A previously unknown hacker group is behind a mounting number of breaches that have been reported by local governments across the US. From a report: In a report published today, US cyber-security vendor FireEye has revealed that this yet-to-be-identified hacker group has been breaking into Click2Gov servers and planting malware that stole payment card details. Click2Gov is a popular self-hosted payments solution, a product of US software supplier Superion. It is sold primarily to US local governments, and you can find a Click2Gov server installed anywhere from small towns to large metropolitan areas, where it's used to handle payments for utility bills, permits, fines, and more.

FireEye says this new hacker group has been attacking Click2Gov portals for almost a year. The company's investigators believe hackers are using one or more vulnerabilities in one of Click2Gov's components --the Oracle WebLogic Java EE application server-- to gain a foothold and install a web shell named SJavaWebManage on hacked portals. Forensic evidence suggests the hackers are using this web shell to turn on Click2Gov's debug mode, which, in turn, starts logging payment transactions, card details included.

Microsoft has officially unveiled "Windows Sandbox," a feature that was expected to be unveiled next year. Windows Sandbox, the company says, creates "an isolated, temporary desktop environment" where users can run potentially suspicious software. From a report: Windows Sandbox is an isolated desktop environment which functions much like a virtual machine; any software installed to it is completely sandboxed from the host operating system. Aimed at businesses, enterprises and security-conscious home users, Windows Sandbox will be part of Windows 10 Pro and Windows 10 Enterprise. It is not clear exactly when the feature will debut, but it could make an appearance in Windows 10 19H1 next year.

The company touts the following features of Windows Sandbox in a detailed blog post introducing the new feature:
Part of Windows -- everything required for this feature ships with Windows 10 Pro and Enterprise. No need to download a VHD!
Pristine -- every time Windows Sandbox runs, it's as clean as a brand-new installation of Windows.
Disposable -- nothing persists on the device; everything is discarded after you close the application.
Secure -- uses hardware-based virtualization for kernel isolation, which relies on the Microsoft's hypervisor to run a separate kernel which isolates Windows Sandbox from the host.
Efficient -- uses integrated kernel scheduler, smart memory management, and virtual GPU.

Google engineers are currently working on a Chrome browser update that will block malicious websites from hijacking the browser's history and, indirectly, the Back button. From a report: The issue at hand is a well-known tactic often seen employed by many shady sites across the Internet. A user would visit a website, then he'd accidentally click or tap on an ad, and be taken to a new page. But when the user presses the Back button to go back to the previous page, the browser just reloads the same page over and over again, keeping the user trapped on the ad page. [...] Recent source code updates to the Chromium project, the open-source browser engine behind the Chrome browser, reveal that Google engineers are planning to crack down on this type of abusive behavior. These code updates will allow Chrome to detect when browser history entries have been generated by user interaction, or by an automated method.

An anonymous reader shares a report: If you often find yourself needing to remove the backgrounds from photos but don't have the time to manually do it, you might want to bookmark Remove.bg. It's a simple free website that automatically removes the backgrounds from photos in just 5 seconds with a single click.

Simply use the button on the homepage to select a photo from your computer (or you can also enter a photo's URL on the Web). The website then processes the photo and shows the result in moments. Under the result is a button that lets you download it as a PNG image with a transparent background.

Even if you explicitly tell Facebook to not track your location, it says it will still use your IP address to track your location. Kashmir Hill, reporting for Gizmodo: Aleksandra Korolova has turned off Facebook's access to her location in every way that she can. She has turned off location history in the Facebook app and told her iPhone that she "Never" wants the app to get her location. She doesn't "check-in" to places and doesn't list her current city on her profile.

Despite all this, she constantly sees location-based ads on Facebook. She sees ads targeted at "people who live near Santa Monica" (where she lives) and at "people who live or were recently near Los Angeles" (where she works as an assistant professor at the University of Southern California). When she traveled to Glacier National Park, she saw an ad for activities in Montana, and when she went on a work trip to Cambridge, Massachusetts, she saw an ad for a ceramics school there. Facebook was continuing to track Korolova's location for ads despite her signaling in all the ways that she could that she didn't want Facebook doing that.

