Elephant0991

Comment

I hope nobody loses their shirt over this.

Summary

• Sensitive data exposed: Internal code, infrastructure diagrams, passwords, and other technical information were publicly accessible on GitHub for months.
• Source unclear: Unclear if an outside hacker or Binance employee accidentally uploaded the data.
• Potential risk: Information could be used by attackers to compromise Binance systems, though Binance claims "negligible risk".
• Data details: Included code related to passwords and multi-factor authentication, diagrams of internal infrastructure, and apparent production system passwords.
• Binance response: Initially downplayed the leak, later acknowledged data was theirs but downplayed risk.
• Current status: Data removed from GitHub via copyright takedown request.
• Unclear if any malicious actors accessed the data.

The issue:

Android users with Firefox can't access Google Search (including intl sites and localized domains like google.de, .co.uk, .com.br). Instead, they see a blank page.

Cause:

A server-side bug on Google's end related to User-Agent (UA) sniffing, which serves an empty page to newer Firefox versions.

Affected versions:

All Firefox versions on Android (>= 65) including Mobile 121.0, Nightly 123, and older.

Chrome not affected:

The bug is specific to Firefox.

Solutions:

• Use a different browser (Chrome, etc.) or search engine (DuckDuckGo).

Advanced users can:

• Change Firefox's UA in developer settings or with add-ons.

• Request the desktop version of Google from Firefox settings (region-dependent).

Status:

• Problem identified as critical and escalated.
• Still unresolved at the time of reporting.

Additional notes:

• Disabling Firefox's Enhanced Tracking Protection doesn't fix the issue.
• Some users report google.co.in loading the desktop site instead of mobile.

Main findings:

• The seasons, especially winter, can affect our mood, memory, concentration, social behavior, and sex drive.
• Shorter daylight hours are linked to winter blues and Seasonal Affective Disorder (SAD), characterized by low mood, sleep issues, and energy loss.
• Reduced light disrupts our circadian rhythm, impacting mood and cognitive function.
• Vitamin D deficiency (from less sunlight) might also contribute to winter blues and cognitive decline.
• We may subconsciously seek warmth and social connection during colder months, explaining increased interest in romance films and social activities.
• Sexual activity fluctuates across seasons, potentially due to the desire for physical and emotional warmth.

Key takeaways:

• Embrace positive aspects of winter like its beauty and coziness to improve mood.
• Cognitive behavioural therapy can help managing negative thoughts and boost winter well-being.
• Don't be hard on yourself if you're forgetful or less social during winter; it's natural.
• Actively seek social connection and engage in activities you enjoy to combat winter blues.
• 2019 Cochrane Systematic Review concluded that the evidence for light therapy's effectiveness as a preventative treatment was limited.

Key Points:

• Security and privacy concerns: Increased use of AI systems raises issues like data manipulation, model vulnerabilities, and information leaks.
• Threats at various stages: Training data, software, and deployment are all vulnerable to attacks like poisoning, data breaches, and prompt injection.
• Attacks with broad impact: Availability, integrity, and privacy can all be compromised by evasion, poisoning, privacy, and abuse attacks.
• Attacker knowledge varies: Threats can be carried out by actors with full, partial, or minimal knowledge of the AI system.
• Mitigation challenges: Robust defenses are currently lacking, and the tech community needs to prioritize their development.
• Global concern: NIST's warning echoes recent international guidelines emphasizing secure AI development.

Overall:

NIST identifies serious security and privacy risks associated with the rapid deployment of AI systems, urging the tech industry to develop better defenses and implement secure development practices.

Comment:

From the look of things, it looks like it's going to get worse before it gets better.

• Previous images of Neptune and Uranus, particularly from Voyager 2, were inaccurately blue and green due to image processing for detail enhancement.
• New research analyzed data from Hubble and VLT telescopes to reveal their "true" colors are both a similar shade of greenish-blue.
• Neptune still has a slightly bluer tinge due to a thinner haze layer.
• Uranus may appear slightly greener in summer/winter but bluer in spring/autumn due to its unique tilt.
• This research corrects a long-held misconception about these distant planets.

cross-posted from: https://zerobytes.monster/post/5063838

I guess if the law firm handles its own data breach this way; you can expect the companies to handle the breaches the same way.

Summary

The international law firm Orrick, Herrington & Sutcliffe, specializing in handling security incidents for companies, suffered a cyberattack in March 2023, resulting in the exposure of sensitive health information belonging to over 637,000 data breach victims.

