Larry Sanger, American internet project developer and co-founder of Wikipedia, argues in a blog post that vendors must start adding physical on/off switches to webcams, smartphone cameras/mics, and other devices that spy on us. He writes: Have you ever noticed that your webcam doesn't have an "off" switch? I looked on Amazon, and I couldn't find any webcams for sale that had a simple on/off switch. When I thought I found one, but it turned out just to have a light that turns on when the camera is in use, and off when not -- not a physical switch you can press or slide. The "clever" solution is supposed to be webcam covers (something Mark Zuckerberg had a hand in popularizing); you can even get a webcam (or a laptop) with such a cover built in. How convenient! I've used tape, which works fine. But a cover doesn't cover up the microphone, which could be turned on without your knowledge.
[...]
It's almost as if the vendors of common, must-have devices want to make it possible to spy on us. An enterprising journalist should ask why they don't make such switches. They certainly have deliberately made it hard for us to stop being spied upon -- even though we're their customers. Think about that. We're their bread and butter, and we're increasingly and rightly concerned about our security. Yet they keep selling us these insecure devices. That's just weird, isn't it? What the hell is going on? [...] If your webcam, or your phone, or any other device with an Internet-connected camera or microphone (think about how many you own) has ever been hacked, these [hardware vendors like Logitech and Apple and large software vendors like Skype and Snapchat] are partly to blame if it was always-on by design. They have a duty to worry about how their products make their users less secure. They haven't been doing this duty. Sanger goes on to urge consumers to care more about our privacy and security, and demand that vendors give us an off switch. "I think we consumers should demand that webcams, smart phones, smart speakers, and laptop cameras and microphones -- and any other devices with cameras and microphones that are connected to the Internet -- be built with hardware 'off' switches that make it impossible for the camera and microphone to be operated," writes Sanger.

Do you agree?

Dan Goodin writes via Ars Technica: A researcher has uncovered strange and unexpected behavior in Windows 10 that allows remote attackers to steal data stored on hard drives when a user opens a malicious file downloaded with the Edge browser. The threat partially surfaced last week when a different researcher, John Page, reported what he called a flaw in Internet Explorer. Page claimed that when using the file manager to open a maliciously crafted MHT file, the browser uploaded one or more files to a remote server. According to Page, the vulnerability affected the most recent version of IE, version 11, running on Windows 7, Windows 10, and Windows Server 2012 R2 with all security updates installed. (It's no longer clear whether any OS other than Windows 10 is affected, at least for some users. More about that in a moment.)

[I]n Page's post was a video demonstration of the proof-of-concept exploit Page created. It shows a booby-trapped MHT file triggering an upload of the host computer's system.ini file to a remote server. Page's video shows the file being downloaded with Edge. "This can allow remote attackers to potentially exfiltrate Local files and conduct remote reconnaissance on locally installed Program version information," Page wrote. "Example, a request for 'c:\Python27\NEWS.txt' can return version information for that program."

A year ago, the French government unveiled its plan to build its own encrypted messenger service to ease fears that foreign entities could spy on private conversations between top officials. That app, named Tchap, is now official for Android handsets and the iPhone. From a report: A web dashboard is also in the works. Only official French government employees can sign-up for an account; however, the French government also open-sourced Tchap's source code on GitHub so other organizations can roll out their own versions of Tchap for internal use as well. Work on the app started in July 2018, and the app itself is based on Riot, a well-known open-source, self-hostable, and secure instant messaging client-server package. The app was officially developed by DINSIC (Interministerial Directorate of Digital and Information System and Communication of the State), under the supervision of ANSSI, France's National Cybersecurity Agency.

A computer attack knocked the Weather Channel off the air for more than an hour Thursday morning [Editor's note: the link may be paywalled; alternative source], and federal authorities are investigating the incident, WSJ is reporting. From the report: After its broadcast was disrupted, the weather news service sent a tweet saying it had been the victim of "a malicious software attack," adding that federal law-enforcement officials were investigating the matter. A spokesman for the Federal Bureau of Investigation said the incident was a ransomware attack, and the agency was conducting an investigation. Ransomware is an increasingly common form of digital extortion. Criminals install it on computer networks via trickery or hacking, and the software then spreads from computer to computer, locking up systems until a digital ransom is paid.

To fight phishing, Google last year announced it would require users to enable JavaScript during Google Account sign-in so that it could run attack-detecting risk assessments, and this week, the company said it'll begin to block all sign-ins from embedded browser frameworks like Chromium Embedded Framework starting in June. From a report: For the uninitiated, embedded browser frameworks enable developers to add basic web browsing functionality to their apps, and to use web languages like HTML, CSS, and JavaScript to create those apps' interface (or portions of it). They're typically cross-platform -- Chromium Embedded Framework runs on Linux, Windows, and macOS -- and they support a range of language bindings. With the change, Google is specifically targeting man in the middle (MITM) attacks, which it says are particularly difficult to spot from automation platforms like embedded browser frameworks.

