An anonymous reader quotes a report from ZDNet: In a report published earlier this month, security researchers from the Shadowserver Foundation, a non-profit organization focused on improving cyber-security practices across the world, have published a warning about companies that are leaving printers exposed online. More specifically, Shadowserver experts scanned all the four billion routable IPv4 addresses for printers that are exposing their IPP port. IPP stands for "Internet Printing Protocol" and, as the name suggests, is a protocol that allows users to manage internet-connected printers and send printing jobs to printers hosted online. The difference between IPP and the multiple other printer management protocols is that IPP is a secure protocol that supports advanced features such as access control lists, authentication, and encrypted communications. However, this doesn't mean that device owners are making use of any of these features.

Shadowserver experts said they specifically scanned the internet for IPP-capable printers that were left exposed without being protected by a firewall and allowed attackers to query for local details via the "Get-Printer-Attributes" function. In total, experts said they usually found an average of around 80,000 printers exposing themselves online via the IPP port on a daily basis. The number is about an eighth of all IPP-capable printers currently connected online. A normal scan with the BinaryEdge search engine reveals a daily count of between 650,000 and 700,000 devices with their IPP port (TCP/631) reachable via the internet. What are the issues with not securing the IPP port? Shadowserver experts say this port can be used for intelligence gathering, since many of the printers scanned returned additional info about themselves, such as printer names, locations, models, firmware, organization names, and even Wi-Fi network names.

"To configure IPP access control and IPP authentication features, users are advised to check their printers' manuals," adds ZDNet. "Most printers have an IPP configuration section in their administration panel from where users can enable authentication, encryption, and limit access to the device via access lists."

Starting today, customers of Microsoft's commercial antivirus product -- Defender Advanced Threat Protection (ATP) -- can install a first version of the product's Android port. From a report: The product, named "Microsoft Defender ATP for Android," was announced at the RSA security conference in February this year, and has reached a first public preview today. Companies that have contracted Microsoft Defender ATP protection have a new option in their dashboard where they can enable the feature and deploy an Android app to employees' devices.

This new Android app will work like a classic mobile antivirus product that can scan the phone for malicious apps and other malware, detect malicious and phishing sites while the user is browsing the web, and block users from accessing certain sites based on a predefined block-list. Microsoft says the Defender ATP for Android app also comes with hidden features, courtesy of its integration into the larger and more complex Defender ATP, Intune, and Configuration Manager platforms.

An anonymous reader quotes a report from Wired: When the Natural History Museum of Los Angeles County shut down due to the pandemic in mid-March, Lisa Gonzalez headed home with the expectation that she would be back in a few weeks. But once it became clear that she wouldn't get back anytime soon, Gonzalez, the museum's assistant entomology collection manager, converted her home's craft room into a makeshift lab. Then she began sifting through thousands of insects the museum had previously collected via a citizen science project. [...] Using just her own microscope, Gonzalez identified dozens of insect species by looking at features like tiny hairs or the shape of a fly's wings. She also found some unusual insects that she turned over to her colleague, Brian Brown, the museum's curator of entomology. Using a larger Leica stereoscope that he hauled in from the office, as well as a smaller compound microscope he found on craigslist, Brown discovered nine species of small flies, all new to science. "It's always cool to find new things, and it is one of the great joys of this job," says Brown. "It's not just finding slightly different new things -- we find extravagantly different things all the time."

The insects, mostly small flies, wasps, and wasplike flies, had been collected through the BioSCAN project, which began in 2012 with insect traps set at 30 sites throughout Los Angeles, mostly in backyards or public spaces. The pair recruited volunteers who were then trained in how to use the "Malaise traps," which resemble two-person pup tents that force bugs to fly upward into collecting nets before the volunteers can put them into vials. The BioSCAN project started when Brown bet a museum trustee that he could find a new species of insect in her backyard in West LA. He did, and the project took off. In its first three years, Brown and the backyard collector discovered 30 new species of insects and published their results. The museum team found an additional 13 new species in the past two years, plus he and the staff have discovered nine more since the pandemic shutdown. "The nine new species include phorid flies, some of which are known for their ability to run across surfaces and or enter coffins to consume dead bodies," the report adds. "Brown and Gonzalez have also found botflies, parasites of rats and wasplike flies that have never been seen before in Southern California. They likely arrived from Central America, perhaps hitching a ride on a flowering plant or piece of food."

"With the help of tens of thousands of insects collected through the BioSCAN project, over the years Brown and Gonzalez have expanded the count of known insect species in the Los Angeles basin from 3,500 during the last census in 1993 to around 20,000 today."