The stolen data included consumer names, dates of birth, postal address and email addresses, and government-issued identification numbers, such as Social Security numbers, passport and driver license numbers, and tax identification numbers. The data also includes medical treatment and diagnosis information, insurance claims information — such as the date and costs of services — and healthcare insurance numbers and provider details.

Orrick, serving as legal counsel during security incidents at other companies, revealed that the breach also affected clients such as EyeMed Vision Care, Delta Dental, MultiPlan, Beacon Health Options, and the U.S. Small Business Administration. The number of affected individuals tripled since the initial disclosure. Orrick reached a settlement for class action lawsuits in December, which accused Orrick of failing to inform victims of the breach until months after the incident, acknowledging the incident's impact and expressing regret for the inconvenience caused. The firm did not disclose details about the hackers' entry or whether a financial ransom was demanded.

Summary:

The author reflects on the challenges of memory and highlights a forgotten but valuable feature of Google Assistant on Android. The feature, called "Open memory," serves as a hub for Assistant's cross-platform information-storing system. Users can ask Google Assistant to remember specific information, and the "Open memory" command allows them to access a comprehensive list of everything stored, making it a useful tool for recalling details from any device connected to Google Assistant. The article emphasizes the potential of this feature for aiding memory and suggests incorporating it into daily habits for better recall.

From: https://petapixel.com/2023/05/30/15-incredible-photos-from-2023-milky-way-photographer-of-the-year/

These two news articles being consecutive is hilarious.

by long10000

Other views:

by long10000

by 杨志强Zhiqiang

by long10000

by long10000

by David290

by long10000

Short Summary

The macOS app called NightOwl, originally designed to provide a night mode feature for Macs, has turned into a malicious tool that collects users' data and operates as part of a botnet. Originally well-regarded for its utility, NightOwl was bought by another company, and a recent update introduced hidden functionalities that redirected users' data through a network of affected computers. Web developer Taylor Robinson discovered that the app was running a local HTTP proxy without users' knowledge or consent, collecting users' IP addresses and sending the data to third parties. The app's certificate has been revoked, and it is no longer accessible. The incident highlights the risks associated with third-party apps that may have malicious intentions after updates or ownership changes.

Longer Summary

The NightOwl app was developed by Keeping Tempo, an LLC that went inactive earlier this year. The app was recently found to have been turned into a botnet by the new owners, TPE-FYI, LLC. The original developer, Michael Kramser, claims that he was unaware of the changes to the app and that he sold the company last year due to time constraints.

Gizmodo was unable to reach TPE-FYI, LLC for comment. However, the internet sleuth who discovered the botnet, Will Robinson, said that it is not uncommon for shady companies to buy apps and then monetize them by integrating third-party SDKs that harvest user data.

Robinson also said that it is understandable why developers might sell their apps, even if it means sacrificing their morals. App development is both hard and expensive, and for individual creators, it can be tempting to take the money and run.

This is not the first time that a popular app has been turned into a botnet. In 2013, the Brightest Flashlight app was sued by the Federal Trade Commission after allegedly transmitting users' location data and device info to third parties. The developer eventually settled with the FTC for an undisclosed amount.

In 2017, software developers discovered that the Stylish browser extension started recording all of its users' website visits after the app was bought by SimilarWeb. Another extension, The Great Suspender, was flagged as malware after it was sold to an unknown group back in 2020.

All of these apps had millions of users before anyone recognized the signs of intrusion. In these cases, the new app owners' shady efforts were all to support a more-intrusive version of harvesting data, which can be sold to third parties for an effort-free, morals-free payday.

Possible Takeaways

• Minimize the software you use

• Keep track of ownership changes

• Use software from only the most reputable sources

• Regularly review installed apps

• Be suspicious about app's unexpected behaviors and permissions

Summary

• The Marion County Record newsroom in Kansas was raided by police, who seized two cellphones, four computers, a backup hard drive, and reporting materials.

• A computer seized was most likely unencrypted. Law enforcement officials hope that devices seized during a raid are unencrypted, as this makes them easier to examine.

• Modern iPhones and Android phones are encrypted by default, but older devices may not be.

• Desktop computers typically do not have encryption enabled by default, so it is important to turn this on manually.

• Use strong random passwords and keep them in a password manager.

• During the raid, police seized a single backup hard drive. It is important to have multiple backups of your data in case one is lost or stolen.

• You can encrypt USB storage devices using BitLocker To Go on Windows, or Disk Utility on macOS.

• All major desktop operating systems support Veracrypt, which can be used to encrypt entire drives.

Main Take-aways

• Encrypt your devices, drives, and USBs.

• Use strong random passwords and password manager.

• Have multiple backups.