Mozilla has switched on Firefox's tracking protection feature for everyone on Windows and Android, dialing up its effort to protect privacy from website publishers and advertisers that would like to keep tabs on your online behavior. From a report: Mozilla enabled tracking protection for new Firefox users in June, but now it's on for everyone, the nonprofit said Tuesday. Tracking protection is all the rage among browser makers, including Apple's Safari, Brave Software's Brave and Microsoft's new Chromium-based Edge. Even Google's Chrome, long the laggard among major browsers, is starting to tackle the problem. It's a thorny issue for websites and advertisers that seek to improve advertising revenue by targeting ads based on their assessment of your interests. "Currently over 20% of Firefox users have Enhanced Tracking Protection on. With today's release, we expect to provide protection for 100% of ours users by default," Mozilla said in a blog post Tuesday.

Mozilla teased today an upcoming update for Firefox on macOS that it says will reduce power consumption by a factor of up to three. From a report: The primary beneficiaries of this upcoming update are Macbook users, who can now expect longer battery lives while using Firefox. Firefox's increased battery consumption has been a problem for Mozilla, and a black stain on the Firefox Quantum release -- a revamped, performance-centric version of the older Firefox browser. While Firefox Quantum has received praises for its increased page loading speeds, Macbook users haven't been that delighted, especially when they're mobile and have to rely on the notebook's battery as long as possible.

For years, an enduring mystery has surrounded the Stuxnet virus attack that targeted Iran's nuclear program: How did the U.S. and Israel get their malware onto computer systems at the highly secured uranium-enrichment plant? From a report: The first-of-its-kind virus, designed to sabotage Iran's nuclear program, effectively launched the era of digital warfare and was unleashed some time in 2007, after Iran began installing its first batch of centrifuges at a controversial enrichment plant near the village of Natanz. The courier behind that intrusion, whose existence and role has not been previously reported, was an inside mole recruited by Dutch intelligence agents at the behest of the CIA and the Israeli intelligence agency, the Mossad, according to sources who spoke with Yahoo News.

An Iranian engineer recruited by the Dutch intelligence agency AIVD provided critical data that helped the U.S. developers target their code to the systems at Natanz, according to four intelligence sources. That mole then provided much-needed inside access when it came time to slip Stuxnet onto those systems using a USB flash drive. The Dutch were asked in 2004 to help the CIA and Mossad get access to the plant, but it wasn't until three years later that the mole, who posed as a mechanic working for a front company doing work at Natanz, delivered the digital weapon to the targeted systems. "[T]he Dutch mole was the most important way of getting the virus into Natanz," one of the sources told Yahoo.

thegarbz writes: It seems not a day goes by without yet another story reflecting poorly on major browsers. Not uncommon are stories that are mixed with a degree of bloat, either discussing rarely used features or directly criticizing memory consumption of major browsers. Unfortunately memory consumption is quite often the result of complete feature implementation of technologies used on the web, including DRM for streaming services and WebRTC. Other times it's the result of security measures, feature creep, or poor coding.

So in 2019 for those of us with slower tablets, what browser do you use as an alternative to the big two? How well does it work with the modern HTML5 internet? Are websites frequently broken does the simplicity of other browsers largely go unnoticed?

In a rare feat, French police have hijacked and neutralized a massive cryptocurrency mining botnet controlling close to a million infected computers. From a report: The notorious Retadup malware infects computers and starts mining cryptocurrency by sapping power from a computer's processor. Although the malware was used to generate money, the malware operators easily could have run other malicious code, like spyware or ransomware. The malware also has wormable properties, allowing it to spread from computer to computer. Since its first appearance, the cryptocurrency mining malware has spread across the world, including the U.S., Russia, and Central and South America. According to a blog post announcing the bust, security firm Avast confirmed the operation was successful. The security firm got involved after it discovered a design flaw in the malware's command and control server. That flaw, if properly exploited, would have "allowed us to remove the malware from its victims' computers" without pushing any code to victims' computers, the researchers said.

"The UK government is requiring all major UK airports to introduce 3D baggage screening equipment before the end of 2022," writes Slashdot reader Hammeh.

The BBC reports: Ministers say the technology will boost security, speed up pre-boarding checks, and could end the restrictions on travelling with liquids and laptops. The equipment, similar to CT scanners used in hospitals, is already being installed at London's Heathrow Airport. It provides a clearer picture of a bag's contents, which staff can zoom in to and rotate for inspection.

