Eliana Willis

More stories

  • 75 Shares189 Views

    in Information Technology

    Brazil sees improvement in data breaches

    Written by

    Angelica Mari, Contributing Editor

    Angelica Mari
    Contributing Editor

    Angelica Mari is a Brazil-based technology journalist. She started working at age 15 as a computer instructor and started writing professionally about technology two years later.

    Full Bio

    Brazil has seen an improvement in its data breach situation, with an 80% decrease in the number of cases seen in the first three months of 2022, according to new research by cybersecurity company Surfshark. Over 285,000 Brazilians were breached between January and March, placing Brazil in the 12th position in the ranking of most breached countries globally. That compares with the situation in the last quarter of 2021, when Brazil occupied the fifth spot on the list with 1.45 million breached accounts, with major incidents involving organizations such as the Ministry of Health and Experian.

    According to the research, Russia topped the list of breached individual accounts in the first quarter of 2022, with more than 3.5 million users affected. The US ranks second on the list, followed by Poland, France, and India. On the other hand, data management incidents involving large companies continue to emerge in Brazil. For example, last week, the company running the network of McDonald’s restaurants in Latin America told some of its customers that their data could have been exposed after an incident involving one of its third-party suppliers.Arcos Dorados sent an email to some of its customers on Sunday (17) saying some of their data – including names, addresses, emails, telephone numbers, and social security numbers – was potentially exposed after the event. On the other hand, the firm said no sensitive data was exposed in the incident and included two email addresses customers could use to get in touch. Contacted by ZDNet, the company said that when it became aware of what had happened, it took the appropriate measures and contacted consumers that had their data exposed – the local data protection legislation requires companies to do so. Moreover, Arcos Dorados said it has also informed the National Data Protection Authority (ANPD). “Arcos Dorados repudiates this criminal activity and is working continuously to strengthen measures to protect its customers’ data, including reviewing and constantly updating security systems. We regret the situation and are providing communication channels to clarify any questions consumers might have”, the company added, without disclosing the name of the supplier that had exposed the data.The company isn’t new to major data exposure incidents. In 2019, Brazilian cybersecurity website The Hack reported that an unprotected Elasticsearch environment managed by an Arcos Dorados supplier had exposed over 2.3 million sensitive data records, including data from over 1 million McDonald’s employees.

    ZDNet Recommends More

  • 125 Shares139 Views

    in Information Technology

    This sneaky phishing attack tries to steal your Facebook password

    A sneaky phishing campaign aims to steal passwords from Facebook users – including administrators of company Facebook Pages. Detailed by cybersecurity researchers at Abnormal Security, the attack begins with a phishing email claiming to be from ‘The Facebook Team’, which warns that the user’s account “might be disabled and your page might be removed” due to repeatedly posting content that has been reported as infringing the rights of another user. The victim is invited to appeal the report by clicking on a link that the security researchers said goes to a Facebook post – and within this post there’s another link that directs users to a separate website in order to make their “appeal”.

    As part of the fake appeals process, the user is asked to provide sensitive information, including their name and email address. Before submitting the form, the user is also asked to enter their Facebook password. SEE: Multi-factor authentication: How to enable 2FA to step up your securityAll this information is sent to the attacker, who can use it to log in to the victim’s Facebook page, collect information from their account and potentially lock them out of it. If the victim re-uses their Facebook email address and password for other websites and applications, the attacker can access those too. One of the reasons phishing attacks like this are successful is because they create a sense of urgency.”This is often enough to convince recipients to provide their personal information, particularly if they are using their Facebook account for business purposes,” said Rachelle Chouinard, threat intelligence analyst at Abnormal Security.  What made this particular phishing campaign interesting to the security researchers was that it connected to a post on Facebook and that there was a link to a credential-phishing site within the post, which was disguised as a form to request an appeal.However, while the phishing email and phishing domain might have looked legitimate at first glance, there were clues that would have suggested that something might be off.  For example, while the email contained Facebook branding and claimed to be from Facebook itself, the sender email address was not related to Facebook at all. In addition to this, attempting to reply to the sender email directs messages to an unrelated Gmail address. The language of the email is designed to create fear in the victim, scaring them into losing their account. It’s unlikely an actual online service will send an email like this, but if you receive a message and do get worried, don’t click the link in the email. Instead, log in to the website directly. If something is wrong with your account, you’ll be able to find out there – without handing your password to cyber criminals. SEE: These are the problems that cause headaches for bug bounty huntersZDNet contacted Facebook and the company pointed to advice to users on how to identify and report phishing attacks. Facebook’s Help Centre says anyone who thinks that their account has been phished should report it, change their password, and – in the security settings – log out of any devices that they don’t recognise.  It’s also recommended that users turn on multi-factor authentication to increase account security against unauthorised logins.  ZDNet also contacted Google – the company said the Gmail account used as part of the campaign has now been removed. MORE ON CYBERSECURITY More

