Verizon's Visible network has confirmed that some accounts were accessed without authorization. Visible is a cell service owned and operated by Verizon that "pitches itself as a less expensive, 'all-digital' network, meaning there aren't any physical stores like you'd get with a tradtiional carrier," notes The Verge. From the report: Starting on Monday, customers on both Twitter and Reddit reported en masse that they'd been getting emails from the company about changed passwords and addresses, and that they've had difficulties contacting the company's chat support. Visible's customer service account on Twitter seemingly hasn't addressed the issue, besides directing upset customers to its DMs. A user marked as a Visible employee on the subreddit posted a statement on Monday afternoon, saying that a "small number" of accounts were affected, but that the company didn't believe its systems had been breached. The statement did recommend that users change their passwords, but as many commenters pointed out (and as I can confirm), the password reset system currently isn't working. In a follow-up article, The Verge reports that Visible has confirmed customer reports of attackers accessing and changing user accounts. The company said that the breaches were carried out using usernames and passwords from "outside sources," adding that it's worked to "mitigate the issue" since it became aware of it. They're recommending you reset your password if it's one you've used for other services.

Activision unveiled its Ricochet anti-cheat system for Call of Duty games as it tries to attack a longstanding cheating problem that has frustrated a lot of players. From a report: The new system will get rid of players cheating in Call of Duty: Warzone later this year and it will debut with Call of Duty: Vanguard, the new premium game coming on multiple platforms on November 5. Activision, whose parent company Activision Blizzard has been sued for having an alleged toxic culture of its own, said in its announcement that cheating in Call of Duty is frustrating for players, developers, and the entire community. The anti-cheat team has made great strides in fighting this persistent issue that affects so many, but the company said it knows more must be done. Ricochet is supported by a team of dedicated professionals focused on fighting unfair play.

The Ricochet anti-cheat initiative is a multi-faceted approach to combat cheating, featuring new server-side tools which monitor analytics to identify cheating, enhanced investigation processes to stamp out cheaters, updates to strengthen account security, and more. Ricochet's backend anti-cheat security features will launch alongside Call of Duty: Vanguard, and later this year with the Pacific update coming to Call of Duty: Warzone. In addition to server enhancements coming with Ricochet is a new PC kernel-level driver, developed internally for the Call of Duty franchise, and launching first for Call of Duty: Warzone. This driver will assist in the identification of cheaters, reinforcing and strengthening the overall server security. The kernel-level driver launches alongside the Pacific update for Warzone later this year. Further reading: Cheat Maker Is Not Afraid of Call of Duty's New Kernel-Level Anti-Cheat.

AMD warned last week that its chips are experiencing performance issues in Windows 11, and now Microsoft's first update to its new OS has reportedly made the problems worse. From a report: TechPowerUp reports that it's seeing much higher latency, which means worse performance, after the Windows 11 update went live yesterday. AMD and Microsoft found two issues with Windows 11 on Ryzen processors. Windows 11 can cause L3 cache latency to triple, slowing performance by up to 15 percent in certain games. The second issue affects AMD's preferred core technology, that shifts threads over to the fastest core on a processor. AMD says this second bug could impact performance on CPU-reliant tasks. TechPowerUp measured the L3 cache latency on its Ryzen 7 2700X at around 10ns, and Windows 11 increased this to 17ns. "This was made much worse with the October 12 'Patch Tuesday' update, driving up the latency to 31.9ns," says TechPowerUp. That's a huge jump, and the exact type of issue AMD warned about.

