An anonymous reader quotes a report from ZDNet: French authorities have arrested five men who stole over 120,000 liters (26,400 gallons) of fuel from gas stations around Paris by unlocking gas pumps using a special remote. The five-man team operated with the help of a special remote they bought online and which could unlock a particular brand of gas pumps installed at Total gas stations. The hack was possible because some gas station managers didn't change the gas pump's default lock code from the standard 0000. Hackers would use this simple PIN code to reset fuel prices and remove any fill-up limits.

Crooks would operate in small teams of two to three individuals who visited gas stations at night using two vehicles. A man in a first car would use the remote to unlock the gas station, and then a second car, usually a van, would come along seconds later to fill a giant tanker installed in the back of the vehicle with as much as 2,000 or 3,000 liters in one go. The group advertised the fuel they stole on social media, providing a time and place where customers could come and refuel their vehicles or pick up orders for gasoline and diesel at smaller prices. Police uncovered the scheme in April 2018, when they arrested a suspect in possession of a remote used in the hack. "Five men, part of the same gang, were arrested on Monday, according to Le Parisien, who first reported the scheme last November," the report adds.

An anonymous reader quotes a report from TechCrunch: Four senior senators have called on the largest U.S. voting machine makers to explain why they continue to sell devices with "known vulnerabilities," ahead of upcoming critical elections. The letter, sent Wednesday, calls on election equipment makers ES&S, Dominion Voting and Hart InterCivic to explain why they continue to sell decades-old machines, which the senators say contain security flaws that could undermine the results of elections if exploited. "The integrity of our elections is directly tied to the machines we vote on," said the letter sent by Sens. Amy Klobuchar (D-MN), Mark Warner (D-VA), Jack Reed (D-RI) and Gary Peters (D-MI), the most senior Democrats on the Rules, Intelligence, Armed Services and Homeland Security committees, respectively. "Despite shouldering such a massive responsibility, there has been a lack of meaningful innovation in the election vendor industry and our democracy is paying the price," the letter adds.

Their primary concern is that the three companies have more than 90 percent of the U.S. election equipment market share but their voting machines lack paper ballots or auditability, making it impossible to know if a vote was accurately counted in the event of a bug. Yet, these are the same devices tens of millions of voters will use in the upcoming 2020 presidential election. ES&S spokesperson Katina Granger said it will respond to the letter it received. The ranking Democrats say paper ballots are "basic necessities" for a reliable voting system, but the companies still produce machines that don't produce paper results.

Everyone hates April Fools' Day, and Microsoft is taking a stand against its own corporate pranks. From a report: Microsoft's marketing chief Chris Capossela has warned all employees to not participate in the process of annoying hoaxes on Monday. In an internal memo, Capossela explains that "data tells us these stunts have limited positive impact and can actually result in unwanted news cycles." He encourages all teams inside Microsoft not to do any public-facing April Fools' Day stunts. "I appreciate that people may have devoted time and resources to these activities, but I believe we have more to lose than gain by attempting to be funny on this one day," says Capossela. That's probably a safe bet, as we've seen some April Fools' Day pranks backfire spectacularly in the past. Google was forced to apologize for adding Despicable Me minions into emails and muting threads a few years ago, causing email havoc for Gmail users. Microsoft has also participated in many April Fools' Day pranks over the years, including an MS-DOS mobile for Windows Phone and Google insults.

According to ZDNet, researchers at Microsoft have discovered a buggy Huawei utility that could have given attackers a cheap way to undermine the security of the Windows kernel. From the report: Microsoft has now detailed how it found a severe local privilege escalation flaw in the Huawei PCManager driver software for its MateBook line of Windows 10 laptops. Thanks to Microsoft's work, the Chinese tech giant patched the flaw in January. As Microsoft researchers explain, third-party kernel drivers are becoming more attractive to attackers as a side-door to attacking the kernel without having to overcome its protections using an expensive zero-day kernel exploit in Windows. The flaw in Huawei's software was detected by new kernel sensors that were implemented in the Windows 10 October 2018 Update, aka version 1809.

