Andrei Zakharov, reporting for BBC: Hackers appear to have compromised and published private messages from at least 81,000 Facebook users' accounts. The perpetrators told the BBC Russian Service that they had details from a total of 120 million accounts, which they were attempting to sell, although there are reasons to be sceptical about that figure. Facebook said its security had not been compromised. And the data had probably been obtained through malicious browser extensions.

Facebook added it had taken steps to prevent further accounts being affected. The BBC understands many of the users whose details have been compromised are based in Ukraine and Russia. However, some are from the UK, US, Brazil and elsewhere. The hackers offered to sell access for 10 cents (8p) per account. However, their advert has since been taken offline. "We have contacted browser-makers to ensure that known malicious extensions are no longer available to download in their stores," said Facebook executive Guy Rosen. "We have also contacted law enforcement and have worked with local authorities to remove the website that displayed information from Facebook accounts."

TTL0 shares a report from The Times of Israel: Iranian infrastructure and strategic networks have come under attack in the last few days by a computer virus similar to Stuxnet but "more violent, more advanced and more sophisticated," and Israeli officials are refusing to discuss what role, if any, they may have had in the operation, an Israeli TV report said Wednesday. "Remember Stuxnet, the virus that penetrated the computers of the Iranian nuclear industry?" the report on Israel's Hadashot news asked. Iran "has admitted in the past few days that it is again facing a similar attack, from a more violent, more advanced and more sophisticated virus than before, that has hit infrastructure and strategic networks." The Iranians, the TV report went on, are "not admitting, of course, how much damage has been caused." On Sunday, Gholamreza Jalali, the head of Iran's civil defense agency, said Tehran had neutralized a new version of Stuxnet, Reuters reported. Stuxnet penetrated Iran's nuclear program, "taking control and sabotaging parts of its enrichment processes by speeding up its centrifuges," the report notes. We'll update this story when more details become available.

Two new zero-day vulnerabilities called "Bleeding Bit" have been revealed by security firm Armis, impacting Bluetooth Low-Energy (BLE) chips used in millions of Cisco, Meraki, and Aruba wireless access points (APs). "Developed by Texas Instruments (TI), the vulnerable BLE chips are used by roughly 70 to 80 percent of business wireless access points today by way of Cisco, Meraki and Aruba products," reports ZDNet. From the report: The first vulnerability, CVE-2018-16986, impacts Cisco and Meraki APs using TI BLE chips. Attacks can remotely send multiple benign BLE broadcast messages, called "advertising packets," which are stored on the memory of the vulnerable chip. As long as a target device's BLE is turned on, these packets -- which contain hidden malicious code to be invoked later on -- can be used together with an overflow packet to trigger an overflow of critical memory. If exploited, attackers are able to trigger memory corruption in the chip's BLE stack, creating a scenario in which the threat actor is able to access an operating system and hijack devices, create a backdoor, and remotely execute malicious code.

The second vulnerability, CVE-2018-7080, is present in the over-the-air firmware download (OAD) feature of TI chips used in Aruba Wi-Fi access point Series 300 systems. The vulnerability is technically a leftover development backdoor tool. This oversight, the failure to remove such a powerful development tool, could permit attackers to compromise the system by gaining a foothold into a vulnerable access point. "It allows an attacker to access and install a completely new and different version of the firmware -- effectively rewriting the operating system of the device," the company says. "The OAD feature doesn't offer a security mechanism that differentiates a "good" or trusted firmware update from a potentially malicious update."

A series of benchmark results have shown up on Geekbench for the new iPad Pro, and its new eight-core A12X Bionic chip is truly a powerhouse. From a report: The new iPad Pro achieved single-core and multi-core scores of 5,025 and 18,106 respectively based on an average of two benchmark results, making it by far the fastest iPad ever and comparable even to the performance of the latest 15-inch MacBook Pro models with Intel's six-core Core i7 chips. We've put together a chart that compares Geekbench scores of the new iPad Pro and various other iPad, Mac, and iPhone models.

