"A significant swath of our downtown office space is sitting empty," writes a columnist for the Guardian. "New York, Chicago, Atlanta, Los Angeles, Denver, Philadelphia, San Francisco, Houston, Dallas and other big cities are experiencing record-high office vacancies as workers keep working from home and companies keep letting them..." Some face-time is necessary but we're never going to go back to a 100% in-the-office policy, and companies that attempt this will lose talent to those that adapt to the shift. All this means that a substantial amount of square feet in all those tall office buildings in our major metropolitan areas are going to remain empty. The owners of these properties are already feeling the pressure of meeting higher debt maintenance with lower lease revenue, with many facing default. Countless small businesses in downtown areas facing significantly less traffic are closing their doors. And unless something is done, those empty buildings — after the banks have repossessed them from bankrupt borrowers — will become derelict, inviting even more crime and homelessness. It's already happening.

So what to do? The good news is that there are many opportunities for the entrepreneurial.

For example, existing office floors can be turned into less expensive single units for startups and incubators who want to boast a downtown address. Some buildings in cities with a vibrant and residential downtown — like Philadelphia — could be turned into residences. Others that are burdened with older, unsafe, non-air-conditioned school structures could convert this space into classrooms for students. Or perhaps all the homeless people sleeping on the streets outside of these empty structures could be given a warm place to stay with medical and counselling support?

With the continuing boom in e-commerce, warehouse space remains costly but could become more affordable — and logistically accessible — in a downtown structure. Manufacturing space could be more accommodating, with a better location making it easier to procure workers. Other alternatives for these buildings already being considered include vertical farming, storage facilities, gyms and movie sets. Or what about taking the red pill and merely knocking these buildings down and creating open spaces, parks, museums or structures that are more amenable to this new era of downtown life?

Slashdot reader storagedude writes: A quantum computer capable of breaking public-key encryption is likely years away. Unfortunately, so are products that support post-quantum cryptography.

That's the conclusion of an eSecurity Planet article by Henry Newman. With the second round of NIST's post-quantum algorithm evaluations — announced last week — expected to take "several years" and the FIPS product validation process backed up, Newman notes that it will be some time before products based on post-quantum standards become available.

"The delay in developing quantum-resistant algorithms is especially troubling given the time it will take to get those products to market," Newman writes. "It generally takes four to six years with a new standard for a vendor to develop an ASIC to implement the standard, and it then takes time for the vendor to get the product validated, which seems to be taking a troubling amount of time.

"I am not sure that NIST is up to the dual challenge of getting the algorithms out and products validated so that vendors can have products that are available before quantum computers can break current technology. There is a race between quantum technology and NIST vetting algorithms, and at the moment the outcome is looking worrisome."

And as encrypted data stolen now can be decrypted later, the potential for "harvest now, decrypt later" attacks "is a quantum computing security problem that's already here."

Monday a researcher with Google Information Security posted about a new vulnerability he independently found in AMD's Zen 2 processors. Tom's Hardware reports: The 'Zenbleed' vulnerability spans the entire Zen 2 product stack, including AMD's EPYC data center processors and the Ryzen 3000/4000/5000 CPUs, allowing the theft of protected information from the CPU, such as encryption keys and user logins. The attack does not require physical access to the computer or server and can even be executed via JavaScript on a webpage...

AMD added the AMD-SB-7008 Bulletin several hours later. AMD has patches ready for its EPYC 7002 'Rome' processors now, but it will not patch its consumer Zen 2 Ryzen 3000, 4000, and some 5000-series chips until November and December of this year... AMD hasn't given specific details of any performance impacts but did issue the following statement to Tom's Hardware: "Any performance impact will vary depending on workload and system configuration. AMD is not aware of any known exploit of the described vulnerability outside the research environment..."

AMD describes the exploit much more simply, saying, "Under specific microarchitectural circumstances, a register in "Zen 2" CPUs may not be written to 0 correctly. This may cause data from another process and/or thread to be stored in the YMM register, which may allow an attacker to potentially access sensitive information."
The article includes a list of the impacted processors with a schedule for the release of the updated firmware to OEMs.

The Google Information Security researcher who discovered the bug is sharing research on different CPU behaviors, and says the bug can be patched through software on multiple operating systems (e.g., "you can set the chicken bit DE_CFG[9]") — but this might result in a performance penalty.

Thanks to long-time Slashdot reader waspleg for sharing the news.

