Travelers heading to the US have many reasons to be cautious about their devices when it comes to privacy. A report released Thursday from the Department of Homeland Security provides even more cause for concern about how much data border patrol agents can pull from your phones and computers. From a report: In a Privacy Impact Assessment dated July 30, the DHS detailed its US Border Patrol Digital Forensics program, specifically for its development of tools to collect data from electronic devices. For years, DHS and border agents were allowed to search devices without a warrant, until a court found the practice unconstitutional in November 2019. In 2018, the agency searched more than 33,000 devices, compared to 30,200 searches in 2017 and just 4,764 searches in 2015. Civil rights advocates have argued against this kind of surveillance, saying it violates people's privacy rights.

The report highlights the DHS' capabilities, and shows that agents can create an exact copy of data on devices when travelers cross the border. According to the DHS, extracted data from devices can include: Contacts, call logs/details, IP addresses used by the device, calendar events, GPS locations used by the device, emails, social media information, cell site information, phone numbers, videos and pictures, account information (user names and aliases), text/chat messages, financial accounts and transactions, location history, browser bookmarks, notes, network information, and tasks list. The policy to retain this data for 75 years still remains, according to the report.

Dropbox is officially launching a handful of new consumer features out of beta today, along with some new tools for businesses. From a report: The cloud storage giant first introduced its password manager -- replete with a standalone mobile app for Android and iOS -- back in June. Similar to other password management apps on the market, Dropbox Passwords stores and encrypts users' online passwords and syncs them across all devices (desktop and mobile) so users don't have to remember multiple login credentials. Dropbox Passwords can also suggest strong, randomly generated, individual passwords for your online services, such as Facebook, Twitter, Netflix, and Dropbox itself.

Dropbox Passwords is the result of last year's acquisition of Massachusetts-based Valt, which swiftly shuttered its own apps ahead of integration with Dropbox. Dropbox Passwords is available to everyone on a Dropbox Plus or Professional subscription from today. The San Francisco-based company is also launching its previously announced computer backup feature in general availability today. The tool, which is available for Dropbox Basic, Plus, and Professional users, automatically creates a cloud-based backup of any folder stored on a PC or Mac and is continuously synced.

A consumer advocacy group is suing Zoom and seeking millions of dollars in damages, accusing the company of misleading its users about the strength of its encryption protections. From a report: The nonprofit group Consumer Watchdog is also accusing the videoconferencing company of deceiving users about the extent of its links with China and the fact that some calls between people in North America were routed through servers in China. That raises the danger Beijing could steal or demand access to the contents of those calls, according to a copy of the lawsuit, which was shared exclusively with The Cybersecurity 202.

Those phony claims "lull[ed] consumers and businesses into a false sense of security" and helped Zoom to soar in popularity during the early months of the pandemic, according the lawsuit, which was filed late yesterday in Washington D.C. Superior Court. The consumer group fears that if Zoom isn't punished, other companies will be incentivized to make false claims about their security and privacy protections to attract users and stand out against competitors.

As Apple's Mac computers begin their two-year transition from Intel- to Apple-developed CPUs later this year, one feature that's going away is Boot Camp -- the Mac's ability to boot directly into Windows and run PC apps natively. But Corel's Parallels Desktop will still be there to let Mac users run Windows, and in this year's version 16, it will thankfully be faster, more compatible, and easier to use than ever. From a report: Like Parallels Desktop 15, version 16 is an emulator that allows users to load a complete operating system or individual apps within macOS, treating them as windows within the Mac environment. Once again, high-end Business, mid-range Pro, and regular Standard versions are available. With the latest Business version of Parallels Desktop, an IT department can create, deploy, and remotely manage a profile-customized Windows system that Mac users download in a compact file size and expand on their own machines. A simpler Pro version includes the file-compacting feature used to more easily transfer virtual machines between computers, achieving as much as 20 times compression for Linux installs and 75% faster Linux git status executions. The standard version includes a manual Free Up Disk Space feature with archiving and space reclaiming options.