A new study (PDF) by a team of university researchers in the UK has unveiled a host of privacy issues that arise from using Android smartphones. BleepingComputer reports: The researchers have focused on Samsung, Xiaomi, Realme, and Huawei Android devices, and LineageOS and /e/OS, two forks of Android that aim to offer long-term support and a de-Googled experience. The conclusion of the study is worrying for the vast majority of Android users: "With the notable exception of /e/OS, even when minimally configured and the handset is idle these vendor-customized Android variants transmit substantial amounts of information to the OS developer and also to third parties (Google, Microsoft, LinkedIn, Facebook, etc.) that have pre-installed system apps." As the summary table indicates, sensitive user data like persistent identifiers, app usage details, and telemetry information are not only shared with the device vendors, but also go to various third parties, such as Microsoft, LinkedIn, and Facebook. And to make matters worse, Google appears at the receiving end of all collected data almost across the entire table.

It is important to note that this concerns the collection of data for which there's no option to opt-out, so Android users are powerless against this type of telemetry. This is particularly concerning when smartphone vendors include third-party apps that are silently collecting data even if they're not used by the device owner, and which cannot be uninstalled. For some of the built-in system apps like miui.analytics (Xiaomi), Heytap (Realme), and Hicloud (Huawei), the researchers found that the encrypted data can sometimes be decoded, putting the data at risk to man-in-the-middle (MitM) attacks. As the study points out, even if the user resets the advertising identifiers for their Google Account on Android, the data-collection system can trivially re-link the new ID back to the same device and append it to the original tracking history. The deanonymization of users takes place using various methods, such as looking at the SIM, IMEI, location data history, IP address, network SSID, or a combination of these. In response to the report, a Google spokesperson said: "While we appreciate the work of the researchers, we disagree that this behavior is unexpected -- this is how modern smartphones work. As explained in our Google Play Services Help Center article, this data is essential for core device services such as push notifications and software updates across a diverse ecosystem of devices and software builds. For example, Google Play services uses data on certified Android devices to support core device features. Collection of limited basic information, such as a device's IMEI, is necessary to deliver critical updates reliably across Android devices and apps."

A woman allegedly hacked into the systems of a flight training school in Florida to delete and tamper with information related to the school's airplanes. In some cases, planes that previously had maintenance issues had been "cleared" to fly, according to a police report. The hack, according to the school's CEO, could have put pilots in danger. From a report: Lauren Lide, a 26-year-old who used to work for the Melbourne Flight Training school, resigned from her position of Flight Operations Manager at the end of November of 2019, after the company fired her father. Months later, she allegedly hacked into the systems of her former company, deleting and changing records, in an apparent attempt to get back at her former employer, according to court records obtained by Motherboard. The news of her arrest was first reported by local TV station News Channel 8.

Derek Fallon, the CEO of Melbourne Flight Training called the police on January 17, 2020, and reported that five days before, he logged onto his account for Flight Circle, an app his company uses to manage and keep track of its airplanes, and found that there was missing information. Fallon found that someone had removed records related to planes with maintenance issues and reminders of inspections had all been deleted, "meaning aircraft which may have been unsafe to fly were purposely made 'airworthy,'" according to a document written by a Melbourne Airport Police officer.

Coinbase is getting into NFTs. The cryptocurrency exchange said Tuesday it plans to launch a marketplace that lets users mint, collect and trade NFTs, or non-fungible tokens. From a report: Users can sign up to a waitlist for early access to the feature, the company said. NFTs are one-of-a-kind digital assets designed to represent ownership of online items like rare art or collectible trading cards. They aren't fungible, meaning you can't exchange one NFT for another like you could with bitcoin and other cryptocurrencies. Sales of such tokens have boomed this year. The NFT market topped $10 billion in transaction volume in the third quarter of 2021, according to DappRadar, a company that tracks data on crypto-based applications.

Japanese technology giant Olympus has confirmed it was hit by a cyberattack over the weekend that forced it to shut down its IT systems in the U.S., Canada and Latin America. From a report: In a statement on its website, Olympus said it is "investigating a potential cybersecurity incident detected October 10" and is "currently working with the highest priority to resolve this issue."