An anonymous reader quotes a report from TechCrunch: U.S. government services contracting giant Maximus has confirmed that hackers exploiting a vulnerability in MOVEit Transfer accessed the protected health information of as many as 11 million individuals. Virginia-based Maximus contracts with federal, state and local governments to manage and administer government-sponsored programs, such as Medicaid, Medicare, healthcare reform and welfare-to-work. In an 8-K filing on Wednesday, Maximus confirmed that the personal information of a "significant number" of individuals was accessed by hackers exploiting a zero-day vulnerability in MOVEit Transfer, which the organization uses to "share data with government customers pertaining to individuals who participate in various government programs."

While Maximus hasn't yet been able to confirm the exact number of individuals impacted -- something the company expects to take "several more weeks" -- the organization said it believes hackers accessed the personal data, including Social Security numbers and protected health information, of "at least" 8 to 11 million individuals. If the latter, this would make the breach the largest breach of healthcare data this year -- and the most significant data breach reported as a result of the MOVEit mass-hacks. Maximus has not confirmed which specific types of health data were accessed and has not responded to TechCrunch's questions. In its 8-K filing, the company said it began notifying impacted customers and federal and state regulators, adding that it expects the security incident to cost approximately $15 million to investigate and remediate. Clop, the Russia-linked data extortion group responsible for the MOVEit mass-hacks, claims to have stolen 169 gigabytes of data from Maximus, which it has not yet published. The report notes that "more than 500 organizations have so far been impacted by the MOVEit mass-hacks, exposing the personal information of more than 34.5 million people."

Apple will soon start cracking down on apps that collect data on users' devices in order to track them (aka "fingerprinting"), according to an article on its developer site. Engadget writes: Starting with the release of iOS 17, tvOS 17, watchOS 10 and macOS Sonoma, developers will be required to explain why they're using so-called required reason APIs. Apps failing to provide a valid reason will be rejected started in spring of 2024. "Some APIs... have the potential of being misused to access device signals to try to identify the device or user, also known as fingerprinting. Regardless of whether a user gives your app permission to track, fingerprinting is not allowed," Apple wrote.

"To prevent the misuse of certain APIs that can be used to collect data about users' devices through fingerprinting, you'll need to declare the reasons for using these APIs in your app's privacy manifest." The new rules could increase the rate of app rejections, some developers told 9to5Mac. For instance, an API called UserDefaults falls into the "required reason" category, but since it stores user preferences, it's used by a lot of apps.

Cyber attackers targeted a digital platform used by Kenya's government to deliver services, the country's technology minister said, highlighting the vulnerabilities of the system. From a report: The attack on the e-Citizen platform in recent days caused system outages that left users unable to access a broad range of government services, ranging from passport applications to electricity payments. Some private companies were also affected.

It was "an unsuccessful attempt to overload the system through extraordinary requests, with the intention of clogging it," said Eliud Owalo, cabinet secretary for information technology, in a statement on Thursday. He said technical teams had blocked the source of the requests, adding that privacy and the security of data had not been compromised.

The U.S. Securities and Exchange Commission (SEC) has implemented new rules requiring publicly traded companies to disclose any cyberattacks considered material incidents within four business days of discovery. BleepingComputer reports: According to the Wall Street watchdog, material incidents are those that a public company's shareholders would consider important "in making an investment decision." The SEC also adopted new regulations mandating foreign private issuers to provide equivalent disclosures following cybersecurity breaches. Listed companies must now include details about the cyberattack (including the incident's nature, scope, and timing) in periodic report filings, specifically on 8-K forms.

These new cybersecurity incident reporting rules are set to take effect in December or 30 days after being published in the Federal Register. However, smaller companies will be granted an additional 180 days before they are required to provide Form 8-K disclosures. In some instances, the disclosure timeline may also be postponed if the U.S. Attorney General determines that an immediate disclosure would pose a significant risk to national security or public safety. "Whether a company loses a factory in a fire -- or millions of files in a cybersecurity incident -- it may be material to investors. Currently, many public companies provide cybersecurity disclosure to investors," said SEC Chair Gary Gensler today.

"I think companies and investors alike, however, would benefit if this disclosure were made in a more consistent, comparable, and decision-useful way. Through helping to ensure that companies disclose material cybersecurity information, today's rules will benefit investors, companies, and the markets connecting them."