A "computer glitch" may have been behind the fast-spreading fire that ravaged Notre Dame, Associated Press reported Friday, citing the cathedral's rector. From the report: Speaking during a meeting of local business owners, rector Patrick Chauvet did not elaborate on the exact nature of the glitch, adding that "we may find out what happened in two or three months." On Thursday, Paris police investigators said they think an electrical short-circuit most likely caused the fire. French newspaper Le Parisien has reported that a fire alarm went off at Notre Dame shortly after 6 p.m. Monday but a computer bug showed the fire's location in the wrong place. The paper reported the flames may have started at the bottom of the cathedral's giant spire and may have been caused by an electrical problem in an elevator. Chauvet said there were fire alarms throughout the building, which he described as "well protected."

Records for potentially tens of thousands of patients seeking treatment at several addiction rehabilitation centers were exposed in an unsecured online database, an independent researcher revealed Friday. From a report: The 4.91 million documents included patients' names, as well as details of the treatments they received, according to Justin Paine, the researcher. Each patient had multiple records in the database, and Paine estimates that the records may cover about 145,000 patients. Paine notified the main treatment center, as well as the website hosting company, when he discovered the database. The data has since been made unavailable to the public. Paine found the data by typing keywords into the Shodan search engine that indexes servers and other devices that connect to the internet.

"Given the stigma that surrounds addiction this is almost certainly not information the patients want easily accessible," Paine said in a blog post that he shared with CNET ahead of publication. Paine hunts for unsecured databases in his free time. His day job is head of trust and safety at web security company Cloudflare. The find is the latest example of a widespread problem: Any organization can easily store customer data on cloud-based services now, but few have the expertise to set them up securely. As a result, countless unsecured databases sit online and can be found by anyone with a few search skills. Many of those databases are full of sensitive personal data.

An anonymous reader shares a report: Last year, Microsoft announced when it would be killing app updates and distribution in the Windows Store for Windows Phone 8.x and Windows 8.x. At the time, the blog post stated that Windows Phone 8.x devices would stop receiving app updates after July 1, 2019, while Windows 8.x devices would get app updates through July 1, 2023. However, it seems as though plans have changed a little bit, as the blog post has quietly been updated earlier this month. Microsoft has changed the wording in the post to state that Windows 8 devices will stop getting updates for their apps at the same time as Windows Phone 8.x, that is, July 1 of this year. Windows 8.1 devices will continue to receive updates through the previously announced date in 2023.

In an incident reminiscent of the Shadow Brokers leak that exposed the NSA's hacking tools, someone has now published similar hacking tools belonging to one of Iran's elite cyber-espionage units, known as APT34, Oilrig, or HelixKitten. From a report: The hacking tools are nowhere near as sophisticated as the NSA tools leaked in 2017, but they are dangerous nevertheless. The tools have been leaked since mid-March on a Telegram channel by an individual using the Lab Dookhtegan pseudonym. Besides hacking tools, Dookhtegan also published what appears to be data from some of APT34's hacked victims, mostly comprising of username and password combos that appear to have been collected through phishing pages. ZDNet was previously aware of some of these tools and victim data after this reporter received a tip in mid-March. In a Twitter DM, a Twitter user shared some of the same files that were discovered today on Telegram, and we believe that this Twitter user is the Telegram Lab Dookhtegan persona.

AmiMoJo writes: It's time to buy a new chair so I'm turning to Slashdot for recommendations. The Herman Miller Aeron seems to be the go-to, much like the Model M for keyboards, but I've heard that there are some other good options on the market.

I need something that is comfortable and durable -- too many chairs get squeaky and loose because I can't sit still and keep shifting my weight around. Many are difficult to maintain as well, e.g. the screws attacking the back are often under plastic attached with very stiff clips so you can't easily give them a quick tighten. What does Slashdot recommend for my posterior? It's been more than a decade since readers sought recommendations for a quality chair for desktop coding, or back-friendly chairs. In fact, it's been almost two decades since a user inquired about the perfect computer chair. Hopefully office chairs have improved in quality/design since then...

An anonymous reader quotes a report from Ars Technica: FCC Chairman Ajit Pai has proposed denying China Mobile USA's application to offer telecom services in the U.S., saying the Chinese government-owned company poses a security risk. The FCC is scheduled to vote on an order to deny the application at its open meeting on May 9, and Pai yesterday announced his opposition to China Mobile entering the U.S. market. "After reviewing the evidence in this proceeding, including the input provided by other federal agencies, it is clear that China Mobile's application to provide telecommunications services in our country raises substantial and serious national security and law enforcement risks," Pai said. "Therefore, I do not believe that approving it would be in the public interest. I hope that my colleagues will join me in voting to reject China Mobile's application."

