The Federal Reserve's system that allows financial institutions to send money back and forth electronically went down Wednesday morning. From a report: The "operational error," as the Fed described it, impacted multiple services, including its pivotal automated clearinghouse system, which connects depository and related institutions send electronic credit and debt transfers. There were no initial indications that foul play was suspected. Along with the Fed ACH service, other systems impacted included the Check 21, FedCash, Fedwire and the national settlement service. A statement from the central bank said it became aware of a problem around 11:15 a.m. ET. "Our technical teams have determined that the cause is a Federal Reserve operational error. We will provide updates via service status as more information becomes available," the Fed said. The statement further noted that the glitch impacted payment deadlines and said the Fed "will communicate remediation efforts to our customers when available."

The Economic Security Project is trying to make a point about big tech monopolies by releasing a browser plugin that will block any sites that reach out to IP addresses owned by Google, Facebook, Microsoft, or Amazon. From a report: The extension is called Big Tech Detective, and after using the internet with it for a day (or, more accurately, trying and failing to use), I'd say it drives home the point that it's almost impossible to avoid these companies on the modern web, even if you try. Currently, the app has to be side-loaded onto Chrome, and the Economic Security Project expects that will remain the case. It's also available to side-load onto Firefox. By default, it just keeps track of how many requests are sent, and to which companies. If you configure the extension to actually block websites, you'll see a big red popup if the website you're visiting sends a request to any of the four. That popup will also include a list of all the requests so you can get an idea of what's being asked for.

Over the past week, some M1 Mac users have been reporting alarming SSD health readings, suggesting that these devices are writing extraordinary amounts of data to their drives. From a report: Across Twitter and the MacRumors forums, users are reporting that M1 Macs are experiencing extremely high drive writes over a short space of time. In what appear to be the most severe cases, M1 Macs are said to be consuming as much as 10 to 13 percent of the maximum warrantable total bytes written (TBW) value of its SSD. Flash memory on solid-state drives, such as those used in Macs, can only be written to a certain number of times before they become unstable. Software ensures that load is spread evenly across the drive's memory cells, but there is a point when the drive has been written to so many times that it can no longer reliably hold data. So while SSD wear is normal, expected behavior, drives should not be exhausting their ability to hold data as quickly as some M1 Macs seem to be. One user showed that their M1 Mac had already consumed one percent of its SSD after just two months, while another M1 Mac with a 2TB SSD had already consumed three percent. The total data units written for these machines is running into many terabytes, when they would normally be expected to be considerably lower.

Although the Flash Player app formally reached its end of life on December 31, 2020, Adobe has allowed a local Chinese company to continue distributing Flash inside China, where the application still remains a large part of the local IT ecosystem and is broadly used across both the public and private sectors. From a report: Currently, this Chinese version of the old Flash Player app is available only via flash.cn, a website managed by a company named Zhong Cheng Network, the only entity authorized by Adobe to distribute Flash inside China. But in a report published earlier this month, security firm Minerva Labs said its security products picked up multiple security alerts linked to this Chinese Flash Player version. During subsequent analysis, researchers found that the app was indeed installing a valid version of Flash but also downloading and running additional payloads. More precisely, the app was downloading and running nt.dll, a file that was loaded inside the FlashHelperService.exe process and which proceed to open a new browser window at regular intervals, showing various ad- and popup-heavy sites.

According to Arizona Department of Corrections whistleblowers, hundreds of incarcerated people who should be eligible for release are being held in prison because the inmate management software cannot interpret current sentencing laws. From a report: KJZZ is not naming the whistleblowers because they fear retaliation. The employees said they have been raising the issue internally for more than a year, but prison administrators have not acted to fix the software bug. The sources said Chief Information Officer Holly Greene and Deputy Director Joe Profiri have been aware of the problem since 2019. The Arizona Department of Corrections confirmed there is a problem with the software. As of 2019, the department had spent more than $24 million contracting with IT company Business & Decision, North America to build and maintain the software program, known as ACIS, that is used to manage the inmate population in state prisons. One of the software modules within ACIS, designed to calculate release dates for inmates, is presently unable to account for an amendment to state law that was passed in 2019.

Android users can now take advantage of the Password Checkup feature that Google first introduced in its Chrome web browser in late 2019, the OS maker announced today. From a report: On Android, the Password Checkup feature is now part of the "Autofill with Google" mechanism, which the OS uses to select text from a cache and fill in forms. The idea is that the Password Checkup feature will take passwords stored in the Android OS password manager and check them against a database containing billions of records from public data breaches and see if the password has been previously leaked online. If it has, a warning is shown to the user.