That the new iPad Pro rivals the performance of the latest 15-inch MacBook Pro with a 2.6GHz six-core Core i7 processor is impressive, but even more so when you consider that the tablet starts at $799. The aforementioned MacBook Pro configuration is priced at $2,799, although with 512GB of storage. Even the new 11-inch iPad Pro with 512GB of storage is only $1,149, less than half that of the Core i7-equipped MacBook Pro.

Emil Protalinski, writing for VentureBeat: After upgrading to Android Pie, most users have either seen a slight improvement in battery life or reported no perceivable difference. But soon after we published our story, some users told us that they are experiencing the opposite: significantly higher battery drain after upgrading to Pie. We've been tracking this issue for the past few months, during which the Pixel 3 and Pixel 3 XL launched with Android Pie out-of-the-box and new device owners reported similar problems. Some Android Pie users simply don't expect their phones to make it through the day.

Users on Reddit, the Pixel forums, and Google's issue tracker have been discussing battery life issues on existing devices after upgrading to Android Pie, and some even on new devices (although there are naturally fewer of those cases). VentureBeat was able to independently confirm the issue on a Pixel 2 XL and a Pixel 3 -- we sent the details to Google. Given that Adaptive Battery is the main feature highlight when it comes to battery improvement in Android Pie, many suspected it could be the culprit. Users have reported, however, that turning it off didn't help the situation much, if at all. We were also able to independently verify that Adaptive Battery is not the cause. Adaptive Battery is only available in Pie, but in our tests battery life only drained faster with the feature off. We did, however, confirm that the problem is unique to Android Pie. Users have reported significant battery drain when their phones are idle, anywhere between 10 percent to 20 percent drained in an hour.

With iOS 12.1, Apple introduced a bunch of new features like Group FaceTime and dozens of new emoji. But the company also elected to add a controversial new performance management feature to the iPhone 8, iPhone 8 Plus, and iPhone X. From a report: For the uninitiated, back in December 2017, Apple confirmed that it would sometimes slow down older iPhones through a software update in order to prevent unexpected shutdowns. The result was that certain models -- iPhone 6, 6 Plus, 6S, 6S Plus, 7, and 7 Plus -- would often perform poorly after being updated to the newest version of iOS. Users had long suspected Apple was throttling older iPhones, but it wasn't until Geekbench published an expose that the company publicly admitted it was, indeed, slowing down older iPhones -- albeit, for a good reason. Apple said in its explanation of the throttling issue that its goal was "to deliver the best experience for customers" and essentially argued the practice of throttling was a feature -- not a bug as it had been reported. Apple's solution was to give iPhone owners some extra control over the feature and offer a reduced cost for battery replacements.

US prosecutors are preparing new charges against a former CIA coder who was indicted earlier this year in June for leaking classified CIA material to WikiLeaks, in what later become known as the Vault7 leaks. From a report: According to new court documents filed late Wednesday, October 31, US prosecutors plan to file three new charges against Joshua Schulte for allegedly leaking more classified data while in detention at the New York Metropolitan Correctional Center (MCC). Prosecutors say they first learned of Schulte's behavior back in May, when they found out that "Schulte had distributed the Protected Search Warrant Materials to his family members for purposes of dissemination to other third parties, including members of the media." The prosecution held a court hearing in May and initially warned the suspect about his actions, a warning they found Schulte ignored. The US government says that "in or about early October 2018, the Government learned that Schulte was using one or more smuggled contraband cellphones to communicate clandestinely with third parties outside of the MCC." A search of his housing unit performed by FBI agents revealed "multiple contraband cellphones (including at least one cellphone used by Schulte that is protected with significant encryption); approximately 13 email and social media accounts (including encrypted email accounts); and other electronic devices."

An anonymous reader quotes a report from ZDNet: Google announced today four new security features for securing Google accounts. These four updates are meant to bolster protections before and after users sign into accounts, but also in the case of recovering after a hack. According to Google's Jonathan Skelker, the first of these protections that Google has rolled out today comes into effect even before users start typing their username and password. In the coming future, Skelker says that Google won't allow users to sign into accounts if they disabled JavaScript in their browser. The reason is that Google uses JavaScript to run risk assessment checks on the users accessing the login page, and if JavaScript is disabled, this allows crooks to pass through those checks undetected. This change is likely to impact only a very small number of users -- around 0.01 percent according to Google's data -- but it will likely impact bots harder, as many of them run through headless browsers where this feature is turned off for performance reasons. Google also plans to pull data from Google Play Protect and list all malicious apps that are still installed on a user's Android smartphone. Google's Jonathan Skelker says they will be notifying you "whenever you share any data from your Google Account," expanding on the notifications it sends when you've granted access to sensitive information, like Gmail data or your Google Contacts.