  • 188 Shares179 Views

    in Information Technology

    FBI: This ransomware written in the Rust programming language has hit at least 60 targets

    The BlackCat ransomware gang, known for being the first to use ransomware written in the Rust programming language, has compromised at least 60 organizations worldwide since March 2022, the Federal Bureau of Investigation (FBI) says in a new alert. BlackCat, which also goes by the name ALPHV, is a relatively new ransomware-as-a-service gang that security researchers believe is related to the more established BlackMatter (aka Darkside) ransomware gang that hit US fuel distributor Colonial Pipeline last May. 

    ZDNet Recommends

    BlackCat appeared in November 2021 and was created by compromise experts or ‘access brokers’ that have sold access to multiple RaaS groups, including BlackMatter, according to Cisco’s Talos researchers. SEE: These are the problems that cause headaches for bug bounty huntersAs ZDNet reported in February, BlackCat has hit several high-profile companies since December, including Swiss airport management service Swissport and two German oil suppliers. While much of the group’s efforts have been focused on striking several European critical infrastructure firms, Cisco notes in a March report that more than 30% of BlackCat compromises have targeted US firms. “As of March 2022, BlackCat/ALPHV ransomware as a service (RaaS) had compromised at least 60 entities worldwide and is the first ransomware group to do so successfully using Rust, considered to be a more secure programming language that offers improved performance and reliable concurrent processing,” the FBI says in its alert detailing BlackCAT/ALPHV indicators of compromise. “BlackCat-affiliated threat actors typically request ransom payments of several million dollars in Bitcoin and Monero but have accepted ransom payments below the initial ransom demand amount. Many of the developers and money launderers for BlackCat/ALPHV are linked to Darkside/BlackMatter, indicating they have extensive networks and experience with ransomware operations,” it continues. The BlackCat gang uses previously compromised user credentials to gain initial access to the victim’s system. The group then compromises Microsoft Active Directory user and administrator accounts and uses the Windows Task Scheduler to configure Group Policy Objects to deploy the ransomware. BlackCat also uses legitimate Windows tools – such as Microsoft Sysinternals, as well as PowerShell scripts – to disable security features in anti-malware tools, launch ransomware executables including on MySQL databases, and copy ransomware to other locations on a network. The group practices double extortion by stealing data prior to encrypting it in order to threaten victims with a leak in the event they don’t pay a ransom demand.       Cisco said it was unlikely the BlackCat gang or affiliates were using an Exchange flaw. However, Trend Micro researchers last week claimed to have identified BlackCat exploiting the Exchange bug CVE-2021-31207 during an investigation. That was one of the ProxyShell Exchange bugs discovered in mid-2021.      BlackCat has versions that work on Windows and Linux, as well as VMware’s ESXi environment, notes Trend Micro.”In this incident, we identified the exploitation of CVE-2021-31207. This vulnerability abuses the New-MailboxExportRequest PowerShell command to export the user mailbox to an arbitrary file location, which could be used to write a web shell on the Exchange Server,” the firm said. SEE: Google: We’re spotting more zero-day bugs than ever. But hackers still have it too easyThe Cybersecurity and Infrastructure Security Agency is urging organizations to review the FBI’s alert.The FBI is seeking information from the public about BlackCat compromises. It wants “any information that can be shared, to include IP logs showing callbacks from foreign IP addresses, Bitcoin or Monero addresses and transaction IDs, communications with the threat actors, the decryptor file, and/or a benign sample of an encrypted file.”As Windows Task Scheduler is commonly used by attackers to hide malicious activity within seemingly normal admin tasks, the FBI recommends organizations review Task Scheduler for unrecognized scheduled tasks, as well as to check domain controllers, servers, workstations, and active directories for new or unrecognized user accounts. More