Samsung is upping the ante on Android updates and offering four years of security updates on many of its Android devices. The company's full update package is now three years of major OS updates and four years of security updates, besting even what Google offers on the Pixel line. From a report: In the announcement, Samsung says, "Over the past decade, Samsung has made significant progress in streamlining and speeding up its regular security updates. Samsung worked closely with its OS and chipset partners, as well as over 200 carriers around the world, to ensure that billions of Galaxy devices receive timely security patches." Samsung has experimented with bringing four years of updates to its own Exynos SoC devices, but now it looks like the company is getting Qualcomm models on board as well. Keep in mind that these are not necessarily monthly security updates. Samsung says it's delivering four years of "monthly or quarterly" updates, depending on the age of the device. Samsung's current security bulletin page has the Galaxy S9 (2018) on the monthly update plan, while the Galaxy S8 is on the quarterly plan. So it sounds like three years of monthly security updates and one more year of quarterly updates.

As part of its war on web tracking, Mozilla is adding a new tool to Firefox aimed at stopping cookies from keeping tabs on you across multiple sites. From a report: The "Total Cookie Protection" feature is included in the web browser's latest release -- alongside multiple picture-in-picture views -- and essentially works by keeping cookies isolated between each site you visit. Or, in Mozilla's words: "By creating a separate cookie jar for every website." Firefox's new feature pares with last month's network partitioning tool, which works by splitting the Firefox browser cache on a per-website basis to prevent tracking across the web, itself targeted at blocking more stubborn "supercookies." According to Mozilla, these types of cookies are more difficult to delete and block as they are stored in obscure parts of the browser, including in Flash storage, ETags, and HSTS flags. Both tools are available as part of Firefox's enhanced tracking protection suite in "strict mode" on desktop and Android.

Microsoft is planning to add text predictions to Word in March. From a report: The new feature will work similarly to Google Docs' Smart Compose option, using machine learning to predict what words an author will need to speed up document creation. Microsoft originally announced a beta of text predictions last year, but it's now on the Microsoft 365 roadmap to reach all Word users on Windows next month. Word will highlight grayed-out predictions when users are writing a document, and the suggestions can be accepted using the Tab key or rejected by hitting Escape. Text predictions can also be completely disabled by Word users.

Apple is going to make one of the most powerful types of attacks on iPhones much harder to pull off in an upcoming update of iOS. From a report: The company quietly made a new change in the way it secures the code running in its mobile operating system. The change is in the beta version of the next iOS version, 14.5, meaning it is currently slated to be added to the final release. Several security researchers who specialize in finding vulnerabilities in and crafting exploits for iOS believe this new mitigation will make it much harder for hackers to take control of an iPhone with a technique known as a zero-click (or 0-click) exploit, which allows a hacker to take over an iPhone with no interaction from the target. Apple also told Motherboard it believes the changes will impact 0-click attacks.

"It will definitely make 0-clicks harder. Sandbox escapes too. Significantly harder," a source who develops exploits for government customers told Motherboard, referring to "sandboxes" which isolate applications from each other in an attempt to stop code from one program interacting with the wider operating system. Motherboard granted multiple exploit developers anonymity to speak more candidly about sensitive industry issues. Like the name suggests, zero-click attacks allow hackers to break into a target without needing the victim to interact with anything, such as a malicious phishing link. This means that the attack is generally harder for the targeted user to detect. These are generally very sophisticated attacks. These attacks may now become much rarer, according to several security researchers who look for vulnerabilities in iOS.

Experian may be in trouble again — this time in Brazil.

ZDNet reports on "the emergence of a leak that exposed the personal data of more than 220 million citizens and companies, which is being offered for sale in the dark web." After receiving feedback from Experian over a massive data leak in Brazil, São Paulo state consumer rights foundation Procon described the company's explanations as "insufficient" and said it is likely that the incident was initiated in a corporate environment...

Security firm PSafe discovered the incident, which exposed all manner of personal details, including information from Mosaic, a consumer segmentation model used by Serasa, Experian's Brazilian subsidiary. Following the emergence of the leak in January, Procon notified the credit bureau, and asked the company for a confirmation of the incident, and an explanation of the reasons that caused the leak, the steps taken to contain it, how it will repair the damage to consumers impacted and the measures taken to prevent it from happening again...