"Last but not least is a security feature that Google plans to use after an account hack," reports ZDNet. "This feature is already live and is a new set of procedures for regaining access and re-securing compromised profiles. The procedure is detailed in this Google support page, and besides just helping users regain access to accounts, it will also help them check financial activity related to Google Pay accounts, review new files added to Gmail or Drive, and secure other accounts at other services that are tied to the main Google account."

Security researcher David Buchanan has found that Twitter image uploads can be polyglot files, meaning they can be valid simultaneously in multiple formats, such as a .jpg, a .rar archive and a .zip archive. From a report: Using some Python code he wrote, he created a thumbnail image of William Shakespeare overlaid with the words, "Unzip Me" and posted it to Twitter. The .jpg image is also a valid .zip file, so if you download it, you can unzip it and extract the contents, a multipart .rar archive of the text of Shakespeare's plays. [...] Twitter performs some processing on uploaded images, which has the potential to mess with the data. But Buchanan found that his multi-format file survived this process. It may be that image itself (excluding the rather bulky metadata) is light enough not to trigger any compression or post-upload processing.

Apple has pulled an update for its smartwatches after some owners complained the software -- watchOS 5.1 -- had caused their devices to stop working. From a report: The problem appears to have baffled the firm's repair staff, and there appears to be no way at present for owners to restore the products themselves. Several have said they have been told they need to send in the devices for a fix. Apple said it intended to release a revised update soon. Those affected reported that their watches had become stuck in a state showing the Apple logo -- but nothing else -- on their screens. One owner of a newly released Series 4 model said he had been told it would take the firm's repair staff up to a week to decide whether his device needed to be repaired or replaced.

Etcetera writes: Fresh on the heels of the IBM purchase announcement, Red Hat released RHEL 7.6 today. Business press release is here and full release notes are here. It's been a busy week for Red Hat, as Fedora 29 also released earlier this morning. No doubt CentOS and various other rebuilds will begin their build cycles shortly. The release offers improved security, such as support for the Trusted Platform Module (TPM) 2.0 specification for security authentication. It also provides enhanced support for the open-source nftables firewall technology.

"TPM 2.0 support has been added incrementally over recent releases of Red Hat Enterprise Linux 7, as the technology has matured," Steve Almy, principal product manager, Red Hat Enterprise Linux at Red Hat, told eWEEK. "The TPM 2.0 integration in 7.6 provides an additional level of security by tying the hands-off decryption to server hardware in addition to the network bound disk encryption (NBDE) capability, which operates across the hybrid cloud footprint from on-premise servers to public cloud deployments."

An anonymous reader quotes a report from TechCrunch: Buried in Apple's latest range of MacBooks -- including the MacBook Pro out earlier this year and the just-announced MacBook Air -- is the new T2 security chip, which helps protect the device's encryption keys, storage, fingerprint data and secure boot features. Little was known about the chip until today. According to its newest published security guide, the chip comes with a hardware microphone disconnect feature that physically cuts the device's microphone from the rest of the hardware whenever the lid is closed. "This disconnect is implemented in hardware alone, and therefore prevents any software, even with root or kernel privileges in macOS, and even the software on the T2 chip, from engaging the microphone when the lid is closed," said the support guide. The camera isn't disconnected, however, because its "field of view is completely obstructed with the lid closed." Apple said the new feature adds a "never before seen" level of security for its Macs, without being quite so blunt as to say: Macs get malware too.