Currently, passengers taking liquid in their cabin baggage are restricted to containers holding no more than 100ml, which must be shown to security staff in a single, transparent, resealable plastic bag of about 20cm (8in) x 20cm. The limits have been in place since November 2006. Their introduction ended a ban on liquids in the cabin imposed three months earlier, when British police said they had foiled a plot to blow up as many as 10 planes using explosives hidden in drinks bottles...

The technology is already being used by US airports, including Atlanta's Hartsfield-Jackson and Chicago's O'Hare.

"The unprecedented attack on Apple iPhones revealed by Google this week was broader than first thought," reports Forbes: Multiple sources with knowledge of the situation said that Google's own Android operating system and Microsoft Windows PCs were also targeted in a campaign that sought to infect the computers and smartphones of the Uighur ethnic group in China. That community has long been targeted by the Chinese government, in particular in the Xinjiang region, where surveillance is pervasive.

Google's and Microsoft's operating systems were targeted via the same websites that launched the iPhone hacks, according to the sources, who spoke on the condition of anonymity. That Android and Windows were targeted is a sign that the hacks were part of a broad, two-year effort that went beyond Apple phones and infected many more than first suspected. One source suggested that the attacks were updated over time for different operating systems as the tech usage of the Uighur community changed...

The attacks appear to form part of a mass surveillance operation taking place on Uighur civilians, who've faced various forms of persecution in Xinjiang. Surveillance cameras are scattered across the region and facial recognition is prevalent.

"Businesses are waking up to the skills gamers can bring to the workplace," argues the BBC, adding that "Even the military is hiring gamers." "The ability to assimilate information, react swiftly and co-ordinate actions whilst remaining calm under pressure are often attributes of people that are good at gaming," a Royal Air Force spokesperson tells the BBC. Those skills are part of what the RAF is looking for "in a variety of roles. Skills acquired through gaming can be very relevant to certain areas."

"There are plenty of soft skills that gamers can utilise in a professional setting, such as teamwork, problem solving and strategic planning," says Ryan Gardner, a regional director with Hays recruitment.
They also interview the man who told Kotaku that "If you're playing EVE Online you basically already have an MBA." Matthew Ricci tells the BBC he stands by the sentiment -- and Eve players might understand why. Often made fun of in gaming circles as a "spreadsheet simulator", the economy of the fictional Eve universe is driven by real market principles. If you want to build a new spaceship, the raw material has to be mined by another player. Manufacturing costs come into effect, and commodities fluctuate in price based on demand and haulage distance.

Mr Ricci, who had always dreamed of being the boss of his own company, ran an in-game corporation comprising hundreds of players. Eventually, he realised he could transfer his skills to real-life business -- instead of doing it for free. He restructured Zentech, once a taxation vehicle for his father's business, and it is now in its fourth year helping international brands enter the Canadian market... He credits his success to his family, his obsession with running his own business -- and "a damn good company in Iceland that made a damn good game".
The BBC also spoke to a radiotherapy physicist who says old-school games like Palace of Magic, on his father's Acorn Electron [released in 1983] not only exposed him to computers, but encouraged a competitive streak which he believes translates to his work today. "When creating treatment plans, the aim is to optimise the radiation dose to the tumour and restrict it as much as possible to healthy surrounding tissue and organs... Most videogames are essentially puzzles to solve," he says. "And problem-solving is a big part of my job."

Last week Forbes ran an article by writer/data scientist Kurt Cagle arguing that Agile software development "was becoming less and less relevant." Within five days it had racked up 300,000 hits, and "I'm still digging out from the deluge of email, Tweets and Linked In messages," he wrote this week.

But in a new follow-up, Cagle looks back over his 40 years of programming, remembering successful six-month development cycles in the 1990s that used "a home-grown methodology which I've since dubbed the Studio Model, because it reflected the way that you create movies, television programs, orchestrated concerts, video games, and to be honest, most intellectual property." He then attempts a 12-point manifesto for this Agile alternative, which emphasizes things like a clear vision, good design, redundancy, flexibility, and remembering that as a project moves forward changes become "exponentially expensive". All too often, proponents of certain methodologies want to claim that their methodologies are the reason for success, when in reality, the deciding factor was the skill and tenaciousness of the people involved, the presence of a clearly articulated vision that could be changed as needed but that was not written in jello, and on recognizing the distinction between providing flexibility and fueling failures.