"As part of the investigation and containment, we have suspended affected systems and have informed the relevant external partners. The current results of our investigation indicate the incident was contained to the Americas with no known impact to other regions. We are working with appropriate third parties on this situation and will continue to take all necessary measures to serve our customers and business partners in a secure way. Protecting our customers and partners and maintaining their trust in us is our highest priority. Our investigation is ongoing and we are committed to transparent disclosure and will continue to provide updates as new information becomes available."

It's near-identical to a statement put out by Olympus last month following a cyberattack on its European, Middle East and Africa network.

Microsoft said its Azure cloud service mitigated a 2.4 terabytes per second (Tbps) distributed denial of service attack this year, at the end of August, representing the largest DDoS attack recorded to date. From a report: Amir Dahan, Senior Program Manager for Azure Networking, said the attack was carried out using a botnet of approximately 70,000 bots primarily located across the Asia-Pacific region, such as Malaysia, Vietnam, Taiwan, Japan, and China, as well as the United States. Dahan identified the target of the attack only as "an Azure customer in Europe."

The Microsoft exec said the record-breaking DDoS attack came in three short waves, in the span of ten minutes, with the first at 2.4 Tbps, the second at 0.55 Tbps, and the third at 1.7 Tbps. Dahan said Microsoft successfully mitigated the attack without Azure going down. Prior to Microsoft's disclosure today, the previous DDoS record was held by a 2.3 Tbps attack that Amazon's AWS division mitigated in February 2020.

An anonymous reader shares a report: By the end of 2021, cybercrime is expected to cost the world $6 trillion. And by 2025, this figure will climb to $10.5 trillion, according to Cybersecurity Ventures. There's been a rash of recent high-profile cyberattacks, including Colonial Pipeline, the SolarWinds breach, and JBS USA. That's perhaps why 80% of senior IT employees believe that their companies lack sufficient protection against cyberattacks, despite increased security investments made in 2020.

To address the challenges, Google today at Google Cloud Next 2021 debuted Work Safer, a program to help organizations, employees, and partners collaborate in hybrid work environments. It also unveiled a new security-focused task force --- the Cybersecurity Action Team -- and a security and resilience framework, in addition to enhanced security capabilities in Workspace. The announcements come after research showing that companies want cloud providers to increase their security efforts. According to a a recent Tripwire survey, while the majority of enterprises believe that public cloud providers are doing enough to ensure security for users, it's "just barely adequate."

LibreOffice and OpenOffice have pushed updates to address a vulnerability that makes it possible for an attacker to manipulate documents to appear as signed by a trusted source. Although the severity of the flaw is classified as moderate, the implications could be dire. BleepingComputer reports: The discovery of the flaw, which is tracked as CVE-2021-41832 for OpenOffice, was the work of four researchers at the Ruhr University Bochum. The same flaw impacts LibreOffice, which is a fork of OpenOffice spawned from the main project over a decade ago, and for their project is tracked as CVE-2021-25635. If you're using either of the open-source office suites, you're advised to upgrade to the latest available version immediately. For OpenOffice, that would be 4.1.10 and later, and for LibreOffice, 7.0.5 or 7.1.1 and later. Since neither of these two applications offer auto-updating, you should do it manually by downloading the latest version from the respective download centers -- LibreOffice, OpenOffice. If you're using Linux and the aforementioned versions aren't available on your distribution's package manager yet, you are advised to download the "deb", or "rpm" package from the Download center or build LibreOffice from source. If updating to the latest version is not possible for any reason, you can always opt to completely disable the macro features on your office suite, or avoid trusting any documents containing macros.

Microsoft has shared details of a new known issue with Windows 11. The company has confirmed that a problem exists with apps that use certain characters in registry keys. From a report: As a result of the discovery, Microsoft has put a compatibility hold in place that means people with problematic apps installed will not be offered Windows 11 via Windows Update. The issue is under investigation. It seems that the issue is related to, or is an extension of, one of the three initial known issues with Windows 11.