Apple's new dual-SIM function, which lets iPhone XS, XS Max, and XR owners use two cellular subscriptions at once, will come to new phones today. But the current implementation will have a huge negative impact on Verizon subscribers who choose to use dual-SIM in the US, PCMag reported Tuesday, citing engineers who have seen early builds of the software. From the report: Dual-SIM, a popular feature in the rest of the world, is largely unknown in the US. Generally, it's used for three things: roaming internationally, where you get a foreign SIM and also keep your local number; having home and work lines on one phone; or trying out multiple domestic services to see which one is better. Apple's dual-SIM relies on one physical SIM and an "electronic SIM" or eSIM, which is activated from a menu or an app. AT&T, T-Mobile, and Verizon promised eSIM support at launch, but neither Verizon nor T-Mobile will support the eSIM right now. T-Mobile is working on it and will support eSIM when its software is ready, the carrier told me.

[...] The problem comes when a physical Verizon SIM is pushed into the "secondary" position while the phone is in the US. Under the current software build, that kicks the Verizon connection down to 2G CDMA, an old network with significantly less coverage than the current LTE network. The old network also has no MMS support, and certainly wouldn't work for FaceTime. So Verizon customers may find they have perfectly good coverage with their SIM in "primary" position, but no signal and fewer features with the SIM in "secondary." When I asked Verizon about the CDMA network, the company said that 30 percent of its cell sites were now LTE-only, so there would be a definite coverage hit.

An anonymous reader quotes a report from TechCrunch: A U.S. government network was infected with malware thanks to one employee's "extensive history" of watching porn on his work computer, investigators have found. The audit, carried out by the U.S. Department of the Interior's inspector general, found that a U.S. Geological Survey (USGS) network at the EROS Center, a satellite imaging facility in South Dakota, was infected after an unnamed employee visited thousands of porn pages that contained malware, which downloaded to his laptop and "exploited the USGS' network." Investigators found that many of the porn images were "subsequently saved to an unauthorized USB device and personal Android cell phone," which was connected to the employee's government-issued computer. Investigators found that his Android cell phone "was also infected with malware." The findings were made public in a report earlier this month but buried on the U.S. government's oversight website and went largely unreported.

An anonymous reader quotes a report from Motherboard: Friday, the Librarian of Congress and U.S. Copyright Office renewed several key exemptions (and added a few new ones) to the Digital Millennium Copyright Act. This go round, they've extended some essential exemptions ensuring that computer security researchers won't be treated like nefarious criminals for their contributions to society. As part of an effort to keep the DMCA timely, Congress included a so-called "safety valve" dubbed the Section 1201 triennial review process that, every three years, mandates that activists and concerned citizens beg the Copyright Office and the Librarian of Congress to craft explicit exemptions from the law to ensure routine behavior won't be criminalized.

The exemptions still have some caveats. Specifically, the Copyright Office ruling only applies to "use exemptions," not "tools exemptions" -- meaning security researchers still can't release things like pen-testing tools that bypass DRM, or even publish technical papers exploring how to bypass bootloaders or other Trusted Platform Modules to test the security of the systems behind them. But other modest changes to the rules were incredibly helpful, notes Blake Reid, Associate Clinical Professor at Colorado Law. Specifically, the new exemption removes a "device limitation" from previous exemptions that potentially limited researchers to investigating software only on "consumer" devices; hindering their ability to investigate security vulnerabilities in things like the cryptographic hardware used in banking applications, networking equipment, and industrial control systems. The new exemption also modified the "controlled environment limitation" from the previous exemption, which was often read to imply that researchers had to conduct their work in a formal laboratory, potentially hindering research into things like integrated building systems like internet-connected HVAC systems.

An anonymous reader quotes a report from ZDNet: The Trump administration on Monday announced it was banning U.S. exports to a Chinese semiconductor firm named Fujian Jinhua Integrated Circuit Company, citing national security concerns. In a statement released by the U.S. Department of Commerce (DoC), officials said the Chinese chipmaker posed "a significant risk of being or becoming involved, in activities contrary to the national security or foreign policy interests of the United States." DoC officials are now barring US companies from selling any products to Fujian Jinhua, which was recently nearing completion of a new dynamic random access memory (DRAM) factory project. "When a foreign company engages in activity contrary to our national security interests, we will take strong action to protect our national security. Placing Jinhua on the Entity List will limit its ability to threaten the supply chain for essential components in our military systems," said Wilbur Ross, Secretary of Commerce.

