TechCrunch reports: Apple's warnings in late October that Indian journalists and opposition figures may have been targeted by state-sponsored attacks prompted a forceful counterattack from Prime Minister Narendra Modi's government. Officials publicly doubted Apple's findings and announced a probe into device security.

India has never confirmed nor denied using the Pegasus tool, but nonprofit advocacy group Amnesty International reported Thursday that it found NSO Group's invasive spyware on the iPhones of prominent journalists in India, lending more credibility to Apple's early warnings. "Our latest findings show that increasingly, journalists in India face the threat of unlawful surveillance simply for doing their jobs, alongside other tools of repression including imprisonment under draconian laws, smear campaigns, harassment, and intimidation," said Donncha Ã" Cearbhaill, head of Amnesty International's Security Lab, in the blog post.
Cloud security company Lookout has also published "an in-depth technical look" at Pegasus, calling its use "a targeted espionage attack being actively leveraged against an undetermined number of mobile users around the world." It uses sophisticated function hooking to subvert OS- and application-layer security in voice/audio calls and apps including Gmail, Facebook, WhatsApp, Facetime, Viber, WeChat, Telegram, Apple's built-in messaging and email apps, and others. It steals the victim's contact list and GPS location, as well as personal, Wi-Fi, and router passwords stored on the device...

According to news reports, NSO Group sells weaponized software that targets mobile phones to governments and has been operating since 2010, according to its LinkedIn page. The Pegasus spyware has existed for a significant amount of time, and is advertised and sold for use on high-value targets for multiple purposes, including high-level espionage on iOS, Android, and Blackberry.
Thanks to Slashdodt reader Mirnotoriety for sharing the news.

"Remote-work numbers have dwindled over the past few years as employers issue return-to-office mandates," reports USA Today. "But will that continue in 2024?" The numbers started to slide after spring 2020, when more than 60% of days were worked from home, according to data from WFH Research, a scholarly data collection project. By 2023, that number had dropped to about 25% â' much lower than its peak but still a fivefold increase from 5% in 2019. But work-from-home numbers have held steady throughout most of 2023. And according to remote-work experts, they're expected to rebound in the years to come as companies adjust to work-from-home trends. "Return-to-office died in '23," said Nick Bloom, an economics professor at Stanford University and work-from-home expert. "There's a tombstone with 'RTO' on it...."

Though a number of companies issued return-to-work mandates this year, most are allowing employees to work from home at least part of the week. That makes 2024 the year for employers to figure out the hybrid model. "We're never going to go back to a five-days-in-the-office policy," said Stephan Meier, professor of business at Columbia University. "Some employers are going to force people to come back, but I think over the next year, more and more firms will actually figure out how to manage hybrid well." Thirty-eight percent of companies require full-time in-office work, down from 39% one quarter ago and 49% at the start of the year, according to software firm Scoop Technologies...

[Stanford economics professor] Bloom called remote-work numbers in 2023 "pancake-flat." Yes, large companies like Meta and Zoom made headlines by ordering workers back to the office. But, Bloom said, just as many other companies were quietly reducing office attendance to cut costs.
Bloom thinks holograms and VR devices are possible within five years. "In the long run, the thing that really matters is technology."

One paper estimates that currently 37% of America's jobs can be done entirely at home, according to the article, and ZipRecruiter's chief economist seems to agree, predicting as much as 33% America's work days will eventually be completed from home. "I think the numbers will gradually go up as this becomes more of an accepted norm as future generations grow up with it being so widely available, and as the technology for for doing it gets better."

And the article notes that the ZipRecruiter economist sees another factor fueling the trend. "Reluctant leaders aging out of the workforce will help, too, she said."

Microsoft has again disabled the MSIX ms-appinstaller protocol handler after multiple financially motivated threat groups abused it to infect Windows users with malware. From a report: The attackers exploited the CVE-2021-43890 Windows AppX Installer spoofing vulnerability to circumvent security measures that would otherwise protect Windows users from malware, such as the Defender SmartScreen anti-phishing and anti-malware component and built-in browser alerts cautioning users against executable file downloads.

Microsoft says the threat actors use both malicious advertisements for popular software and Microsoft Teams phishing messages to push signed malicious MSIX application packages. "Since mid-November 2023, Microsoft Threat Intelligence has observed threat actors, including financially motivated actors like Storm-0569, Storm-1113, Sangria Tempest, and Storm-1674, utilizing the ms-appinstaller URI scheme (App Installer) to distribute malware," the company said.

