While you filled your face at Noodles and Co, malware was slurping your bank cards • The Register: "American fast-food chain Noodles and Company says malware got into its sales registers, allowing it to slurp customers' payment card numbers."

Time to introduce the financial firewall to the general public.

Labels: security fail, security flaw

Safari 10 brings fast, native App Extensions to the macOS browser, web content: "Building on work completed last year to enable Web Content Blockers, Apple's new Safari 10 enables a wide range of native code App Extensions that users can automatically obtain and update through the Mac App Store, contributing to faster performance, enhanced security and better reliability. "

Flash is dead, long live the Flash!

Labels: Adobe Flash

High-severity bugs in 25 Symantec/Norton products imperil millions | Ars Technica: ""These vulnerabilities are as bad as it gets," Tavis Ormandy, a researcher with Google's Project Zero, wrote in a blog post. "They don’t require any user interaction, they affect the default configuration, and the software runs at the highest privilege levels possible. In certain cases on Windows, vulnerable code is even loaded into the kernel, resulting in remote kernel memory corruption.""

Further proof that security is hard and you shouldn't hand over root level access to any app that's going to be "always on".

Labels: security flaw

From file-sharing to prison: A Megaupload programmer tells his story | Ars TechnicaThe legal saga dragged on for three years. In 2012, Nõmm was first arrested by authorities in the Netherlands and placed under house arrest. Like Dotcom, Nõmm next spent a significant amount of time fighting extradition. But eventually in 2015, he voluntarily traveled to the US and was arrested in Virginia. Nõmm pleaded guilty to felony copyright infringement and was sentenced to a year and a day in a US federal prison.

A drop in the bucket compared to the grievous harm caused by banksters, none of whom saw a day of prison time.

Labels: sad

Catching up with the guy who stole Half-Life 2’s source code, 10 years later | Ars Technica: "the chief of police greeted him. He walked up to Gembe, looked him in the eye and said: "Have you any idea how lucky you are that we got to you before you got on that plane?" "

Deutschland über alles!

Labels: best hacker stories, zero day exploit

User testing is essential for app development, says Bill AtkinsonSAN FRANCISCO — If you want to make a truly killer app, here’s a crucial part of the creative process you shouldn’t overlook: Give your “finished” software to someone, ask them to do something with it, and then shut the hell up.

Sir Bill from the Knights of the Rounded Rectangle speaks!

Labels: bill atkinson, bill budge, woz

Kill Flash now. Or patch these 36 vulnerabilities. Your choice • The Register: "Adobe has released an update for Flash that addresses three dozen CVE-listed vulnerabilities.

The update includes a fix for the CVE-2016-4171 remote code execution vulnerability that is right now being exploited in the wild to install malware on victims' computers."

Flash is like the Windows XP of the internet. Didn't quite anticipate the rise in security concerns. Not that anyone did, but Flash is paying the heaviest price.

Labels: security flaw

Microsoft releases open source bug-bomb in the rambling house of C • The Register: "Key to it is better handling of pointers in C programs. Checked C “allows programmers to better describe how they intend to use pointers and the range of memory occupied by data that a pointer points to,” MS Research explains at its project page."

New features for an old friend. You don't know sizeof like I know sizeof.

Labels: security, security exploit

FBI expands code theft charges against Chinese national • The Register: "The charge is that he stole source code from his employer, believed to have been IBM but not yet confirmed, intending to turn it over to the Chinese government.

Xu was employed by the company from 2010 to 2014, and was one of what the DoJ says was a “small subset” of staff with access to the source code of a clustered file system. The indictment notes that individuals had to sign NDAs to access the code."

Justice for IP theft IFF your name is IBM.

Labels: IP theft

iOS 10 warns users when opening legacy apps not encoded in 64-bit: "More than a year after Apple mandated that all new apps must be 64-bit compatible, iOS 10 will begin warning users that non-compliant legacy apps may affect the stability of their iPhone or iPad."

for (NSInteger memoryBandwidth=0; memoryBandwidth<ohReally; ++memoryBandwidth) overkill=YES;

Labels: yawn

How a college student tricked 17k coders into running his sketchy script | Ars Technica: "The eye-opening (if ethically questionable) research was conducted by University of Hamburg student Nikolai Philipp Tschacher as part of his bachelor thesis. Using a variation of a decade-old attack known as typosquatting, he uploaded his code to three popular developer communities and gave them names that were similar to widely used packages already submitted by other users."

Hmmm.

Labels: social hacking

Microsoft's BITS file transfer tool fooled into malware distribution • The Register: "While working on a customer clean-up project, SecureWorks staff found that attackers had created self-contained BITS tasks that didn't appear in the registries of affected machines, and their footprints were limited to entries on the BITS database."

Security is hard, real hard.

Labels: attack surface, security exploit

Why does an Android keyboard need to see your camera and log files – and why does it phone home to China? • The Register: "UK-based Pentest said a whitepaper study [PDF] of the popular Flash Keyboard found that the Android app is "abusing" OS permissions, inserting potentially malicious ads, and tracking user behavior, then sending data to servers in China."

Marketing 101 - computer users ain't that smart.

Labels: security flaw

TeamViewer users are being hacked in bulk, and we still don’t know how | Ars Technica: "For more than a month, users of the remote login service TeamViewer have taken to Internet forums to report their computers have been ransacked by attackers who somehow gained access to their accounts."

Uh-oh.

Labels: security leak

Giveaway: Win an mCookie Kit from Microduino: "Microduino is partnering with AppleInsider to offer readers the chance to win an mCookie kit, which contains a magnetic stackable Arduino microcontroller for programmers and DIY-ers. As a bonus, not one, but two kits are up for grabs this week."

For all you hackers out there.

Labels: think different

The guy who named iMac says Apple's names are too confusing | Cult of Mac: "Former Apple marketing guru Ken Segall helped launched Apple’s string of i-devices, but now he says that the company has lost its way from simplicity lately and there’s no clearer sign than the confusing naming scheme of the iPhone.

Hmmmmm.

Labels: Apple vs. Apple