial device-pairing happening over Bluetooth. Nearby share has been kind of tough to use in real life, since most people share files over the Internet. And for personal use, most people only have one Android device, their phone, so there has been nothing to share files with. A ton of Android users have Windows PCs, though, so for many this will be the first time Nearby Share has an actual use. Using the app is easy. Just download it from the Android website and click a few "next" buttons in the installer. You need a 64-bit Windows PC (not ARM, ironically) with Bluetooth and Wi-Fi. From there you can easily share by dragging and dropping on Windows or by using the Android "share" button and hitting "Nearby Share." You have the option of signing in to the Windows app or not. If you don't you'll need to manually approve every transaction on both the phone and PC. If you sign in, you can set up auto-accept from yourself, anyone in your contacts, or the probably not advisable "everyone" option.

Google's finance chief Ruth Porat recently said in a rare companywide email that the company is making cuts to employee services. From a report: "These are big, multi-year efforts," Porat said in a Friday email titled: "Our company-wide OKR on durable savings." Elements of the email were previously reported by the Wall Street Journal. In separate documents viewed by CNBC, Google said it's cutting back on fitness classes, staplers, tape, and the frequency of laptop replacements for employees. One of the company's important objectives for 2023 is to "deliver durable savings through improved velocity and efficiency." Porat said in the email. "All PAs and Functions are working toward this," she said, referring to product areas.

Data storage giant Western Digital has confirmed that hackers exfiltrated data from its systems during a "network security incident" last week. From a report: The California-based company said in a statement on Monday that an unauthorized third party gained access to "a number" of its internal systems on March 26. Western Digital hasn't confirmed the nature of the incident or revealed how it was compromised, but its statement suggests the incident may be linked to ransomware. [...] Western Digital notes that the incident "has caused and may continue to cause disruption" to the company's business operations.

An anonymous reader shares this report from the Washington Post: The exodus of people fleeing large urban areas during the height of the pandemic appears to be reversing, according to data from the Census Bureau released Thursday. Many workers who could telecommute abandoned crowded cities and counties for suburban or rural areas when covid struck, causing demographers and businesses to wonder whether the movement signified a permanent shift. But the overall patterns of population change are moving toward pre-pandemic rates, the bureau's Vintage 2022 estimates of population and components of change show.

Eleven of the 15 largest metro areas gained residents or lost fewer people compared with the previous year, including the D.C. metro area, New York City, the San Francisco Bay Area, and Seattle, according to an analysis by Brookings Institution senior demographer William Frey.... Among the most striking recorded shifts were in Manhattan and San Francisco, both of which lost population at a significant rate between 2020 and 2021. Manhattan, which shrank by 5.87 percent in 2021, grew by 1.11 percent last year. San Francisco lost 6.79 percent of its population in 2021 but shrank by only a third of a percentage point last year. Both are home to a large number of people who were able to work remotely during the pandemic. Covid rates in New York City were especially high early in the pandemic, and many Manhattan residents moved to outlying counties....

"Many counties with large universities saw their populations fully rebound this year as students returned," said Christine Hartley, assistant division chief for estimates and projections in the Census Bureau's population division.
The article also makes the point that immigration into America was temporarily restricted during the pandemic, so outflows never had a chance to be counterbalanced by inflows. And the exodus to the suburbs may have already peaked. Last year Manhattan gained 17,472 people, the article points out, while counties outside the city lost residents. The Census Bureau notes that was a pattern for 2022: "the smallest counties nationally, those with populations below 10,000, experienced more population loss (60.8%) than gains (38.3%); while the largest counties, having populations at or greater than 100,000, largely experienced population increases (68%)."

Beyond that, the executive director of the DC Fiscal Policy Institute argues that it's just too soon to know whether the pandemic-era outflow from cities was permanent. "We've just been through a major health and economic shock. There's been what I call a doomsday narrative about what's going to happen, with predictions of empty downtowns and city centers that wither and die." They believe the new census data "should give us pause in terms of declaring that we've arrived at a new normal. It's highly likely that some of the folks who left will come back, and we really don't know if it's going to be a lot of them or just a small portion."

Today a warning was published from the editorial board of the San Francisco Chronicle. "Experts say post-pandemic woes stemming from office workers staying home instead of commuting into the city could send San Francisco into a 'doom loop' that would gut its tax base, decimate fare-reliant regional transit systems like BART and trap it in an economic death spiral...." Despite our housing crisis, it was years into the COVID pandemic before our leaders meaningfully questioned the logic of reserving some of the most prized real estate on Earth for fickle suburbanites and their cars. Downtown, after all, was San Francisco's golden goose. Companies in downtown offices accounted for 70% of San Francisco's pre-pandemic jobs and generated nearly 80% of its economic output, according to city economist Ted Egan. And so we wasted generous federal COVID emergency funds trying to bludgeon, cajole and pray for office workers to return downtown instead of planning for change. We're now staring down the consequences for that lack of vision.

The San Francisco metropolitan area's economic recovery from the pandemic ranked 24th out of the 25 largest regions in the U.S., besting only Baltimore, according to a report from the Bay Area Council Economic Institute. In the first quarter of 2023, San Francisco's office vacancy rate shot up to a record-high 29.4% — the biggest three-year increase of any U.S. city. The trend isn't likely to end anytime soon: In January, nearly 30% of San Francisco job openings were for hybrid or fully remote work, the highest share of the nation's 50 largest cities. Amid lower property, business and real estate transfer taxes, the city is projecting a $728 million deficit over the next two fiscal years. Transit ridership remains far below pre-pandemic levels. In January, downtown San Francisco BART stations had just 30% of the rider exits they did in 2019, according to a report from Egan's office. Many Bay Area transit agencies, including Muni, are rapidly approaching a fiscal cliff.

