For years, a mysterious figure has been stealing books before their release. Is it espionage? Revenge? Or a complete waste of time? Vulture: On the spectrum of cyberattacks, this one wasn't very complex. There was no malicious software or actual hacking involved. Some of the earliest victims used Gmail accounts for work, which were easy and free to spoof. Registering an alternate domain and setting up an email server was only slightly more involved, and the possibilities were endless: t's became f's (@wwnorfon.com), q's replaced g's (@wylieaqency.com), r's and n's cornbined to make m's (@penguinrandornhouse.com). The domains suggested someone who liked to play with words as much as code. Books became bocks, unless the company was Dutch, in which case boek was Anglicized to book.

What did seem sophisticated was the thief's knowledge of the business. The culprit wrote like someone in publishing, abbreviating to "MS" for manuscript and "WEL" for world English-language rights, while exchanging insider chatter, telling one victim that a publisher was pitching a book as a comp to Pachinko and expressing surprise to another that a novel had recently sold for a shocking amount. The thief sent messages in the wake of announcements on Publishers Marketplace, a subscription website that tracks deals, but they also asked about books that the thief's marks didn't even know existed. The mimicry wasn't always perfect -- an assistant at the talent agency WME realized her boss was being impersonated because she would never say "please" or "thank you" -- but the impression was good enough.

What's more, the thief seemed to have a strong grasp of the rarefied world of international publishing. The first emails, in the fall of 2016, traveled almost exclusively among the small group of people who handle the flow of manuscripts between countries, including a foreign-rights manager in Greece, an editor in Spain, and an agent selling international writers in the Chinese market. In the attempted "Millennium" heist, only a few dozen people in the world knew the book was being shared with foreign publishers and that Mork and Altrov Berg controlled access to it.

Google is the latest manufacturer to bid farewell to the in-box charging brick, saying it expects the Pixel 5A will be the last phone to include one. That means the Pixel 6 and Pixel 6 Pro won't include one when they arrive this fall. From a report: The company says that most people already have a USB-C charging brick, so there's no longer a need to include one with its phones. Apple and Samsung made similar arguments when they announced they would no longer be offering an in-box charger. That may be true, but it's likely that the cost savings of not including a charger played a big role in those decisions.

A security researcher has discovered a web attack framework developed by a suspected Chinese government hacking group and used to exploit vulnerabilities in 58 popular websites to collect data on possible Chinese dissidents. From a report: Fifty-seven of the sites are popular Chinese portals, while the last is the site for US newspaper, the New York Times. In addition, the tool also abused legitimate browser features in attempts to collect user keystrokes, a large swath of operating system details, geolocation data, and even webcam snapshots of a target's face -- although many of these capabilities weren't as silent as the exploits targeting third-party websites, since they also tended to trigger a browser notification prompt.

Named Tetris, the tool was found secretly uploaded on two websites with a Chinese readership. "The sites both appear to be independent newsblogs," said a security researcher going online under the pseudonym of Imp0rtp3, who analyzed the Tetris attack framework for the first time in a blog post earlier this month. "Both [sites] are focused on China, one site [is focused on China's] actions against Taiwan and Hong-Kong written in Chinese and still updated and the other about general atrocities done by the Chinese government, written in Swedish and last updated [in] 2016," the researcher said. According to Imp0rtp3, users who landed on these two websites were first greeted by Jetriz, the first of Tetris' two components, which would gather and read basic information about a visitor's browser.

Hamburg's state government has been formally warned against using Zoom over data protection concerns. From a report: The German state's data protection agency (DPA) took the step of issuing a public warning yesterday, writing in a press release that the Senate Chancellory's use of the popular videoconferencing tool violates the European Union's General Data Protection Regulation (GDPR) since user data is transferred to the US for processing. The DPA's concern follows a landmark ruling (Schrems II) by Europe's top court last summer which invalidated a flagship data transfer arrangement between the EU and the US (Privacy Shield), finding US surveillance law to be incompatible with EU privacy rights.

The fallout from Schrems II has been slow to manifest -- beyond an instant blanket of legal uncertainty. However a number of European DPAs are now investigating the use of US-based digital services because of the data transfer issue, and in some instances publicly warning against the use of mainstream US tools like Facebook and Zoom because user data cannot be adequately safeguarded when it's taken over the pond. German agencies are among the most proactive in this respect. But the EU's data protection supervisor is also investigating the bloc's use of cloud services from US giants Amazon and Microsoft over the same data transfer concern.

