An anonymous reader quotes a report from OPP.Today: Android 14, the latest operating system from Google, is facing a major storage bug that is causing users to be locked out of their devices. This issue is particularly affecting users who utilize the "multiple profiles" feature. Reports suggest that the bug is comparable to being hit with "ransomware," as users are unable to access their device storage. Initially, it was believed that this bug was limited to the Pixel 6, but it has since been discovered that it impacts a wider range of devices upgrading to Android 14. This includes the Pixel 6, 6a, 7, 7a, Pixel Fold, and Pixel Tablet. The Google issue tracker for this bug has garnered over 350 replies, but there has been no response from Google so far. The bug has been assigned the medium priority level of "P2" and remains unassigned, indicating that no one is actively investigating it.

Users who have encountered this storage bug have shared log files containing concerning messages such as "Failed to open directory /data/media/0: Structure needs cleaning." This issue leads to various problematic situations, with some users experiencing boot loops, others stuck on a "Pixel is starting..." message, and some unable to take screenshots or access their camera app due to the lack of storage. Users are also unable to view files on their devices from a PC over USB, and the System UI and Settings repeatedly crash. Essentially, without storage, the device becomes practically unusable.

Android's user-profile system, designed to accommodate multiple users and separate work and personal profiles, appears to be the cause of this rarely encountered bug. Users have reported that the primary profile, which is typically the most important one, becomes locked out.

Intel CEO Pat Gelsinger has downplayed the threat of rival chipmakers creating processors based on the Arm architecture for PCs. From a report: "Arm and Windows client alternatives, generally they've been relegated to pretty insignificant roles in the PC business," he told analysts during the x86 giant's Q3 earnings call Thursday. "We take all our competition seriously, but I think history is our guide here. We don't see these as potentially being all that significant overall," he added, a sentiment somewhat at odds with Microsoft which last week cited analyst research predicting Arm's PC market share will grow from its curernt 14 percent to 25 percent by 2027.

Which seems far from "pretty insignificant." Gelsinger's words also contrast markedly with past Intel CEO Andy Grove, who penned a book titled "Only the Paranoid Survive: How to Exploit the Crisis Points That Challenge Every Company." While Gelsinger doesn't see Arm as a threat, he said Intel Foundry Services is more than happy to work with chipmakers to build chips based on the architecture. "When you're thinking about other alternative architectures like Arm, we also say, 'Wow, what a great opportunity for our foundry'," he said. To that end, the in April 2023 the chipmaker announced a strategic partnership with Arm to make it easier to produce chips on the architecture in Intel foundries.

An anonymous reader shares a report: Microsoft is starting to roll out new changes to Windows Ink that let you write anywhere you can type in Windows 11. After months of previewing the changes, the handwriting-to-text conversion now works inside search boxes and other elements of Windows 11 where you'd normally type your input. [...] If you have a Surface device with a stylus or any other Windows tablet that supports Windows Ink then you'll immediately see this new feature if you head into Settings and start to write into a search box, or in other text edit fields in Windows 11.

iFixit has started selling genuine replacement parts for Microsoft Surface devices. From a report: The company now offers SSDs, batteries, screens, kickstands, and a whole bunch of other parts for 15 Surface products. Some of the devices on that list include the Surface Pro 9, Surface Laptop 5, Surface Go 4, Surface Studio 2 Plus, and others. You can check out the entire list of supported products and parts in this post on Microsoft's website. In addition to supplying replacement parts, iFixit also offers disassembly videos and guides for each product, as well as toolkits that include things like an opening tool, tweezers, drivers, and more.

Google has expanded its vulnerability rewards program (VRP) to include attack scenarios specific to generative AI. From a report: In an announcement shared with TechCrunch ahead of publication, Google said: "We believe expanding the VRP will incentivize research around AI safety and security and bring potential issues to light that will ultimately make AI safer for everyone." Google's vulnerability rewards program (or bug bounty) pays ethical hackers for finding and responsibly disclosing security flaws.