Google has pulled several "stalkerware" ads that violated its policies by promoting apps that encouraged prospective users to spy on their spouses' phone. From a report: These consumer-grade spyware apps are often marketed to parents wishing to monitor their child's calls, messages, apps, photos and location, often under the guise of protecting against predators. But these apps, which are often designed to be installed surreptitiously and without the device owner's consent, have been repurposed by abusers to spy on the phones of their spouses.

[...] Last August, Google banned ads in users' search results that promoted apps that are designed "with the express purpose of tracking or monitoring another person or their activities without their authorization." But TechCrunch found five app makers were still advertising their stalkerware apps as recently as last week. "We do not allow ads promoting spyware for partner surveillance. We immediately removed the ads that violated this policy and will continue to track emerging behaviors to prevent bad actors from trying to evade our detection systems," a Google spokesperson told TechCrunch.

Cristiano Amon is the new boss of Qualcomm, a U.S. tech giant that designs semiconductors. His first task: Convince companies to make more chips for him -- and fast. From a report: Months before Cristiano Amon started as CEO of Qualcomm, he already was at work on his first crisis. To solve it, he sat in a mostly empty meeting room in Taipei and pleaded with executives from one of the world's biggest semiconductor makers for more chips. He needed the help so that Qualcomm, a designer of circuits that go into hundreds of millions of electronic devices every year, could chase new markets and meet demand from big customers such as Apple, Samsung Electronics and China's top handset-makers. In fact, he needed the assistance so much that he got permission from the Taiwanese government to arrive in March and then waited through a three-day quarantine. Once he and his team got to the meeting place in a Taipei hotel, they negotiated with counterparts across a large room outfitted with microphones and speakers to communicate.

"I'm a very big believer that sometimes you have to meet folks in person," said Mr. Amon, who was named CEO in January and officially took over in June. Many new CEOs across the business world had to adjust to their roles amid unprecedented pandemic-era restrictions, getting to know key employees without ever meeting them in person and managing offices and business relationships from far away. Few can say they had a more tumultuous transition than Mr. Amon, a gregarious Brazilian who revels in person-to-person contact. He is juggling a cluster of major challenges -- a global chip shortage, a sudden shift in a key market, and an unexpected acquisition opportunity -- while trying to put his own stamp on a company after working there for more than two decades. He wants to focus on an expansion beyond Qualcomm's core mobile-phone chip business, a shift that began before he took over. "I've been doing many things in parallel and I want to succeed in them all," he said in an interview. "I can't afford not to do them because we're in a hurry."

"I'm done with paying for a virtual private network," writes the New York Times' lead consumer technology writer. [Alternate URLs here and here.] The reality is that web security has improved so much in the last few years that VPN services, which charge monthly subscription fees that cost as much as Netflix, offer superfluous protection for most people concerned about privacy, some security researchers said.

Many of the most popular VPN services are now also less trustworthy than in the past because they have been bought by larger companies with shady track records. That's a deal-breaker when it comes to using a VPN service, which intercepts our internet traffic. If you can't trust a product that claims to protect your privacy, what good is it? "Trusting these people is really critical," Matthew Green, a computer scientist who studies encryption, said about VPN providers. "There's no good way to know what they're doing with your data, which they have huge amounts of control over...."

As a mainstream privacy tool, it's no longer an ideal solution. This sent me down a rabbit hole of seeking alternatives to paying for a VPN. I ended up using some web tools to create my own private network [on the cloud] for free, which wasn't easy... Not only is it free to use, but I no longer have to worry about trust because the operator of the technology is me.
"But I also learned that many casual users may not even need a VPN anymore," the article concludes. (Unless you're living in an authoritarian country and trying to reach information beyond its firewall.) One cybersecurity firm tells the Times that journalists with sensitive contacts or business executives carrying trade secrets might also still benefit from a VPN. But (according to the firm) the rest of us can just try two-factor authentication and keeping all of our software up-to-date. (And if you'd rather not use a public wifi network — use your phone as a mobile hot spot.)