[...] "There is no way for people to opt out of using location for ads entirely," said a Facebook spokesperson by email. "We use city and zip level location which we collect from IP addresses and other information such as check-ins and current city from your profile to ensure we are providing people with a good service -- from ensuring they see Facebook in the right language, to making sure that they are shown nearby events and ads for businesses that are local to them."

Amazon may have turned off its Oracle data warehouse in favor of Amazon Web Services database technology, but no one else in their right mind would, Oracle's outspoken co-founder and CTO Larry Ellison says. From a report: "We have a huge technology leadership in database over Amazon," Ellison said on a conference call following the release of Oracle's second quarter financial results. "In terms of technology, there is no way that... any normal person would move from an Oracle database to an Amazon database." During last month's AWS re:Invent conference, AWS CTO Werner Vogels gave an in-the-weeds talk explaining why Amazon turned off its Oracle data warehouse. In a clear jab at Oracle, Vogels wrote off the "90's technology" behind most relational databases. Cloud native databases, he said, are the basis of innovation.

The remarks may have gotten under Ellison's skin. Moving from Oracle databases to AWS "is just incredibly expensive and complicated," he said Monday. "And you've got to be willing to give up tons of reliability, tons of security, tons of performance... Nobody, save maybe Jeff Bezos, gave the command, 'I want to get off the Oracle database." Ellison said that Oracle will not only hold onto its 50 percent relational database market share but will expand it, thanks to the combination of Oracle's new Generation 2 Cloud infrastructure and its autonomoius database technology. "You will see rapid migration of Oracle from on-premise to the Oracle public cloud," he said. "Nobody else is going to go through that forced march to go on to the Amazon database."

An anonymous reader writes from a report via ZDNet: No data encryption, no antivirus programs, no multi-factor authentication mechanisms, and 28-year-old unpatched vulnerabilities are just some of the cyber-security failings described in a security audit of the U.S.' ballistic missile system released on Friday by the U.S. Department of Defense Inspector General (DOD IG). The report [PDF] was put together earlier this year, in April, after DOD IG officials inspected five random locations where the Missile Defense Agency (MDA) had placed ballistic missiles part of the Ballistic Missile Defense System (BMDS) -- a DOD program developed to protect U.S. territories by launching ballistic missiles to intercept enemy nuclear rockets.

Here is a summary of the findings: (1) Multi-factor authentication wasn't used consistently. (2) One base didn't even bother to configure its network to use multifactor authentication. (3) Patches weren't applied consistently. (4) One base didn't patch systems for flaws discovered in 1990. (5) Server racks weren't locked. (6) Security cameras didn't cover the entire base. (7) Door sensors showed doors closed when they were actually open. (8) Base personnel didn't challenge visitors on bases without proper badges, allowing access to secure areas. (9) One base didn't use antivirus or other security software. (10) Data stored on USB thumb drives was not encrypted. (11) IT staff didn't keep a database of who had access to the system and why.

hackingbear writes: Germany's IT watchdog has expressed skepticism about calls for a boycott of Chinese telecoms giant Huawei, saying it has seen no evidence the firm could use its equipment to spy for Beijing, news weekly Spiegel reported. "For such serious decisions like a ban, you need proof," the head of Germany's Federal Office for Information Security (BSI), Arne Schoenbohm, told Spiegel, adding that his agency had no such evidence. The U.S. has been pressuring German authorities for months to drop Huawei, according to people familiar with the matter, but the Germans have asked for more specific evidence to demonstrate the security threat. German authorities and telecom executives have yet to turn up any evidence of security problems with Chinese equipment vendors, according to a person familiar with the matter.

Separately, at a (secret lobster-themed) meeting in Canada in July 2018, espionage chiefs from Australia, Canada, New Zealand, the U.K. and the U.S. -- all signatories to a treaty on signals intelligence, and often referred to as the "Five Eyes" -- agreed to do their best to contain the global growth of Chinese telecom (vendor) Huawei, the Australian Financial Review reported (paywalled). On the other hand, documents leaked by WikiLeaks and Snowden claimed that the NSA, the leader of the Five Eyes, tapped German Chancellery for decades and bugged routers made by Cisco, the leading American networking equipment vendor.