Given that generative AI brings to light new security issues, such as the potential for unfair bias or model manipulation, Google said it sought to rethink how bugs it receives should be categorized and reported. The tech giant says it's doing this by using findings from its newly formed AI Red Team, a group of hackers that simulate a variety of adversaries, ranging from nation-states and government-backed groups to hacktivists and malicious insiders to hunt down security weaknesses in technology. The team recently conducted an exercise to determine the biggest threats to the technology behind generative AI products like ChatGPT and Google Bard.

Hyundai said this week that it will set up "mobile clinics" at five U.S. locations to provide anti-theft software upgrades for vehicles now regularly targeted by thieves using a technique popularized on TikTok and other social media platforms. From a report: The South Korean automaker will hold the clinics, which will run for two to three days on or adjacent to weekends, in New York City; Chicago; Minneapolis; St. Paul, Minnesota; and Rochester, New York. The clinics will take place between Oct. 28 and Nov. 18. Hyundai said it will also support single-day regional clinics run by dealerships before the end of 2023, although it didn't name locations or dates.

Negotiations to merge Western Digital's semiconductor memory business and Japan's Kioxia Holdings have been terminated, Nikkei reported Thursday. From the report: The companies were aiming to reach an agreement by the end of October. U.S.-based Western Digital by Thursday had notified Kioxia that it would exit the talks after the merger failed to secure approval from SK Hynix, an indirect shareholder in Kioxia. The companies were also unable to agree on the merger's conditions with Bain Capital, Kioxia's top shareholder. Kioxia, formerly known as Toshiba Memory, and Western Digital have both suffered a downturn in earnings amid headwinds in memory chips. They are each seeking capital infusions and other measures to help bolster operations.

Kioxia ranks third in global market share for NAND flash memory, while Western Digital ranks fourth. The proposed merger would have resulted in an entity that rivals market leader Samsung Electronics, and the companies had hoped the larger scale would lead to greater profits and growth. But SK Hynix officially declared its opposition to the deal on Thursday. SK Hynix had invested about 400 billion yen ($2.67 billion at current rates) in the Bain-led consortium that acquired what is now Kioxia from Toshiba. The South Korean company is now second only to Samsung in NAND memory, and was worried that the Western Digital-Kioxia merger would hurt its position while derailing partnerships it had been exploring with Kioxia.

An anonymous reader quotes a report from NPR: Two Ukrainian hacktivist groups are claiming to have broken into Russia's largest private bank, Alfa-Bank. In a blog post last week, the hackers from groups called KibOrg and NLB shared screenshots of what appears to be an internal database belonging to Alfa-Bank, as well as personal details of several Russian individuals as "confirmation" of the breach. Within the database, the hackers say there are over 30 million records including names, birthdates, account numbers and phone numbers of Russian customers.

Adding some legitimacy to those claims, a Ukrainian intelligence official who requested anonymity to discuss the sensitive operation confirmed to NPR that Ukraine's top counterintelligence agency, the SBU, helped the hacktivists breach Alfa-Bank. The official did not share additional details about how the SBU participated or any further plans for sharing the stolen data. Ukrainian journalists including from cybersecurity website The Record previously reported on the connection to the SBU. While the hacktivists did not immediately respond to a request to discuss the breach, they wrote in the blog post -- posted on their own site -- that they would be sharing the data obtained from Alfa-Bank with investigative journalists. Alfa-Bank has not publicly responded to the news of the hack.

Researchers have devised an attack that forces Apple's Safari browser to divulge passwords, Gmail message content, and other secrets by exploiting a side channel vulnerability in the A- and M-series CPUs running modern iOS and macOS devices. From a report: iLeakage, as the academic researchers have named the attack, is practical and requires minimal resources to carry out. It does, however, require extensive reverse-engineering of Apple hardware and significant expertise in exploiting a class of vulnerability known as a side channel, which leaks secrets based on clues left in electromagnetic emanations, data caches, or other manifestations of a targeted system. The side channel in this case is speculative execution, a performance enhancement feature found in modern CPUs that has formed the basis of a wide corpus of attacks in recent years. The nearly endless stream of exploit variants has left chip makers -- primarily Intel and, to a lesser extent, AMD -- scrambling to devise mitigations.