Those of you who detest display notches will find this bug especially unpleasant. A small number of Pixel 3 XL users are reportedly experiencing a bug where an additional notch appears on the right side of the display. Android Police reports: Turns out that it's a real-life bug experienced by several users, including Jessie Burroughs, Kyle Gutschow, and UrAvgConsumer. We're not sure what's causing it, but it could be something to do with the screen rotation setting getting a bit confused about its orientation. In all three of the examples we've seen, the users reported that the issue went away after a restart or fiddling with the developer settings, so at least it's not a permanent problem. Anyone who bought a Pixel 3 XL probably decided that the notch didn't bother them that much, but we're not sure how they'd feel about another one showing up unannounced. Google is aware of this bug and says a fix is "coming soon."

With the in-development Linux 4.20 kernel, it is now effectively VLA-free. From a report: The variable-length arrays (VLAs) that can be convenient and part of the C99 standard but can have unintended consequences. VLAs allow for array lengths to be determined at run-time rather than compile time. The Linux kernel has long relied upon VLAs in different parts of the kernel -- including within structures -- but going on for months now (and years if counting the kernel Clang'ing efforts) has been to remove the usage of variable-length arrays within the kernel. The problems with them are:
1. Using variable-length arrays can add some minor run-time overhead to the code due to needing to determine the size of the array at run-time.
2. VLAs within structures is not supported by the LLVM Clang compiler and thus an issue for those wanting to build the kernel outside of GCC, Clang only supports the C99-style VLAs.
3. Arguably most importantly is there can be security implications from VLAs around the kernel's stack usage.

An anonymous reader writes: Windows Defender is the first antivirus to gain the ability to run inside a sandbox environment, Microsoft said in an announcement. In software design, a "sandbox" is a security mechanism that works by separating a process inside a tightly controlled area of the operating system that gives that process access to limited disk and memory resources. The idea is to prevent bugs and exploit code from spreading from one process to another, or to the underlying OS.

"We're in the process of gradually enabling this capability for Windows insiders and continuously analyzing feedback to refine the implementation," Microsoft said in a celebratory blog post. Users who can't wait until Microsoft finishes testing the feature can also enable it right now. Support for Windows Defender running inside a sandbox environment has been silently added since Windows 10 version 1703. To enable it right now, Windows 10 users can follow these steps.

Earlier this week, The New York Times reported that the Russians and the Chinese were eavesdropping on President Donald Trump's personal cellphone and using the information gleaned to better influence his behavior. This should surprise no one, writes Bruce Schneier. From a story: Security experts have been talking about the potential security vulnerabilities in Trump's cellphone use since he became president. And President Barack Obama bristled at -- but acquiesced to -- the security rules prohibiting him from using a "regular" cellphone throughout his presidency. Three broader questions obviously emerge from the story. Who else is listening in on Trump's cellphone calls? What about the cellphones of other world leaders and senior government officials? And -- most personal of all -- what about my cellphone calls?

There are two basic places to eavesdrop on pretty much any communications system: at the end points and during transmission. This means that a cellphone attacker can either compromise one of the two phones or eavesdrop on the cellular network. Both approaches have their benefits and drawbacks. The NSA seems to prefer bulk eavesdropping on the planet's major communications links and then picking out individuals of interest. In 2016, WikiLeaks published a series of classified documents listing "target selectors": phone numbers the NSA searches for and records. These included senior government officials of Germany -- among them Chancellor Angela Merkel -- France, Japan, and other countries.

Other countries don't have the same worldwide reach that the NSA has, and must use other methods to intercept cellphone calls. We don't know details of which countries do what, but we know a lot about the vulnerabilities. Insecurities in the phone network itself are so easily exploited that 60 Minutes eavesdropped on a U.S. congressman's phone live on camera in 2016. Back in 2005, unknown attackers targeted the cellphones of many Greek politicians by hacking the country's phone network and turning on an already-installed eavesdropping capability. The NSA even implanted eavesdropping capabilities in networking equipment destined for the Syrian Telephone Company. Alternatively, an attacker could intercept the radio signals between a cellphone and a tower. Encryption ranges from very weak to possibly strong, depending on which flavor the system uses. Don't think the attacker has to put his eavesdropping antenna on the White House lawn; the Russian Embassy is close enough.