Anker's popular Eufy-branded security cameras appear to be sending some data to the cloud, even when cloud storage is disabled and local only storage settings are turned on. MacRumors reports: The information comes from security consultant Paul Moore, who last week published a video outlining the issue. According to Moore, he purchased a Eufy Doorbell Dual, which was meant to be a device that stored video recording on device. He found that Eufy is uploading thumbnail images of faces and user information to its cloud service when cloud functionality is not enabled. Moore demonstrates the unauthorized cloud uploading by allowing his camera to capture his image and turning off the Eufy HomeBase. The website is still able to access the content through cloud integration, though he had not signed up for cloud service, and it remains accessible even when the footage is removed from the Eufy app. It's important to note that Eufy does not appear to be automatically uploading full streaming video to the cloud, but rather taking captures of the video as thumbnails.

The thumbnails are used in the Eufy app to activate streaming video from the Eufy base station, allowing Eufy users to watch their videos when away from home, as well as for sending rich notifications. The problem is the thumbnails are uploaded to the cloud automatically even when the cloud functionality is not active, and Eufy also seems to be using facial recognition on the uploads. Some users have taken issue with the unauthorized cloud uploads because Eufy advertises local-only service and has been popular among those who want a more private camera solution. "No Clouds or Costs," reads the Eufy website. Moore suggests that Eufy is also able to link facial recognition data collected from two separate cameras and two separate apps to users, all without camera owners being aware.

Moore received a response from Eufy in which Eufy confirmed that it is uploading event lists and thumbnails to AWS, but said the data is not able to "leak to the public" because the URL is restricted, time limited, and requires account login. There is also another issue that Moore has highlighted, suggesting Eufy camera streams can be watched live using an app like VLC, but little information on the exploit is available at this time. Moore said that unencrypted Eufy camera content can be accessed without authentication, which is alarming for Eufy users. There's a dedicated Reddit thread where other Eufy users are reporting the same thing happening.

Dropbox has announced plans to bring end-to-end encryption to its business users, and it's doing so through acquiring "key assets" from Germany-based cloud security company Boxcryptor. Terms of the deal were not disclosed. From a report: Dropbox is well-known for its cloud-based file back-up and sharing services, and while it does offer encryption for files moving between its servers and the destination, Dropbox itself has access to the keys and can technically view any content passing through. What Boxcryptor brings to the table is an extra layer of security via so-called "zero knowledge" encryption on the client side, giving the user full control over who is allowed to decrypt their data.

For many people, such as consumers storing family photos or music files, this level of privacy might not be a major priority. But for SMEs and enterprises, end-to-end encryption is a big deal as it ensures that no intermediary can access their confidential documents stored in the cloud -- it's encrypted before it even arrives. Moving forward, Dropbox said that it plans to bake Boxcryptor's features natively into Dropbox for business users.

Say goodbye to the airline call center -- at least at Frontier Airlines. From a report: The budget carrier has completed its transition to online, mobile and text support, which enables it to ensure that customers get "the information they need as expeditiously and efficiently as possible," spokeswoman Jennifer de la Cruz told CNBC in an e-mailed statement. Passengers who call the customer service number Frontier lists on its website now get the message: "At Frontier, we offer the lowest fares in the industry by operating our airline as efficiently as possible. We want our customers to be able to operate efficiently as well, which is why we make it easy to find what you need at Flyfrontier.com or on our mobile app." Those who want to text with the carrier can get a link to do so sent to their phone. Most major carriers still offer customer service lines. But Frontier, which charges fees for everything from advanced seat assignments to carry-on luggage and snacks, is often looking for ways to cut expenses. During its investor day earlier this month, Frontier hinted that it would stop offering customer service by phone, a change that travel site Travel Noire reported earlier this week. Further reading: US Fines Airlines More Than $7 Million for Not Providing Refunds.

ZDNet asks: why is everyone getting remote working wrong?

Researchers at tech analyst Gartner believe a rigid requirement to return to offices is a mistake. But the researchers also believe so-called "hybrid" schedules often are also flawed: "Most of those work models delivered below-average outcomes," the research found, and the common factor was some kind of rigid on-site requirement. Much more successful was a "hybrid-flexible" set-up offering leaders and employees the opportunity to choose where they work from. But most successful by far were workplaces that offered this flexibility and also included elements of "intentional collaboration and empathy-based management", where bosses don't force staff to come to the office just to keep an eye on them.