The kernel sensors are meant to address the difficulty of detecting malicious code running in the kernel and are designed to detect user-space asynchronous procedure call (APC) code injection from the kernel. Microsoft Defender ATP anti-malware uses these sensors to detect actions caused by kernel code that may inject code into user-mode. Huawei's PCManager triggered Defender ATP alerts on multiple Windows 10 devices, prompting Microsoft to launch an investigation. [...] The investigation led the researcher to the executable MateBookService.exe. Due to a flaw in Huawei's 'watchdog' mechanism for HwOs2Ec10x64.sys, an attacker is able to create a malicious instance of MateBookService.exe to gain elevated privileges. The flaw can be used to make code running with low privileges read and write to other processes or to kernel space, leading to a "full machine compromise." Long-time Slashdot reader shanen writes: Though the story features Huawei, there doesn't seem to be anything specific to that company there. Just innuendo that you can't trust Chinese companies, eh? "Don't throw your computer into that Chinese briar patch!" Anyway, the sordid reality is that Microsoft is the root of all evils in the Windows platform. If increasing security had been half as important as maximizing profits, then we'd be in a much better world today. All complicated software is buggy, but adding complexity for no good reason is just begging for more problems. Here's a crazy solution approach: Any OS feature that isn't used by a LARGE majority of the users should be REMOVED from the OS. Maybe that isn't strong enough. Maybe the OS should be strictly limited to what absolutely needs to be there. Guard those eggs carefully!

A reader shares a report from Engadget: ASUS may have inadvertently pushed malware to some of its computers through its update tool, but it at least it has a fix ready to go. The PC maker has released a new version of its Live Update software for laptops that addresses the ShadowHammer backdoor attack. It also promised "multiple security verification mechanisms" to reduce the chances of further attacks, and started using an "enhanced end-to-end encryption mechanism." There are upgrades to the behind-the-scenes server system to prevent future attacks, ASUS added.

The company simultaneously reiterated the narrow scope of ShadowHammer, noting that the malware targeted a "very small and specific user group." It's believed to be an Advanced Persistent Threat -- that is, a state-backed assault against organizations rather than everyday users. Other ASUS devices weren't affected, according to a notice. While the fix is reassuring, it also raises questions as to why the systems weren't locked down earlier. Update tools are prime targets for hackers precisely because they're both trusted and have deep access to the operating system -- tight security is necessary to prevent an intruder from hijacking the process.

A computer system that airlines use for check-in kiosks, booking and more was experiencing issues on Tuesday, apparently affecting multiple air carriers. From a report: There were widespread reports on social media of air passengers inconvenienced by the outage, with long lines at airports across the country. Sabre Airline Solutions released this statement shortly before noon Eastern Time: "We are aware of the issues facing some of our customers. Recovery is in progress. We apologize for the inconvenience." The company was tweeting that statement to people who took note of the outage. American Airlines flagged the issue, saying in a statement that Sabre was "experiencing a technical issue that is impacting multiple carriers, including American Airlines. Sabre is working to resolve the issue as quickly as possible, and we apologize to our customers for the inconvenience." American later said that the issue with Sabre's system "has been resolved."

If you're a Firefox true believer, or even just a Firefox user, your password struggles just got a little easier with the release of Firefox Lockbox for Android devices. From a report: The password manager, based on login information already in Firefox, makes it easier to sign into apps as well. It integrates with login autocomplete systems in both Apple's iOS and Google's Android software, Mozilla said. It's not as fancy as password managers like LastPass, BitWarden, 1Password and Dashlane, and the only browser it works with is Firefox. On the other hand, if you're already in the Firefox world, it's basically already set up for you. There's no migration process as with dedicated password managers.

Almost all of Gmail's IFTTT routines and actions will stop working at the end of the month as Google alters the Gmail API to make it more secure. The only functionality of IFTTT-Gmail integration will be sending yourself an email and sending an email to someone else. TechSpot reports: The roots of this problem reach back to a breathless report in the Wall Street Journal in the summer of 2018 that claimed Gmail app developers have been reading your email. What it actually meant was that Gmail's OAuth account access was too simple -- if you allowed an application to access to Gmail, it had access to all of it. Even apps that didn't need the full text of emails for their intended function would have access to that after you signed in. Google began tightening access to Gmail content for third-party apps, and that's where IFTTT comes in.

As of March 31, Google is placing new restrictions on Gmail apps. Apps can no longer read, create, or modify message bodies. None of IFTTT's seven Gmail triggers will work anymore after the new API rules go into effect. In conversations with Google, IFTTT was able to keep two of the Gmail actions: sending yourself an email and sending an email to someone else. However, the trigger needs to be from another service. You can log into your IFTTT account to see which of your Applets are affected by the change. The new API rules only affect Gmail. Other G Suite services like Google Drive and Assistant will remain operating normally.

