An anonymous reader writes: Researchers from the Ben-Gurion University of the Negev in Israel have developed malware that when installed on a router or a switch can take control over the device's LEDs and use them to transmit data in a binary format to a nearby attacker, who can capture it using simple video recording equipment. The attack is similar to the LED-it-GO attack developed by the same team, which uses a hard drive's blinking LED to steal data from air-gapped computers. Because routers and switches have many more LEDs than a hard drive, this attack scenario is much more efficient, as it can transmit data at about the same speed, but multiplied by the number of ports/LEDs. Researchers say they were able to steal data by 1000 bits/ per LED, making this the most efficient attack known to date. The attack worked best when coupled with optical sensors, which are capable of sampling LED signals at high rates, enabling data reception at a higher bandwidth than other typical video recording equipment. A video of the attack is available here.

dryriver writes: Major news organizations from CNN, BBC, ABC to TIME magazine, the New York Times and the Economist publish a tremendous amount of information, especially now that almost everybody runs a 24/7 updated website alongside their TV channel, magazine or newspaper. Question: How do news organizations actually keep track of what must be 1000s of pieces of incoming information that are processed into news stories every day? If they are using software to manage all this info -- which makes a lot of sense -- is it off-the-shelf software that anybody can buy, or do major news organizations typically commission IT/software contractors to build them a custom "Information Management System" or similar? If there is good off-the-shelf software for managing a lot of information, who makes it and what is it called?

AmiMoJo quotes the Register: The Internet Engineering Task Force has taken another small step in protecting everybody's privacy... As the draft proposal explains, the RFCs that define NTP have what amounts to a convenience feature: packets going from client to server have the same set of fields as packets sent from servers to clients... "Populating these fields with accurate information is harmful to privacy of clients because it allows a passive observer to fingerprint clients and track them as they move across networks".

The header fields in question are Stratum, Root Delay, Root Dispersion, Reference ID, Reference Timestamp, Origin Timestamp, and Receive Timestamp. The Origin Timestamp and Receive Timestamp offer a handy example or a "particularly severe information leak". Under NTP's spec (RFC 5905), clients copy the server's most recent timestamp into their next request to a server – and that's a boon to a snoop-level watcher.
The proposal "proposes backward-compatible updates to the Network Time Protocol to strip unnecessary identifying information from client requests and to improve resilience against blind spoofing of unauthenticated server responses." Specifically, client developers should set those fields to zero.

An anonymous reader quotes a report from Ars Technica: In a blog post, YouTube outlined more specific definitions of hate speech and what kinds of incendiary content wouldn't be eligible for monetization. Three categories are classified as hate speech, with the broadest one being "hateful content." YouTube is defining this as anything that "promotes discrimination or disparages or humiliates an individual or group of people on the basis of the individual's or group's race, ethnicity, or ethnic origin, nationality, religion, disability, age, veteran status, sexual orientation, gender identity, or other characteristic associated with systematic discrimination or marginalization." The second category is "inappropriate use of family entertainment characters," which means content showing kid-friendly characters in "violent, sexual, vile, or otherwise inappropriate behavior," no matter if the content is satirical or a parody. The final category is somewhat broad: "incendiary and demeaning content" means that anything "gratuitously" demeaning or shameful toward an individual or group is prohibited. The updated guidelines are a response to creators asking YouTube to clarify what will and will not be deemed advertiser-friendly. YouTube acknowledges that its systems still aren't perfect, but it says it's doing its best to inform creators while maintaining support for advertisers. YouTube also launched a new course in its Creator Academy that creators can take to learn more about how to make "content appealing for a broad range of advertisers."

OutOnARock quotes a report from Yahoo: Ross Ulbricht, the founder of the darknet marketplace known as Silk Road, has lost his appeal of a 2015 conviction that has him serving a life sentence on drug trafficking and money laundering charges, according to a federal appeals court decision released Wednesday morning. Ulbricht argued that the district court that convicted him violated the Fourth Amendment -- which protects against unreasonable searches and seizures -- by wrongly denying his motion to suppress evidence, and that he was deprived of his right to a fair trial. "On the day of Ulbricht's arrest, the government obtained a warrant to seize Ulbricht's laptop and search it for a wide variety of information related to Silk Road and information that would identify Ulbricht as Dread Pirate Roberts," states the decision by the United States Court of Appeals for the Second Circuit in Downtown Manhattan. "Ulbricht moved to suppress the large quantity of evidence obtained from his laptop, challenging the constitutionality of that search warrant."

the_newsbeagle writes: Many of today's fanciest artificial intelligence systems are some type of artificial neural network, but they bear only the roughest resemblance to a biological brain's real networks of neurons. That could change thanks to a $100M program from IARPA. The intelligence agency is funding neuroscience teams to map 1 cubic millimeter of rodent brain, looking at activity in the visual cortex while the rodent is engaged in a complex visual recognition task. By discovering how the neural circuits in that brain cube get activated to process information, IARPA hopes to find inspiration for better artificial neural networks. And an AI that performs better on visual recognition tasks could certainly be useful to intelligence agencies.