How the working week is organized matters: get it right, and staff are more likely to want to stay, and more likely to perform well. Autonomy also reduces fatigue, which in turn means workers are likely to sustain good performance over time.
ZDNet also tested virtual reality meetings — concluding they're "still undeniably somewhat clunky and can make you feel a bit awkward."

But at the same time, "I was also surprised by how much benefit they could potentially deliver." Sure, a meeting with avatars that only look a bit like your colleagues, in a fantasy meeting room that wouldn't look out of place in a Bond villain's lair does feel a bit ridiculous. But it also — and this was the revelation to me — adds a level of engagement that you just don't get from a video meeting of colleagues occupying flat tiles on a screen. It provides a sense of being there (wherever 'there' was) that adds meaning beyond what you get from staring into a monitor.

I'm not saying I want to have every meeting in VR from now on: far from it. But we have to see the present state of hybrid and remote working as just the current state of the art, and to keep experimenting, and thinking, about the way we work.

Brace for yet another expansion to the UK's Online Safety Bill: The Ministry of Justice has announced changes to the law which are aimed at protecting victims of revenge porn, pornographic deepfakes and other abuses related to the taking and sharing of intimate imagery without consent -- in a crackdown on a type of abuse that disproportionately affects women and girls. From a report: The government says the latest amendment to the Bill will broaden the scope of current intimate image offences -- "so that more perpetrators will face prosecution and potentially time in jail."

Other abusive behaviors that will become explicitly illegal include "downblousing" (where photographs are taken down a women's top without consent); and the installation of equipment, such as hidden cameras, to take or record images of someone without their consent. The government describes the planned changes as a comprehensive package of measure to modernize laws in this area.

Google has disclosed several security flaws for phones that have Mali GPUs, such as those with Exynos chipsets. From a report: The company's Project Zero team says it flagged the problems to ARM (which produces the GPUs) back in the summer. ARM resolved the issues on its end in July and August. However, smartphone manufacturers including Samsung, Xiaomi, Oppo and Google itself hadn't deployed patches to fix the vulnerabilities as of earlier this week, Project Zero said.

Researchers identified five new issues in June and July and promptly flagged them to ARM. "One of these issues led to kernel memory corruption, one led to physical memory addresses being disclosed to userspace and the remaining three led to a physical page use-after-free condition," Project Zero's Ian Beer wrote in a blog post. "These would enable an attacker to continue to read and write physical pages after they had been returned to the system." Beer noted that it would be possible for a hacker to gain full access to a system as they'd be able to bypass the permissions model on Android and gain "broad access" to a user's data. The attacker could do so by forcing the kernel to reuse the afore-mentioned physical pages as page tables.

An international police operation has dismantled an online spoofing service that allowed cybercriminals to impersonate trusted corporations to steal more than $120 million from victims. From a report: iSpoof, which now displays a message stating that it has been seized by the FBI and the U.S. Secret Service, offered "spoofing" services that enabled paying users to mask their phone numbers with one belonging to a trusted organization, such as banks and tax offices, to carry out social engineering attacks. "The services of the website allowed those who sign up and pay for the service to anonymously make spoofed calls, send recorded messages, and intercept one-time passwords," Europol said in a statement on Thursday. "The users were able to impersonate an infinite number of entities for financial gain and substantial losses to victims."

London's Metropolitan Police, which began investigating iSpoof in June 2021 along with international law enforcement agencies, in the U.S., the Netherlands, and Ukraine, said it had arrested the website's suspected administrator, named as Teejai Fletcher, 34, charged with fraud and offenses related to organized crime. Fletcher was remanded to custody and will appear at Southwark Crown Court in London on December 6. iSpoof had around 59,000 users, which caused $58.2 million of losses to 200,000 identified victims in the U.K., according to the Met Police. One victim was scammed out of $3.64 million, while the average amount stolen was $12,100.