Contacted by ZDNet, Serasa Experian did not answer to requests for comment on Procon's response to its feedback.

The agency's demands for answers follow calls from the Brazilian Institute for Consumer Protection for urgent measures to investigate and punish those responsible for exposing the population's data, as well as improved citizen information and transparency.

Long-time Slashdot reader b0s0z0ku quotes Ars Technica: A previously undetected piece of malware found on almost 30,000 Macs worldwide is generating intrigue in security circles, which are still trying to understand precisely what it does and what purpose its self-destruct capability serves.

Once an hour, infected Macs check a control server to see if there are any new commands the malware should run or binaries to execute. So far, however, researchers have yet to observe delivery of any payload on any of the infected 30,000 machines, leaving the malware's ultimate goal unknown. The lack of a final payload suggests that the malware may spring into action once an unknown condition is met.

Also curious, the malware comes with a mechanism to completely remove itself, a capability that's typically reserved for high-stealth operations. So far, though, there are no signs the self-destruct feature has been used, raising the question why the mechanism exists. Besides those questions, the malware is notable for a version that runs natively on the M1 chip that Apple introduced in November, making it only the second known piece of macOS malware to do so...

The malware has been found in 153 countries with detections concentrated in the US, UK, Canada, France, and Germany.
Red Canary, the security firm that discovered the malware, has named it "Silver Sparrow." Long-time Slashdot reader Nihilist_CE writes: First detected in August of 2020, the Silver Sparrow malware is interesting in several unsettling ways. It uses the macOS Installer Javascript API to launch a bash process to gain a foothold into the user's system, a hitherto-unobserved method for bypassing malware detection. This bash shell is then used to invoke macOS's built-in PlistBuddy tool to create a LaunchAgent which executes a bash script every hour. This is the command and control process, which downloads a JSON file containing (potentially) new instructions.

Besides the novel installation method, Silver Sparrow is also mysterious in its payload: a single, tiny binary that does nothing but open a window reading "Hello, World!" (in v1, which targets Intel Macs) or "You did it!" (in v2, which is an M1-compatible fat binary). These "bystander binaries" are never executed and appear to be proofs-of-concept or placeholders for future functionality.

Microsoft's security team said today it has formally completed its investigation into its SolarWinds-related breach and found no evidence that hackers abused its internal systems or official products to pivot and attack end-users and business customers. From a report: The OS maker began investigating the breach in mid-December after it was discovered that Russian-linked hackers breached software vendor SolarWinds and inserted malware inside the Orion IT monitoring platform, a product that Microsoft had also deployed internally. In a blog post published on December 31, Microsoft said it discovered that hackers used the access they gained through the SolarWinds Orion app to pivot to Microsoft's internal network, where they accessed the source code of several internal projects. "Our analysis shows the first viewing of a file in a source repository was in late November and ended when we secured the affected accounts," the company said today, in its final report into the SolarWinds-related breach.

In a company blog post Thursday, Microsoft released more details about the new, flat-price version of its Office productivity software coming later this year. The company emphasized that while its main focus remains in its subscription offering, Microsoft 365, it will release the one-time purchase Office 2021 for those who aren't ready to move to the cloud. From a report: Office 2021 will arrive in two versions: one for commercial users, called Office LTSC (which stands for Long Term Servicing Channel), and one for personal use. Office LTSC will include enhanced accessibility features, performance improvements across Word, Excel and PowerPoint, and visual improvements, like dark mode support across apps. It's meant for specialty situations, as opposed to for an entire organization, such as process control devices on the manufacturing floor that are not connected to the internet. More details about pricing and new features for the commercial version and the personal version will be announced when Office 2021 is closer to general availability. Both will have both Windows and Mac versions, and will ship with the OneNote app. They will also ship both 32- and 64-bit versions, according to the post. Microsoft will support the software for five years, and said it does not plan to change the price at the time of release.

Microsoft has begun deploying this week KB4577586, a Windows update that permanently removes the Adobe Flash Player software from Windows devices. From a report: The update was formally announced last year at the end of October when Microsoft and other browser makers were preparing for the impending Flash end-of-life, scheduled for the end of 2020. According to a support document published at the time, the update was initially supposed to be optional. System administrators who wanted to remove Flash before the EOL date could access the Microsoft Update Catalog, download the KB4577586 packages, and remove Flash to avoid any security-related issues. But this week, multiple Windows 10 users reported that Microsoft is now forcibly installing KB4577586 on their devices and removing Flash support from the OS. While users might think this would cause issues for some enterprises, it actually does not. Last year, Adobe introduced a time bomb in the Flash Player code that prevents the Flash Player app from playing content after January 12.