New submitter bmimatt shares a report from Krebs On Security: Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed "BlueLeaks" and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals. The collection -- nearly 270 gigabytes in total -- is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.

In a post on Twitter, DDoSecrets said the BlueLeaks archive indexes "ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources," and that "among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more." KrebsOnSecurity obtained an internal June 20 analysis by the National Fusion Center Association (NFCA), which confirmed the validity of the leaked data. The NFCA alert noted that the dates of the files in the leak actually span nearly 24 years -- from August 1996 through June 19, 2020 -- and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files. The NFCA said it appears the data published by BlueLeaks was taken after a security breach at Netsential, a Houston-based web development firm.

An anonymous reader quotes a report from Ars Technica: Hackers are abusing Google Analytics so that they can more covertly siphon stolen credit card data out of infected ecommerce sites, researchers reported on Monday. Payment card skimming used to refer solely to the practice of infecting point-of-sale machines in brick-and-mortar stores. The malware would extract credit card numbers and other data. Attackers would then use or sell the stolen information so it could be used in payment card fraud. One challenge in pulling off the hack is bypassing website security policies or concealing the exfiltration of massive amounts of sensitive data from endpoint security applications installed on the infected network. Researchers from Kaspersky Lab on Monday said that they have recently observed about two dozen infected sites that found a novel way to achieve this. Instead of sending it to attacker-controlled servers, the attackers send it to Google Analytics accounts they control. Since the Google service is so widely used, ecommerce site security policies generally fully trust it to receive data.

"Google Analytics is an extremely popular service (used on more than 29 million sites, according to BuiltWith) and is blindly trusted by users," Kaspersky Lab researcher Victoria Vlasova wrote here. "Administrators write *.google-analytics.com into the Content-Security-Policy header (used for listing resources from which third-party code can be downloaded), allowing the service to collect data. What's more, the attack can be implemented without downloading code from external sources." The researcher added: "To harvest data about visitors using Google Analytics, the site owner must configure the tracking parameters in their account on analytics.google.com, get the tracking ID (trackingId, a string like this: UA-XXXX-Y), and insert it into the web pages together with the tracking code (a special snippet of code). Several tracking codes can rub shoulders on one site, sending data about visitors to different Analytics accounts." The "UA-XXXX-Y" refers to the tracking ID that Google Analytics uses to tell one account from another. As demonstrated in the following screenshot, showing malicious code on an infected site, the IDs (underlined) can easily blend in with legitimate code.

Someone in control of an email address long associated with Encrochat, a company that sells custom encrypted phones often used by organized criminals, tells Motherboard the company is shutting down after a law enforcement hacking operation against its customers. From a report: The news comes as law enforcement agencies have arrested multiple criminal users of Encrochat across Europe in what appears to be a large scale, coordinated operation against the phone network and its users. "We have been forced to make the difficult decision to shut down our service and our business permanently," the person wrote in an email to Motherboard. "This [sic] following several attacks carried out by a foreign organization that seems to originate in the UK." The email address has been linked to Encrochat for years, but Motherboard could not confirm the identity of the person currently using the account. Motherboard also separately obtained screenshots of text messages sent over the past week of alleged Encrochat users discussing a wave of arrests associated with the Encrochat takeover. Encrochat is part of the encrypted phone industry, which sells devices pre-loaded with private messaging apps, sometimes have the GPS or camera functionality physically removed, and can be remotely wiped by the user.

A team of Dutch and German academics has studied the aftermath of a major crackdown against DDoS providers and concluded that law enforcement takedowns are largely ineffective, recommending that authorities rather focus on patching the vulnerable systems that are abused for the DDoS attacks in the first place. From a report: The study, published last year on paper-hosting service arXiv, analyzed how the DDoS-for-hire market was impacted after US and European law enforcement shut down 15 major DDoS-for-hire (aka DDoS booter, DDoS stresser) services in December 2018. The research team said it analyzed DDoS attack traffic observed at the level of three different major networks -- a tier-1 internet service provider, a tier-2 internet service provider, and a major IXP (internet exchange point). "The takedown immediately reduced the DDoS amplification traffic to reflectors," the research team said. "However, it did not have any significant effect on DDoS traffic hitting victims or on the number of attacks observed." By reflectors, the research team is referring to vulnerable servers abused during a DDoS attack.