An anonymous reader quotes a report from TechCrunch: Microsoft has warned that malicious hackers are exploiting a discontinued web server found in common Internet of Things (IoT) devices to target organizations in the energy sector. In an analysis published on Tuesday, Microsoft researchers said they had discovered a vulnerable open-source component in the Boa web server, which is still widely used in a range of routers and security cameras, as well as popular software development kits (SDKs), despite the software's retirement in 2005. The technology giant identified the component while investigating a suspected Indian electric grid intrusion first detailed by Recorded Future in April, where Chinese state-sponsored attackers used IoT devices to gain a foothold on operational technology (OT) networks, used to monitor and control physical industrial systems.

Microsoft said it has identified one million internet-exposed Boa server components globally over the span of a one-week period, warning that the vulnerable component poses a "supply chain risk that may affect millions of organizations and devices." The company added that it continues to see attackers attempting to exploit Boa flaws, which include a high-severity information disclosure bug (CVE-2021-33558) and another arbitrary file access flaw (CVE-2017-9833). "The known [vulnerabilities] impacting such components can allow an attacker to collect information about network assets before initiating attacks, and to gain access to a network undetected by obtaining valid credentials," Microsoft said, adding that this can allow the attackers to have a "much greater impact" once the attack is initiated. "The company has warned that mitigating these Boa flaws is difficult due to both the continued popularity of the now-defunct web server and the complex nature of how it is built into the IoT device supply chain," reports TechCrunch. "Microsoft recommends that organizations and network operators patch vulnerable devices where possible, identify devices with vulnerable components, and to configure detection rules to identify malicious activity."

Mark Hachman, writing for PCWorld: Windows 8 stunk. It might have helped cost chief executive Steve Ballmer his job. Windows 8.1 was a bit better -- but if you love it, you have only a month or so left to enjoy it. Microsoft will kill off Windows 8.1 support on January 10, 2023. There's no out: Microsoft will not be offering an extended support package for Windows 8.1. At that point, you'll have a choice: buy a new Windows PC, or officially pay to upgrade to either Windows 10 or Windows 11. What does the end of support mean? Until January 10, Microsoft will offer security patches and other fixes for any security issues that crop up. Afterwards, you're on your own. If any exploit or malware surfaces, you'll have to depend on any antivirus software you have running -- Microsoft won't be issuing any more patches after Jan. 10, and your PC will absolutely be at risk.

An anonymous reader shares a report: A little more than a year ago, Amazon, specifically Amazon Web Services, flashed its stacks of cash as it announced it was buying up the end-to-end encrypted messaging app Wickr. AWS users could suddenly use Wickr's services, and some reporters speculated Amazon could have been trying to make a move in the increasingly crowded encrypted messaging space. That's much more unlikely now as Amazon announced Monday it was nixing its secure messaging app Wickr Me.

The tech giant said that Wickr would instead be focused on business and public sector communications, specifically through AWS Wickr and Wickr Enterprise. The company will no longer allow registrations for Wickr Me after Dec. 31, and a year later, at the tail end of 2023, the app will be but a puff of smoke and a memory. Wickr was worth in the ballpark of $60 million when it was purchased, but just a few years ago Wickr was spouting off about its features that encrypted conference calls, which was a major evolution in the encrypted messaging space. Amazon's other messaging app, Chime, does videoconferencing without encryption. In September, Amazon finally added end-to-end encryption for the data sent to users through its Ring doorbells.

Through 2020 America's professional lives "had taken on the overtones of a secular religion," argues a writer in the Washington Post, with jobs forming "a primary way to find meaning in the world and a crucial part of our identity.... Even precarious, low-paying gigs were valorized as 'hustle culture,' representing freedom to perform labor on our terms."

But then... Fast-forward to fall 2022. The number of people quitting, while down from the peak, remains at the highest level since the 1970s. White-collar workers don't want to give up working remotely. Low-paying sectors such as the hospitality industry can't find enough people willing to work for the wages on offer. Union organizing and strikes have been on an upswing.... [W]hat's increasingly clear is that the March 2020 decision to partially close down the American economy shattered Americans' dysfunctional, profoundly unequal relationship with work like nothing in decades. And even if there was great discomfort in a shutdown that severed almost every one of us from assumptions about how we earn a living, we also found an unexpected opportunity: to remake our relationship with the labor that fills our days....