Research spanning 20 years proves PDFs are problematic for online reading. Yet they're still prevalent and users continue to get lost in them. They're unpleasant to read and navigate and remain unfit for digital-content display. From a report: [...] Burying information in PDFs means that most people won't read it. Participants in several of our recent usability studies on corporate websites and intranets did not appreciate PDFs and skipped right over them. They complained woefully whenever they encountered PDF files and many who opened PDFs quickly abandoned them. Following are behaviors and quotes from business professionals testing the About Us areas of corporate websites. One user looking for information on the Small Business Administration's website got stuck in a PDF. While she was trying to figure out what exactly the administration did, she said, "I expect it to talk more about what they can do for me. If the print was bigger, that would be really helpful. Now, I'm stuck in a PDF."

Boeing 747-400s still use floppy disks for loading critical navigation databases, Pen Test Partners has revealed to the infosec community after poking about one of the recently abandoned aircraft. From a report: The eye-catching factoid emerged during a DEF CON video interview of PTP's Alex Lomas, where the man himself gave a walkthrough of a 747-400, its avionics bay and the flight deck. Although airliners are not normally available to curious infosec researchers, a certain UK-based Big Airline's decision to scrap its B744 fleet gave Pen Test Partners a unique opportunity to get aboard one and have a poke about before the scrap merchants set about their grim task.

"Aircraft themselves are really expensive beasts, you know," said Lomas as he filmed inside the big Boeing. "Even if you had all the will in the world, airlines and manufacturers won't just let you pentest an aircraft because [they] don't know what state you're going to leave it in." While giving a tour of the aircraft on video, Lomas pointed out the navigation database loader.

"Anyone in the United States who held a Google Plus account between January 1, 2015 and April 2, 2019, and believes they were impacted by a security flaw that Google disclosed in 2018 can now register for a payout from a class action settlement..." reports the Verge.

"Each class action member is eligible for a payout of up to $12 after attorney fees and other costs are accounted for, although this could vary depending on the number of people who submit a claim." Although it's reached a settlement, Google denies the allegations made in the lawsuit. It denies any wrongdoing, and believes that no users "sustained any damages or injuries due to the software bugs."

If you're interested in making a claim, then you can do so over on the settlement's website, where you'll need to provide the email address associated with your Google Plus account. As well as holding an account between the dates listed, your data must have been exposed as part of the security lapse (Google has previously said that as many as 500,000 users were affected). A final fairness hearing is scheduled for November 19.
Google has set aside $7.5 million to handle all costs associated with the settlement, according to the claims page at GooglePlusDataLitigation.com.

"If you submit a Valid Claim by October 8, 2020, you may receive a payment. You will also give up your rights to sue Google and/or any other released entities regarding the legal claims in this case."

Some scary new variants of "HTTP request smuggling" have been discovered by Amit Klein, VP of security research at SafeBreach, reports Security Week: Specifically, an HTTP request smuggling attack, which can be launched remotely over the internet, can allow a hacker to bypass security controls, gain access to sensitive data, and compromise other users of the targeted app. While the attack method has been known for more than a decade, it still hasn't been fully mitigated. Klein has managed to identify five new attack variants and he has released proof-of-concept (PoC) exploits.

He demonstrated his findings using the Abyss X1 web server from Aprelium and the Squid caching and forwarding HTTP web proxy. The developers of Abyss and Squid have been notified of the vulnerabilities exploited by Klein during his research, and they have released patches and mitigations. One of the attacks bypasses the OWASP ModSecurity Core Rule Set (CRS), which provides generic attack detection rules for ModSecurity or other web application firewalls. OWASP has also released fixes after being notified.

Klein told SecurityWeek ahead of his talk on HTTP request smuggling at the Black Hat conference that an attacker needs to find combinations of web servers and proxy servers with "matching" vulnerabilities in order to launch an attack, which makes it difficult to determine exactly how many servers are impacted. However, an attacker can simply try to launch an attack to determine if a system is vulnerable. "The attack is not demanding resource-wise, so there's no downside to simply trying it," Klein said. In his research, he demonstrated a web cache poisoning attack, in which the attacker forces the proxy server to cache the content of one URL for a request of a different URL.

He says attacks can be launched en-masse through a proxy server against multiple different web servers or against multiple proxy servers... While there haven't been any reports of HTTP request smuggling being used in the wild, Klein has pointed out that attacks may have been launched but were not detected by the target.