Joshua Bakita, a former software engineering intern on the Edge team at Microsoft, says one of the reasons why Microsoft had to ditch EdgeHTML rendering engine in Edge browser and switch to Chromium was to keep up with the changes (some of which were notorious) that Google pushed to its sites. These changes were designed to ensure that Edge and other browsers could not properly run Google's sites, he alleged. Responding to a comment, he wrote: "For example, they may start integrating technologies for which they have exclusive, or at least 'special' access. Can you imagine if all of a sudden Google apps start performing better than anyone else's?" This is already happening. I very recently worked on the Edge team, and one of the reasons we decided to end EdgeHTML was because Google kept making changes to its sites that broke other browsers, and we couldn't keep up.

For example, they recently added a hidden empty div over YouTube videos that causes our hardware acceleration fast-path to bail (should now be fixed in Win10 Oct update). Prior to that, our fairly state-of-the-art video acceleration put us well ahead of Chrome on video playback time on battery, but almost the instant they broke things on YouTube, they started advertising Chrome's dominance over Edge on video-watching battery life. What makes it so sad, is that their claimed dominance was not due to ingenious optimization work by Chrome, but due to a failure of YouTube. On the whole, they only made the web slower.

Now while I'm not sure I'm convinced that YouTube was changed intentionally to slow Edge, many of my co-workers are quite convinced -- and they're the ones who looked into it personally. To add to this all, when we asked, YouTube turned down our request to remove the hidden empty div and did not elaborate further. And this is only one case.

AmiMoJo shares a report: Taylor Swift used facial recognition technology at her live performances so that technicians running the system could then check those face scans against a private database of her stalkers. There is now big demand for serious security at live events the size of a Taylor Swift concert. There have been so many bombings and mass shootings at music concerts over the past year to even remember without Googling. Fear of being killed at a music concert is something people factor in to the decision to buy tickets and go to live events. The demand for security is real.

An anonymous reader writes: A new variant of the Shamoon malware was discovered on the network of an Italian and UAE oil and gas company. While the damage at the UAE firm is currently unknown, the malware has been confirmed to have destroyed files on about ten percent of the Italian company's PC fleet. Shamoon is one of the most dangerous strains of malware known to date. It was first deployed in two separate incidents that targeted the infrastructure of Saudi Aramco, Saudi Arabia's largest oil producer, in 2012 and 2016. During those incidents, the malware wiped files and replaced them with propaganda images (burning U.S. flag and body of Alan Kurdi). The 2012 attack was devastating in particular, with Shamoon wiping data on over 30,000 computers, crippling the company's activity for weeks. Historically, the malware has been tied to the Iranian regime, but it's unclear if Iranian hackers were behind these latest attacks. This new Shamoon version was revealed to the world when an Italian engineer uploaded the malware on VirusTotal, triggering detections at all major cyber-security firms across the globe.

An anonymous reader quotes Inc: Our attention in the workplace is a precious resource that often falls victim to tools like email, Slack, and so on, which bring a nonstop supply of things to read, things to respond to, things to file, things to loop others in on, things to follow up on, and in general, things to do. This "always on" dynamic has roots in a desire for increased workplace collaboration and productivity, but as is so often the case, it turns out there is a balance to be struck for optimal results. New research shows that groups who collaborate less often may be better at problem solving....

In a study titled "How Intermittent Breaks in Interaction Improve Collective Intelligence", the authors use a standardized problem-solving test to measure the contrast between time spent in collaboration mode against the quality and quantity of problem solving results. The group with no interaction predictably had the highest options for solutions, but those solutions were of lower overall quality. The group with high interaction had higher quality solutions, but less variety and a lower likelihood to find the optimal solution. The intermittent collaboration groups found the desirable middle ground to balance out the pros/cons of the no interaction and high interaction groups, leading them to become the most successful problem solvers.
The article warns of a "collaboration drain", suggesting managers pay closer attention to when collaboration is (and isn't) necessary. "Once upon a time in the land of business, people primarily communicated through conversations, meetings, and internally circulated printed memos. In the absence of email, Internet, cell phones, and CRMs there was a repeating cadence of connection, then disconnection, even while in the office."