  • 138 Shares199 Views

    in Networking

    Radia Perlman, who made LANs work, honored in 'Hidden Heroes' series

    Written by

    Tiernan Ray, Contributing Writer

    Tiernan Ray
    Contributing Writer

    Tiernan Ray has been covering technology and business for 27 years. He was most recently technology editor for Barron’s where he wrote daily market coverage for the Tech Trader blog and wrote the weekly print column of that name.

    Full Bio

    Computer science classes “drove me crazy,” said Perlman. “Mathematical thinking is always very clear.”
    Tiernan Ray for ZDNet
    The computer network on which you’re working and playing functions because Radia Perlman figured out how to prevent computer network disasters. She did it in one afternoon.Nearly 40 ago, Perlman’s boss at Digital Equipment Corporation, then a titan of the computer world, challenged her to find a way that computer networks could scale across multiple network segments spanning offices, cities, and regions.

    “He asked me on a Friday, and right before he was going away on vacation for a week, so he would be unavailable, just to make it extra challenging,” recalled Perlman. Undaunted, Perlman hit upon a solution later the same day. “I realized that night, ‘Oh, my god, it’s trivial,'” said Perlman, who has a disarming way of turning complex achievements into no big deal. “Yeah, you just think about it the right way; I knew just how to do it.”By Tuesday, Perlman had finished writing up the technical details of the spec for what would come to be known as spanning tree protocol, or STP, a key “layer two” technology for local area networks. “I spent the remainder of the week working on the poem that goes along with it,” she said.Perlman put her ode to spanning tree, “Algorhyme” (which deftly reconstitutes Joyce Kilmer’s “Trees” in exact meter) on the front page of her spec:I think that I shall never seeA graph more lovely than a tree.A tree whose crucial propertyIs loop-free connectivity.A tree which must be sure to spanSo packets can reach every LAN.First the Root must be selected.By ID it is elected.Least cost paths from Root are traced.In the tree these paths are placed.A mesh is made by folks like meThen bridges find a spanning tree.Perlman recited the poem by heart to a group of reporters and admirers Thursday night in New York’s Meat Packing District, where she was honored as the subject of a multi-part series, “Hidden Heroes,” exploring the unsung innovators of computer technology. Published by the software development consultancy Netguru, the series is being compiled this year by noted technology reporter Steven Johnson, author of books such as Extra Life: A Short History of Living Longer and How We Got to Now. Johnson interviewed Perlman onstage. Johnson paid special thanks to the staff of Netguru, many of whom came to New York City this week from the company’s headquarters in Poznań, Poland. Netguru’s CEO, Marek Talarczyk, thanked the hidden heroes back home contending with the effects of Russia’s war in Ukraine, especially those who are helping over two million Ukrainian refugees who have entered Poland.Talarczyk explained the inspiration for Hidden Heroes as giving credit where credit is due. He related his own experience growing up enchanted by technologies that made the internet possible.”We honor business leaders such as Elon Musk, but we don’t always pay attention to those who started those technologies,” said Talarczyk.”Because innovation has generated such vast fortunes, when we think about world-changing ideas, our attention is drawn to the shiny objects of wealthy people,” said technology writer Steven Johnson. 
    Tiernan Ray for ZDNet
    “It’s high time we pay tribute to those software pioneers.”Johnson echoed the sentiment and said, “Because innovation has generated such vast fortunes, when we think about world-changing ideas, our attention is drawn to the shiny objects of wealthy people.” “Sometimes innovation happens at a lower level,” added Johnson, referencing a realm of almost invisible technology that “just works,” such as networking protocols underlying the internet. “We want to make those invisible breakthroughs visible, that’s the ambition.”  Perlman, who studied under AI pioneer Seymour Papert at MIT, first earning an undergraduate degree and later a PhD, is an unlikely computer science hero. “You hear about these engineers who grow up taking things apart, but I was never like that,” Perlman told the audience. “I never took anything apart because I was afraid I would break it.””But I was always the best in math and science,” she recalled. Perlman’s strategy early on was to take on the hardest science problems, starting with physics. “I got as far as quantum mechanics, and then I was out of there,” switching to mathematics and later to computer science. “That’s the usual path people take: physics, math, computer science, and then humanities.””[I had} no idea what I wanted to do, I was interested, kind of, in anything,” she said, “as long as it didn’t involve computers!””We honor business leaders such as Elon Musk, but we don’t always pay attention to those who started those technologies,” said Netguru CEO Marek Talarczyk.
    Tiernan Ray for ZDNet
    Mathematics thinking was “clear,” she said, but computer science classes never made any sense. “They would drive me crazy,” she said. “A professor would wax rhapsodic about object-oriented programming, and I didn’t understand, and then at some point, I’d realize, ‘Oh! You’re just saying the program should have a library!'”Perlman was drafted into programming by a teaching assistant at MIT who was eager to help a young person learn the art, given that an unskilled draftee would be cheaper to employ for programming tasks than a trained programmer. She was one of only a handful of women in the MIT dorms in an era of a one-to-fifteen gender ratio.”The school was full of these incredibly shy, awkward, sensitive boys who had never talked to a girl before,” said Perlman. “You would just say hello, and they would get all excited — “a girl talked to me” — and think they were going to get married. I felt so incredibly bad about that!”