All of it — the lockdowns, the disease, the sudden change in household functioning and how or whether we worked at all — amounted to a massive psychological shock, leading many to ask why labor looms so large in our psyches. "It really was an opportunity — an unwelcome opportunity — to take a look at the mad scramble that many of us have just assumed was normal," said Kate Shindle, who as president of the Actors' Equity Association represents a particularly hard-hit industry. Then, when the economy unexpectedly boomed back, Americans were poised to pivot. As many had recognized, it was one thing to seek meaning in work but another to see our lives subsumed by it — and for what? A less-than-adequate paycheck? A job that could literally kill you? "Maybe the poor safety net really kept people from analyzing the role of work in their lives," David Blustein, author of "The Importance of Work in an Age of Uncertainty" and a professor at Boston College's Lynch School of Education and Human Development, told me. "Maybe the American work ethic was a form of survival...."

Over and over, when people spoke to journalists, including me, about why they made changes in their professional lives since March 2020, they told us they liked receiving better wages when they switched employers. But even more, they wanted greater control over the terms of their labor.... An increased level of remote work, likely in a hybrid format, is almost certainly here to stay, says Nick Bloom, a professor of economics at Stanford University, who has studied the topic for decades. Employees want it, technological advances continue to make it easier, and companies that forbid it completely are likely to find themselves at a disadvantage....

The past two and a half years brought immense upheaval, and we'll be struggling to process the resulting changes for years. But it's undeniable that some of these shifts were long overdue. Workers are highly unlikely to forget what we learned: namely, that our jobs are much more flexible than we thought.

"Get ready: Neurotechnology is coming to the workplace," claims IEEE Spectrum: Neural sensors are now reliable and affordable enough to support commercial pilot projects that extract productivity-enhancing data from workers' brains.

These projects aren't confined to specialized workplaces; they're also happening in offices, factories, farms, and airports. The companies and people behind these neurotech devices are certain that they will improve our lives. But there are serious questions about whether work should be organized around certain functions of the brain, rather than the person as a whole.

To be clear, the kind of neurotech that's currently available is nowhere close to reading minds. Sensors detect electrical activity across different areas of the brain, and the patterns in that activity can be broadly correlated with different feelings or physiological responses, such as stress, focus, or a reaction to external stimuli. These data can be exploited to make workers more efficient — and, proponents of the technology say, to make them happier. Two of the most interesting innovators in this field are the Israel-based startup InnerEye, which aims to give workers superhuman abilities, and Emotiv, a Silicon Valley neurotech company that's bringing a brain-tracking wearable to office workers, including those working remotely....

EEG has recently broken out of clinics and labs and has entered the consumer marketplace. This move has been driven by a new class of "dry" electrodes that can operate without conductive gel, a substantial reduction in the number of electrodes necessary to collect useful data, and advances in artificial intelligence that make it far easier to interpret the data. Some EEG headsets are even available directly to consumers for a few hundred dollars.

Microsoft says token theft attacks are on the rise. From a report: Microsoft has outlined several mitigations to protect against attacks on multi-factor authentication that will unfortunately make life more difficult for your remote workers. Three years ago, attacks on multi-factor authentication (MFA) were so rare that Microsoft didn't have decent statistics on them, largely because few organisations had enabled MFA. But with MFA use rising as attacks on passwords become more common, Microsoft has seen an increase in attackers using token theft in their attempts to sidestep MFA.

In these attacks, the attacker compromises a token issued to someone who's already completed MFA and replays that token to gain access from a different device. Tokens are central to OAuth 2.0 identity platforms, including Azure Active Directory (AD), which aim to make authentication simpler and faster for users, but in a way that's still resilient to password attacks. Moreover, Microsoft warns that token theft is dangerous because it doesn't require high technical skills, detection is difficult and, because the technique has only recently seen an uptick, few organisations have mitigations in place. "Recently, the Microsoft Detection and Response Team (DART) has seen an increase in attackers utilizing token theft for this purpose," Microsoft says in a blogpost. "By compromising and replaying a token issued to an identity that has already completed multifactor authentication, the threat actor satisfies the validation of MFA and access is granted to organizational resources accordingly. This poses to be a concerning tactic for defenders because the expertise needed to compromise a token is very low, is hard to detect, and few organizations have token theft mitigations in their incident response plan."