The researchers implement iLeakage as a website. When visited by a vulnerable macOS or iOS device, the website uses JavaScript to surreptitiously open a separate website of the attacker's choice and recover site content rendered in a pop-up window. The researchers have successfully leveraged iLeakage to recover YouTube viewing history, the content of a Gmail inbox -- when a target is logged in -- and a password as it's being autofilled by a credential manager. Once visited, the iLeakage site requires about five minutes to profile the target machine and, on average, roughly another 30 seconds to extract a 512-bit secret, such as a 64-character string.

Intel's latest 14th Gen chips aren't a huge improvement over the 13th Gen in gaming performance, but a new Intel Application Optimization (APO) feature might just change that. From a report: Intel's new APO app simply runs in the background, improving performance in games. It offers impressive boosts to frame rates in games that support it, like Tom Clancy's Rainbow Six Siege and Metro Exodus. Intel Application Optimization essentially directs application resources in real time through a scheduling policy that fine-tunes performance for games and potentially even other applications in the future.

It operates alongside Intel's Thread Director, a technology that's designed to improve how apps and games are assigned to performance or efficiency cores depending on the performance needs. The result is some solid gains to performance in certain games, with one Reddit poster seeing a 200fps boost in Rainbow Six Siege at 1080p. "Not all games benefit from APO," explained Intel VP Roger Chandler in a press briefing ahead of the 14th Gen launch. "As we test and verify games we will add those that benefit the most, so gamers can get the best performance from their systems."

SonicSpike shares a report from Politico: An agency set up under Donald Trump to protect elections and key U.S. infrastructure from foreign hackers is now fighting off increasingly intense threats from hard-right Republicans who argue it's gone too far and are looking for ways to rein it in. These lawmakers insist work by the Cybersecurity and Infrastructure Security Agency to combat online disinformation during elections singles out conservative voices and infringes upon free speech rights -- an allegation the agency vehemently denies and the Biden administration is contesting in court. The accusations started in the wake of the 2020 election and are ramping up ahead of 2024, with lawmakers now calling for crippling cuts at the agency. "CISA has blatantly violated the First Amendment and colluded with Big Tech to censor the speech of ordinary Americans," Rand Paul (R-Ky.), the ranking member of the Senate Homeland Security Committee, which oversees CISA, said in a statement to POLITICO.

The fight over CISA underscores yet another way Trump's election fraud claims are reverberating into 2024. And though the hard right doesn't have enough votes to defund CISA today, the growing backlash against it has supporters worried that a hard-right faction could hobble the agency in the years ahead -- undermining its efforts not just to secure future elections, but also protect key U.S. and federal networks from major hacks. CISA had broad bipartisan support in Congress when lawmakers passed legislation creating the agency in 2018. At the ceremony where Trump signed it into law, he called it "very, very important legislation" to protect the U.S. against both nation-state hackers and cybercriminals. But when Chris Krebs, the then-head of CISA, debunked Trump's 2020 election fraud claims, the president fired him. And since the GOP assumed control of the House in 2022, like-minded Republicans have been ratcheting up their scrutiny of the agency. [...]

Conservatives now argue that activity has become a smokescreen for left-leaning government censorship. In Congress and within the courts, they contend that pressure from federal agencies like CISA led social media companies to limit the spread of information perceived as damaging to Joe Biden's campaign, such as stories relating to Hunter Biden. In a sign of trouble for an agency once boasting strong bipartisan support, 108 Republicans supported the failed push to cut CISA's budget last month -- a near majority within the conference. Backers of the budget cut included a swathe of increasingly influential hard-right lawmakers, like Jordan and James Comer (R-Ky.), chair of the powerful House Oversight Committee. Those with direct oversight over CISA also backed the vote, such as the chief of the Homeland Security Committee, Mark Green (R-Tenn.), and another panel member, August Pfluger (R-Texas).