San Francisco isn't dead; as of March, it was home to an estimated 173 of the country's 655 companies valued at more than $1 billion. Tourism is beginning to rebound. And new census data shows that San Francisco's population loss is slowing, a sign its pandemic exodus may be coming to an end. But the city can't afford to wait idly for things to reach equilibrium again. It needs to evolve — quickly. Especially downtown. That means rebuilding the neighborhood's fabric, which won't be cheap or easy. Office-to-housing conversions are notoriously tricky and expensive. Demolishing non-historic commercial buildings that no longer serve a purpose in the post-pandemic world is all but banned. And, unlike New York after 9/11, San Francisco is a city that can't seem to stop getting in its own way.
So what's the solution? The CEO of the Bay Area Council suggests public-private partnerships that "could help shift downtown San Francisco's focus from tech — with employees now accustomed to working from home — to research and development, biotech, medical research and manufacturing, which all require in-person workers."

And last week San Francisco's mayor proposed more than 100 changes to streamline the permitting process for small businesses, and on Monday helped introduce legislation making it easier to convert office buildings to housing, expand pop-up business opportunities, and fill some empty storefronts. This follows a February executive order to speed housing construction. The editorial points out that "About 40% of office buildings in downtown San Francisco evaluated in a study would be good candidates for housing due to their physical characteristics and location and could be converted into approximately 11,200 units, according to research from SPUR and the Urban Land Institute San Francisco."

But without some action, the editorial's headline argues that "Downtown San Francisco is at risk of collapsing — and taking much of the Bay Area with it."

An anonymous reader quotes a report from KrebsOnSecurity: Authorities in Germany this week seized Internet servers that powered FlyHosting, a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was open for business to anyone looking for a reliable place to host malware, botnet controllers, or DDoS-for-hire infrastructure. A statement released today by the German Federal Criminal Police Office says they served eight search warrants on March 30, and identified five individuals aged 16-24 suspected of operating "an internet service" since mid-2021. The German authorities did not name the suspects or the Internet service in question.

"Previously unknown perpetrators used the Internet service provided by the suspects in particular for so-called 'DDoS attacks', i.e. the simultaneous sending of a large number of data packets via the Internet for the purpose of disrupting other data processing systems," the statement reads. The German authorities said that as a result of the DDoS attacks facilitated by the defendants, the websites of various companies as well as those of the Hesse police have been overloaded in several cases since mid-2021, "so that they could only be operated to a limited extent or no longer at times." The statement says police seized mobile phones, laptops, tablets, storage media and handwritten notes from the unnamed defendants, and confiscated servers operated by the suspects in Germany, Finland and the Netherlands.

Technical glitch during a scheduled upgrade affected all automated immigration clearance systems and led to rare delays at Singapore's Changi Airport, which recently was again named the world's best airport. ZDNet reports: Long lines were spotted Thursday morning at the country's airport where travelers usually would not need more than mere minutes to clear immigration. In a series of posts on Facebook and Twitter, Singapore's Immigration & Checkpoints Authority (ICA) said it was experiencing "system slowness" at several passenger clearance checkpoints, including all automated departure lanes at all terminals at Changi Airport. Selected automated systems at the Woodlands and Tuas border checkpoints, through which travelers would enter neighboring country Malaysia, also were affected. Immigration systems at coastal checkpoints were the only ones that were not disrupted.

Passengers were advised to postpone non-essential travel and expect delays, as they would be redirected to manual lanes for immigration clearance. By 4pm the same day, automated immigration clearance at all checkpoints were back up and running. ICA said in a statement late-Thursday that preliminary investigations revealed a "technical glitch" had occurred during a pre-scheduled system upgrade, causing an "unanticipated system overload". This brought down the automated immigration clearance systems, which affected all departure terminals at Changi Airport and arrival terminals at Terminals 2 and 4. ICA did not provide details on the system upgrade or whether the procedure was tested before the scheduled live rollout.

Dumb phones may be falling out of fashion on a global scale, but it's a different story in the U.S. From a report: Companies like HMD Global, the maker of Nokia phones, continue to sell millions of mobile devices similar to those used in the early 2000s. This includes what's known as "feature phones" -- traditional flip or slide phones that have additional features like GPS or a hotspot. "I think you can see it with certain Gen Z populations -- they're tired of the screens," said Jose Briones, dumb phone influencer and moderator of the subreddit, "r/dumbphones." "They don't know what is going on with mental health and they're trying to make cutbacks."

In the U.S., feature flip phone sales were up in 2022 for HMD Global, with tens of thousands sold each month. At the same time, HMD's global feature phone sales were down, according to the company. In 2022, almost 80% of feature phone sales in 2022 came from the Middle East, Africa and India, according to Counterpoint Research. But some see that number shifting, as a contingency of young people in the U.S. revert back to dumb or minimalist phones. "In North America, the market for dumb phones is pretty much flatlined," said Moorhead. "But I could see it getting up to 5% increase in the next five years if nothing else, based on the public health concerns that are out there."