A fix that was made in early June to the GNU C Library (glibc) introduced a new and nastier problem. Steven J. Vaughan-Nichols writes via ZDNet: The first problem wasn't that bad. As Siddhesh Poyarekar, a Red Hat principal software engineer wrote, "In order to mount a minimal attack using this flaw, an attacker needs many pre-requisites to be able to even crash a program using this mq_notify bug." Still, it needed patching and so it was fixed. Alas, the fix contained an even nastier bug. While checking the patch, Nikita Popov, a member of the CloudLinux TuxCare Team, found the problem. It turns out that it is possible to cause a situation where a segmentation fault could be triggered within the library. This can lead to any application using the library crashing. This, of course, would cause a Denial-of-Service (DoS) issue. This problem, unlike the earlier one, would be much easier to trigger. Whoops.

Red Hat gives the problem in its Common Vulnerability Scoring System (CVSS) a score of 7.5, which is "high." An attack using it would be easy to build and requires no privileges to be made. In short, it's bad news. Popov himself thinks "every Linux application including interpreters of other languages (python, PHP) is linked with glibc. It's the second important thing after the kernel itself, so the impact is quite high." [...] The good news is both the vulnerability and code fix have been submitted to the glibc development team. It has already been incorporated into upstream glibc.

In addition, a new test has been submitted to glibc's automated test suite to pick up this situation and prevent it from happening in the future. The bottom line is sometimes changed in unrelated code paths can lead to behaviors changing elsewhere without the programmer realizing what's going on. This test will catch this situation. The Linux distributors are still working out the best way to deploy the fix. In the meantime, if you want to be extra careful -- and I think you should be -- you should upgrade to the newest stable version of glibc 2.34 or higher.

T-Mobile confirmed hackers gained access to the telecom giant's systems in an announcement published Monday. Joseph Cox, reporting at Motherboard: The move comes after Motherboard reported that T-Mobile was investigating a post on an underground forum offering for sale Social Security Numbers and other private data. The forum post at the time didn't name T-Mobile, but the seller told Motherboard the data came from T-Mobile servers.

We have determined that unauthorized access to some T-Mobile data occurred, however we have not yet determined that there is any personal customer data involved," T-Mobile wrote in its new announcement. "This investigation will take some time but we are working with the highest degree of urgency. Until we have completed this assessment we cannot confirm the reported number of records affected or the validity of statements made by others," the announcement added.

A secret terrorist watchlist with 1.9 million records, including classified "no-fly" records was exposed on the internet. The list was left accessible on an Elasticsearch cluster that had no password on it. BleepingComputer reports: July this year, Security Discovery researcher Bob Diachenko came across a plethora of JSON records in an exposed Elasticsearch cluster that piqued his interest. The 1.9 million-strong recordset contained sensitive information on people, including their names, country citizenship, gender, date of birth, passport details, and no-fly status. The exposed server was indexed by search engines Censys and ZoomEye, indicating Diachenko may not have been the only person to come across the list.

The researcher discovered the exposed database on July 19th, interestingly, on a server with a Bahrain IP address, not a US one. However, the same day, he rushed to report the data leak to the U.S. Department of Homeland Security (DHS). "I discovered the exposed data on the same day and reported it to the DHS." "The exposed server was taken down about three weeks later, on August 9, 2021." "It's not clear why it took so long, and I don't know for sure whether any unauthorized parties accessed it," writes Diachenko in his report. The researcher considers this data leak to be serious, considering watchlists can list people who are suspected of an illicit activity but not necessarily charged with any crime. "In the wrong hands, this list could be used to oppress, harass, or persecute people on the list and their families." "It could cause any number of personal and professional problems for innocent people whose names are included in the list," says the researcher.

Pearson, a London-based publishing and education giant that provides software to schools and universities has agreed to pay $1 million to settle charges that it misled investors about a 2018 data breach resulting in the theft of millions of student records. From a report: The U.S. Securities and Exchange Commission announced the settlement on Monday after the agency found that Pearson made "misleading statements and omissions" about its 2018 data breach, which saw millions of student usernames and scrambled passwords stolen, along with the administrator login credentials of 13,000 schools, district and university customer accounts.

The agency said that in Person's semi-annual review filed in July 2019, the company referred to the incident as a "hypothetical risk," even after the data breach had happened. Similarly, in a statement that same month, Pearson said the breach may include dates of birth and email addresses, when it knew that such records were stolen, according to the SEC. Pearson also said that it had "strict protections" in place when it actually took the company six months to patch the vulnerability after it was notified.