"For the first time ever, the world's largest companies are telling hundreds of thousands of workers to stay away from the office for a full year, or longer," notes the Atlantic.

"If, in five years, these edicts have no lingering effects on office culture, that would be awfully strange..." Ambitious engineers, media makers, marketers, PR people, and others may be more inclined to strike out on their own, in part because they will, at some point, look around at their living room and realize: I am alone, and I might as well monetize the fact of my independence. A new era of entrepreneurship may be born in America, supercharged by a dash of social-existential angst.

Or, you know, maybe not. If companies find that remote work is a mess, they might decide to prematurely scrap the experiment, like IBM and Yahoo famously did. It is certainly curious that the most prestigious tech companies now proclaiming the future of working from home were, just seven months ago, outfitting their offices with the finest sushi bars, yoga rooms, and massage rooms...

Nothing is certain, and every new trend incurs a backlash. Telepresence could crush some downtown businesses; but cheaper downtown real estate could also lead to a resurgence in interesting new restaurants. Working from home could lead to more free-agent entrepreneurship; but if companies notice that they're bleeding talent, they'll haul their workforces back to headquarters. Still, even a moderate increase in remote work could lead to fundamental changes in our labor force, economy, and politics. Remote workers will spend more money and time inside their houses; they will spend more time with online communities than with colleagues; and many will distribute themselves across the country, rather than feel it necessary to cluster near semi-optional headquarters.

Bill Gates gave a wide-ranging new interview to Wired's Steven Levy (also republished at Ars Technica.) The interview's first question: as a man who'd been warning about a pandemic for years, are you disappointed with the response of the United States? Bill Gates: Yeah. There's three time periods, all of which have disappointments. There is 2015 until this particular pandemic hit. If we had built up the diagnostic, therapeutic, and vaccine platforms, and if we'd done the simulations to understand what the key steps were, we'd be dramatically better off. Then there's the time period of the first few months of the pandemic, when the U.S. actually made it harder for the commercial testing companies to get their tests approved, the CDC had this very low volume test that didn't work at first, and they weren't letting people test. The travel ban came too late, and it was too narrow to do anything. Then, after the first few months, eventually we figured out about masks, and that leadership is important... [America's Centers for Disease Control and Prevention] have basically been muzzled since the beginning. We called the CDC, but they told us we had to talk to the White House a bunch of times. Now they say, "Look, we're doing a great job on testing, we don't want to talk to you." Even the simplest things, which would greatly improve this system, they feel would be admitting there is some imperfection and so they are not interested.

Wired: Do you think it's the agencies that fell down or just the leadership at the top, the White House?

Bill Gates: We can do the postmortem at some point. We still have a pandemic going on, and we should focus on that....

Wired: At this point, are you optimistic?

Bill Gates: Yes. You have to admit there's been trillions of dollars of economic damage done and a lot of debts, but the innovation pipeline on scaling up diagnostics, on new therapeutics, on vaccines is actually quite impressive. And that makes me feel like, for the rich world, we should largely be able to end this thing by the end of 2021, and for the world at large by the end of 2022. That is only because of the scale of the innovation that's taking place...

This disease, from both the animal data and the phase 1 data, seems to be very vaccine preventable.
Gates also believes the government shouldn't allow encryption to hide "lies or fraud or child pornography" on apps like Facebook Messenger or WhatsApp -- prompting the interviewer to ask whether he's talked to his friend Mark Zuckerberg about it. "After I said this publicly, he sent me mail. I like Mark, I think he's got very good values, but he and I do disagree on the trade-offs involved there..."

Gates also thought today's tech executives got off easy with five hours of testifying before a Congressional subcommittee as a group of four. "Jesus Christ, what's the Congress coming to? If you want to give a guy a hard time, give him at least a whole day that he has to sit there on the hot seat by himself! And they didn't even have to get on a plane...!"

Gates added later that "there are a lot of valid issues, and if you're super-successful, the pleasure of going in front of the Congress comes with the territory."