Agile is not, by itself, a methodology. The Agile Manifesto is a wish-list, written primarily by programmers, in response to the incessant micro-management by non-technical managers who were in general too incompetent to learn about the technology that they managed. I cheered when I first read it... Agile legitimized the idea that all stakeholders must be involved in the process of shaping the product's constraints and parameters (something that even now is still more preached than practiced). It gave a voice to developers and (some) others in the production process who up until then often had little say, and its message to managers in particular about the need to trust in the competence of the people they manage is one that cannot be stressed loudly enough. Its emphasis on change management has spurred a lot of thought about the nature of change, experimentation and development costs in the field. And for all that I think that certain Agile tools are a bit on the cheesy size, the idea of formalizing the process of development in such a way as to give creatives both the opportunities and the tools to shape and push back on design decisions is invaluable.

Yet, there are two key sets of problems that the Agile community faces. The first, and foremost, is that it decentralizes responsibility too much -- it essentially punts on the whole issue of governance or editorial guidance. This is that whole vision thing all over again... Agile empowers autonomous teams, but those teams still need to be able to pull together towards a common set of goals, and this means sacrificing some autonomy for cohesiveness. Agile also does not (ironically) distribute very well for precisely that same reason...

Agile may be everywhere, as several readers suggested, but scratch the surface a bit and you'll find that most of those successful agile projects were ones where you had a strong architect or steward, a culture that was already primed to work in a more Studio-Model like manner, a strong design in the first place as a foundation, and exceptional team-members that used agile in the way it should be used -- as a scaffold, rather than a crutch. There are good things to take out of the last twenty years of Agile, but this is not 2000, and it's well past time to acknowledge what's worked with Agile ... and what hasn't.

Long-time Slashdot reader theodp writes: For nearly 20 years," writes WIRED's Alex Davies in How Anthony Levandowski Put Himself at the Center of an Industry, "the French-American Levandowski has played a kind of purposeful Forrest Gump for the world of autonomous driving. Rather than stumbling into the center of one momentous event after another, Levandowski has put himself there. And he has left a mixed trail in his wake: Former colleagues have described him as brilliant, engaging, motivating, fast-charging, inconsiderate, a weasel, and just plain evil. None, though, deny that whether for good or ill, the benefit of society or himself, Levandowski has played a propulsive role in the development of self-driving tech."

But that's of little comfort to Levandowski, who was charged by the Feds earlier this week with stealing driverless-vehicle technology from Alphabet Inc.'s Waymo unit, prompting the New Yorker's Charles Duhigg to explain How the Anthony Levandowski Indictment Helps Big Tech Stifle Innovation in Silicon Valley. The Economic Espionage Act of 1996, Duhigg notes, "was mostly intended to be used against overseas saboteurs, but it has largely been directed at American citizens -- and, in effect, has made federal prosecutors into heavies operating on behalf of disgruntled tech firms."

The definition of a 'trade secret' in the statute, Duhigg adds, is so broad that it could very well mean anything. Daniel Olmos, an attorney who has represented individuals accused of stealing trade secrets, once told Duhigg, "I get calls all the time from scared engineers, who once put some work stuff on their home computer so they could work on it after dinner, and now they're worried if they try to jump to another firm they're gonna get sued. And you know what? They're right to be worried.

An anonymous reader quotes a report from ZDNet: Foxit Software, the company behind the Foxit PDF reader app, said today that hackers breached its servers and have made off with some user information. ZDNet learned of the breach from a Foxit customer who shared a copy of the email the company is sending out to affected users, asking them to choose new passwords when logging in the next time.

According to this email, the security breach impacted the company's website, and, namely, information stored in the My Account section. Foxit web accounts are how the company manages its existing customers and is where users can access trial software, download purchased products, and access order histories. Foxit said hackers managed to access MyAccount data such as email addresses, passwords, real names, phone numbers, company names, and IP addresses from which users logged into their accounts. Due to the presence of IP addresses in the data hackers managed to access, this is believed to be a breach of Foxit's backend infrastructure, rather than a credential stuffing attack. The email did not mention if passwords were either hashed or salted. However, Foxit said it did invalidate all passwords for customers who it believed were impacted by the breach.