    As a reluctant computer programmer, Perlman nevertheless discovered an ability to cut through the complexity and find foundational solutions to computer science problems. “My superpower is that I have no memory,” she explained. “I have to understand things so deeply that I can figure them out from a couple of concepts, and I get rid of all irrelevant details.” Most programmers, she observed, would do something like the opposite; they’d just start coding, working out details first.Perlman, who wrote one of the foundational textbooks that is required reading in networking, observes the discipline with dry wit. At Digital Equipment, for example, the networking technology she helped create (DECNet) was deemed “boring” by customers.”I said, ‘I’ll put knobs on it to make it more exciting, and if you touch them, nothing bad happens because all the knobs have the same setting!'” Her impulse, she said, was always to simplify. “I hate gadgets,” said Perlman. “I want to design things for people like me; I wanted you to be able to just plug it together and it works.” In many of the emerging settings for technology among DEC’s customers, she noted, ordinary people had to be able to depend on the network. “When you have a network in a hospital, doctors shouldn’t have to be network people,” she said.”I’m proud of making networks much more self-configuring so you don’t have to worry about them.”Her crowning achievement, the spanning tree protocol, was an exercise in elegance, a distillation of the problem down to a single, eidetic concept. The problem was that early computer networks consisted of individual machines with no knowledge of how they were all connected to one another. To pass a message from one machine to another, all the machines in between the two would forward on the message. Sometimes, because they didn’t know much, a computer along the way would mistakenly re-direct the message back to its originator. That could happen repeatedly, resulting in a never-ending loop of data transmission that could bring down the network.A spanning tree is a form that takes shape inside a mesh, touching each vertex of the mesh only once.
    David Eppstein
    To end the loops, Perlman came up with the idea for a few computers along the way to have more knowledge about the total structure of the network. They could forward the message to certain computers that were best placed not to send the message back to its originator. The smarter software in practice made the network a structure with no loops, just a tree shape, a branching form leading ever outward. In mathematics, a single path that connects all the points in space of a grid once and only once is called a spanning tree, hence, the name.The software rules written by a programmer set up a grid, but it’s the software operating in real-time that identifies the smartest path within that grid. Hence, Perlman’s final stanza of her poem recapitulates the spirit of Kilmer’s final stanza:A mesh is made by folks like meThen bridges find a spanning tree.Perlman is a realist about the evolution of computer technology. Many times, the best approaches to a problem don’t win out, she said. “Spanning tree was not ideal by any means,” she told ZDNet following the onstage interview. And neither was the Internet Protocol technology that became the heart of the internet, she said. Perlman believes the computing standard called Connectionless-mode Network Protocol (CLNP) which she was championing in the early 1990s, was the best option. But it lost out to IP version 6. The two technologies were promoted by competing technology standards organizations, and that made all the difference, she explained.”A lot of the time, we like to think that standards bodies are composed of very smart people who are thinking about the best approach to deep technical problems,” Perlman told ZDNet. “In fact, they’re a lot more like drunken sports fans.”