"Researchers have found that Qualcomm's Snapdragon chip, one of the most widely used in Android phones, has hundreds of bits of vulnerable code that leaves millions of Android users at risk," reports Gizmodo: To back up a bit, Qualcomm is a major chip supplier to several well-known tech companies. In 2019, its Snapdragon series of processors could be found on nearly 40% of all Android smartphones, including high-profile flagship phones from Google, Samsung, Xiaomi, LG, and OnePlus. Researchers from Check Point, a cybersecurity firm, found the digital signal processor (DSP) in Qualcomm Snapdragon chips had over 400 pieces of vulnerable code. The vulnerabilities, altogether dubbed "Achilles," can impact phones in three major ways.

Attackers would only have to convince someone to install a seemingly benign app that bypasses usual security measures. Once that's done, an attacker could turn the affected phone into a spying tool. They'd be able to access a phone's photos, videos, GPS, and location data. Hackers could potentially also record calls and turn on the phone's microphones without the owner ever knowing. Alternatively, an attacker could choose to render the smartphone completely unusable by locking all the data stored on it in what researchers described as a "targeted denial-of-service attack." Lastly, bad actors could also exploit the vulnerabilities to hide malware in a way that would be unknown to the victim, and unremovable.

Part of why so many vulnerabilities were found is that the DSP is a sort of "black box." It's difficult for anyone other than the manufacturer of the DSP to review what makes them work...
The article notes that Qualcomm has no evidence of the vulnerability being exploited in the wild, adding that the company has "reportedly since fixed the issue."

But they also note that it's still up to individual phone makers to push out the relavant security paches, "which could take some time."

Firefox has fixed a bug that was being exploited in the wild by tech support scammers to create artificial mouse cursors and prevent users from easily leaving malicious sites. From a report: The bug was discovered being abused online by UK cyber-security firm Sophos and reported to Mozilla earlier this year. A bugfix was provided and has been live in Firefox since version 79.0, released last week. he bug is a classic "evil cursor" attack and works because modern browsers allow site owners to modify how the mouse cursor looks while users are navigating their websites. This type of customization might look useless, but it's often used for browser-based games, browser augmented reality, or browser virtual reality experiences. However, custom cursors have been a major problem for the regular web. In evil cursor attacks, malicious websites tamper with cursor settings in order to modify where the actual cursor is visible on screen, and where the actual click area is.

A massive attack has hit Reddit today after at least tens of Reddit channels (subreddits) have been hacked and defaced to show messages in support of Donald Trump's reelection campaign, ZDNet reports. From the report: The hacks are still ongoing at the time of writing, but we were told Reddit's security team is aware of the issue and has already begun restoring defaced channels. A partial list of impacted channels (subreddits) is available below, according to ZDNet's research: r/NFL, r/49ers, r/TPB (The Pirate Bay's Reddit channel), r/BlackMirror, r/Beer, r/Vancouver, r/Dallas, r/Gorillaz, r/Podcasts, r/freefolk, r/StartledCats, r/TheDailyZeitgeist, r/Supernatural, r/GRE, r/GMAT, r/greatbritishbakeoff, r/11foot8, r/truecrimepodcasts, r/Leafs, r/weddingplanning, r/Chadsriseup, r/bertstrips, r/CFB ...and many many other more.

As Google faces at least four major antitrust investigations on two continents, internal documents obtained by The Markup show its parent company, Alphabet, has been preparing for this moment for years, telling employees across the massive enterprise that certain language is off limits in all written communications, no matter how casual. From a report: The taboo words include "market," "barriers to entry," and "network effects," which is when products such as social networks become more valuable as more people use them. "Words matter. Especially in antitrust law," reads one document titled "Five Rules of Thumb for Written Communications." "Alphabet gets sued a lot, and we have our fair share of regulatory investigations," reads another. "Assume every document will become public."

The internal documents appear to be part of a self-guided training session for a wide range of the company's more than 100,000 employees, from engineers to salespeople. One document, titled "Global Competition Policy," says it applies not only to interns and employees but also to temps, vendors, and contractors. The documents explain the basics of antitrust law and caution against loose talk that could have implications for government regulators or private lawsuits.

