Federal prosecutors unveiled charges in an international stock-trading scheme that involved hacking into the Securities and Exchange Commission's EDGAR corporate filing system. "The scheme allegedly netted $4.1 million for fraudsters from the U.S., Russia and Ukraine," reports CNBC. "Using 157 corporate earnings announcements, the group was able to execute trades on material nonpublic information. Most of those filings were 'test filings,' which corporations upload to the SEC's website." From the report: The scheme involves seven individuals and operated from May to at least October 2016. Prosecutors said the traders were part of the same group that previously hacked into newswire services. Carpenito, in a press conference Tuesday, said the thefts included thousands of valuable, private business documents. "After hacking into the EDGAR system they stole drafts of [these] reports before the information was disseminated to the general public," he said.

Those documents included quarterly earnings, mergers and acquisitions plans and other sensitive news, and the criminals were able to view it before it was released as a public filing, thus affecting the individual companies' stock prices. The alleged hackers executed trades on the reports and also sold them to other illicit traders. One inside trader made $270,000 in a single day, according to Carpenito. The hackers used malicious software sent via email to SEC employees. Then, after planting the software on the SEC computers, they sent the information they were able to gather from the EDGAR system to servers in Lithuania, where they either used it or distributed the data to other criminals, Carpenito said.

fahrbot-bot writes: The gadget, called Alias, is an always-listening speaker, designed to fit on top of an Amazon Echo or Google Home, where it looks like a mass of melted candle wax. It's composed of a 3D-printed top layer, a mic array, a Raspberry Pi, and two speakers. It only connects to the internet during the initial setup process. Alias stays "off the grid" while you're using it, preventing your conversations from leaving the device. When the Alias hears its own (customizable) wake word, it'll stop broadcasting white noise and wake up Alexa or Google Assistant so you can use them as normal.

The WordPress open-source content management system (CMS) will show warnings in its backend admin panel if the site runs on top of an outdated PHP version. From a report: The current plan is to have the warnings appear for sites using a PHP version prior to the 5.6.x branch (5.6 or lower). The warnings will contain a link to a WordPress support page with information on how site owners can update their server's underlying PHP version. In instances where site owners are running their WordPress portals on top of tightly-controlled web hosting environments, the web host has the option to change this link with a custom URL pointing at its own support site. [...] Around 66.7 percent of all Internet sites run an unsupported PHP version, according to W3Techs. Almost a quarter of all internet sites run on top of a WordPress CMS.

Mark Wilson writes: After five years of leaking information about unreleased builds of Windows, BuildFeed has shut its shop. Over the weekend, the site posted a slew of build numbers including references to onecore and shell_devices_foldable. But there will be no more leaks coming from the BuildFeed. Citing 'extensive internal pressures and external pressures', site founder Thomas Hounsell says that he has terminated his project with immediate effect.

An anonymous reader quotes a report from Ars Technica: A free texting service used by teachers, students, and parents may stop working on the Verizon Wireless network because of a dispute over texting fees that Verizon demanded from the company that operates the service. As a result, teachers that use the service have been expressing their displeasure with Verizon. Remind -- the company that offers the classroom communication service -- criticized Verizon for charging the new fee. Remind said its service's text message notifications will stop working on the Verizon network on January 28 unless Verizon changes course. (Notifications sent via email or via Remind's mobile apps will continue to work.) The controversy cropped up shortly after a Federal Communications Commission decision that allowed U.S. carriers' text-messaging services to remain largely unregulated. Verizon says the fee must be charged to fund spam-blocking services. Remind said in a statement: "To offer our text-messaging service free of charge, Remind has always paid for each text that users receive or send. Now, Verizon is charging Remind an additional fee intended for companies that send spam over its network. Your Remind messages aren't spam, but that hasn't helped resolve the issue with Verizon. The fee will increase our cost of supporting text messaging to at least 11 times our current cost -- forcing us to end free Remind text messaging for the more than 7 million students, parents, and educators who have Verizon Wireless as their carrier."