    Networking More

  • 150 Shares189 Views

    in Information Technology

    Ransomware attacks are hitting universities hard, and they are feeling the pressure

    Schools and universities are facing an unprecedented level of ransomware attacks as incidents continue to severely impact the education sector. The warning comes from Jisc, a not-for-profit organisation that provides network and IT services to higher education and research institutions. Jisc’s ‘Cyber Impact 2022’ report suggests there’s an increased threat of ransomware attacks against education. 

    ZDNet Recommends

    According to the report, dozens of UK universities, colleges and schools have been hit with ransomware attacks since 2020, causing disruptions for staff and students, and costing institutions substantial amounts of money. In some incidents, Jisc says impact costs have exceeded £2 million. SEE: Cybersecurity: Let’s get tactical (ZDNet special report)And the attacks keep coming, as the report details how two universities and a further education and skills (FES) provider were hit by separate ransomware attacks during March 2022.The institutions aren’t specified, but the report says each incident caused a significant impact as systems were taken down to prevent further spread of malware, and to safely recover and restore data. In one case, a third party was called in to help the organisation fully recover from the incident.  According to Jisc, higher education views ransomware and malware as the top cybersecurity threat, followed by phishing and social engineering. The report suggests that one of the reasons universities have become such a common target for ransomware attacks is because of the pandemic-induced sudden shift to remote working for staff and students that inadvertently left institutions open to attack. For example, the switch to remote education led to a big rise in the use of remote desktop protocol, which can provide ransomware attackers with a route into networks.  Cyber criminals can send out phishing emails to steal usernames and passwords, which they can use to enter networks via legitimate user accounts. It’s also possible for cyber criminals to use brute-force attacks to break into accounts that use common or previously breached passwords. “This underlines the importance of basic security controls being in place, such as protections against brute-force attacks,” says the report. While the threat posed by ransomware and other cyberattacks to higher education is well known, some institutions are struggling, particularly when IT and information security teams are hamstrung by a lack of resources. “We are doing our best, but all areas of IT support seem to be growing and requiring more attention and it’s one part of a larger role (where its importance should be far greater). The pandemic has only stretched us further,” an undisclosed FES provider told Jisc. SEE: These are the problems that cause headaches for bug bounty huntersOne of the steps that organisations can take to protect accounts from being hacked and exploited to help launch a ransomware attack is to provide all users with multi-factor authentication (MFA). According to Jisc, there has been a sharp rise in the number of institutions that have MFA in place, although it hasn’t yet been rolled out across the board yet.It’s also recommended that universities encourage the use of strong, unique passwords, which makes them harder to guess and for cyber criminals to breach accounts, even if another account by the user has previously been stolen. In addition, it’s highly recommended that security patches are rolled out as soon as possible, so that devices, operating systems and software aren’t left exposed to known security vulnerabilities. MORE ON CYBERSECURITY More