LG just announced its latest 4K projector, the CineBeam Qube. It'll officially unveil the projector at CES 2024 in early January, but the company's giving curious consumers an early look. From a report: The CineBeam Qube has plenty of high-tech bells and whistles, but with a stylish design that LG calls "minimalist." There's also a handle that resembles a crank. Yeah this thing has an actual handle. The CineBeam Qube is built for portability. It's lightweight, at around three pounds, and the square form factor makes it easy to place just about anywhere. The 360-degree rotatable handle also helps with placement. LG's calling it "one of the smallest projectors available."

Of course, the most important part of any projector is, well, the projection. The Qube projects 4K UHD (3,840 x 2,160) resolution images that measure up to 120 inches. There's an RGB laser light source, a 450,000:1 contrast ratio and 154 percent coverage of the DCI-P3 color gamut. With these specs, that episode of Reacher will really pop. Speaking of streaming content, the projector runs on LG webOS 6.0 and offers access to all of the big streaming services, including Prime Video, Disney+, Netflix and YouTube.

Boeing instructed customer airlines to inspect their 787 Max jets for loose bolts, the Federal Aviation Administration (FAA) announced this week. From a report: The request comes after the manufacturer discovered two aircraft with missing bolts in the rudder control system, raising concerns about faults across all aircraft. "The issue identified on the particular airplane has been remedied," Boeing told CNN in a statement. "Out of an abundance of caution, we are recommending operators inspect their 737 Max airplanes and inform us of any findings." The inspection request entails a two-hour probe of the aircraft's safety-critical parts for each of the approximately 1,300 787 Max jets in service, the FAA said.

After falsified records for spare aircraft parts set off a frantic global search for suspect pieces, the aviation industry now faces another daunting task: adapting the archaic paperwork for 100 million components to the digital age. From a report: Since the middle of the year, maintenance shops and aerospace manufacturers have found thousands of engine parts with falsified records linked to a distributor called AOG Technics. Airlines from China to the US and Europe have had to pull planes from service and extract the dubious components, leaving jets grounded and racking up millions of dollars in costs.

The episode has prodded carriers and maintenance shops to bolster scrutiny of their vendors and the parts they receive. And it's given fresh weight to an ongoing push to digitize the paper-based records still prevalent in the industry to document the lifespan of every piece of an aircraft from the time that it's made to when it lands in a scrap heap. But any structural reforms to thwart would-be copycats of the scheme of which AOG is suspected are likely years away. The industry is accustomed to following standardized methods and only making fundamental changes after a detailed and often lengthy examination of potential safety risks -- and costs.

An anonymous reader quotes a report from SecurityWeek: Albania's Parliament said on Tuesday that it had suffered a cyberattack with hackers trying to get into its data system, resulting in a temporary halt in its services. A statement said Monday's cyberattack had not "touched the data of the system," adding that experts were working to discover what consequences the attack could have. It said the system's services would resume at a later time. Local media reported that a cellphone provider and an air flight company were also targeted by Monday's cyberattacks, allegedly from Iranian-based hackers called Homeland Justice, which could not be verified independently.

Albania suffered a cyberattack in July 2022 that the government and multinational technology companies blamed on the Iranian Foreign Ministry. Believed to be in retaliation for Albania sheltering members of the Iranian opposition group Mujahedeen-e-Khalq, or MEK, the attack led the government to cut diplomatic relations with Iran two months later. The Iranian Foreign Ministry denied Tehran was behind an attack on Albanian government websites and noted that Iran has suffered cyberattacks from the MEK. In June, Albanian authorities raided a camp for exiled MEK members to seize computer devices allegedly linked to prohibited political activities. [...] In a statement sent later Tuesday to The Associated Press, MEK's media spokesperson Ali Safavi claimed the reported cyberattacks in Albania "are not related to the presence or activities" of MEK members in the country.

Google has indicated that it is ready to settle a class-action lawsuit filed in 2020 over its Chrome browser's Incognito mode. From a report: Arising in the Northern District of California, the lawsuit accused Google of continuing to "track, collect, and identify [users'] browsing data in real time" even when they had opened a new Incognito window. The lawsuit, filed by Florida resident William Byatt and California residents Chasom Brown and Maria Nguyen, accused Google of violating wiretap laws.