"In this case, 'disconnected' really amounts to uninterrupted -- and able to focus."

Thursday a bug report complained that the source code for OpenJDK, the free and open-source implementation of Java, "has too many swear words." An anonymous reader writes: "There are many instances of swear words inside OpenJDK jdk/jdk source, scattered all over the place," reads the bug report. "As OpenJDK is used in a professional context, it seems inappropriate to leave these 12 instances in there, so here's a changeset to remove them."
IBM software developer (and OpenJDK team member and contributor) Adam Farley responded that "after discussion with the community, three determinations were reached":

• "Damn" and "Crap" are not swear words.

• Three of the four f-bombs are located in jszip.js, which should be corrected upstream (will follow up).

• The f-bomb in BitArray.java, as well as the rude typo in SoftChannel.java, *are* swear words and should be removed to resolve this work item.

He promised a new webrev would be uploaded to reflect these determinations, and the bug has been marked as "resolved."

According to CNBC, T-Mobile and Sprint are expecting their merger to be approved by a U.S. national security panel as early as next week, after their respective parent companies said they would consider dropping Huawei. From the report: U.S. government officials have been pressuring T-Mobile's German majority owner, Deutsche Telekom, to stop using Huawei equipment, the sources said, over concerns that Huawei is effectively controlled by the Chinese state and its network equipment may contain "back doors" that could enable cyber espionage, something which Huawei denies. That pressure is part of the national security review of T-Mobile's $26 billion deal to buy U.S. rival Sprint, the sources said.

The Committee on Foreign Investment in the United States (CFIUS) has been conducting a national security review of the Sprint deal, which was announced in April. Negotiations between the two companies and the U.S. government have not been finalized and any deal could still fall through, the sources cautioned. Sprint's parent, SoftBank Group, plans to replace 4G network equipment from Huawei with hardware from Nokia and Ericsson, Nikkei reported on Thursday, without citing sources.

In addition to relying on Windows Insiders, employees, and willing participants for testing updates, Microsoft is pushing patches before they are known to be stable to regular users too if they opt to click the "check for updates" button on their own, the company said. From a report: In a blog post by Michael Fortin, Corporate Vice President for Windows, it is made clear that home users are intentionally being given updates that are not necessarily ready for deployment. Many power users are familiar with Patch Tuesday. On the second Tuesday of each month, Microsoft pushes out a batch of updates at 10:00 a.m. Pacific time on this day containing security fixes, bug patches, and other non-security fixes. Updates pushed out as part of Patch Tuesday are known as "B" release since it happens during the second week of the month.

During the third and fourth weeks of the month are where things begin to get murky. Microsoft's "C" and "D" releases are considered previews for commercial customers and power users. No security fixes are a part of these updates, but for good reasoning. Microsoft has come out to directly say that some users are the guinea pigs for everyone else. In some fairness to Microsoft, C and D updates are typically only applied when a user manually checks for updates by clicking the button buried within Settings. However, if end users really wanted to be a part of testing the latest features, the Windows Insider Program is designed exactly for that purpose. Further reading: Windows 10's 'Check for updates' button may download beta code.

Chinese hackers are breaching Navy contractors to steal everything from ship-maintenance data to missile plans, triggering a top-to-bottom review of cyber vulnerabilities, WSJ reported Friday, citing officials and experts. From the report: A series of incidents in the past 18 months has pointed out the service's weaknesses, highlighting what some officials have described as some of the most debilitating cyber campaigns linked to Beijing. Cyberattacks affect all branches of the armed forces but contractors for the Navy and the Air Force are viewed as choice targets for hackers seeking advanced military technology, officials said. Navy contractors have suffered especially troubling breaches over the past year, one U.S. official said. The data allegedly stolen from Navy contractors and subcontractors often is highly sensitive, classified information about advanced military technology, according to U.S. officials and security researchers. The victims have included large contractors as well as small ones, some of which are seen as lacking the resources to invest in securing their networks. One major breach of a Navy contractor, reported in June, involved the theft of secret plans to build a supersonic anti-ship missile planned for use by American submarines, according to officials.