What's also unknown is when exactly the security incident took place. It could've happened this week, last month, or in previous years.

The co-founder and chief executive of Twitter has had his own account on the service taken over by hackers. From a report: A group referring to itself as the Chuckling Squad said it was behind the breach of Jack Dorsey's account. A spokeswoman for Twitter told the BBC that the site was urgently investigating. The account tweeted out a flurry of highly offensive and racist remarks. The offending tweets appear to have been mostly removed.

An unprecedented iPhone hacking operation, which attacked "thousands of users a week" until it was disrupted in January, has been revealed by researchers at Google's external security team. From a report: The operation, which lasted two and a half years, used a small collection of hacked websites to deliver malware on to the iPhones of visitors. Users were compromised simply by visiting the sites: no interaction was necessary, and some of the methods used by the hackers affected even fully up-to-date phones.

Once hacked, the user's deepest secrets were exposed to the attackers. Their location was uploaded every minute; their device's keychain, containing all their passwords, was uploaded, as were their chat histories on popular apps including WhatsApp, Telegram and iMessage, their address book, and their Gmail database. The one silver lining is that the implant was not persistent: when the phone was restarted, it was cleared from memory unless the user revisited a compromised site. However, according to Ian Beer, a security researcher at Google: "Given the breadth of information stolen, the attackers may nevertheless be able to maintain persistent access to various accounts and services by using the stolen authentication tokens from the keychain, even after they lose access to the device."

Hundreds of dental practice offices in the US have had their computers infected with ransomware this week, ZDNet reported Thursday. From a report: The incident is another case of a ransomware gang compromising a software provider and using its product to deploy ransomware on customers' systems. In this case, the software providers are The Digital Dental Record and PerCSoft, two Wisconsin-based companies who collaborated on DDS Safe, a medical records retention and backup solution advertised to dental practice offices in the US. Over the last weekend, a hacker group breached the infrastructure behind this software, and used it to deploy the REvil (Sodinokibi) ransomware on computers at hundreds of dentist offices across the US. The security breach came to light on Monday, when dentists returned to work, only to find out they couldn't access any patient information. A source impacted by the ransomware tells ZDNet that the two companies opted to pay the ransom demand. The Digital Dental Record and PerCSoft have been sharing a decrypter with impacted dental offices since Monday, helping companies recover encrypted files.

French police, with help from an antivirus firm, took control of a server that was used by cybercriminals to spread a worm programmed to mine cryptocurrency from more than 850,000 computers. Once in control of the server, the police remotely removed the malware from those computers. Motherboard reports: Antivirus firm Avast, which helped France's National Gendarmerie cybercrime center, announced the operation on Wednesday. Avast said that they found that the command and control server, which was located in France, had a design flaw in its protocol that made it possible to remove the malware without "making the victims execute any extra code," as the company explained in its lengthy report.

Cybersecurity firms such as Avast, as well as Trend Micro, had been tracking the worm, called Retadup, since last spring. Most of the infected computers were used by the malware authors to mine the cryptocurrency Monero, but in some cases it was also used to push ransomware and password-stealing malware, according to Avast. As the antivirus firm reported, most Retadup victims were in South America, with Peru, Venezuela, Bolivia and Mexico at the top of the list.

"A secret cyberattack against Iran in June wiped out a critical database used by Iran's paramilitary arm to plot attacks against oil tankers and degraded Tehran's ability to covertly target shipping traffic in the Persian Gulf, at least temporarily," reports The New York Times, citing senior American officials. From the report: Iran is still trying to recover information destroyed in the June 20 attack and restart some of the computer systems -- including military communications networks -- taken offline, the officials said. Senior officials discussed the results of the strike in part to quell doubts within the Trump administration about whether the benefits of the operation outweighed the cost -- lost intelligence and lost access to a critical network used by the Islamic Revolutionary Guards Corps, Iran's paramilitary forces.

The United States and Iran have long been involved in an undeclared cyberconflict, one carefully calibrated to remain in the gray zone between war and peace. The June 20 strike was a critical attack in that ongoing battle, officials said, and it went forward even after President Trump called off a retaliatory airstrike that day after Iran shot down an American drone. Iran has not escalated its attacks in response, continuing its cyberoperations against the United States government and American corporations at a steady rate, according to American government officials.