DerbyCon 9.0, the upcoming edition of the popular InfoSec conference in September, will be its last. From an official announcement: When we first started DerbyCon, our goal was to create a conference where we could all come together to collaborate and share as a community, but most importantly as a profession. DerbyCon 1.0 was a huge gamble for us both personally and financially, but we believed in what we were doing, and it worked. For those that don't know the history of DerbyCon, it started off inside of a pizza shop as an idea between a few friends. Our goal was to create an affordable conference that shared a lot of what we had experienced in our early days in security. The ideas of collaboration, community, and the betterment of the industry and the safety of technology were at the forefront. At the end of DerbyCon 1.0, we realized that the conference was a huge success and our dream became a reality.

[...] What we have had to deal with on the back-end the past few years is more than just running a conference and sharing with friends. The conference scene in general changed drastically and small pocket groups focus on outrage and disruption where there is no right answer (regardless of how you respond, it's wrong), instead of coming together, or making the industry better. There is a small, yet vocal group of people creating negativity, polarization, and disruption, with the primary intent of self-promotion to advance a career, for personal gain, or for more social media followers. Individuals that would have us be judge, jury, and executioner for people they have had issues with outside of the conference that has nothing to do with the conference itself.

Instead of working hard in research, being a positive force in the industry, or sharing their own unique experiences (which makes us better as a whole), they tear others down in order to promote themselves. This isn't just about DerbyCon, it is present at other conferences as well and it's getting worse each year. We've spoken with a number of conference organizers, and each year it becomes substantially more difficult to host a conference where people can come together in large group settings. It's not just conferences either. This behavior is happening all over the place on social media, in our industry, targeting people trying to do good. As a community, we add fuel to fire, attack others, and give them a platform in one massive toxic environment. We do this all in fear of repercussions from upsetting others. Until this pattern changes, it will continue to get worse.

secwatcher quotes a report from Threatpost: Researchers hacked the Docker test platform called Play-with-Docker, allowing them to access data and manipulate any test Docker containers running on the host system. The proof-of-concept hack does not impact production Docker instances, according to CyberArk researchers that developed the proof-of-concept attack. "The team was able to escape the container and run code remotely right on the host, which has obvious security implications," wrote researchers in a technical write-up posted Monday.

Play-with-Docker is an open source free in-browser online playground designed to help developers learn how to use containers. While Play-with-Docker has the support of Docker, it was not created by nor is it maintained by the firm. The environment approximates having the Alpine Linux Virtual Machine in browser, allowing users to build and run Docker containers in various configurations. The vulnerability was reported to the developers of the platform on November 6. On January 7, the bug was patched. As for how many instances of Play-with-Docker may have been affected, "CyberArk estimated there were as many as 200 instances of containers running on the platform it analyzed," reports Threatpost. "It also estimates the domain receives 100,000 monthly site visitors."

An anonymous reader quotes a report from Ars Technica: Windows 7's five years of extended support will expire on January 14, 2020 -- exactly one year from today. After this date, security fixes will no longer be freely available for the operating system that's still widely used. As always, the end of free support does not mean the end of support entirely. Microsoft has long offered paid support options for its operating systems beyond their normal lifetime, and Windows 7 is no different. What is different is the way that paid support will be offered. For previous versions of Windows, companies had to enter into a support contract of some kind to continue to receive patches. For Windows 7, however, the extra patches will simply be an optional extra that can be added to an existing volume license subscription -- no separate support contract needed -- on a per-device basis. These Extended Security Updates (ESU) will be available for three years after the 2020 cut-off, with prices escalating each year.

A security researcher has found, reported and now disclosed a dozen bugs that made it easy to steal sensitive information or take over any customer's account from some of the largest web hosting companies on the internet. From a news report: In some cases, clicking on a simple link would have been enough for Paulos Yibelo, a well-known and respected bug hunter, to take over the accounts of anyone using five large hosting providers -- Bluehost, DreamHost, Hostgator, OVH and iPage. "All five had at least one serious vulnerability allowing a user account hijack," he told TechCrunch, with which he shared his findings before going public. The results of his vulnerability testing likely wouldn't fill customers with much confidence. The bugs, now fixed -- according to Yibelo's writeup -- represent cases of aging infrastructure, complicated and sprawling web-based back-end systems and companies each with a massive user base -- with the potential to go easily wrong. In all, the bugs could have been used to target any number of the collective two million domains under Endurance-owned Bluehost, Hostgator and iPage, DreamHost's one million domains and OVH's four million domains -- totaling some seven million domains.