A new feature in Windows 10 might allow Google to streamline Chrome, and we know it works because Microsoft is already using it. From a report: According to Microsoft, its recent update implemented a new memory management feature in Edge known as SegmentHeap. In the latest version of Windows, developers can opt into SegmentHeap to lower the RAM usage of a program. Microsoft says it already added support to the new Edge browser, and it has seen a 27 percent drop in the browser's memory footprint.

A sophisticated, state-sponsored cyber attack is targeting Australian government, business, education and political organisations [Editor's note: the link may be paywalled; alternative source], the prime minister has warned. From a report: Scott Morrison did not reveal the identity of the state actor that was responsible for the attacks, which he said had been launched over many months. But the scale and sophistication of the malicious activity prompted cyber-security experts to speculate that China was the most likely culprit. "Based on advice provided to me by our cyber experts, Australian organisations are currently being targeted by a sophisticated state-based cyber actor," Mr Morrison said on Friday. "This act is targeting Australian organisations across a range of sectors including all levels of government, industry, political organisations, education, health, essential service providers and operators of other critical infrastructure."

After Motherboard discovered multiple servers on Discord containing pirated porn, the chat platform removed them and banned the owners of each. From a report: "Discord prohibits the sale, dissemination, and promotion of cracked accounts," a spokesperson told Motherboard. "We ban users and shut down servers that are responsible for this behavior. In cases of copyrighted material, we respond promptly to DMCA takedown requests and take the appropriate action." The bans are permanent, and the owners can no longer access their accounts for any purpose. Former members of those servers can no longer access those servers, either.

During Motherboard's reporting, Google removed an OnlyFans scraping Chrome extension when approached for comment. Stolen content is a problem that has plagued the adult industry for as long as porn has existed on the internet. Several owners of premium platforms similar to OnlyFans urged the industry to do better in how it safeguards content, by protecting models from theft using more advanced fingerprinting, watermarking, copyright takedown support, and technology that could prevent scrapers from using these tools to begin with.

CAPTCHAs, those puzzles with muffled sounds or blurred or squiggly letters that websites use to filter out bots (often unsuccessfully), have been annoying end users for more than a decade. Now, the challenge-and-response tests are likely to vex targets in malware attacks. From a report: Microsoft recently spotted an attack group distributing a malicious Excel document on a site requiring users to complete a CAPTCHA, most likely in an attempt to thwart automated detection by good guys. The Excel file contains macros that, when enabled, install GraceWire, a trojan that steals sensitive information such as passwords. The attacks are the work of a group Microsoft calls Chimborazo, which company researchers have been tracking since at least January. Previously, Microsoft observed Chimborazo distributing the Excel file in attachments included in phishing messages and later spreading through embedded Web links. In recent weeks, the group has begun sending phishing emails that change things up again. In some cases, the phishes include links that lead to redirector sites (usually legitimate sites that have been compromised). In other cases, the emails have an HTML attachment that contains a malicious iframe tag.

Either way, clicking on the link or attachment leads to a site where targets download the malicious file, but only after completing the CAPTCHA (which is short for completely automated public Turing test to tell computers and humans apart). The purpose: to thwart automated analysis defenders use to detect and block attacks and get attack campaigns shut down. Typically the analysis is performed by what are essentially bots that download malware samples and run and analyze them in virtual machines. Requiring the successful completion of a CAPTCHA means analysis will only happen when a live human being downloads the sample. Without the automation, the chances of the malicious file flying under the radar are much better. Microsoft has dubbed Chimborazo's ongoing attack campaign Dudear.

An anonymous reader quotes a report from ZDNet: Amazon said its AWS Shield service mitigated the largest DDoS attack ever recorded, stopping a 2.3 Tbps attack in mid-February this year. The incident was disclosed in the company's AWS Shield Threat Landscape [PDF], a report detailing web attacks mitigated by Amazon's AWS Shield protection service. The report didn't identify the targeted AWS customer but said the attack was carried out using hijacked CLDAP web servers and caused three days of "elevated threat" for its AWS Shield staff. [...] The previous record for the largest DDoS attack ever recorded was of 1.7 Tbps, mitigated by NETSCOUT Arbor in March 2018. Before that, the biggest DDoS attack ever recorded was a 1.3 Tbps DDoS attack that hit GitHub, a month before, in February 2018.

Weeks after Zoom said it will offer end-to-end encryption to only paying customers -- a move that was received poorly by several privacy and security advocates, the popular video calling software said on Wednesday it is making some amendments: We are also pleased to share that we have identified a path forward that balances the legitimate right of all users to privacy and the safety of users on our platform. This will enable us to offer E2EE (end-to-end encryption) as an advanced add-on feature for all of our users around the globe -- free and paid -- while maintaining the ability to prevent and fight abuse on our platform. To make this possible, Free/Basic users seeking access to E2EE will participate in a one-time process that will prompt the user for additional pieces of information, such as verifying a phone number via a text message. Many leading companies perform similar steps on account creation to reduce the mass creation of abusive accounts. We are confident that by implementing risk-based authentication, in combination with our current mix of tools -- including our Report a User function -- we can continue to prevent and fight abuse.