China Mobile filed its application in 2011, and has repeatedly complained about the government's lengthy review process. According to Pai's announcement, China Mobile's application sought authority "to provide international facilities-based and resale telecommunications services between the U.S. and foreign destinations." In simpler terms, the company was seeking "a license to connect calls between the United States and other nations" and "was not seeking to provide domestic cell service and compete in the country with businesses like AT&T and Verizon," The New York Times wrote yesterday. An FCC official told reporters that such calls "could be intercepted for surveillance and make the domestic network vulnerable to hacking and other risks," the Times wrote.

Last month, Facebook disclosed that hundreds of millions of users on its platform had their account passwords stored in plain text -- in some cases going back to 2012 -- and searchable by thousands of Facebook employees. Today, the company quietly updated that blog post to reveal that Instagram users are also impacted. It said, in the update: Since this post was published, we discovered additional logs of Instagram passwords being stored in a readable format. We now estimate that this issue impacted millions of Instagram users. We will be notifying these users as we did the others. Our investigation has determined that these stored passwords were not internally abused or improperly accessed.

An internet milestone known as "768k Day" is getting closer and some network administrators are shaking in their boots fearing downtime caused by outdated network equipment. From a report: The fear is justified, and many companies have taken precautions to update old routers, but some cascading failures are still predicted. The term 768k Day comes from the original mother of all internet outages known as 512k Day. [...] Many legacy routers received emergency firmware patches that allowed network admins to set a higher threshold for the size of the memory allocated to handle the global BGP routing table. Most network administrators followed documentation provided at the time and set the new upper limit at 768,000 -- aka 768k.

CIDR Report, a website that keeps track of the global BGP routing table, puts the size of this file at 773,480 entries; however, their version of the table isn't official and contains some duplicates. A Twitter bot named BGP4-Table, which has also been tracking the size of the global BGP routing table in anticipation of 768K Day, puts the actual size of the file at 767,392, just a hair away from overflowing. ZDNet spoke today with Aaron A. Glenn, a networking engineer with AAGICo Berlin, and Jim Troutman, Director at the Northern New England Neutral Internet Exchange (NNENIX). Both estimate 768K Day happening within the next month. But unlike many network admins, they don't expect the event to cause internet-wide outages like in 2014. However, both Glenn and Troutman expect some companies and smaller, local ISPs to be affected. "I would be mildly surprised if there was any interruption or outage at any real scale," Glenn told ZDNet.

Google's Chrome browser will get a Reader Mode, similar to the one found in competing browsers like Firefox and the old Microsoft Edge. From a report: The feature is currently under development, but Chrome Canary users can test it starting today. Chrome's Reader Mode will work by stripping pages of most of their useless content, such as ads, comments sections, or animations, and leave a bare-bones version behind, showing only titles, article text, and article images. Work on the feature started in February this year when Google engineers began porting the "simplified view" offered by Chrome on Android to desktop editions. Today is the first day that a fully-functional Reader Mode is active in Chrome's desktop versions -- via Google Chrome Canary distributions. To test Chrome's upcoming Reader Mode, users must first visit the chrome://flags/#enable-reader-mode section in their Chrome Canary version, and enable the Reader Mode option.

Facebook "unintentionally" harvested the email contacts of about 1.5 million of its users during the past three years. From a report: The activity came to light when a security researcher noticed that Facebook was asking users to enter their email passwords to verify their identities when signing up for an account, according to Business Insider, which previously reported on the practice. Those who did enter their passwords then saw a pop-up message that said it was "importing" their contacts -- without first asking permission, BI reported. A Facebook spokesperson confirmed that 1.5 million people's contacts were collected in this manner since May 2016 to help build Facebook's web of social connections and recommend other users to add as friends.

So-called "bad bots," tasked with performing denial-of-service (DoS) attacks or other malicious activities like automatically publishing fake content or reviews, are estimated to make up roughly 37.9 percent of all internet traffic. "In 2018, one in five website requests -- 20.4 percent -- of traffic was generated by bad bots alone," reports ZDNet, citing Distil Networks' latest bot report, "Bad Bot Report 2019: The Bot Arms Race Continues." From the report: According to Distil Networks' latest bot report, the financial sector is the main target for such activity, followed by ticketing, the education sector, government websites, and gambling. Based on the analysis of hundreds of billions of bad bot requests over 2018, simple bots, which are easy to detect and defend against, accounted for 26.4 percent of bad bot traffic. Meanwhile, 52.5 percent came from those considered to be "moderately" sophisticated, equipped with the capability to use headless browser software as well as JavaScript to conduct illicit activities.