It also alleged that sites using Google Analytics or Ad Manager collected information from browsers in Incognito mode, including web page content, device data, and IP address. The plaintiffs also accused Google of taking Chrome users' private browsing activity and then associating it with their already-existing user profiles. Google initially attempted to have the lawsuit dismissed by pointing to the message displayed when users turned on Chrome's incognito mode. That warning tells users that their activity "might still be visible to websites you visit."

Researchers on Wednesday presented intriguing new findings surrounding an attack that over four years backdoored dozens if not thousands of iPhones, many of which belonged to employees of Moscow-based security firm Kaspersky. Chief among the discoveries: the unknown attackers were able to achieve an unprecedented level of access by exploiting a vulnerability in an undocumented hardware feature that few if anyone outside of Apple and chip suppliers such as ARM Holdings knew of. ArsTechnica: "The exploit's sophistication and the feature's obscurity suggest the attackers had advanced technical capabilities," Kaspersky researcher Boris Larin wrote in an email. "Our analysis hasn't revealed how they became aware of this feature, but we're exploring all possibilities, including accidental disclosure in past firmware or source code releases. They may also have stumbled upon it through hardware reverse engineering."

Other questions remain unanswered, wrote Larin, even after about 12 months of intensive investigation. Besides how the attackers learned of the hardware feature, the researchers still don't know what, precisely, its purpose is. Also unknown is if the feature is a native part of the iPhone or enabled by a third-party hardware component such as ARM's CoreSight. The mass backdooring campaign, which according to Russian officials also infected the iPhones of thousands of people working inside diplomatic missions and embassies in Russia, according to Russian government officials, came to light in June. Over a span of at least four years, Kaspersky said, the infections were delivered in iMessage texts that installed malware through a complex exploit chain without requiring the receiver to take any action. With that, the devices were infected with full-featured spyware that, among other things, transmitted microphone recordings, photos, geolocation, and other sensitive data to attacker-controlled servers. Although infections didn't survive a reboot, the unknown attackers kept their campaign alive simply by sending devices a new malicious iMessage text shortly after devices were restarted.

National Amusements, the cinema chain and corporate parent giant of media giants Paramount and CBS, has confirmed it experienced a data breach in which hackers stole the personal information of tens of thousands of people. TechCrunch: The private media conglomerate said in a legally required filing with Maine's attorney general that hackers stole personal information on 82,128 people during a December 2022 data breach. Details of the December 2022 breach only came to light a year later, after the company began notifying those affected last week.

According to Maine's notice, the company discovered the breach months later in August 2023, but did not say what specific personal information was taken. The data breach notice filed with Maine said that hackers also stole financial information, such as banking account numbers or credit card numbers in combination with associated security codes, passwords or secrets.

An anonymous reader writes: If you've ever performed a fresh reinstall of Windows 11, you'll know how long it takes and how much effort you need to make to get it started. Fortunately, Microsoft is taking note. As spotted in a recent update to the Windows 11 beta branch, the company is working on a way to reinstall your operating system through Windows Update, and no files are lost in the process.

The newest update to the Windows Insider beta branch has added a new feature titled "Fix Problems using Windows Update." The feature is still a work in progress, so it doesn't work as it should right now. However, if you're on the Windows 11 Insider beta branch, you can see the button for yourself on the Recovery page, among the Windows 11 backup settings.

Mint Mobile has disclosed a new data breach that exposed the personal information of its customers, including data that can be used to perform SIM swap attacks. From a report: Mint is a mobile virtual network operator (MVNO) offering budget, pre-paid mobile plans. T-Mobile has proposed paying $1.3 billion to purchase the company. The company began notifying customers on December 22nd via emails titled "Important information regarding your account," stating that they suffered a security incident and a hacker obtained customer information.

"We are writing to inform you about a security incident we recently identified in which an unauthorized actor obtained some limited types of customer information," warns the Mint Mobile data breach notification. "Our investigation indicates that certain information associated with your account was impacted."

An anonymous reader shared this report from Fast Company: Providers of critical infrastructure in the United States are doing a sloppy job of defending against cyber intrusions, the National Security Council tells Fast Company, pointing to recent Iran-linked attacks on U.S. water utilities that exploited basic security lapses [earlier this month]. The security council tells Fast Company it's also aware of recent intrusions by hackers linked to China's military at American infrastructure entities that include water and energy utilities in multiple states.