Social media research group Graphika published today a 120-page report unmasking a new Russian information operation of which very little has been known so far. ZDNet reports: Codenamed Secondary Infektion, the group is different from the Internet Research Agency (IRA), the Sankt Petersburg company (troll farm) that has interfered in the US 2016 presidential election. Graphika says this new and separate group has been operating since 2014 and has been relying on fake news articles, fake leaks, and forged documents to generate political scandals in countries across Europe and North America. The research team says it first learned of the group from reports published by Reddit and Facebook last year, along with previous research done by the Atlantic Council's Digital Forensic Research Lab.

According to Graphika's analysis, most of the group's content has followed nine primary themes:

- Ukraine as a failed state or unreliable partner
- The United States and NATO as aggressive and interfering in other countries
- Europe as weak and divided
- Critics of the Russian government as morally corrupt, alcoholic, or otherwise mentally unstable
- Muslims as aggressive invaders
- The Russian government as the victim of Western hypocrisy or plots
- Western elections as rigged and candidates who criticized the Kremlin as unelectable
- Turkey as an aggressive and destabilizing state
- World sporting bodies and competitions as unfair, unprofessional, and Russophobic

Graphika says that most of this content has been aimed at attacking classic Russian political rivals like Ukraine, the US, Poland, and Germany, but also other countries where Russian influence came under attack, at one point or another. [...] Researchers said the group managed to keep its identity secret because they paid very close attention to operational security (OpSec). Graphika says Secondary Infektion agents employed single-use burner accounts for almost everything they posted online, abandoning each account in less than an hour after promoting their content. With its identity still a secret, the group is expected to continue operating and sowing conflict between Russia's rivals.

Lily Hay Newman writes via Wired: Security researchers Noam Rotem and Ran Locar were scanning the open internet on May 24 when they stumbled upon a collection of publicly accessible Amazon Web Services "buckets." Each contained a trove of data from a different specialized dating app, including 3somes, Cougary, Gay Daddy Bear, Xpal, BBW Dating, Casualx, SugarD, Herpes Dating, and GHunt. In all, the researchers found 845 gigabytes and close to 2.5 million records, likely representing data from hundreds of thousands of users. They are publishing their findings today with vpnMentor.

The information was particularly sensitive and included sexually explicit photos and audio recordings. The researchers also found screenshots of private chats from other platforms and receipts for payments, sent between users within the app as part of the relationships they were building. And though the exposed data included limited "personally identifying information," like real names, birthdays, or email addresses, the researchers warn that a motivated hacker could have used the photos and other miscellaneous information available to identify many users. The data may not have actually been breached, but the potential was there. "The researchers don't know whether anyone else discovered the exposed trove before they did," the report adds. "If you use one of the affected apps there's not a lot you can do to protect against the possibility that the data was stolen before the researchers found it. There wasn't a specific trove of passwords in the exposed data, so changing your password likely won't do much."

All you can really do is hope the developer locks down the cloud infrastructure before anyone grabs the information.

Cyber-security experts have revealed today 19 vulnerabilities in a small library designed in the 90s that has been widely used and integrated into countless of enterprise and consumer-grade products over the last 20+ years. From a report: Affected products include smart home devices, power grid equipment, healthcare systems, industrial gear, transportation systems, printers, routers, mobile/satellite communications equipment, data center devices, commercial aircraft devices, various enterprise solutions, and many others. Experts now fear that all products using this library will most likely remain unpatched due to complex or untracked software supply chains. Problems arise from the fact that the library was not only used by equipment vendors directly but also integrated into other software suites, which means that many companies aren't even aware that they're using this particular piece of code, and the name of the vulnerable library doesn't appear in their code manifests.

Mozilla, Electronic Frontier Foundation (EFF), and more than 19,000 internet users today urged Zoom CEO Eric Yuan to reverse his decision to deny end-to-end encryption to users of its free service end-to-end encryption, saying it puts activists and other marginalized groups at risk. Earlier this month, Zoom announced it will offer end-to-end encryption, but only to those who pay. From a statement: The pressure to reverse the decision comes as racial justice activists are using tools like Zoom to organize protests. Without end-to-end encryption, information shared in their online meetings could be intercepted -- a concern that has been legitimized by both recent actions by law enforcement and a long-term history of discriminatory policing. Mozilla and EFF today are presenting an open letter to Yuan, co-signed by 19,000 people, maintaining that privacy and best-in-class security should be the default, not something that only the wealthy or businesses can afford.