A total of 73.6 percent of bad bots are classified as Advanced Persistent Bots (APBs), which are able to cycle through random IP addresses, switch their digital identities, and mimic human behavior. Amazon is the leading ISP for bad bot traffic origins. In total, 18 percent of bad bot traffic came from the firm's services, a jump from 10.62 percent in 2017. Almost 50 percent of bad bots use Google Chrome as their user agent and 73.6 percent of bad bot traffic was recorded as originating from data centers, down from 82.7 percent in 2017. The United States outstrips all other countries as a generator of bad bots. In total, 53.4 percent of bad bot traffic came from the US, followed by the Netherlands and China. The most blocked country by IP is Russia, together with Ukraine and India.

pgmrdlm shares a report: Calls between T-Mobile users and Comcast's Xfinity Voice home subscribers will now be "verified," the latest move in the ongoing fight against robocalls. The two companies announced Wednesday that they have launched cross-network verification, allowing users to know that the calls they are receiving is from an actual person and not a spammer or robocaller.

They use a handoff system recommended by the FCC where the caller's network verifies that a legitimate call is being made with a "digital signature." The recipient's network then confirms the signature on its side. A number of major wireless and traditional home voice providers have pledged support for the verification method, including Verizon, AT&T, Sprint, Charter, Cox and Vonage, with several announcing plans to roll out or test the feature in 2019.

Trailrunner7 shares a report: The discovery of a new, sophisticated team of hackers spying on dozens of government targets is never good news. But one team of cyberspies has pulled off that scale of espionage with a rare and troubling trick, exploiting a weak link in the internet's cybersecurity that experts have warned about for years: DNS hijacking, a technique that meddles with the fundamental address book of the internet. Researchers at Cisco's Talos security division on Wednesday revealed that a hacker group it's calling Sea Turtle carried out a broad campaign of espionage via DNS hijacking, hitting 40 different organizations.

In the process, they went so far as to compromise multiple country-code top-level domains -- the suffixes like .co.uk, or .ru, that end a foreign web address -- putting all the traffic of every domain in multiple countries at risk. The hackers' victims include telecoms, internet service providers, and domain registrars responsible for implementing the domain name system. But the majority of the victims and the ultimate targets, Cisco believes, were a collection of mostly governmental organizations including ministries of foreign affairs, intelligence agencies, military targets, and energy-related groups, all based in the Middle East and North Africa. By corrupting the internet's directory system, hackers were able to silently use "man-in-the-middle" attacks to intercept all internet data from email to web traffic sent to those victim organizations.

[...] Cisco Talos said it couldn't determine the nationality of the Sea Turtle hackers, and declined to name the specific targets of their spying operations. But it did provide a list of the countries where victims were located: Albania, Armenia, Cypress, Egypt, Iraq, Jordan, Lebanon, Libya, Syria, Turkey, and the United Arab Emirates. Cisco's Craig Williams confirmed that Armenia's .am top-level domain was one 'of the "handful" that were compromised, but wouldn't say which of the other countries' top-level domains were similarly hijacked.

The UK's age verification system for online pornography will become mandatory on 15 July, the government has confirmed. From a report: From that date, commercial providers of online pornography will be required to carry out "robust" age verification checks on users, in order to keep children from accessing adult content. Websites that refuse to implement the checks face being blocked by UK internet service providers or having their access to payment services withdrawn.The digital minister, Margot James, welcomed the introduction of the rules, saying: "Adult content is currently far too easy for children to access online."

She added, "The introduction of mandatory age verification is a world first, and we've taken the time to balance privacy concerns with the need to protect children from inappropriate content. We want the UK to be the safest place in the world to be online, and these new laws will help us achieve this." Will Gardner, the chief executive of Childnet, said: "We hope that the introduction of this age verification will help in protecting children, making it harder for young people to accidentally come across online pornography, as well as bringing in the same protections that we use offline to protect children from age-restricted goods or services."

Microsoft has lost control over a crucial subdomain that Windows 8 and Windows 10 use to deliver RSS-based news and updates to Live Tiles -- animated Windows start menu items. From a report: The subdomain (notifications.buildmypinnedsite.com) is currently under the control of Hanno Bock, a security researcher and journalist for German tech news site Golem.de. The subdomain was part of the buildmypinnedsite.com service that Microsoft set up with the launch of Windows 8, and more specifically to allow websites to show live updates inside users' Start pages and menus.

[...] Today Bock said the service no longer works. "The host that should deliver the XML files -- notifications.buildmypinnedsite.com -- only showed an error message from Microsoft's cloud service Azure," the researcher said. "The host was redirected to a subdomain of Azure. However this subdomain wasn't registered with Azure." Bock registered this subdomain on his Azure account and is currently sinkholing any requests it receives. He also notified Microsoft of the issue but said the company did not reply. "We won't keep the host registered permanently. There's a decent amount of traffic reaching this host and running up costs," the researcher said. "Once we cancel the subdomain a bad actor could register it and abuse it for malicious attacks," he warned.