Among the hotel patrons snarled in the fallout of MGM Resorts' cyberattack was -- unfortunately for the company -- one very high-profile figure: Lina Khan, the chair of the US Federal Trade Commission. Bloomberg News: On Tuesday night, she was among the 45 people waiting to check in at the MGM Grand along the Las Vegas strip as staff worked to manually fulfill everyone's reservation, according to people familiar with the matter. When Khan and her staff got to the front of the line, an employee at the desk asked them to write down their credit card information on a piece of paper.

As the leader of the federal agency that, among other things, ensures companies protect consumer data wrote down her details, Khan asked the worker: How exactly was MGM managing the data security around this situation? The desk agent shrugged and said he didn't know, according to a senior aide who was traveling with Khan and described the experience to Bloomberg as surreal. Khan was among the thousands of MGM hotel patrons inconvenienced in the aftermath of the hack, which was said to be orchestrated by a group of hackers known as Scattered Spider. Days after the incident, many of the company's websites -- including its reservation system -- were still displaying error messages, some slot machines at its casinos across the country are still out of service and employees were handling processes manually.

Iranian hackers have hacked dozens of companies in the defense, satellite and pharmaceutical sectors this year using a fairly unsophisticated, blunt hacking technique, Microsoft warned in a new report. From a report: Many of these companies are based in the U.S., and the breaches come amid heavy U.S. sanctions targeting Iranian oil and petrochemical sales. Microsoft said Thursday that Iranian hacking group Peach Sandstorm -- which other firms also refer to as APT33, Elfin or Refined Kitten -- has been breaking into these companies by trying to guess multiple user accounts' passwords.

The password-spraying campaign took place between February and July this year, Microsoft found. In some cases, the hackers were able to exfiltrate data, and in others, they just lurked on the networks to see what intelligence they could gather. The Iranian group targeted thousands of companies as part of this monthslong campaign -- but was able to access only a small percentage of those organizations, Microsoft said.

A security company is calling out a feature in Google's authenticator app that it says made a recent internal network breach much worse. ArsTechnica: Retool, which helps customers secure their software development platforms, made the criticism on Wednesday in a post disclosing a compromise of its customer support system. The breach gave the attackers responsible access to the accounts of 27 customers, all in the cryptocurrency industry. The attack started when a Retool employee clicked a link in a text message purporting to come from a member of the company's IT team. It warned that the employee would be unable to participate in the company's open enrollment for health care coverage until an account issue was fixed. The text arrived while Retool was in the process of moving its login platform to security company Okta.

Most of the targeted Retool employees took no action, but one logged in to the linked site and, based on the wording of the poorly written disclosure, presumably provided both a password and a temporary one-time password, or TOTP, from Google authenticator. Shortly afterward, the employee received a phone call from someone who claimed to be an IT team member and had familiarity with the "floor plan of the office, coworkers, and internal processes of our company." During the call, the employee provided an "additional multi-factor code." It was at this point, the disclosure contended, that a sync feature Google added to its authenticator in April magnified the severity of the breach because it allowed the attackers to compromise not just the employee's account but a host of other company accounts as well.

If you crack the screen on the Pixel Watch, getting it officially repaired by Google isn't on the cards. From a report: Several Pixel Watch owners have vented their frustrations about the inability to replace cracked screens, both on Reddit and in Google support forums. The Verge has also reviewed an official Google support chat from a reader who broke their Pixel Watch display after dropping the wearable. In it, a support representative states that Google "doesn't have any repair centers or service centers" for the device. "At this moment, we don't have any repair option for the Google Pixel Watch. If your watch is damaged, you can contact the Google Pixel Watch Customer Support Team to check your replacement options," Google spokesperson Bridget Starkey confirmed to The Verge.

GoDaddy needs to cut more jobs, reduce the tech budget, and address why it is falling short of financial targets outlined at its shareholder day in 2022, or the board should consider exploring a sale of the business. From a report: This is the view from activist investor Starboard Blue LLP, GoDaddy's third largest shareholder and one which is agitating for change and a seat on the corporation's board, something it has so far failed to secure. An open letter [PDF] to GoDaddy's top brass starts off friendly enough, with Starboard Value managing member Peter Feld describing the business as a "one-stop shop for micro- and small-businesses looking to develop a web presence."