A week after releasing v5.0 major update, WordPress has pushed the first security patch for its popular CMS service. ZDNet: Released hours ago, WordPress version 5.0.1 fixes seven security vulnerabilities (some of which allow site takeover) but also plugs a pretty serious privacy leak. The latter was found by the authors of the popular Yoast SEO plugin, who discovered that in some cases the activation screen for new users could end up being indexed by Google. With specially crafted Google searches, an attacker could find these pages and collect users' email addresses, and in some rare cases, default-generated passwords. This leak could have catastrophic consequences if the user has an admin role or if the user didn't change his default password, as is regularly advised.

A corporate-issued laptop lifted from a Lenovo employee in Singapore contained a cornucopia of unencrypted payroll data on staff based in the Asia Pacific region, news outlet The Register reports. From the report: Details of the massive screw-up reached us from Lenovo staffers, who are simply bewildered at the monumental mistake. Lenovo has sent letters of shame to its employees confessing the security snafu. "We are writing to notify you that Lenovo has learned that one of our Singapore employees recently had the work laptop stolen on 10 September 2018," the letter from Lenovo HR and IT Security, dated 21 November, stated.

"Unfortunately, this laptop contained payroll information, including employee name, monthly salary amounts and bank account numbers for Asia Pacific employees and was not encrypted." Lenovo employs more than 54,000 staff worldwide, the bulk of whom are in China.

An anonymous reader quotes a report from Ars Technica: A recent phishing campaign targeting U.S. government officials, activists, and journalists is notable for using a technique that allowed the attackers to bypass two-factor authentication protections offered by services such as Gmail and Yahoo Mail, researchers said Thursday. The event underscores the risks of 2fa that relies on one-tap logins or one-time passwords, particularly if the latter are sent in SMS messages to phones.

Attackers working on behalf of the Iranian government collected detailed information on targets and used that knowledge to write spear-phishing emails that were tailored to the targets' level of operational security, researchers with security firm Certfa Lab said in a blog post. The emails contained a hidden image that alerted the attackers in real time when targets viewed the messages. When targets entered passwords into a fake Gmail or Yahoo security page, the attackers would almost simultaneously enter the credentials into a real login page. In the event targets' accounts were protected by 2fa, the attackers redirected targets to a new page that requested a one-time password. "In other words, they check victims' usernames and passwords in realtime on their own servers, and even if 2 factor authentication such as text message, authenticator app or one-tap login are enabled they can trick targets and steal that information too," Certfa Lab researchers wrote. "We've seen [it] tried to bypass 2fa for Google Authenticator, but we are not sure they've managed to do such a thing or not," the Certfa representative wrote. "For sure, we know hackers have bypassed 2fa via SMS."

An anonymous reader writes: A new variant of the Shamoon malware was discovered on the network of an Italian and UAE oil and gas companies. While the damage at the UAE firm is currently unknown, the malware has been confirmed to have destroyed files on about ten percent of the Italian company's PC fleet.

Shamoon is one of the most dangerous strains of malware known to date. It was first deployed in two separate incidents that targeted the infrastructure of Saudi Aramco, Saudi Arabia's largest oil producer, in 2012 and 2016. During those incidents, the malware wiped files and replaced them with propaganda images (burning US flag, body of Alan Kurdi). The 2012 attack was devastating in particular, with Shamoon wiping data on over 30,000 computers, crippling the company's activity for weeks. Historically, the malware has been tied to the Iranian regime, but it's unclear if Iranian hackers were behind this latest attacks. This new Shamoon version was revealed to the world when an Italian engineer uploaded the malware on VirusTotal, triggering detections at all major cyber-security firms across the globe.