Researchers behind a large-scale independent study of pre-installed Android apps "unearthed a complex ecosystem of players with a primary focus on advertising and 'data-driven services' -- which they argue the average Android user is likely to be unaware of (while also likely lacking the ability to uninstall/evade the baked in software's privileged access to data and resources themselves)," reports TechCrunch. From the report: The study, which was carried out by researchers at the Universidad Carlos III de Madrid (UC3M) and the IMDEA Networks Institute, in collaboration with the International Computer Science Institute (ICSI) at Berkeley (USA) and Stony Brook University of New York (US), encompassed more than 82,000 pre-installed Android apps across more than 1,700 devices manufactured by 214 brands, according to the IMDEA institute. "The study shows, on the one hand, that the permission model on the Android operating system and its apps allow a large number of actors to track and obtain personal user information," it writes. "At the same time, it reveals that the end user is not aware of these actors in the Android terminals or of the implications that this practice could have on their privacy. Furthermore, the presence of this privileged software in the system makes it difficult to eliminate it if one is not an expert user."

In all 1,200 developers were identified behind the pre-installed software they found in the data-set they examined, as well as more than 11,000 third party libraries (SDKs). Many of the preloaded apps were found to display what the researchers dub potentially dangerous or undesired behavior. The data-set underpinning their analysis was collected via crowd-sourcing methods -- using a purpose-built app (called Firmware Scanner), and pulling data from the Lumen Privacy Monitor app. The latter provided the researchers with visibility on mobile traffic flow -- via anonymized network flow metadata obtained from its users. They also crawled the Google Play Store to compare their findings on pre-installed apps with publicly available apps -- and found that just 9% of the package names in their dataset were publicly indexed on Play. Another concerning finding relates to permissions. In addition to standard permissions defined in Android (i.e. which can be controlled by the user) the researchers say they identified more than 4,845 owner or "personalized" permissions by different actors in the manufacture and distribution of devices. So that means they found systematic user permissions workarounds being enabled by scores of commercial deals cut in a non-transparency data-driven background Android software ecosystem. The researchers address the lack of transparency and accountability in the Android ecosystem by suggesting the introduction and use of certificates signed by globally-trusted certificate authorities, or a certificate transparency repository "dedicated to providing details and attribution for certificates used to sign various Android apps, including pre-installed apps, even if self-signed." They also suggest Android devices should be required to document all pre-installed apps, plus their purpose, and name the entity responsible for each piece of software -- and do so in a manner that is "accessible and understandable to users."

Google has patched a Chrome bug that was being abused in the wild by tech support scammers to create artificial mouse cursors and lock users inside browser pages by preventing them from closing and leaving browser tabs. From a report: The trick was first spotted in September 2018 by Malwarebytes analyst Jerome Segura. Called an "evil cursor," it relied on using a custom image to replace the operating system's standard mouse cursor graphic. A criminal group that Malwarebytes called Partnerstroka operated by switching the standard OS 32-by-32 pixels mouse cursor with one of 128 or 256 pixels in size. A normal cursor would still appear on screen, but in the corner of a bigger transparent bounding box. [...] The "evil cursor" fix is currently live for Google Canary users, and is scheduled to land in the Chrome 75 stable branch, to be released later this spring.

The founder and CEO of NSO Group, the notorious Israeli hacking company with customers around the world, appeared on CBS's 60 Minutes Sunday night to defend the use of his company's tools in hacking and spying on lawyers, journalists, and minors when the country's customers determine the ends justify the means. From a report: NSO Group has reportedly sold hacking tools to dictators including those in Saudi Arabia, the United Arab Emirates, and across Central Asia -- a group of decision-makers whose track record includes numerous examples of human rights abuses and oppression of dissent. NSO's tools have been directly involved in the arrest of human rights activists and, in Mexico at least, spying on lawyers and journalists in an effort to catch the drug lord Joaquin "El Chapo" Guzman. "In order to catch El Chapo, for example, they had to intercept a journalist, an actress, and a lawyer," NSO Group founder Shalev Hulio told 60 minutes. "Now, by themselves, they are not criminals, right? But if they are in touch with a drug lord and in order to catch them, you need to intercept them, that's a decision an intelligence agency should get."

ASUS is believed to have pushed malware to hundreds of thousands of customers through its trusted automatic software update tool after attackers compromised the company's server and used it to push the malware to machines. From a report: Researchers at cybersecurity firm Kaspersky Lab say that ASUS, one of the world's largest computer makers, was used to unwittingly to install a malicious backdoor on thousands of its customers' computers last year after attackers compromised a server for the company's live software update tool. The malicious file was signed with legitimate ASUS digital certificates to make it appear to be an authentic software update from the company, Kaspersky Lab says. ASUS, a multi-billion dollar computer hardware company based in Taiwan that manufactures desktop computers, laptops, mobile phones, smart home systems, and other electronics, was pushing the backdoor to customers for at least five months last year before it was discovered, according to new research from the Moscow-based security firm.