Feld says Starboard Value invested in the stock, a move it made public in early 2022, on the basis of opportunities for strong revenue growth, "meaningful margin expansion" and a "more appropriate capital allocation strategy." "Unfortunately, despite each of these opportunities remaining, over the last 18 months we have been disappointed by GoDaddy's operational, financial and stock price performance," the letter adds. At the investor day, GoDaddy projected compound annual growth in revenue of 10 percent between 2022 and 2024, as well as 15 percent EBITDA, 20 percent free cashflow per share and $3 billion in share buybacks. Further reading: Alphabet Selling Google Domains Assets To Squarespace.

An anonymous reader quotes a report from Engadget: The ALPHV/BlackCat ransomware group claimed responsibility for the MGM Resorts cyber outage on Tuesday, according to a post by malware archive vx-underground. The group claims to have used common social engineering tactics, or gaining trust from employees to get inside information, to try and get a ransom out of MGM Resorts, but the company reportedly refuses to pay. The conversation that granted initial access took just 10 minutes, according to the group.

"All ALPHV ransomware group did to compromise MGM Resorts was hop on LinkedIn, find an employee, then call the Help Desk," the organization wrote in a post on X. Those details came from ALPHV, but have not been independently confirmed by security researchers. The international resort chain started experiencing outages earlier this week, as customers noticed slot machines at casinos owned by MGM Resorts shut down on the Las Vegas strip. As of Wednesday morning, MGM Resorts still shows signs that it's experiencing downtime, like continued website disruptions. In a statement on Tuesday, MGM Resorts said: "Our resorts, including dining, entertainment and gaming are currently operational." However, the company said Wednesday that the cyber incident has significantly disrupted properties across the United States and represents a material risk to the company.

"[T]he major credit rating agency Moody's warned that the cyberattack could negatively affect MGM's credit rating, saying the attack highlighted 'key risks' within the company," reports CNBC. "The company's corporate email, restaurant reservation and hotel booking systems remain offline as a result of the attack, as do digital room keys. MGM on Wednesday filed a 8-K report with the Securities and Exchange Commission noting that on Tuesday the company issued a press release 'regarding a cybersecurity issue involving the Company.'" MGM's share price has declined more than 6% since Monday.

An anonymous reader quotes a report from Ars Technica: A download site surreptitiously served Linux users malware that stole passwords and other sensitive information for more than three years until it finally went quiet, researchers said on Tuesday. The site, freedownloadmanager[.]org, offered a benign version of a Linux offering known as the Free Download Manager. Starting in 2020, the same domain at times redirected users to the domain deb.fdmpkg[.]org, which served a malicious version of the app. The version available on the malicious domain contained a script that downloaded two executable files to the /var/tmp/crond and /var/tmp/bs file paths. The script then used the cron job scheduler to cause the file at /var/tmp/crond to launch every 10 minutes. With that, devices that had installed the booby-trapped version of Free Download Manager were permanently backdoored.

After accessing an IP address for the malicious domain, the backdoor launched a reverse shell that allowed the attackers to remotely control the infected device. Researchers from Kaspersky, the security firm that discovered the malware, then ran the backdoor on a lab device to observe how it behaved. "This stealer collects data such as system information, browsing history, saved passwords, cryptocurrency wallet files, as well as credentials for cloud services (AWS, Google Cloud, Oracle Cloud Infrastructure, Azure)," the researchers wrote in a report on Tuesday. "After collecting information from the infected machine, the stealer downloads an uploader binary from the C2 server, saving it to /var/tmp/atd. It then uses this binary to upload stealer execution results to the attackers' infrastructure."

Mozilla has released emergency security updates to fix a critical zero-day vulnerability exploited in the wild, impacting its Firefox web browser and Thunderbird email client. From a report: Tracked as CVE-2023-4863, the security flaw is caused by a heap buffer overflow in the WebP code library (libwebp), whose impact spans from crashes to arbitrary code execution. "Opening a malicious WebP image could lead to a heap buffer overflow in the content process. We are aware of this issue being exploited in other products in the wild," Mozilla said in an advisory published on Tuesday. Mozilla addressed the exploited zero-day in Firefox 117.0.1, Firefox ESR 115.2.1, Firefox ESR 102.15.1, Thunderbird 102.15.1, and Thunderbird 115.2.2. Even though specific details regarding the WebP flaw's exploitation in attacks remain undisclosed, this critical vulnerability is being abused in real-world scenarios.