  • 213 Shares139 Views

    in Information Technology

    Is Microsoft really going to cut off security updates for my “unsupported” Windows 11 PC? [Ask ZDNet]

    Welcome to this week’s installment of Ask ZDNet, where we answer your burning tech questions.  In the mailbag this week: Is Microsoft really threatening to cut off security updates for people who install Windows 11 on “unsupported” hardware? How can I make my online services more secure with 2FA? And why is it so difficult to get Google Fiber in a condo or apartment building?  If you’ve got a question about any of the topics ZDNet covers, one of our team of editors and contributors probably has an answer. If they don’t, we’ll find an outside expert who can steer you in the right direction.  Questions can cover just about any topic that’s remotely related to work and technology, including PCs and Macs, mobile devices, security and privacy, social media, home office gear, consumer electronics, business etiquette, financial advice… well, you get the idea.  Send your questions to ask@zdnet.com. Due to the volume of submissions, we can’t guarantee a personal reply, but we do promise to read every letter and respond right here to the ones that we think our readers will care about.  Ask away. 

    Is Microsoft really going to cut off security updates for my ‘unsupported’ Windows 11 installation?

    I’ve read that Microsoft says installing Windows 11 on an unsupported PC means it won’t be entitled to receive updates in the future. If I do a clean install of Windows 11 on an incompatible PC, is my PC in danger of getting cut off from monthly security updates at some point in the future?

    Have you ever heard of FUD? The acronym, short for “fear, uncertainty, and doubt,” has been around a long time, but it was popularized in the 1970s as a way of describing how the giant IBM Corporation discouraged its customers from even considering competing products.FUD is a classic marketing technique used when there’s no good technical argument to make against the choice that the customer is contemplating. It’s odd, though, to see an example like this, in which the giant Microsoft Corporation is using FUD to discourage customers from installing one of its own products.The exact language in that warning is interesting:Installing Windows 11 on this PC is not recommended and may result in compatibility issues. If you proceed with installing Windows 11, your PC will no longer be supported and won’t be entitled to receive updates. Damages to your PC due to lack of compatibility aren’t covered under the manufacturer warranty. [emphasis added]This is, of course, the business-school version of “Gee, nice PC you got there. Be a shame if something happened to it.” But it really doesn’t say that Microsoft is going to cut off your access to updates; it simply says you’re no longer “entitled” to those updates. That word is a tell on Microsoft’s part, disclaiming legal responsibility without actually saying what it will do. In fact, it would require an awful lot of work on Microsoft’s part to configure its update servers to reject requests from PCs based on such detailed configuration information. Doing so would run a risk of snagging customers with valid installations, and it would needlessly anger customers who were otherwise having a perfectly good experience with Windows 11.Instead, that language is a way of convincing timid customers to retire those old PCs in favor of shiny new ones, thereby choosing the option that puts fresh revenue in the pockets of Microsoft and its OEM partners.Also: The best Windows laptops: Top notebooks, 2-in-1s, and ultraportablesThis sort of confusion isn’t without precedent. Back in the days before Windows 10 launched, Windows skeptics were convinced that Microsoft was going to pull the rug out from updates based on some confusing language about the “supported lifetime of the device.” The world’s worst Windows pundit, in fact, was convinced Microsoft was going to start charging Windows 10 customers for updates within two years.That turned out to be a false alarm, for all the same reasons I outlined in this case.It’s possible, of course, that some future Windows update will cause performance and reliability issues on older PCs, but the idea that Microsoft will punish its customers for following a documented upgrade deployment procedure is, in my opinion, highly unlikely.

    How do I know which 2FA options are available for the services I use?

    A few weeks ago, you recommended using 2FA for online accounts and said using an app or even a hardware key for 2FA is most secure. How can I find out which security options are supported by the services I use? And what happens if your online account (bank, credit card, etc.) doesn’t support advanced security options?