Since disclosing a security breach of its support systems Friday, Okta has shed more than $2 billion from its market valuation "Okta shares slumped more than 11% Friday after the company said an unidentified hacking group was able to access client files through a support system," reports CNBC. "The company did not provide more details beyond a set of technical identifiers. The company's stock continued to fall in Monday trading, ultimately closing down 8.1%." From the report: Okta is a lesser-known name but forms a critical part of cybersecurity systems at major corporations. The identity management company boasts more than 18,000 customers who use its products to provide a single login point for many different platforms that a given company uses. Zoom, for example, uses Okta to give "seamless" access through a single login to the company's Google Workspace, ServiceNow, VMware and Workday platforms. Okta said it had communicated with all affected clients in Friday's announcement. At least one of those clients said it had alerted Okta about a potential breach weeks earlier. [...]

Okta has also been at the center of other higher-profile incidents. Earlier this year, for example, casino giants Caesars and MGM were both affected by hacks. Caesars was forced to pay millions in ransom to the hacking group, sources told CNBC. MGM had to shut down critical systems that the company acknowledged would have a material effect on its bottom line in an SEC filing. The direct and indirect losses from those incidents totaled over $100 million. Both those attacks targeted MGM and Caesars' Okta installations, using a sophisticated social engineering attack that went through IT help desks. Three other companies were also targeted by the hacking group, an Okta executive told Reuters.

Okta has also been a target before. A hacking group purportedly accessed numerous Okta systems in a March attempt. That group, Lapsus$, has been tied to hacking attacks at Uber and Grand Theft Auto maker Rockstar Games, a subsidiary of Take-Two Interactive, according to a report from the Cybersecurity and Infrastructure Security Agency.

Qualcomm unveiled a new laptop processor designed to outperform rival products from Intel and Apple on Tuesday, stepping up its long-running effort to break into the personal computer market. From a report: Qualcomm formally launched the Snapdragon X Elite, the flagship platform of its Snapdragon X family that leverages its Oryon CPU core, and promises to double -- yes, double -- the performance of some of the most popular 13th-gen Core chips from AMD and Intel. Sound familiar? It should. Qualcomm promised the same with its earlier Snapdragon 8-series chips, and really didn't deliver. But after buying chip designer Nuvia in 2021, Qualcomm is trying again, hoping that its superpowered Arm chips can once again make Windows on Arm PCs a competitor to conventional X86 PCs when they launch in mid-2024. And they'e talking some big numbers to prove it.

Qualcomm sees Oryon first going into PCs (as the engine of the Snapdragon X Elite platform) but then moving into smartphones, cars, "extended reality" devices, and more, Qualcomm chief executive Cristiano Amon is expected to say today. [...] To begin with, Qualcomm's Snapdragon X Elite is manufactured on a 4nm process node, versus the Intel 4 process node of Intel's Meteor Lake. (The two process technologies aren't directly comparable, though they're close enough for most purposes.) Oryon is a tri-cluster design. Historically, that has meant prime, performance, and efficiency cores, with each type of core taking on their own role depending upon the task. However, it appears that Qualcomm and its X86 rivals may have swapped strategies; as Intel adopts performance and efficiency cores, Qualcomm has chosen AMD's path. There are twelve cores within the Snapdragon X Elite, all running at 3.8GHz. Well, most of the time. If needed one or two of the cores can boost to 4.3GHz, the turbo boost strategy that's become common on the PC. The 64-bit Oryon CPU will be paired with 42Mbytes of total cache, and a memory controller that can access eight channels of LPDDR5x memory (64GB in total) with 130GBps memory bandwidth, executives said. It will be a single die, not a chiplet design.

An anonymous reader shares a report: Most Android users have probably never seen Google Play Protect in action. The malware-scanning service is built into every Android device and is supposed to flag malware that users have installed. Recently it flagged some popular apps that are very much not malware: Samsung Wallet and Samsung Messages.

As spotted by 9to5Google, Samsung users have been getting hit with Play Protect warnings since earlier this month. Users on the Google Support forum have posted screenshots of Play Protect flagging the Samsung system apps, and even Samsung responded to the issue, explaining (in Korean) how to fix any damage caused by the bug. Samsung says (through translation) the issue was caused by "a temporary failure of the Google server" and should now be fixed.