A YouTube user who goes by Electronic Grenade has designed a computer mouse that is also a functional laptop. From a report: As detailed in a video published on Sunday, the computer mouse computer consists of a 3d-printed mouse, a Raspberry Pi microcontroller, a small keyboard, and a handful of components that were taken from a normal computer mouse. "Even though the screen is attached to the mouse, the sensitivity of the mouse makes it not that hard to follow along with what is happening on the screen," Electronic Grenade said in the video. Nevertheless, the mouse does have its faults. According to Electronic Grenade, a few resource intensive applications will occasionally cause the mouse computer to crash.

In a sea of 3D audio products and true-wireless earbuds, USB Type-C headphones were nowhere in sight at CES 2019. From a report: This absence isn't an accident, however. Rather, it's the deafening silence of an abandoned product category. While many looked to USB-C audio as the successor to the famed physical port, the available models aren't catching on, and they don't seem to be going anywhere. Their absence at CES 2019 doesn't paint a rosy picture of their future, either.

In general, it takes new standards quite a while to catch on, however, USB-C was thrust into the limelight far before its time. When Apple and Google ditched their headphone jacks, it limited the pool of audio peripherals to Bluetooth, or the very young USB-C category. Perhaps with a little more time and backing from a few more serious partners this could have matured alongside its older brother the TRRS plug, but it just wasn't to be. [...] One of the biggest issues that companies need to navigate pertains to source and peripheral device compatibility. USB Type-C headphone cables can either be active or passive -- or manifest as a dongle adapter. This inconsistency, paired with the fact that Audio Accessory Mode has yet to be universally supported, results in a barrage of compatibility issues. Hence why many users are unable to operate playback controls or use a headset's integrated microphone.

According to a report from HackenProof, a database containing resumes of over 200 million job seekers in China was exposed last month. "The leaked info included not just the name and working experience of people, but also their mobile phone number, email, marriage status, children, politics, height, weight, driver license, and literacy level as well," reports The Next Web. From the report: Bob Diachenko, Director of Cyber Risk Research at Hacken.io and bug bounty platform HackenProof, found an unprotected instance of MongoDB containing these resumes on December 28. Diachenko found the resumes in the open database search engines Shodan and BinaryEdge. The 854GB database didn't have any password protection and was open to anyone to read.

Diachenko wasn't able to identify who generated the database or who owned it, but a now-defunct GitHub code repository featured a code that used an identical data structure to the leaked database. The database contained scraped data from multiple Chinese classified websites like bj.58.com. However, in a blog post, the website's spokesperson denied the leak. Interestingly, the database was taken down as soon as Diachenko posted about the database on Twitter. Sadly, the MongoDB log showed at least a dozen IP addresses that read the instance before it went off the grid.

Danngggg writes: Many will remember Martin Gottesfeld since he was arrested on a speedboat coming from Cuba. He volunteered at trial that he and his wife had just been denied political asylum by Castro. Gottesfeld has said he did it to defend the life of an innocent child named Justina Pelletier. On Thursday, the same judge that over saw the Aaron Swartz case sentenced the Anonymous hacktivist to 10 years in federal prison for a DDoS of Boston Children's Hospital, Harvard-affiliated hospitals, and Wayside Youth and Family. The sentence included $440,000 in restitution, 3 years supervised release, and other conditions. The week before, Gottesfeld docketed a 690-page affidavit (including exhibits) documenting the judge's conflicts of interest and why he doesn't belong anywhere near the case. That's available on the FreeMartyG website. Local news spoke to his wife after the sentencing hearing as well.

One study found that 66% of tweets with links were posted by "suspected bots" -- with an even higher percentage for certain kinds of content. Now a new California law will require bots to disclose that they are bots.