    It’s incredibly frustrating to sign in to a service and discover that their advanced security options are weak or nonexistent. There are still too many sites that only support two-step verification using SMS codes, with no option to use an authenticator app or a hardware key.Also: Best security keysFor the most part, finding out which authentication methods are available for a specific site usually requires signing in and then poking around the account options section. Look for anything with the words login or security.If you want to see how your service stacks up against its competitors, check out the excellent 2FA Directory, an open-source project that maintains an exhaustive list of websites, with details on whether and how they support 2FA. If your service isn’t measuring up, and switching is an option, this is definitely the place to start. 

    How do I convince Google Fiber to extend service to my building?

    I’m about to move into a new condo, and I’ve been looking at my options for internet service. Just about every other building in the neighborhood has access to high-speed fiber options from AT&T or Google, but when I type my new address into either site, they tell me fiber service isn’t available. What can I do to get this option in my building? Am I stuck with Comcast?

    Cable TV has been around long enough that its infrastructure is pretty much ubiquitous in modern U.S. housing. That coaxial cable usually offers a connection to the Internet, at terms and prices that might or might not be competitive.One of the best new alternatives to cable is fiber, which typically has the advantage of being faster than cable and offering symmetrical download and upload speeds. Cable systems typically offer fast downloads but much slower upload speeds, which makes a difference when you’re working from home and you’re sharing big projects like video files.Google Fiber, which was an early pioneer in fiber deployment before hitting some speed bumps a few years back, appears to be trying to grow again. A recent news story says the company wants to move into Colorado Springs, even quoting Google Fiber’s general manager of expansion. As of April 2022, there are 20 cities listed on the Google Fiber website.Getting a fiber connection to a single-family home isn’t particularly difficult. Getting connections inside a multi-dwelling unit is a little more complicated. It requires an agreement from the owners of the apartment building or the management of a condo complex, followed by an inspection and then some construction.To handle the logistics of getting service to multiple households in a single building, you need a Network Demarc Point (NDP) outside the building and then a fiber distribution hub inside the building, with fiber distribution terminals and conduit throughout the building. For details on exactly what’s involved, see the Google Fiber Construction Stages and Constructions Guidelines documents. When we asked Google Fiber how you can get your building connected, they recommended that you ask your property manager to fill out the form at google.com/fiber/properties. You should expect a response “within a couple of weeks,” they said, from a team member who can assess whether service is available in the area and whether the building is suitable for connection. If the answer to both questions is yes, they can get the ball rolling.

    Send your questions to ask@zdnet.com. Due to the volume of submissions, we can’t guarantee a personal reply, but we do promise to read every letter and respond right here to the ones that we think our readers will care about. Be sure to include a working email address in case we have follow-up questions. We promise not to use it for any other purpose.  

    ZDNet Recommends

      More

  • 213 Shares99 Views

    in Information Technology

    Android security: Flaw in an audio codec left two-thirds of smartphones at risk of snooping, say researchers

    Millions of Android devices were vulnerable to a remote code execution attack due to flaws in an audio codec that Apple open-sourced years ago but which hasn’t been patched since.    Researchers at Check Point discovered a bug in Apple Lossless Audio Codec (ALAC), which is audio-compression technology that Apple open-sourced in 2011. After this, ALAC was embedded in Android devices and programs for audio playback. 