Security researcher Troy Hunt: Let me just cut straight to it: I'm going to open source the Have I Been Pwned code base. The decision has been a while coming and it took a failed M&A process to get here, but the code will be turned over to the public for the betterment of the project and frankly, for the betterment of everyone who uses it. Let me explain why and how.

An anonymous reader quotes a report from MSN: In a draft law seen by AFP, the country's environment ministry has drawn up a number of new measures to protect insects, ranging from partially outlawing spotlights to increased protection of natural habitats. "Insects play an important role in the ecosystem...but in Germany, their numbers and their diversity has severely declined in recent years," reads the draft law, for which the ministry hopes to get cabinet approval by October. The changes put forward in the law include stricter controls on both lighting and the use of insecticides.

Light traps for insects are to be banned outdoors, while searchlights and sky spotlights would be outlawed from dusk to dawn for ten months of the year. The draft also demands that any new streetlights and other outdoor lights be installed in such a way as to minimize the effect on plants, insects and other animals. The use of weed-killers and insecticides would also be banned in national parks and within five to ten meters of major bodies of water, while orchards and dry-stone walls are to be protected as natural habitats for insects. The proposed reforms are part of the German government's more general "insect protection action plan," which was announced last September under growing pressure from environmental and conservation activists.

Twitter on Wednesday disclosed a new security vulnerability that may have exposed the direct messages of users who access the service using Android devices. CNBC reports: Specifically, the vulnerability could have exposed the private data of Twitter users running devices with Android OS versions 8 and 9, the company said. "This vulnerability could allow an attacker, through a malicious app installed on your device, to access private Twitter data on your device (like Direct Messages) by working around Android system permissions that protect against this," the company said in a blog post.

The company said there is no evidence that the Android vulnerability has been exploited by attackers. Regardless, Twitter said it has begun informing users who could have been vulnerable. The company has also updated its Android app to remove the vulnerability, and it is requiring anyone who may have been impacted to update their Twitter for Android app. Twitter said it is also identifying changes to its processes to better guard against issues like this. "Your privacy and trust is important to us and we will continue working to keep your data secure on Twitter," the company said in its blog.

The public beta of macOS Big Sur, the next major release of Apple's Mac operating system, is now available. From a report: The new update brings a big visual overhaul to macOS while also adding a number of brand-new enhancements. If you're thinking about installing the macOS Big Sur public beta, be warned that it's still, well, a beta. That means you could experience some unexpected bugs, and software you rely on may not work with the new OS just yet. Before you install Big Sur, make sure all of your important documents are backed up somewhere safe, and if at all possible, you should only install this on a secondary Mac. But if you do roll the dice and install the Big Sur beta, you'll immediately see that it looks much different than previous versions of macOS, as Apple has made significant design changes across the entire operating system. Windows have a whole lot more white, for example (unless you're using dark mode, in which case, there's still a lot of black). Apple's app icons have received a major facelift and are now rounded squares, like iOS's app icons. And the menu bar is now translucent, blending into your wallpaper.

The US Department of State announced today rewards of up to $10 million for any information leading to the identification of any person who works with or for a foreign government for the purpose of interfering with US elections through "illegal cyber activities." From a report: This includes attacks against US election officials, US election infrastructure, voting machines, but also candidates and their staff. The announcement was made today, less than 100 days until the 2020 US Presidential Election that will have incumbent Donald Trump face off against Democrat candidate Joe Biden. Nevertheless, the Department of State said the reward is valid for any form of election hacking, at any level, such as elections held at the federal, state, or local level as well.

An anonymous reader writes: More than 80 million Chrome users have installed one of 295 Chrome extensions that have been identified to hijack and insert ads inside Google and Bing search results. The malicious extensions were discovered by AdGuard, a company that provides ad-blocking solutions, while the company's staff was looking into a series of fake ad-blocking extensions that were available on the official Chrome Web Store. AdGuard says that most of the extensions (245 out of the 295 extensions) were simplistic utilities that had no other function than to apply a custom background for Chrome's "new tab" page. In addition to the 295 cluster, AdGuard also found a large number of copycat extensions that cloned popular add-ons to capitalize on their brands, and then load malicious code that performed ad fraud or cookie stuffing. ZDNet has the full list of 295 Chrome extensions embedded in their article.