Hackers are infecting players of an old Call of Duty game with a worm that spreads automatically in online lobbies, according to two analyses of the malware. From a report: On June 26, a user on a Steam forum alerted other players of Call of Duty: Modern Warfare 2 that hackers "attack using hacked lobbies," and suggested running an antivirus. The malware mentioned in the thread appears to be on the malware online repository VirusTotal. Another player claimed to have analyzed the malware and wrote in the same forum thread that the malware appears to be a worm, based on a series of text strings inside the malware. A game industry insider, who asked to remain anonymous because they were not allowed to speak to the press, confirmed that the malware contains those strings, indicating a worm.

Following two years of testing, The Browser Company's Arc is graduating from its waitlist phase, launching its version 1.0. Arc, the Mac and iOS browser, aims to redefine online interaction by incorporating tools for note-taking, collaboration, webpage personalisation, among others. The Verge adds: We've covered Arc a lot in recent months, both because it's a good browser and because it's a big new idea about how you use the internet. The Browser Company's ultimate plan is to build "the operating system for the internet." Arc isn't just a place to see webpages; it has tools for taking notes, making visual and collaborative easels with others, redesigning webpages to your liking, and more. (Personally, I love Arc's picture-in-picture mode above everything else, especially now that it works with Google Meet calls.) Arc 1.0 doesn't seem to come with any splashy new features. Rather, The Browser Company seems to just feel like it's ready to launch more widely. Arc has been pretty stable for me in recent months, though it does run into some of the same performance issues you'll find with any browser based on the Chromium engine -- you can always open a couple dozen tabs and watch your computer grind to a halt.

An anonymous reader shares a report: In January, artificial intelligence powerhouse OpenAI announced a tool that could save the world -- or at least preserve the sanity of professors and teachers -- by detecting whether a piece of content had been created using generative AI tools like its own ChatGPT. Half a year later, that tool is dead, killed because it couldn't do what it was designed to do.

ChatGPT creator OpenAI quietly unplugged its AI detection tool, AI Classifier, last week because of "its low rate of accuracy," the firm said. The explanation was not in a new announcement, but added in a note added to the blog post that first announced the tool. The link to OpenAI's classifier is no longer available. "We are working to incorporate feedback and are currently researching more effective provenance techniques for text, and have made a commitment to develop and deploy mechanisms that enable users to understand if audio or visual content is AI-generated," OpenAI wrote.

Chainalysis' head of investigations doesn't seem to have a great understanding of whether her company's flagship software even works. From a report: Elizabeth Bisbee, head of investigations at Chainalysis Government Solutions, testified she was "unaware" of scientific evidence for the accuracy of Chainalysis' Reactor software used by law enforcement, an unreleased transcript of a June 23 hearing shared with CoinDesk shows.

The fact that Chainalysis' blockchain demystification tools have become so widespread is a serious threat to the crypto ecosystem. Although industry insiders have raged against Chainalysis since it was founded, often accusing it of violating people's financial privacy, there may be a better argument to make against the company and analysis firms like it: it's within the realm of possibility that these "probabilistic" machines don't work as well as advertised. This is a big deal considering Chainalysis' surveillance tools are used widely across the industry for compliance, and have at times led to unjustified account restrictions and -- even worse -- land unsuspecting individuals on the radar of law enforcement agencies without probable cause.

A group of cybersecurity researchers has uncovered what they believe is an intentional backdoor in encrypted radios used by police, military, and critical infrastructure entities around the world. The backdoor may have existed for decades, potentially exposing a wealth of sensitive information transmitted across them, according to the researchers. From a report: While the researchers frame their discovery as a backdoor, the organization responsible for maintaining the standard pushes back against that specific term, and says the standard was designed for export controls which determine the strength of encryption. The end result, however, are radios with traffic that can be decrypted using consumer hardware like an ordinary laptop in under a minute. "There's no other way in which this can function than that this is an intentional backdoor," Jos Wetzels, one of the researchers from cybersecurity firm Midnight Blue, told Motherboard in a phone call.

The research is the first public and in-depth analysis of the TErrestrial Trunked RAdio (TETRA) standard in the more than 20 years the standard has existed. Not all users of TETRA-powered radios use the specific encryption algorithim called TEA1 which is impacted by the backdoor. TEA1 is part of the TETRA standard approved for export to other countries. But the researchers also found other, multiple vulnerabilities across TETRA that could allow historical decryption of communications and deanonymization. TETRA-radio users in general include national police forces and emergency services in Europe; military organizations in Africa; and train operators in North America and critical infrastructure providers elsewhere.