Slashdot reader lightbox32 shared this report from Motherboard: T-Mobile says it is investigating a forum post claiming to be selling a mountain of personal data. The forum post itself doesn't mention T-Mobile, but the seller told Motherboard they have obtained data related to over 100 million people, and that the data came from T-Mobile servers.

The data includes social security numbers, phone numbers, names, physical addresses, unique IMEI numbers, and driver licenses information, the seller said. Motherboard has seen samples of the data, and confirmed they contained accurate information on T-Mobile customers.
Mashable points out that "it's entirely possible that the seller is misrepresenting the scope of the breach and/or the contents of the information they claim to be selling.

"T-Mobile likely isn't going to say anything until there's a clearer sense of the risks its customers are actually facing."

A new article in Time magazine argues it's time to "follow the science" on working from home.

"The solution for the future is a structured hybrid model, acknowledging that working from home doesn't work long-term for most jobs, while still giving workers flexibility." (Alternate URL here.) One way to do that would be to allocate time slots — perhaps specific days — of in-office working for all employees to maintain workplace productivity and collaboration, while also allowing working from home to continue outside those hours... For some, remote work leads to increased productivity, as well as job satisfaction, particularly for those working in technical jobs that require minimal teamwork... But the science tells us that workers like them are in a minority and, however topical their case is, we should be cautious about applying such a drastic change across our economies.

Since before the pandemic began I have been assessing multi-disciplinary collaboration in a work-from-home environment for my PhD research at Imperial College, London. Individuals employed on creative projects in virtual teams reported feeling more like a 'worker', and less like a member of a family. One respondent said of employers: "They don't see how early you show up in front of your computer...They don't see how hard I'm working." But more damaging than the effects of working from home on individuals, is what it does to teams. Remote work often breaks the mechanisms that allow a team to work together creatively. Studies have found that the best creative work occurs when a team is in a state of flow, or focuses its collective attention on a single problem together, known as 'team flow'. But remote work makes it harder to keep everyone engaged in solving that problem.

In my study, many respondents said it was hard to gauge when a team member had zoned out during a Zoom call. There is currently no digital technology that can reliably create 'flow' remotely, and we shouldn't pretend there is. If it did exist, it wouldn't have taken the necessity of pandemic restrictions for us to work remotely — managers and employees would have already embraced it. There's other evidence that points to this problem. Utah-based virtual whiteboard app Lucidspark found that 75% of 1,000 respondents surveyed in September last year said collaboration was the thing that suffered most when working remotely.
"It is clear from my research that fully autonomous working from home across all industries is neither desirable nor sustainable," the article concludes.

"That's why we need to carve out a third way, where teams that thrive on collaboration are given mandatory times each week when everyone is expected to be in the office."

Uptycs Threat Research Team has discovered malware that not only hijacks vulnerable *nix-based servers and uses them to mine cryptocurrency but actually modifies their CPU configurations in a bid to increase mining performance at the cost of performance in other applications. Tom's Hardware reports: Perpetrators use a Golang-based worm to exploit known vulnerabilities like CVE-2020-14882 (Oracle WebLogic) and CVE-2017-11610 (Supervisord) to gain access to Linux systems, reports The Record. Once they hijack a machine, they use model-specific registers (MSR) to disable the hardware prefetcher, a unit that fetches data and instructions from the memory into the L2 cache before they are needed.

Prefetching has been used for years and can boost performance in various tasks. However, disabling it can increase mining performance in XMRig, the mining software the perpetrators use, by 15%. But disabling the hardware prefetcher lowers performance in legitimate applications. In turn, server operators either have to buy additional machines to meet their performance requirements or increase power limits for existing hardware. In either case, they increase power consumption and spend additional money. The botnet has been reportedly used since at least December 2020 and targeted vulnerabilities in MySQL, Tomcat, Oracle WebLogic, and Jenkins.

When the pandemic freed employees from having to report to the office, some saw an opportunity to double their salary on the sly. From a report: They were bored. Or worried about layoffs. Or tired of working hard for a meager raise every year. They got another job offer. Now they have a secret. A small, dedicated group of white-collar workers, in industries from tech to banking to insurance, say they have found a way to double their pay: Work two full-time remote jobs, don't tell anyone and, for the most part, don't do too much work, either. Alone in their home offices, they toggle between two laptops. They play "Tetris" with their calendars, trying to dodge endless meetings. Sometimes they log on to two meetings at once. They use paid time off -- in some cases, unlimited -- to juggle the occasional big project or ramp up at a new gig. Many say they don't work more than 40 hours a week for both jobs combined. They don't apologize for taking advantage of a system they feel has taken advantage of them.