Downloading Chrome using Microsoft Edge is already a nightmare filled with banners and stop-gaps, and nothing seems to be stopping Microsoft from adding even more. From a report: Last weekend, we noticed that an attempt to download Google Chrome using Microsoft Edge results in the latter opening its sidebar with a poll, asking you to explain to Microsoft how you could dare try downloading Google Chrome. Of course, the exact wording is more tame, but you get the idea. Now, besides dismissing several banners and a full-size ad injected on the Chrome website, Edge wants you to answer a questionnaire with the following options:

We love having you! Can you please take a minute to tell us why you are trying another browser?

I can't search Google easily
I can't access my Google documents
I don't have my favorites or passwords here
Too many ads and pop-ups
I don't like the news feed
It's too slow
My websites don't work on Microsoft Edge
My reason is not listed

Unciphered, a Seattle-based startup, claims to have cracked the seemingly unbreakable encryption of IronKey S200, a decade-old USB thumb drive. By exploiting an undisclosed vulnerability in the device, the company says it can bypass the drive's feature that erases its contents after 10 incorrect password attempts. The breakthrough came within a day of receiving a test device, suggesting that the firm's hacking technique, powered by high-performance computing, could have far-reaching implications.

The startup's focus is not just technological; it's after a specific IronKey that holds 7,002 bitcoins, valued at roughly $235 million, stored in a Swiss bank vault. The device belongs to Stefan Thomas, a Swiss crypto entrepreneur, who has forgotten the password and has only two password attempts left before losing access to his fortune. Unciphered believes its hacking capabilities could unlock Thomas' crypto vault and is preparing to reach out to him to offer its services. The only problem: Thomas doesn't seem to want their help. Wired: Earlier this month, not long after performing their USB-decrypting demonstration for me, Unciphered reached out to Thomas through a mutual associate who could vouch for the company's new IronKey-unlocking abilities and offer assistance. The call didn't even get as far as discussing Unciphered's commission or fee before Thomas politely declined. Thomas had already made a "handshake deal" with two other cracking teams a year earlier, he explained. In an effort to prevent the two teams from competing, he had offered each a portion of the proceeds if either one could unlock the drive. And he remains committed, even a year later, to giving those teams more time to work on the problem before he brings in anyone else -- even though neither of the teams has shown any sign of pulling off the decryption trick that Unciphered has already accomplished.

That has left Unciphered in a strange situation: It holds what is potentially one of the most valuable lockpicking tools in the cryptocurrency world, but with no lock to pick. "We cracked the IronKey," says Nick Fedoroff, Unciphered's director of operations. "Now we have to crack Stefan. This is turning out to be the hardest part." In an email to WIRED, Thomas confirmed that he had turned down Unciphered's offer to unlock his encrypted fortune. "I have already been working with a different set of experts on the recovery so I'm no longer free to negotiate with someone new," Thomas wrote. "It's possible that the current team could decide to subcontract Unciphered if they feel that's the best option. We'll have to wait and see." In past interviews, Thomas has said that his 7,002 bitcoins were left over from a payment he received for making a video titled "What is Bitcoin?" that published on YouTube in early 2011, when a bitcoin was worth less than a dollar. Later that year, he told WIRED that he'd inadvertently erased two backup copies of the wallet that held those thousands of coins, and then lost the piece of paper with the password to decrypt the third copy, stored on the IronKey. By then, his lost coins were worth close to $140,000.

Lawrence Abrams reports via BleepingComputer: 1Password, a popular password management platform used by over 100,000 businesses, suffered a security breach after hackers gained access to its Okta ID management tenant. "We detected suspicious activity on our Okta instance related to their Support System incident. After a thorough investigation, we concluded that no 1Password user data was accessed," reads a very brief security incident notification from 1Password CTO Pedro Canahuati. "On September 29, we detected suspicious activity on our Okta instance that we use to manage our employee-facing apps. We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing."