China flagged security problems with iPhones while saying it isn't barring purchases, the government's first comments on the topic after news reports that authorities are moving to restrict the use of Apple products in sensitive departments and state-owned companies. From a report: "We noticed that there have been many media reports about security incidents concerning Apple phones," Chinese Foreign Ministry spokeswoman Mao Ning told a regular press briefing in Beijing on Wednesday, without elaborating. China plans to expand a ban on the use of iPhones to a plethora of state-backed companies and agencies, Bloomberg News has reported, a sign of growing challenges for Apple in its biggest foreign market and global production base. Several agencies have begun instructing staff not to bring their iPhones to work. "China has not issued laws and regulations to ban the purchase of Apple or foreign brands' phones," Mao said, adding that the government attaches "great importance" to security and that all companies operating in China need to abide by its laws and regulations.

Inditex is racing to iron bugs out of a new anti-shoplifting system for its Zara stores, slightly delaying its rollout partly because the security tags were easy to identify and remove in initial tests, Bloomberg reported Tuesday, citing people familiar with the matter. From the report: Chief Executive Officer Oscar Garcia Maceiras unveiled the new technology in March and pledged to roll it out for tests in all Zara stores worldwide over the summer. The system relies on tiny chips known as RFID, doing away with the hard plastic tags on garments that require checkout clerks to remove them. The new technology has run into teething issues. Staff in several countries have raised concerns to management that the technology may actually make theft easier, according to the people, who asked not to be identified.

Intel has unveiled Thunderbolt 5, the latest iteration of its a standard aimed at enabling super-fast connectivity. From a report: With Thunderbolt 5, Intel promises a significant leap in connectivity speed and bandwidth, delivering enhanced performance for computer users. The unveiling of a prototype laptop and dock accompanied the announcement, providing a glimpse into the future of Thunderbolt technology.

Thunderbolt 5 will offer an impressive 80 gigabits per second (Gbps) of bi-directional bandwidth, enabling lightning-fast data transfer and connectivity. Additionally, with the introduction of Bandwidth Boost, Thunderbolt 5 will reach up to 120 Gbps, ensuring an unparalleled display experience for users. These advancements represent two to three times more bandwidth than Thunderbolt 4. And it can deliver up to 240 watts of power.

Microsoft has made it clear: it will ax third-party printer drivers in Windows. From a report: The death rattle will be lengthy, as the timeline for the end of servicing stretches into 2027 -- although Microsoft noted that the dates will be subject to change. There is, after all, always that important customer with a strange old printer lacking Mopria support.

Mopria is part of the Windows' teams justification for removing support. Founded in 2013 by Canon, HP, Samsung and Xerox, the Mopria Alliance's mission is to provide universal standards for printing and scanning. Epson, Lexmark, Adobe and Microsoft have also joined the gang since then. Since Windows 10 21H2, Microsoft has baked Mopria support into the flagship operating system, with support for devices connected via the network or USB, thanks to the Microsoft IPP Class driver. Microsoft said: "This removes the need for print device manufacturers to provide their own installers, drivers, utilities, and so on."

An anonymous reader shared this report from Bloomberg: China-linked hackers breached the corporate account of a Microsoft engineer and are suspected of using that access to steal a valuable key that enabled the hack of senior U.S. officials' email accounts, the company said in a blog post. The hackers used the key to forge authentication tokens to access email accounts on Microsoft's cloud servers, including those belonging to Commerce Secretary Gina Raimondo, Representative Don Bacon and State Department officials earlier this year.

The U.S. Cybersecurity and Infrastructure Security Agency and Microsoft disclosed the breach in June, but it was still unclear at the time exactly how hackers were able to steal the key that allowed them to access the email accounts. Microsoft said the key had been improperly stored within a "crash dump," which is data stored after a computer or application unexpectedly crashes...

The incident has brought fresh scrutiny to Microsoft's cybersecurity practices.
Microsoft's blog post says they corrected two conditions which allowed this to occur. First, "a race condition allowed the key to be present in the crash dump," and second, "the key material's presence in the crash dump was not detected by our systems." We found that this crash dump, believed at the time not to contain key material, was subsequently moved from the isolated production network into our debugging environment on the internet connected corporate network. This is consistent with our standard debugging processes. Our credential scanning methods did not detect its presence (this issue has been corrected).

After April 2021, when the key was leaked to the corporate environment in the crash dump, the Storm-0558 actor was able to successfully compromise a Microsoft engineer's corporate account. This account had access to the debugging environment containing the crash dump which incorrectly contained the key. Due to log retention policies, we don't have logs with specific evidence of this exfiltration by this actor, but this was the most probable mechanism by which the actor acquired the key.