[...] Gig work and outsourcing have been on the rise for years. Inflation is now ticking up, chipping away at spending power. Some employees in white-collar fields wonder why they should bother spending time building a career. "The harder that you work, it seems like the less you get," one of the workers with two jobs says. "People depend on you more. My paycheck is the same." Overemployed says it has a solution. "There's no implied lifetime employment anymore, not even at IBM," writes one of the website's co-founders, a 38-year-old who works for two tech companies in the San Francisco Bay Area. The site serves up tips on setting low expectations with bosses, staying visible at meetings and keeping LinkedIn profiles free of red flags. (A "social-media cleanse" is a solid excuse for an outdated LinkedIn profile, it says.) In a chat on the messaging platform Discord, people from around the world swap advice about employment checks and downtime at various brand-name companies.

A man who viewed documents online for a controversial London property development and shared them on social media was raided by police after developers claimed there had been a break-in to their systems. The Register reports: The raid by four Metropolitan Police constables took place after Southwark campaigner Robert Hutchinson was reportedly accused of illegally entering a password-protected area of a website. "I was searching in Google and found links to board meeting minutes," he told The Register. "Board reports, none of which were marked confidential. So I have no question that it was in the public domain." The Southwark News reported that Hutchinson was arrested at 8.20am on 10 June this year at home following allegations made by Leathermarket Community Benefit Society (CBS). The society is a property development firm that wants to build flats over a children's caged ball court in the south London borough, something Hutchinson "vocally opposes," according to the local paper.

"There's a directory, which you need to enter a password and a username to get into. But documents from that area were being published on Google," explained Hutchinson. "I didn't see a page saying 'this is the directors' area' or anything like that, the documents were just available. They were just linked directly." Police said in a statement that Hutchinson was arrested on suspicion of breaking section 1 of Britain's Computer Misuse Act 1990 "between the 17th and 24th February 2021 and had published documents from the website on social media." They added: "He was taken into custody and later released under investigation. Following a review of all available evidence, it was determined no offences had been committed and no further action was taken."

Hutchinson said his identification by Leathermarket and subsequent arrest raised questions in his mind, saying police confirmed to him that the company had handed over an access log containing IP addresses: "Now, how that ended up with me being in the frame, I don't know. There's part of this that doesn't add up..." While the property business did not respond to The Register's request for comment at the time of publication, in a statement given to the Southwark News it said: "When it came to the CBS's attention that confidential information had been accessed and subsequently shared via Twitter, the CBS made a general report of the data breach to the police â" who requested a full log of visitor access to the website before deciding whether or not to progress. The police carried out their own independent investigation into who accessed the documents and how, and have now concluded their investigation." The prepared police statement did not explain whether investigators tested Leathermarket CBS's version of events before arresting the campaigner.

According to an exclusive report from Reuters, Apple's move to scan U.S. customer phones and computers for child sex abuse images has resulted in employees speaking out internally, "a notable turn in a company famed for its secretive culture." From the report: Apple employees have flooded an Apple internal Slack channel with more than 800 messages on the plan announced a week ago, workers who asked not to be identified told Reuters. Many expressed worries that the feature could be exploited by repressive governments looking to find other material for censorship or arrests, according to workers who saw the days-long thread. Past security changes at Apple have also prompted concern among employees, but the volume and duration of the new debate is surprising, the workers said. Some posters worried that Apple is damaging its leading reputation for protecting privacy.

In the Slack thread devoted to the photo-scanning feature, some employees have pushed back against criticism, while others said Slack wasn't the proper forum for such discussions. Core security employees did not appear to be major complainants in the posts, and some of them said that they thought Apple's solution was a reasonable response to pressure to crack down on illegal material. Other employees said they hoped that the scanning is a step toward fully encrypting iCloud for customers who want it, which would reverse Apple's direction on the issue a second time. Apple has said it will refuse requests from governments to use the system to check phones for anything other than illegal child sexual abuse material.

Fortune 500 company Accenture has fell victim to a ransomware attack but said today the incident did not impact its operations and has already restored affected systems from backups. From a report: News of the attack became public earlier this morning when the company's name was listed on the dark web blog of the LockBit ransomware cartel. The LockBit gang claimed it gained access to the company's network and was preparing to leak files stolen from Accenture's servers at 17:30:00 GMT. In an emailed statement, Accenture not only confirmed the attack but also greatly played down its impact. But while Accenture said the incident was quickly contained, this didn't stop the hackers from threatening to leak files they stole from the company's internal network.