But does that violate the bots' freedom of speech, asks Laurent Sacharoff, a law professor at the University of Arkansas. "Even though bots are abstract entities, we might think of them as having free speech rights to the extent that they are promoting or promulgating useful information for the rest of us," Sacharoff says. "That's one theory of why a bot would have a First Amendment free speech right, almost independent of its creators." Alternatively, the bots could just be viewed as direct extensions of their human creators. In either case -- whether because of an independent right to free speech or because of a human creator's right -- Sacharoff says, "you can get to one or another nature of bots having some kind of free speech right."

In previous Bulletin coverage, the author of the new California law dismisses the idea that the law violates free speech rights. State Sen. Robert Hertzberg says anonymous marketing and electioneering bots are committing fraud. "My point is, you can say whatever the heck you want," Hertzberg says. "I don't want to control one bit of the content of what's being said. Zero, zero, zero, zero, zero, zero. All I want is for the person who has to hear the content to know it comes from a computer. To me, that's a fraud element versus a free speech element."

Sacharoff believes that the issue of bots and their potential First Amendment rights may one day have its day in court. Campaigns, he says, will find that bots are helpful and that their "usefulness derives from the fact that they don't have to disclose that they're bots. If some account is retweeting something, if they have to say, 'I'm a bot' every time, then it's less effective. So sure I can see some campaign seeking a declaratory judgment that the law is invalid," he says. "Ditto, I guess, [for] selling stuff on the commercial side."

An anonymous reader quotes a report from Vox: More than 150 people who previously stayed in Marriott properties are suing the hotel chain in a federal class-action lawsuit, claiming that Marriott didn't do enough to protect them from a data breach that exposed more than 300 million guests' personal information, including names, credit card information, and passport numbers. The suit, which was filed Maryland federal district court on January 9, claims that Marriott did not adequately protect guest information before the breach and, once the breach had been discovered, "failed to provide timely, accurate, and adequate notice" to guests whose information may have been obtained by hackers.

According to the suit, Marriott's purchase of the Starwood properties [in 2016] is part of the problem. "This breach had been going on since 2014. In conducting due diligence to acquire Starwood, Marriott should have gone through and done an accounting of the cybersecurity of Starwood," Amy Keller, an attorney at DiCello Levitt & Casey who is representing the Marriott guests, told Vox. "In so doing, it should have caught -- at the very least -- that there was some suspicious activity concerning the database where a lot of consumer information was contained." Instead, Keller said, the breach continued for an additional two years after the acquisition, until Marriott caught it in September 2018. And even then, the suit claims, the company waited until November to tell guests about the breach.

Mondelez, the US food company that owns the Oreo and Cadbury brands, is suing its insurance company, Zurich, for refusing to pay out on a $100m claim for damage caused by the NotPetya cyber attack. From a report: The case will be the first serious legal dispute over how companies can recover the costs of a cyber attack [Editor's note: the article may be paywalled; alternative source], as insurance groups seek to tightly define their liabilities. "It's a pretty big deal. I've never seen an insurance company take this position," said Robert Stines, a cyber law specialist at the US law firm Freeborn. "It's going to send ripples through the insurance industry. Major companies are going to rethink what's in their policies." The NotPetya attack in the summer of 2017 crippled the computer systems of companies around the world, including Merck, the pharmaceuticals company, Reckitt Benckiser, the consumer group, and Maersk, the world's largest shipping group. It caused billions of dollars of damage and has been blamed by the US and the UK on Russian hackers attacking the Ukrainian government.

[...] According to the Mondelez court documents, Zurich initially worked to adjust the claim in the usual way and at one point even promised to make a $10m interim payment. But it later refused to pay, relying on an exclusion in the policy for "a hostile or warlike action" by a government or sovereign power or people acting for them. Mondelez described Zurich's refusal as "unprecedented" and is seeking $100m in damages. Both companies declined to comment on the case.