The article also notes that 95% of the top 1,000 websites are now already encrypted with HTTPS, according to W3Techs.

It also points out that one VPN company accused of developing malware nonetheless spent close to a billion dollars to buy at least four other VPN services — and then also bought several VPN review sites, which then give top ratings to VPN services it owns...

The Washington Post explores recent breaches at Twitch and Epik — and asks whether they really signal an upsurge in "hacktivism": The perpetrators of these hacks are distancing themselves from financially driven cybercriminals and ransomware gangs by portraying their attacks as moral crusades against what they said were the companies' sins. In celebratory notes released alongside their data dumps, the Epik hackers said they were sick of the company serving hateful websites, while the Twitch hackers used a hashtag criticizing company efforts to confront harassment and said the site had become a "disgusting cesspool...." Allan Liska, a senior intelligence analyst with the cybersecurity firm Recorded Future, said the growing accessibility and sophistication of hacking tools and the ease with which social media can draw attention to a major hack has contributed to a dramatic upsurge in attacks by "hacktivists..."

[The attacks] also showcase how weak the world's cybersecurity defenses remain despite an eruption of concern after this year's major ransomware attacks, including the crippling cyberattack on Colonial Pipeline that brought panic to fuel markets on the East Coast... Troy Hunt, a security consultant in Australia who created the data-breach notification site Have I Been Pwned, said many such hacks are actually crimes of opportunity, with a loftier mission applied later. He recalled a popular information security joke: "The definition of hacktivist is you hack someone, then make up a reason they deserve it."

"Very often the politically motivated reasons we see are convenient excuses," Hunt said.

Security Week reports: A previously unknown, modular malware family that targets Linux systems has been used in targeted attacks to collect credentials and gain access to victim systems, ESET reported on Thursday. Dubbed FontOnLake, the malware family employs a rootkit to conceal its presence and uses different command and control servers for each sample, which shows how careful its operators are to maintain a low profile.

What's more, the malware developers are constantly modifying the FontOnLake modules, and use three categories of components that have been designed to work together, namely trojanized applications, backdoors, and rootkits.

Evidence suggests that FontOnLake has been used in attacks aimed at organizations in Southeast Asia. The first malware samples related to this family emerged last May. The malware was previously described by Avast and Lacework as the HCRootkit / Sutersu Linux rootkit, as well as by Tencent Security Response Center in a February report.

The various trojanized applications that ESET's researchers have identified during their investigation are used to load custom backdoor or rootkit modules, but also to collect sensitive data when needed. Posing as standard Linux utilities, these files were also designed to achieve persistence on the compromised systems. What the researchers haven't figured out yet is the manner in which the trojanized applications are delivered to the victims. ESET's analysis of FontOnLake has revealed the use of three different backdoors, all written in C++, all using the same Asio library from Boost, and all capable of exfiltrating sshd credentials and bash command history.

The simplest of the three was designed to launch and mediate access to a local SSH server, update itself, and transmit collected credentials. The malware appears to be under development.
The second backdoor was also capable of file manipulation, updating itself, and uploading and downloading files, according to the article, while the third backdoor "accepts remote connections, serves as a proxy and can download and run Python scripts, in addition to exfiltrating credentials."

"Just two years ago the metropolitan areas that serve as the nation's technology hubs seemed to be sucking tech jobs away from other parts of the country," remembers business writer Peter Coy in the New York Times. "A Brookings Institution report in December 2019 noted that just five cities — Boston, San Diego, San Francisco, Seattle and San Jose, Calif. — accounted for more than 90 percent of employment growth in the innovation sector from 2005 to 2017.

"The trend is now in the other direction: The tech hubs' share of employment is falling." This development was already starting in 2019, and the Covid-19 pandemic has accelerated it. Newspapers are full of stories about Silicon Valley tech workers moving to parts of the country where the housing is cheaper and the fishing is better... Employers seem to be benefiting from the trend: Mark Muro, a Brookings senior fellow, told The Wall Street Journal in July that tech companies, by letting people work outside their home offices, can "truly access lost Einsteins all across the country."