Neither the Iran-linked or China-linked attacks affected critical systems or caused disruptions, according to reports.

"We're seeing companies and critical services facing increased cyber threats from malicious criminals and countries," Anne Neuberger, the deputy national security advisor for cyber and emerging tech, tells Fast Company. The White House had been urging infrastructure providers to upgrade their cyber defenses before these recent hacks, but "clearly, by the most recent success of the criminal cyberattacks, more work needs to be done," she says... The attacks hit at least 11 different entities using Unitronics devices across the United States, which included six local water facilities, a pharmacy, an aquatics center, and a brewery...

Some of the compromised devices had been connected to the open internet with a default password of "1111," federal authorities say, making it easy for hackers to find them and gain access. Fixing that "doesn't cost any money," Neuberger says, "and those are the kinds of basic things that we really want companies urgently to do." But cybersecurity experts say these attacks point to a larger issue: the general vulnerability of the technology that powers physical infrastructure. Much of the hardware was developed before the internet and, though they were retrofitted with digital capabilities, still "have insufficient security controls," says Gary Perkins, chief information security officer at cybersecurity firm CISO Global. Additionally, many infrastructure facilities prioritize "operational ease of use rather than security," since many vendors often need to access the same equipment, says Andy Thompson, an offensive cybersecurity expert at CyberArk. But that can make the systems equally easy for attackers to exploit: freely available web tools allow anyone to generate lists of hardware connected to the public internet, like the Unitronics devices used by water companies.

"Not making critical infrastructure easily accessible via the internet should be standard practice," Thompson says.

An anonymous reader shared this report from Reuters: In February, a Canadian cybersecurity firm delivered an ominous forecast to the U.S. Department of Defense. America's secrets — actually, everybody's secrets — are now at risk of exposure, warned the team from Quantum Defen5e (QD5). QD5's executive vice president, Tilo Kunz, told officials from the Defense Information Systems Agency that possibly as soon as 2025, the world would arrive at what has been dubbed "Q-day," the day when quantum computers make current encryption methods useless. Machines vastly more powerful than today's fastest supercomputers would be capable of cracking the codes that protect virtually all modern communication, he told the agency, which is tasked with safeguarding the U.S. military's communications.

In the meantime, Kunz told the panel, a global effort to plunder data is underway so that intercepted messages can be decoded after Q-day in what he described as "harvest now, decrypt later" attacks, according to a recording of the session the agency later made public. Militaries would see their long-term plans and intelligence gathering exposed to enemies. Businesses could have their intellectual property swiped. People's health records would be laid bare... One challenge for the keepers of digital secrets is that whenever Q-day comes, quantum codebreakers are unlikely to announce their breakthrough. Instead, they're likely to keep quiet, so they can exploit the advantage as long as possible.
The article adds that "a scramble is on to protect critical data. Washington and its allies are working on new encryption standards known as post-quantum cryptography... Beijing is trying to pioneer quantum communications networks, a technology theoretically impossible to hack, according to researchers...

"In a quantum communications network, users exchange a secret key or code on subatomic particles called photons, allowing them to encrypt and decrypt data. This is called quantum key distribution, or QKD."

Google's Safety Check feature for Chrome, which, among other things, checks the internet to see if any of your saved passwords have been compromised, will now "run automatically in the background" on desktop, the company said in a blog post on Thursday. From a report: The constant checks could mean that you're alerted about a password that you should change sooner than you would have before. Safety Check also watches for bad extensions or site permissions you need to look at, and you can act on Safety Check alerts from Chrome's three-dot menu. In addition, Google says that Safety Check can revoke a site's permissions if you haven't visited it in a while. Google also announced an upcoming feature for Chrome's tab groups, also on desktop: Chrome will let you save tab groups so that you can use those groups across devices, which might be handy when moving between a PC at home and a laptop when traveling. Google says this feature will roll out "over the next few weeks."

An anonymous reader quotes a report from The Register: It will take 283 years for female representation in IT to make up an equal share of the tech workforce in the UK, according to a report from the British Computer Society, the chartered institute for IT (BCS). BCS has calculated that based on trends from 2005 to 2022, it would take nearly three centuries for the representation of women in the IT workforce -- currently 20 percent -- to reach the average representation across the whole UK workforce, currently at 48 percent. BCS's annual Diversity Report also found that progress towards the gender norm was stalling in IT jobs. Between 2018 and 2021, the proportion of women tech workers rose from 16 percent to 20 percent. But there was no change in 2022, according to BCS analysis of data from the Office for National Statistics.