Twelve Norwegian government ministries have been hit by a cyber attack, the Norwegian government said on Monday, the latest attack to hit the public sector of Europe's largest gas supplier and NATO's northernmost member. From a report: "We identified a weakness in the platform of one of our suppliers. That weakness has now been shut," Erik Hope, head of the government agency in charge of providing services to ministries, told a news conference. The attack was identified due to "unusual" traffic on the supplier's platform, Hope said, declining to provide specifics. It was uncovered on July 12 and was being investigated by police.

Amazon has already cut 27,000 jobs in the past few months. Now the Associated Press reports that Amazon "is asking some corporate workers to relocate to other cities as part of its return-to-office policy, which mandates workers to be in the office three days a week." An Amazon spokesperson confirmed on Friday that relocations are happening but would not comment on reports by several news outlets that the tech giant was requiring some workers in smaller offices to move to main offices located in bigger cities. Amazon didn't provide details on the number of employees that will be required to relocate. Amazon spokesperson Brad Glasser said the company will provide "relocations benefits" to workers who are asked to move and consider requests for exceptions on a case-by-case basis...

Citing internal messages, Business Insider reported earlier Amazon employees who refuse to relocate near main offices of their teams are being told they either have to find a new job internally or leave the company through a "voluntary resignation."
"There's more energy, collaboration, and connections happening since we've been working together at least three days per week," an Amazon spokesperson told the Associated Press, adding "we've heard this from lots of employees and the businesses that surround our offices."

The major gaming platform Roblox has suffered a major data breach, leading to the release of personal information including addresses from those who attended the Roblox Developer Conference between 2017-2020. PCGamer reports: The leak contains almost 4,000 names, phone numbers, email addresses, dates of birth, and physical addresses. Such identifying information is gold dust for bad actors, and raises serious questions about the data security of one of the largest gaming platforms around. The website haveibeenpwned says the original breach date was 18 December 2020, with the information becoming available on 18 July 2023, with a total of 3,943 compromised accounts. The site notes that as well as all the above information, the leak even includes each individual's t-shirt size.

The implications of this for those affected are identity theft and scams, with the quantity of data especially worrying: this is basically all you need to effectively impersonate someone. Beyond the above statement, Roblox has made no further comment, and it's likely that the ramifications of this will continue to unfold for some time, especially if anyone on the list is indeed targeted. Anyone concerned should search on haveibeenpwned and enable two-factor authentication on all accounts (as well as keeping an especially close eye on bank transactions for a while). Troy Hunt, the engineer behind haveibeenpwned, said the leak was posted in 2021 but according to an unnamed source didn't spread outside of niche Roblox communities, while at the time the company did not publicly disclose the leak or alert anyone affected. The leak then appeared on a public forum a few days ago. "Roblox is aware of a third-party security issue where there were indications of unauthorized access to limited personal information of a subset of our creator community," said a Roblox spokesperson to PC Gamer. "We engaged independent experts to support the investigation led by our information security team. Those who are impacted will receive an email communicating the next steps we are taking to support them. We will continue to be vigilant in monitoring and vetting the cyber security posture of Roblox and our third-party vendors."

The hack of Microsoft's cloud that resulted in the compromise of government emails was an example of a traditional espionage threat, a senior National Security Agency official said. From a report: Speaking at the Aspen Security Forum, Rob Joyce, the director of cybersecurity at the N.S.A., said the United States needed to protect its networks from such espionage, but that adversaries would continue to try to secretly extract information from each other. "It is China doing espionage," Mr. Joyce said. "It is what nation-states do. We have to defend against it, we need to push back against it. But that is something that happens."

The hackers took emails from senior State Department officials including Nicholas Burns, the U.S. ambassador to China. The theft of Mr. Burns's emails was earlier reported by The Wall Street Journal and confirmed by a person familiar with the matter. Daniel J. Kritenbrink, the assistant secretary of state for East Asia, also had his email hacked, a U.S. official said. The emails of Commerce Secretary Gina Raimondo were also obtained in the hack, which was discovered in June by State Department cybersecurity experts scouring user logs for unusual activity. Microsoft later determined that Chinese hackers had obtained access to email accounts a month earlier.