An anonymous reader quotes a report from The Independent: A video software firm has come up with a way to prevent people from sharing their account details for Netflix and other streaming services with friends and family members. UK-based Synamedia unveiled the artificial intelligence software at the CES 2019 technology trade show in Las Vegas, claiming it could save the streaming industry billions of dollars over the next few years. The AI system developed by Synamedia uses machine learning to analyze account activity and recognize unusual patterns, such as account details being used in two locations within similar time periods. The idea is to spot instances of customers sharing their account credentials illegally and offering them a premium shared account service that will authorize a limited level of password sharing. The company said it is already carrying out trials with a number of pay-TV operators but did not reveal which ones.

Amazon-owned Ring allowed employees to access customers' live camera feeds, according to a report from The Intercept. "Ring's engineers and executives have 'highly privileged access' to live camera feeds from customers' devices," reports 9to5Google. "This includes both doorbells facing the outside world, as well as cameras inside a person's home. A team tasked with annotating video to aid in object recognition captured 'people kissing, firing guns, and stealing.'" From the report: U.S. employees specifically had access to a video portal intended for technical support that reportedly allowed "unfiltered, round-the-clock live feeds from some customer cameras." What's surprising is how this support tool was apparently not restricted to only employees that dealt with customers. The Intercept notes that only a Ring customer's email address was required to access any live feed.

According to the report's sources, employees had a blase attitude to this potential privacy violation, but noted that they "never personally witnessed any egregious abuses." Meanwhile, a second group of Ring employees working on R&D in Ukraine had access to a folder housing "every video created by every Ring camera around the world." What's more, these employees had a "corresponding database that linked each specific video file to corresponding specific Ring customers." Also bothersome is Ring's reported stance towards encryption. Videos in that bucket were unencrypted due to the costs associated with implementation and "lost revenue opportunities due to restricted access." In response to the report, Ring said: "We have strict policies in place for all our team members. We implement systems to restrict and audit access to information. We hold our team members to a high ethical standard and anyone in violation of our policies faces discipline, including termination and potential legal and criminal penalties. In addition, we have zero tolerance for abuse of our systems and if we find bad actors who have engaged in this behavior, we will take swift action against them."

An anonymous reader quotes a report from ZDNet: A weather app that comes preinstalled on Alcatel smartphones contained malware that surreptitiously subscribed device owners to premium phone numbers behind their backs. The app, named "Weather Forecast-World Weather Accurate Radar," was developed by TCL Corporation, a Chinese electronics company that among other things owns the Alcatel, BlackBerry, and Palm brands. The app is one of the default apps that TCL installs on Alcatel smartphones, but it was also made available on the Play Store for all Android users --where it had been downloaded and installed more than ten million times. But at one point last year, both the app included on some Alcatel devices and the one that was available on the Play Store were compromised with malware. How the malware was added to the app is unclear. TCL has not responded to phone calls requesting comment made by ZDNet this week. The app reportedly harvested users' data and sent it to China. It collected geographic locations, email addresses, and IMEI codes, which it sent back to TCL.

Upstream, a UK-based mobile security firm, also found that "the malicious code hidden inside the app would also attempt to subscribe users to premium phone numbers that incurred large charges on users' phone bills," reports ZDNet. "All in all, the company says it detected and blocked over 27 million transaction attempts across seven markets, which would have created losses of around $1.5 million to phone owners if they hadn't been blocked."

Upstream notes that most of the behavior they've seen originated only from two types of smartphones: Pixi 4 and A3 Max models.

T-Mobile is beginning to roll out support for call verification technology, which will confirm that a phone call is actually coming from the number listed on caller ID. From a report: Now, if one T-Mobile subscriber calls another T-Mobile subscriber, the person receiving the call will see a message saying "Caller Verified" if they have a supported phone. Unfortunately, there's only one supported phone -- Samsung Galaxy Note 9 -- for the time being. Call verification won't put a stop to spammy phone calls, but it will start to help people identify which calls are actually coming from real people. As anyone with a phone knows, spammers have relentlessly spoofed local phone numbers in recent years, making it appear that you're getting an incoming call from someone you may know. Call verification is meant to combat that.