Julia Adamson, BCS managing director for education and public benefit, said in a statement: "More women and girls need the opportunity to take up great careers in a tech industry that's shaping the world. A massive pool of talent and creativity is being overlooked when it could benefit employers and the economy. There has to be a radical rethink of how we get more women and girls into tech careers, and a more inclusive tech culture is ethically and morally the right thing to do. Having greater diversity means that what is produced is more relevant to, and representative of, society at large. This is crucial when it comes to, for instance, the use of AI in medicine or finance. The fact that 94 percent of girls and 79 percent of boys drop computing at age 14 is a huge alarm bell we must not ignore; the subject should have a broader digital curriculum that is relevant to all young people."

arXiv blog: arXiv's goal is equitable access to scientific research for all -- and to achieve this, we have been working to make research papers more accessible for arXiv users with disabilities. We are happy to announce that as of Monday, December 18th, arXiv is now generating an HTML formatted version of all papers submitted in TeX/LaTeX (as long as papers were submitted on or after December 1st, 2023 and HTML conversion is successful).

HTML is not replacing PDF but will be an additional format available for arXiv users. Submitters will be invited to preview the HTML version of their papers during submission time, the same way they have always done with PDF. When accessing a paper's abstract page, readers will see a link to view the HTML paper right under the PDF link. The request to offer arXiv-hosted papers in HTML format comes directly from scientists with disabilities who face barriers to accessing the research they need. HTML formatted papers are more easily and accurately read by screen readers and other technologies, which can assist researchers with reading disabilities, including blindness, low vision, dyslexia, and more.

Beeper is giving up on its mission to bring iMessage to Android after implementing a series of fixes that Apple has knocked down one by one over the past month. From a report: Although the company has issued a complex workaround, it says it has no plans to roll out another one if this one is knocked down by Apple. "Each time that Beeper Mini goes 'down' or is made to be unreliable due to interference by Apple, Beeper's credibility takes a hit," the company wrote in a blog post. "It's unsustainable. As much as we want to fight for what we believe is a fantastic product that really should exist, the truth is that we can't win a cat-and-mouse game with the largest company on earth. With our latest software release, we believe we've created something that Apple can tolerate existing. We do not have any current plans to respond if this solution is knocked offline"

New submitter ekimminau writes: On the morning of December 20, 2023, thousands of users turned on their Samsung TV to find that the Samsung TV Plus application was missing. Available for free on 2016-2023 Samsung Smart TVs, Galaxy devices, Smart Monitors, Family Hub refrigerators, and the web, for many it is their primary method of TV viewing. The masses began flocking to the Samsung community forums asking ... what was going on.

From Cord Cutters: At this time, Samsung has not posted any updates about the outage. Customer service has been telling customers they are aware of the outage and are working on fixing it. This news comes as Samsung recently added seven local FOX news channels for community stories, sports updates, weather forecasts and more. The new markets are Austin, Detroit, Milwaukee, Orlando, Phoenix, Seattle and Tampa Bay. Right now, this outage seems to only be affecting the app on Smart TVs as the website is still working letting anyone stream Samsung TV Plus for free streaming online through the website.

A worrying number of UK authorities are still unaware of the impending switch-off of 2G and 3G mobile networks, according to Local Government Association (LGA) figures. From a report: While 38 percent of respondents were fully aware, 27 percent were only partially aware, and 7 percent had no idea at all that the axe would be falling by 2033 at the latest. The numbers worsened when the researchers spoke to respondents in senior management. Almost half (48 percent) were "partially aware" the UK's 2G and 3G mobile networks were due to be switched off and 14 percent were not at all aware.

The actual switch-off will happen over the next few years. UK mobile operators have told government they do not intend to offer 2G and 3G mobile networks past 2033 at the latest, and there is a high likelihood that some networks will be shut down earlier. The UK government said it welcomes plans to end services ahead of time. Vodafone, for example, intends to pull the plug on 3G once and for all from January 2024. Although most consumers, with their 4G and 5G devices, will likely be unaware of the end when it comes, the same cannot be said of local authorities. According to the survey, almost two-thirds of respondents (63 percent) reported that their authority was still using devices or services reliant on 2G and 3G networks.