On Friday, Okta disclosed that threat actors breached its support case management system using stolen credentials. As part of these support cases, Okta routinely asks customers to upload HTTP Archive (HAR) files to troubleshoot customer problems. However, these HAR files contain sensitive data, including authentication cookies and session tokens that can be used to impersonate a valid Okta customer. Okta first learned of the breach from BeyondTrust, who shared forensics data with Okta, showing that their support organization was compromised. However, it took Okta over two weeks to confirm the breach.

Google is getting ready to test a new "IP Protection" feature for the Chrome browser that enhances users' privacy by masking their IP addresses using proxy servers. From a report: Recognizing the potential misuse of IP addresses for covert tracking, Google seeks to strike a balance between ensuring users' privacy and the essential functionalities of the web. IP addresses allow websites and online services to track activities across websites, thereby facilitating the creation of persistent user profiles. This poses significant privacy concerns as, unlike third-party cookies, users currently lack a direct way to evade such covert tracking.

While IP addresses are potential vectors for tracking, they are also indispensable for critical web functionalities like routing traffic, fraud prevention, and other vital network tasks. The "IP Protection" solution addresses this dual role by routing third-party traffic from specific domains through proxies, making users' IP addresses invisible to those domains. As the ecosystem evolves, so will IP Protection, adapting to continue safeguarding users from cross-site tracking and adding additional domains to the proxied traffic. "Chrome is reintroducing a proposal to protect users against cross-site tracking via IP addresses. This proposal is a privacy proxy that anonymizes IP addresses for qualifying traffic as described above," reads a description of the IP Protection feature. Initially, IP Protection will be an opt-in feature, ensuring users have control over their privacy and letting Google monitor behavior trends.

Matter -- the IOT connectivity standard with ambitions to fix the smart home and make all of our gadgets talk to each other -- has hit version 1.2, adding support for nine new types of connected devices. From a report: Robot vacuums, refrigerators, washing machines, and dishwashers are coming to Matter, as are smoke and CO alarms, air quality sensors, air purifiers, room air conditioners, and fans. It's a crucial moment for the success of the industry-backed coalition that counts 675 companies among its members. This is where it moves from the relatively small categories of door locks and light bulbs to the real moneymakers: large appliances.

The Connectivity Standards Alliance (CSA), the organization behind Matter, released the Matter 1.2 specification this week, a year after launching Matter 1.0, following through on its promise to release two updates a year. Now, appliance manufacturers can add support for Matter to their devices, and ecosystems such as Apple Home, Amazon Alexa, Google Home, and Samsung SmartThings can start supporting the new device types. Yes, this means you should finally be able to control a robot vacuum in the Apple Home app -- not to mention your wine fridge, dishwasher, and washing machine.

The initial feature set for the new device types includes basic function controls (start / stop, change mode) and notifications -- such as the temperature of your fridge, the status of your laundry, or whether smoke is detected. Robot vacuum support is robust -- remote start and progress notifications, cleaning modes (dry vacuum, wet mopping), and alerts for brush status, error reporting, and charging status. But there's no mapping, so you'll still need to use your vacuum app if you want to tell the robot where to go.

An anonymous reader shares a report: In 2020, scientists decided just to rework the alphanumeric symbols they used to represent genes rather than try to deal with an Excel feature that was interpreting their names as dates and (un)helpfully reformatting them automatically. Last week, a member of the Excel team posted that the company is rolling out an update on Windows and macOS to fix that. Excel's automatic conversions are intended to make it easier and faster to input certain types of commonly entered data -- numbers and dates, for instance. But for scientists using quick shorthand to make things legible, it could ruin published, peer-reviewed data, as a 2016 study found.

Microsoft detailed the update in a blog post last week, adding a checkbox labeled "Convert continuous letters and numbers to a date." You can probably guess what that toggles. The update builds on the Automatic Data Conversions settings the company added last year, which included the option for Excel to warn you when it's about to get extra helpful and let you load your file without automatic conversion so you can ensure nothing will be screwed up by it.