The Cyber Police Department of the National Police of Ukraine dismantled another massive bot farm, seizing computer equipment, mobile phones, and roughly 150,000 SIM cards of multiple mobile operators. BleepingComputer reports: The bots were used to push Russian propaganda justifying Russia's war in Ukraine, to disseminate illegal content and personal information, and in various other fraudulent activities. In a joint operation, the cyber police and units of the Ukrainian National Police executed 21 search operations in Vinnytsia, Zaporizhzhia, and Lvivand.

"The cyber police established that the attackers used special equipment and software to register thousands of bot accounts in various social networks and subsequently launch advertisements that violated the norms and legislation of Ukraine," a cyber police press release reads [machine translation]. "In addition to spreading hostile propaganda, the accounts were also used for unauthorized distribution of personal data of Ukrainian citizens on the Internet, in Internet fraud schemes, and for sending known false messages about threats to citizens' safety, destruction or damage to property." Cyber police in Ukraine have busted several pro-Russian bot farms in the last year, including one last month called "Botoferma" and another one late last year that was working for the Russian secret services. Ukraine also traced a Russian propaganda operation to a bot farm that was secretly operating in the country's own capital of Kyiv last August. "The farm operated more than 1 million bot accounts, which helped the propaganda operation build an audience of over 400,000 users on social media," reports PCMag.

Researchers have warned that leaked information from a ransomware attack on hardware-maker Gigabyte two years ago may contain critical zero-day vulnerabilities that pose a significant risk to the computing world. The vulnerabilities were found in firmware made by AMI for BMCs (baseboard management controllers), which are small computers integrated into server motherboards allowing remote management of multiple computers. These vulnerabilities, which can be exploited by local or remote attackers with access to Redfish remote management interfaces, could lead to unauthorized access, remote code execution, and potential physical damage to servers. Ars Technica reports: Until the vulnerabilities are patched using an update AMI published on Thursday, they provide a means for malicious hackers -- both financially motivated or nation-state sponsored -- to gain superuser status inside some of the most sensitive cloud environments in the world. From there, the attackers could install ransomware and espionage malware that runs at some of the lowest levels inside infected machines. Successful attackers could also cause physical damage to servers or indefinite reboot loops that a victim organization can't interrupt. Eclypsium warned such events could lead to "lights out forever" scenarios.

The researchers went on to note that if they could locate the vulnerabilities and write exploits after analyzing the publicly available source code, there's nothing stopping malicious actors from doing the same. And even without access to the source code, the vulnerabilities could still be identified by decompiling BMC firmware images. There's no indication malicious parties have done so, but there's also no way to know they haven't. The researchers privately notified AMI of the vulnerabilities, and the company created firmware patches, which are available to customers through a restricted support page. AMI has also published an advisory here.

Google today announced its support for interoperable end-to-end encrypted communication between large messaging platforms, with plans to integrate the MLS protocol into Google Messages and Android. 9to5Google reports: Google says it is "strongly supportive of regulatory efforts that require interoperability for large end-to-end messaging platforms," which is presumably in reference to the European Union's Digital Markets Act. That regulation would require iMessage to be interoperable with other messaging platforms. To achieve this, Google says this interoperability requires "open, industry-vetted standards, particularly in the area of privacy, security, and end-to-end encryption." If not, end-to-end encrypted group messaging and other advanced features would be "impossible in practice." Specifically, "group messages would have to be encrypted and delivered multiple times to cater for every different protocol." [...]

Google says MLS would make possible "practical interoperability across services and platforms, scaling to groups of thousands of multi-device users." This could "unleash a huge field of new opportunities for the users and developers of interoperable messaging services that adopt it."; It is also flexible enough to allow providers to address emerging threats to user privacy and security, such as quantum computing. Google plans to build MLS into its Messages app, which offers E2EE 1:1 and group RCS chats today, and "support its wide deployment across the industry by open sourcing our implementation in the Android codebase." How RCS factors into this remains to be seen.

Apple says it will remove services such as FaceTime and iMessage from the UK rather than weaken security if new proposals are made law and acted upon. From a report: The government is seeking to update the Investigatory Powers Act (IPA) 2016. It wants messaging services to clear security features with the Home Office before releasing them to customers. The act lets the Home Office demand security features are disabled, without telling the public.

Under the update, this would have to be immediate. Currently, there has to be a review, there can also be an independent oversight process and a technology company can appeal before taking any action. Because of the secrecy surrounding these demands, little is known about how many have been issued and whether they have been complied with. But many messaging services currently offer end-to-end encryption - so messages can be unscrambled by only the devices sending and receiving them.