On August 30th the University of Michigan announced it had finally restored its internet connectivity and Wi-Fi network, according to the Ann Arbor News, "after several days of outages caused by a 'significant security concern,' officials said." The outage coincided with the first days of the new school year, although "classes continued through the outage." The internet was shut down on 1:45 p.m. on Sunday, Aug. 27, after the Information Assurance team at the university identified a security concern, according to previous reporting. The Information Assurance team fights cybersecurity threats and malicious actors... The investigation into the security issue is ongoing and no other information will be released, said Santa Ono, president of University of Michigan.
But a local CBS station heard some theories from cybersecurity experts: "The fact that they took their systems down, like proactively took their systems down, is the indication that it is a cybersecurity incident," said co-founder and CTO of SensCy Dave Kelly. "The reason why you do that is that you don't want it to spread further."

"They probably didn't know to what extent they'd been compromised," senior penetration tester and ethical hacker at NetWorks Group Chris Neuwirth said. "They probably didn't know how many accounts were compromised or the initial entry point that the threat actor used to gain access into the network." Sources close to the investigation told CBS News Detroit that U-M detected malware on its Wi-Fi network and decided to shut it down in response.

So, did the school avoid a disaster? Neuwirth thinks it very well could have. "They likely had very robust backups and data recover, plans, procedures in place that helped them make the decision very confidently and rapidly," he said. "Four days in that they're already bringing up their systems tells me that it's likely that a lot of what they had been preparing for worked."

Kelly said these types of incidents are on the rise. "There's been a large increase in cybersecurity incidents," he said. It's been trending up, quite frankly, for the last several years. It used to be that these threat actors were targeting the government and Fortune 500 companies, but they've started to, more and more over the years, look at universities."
Thanks to long-time Slashdot reader regoli for sharing the news.

A web caching issue resulted in some Wyze security camera owners being able to see webcam feeds that weren't theirs. The Verge reports: Earlier on Friday, users on Reddit made posts about the issue. "Went to check on my cameras and they are all gone be replaced with a new one... and this isn't mine!" wrote one user. "Apologies if this is your house / dog... I don't want it showing up as much as you don't want it!" "I am able to click the events tab and see ALL the events on this random person's camera INSIDE their house," wrote another. "I don't know why, but I can see someone else's camera," wrote another.

Each thread has comments from other Reddit users reporting similar issues. Shockingly, I even saw some instances of people claiming they saw the same cameras that other people did. The user reports indicated that they were seeing the other feeds through Wyze's web viewer at view.wyze.com.

An anonymous reader quotes a report from TechCrunch: Apple released security updates on Thursday that patch two zero-day exploits -- meaning hacking techniques that were unknown at the time Apple found out about them -- used against a member of a civil society organization in Washington, D.C., according to the researchers who found the vulnerabilities. Citizen Lab, an internet watchdog group that investigates government malware, published a short blog post explaining that last week they found a zero-click vulnerability -- meaning that the hackers' target doesn't have to tap or click anything, such as an attachment -- used to target victims with malware.

The researchers said the vulnerability was used as part of an exploit chain designed to deliver NSO Group's malware, known as Pegasus. "The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim," Citizen Lab wrote. Once they found the vulnerability, the researchers reported it to Apple, which released a patch on Thursday, thanking Citizen Lab for reporting them. Based on what Citizen Lab wrote in the blog post, and the fact that Apple also patched another vulnerability and attributed its finding to the company itself, it appears Apple may have found the second vulnerability while investigating the first. Citizen Lab researcher John Scott-Railton says Apple's Lockdown Mode would have blocked the exploits found in this case. Lockdown Mode is an opt-in feature introduced in iOS 16 that gives users the option to temporarily switch off or limit features for security purposes. According to Apple, it "should be used only if you believe you may be targeted by a highly sophisticated cyberattack, such as by a private company developing state-sponsored mercenary spyware."

The days of signing on the dotted line may be numbered -- at least in Australia. From a report: The federal government has announced it is taking statutory declarations into the digital age, saying it will accept electronic signatures and video link witnessing from next year. It makes permanent a change introduced during the pandemic, when attending a justice of the peace (JP) for a statutory declaration -- a practice that goes back to the 19th century -- was forbidden under lockdown restrictions.

Legislation introduced this week by the federal attorney general, Mark Dreyfus, will also allow people to digitally execute a statutory declaration using the online platform myGov and the myGovID Digital ID. Dreyfus says the bill is intended to keep with the changing ways of Australians. "This bill will respond to how Australians want and expect to engage and communicate digitally with government by providing options to make commonwealth statutory declarations facilitated by technology," he says. "This bill is an important milestone in driving the digitisation of government services."