Brian Krebs writes via KrebsOnSecurity: Peter is an IT manager for a technology manufacturer that got hit with a Russian ransomware strain called "Zeppelin" in May 2020. He'd been on the job less than six months, and because of the way his predecessor architected things, the company's data backups also were encrypted by Zeppelin. After two weeks of stalling their extortionists, Peter's bosses were ready to capitulate and pay the ransom demand. Then came the unlikely call from an FBI agent. "Don't pay," the agent said. "We've found someone who can crack the encryption." Peter, who spoke candidly about the attack on condition of anonymity, said the FBI told him to contact a cybersecurity consulting firm in New Jersey called Unit 221B, and specifically its founder -- Lance James. Zeppelin sprang onto the crimeware scene in December 2019, but it wasn't long before James discovered multiple vulnerabilities in the malware's encryption routines that allowed him to brute-force the decryption keys in a matter of hours, using nearly 100 cloud computer servers.

In an interview with KrebsOnSecurity, James said Unit 221B was wary of advertising its ability to crack Zeppelin ransomware keys because it didn't want to tip its hand to Zeppelin's creators, who were likely to modify their file encryption approach if they detected it was somehow being bypassed. This is not an idle concern. There are multiple examples of ransomware groups doing just that after security researchers crowed about finding vulnerabilities in their ransomware code. "The minute you announce you've got a decryptor for some ransomware, they change up the code," James said. But he said the Zeppelin group appears to have stopped spreading their ransomware code gradually over the past year, possibly because Unit 221B's referrals from the FBI let them quietly help nearly two dozen victim organizations recover without paying their extortionists. [...]

The researchers said their break came when they understood that while Zeppelin used three different types of encryption keys to encrypt files, they could undo the whole scheme by factoring or computing just one of them: An ephemeral RSA-512 public key that is randomly generated on each machine it infects. "If we can recover the RSA-512 Public Key from the registry, we can crack it and get the 256-bit AES Key that encrypts the files!" [James and co-author Joel Lathrop wrote in a blog post]. "The challenge was that they delete the [public key] once the files are fully encrypted. Memory analysis gave us about a 5-minute window after files were encrypted to retrieve this public key." Unit 221B ultimately built a "Live CD" version of Linux that victims could run on infected systems to extract that RSA-512 key. From there, they would load the keys into a cluster of 800 CPUs donated by hosting giant Digital Ocean that would then start cracking them. The company also used that same donated infrastructure to help victims decrypt their data using the recovered keys. A more technical writeup on Unit 221B's discoveries (cheekily titled "0XDEAD ZEPPELIN") is available here.

joshuark writes: Yikes, gadzooks, and shiver my timbers! Elastic Labs has found surprisingly that 50% of malware comes from one app: MacKeeper, ironically. Ironic in that MacKeeper claims to "keep your Mac clean and safe with zero effort." MacKeeper also has a tainted reputation for being difficult to completely uninstall and as a malicious antivirus.

A new spin on the biblical phrase, "Am I my brother's keeper..." Well, when the inmate is running the asylum. The findings appear in Elastic Security Labs' recently released 2022 Global Threat Report. As Neowin reports, MacKeeper "can be abused by threat actors because it has extensive permissions and access to processes and files."

With that said, the report found that only 6.2% of malware ends up on macOS devices, compared to 54.4% and 39.4% on Windows and Linux, respectively.

1Password has announced that passkey support will be available to its customers in "early 2023," allowing users to securely log in to apps and websites without a password. The Verge reports: Passkeys are a passwordless login technology developed by the FIDO Alliance, whose members include most of the Big Tech companies. The tech allows users to replace traditional passwords with their device's own authentication -- such as an iPhone with Face ID -- offering greater security and protection since there's no password to steal or accidentally hand over via a phishing attack.