Microsoft is improving some of the built-in apps available in Windows 11. From a report: Windows Insiders in the Dev Channel can now test new updates to the Snipping Tool, Calculator, Mail, and Calendar apps. Some of the updates are minor, but all are designed to match the new visual style in Windows 11. Microsoft is replacing the classic Snipping Tool and Snip & Sketch apps in Windows 11 with a new Snipping Tool app that combines the best features of both apps. The Win + Shift + S keyboard shortcut will be the main way to take a screenshot in Windows 11, and it will activate the snipping menu with various options for selecting what content to screenshot.

Amazon plans to monitor the keyboard strokes and mouse movements of customer service employees in an attempt to stop rogue workers, imposters, or hackers accessing customers' data, according to a confidential Amazon document obtained by Motherboard. The document also includes several concrete instances where people managed to steal Amazon customer data. From the report: Although the document says Amazon has considered deploying a solution that captures all of a worker's keystrokes, the tool the company has seemingly leaned towards buying is not designed to record exactly what workers type or monitor their communications. Instead, the system generates a profile based on the employee's natural keyboard and mouse movements, and then continuously verifies whether it seems the same person is in control of the worker's account to catch hackers or imposters who may then steal data. The move highlights the sorts of tools companies may increasingly deploy as working from home or remotely continues during the ongoing pandemic, and the issues Amazon is already facing with the theft of customer data.

Antivirus vendor NortonLifeLock this afternoon said it will merge with Britain's Avast PLC in a transaction combining cash and stock in two different options, totaling between $8.1 billion and $8.6 billion in stock. ZDNet reports: That value is roughly equivalent to the value in U.S. dollars of Avast's enterprise value, which takes into account its cash and debt, of 6.5 billion pounds, based on the closing price of Avast stock Tuesday of 5.68 pounds on the London Stock Exchange. The two companies said in the joint press release that their respective boards of directors see an opportunity to "create a new, industry-leading consumer Cyber Safety business, leveraging the established brands, technology and innovation of both groups to deliver substantial benefits to consumers, shareholders, and other stakeholders."

The two companies said the deal will bring together product lines that are broadly complementary, while giving the combined company a user base of over half a billion customers. The deal will broaden the geographic market coverage of the combined company. In addition, the two expect to realize "$280 million of annual gross cost synergies." Under terms of the deal, "Avast shareholders will be entitled to receive a combination of cash consideration and newly issued shares in NortonLifeLock with alternative consideration elections available."

Though you might assume children are the most tech-savvy generation out there, it turns out there's an area where they're just as behind as adults: passwords. From a report: National Institute of Standards and Technology released research on Wednesday showing that even though kids are taught best practices for creating passwords, they're not following them. NIST surveyed more than 1,500 children, ages 8 to 18, and found that, for example, 87% of high schoolers use the same password for everything. Depending on age group (45% of high schoolers versus 23% of elementary school kids), many share passwords with friends. Researchers suggested that those surveyed don't see password sharing as risky behavior, but rather a matter of building friendships and trust. "The end goal of this research is to better support children and provide recommendations that can be used to provide guidance to them, parents and educators," NIST researcher Yee-Yin Choong said in a statement.

Hackers have returned nearly half of the $600 million they stole in what's likely to be one of the biggest cryptocurrency thefts ever. From a report: The cybercriminals exploited a vulnerability in Poly Network, a platform that looks to connect different blockchains so that they can work together. Poly Network disclosed the attack Tuesday and asked to establish communication with the hackers, urging them to "return the hacked assets."

A blockchain is a ledger of activities upon which various cryptocurrencies are based. Each digital coin has its own blockchain and they're different from each other. Poly Network claims to be able to make these various blockchains work with each other. Poly Network is a decentralized finance platform. DeFi is a broad term encompassing financial applications based on blockchain technology that looks to cut out intermediaries -- such as brokerages and exchanges. Hence, it's dubbed decentralized. Proponents say this can make financial applications such as lending or borrowing more efficient and cheaper. "The amount of money you hacked is the biggest in defi history," Poly Network said in a tweet. In a strange turn of events Wednesday, the hackers began returning some of the funds they stole. They sent a message to Poly Network embedded in a cryptocurrency transaction saying they were "ready to return" the funds. The DeFi platform responded requesting the money be sent to three crypto addresses. As of 7 a.m. London time, more than $4.8 million had been returned to the Poly Network addresses. By 11 a.m. ET, about $258 million had been sent back.