The evidence for this shift used to be mostly anecdotal. Now there's hard data. It comes from the Conference Board, a business-supported research organization. Gad Levanon, the founder of the board's Labor Market Institute, gave me a preview of data he has collected using software that tracks almost all the online want ads in the United States. He focused on ads placed by tech employers based in five tech hubs — the same five as those surveyed by Brookings in 2019, except with Los Angeles in place of Boston. His findings? "West Coast tech companies are dramatically shifting their hiring to other parts of the U.S.," Levanon wrote to me in an email. "Not just for tech jobs, but also engineers, scientists, managers, business and financial professionals."

Levanon also analyzed the data according to where new jobs are being offered. "They are moving to all over the place," he wrote me. Some of the jobs, he explained, are in metropolitan areas where the employers were already established — such as New York, Washington, Boston and Austin, Texas. "But some of the shift," he said, "is to areas where they barely hired before" — like Boise, Idaho, and Des Moines, Iowa. Because of the pandemic, employers have gotten more comfortable with hiring people who don't work at their companies' headquarters, Levanon says. Some new hires may be working at home while others are in satellite offices. Casting the net wider gives companies access to more talent — including people who may work for lower salaries because their living costs are cheaper elsewhere.

Google has warned about 14,000 of its users about being targeted in a state-sponsored phishing campaign from APT28, a threat group that has been linked to Russia. BleepingComputer reports: Shane Huntley, who is at the helm of Google's Threat Analysis Group (TAG) that responds to government-backed hacking, notes that the higher-than-usual number of alerts this month comes from "from a small number of widely targeted campaigns which were blocked." The campaign from APT28, also known as Fancy Bear, lead to a larger number of warnings for Gmail users across various industries. In a statement sent by a Google spokesperson, Huntley says that Fancy Bear's phishing campaign accounts for 86% of all the batch warnings delivered this month. He explains that these notifications indicate targeting of the recipient, not a compromise of their Gmail account: "So why do we do these government warnings then? The warning really mostly tells people you are a potential target for the next attack so, now may be a good time to take some security actions."

Huntley says that these warnings are normal for individuals such as activists, journalists, government officials, or people that work national security structures because that's who government-backed entities are targeting. All the phishing emails from the Fancy Bear campaign were blocked by Gmail and did not land in the users' inboxes as they were automatically classified as spam. "As we've previously explained, we intentionally send these notices in batches, rather than at the moment we detect the threat itself, so that attackers cannot track some of our defense strategies," Huntley said.

An anonymous reader quotes a report from TechRadar: BrewDog, one of the world's largest craft beer brewers, has exposed personally identifiable information (PII) belonging to more than 200,000 of its shareholders and customers, according to cybersecurity researchers. Cybersecurity consulting firm PenTest Partners discovered that a flaw in the official BrewDog app, which persisted for more than 18 months, made it easy for anyone to access the PII of other users. In its detailed report, PenTest Partners notes that the mobile app doled out the same hard coded API Bearer Token, which effectively rendered request authorization useless. The researchers say that, thanks to the flaw, any user could append the customerID of another user to the API endpoint URL to extract their PII and other details. In addition to being damaging to the user, the flaw could've also been used to adversely affect the company since the leaked details could've been used to generate QR codes to get discounted and even free beers. BrewDog started using hard-coded tokens with v2.5.5 of its app, launched in March 2020, before finally patching the flaw in v2.5.13 release in September 2021.

Instagram has been experiencing issues for many of us here at The Verge, but it turns out that the problem might be broader than that, according to a statement from Facebook. From a report: "We're aware that some people are having trouble accessing our apps and products," Facebook said in a tweet. "We're working to get things back to normal as quickly as possible and we apologize for any inconvenience."