1Password claims its own variation, called Universal Sign On, will be superior to others by supporting multiple platforms and cross-platform syncing when it launches next year. By contrast, passkey support through companies like Apple is only built to seamlessly synchronize access on devices within the same ecosystem. A live demonstration of how passkeys will work is available for 1Password users using the latest version of its Chrome browser extension, alongside a video demo for those not using the service and a directory listing which websites, apps, and services are using passkeys for authentication. 1Password will bring full support for passkeys to its browser extension and desktop apps in early 2023, with mobile support to follow.

A frustrated owner of an RTX 4090 graphics card, suffering from the infamous melty power connector problem, has filed a class action suit against Nvidia. From a report: Filed in a California court on November 11th, the suit may make for painful reading for Nvidia and includes numerous allegations from fraud to unjust enrichment. The case refers to widely reported instances of the new-style 16-pin power connector used by Nvidia's GeForce RTX 4090 boards overheating and melting under heavy load. Reportedly, the lawsuit claims that Nvidia sold RTX 4090s with, "defective and dangerous power cable plug and socket(s), which has rendered consumers' cards inoperable and poses a serious electrical and fire hazard for each and every purchaser." It's notable that the claimant, one Lucas Genova, describes himself as "experienced in the installation of computer componentry like graphics cards," thereby aiming to head off any implication of user error at the pass.

India will be adopting USB-C type as a common charging port for smart devices, with stakeholders reaching a consensus at a meeting of an inter-ministerial task force, consumer affairs secretary Rohit Kumar Singh said on Wednesday. From a report: The government held wide-ranging consultations to standardize charging ports for all compatible smart devices, but it is yet to reach a decision on chargers for low-cost feature phones. With universal chargers consumers will no longer need a different charger every time they purchase a new device. Besides, the move will also reduce massive amounts of e-waste. In 2021, India is estimated to have generated 5 million tonnes of e-waste , only behind China and the US, according to an ASSOCHAM-EY report, Electronic Waste Management in India.

Microsoft has fixed yet another problem in some versions of Windows 10, a bug that makes the taskbar and desktop temporarily vanish or causes the system to ignore you. From a report: According to Redmond, users "might experience an error in which the desktop or taskbar might momentarily disappear, or your device might become unresponsive." The issue affects PCs running Windows 10 versions 22H2, 21H2, 21H1, and 20H2, the company wrote on its Windows Health Dashboard. Microsoft didn't outline the exact cause but notes it was related to the KB5016688 220820_03051 cumulative update and later.

The software giant is using its Known Issue Rollback (KIR) feature -- which enables IT administrators to roll back the unwanted changes of an update -- to resolve the problem, adding that it could take up to 24 hours for the fix to reach non-managed business systems and consumer devices. Restarting the device may accelerate the timeframe. Organizations that use enterprise-managed devices can install and configure a special Group Policy by going to "Computer Configuration" and then "Administrative Templates" and "Group Policy name." If the resolution doesn't work, users can try restarting the Windows device, according to Microsoft. The latest fix comes after a number of other problems were resolved this week.

Microsoft has released SQL Server 2022, the latest version of its database software, which originally launched more than 33 years ago. From a report: Microsoft describes this release as the "most Azure-enabled release of SQL Server yet" and with connections to Azure Synapse Link for enabling real-time analytics over the database, Azure Purview for data governance and disaster recovery with the help of Azure SQL Managed Instance, this release is, in many ways, the culmination of the cloud-connection groundwork the team started quite a few years ago. "From the very beginning, the vision [for SQL Server] really was about -- databases were very complex -- how do you make that extremely simple? And in many ways, I think that has been a key reason why it lasted for so long and how we've evolved it as well," Rohan Kumar, Microsoft's corporate VP for Azure Data, told me. "One of the big things that I think about with SQL Server 2022 is that we've made it completely cloud-connected to Azure."

He noted that while the migration of on-prem workloads is happening, Microsoft's customers are all moving at very different speeds and some, for a multitude of reasons, may never move to the cloud at all. That, he argues, is why the company always bet on a hybrid approach, but it is also why a lot of customers started asking about how they could get the value of being in the cloud without actually having to move all of their data to it. "That was really the key thesis of why we invested in making this into a cloud release," Kumar said. A good example here is the new disaster recovery function that allows users to replicate their data in SQL Managed Instance on Azure and use that as a backup for their main on-premises SQL Server, which should make it easy to fail over to that when the main server goes down.