Kaspersky security researchers have discovered a Trojan Dropper malicious module hidden within the Android app CamScanner that's been downloaded over 100 million times on the Google Play Store. After they reported their findings, Google removed the app, but added, "it looks like the app developers got rid of the malicious code with the latest update of CamScanner." They conclude: "Keep in mind, though, that versions of the app vary for different devices, and some of them may still contain malicious code." BleepingComputer reports: As a confirmation to sudden increases in negative ratings and user reviews usually pointing out to something not exactly going right with an app, the researchers found "that the developer added an advertising library to it that contains a malicious dropper component." In this case, while CamScanner was initially a legitimate Android app using in-app purchases and ad-based monetization, "at some point, that changed, and recent versions of the app shipped with an advertising library containing a malicious module," says Kaspersky.

The module dubbed Trojan-Dropper.AndroidOS.Necro.n is a Trojan Dropper, a malware strain used to download and install a Trojan Downloader on already compromised Android devices which can be employed to infect the infected smartphones or tablets with other malware. When the CamScanner app is launched on the Android device, the dropper decrypts and executes malicious code stored within a mutter.zip file discovered in the app's resources. "As a result, the owners of the module can use an infected device to their benefit in any way they see fit, from showing the victim intrusive advertising to stealing money from their mobile account by charging paid subscriptions," found the researchers.

Verizon on Tuesday said it'll begin automatically enrolling eligible Android phones in its free Call Filter service. The company said it's making the move after the Federal Communications Commission in June voted to give wireless carriers greater power to "aggressively block" unwanted robocalls. From a report: "We know our customers are sick and tired of the endless onslaught of robocalls," Ronan Dunne, Verizon executive vice president, said in a release. "Our team is committed to developing and enhancing the tools that will help bring relief to our customers. This is another major step in that process." The free version of Call Filter will block robocalls, sending them automatically to voicemail, and put a warning label on potential spam calls. Verizon said auto-enrollment will begin Tuesday for postpaid customers with eligible devices. Prepaid Android customers and iPhone users can enroll in the free service by downloading the Call Filter app. Verizon started offering a free version of its spam- and robocall-blocking tools to customers in March. The wireless carrier also offers a paid version called Call Filter Plus, which costs $2.99 a month per line. The paid service offers additional tools like the ability to identify unknown callers by name and a spam number lookup feature.

Microsoft says that users who enable multi-factor authentication (MFA) for their accounts will end up blocking 99.9% of automated attacks. From a report: The recommendation stands not only for Microsoft accounts but also for any other profile, on any other website or online service. If the service provider supports multi-factor authentication, Microsoft recommends using it, regardless if it's something as simple as SMS-based one-time passwords, or advanced biometrics solutions. "Based on our studies, your account is more than 99.9% less likely to be compromised if you use MFA," said Alex Weinert, Group Program Manager for Identity Security and Protection at Microsoft. Weinert said that old advice like "never use a password that has ever been seen in a breach" or "use really long passwords" doesn't really help. He should know. Weinert was one of the Microsoft engineers who worked to ban passwords that became part of public breach lists from Microsoft's Account and Azure AD systems back in 2016. As a result of his work, Microsoft users who were using or tried to use a password that was leaked in a previous data breach were told to change their credentials.

The U.S. government plans to launch a program in roughly one month that narrowly focuses on protecting voter registration databases and systems ahead of the 2020 presidential election. From a report: These systems, which are widely used to validate the eligibility of voters before they cast ballots, were compromised in 2016 by Russian hackers seeking to collect information. Intelligence officials are concerned that foreign hackers in 2020 not only will target the databases but attempt to manipulate, disrupt or destroy the data, according to current and former U.S. officials. "We assess these systems as high risk," said a senior U.S. official, because they are one of the few pieces of election technology regularly connected to the Internet.

The Cybersecurity Infrastructure Security Agency, or CISA, a division of the Homeland Security Department, fears the databases could be targeted by ransomware, a type of virus that has crippled city computer networks across the United States, including recently in Texas, Baltimore and Atlanta. "Recent history has shown that state and county governments and those who support them are targets for ransomware attacks," said Christopher Krebs, CISA's director. "That is why we are working alongside election officials and their private sector partners to help protect their databases and respond to possible ransomware attacks."