Researchers at digital watchdog group Citizen Lab say they found spyware they linked to Israeli firm NSO that exploited a newly discovered flaw in Apple devices. From a report: While inspecting the Apple device of an employee of a Washington-based civil society group last week, Citizen Lab said it found the flaw had been used to infect the device with NSO's Pegasus spyware, it said in a statement.

Bill Marczak, senior researcher at Citizen Lab, said the attacker likely made a mistake during the installation which is how Citizen Lab found the spyware. Citizen Lab said Apple confirmed to them that using the high security feature "Lockdown Mode" available on Apple devices blocks this particular attack. The flaw allowed compromise of iPhones running the latest version of iOS (16.6) without any interaction from the victim, the digital watchdog said. The new update fixes this vulnerability.

Birmingham City Council, the largest local authority in Europe, has declared itself in financial distress after troubled Oracle project costs ballooned from $25 million to around $125.5 million. The Register reports: Contributing to the publication of a legal Section 114 Notice, which says the $4.3 billion revenue organization is unable to balance the books, is a bill of up to $954 million to settle equal pay claims. In a statement today, councillors John Cotton and Sharon Thompson, leader and deputy leader respectively, said the authority was also hit by financial stress owing to issues with the implementation of its Oracle IT system. The council has made a request to the Local Government Association for additional strategic support, the statement said.

In May, Birmingham City Council said it was set to pay up to $125.5 million for its Oracle ERP system -- potentially a fourfold increase on initial estimated expenses -- in a project suffering from delays, cost over-runs, and a lack of controls. After grappling with the project to replace SAP for core HR and finance functions since 2018, the council reviewed the plan in 2019, 2020, and again in 2021, when the total implementation cost for the project almost doubled to $48.5 million. The project, dubbed Financial and People, was "crucial to an organisation of Birmingham City Council's size," a spokesperson said at the time. Cotton said the system had a problem with how it was "tracking our financial transactions and HR transactions issues as well. That's got to be fixed," he said.

Earlier this year, one insider told The Register that Oracle Fusion, the cloud-based ERP system the council is moving to, "is not a product that is suitable for local authorities, because it's very much geared towards a manufacturing/trading organization." They said the previous SAP system had been heavily customized to meet the council's needs and it was struggling to recreate these functions in Oracle.

According to Mozilla's *Privacy Not Included project, every major car brand fails to adhere to the most basic privacy and security standards in new internet-connected models, and all 25 of the brands Mozilla examined flunked the organization's test. Gizmodo reports: Mozilla found brands including BMW, Ford, Toyota, Tesla, and Subaru collect data about drivers including race, facial expressions, weight, health information, and where you drive. Some of the cars tested collected data you wouldn't expect your car to know about, including details about sexual activity, race, and immigration status, according to Mozilla. [...] The worst offender was Nissan, Mozilla said. The carmaker's privacy policy suggests the manufacturer collects information including sexual activity, health diagnosis data, and genetic data, though there's no details about how exactly that data is gathered. Nissan reserves the right to share and sell "preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes" to data brokers, law enforcement, and other third parties.

Other brands didn't fare much better. Volkswagen, for example, collects your driving behaviors such as your seatbelt and braking habits and pairs that with details such as age and gender for targeted advertising. Kia's privacy policy reserves the right to monitor your "sex life," and Mercedes-Benz ships cars with TikTok pre-installed on the infotainment system, an app that has its own thicket of privacy problems. The privacy and security problems extend beyond the nature of the data car companies siphon off about you. Mozilla said it was unable to determine whether the brands encrypt any of the data they collect, and only Mercedes-Benz responded to the organization's questions.

Mozilla also found that many car brands engage in "privacy washing," or presenting consumers with information that suggests they don't have to worry about privacy issues when the exact opposite is true. Many leading manufacturers are signatories to the Alliance for Automotive Innovation's "Consumer Privacy Protection Principles (PDF)." According to Mozilla, these are a non-binding set of vague promises organized by the car manufacturers themselves. Questions around consent are essentially a joke as well. Subaru, for example, says that by being a passenger in the car, you are considered a "user" who has given the company consent to harvest information about you. Mozilla said a number of car brands say it's the drivers responsibility to let passengers know about their car's privacy policies -- as if the privacy policies are comprehensible to drivers in the first place. Toyota, for example, has a constellation of 12 different privacy policies for your reading pleasure.