Postbank, the banking division of South Africa's Post Office, has lost more than $3.2 million from fraudulent transactions and will now have to replace more than 12 million cards for its customers after employees printed and then stole its master key. ZDNet reports: The Sunday Times of South Africa, the local news outlet that broke the story, said the incident took place in December 2018 when someone printed the bank's master key on a piece of paper at its old data center in the city of Pretoria. The bank suspects that employees are behind the breach, the news publication said, citing an internal security audit they obtained from a source in the bank.

The master key is a 36-digit code (encryption key) that allows its holder to decrypt the bank's operations and even access and modify banking systems. It is also used to generate keys for customer cards. The internal report said that between March and December 2019, the rogue employees used the master key to access accounts and make more than 25,000 fraudulent transactions, stealing more than $3.2 million (56 million rand) from customer balances. Following the discovery of the breach, Postbank will now have to replace all customer cards that have been generated with the master key, an operation the bank suspects it would cost it more than one billion rands (~$58 million). This includes replacing normal payment cards, but also cards for receiving government social benefits. Sunday Times said that roughly eight to ten million of the cards are for receiving social grants, and these were where most of the fraudulent operations had taken place.

An anonymous reader quotes a report from Ars Technica: Because of the lag between infection and the onset of symptoms, people can contract the SARS-CoV-2 virus and then pass it on, potentially to many others, before they know they're infected and have to isolate. So being able to identify and warn individuals who have been exposed to an infected person -- known as contact tracing -- is widely acknowledged to be a vital part of any effective strategy to beat COVID-19. Which is why it is extremely dismaying to see survey data that says fewer than 3 in 10 Americans intend to use contact-tracing apps to allow that to happen.

The data was gathered from an online survey of just over 2,000 people in the United States, collected on June 1 by polling company Opinion Matters on behalf of the security company Avira. When asked if they planned to download a contact-tracing app, an overwhelming majority -- 71 percent -- answered no. Not only is that bad, it appears to be a deterioration from earlier this year; in April, we covered a poll that found 1 in 2 Americans would probably or definitely not use a contact-tracing app. Most of the resistance to downloading a contact-tracing app came from people over the age of 55. US Centers for Disease Control and Prevention data show that people aged 55 and over account for almost 80 percent of US COVID-19 deaths to date. "The most common reason cited was a concern about privacy; in all, 44 percent of those who said 'no' to a contact-tracing app said they would not trust the technology to protect their digital privacy," the report adds. "But nearly as many (39 percent) also said they thought the apps created a false sense of security, and 37 percent said they believed the apps would not work to slow the spread of the pandemic. Thirty-five percent also indicated a lack of trust in the app providers."

The Basecamp cofounder and creator of web application framework Ruby on Rails David Heinemeier Hansson has become increasingly outspoken about Big Tech's privacy violations and monopolistic tendencies. Now he's inviting you to join the cause -- by switching your email provider. From a report: Two years ago, he and fellow Basecamp cofounder and CEO Jason Fried decided to do something about it. The culmination of that work is a paid, $99-per-year email service called Hey, which launches today. Along with protecting users from the types of invasive surveillance tactics that have become de rigueur online, Hey also contains some radical ideas about the way that modern correspondence should work. Silicon Valley will be watching the product closely: Consumers like to say they value their privacy, but are they finally willing to pay for it?

[...] Most people haven't tried a new email service since Gmail launched 16 years ago, if not earlier. A handful of startups have played around with email interfaces in the years since, trying to make the experience cleaner and mobile-friendly, but no one has touched concepts as foundational as the inbox itself. Hansson and Fried argue that now is the time to do just that. They have made several radical changes to the inbox, the most glaring of which is that you, the email recipient, have control over who is allowed to appear there. That means you screen all first-time senders. They've also separated out what they call the "The Feed" and the "Paper Trail," so that there are distinct places for emails like newsletters and shipping confirmation notices. Because The Feed requires opt-in confirmation, it's much more pleasant to browse than Gmail's cluttered Promotions tab. It's also more private: Hey strips incoming messages of the tracking tools known as spy pixels that have become common practice in many emails. (The service indicates any emails that originally had tracking capabilities by displaying a small binoculars icon next to them.)