The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines. Kaspersky Lab said it uncovered the attack in January after adding a new supply-chain detection technology to its scanning tool to catch anomalous code fragments hidden in legitimate code or catch code that is hijacking normal operations on a machine. The company plans to release a full technical paper and presentation about the ASUS attack, which it has dubbed ShadowHammer, next month at its Security Analyst Summit in Singapore.

A new report from the open source security company WhiteSource asks the question, "Is one programming language more secure than the rest?"

An anonymous reader quotes TechRepublic: To answer this question, the report compiled information from WhiteSource's database, which aggregates information on open source vulnerabilities from sources including the National Vulnerability Database, security advisories, GitHub issue trackers, and popular open source projects issue trackers. Researchers focused in on open source security vulnerabilities in the seven most widely-used languages of the past 10 years to learn which are most secure, and which vulnerability types are most common in each...

The most common vulnerabilities across most of these languages are Cross-SiteScripting (XSS); Input Validation; Permissions, Privileges, and Access Control; and Information Leak / Disclosure, according to the report.
Across the seven most widely-used programming languages, here's how the vulnerabilities were distributed:

• C (47%)
• PHP (17%)
• Java (11%)
• JavaScript (10%)
• Python (5%)
• C++ (5%)
• Ruby (4%)

But the results are full of disclaimers -- for example, that C tops the list because it's the oldest language with "the highest volume of written code" and "is also one of the languages behind major infrastructure like Open SSL and the Linux kernel."

The report also notes a "substantial rise" across all languages for known open source security vulnerabilities over the last two years, attributing this to more awareness about vulnerable components -- thanks to more research, automated security tools, and "the growing investment in bug bounty programs" -- as well as the increasing popularity of open source software. And it also reports a drop in the percentage of critical vulnerabilities for most languages -- except JavaScript and PHP.

The report then concludes that "the Winner Of Most Secure Programming Language is...no one and everyone...! It is not about the language itself that makes it any more or less secure, but how you use it. If you are mitigating your vulnerabilities throughout the software development lifecycle with the proper management approach, then you are far more likely to stay secure."

Coincidentally, WhiteSource sells software which monitors open source components throughout the software development lifecycle to provide alerts about security (and licensing) issues.

An airline passenger "passed a security checkpoint with a loaded gun magazine," reports the Associated Press, citing information from an airport duty manager: Bob Rotiski said the passenger who apparently had visited a shooting range packed a loaded magazine in his carry-on bag. He said an officer identified the magazine during security screening, but the wrong bag was pulled from the line. By that time, the passenger had already left the checkpoint with the bag containing the magazine....

Security lines were closed and flights were temporarily grounded at a San Francisco International Airport terminal...for nearly an hour, and United Airline flights out of Terminal 3 were grounded Saturday morning as TSA officers looked for the passenger.
"Rotiski said the lines reopened after officers located the passenger and brought him back for re-screening."

A research duo who hacked a Tesla were the big winners at the annual Pwn2Own white hat security contest, reports ZDNet. "The duo earned $375,000 in prize money, of the total of $545,000 awarded during the whole three-day competition... They also get to keep the car." Team Fluoroacetate -- made up of Amat Cama and Richard Zhu -- hacked the Tesla car via its browser. They used a JIT bug in the browser renderer process to execute code on the car's firmware and show a message on its entertainment system... Besides keeping the car, they also received a $35,000 reward. "In the coming days we will release a software update that addresses this research," a Tesla spokesperson told ZDNet today in regards to the Pwn2Own vulnerability.

Not coincidentally, Team Fluoroacetate also won the three-day contest after earning 36 "Master of Pwn" points for successful exploits in Apple Safari, Firefox, Microsoft Edge, VMware Workstation, and Windows 10... [R]esearchers also exploited vulnerabilities in Apple Safari, Microsoft Edge, VMware Workstation, Oracle Virtualbox, and Windows 10.

Oracle "swung the layoff axe" Thursday, reports IEEE Spectrum, saying that the move "clear-cut teams of engineers." The exact numbers of employees cut and their specific roles have not been reported by the company, but the layoffs are clearly significant. Fifty in Mexico, 50 in New Hampshire, 100 in India, at least that many in Silicon Valley -- the numbers, according to anecdotal reports on theLayoff.com and from internal chatter, are adding up quickly....

Oracle's layoff day started at 5 a.m. Pacific Time, when an email from Oracle executive vice president Don Johnson with the subject line "Organizational Restructuring" arrived in employee inboxes. The email informed staff members that, going forward, everything in the company would revolve around the Oracle Cloud Infrastructure (OCI) operation... Then the email continued with a perky sentence that made some employees furious: "OCI's business is stronger than ever, and this team's future is bright." At approximately 10 a.m., I'm told, just five hours after that email, the layoffs began -- and according to anecdotal reports included significant cuts within at least part of that stronger-than-ever, bright-future cloud business.