    The problem, as Check Point researchers note, is that while Apple updated and patched its proprietary version of ALAC, the open-source code for ALAC hasn’t been updated since 2011 and it contains a critical flaw that allows for remote code execution. SEE: Google: We’re spotting more zero-day bugs than ever. But hackers still have it too easyA remote attacker can exploit the flaw by sending the target a malformed audio file, which allows the attacker to execute malware on an Android device. The flaw “could have led an attacker to remotely get access to its media and audio conversations,” the researchers said.The bugs affect Android devices with chips from MediaTek and Qualcomm, which have both confirmed the flaws. Qualcomm patched the bug, tracked as CVE-2021-30351, in its December security update. MediaTek also addressed the ALAC issues, tracked as CVE-2021-0674 and CVE-2021-0675, in its December security update.  Qualcomm gave CVE-2021-30351 a “critical” rating with a severity score of 9.8 out of a possible 10. “An out of bound memory access can occur due to improper validation of number of frames being passed during music playback,” Qualcomm says in its advisory.  MediaTek rated CVE-2021-0675 as a “high” severity elevation of privilege bug due to “improper restriction of operations within the bounds of a memory buffer in alac decoder”. It affects dozens of MediaTek chips used in devices running Android versions 8.1, 9.0, 10.0, and 11.0, according to MediaTek.  “In alac decoder, there is a possible out of bounds write due to an incorrect bounds check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation,” it notes. MediaTek says CVE-2021-0674 is a “medium” severity rating that “could lead to local information disclosure with no additional execution privileges needed.” Again, user interaction is not needed for exploitation.  How many Android devices are vulnerable depends on how many people have installed firmware updates in which the flaws are fixed. But the two chipmakers are the largest vendors behind system on chips used in Android devices sold in the US and around the world.Check Point estimates that two-thirds of all smartphones sold in 2021 are vulnerable to what it calls “ALHACK”. Google did release a patch for the Qualcomm bug and MediaTek’s CVE-2021-0675 in its December 2021 update. However, it’s still up to each Android handset manufacture to roll out patches at their own pace. Check Point plans to reveal more details about the flaws at the CanSecWest security conference next month. More

  • 100 Shares99 Views

    in Networking

    SpaceX and Amazon land NASA space communications deals

    An artist rendering of a NASA Tracking and Data Relay Satellite in orbit. 
    Image: NASA
    NASA has awarded deals to Amazon’s Project Kuiper satellite company and SpaceX’s Starlink as part of $287.5 million in funding for commercial operators to deliver the space agency’s future satellite communications. The funds were awarded to six satellite firms as part of NASA’s Communication Services Project (CSP), which looks to tap the private sector for near-Earth SATCOM replacements for its soon-to-be-decommissioned Tracking and Dara Relay Satellite (TDRS). 

    Innovation

    NASA awarded Amazon’s Kuiper Government Solutions $67 million for a “commercial optical low-Earth orbiting relay network for high- and low-rate SATCOM services to spacecraft in low-Earth orbit for routine missions, contingency operations, and early operations phase communications.”SEE: NASA will test this ‘SpinLaunch’ system that hurls satellites into spaceSpaceX landed $69.5 million for a a commercial optical low-Earth orbiting relay network for high-rate SATCOM services to spacecraft in low-Earth orbit for routine missions, contingency operations, launch and ascent, and early-operations phase communications. Other winners of the program included Inmarsat, Viasat, Telecast, and SES.         SpaceX has launched about 2,000 broadband-beaming Starlink satellites into low-Earth orbit (LEO), while Amazon has yet to launch any of its proposed satellite constellation. However, Amazon announced earlier this month that Project Kuiper had secured 83 launches from Arianespace, Jeff Bezos’ Blue Origin, and United Launch Alliance (ULA), which have enough capacity to carry the majority of its proposed 3,236 satellites. Amazon says it has more than 1,000 people working on the Project Kuiper. The companies have until 2025 to demonstrate their technology can deliver new high-rate and high-capacity two-way communications. NASA wants multiple long-term deals with firms for near-Earth SATCOM operations by 2030, while it phases out its own systems.Eli Naffah, the head of NASA’s Communications Services Project (CSP), told Reuters the goal was to get industry to develop capabilities for customers that are “not just NASA, but other space-based customers as well, hopefully bringing down our costs.”As NASA explains, it envisages CSP services will be used by other government agencies and commercial space flight companies to support their own mission requirements. It also looks to change data transmissions from predominantly being from space to Earth towards higher capacity, two-way communications. 

    Networking More