A sprawling cyber-attack that compromised popular software created by Texas-based SolarWinds was executed from within the U.S., a top White House official said, though the government believes Russia was responsible. From a report: The federal investigation of the hack will take several months, Deputy National Security Advisor Anne Neuberger said in a briefing for reporters on Wednesday. "As of today, nine federal agencies and about 100 private-sector companies were compromised," Neuberger said. She didn't identify them and said the government hasn't ruled out the possibility of further victims. She said the government believes it's still at the "beginning stages" of understanding the scope and scale of the attack, which was publicly disclosed in December but was likely executed months earlier. "The hackers launched the hack from inside the United States which further made it difficult for the U.S. government to observe their activity," she said. Neuberger is leading the U.S. response to the SolarWinds attack. The Texas-based company's software is used by several government agencies and Fortune 500 companies.

Microsoft is trying a new solution for the persistent "would you like to allow notifications from this website" requests that you see across the internet: crowdsourcing data on which ones people block and which ones they allow. From a report: According to a blog post today, Microsoft is calling this feature adaptive notification requests, and the company is rolling it out in Edge 88 after it received positive feedback from testers. For an example of how this works, say there's a website that commonly asks for notifications, and nobody wants them. They'll either ignore the request or click the block button to make sure they never see it again. Microsoft then collects that data and will stop showing new users the notification request in the future.

Fake reviews for products sold on Amazon's Marketplace are being sold online "in bulk", according to Which? The consumer group found 10 websites selling fake reviews from $7 each and incentivising positive reviews in exchange for payment or free products. From a report: It suggested the firm was facing an "uphill struggle" against a "widespread fake reviews industry". An Amazon spokesman said: "We remove fake reviews and take action against anyone involved in abuse." The retail giant's Marketplace allows other retailers to sell their goods via the Amazon website. Which? identified websites offering review services for goods for sale on Amazon Marketplace that violated the firm's terms and conditions. These included "packages" of fake reviews available for sellers to buy for about $21 individually, as well as bulk packages starting at $862 for 50 reviews and going up to $11,130 for 1,000. The group also suggested that five of the businesses it looked at had more than 702,000 "product reviewers" on their books. Product reviewers are offered small payments ranging from a few pounds up to more than $14, alongside free or discounted products. They can even take part in "loyalty schemes" and earn themselves premium goods, from children's toys to exercise equipment.

LastPass is adding new restrictions to its free subscription tier starting March 16th that'll only allow users to view and manage passwords on one category of devices: mobile or computer. From a report: Mobile users will be limited to iOS and Android phones, iPads, Android tablets, and smartwatches. Computer subscribers will be able to use their passwords from Windows, macOS, and Linux desktops and laptops, the LastPass browser extension, and Windows tablets. Users on LastPass' free tier will be asked to pick between the two options the first time they log in after March 16th, and the company says they'll be able to switch between categories up to three times after they've picked. Although customers are restricted to a single category of devices on the free tier, they'll still be able view and manage passwords from an unlimited number of devices within either the mobile or computer category. LastPass says no users will be locked out of their accounts or lose access to their passwords as a result of the changes. As well as restricting its device types, LastPass is also changing the kinds of customer support free tier users will be able to access. From May 17th, free users will lose access to email support, the company announced.

France's cyber-security agency said that a group of Russian military hackers, known as the Sandworm group, have been behind a three-years-long operation during which they breached the internal networks of several French entities running the Centreon IT monitoring software. From a report: The attacks were detailed in a technical report released today by Agence Nationale de la Securite des Systemes d'Information, also known as ANSSI, the country's main cyber-security agency. "This campaign mostly affected information technology providers, especially web hosting providers," ANSSI officials said today. "The first victim seems to have been compromised from late 2017. The campaign lasted until 2020." The point of entry into victim networks was linked to Centreon, an IT resource monitoring platform developed by French company CENTREON, and a product similar in functionality to SolarWinds' Orion platform. ANSSI said the attackers targeted Centreon systems that were left connected to the internet. The French agency couldn't say at the time of writing if the attacks exploited a vulnerability in the Centreon software or if the attackers guessed passwords for admin accounts. However, in the case of a successful intrusion, the attackers installed a version of the P.A.S. web shell and the Exaramel backdoor trojan, two malware strains that when used together allowed hackers full control over the compromised system and its adjacent network.