Those affected were given 30 minutes to turn in company assets and leave the building, and were told that Friday (today) would their last official day. "The morning felt like a slaughter," one Oracle employee told me. "One person after another...." And, that employee said, the layoff process was handled very badly, with entire teams being ushered into conference rooms as groups and told that they no longer had jobs. This employee indicated that technical teams, particularly those involved in product development and focused on software development, data science, and engineering, seemed to take the biggest hit.
Business Insider reports that Oracle hasn't formally announced the number of people laid off, but adds that "One source we spoke to was told by his manager that 1,500 people worldwide were cut."

An anonymous reader shares a report: According to a new study 91 percent of IT and security professionals feel vulnerable to insider threats, and 75 percent believe the biggest risks lie in cloud applications like popular file storage and email solutions including Google Drive, Gmail and Dropbox. The report from SaaS operations management specialist BetterCloud also shows 62 percent of respondents believe the biggest security threat comes from the well-meaning but negligent end user.

Among other findings are that 46 percent of IT leaders (heads of IT and above) believe that the rise of SaaS applications makes them the most vulnerable. In addition 40 percent of respondents believe they are most vulnerable to exposure of confidential business information such as financial information and customer lists. Only 26 percent of C-level executives say they've invested enough to mitigate the risk of insider threats, compared to 44 percent of IT managers.

The Federal Emergency Management Agency (FEMA) unlawfully shared the private information of 2.3 million hurricane and wildfire survivors with a federal contractor that was helping them find temporary housing, an inspector general from the Department of Homeland Security said Friday. The data includes "20 unnecessary data fields" such as "electronic funds transfer number," "bank transit number" and addresses. CNN reports: FEMA said it began filtering the data in December 2018 to prevent this information from being shared, but a more permanent fix may not be finalized until June 2020. "Since discovery of this issue, FEMA has taken aggressive measures to correct this error. FEMA is no longer sharing unnecessary data with the contractor and has conducted a detailed review of the contractor's information system," said Lizzie Litzow, press secretary for FEMA, in a statement.

"To date, FEMA has found no indicators to suggest survivor data has been compromised. FEMA has also worked with the contractor to remove the unnecessary data from the system and updated its contract to ensure compliance with Department of Homeland Security (DHS) cybersecurity and information-sharing standards. As an added measure, FEMA instructed contracted staff to complete additional DHS privacy training."

A scan of billions of files from 13 percent of all GitHub public repositories over a period of six months has revealed that over 100,000 repos have leaked API tokens and cryptographic keys, with thousands of new repositories leaking new secrets on a daily basis. From a report: The scan was the object of academic research carried out by a team from the North Carolina State University (NCSU), and the study's results have been shared with GitHub, which acted on the findings to accelerate its work on a new security feature called Token Scanning, currently in beta. The NCSU study is the most comprehensive and in-depth GitHub scan to date and exceeds any previous research of its kind. NCSU academics scanned GitHub accounts for a period of nearly six months, between October 31, 2017, and April 20, 2018, and looked for text strings formatted like API tokens and cryptographic keys.

An anonymous reader quotes a report from The Guardian: Facebook employees were aware of concerns about "improper data-gathering practices" by Cambridge Analytica months before the Guardian first reported, in December 2015, that the political consultancy had obtained data on millions from an academic. The concerns appeared in a court filing by the attorney general for Washington DC and were subsequently confirmed by Facebook. The new information "could suggest that Facebook has consistently mislead [sic]" British lawmakers "about what it knew and when about Cambridge Analytica," tweeted Damian Collins, the chair of the House of Commons digital culture media and sport select committee (DCMS) in response to the court filing.

In a statement, a company spokesperson said: "Facebook absolutely did not mislead anyone about this timeline." After publication of this article, the spokesperson acknowledged that Facebook employees heard rumors of data scraping by Cambridge Analytica in September 2015. The spokesperson said that this was a "different incident" from Cambridge Analytica's acquisition of a trove of data about as many as 87 million users that has been widely reported on for the past year. "In September 2015 employees heard speculation that Cambridge Analytica was scraping data, something that is unfortunately common for any internet service," the spokesperson said. "In December 2015, we first learned through media reports that Kogan sold data to Cambridge Analytica, and we took action. Those were two different things." The filing raised questions about when Facebook first learned about the misuse of personal data by Cambridge Analytica, the now defunct political consultancy.