chicksdaddy quotes a report from The Security Ledger: The United States should invest resources in preserving aging, analog infrastructure including telecommunications networks that use copper wire and pneumatic pumps used to pump water as a hedge against the growing threat of global disruption resulting from a cyber attack on critical infrastructure, two researchers at MITRE argue. The researchers, Emily Frye and Quentin Hodgson with The MITRE Corporation, note that critical infrastructure is increasingly run from converged IP (Internet Protocol) based networks that are vulnerable to cyber attack. That includes so-called "lifelines" -- essential functions like water, electricity, communications, transportation and emergency services. That marks a critical departure from the past when such systems were isolated from the internet and other general purpose networks. "Each lifeline rides on, and is threaded together by, digital systems. And humans have yet to design a digital system that cannot be compromised," they write. With such civilization-sustaining functions now susceptible to attack, the onus is on society to maintain a means of operating them that does not rely on digital controls, Fry and Hodgson write. In many cases, that means preserving an older generation of analog infrastructure and management systems that could be manually operated, The Security Ledger reports. From their article: "In the case of communications, for instance, what is required is the preservation of a base core of copper-enabled connectivity, and the perpetuation of skills and equipment parts to make analog telephones work. Today, we see a move to decommission the copper-wire infrastructure. From a pure business standpoint, decommissioning copper is the right thing to do; but from a public-safety and homeland security perspective, we should reconsider. Decommissioning copper increases homeland security risk, because failover planning calls simply for relying on another server, router, or data center that is also subject to compromise."

An anonymous reader writes (edited and condensed for length): Smartphones are already computers in our pockets, but Intel's new Compute Card turns an actual PC into something you can take with you wherever you go. Equipped with a range of processor options -- including an ultra-efficient Celeron, and notebook-class Core i5s, this slap that looks like a USB backup battery is attracting a range of interest from Intel OEM partners hoping to use it for everything from smart signage to modular notebooks. The Intel Compute Card, which was originally revealed at CES earlier this year, will come in a range of configurations that include up to 4GB of RAM and 128GB of flash storage, as well as built-in AC 8265 wireless networking and Bluetooth 4.2 connectivity, the company said today at Computex. Intel also announced availability of the Compute Card Device Design Kit today, which will let OEM partners create devices that work with the modular computing core. LG Display, Sharp, Dell, HP and Lenovo are already working on accessory solutions for Compute Card, Intel said.

Orome1 quotes Help Net Security: Even though many IoT devices for smart homes encrypt their traffic, a passive network observer -- e.g. an ISP, or a neighborhood WiFi eavesdropper -- can infer consumer behavior and sensitive details about users from IoT device-associated traffic rate metadata. A group of researchers from the Computer Science Department of Princeton University have proven this fact by setting up smart home laboratory with a passive network tap, and examining the traffic rates of four IoT smart home devices: a Sense sleep monitor, a Nest Cam Indoor security camera, a WeMo smart outlet, and an Amazon Echo smart speaker... "Once an adversary identifies packet streams for a particular device, one or more of the streams are likely to encode device state. Simply plotting send/receive rates of the streams revealed potentially private user interactions for each device we tested," the researchers noted. [PDF]
In addition, the article notes, "Separating recorded network traffic into packet streams and associating each stream with an IoT device is not that hard."

Long-time Slashdot reader williamyf was the first to share news of "a wormable bug [that] has remained undetected for seven years in Samba verions 3.5.0 onwards." Ars Technica reports: Researchers with security firm Rapid7...said they detected 110,000 devices exposed on the internet that appeared to run vulnerable versions of Samba. 92,500 of them appeared to run unsupported versions of Samba for which no patch was available... Those who are unable to patch immediately can work around the vulnerability by adding the line nt pipe support = no to their Samba configuration file and restart the network's SMB daemon. The change will prevent clients from fully accessing some network computers and may disable some expected functions for connected Windows machines.
The U.S. Department of Homeland Security's CERT group issued an anouncement urging sys-admins to update their systems, though SC Magazine cites a security researcher arguing this attack surface is much smaller than that of the Wannacry ransomware, partly because Samba is just "not as common as Windows architectures." But the original submission also points out that while the patch came in fast, "the 'Many eyes' took seven years to 'make the bug shallow'."

A newly found flaw in widely used networking software leaves tens of thousands of computers potentially vulnerable to an attack similar to that caused by WannaCry, which infected more than 300,000 computers worldwide, cybersecurity researchers said on Thursday. From a Reuters report: The U.S. Department of Homeland Security on Wednesday announced the vulnerability, which could be exploited to take control of an affected computer, and urged users and administrators to apply a patch. Rebekah Brown of Rapid7, a cybersecurity company, told Reuters that there were no signs yet of attackers exploiting the vulnerability in the 12 hours since its discovery was announced. But she said it had taken researchers only 15 minutes to develop malware that made use of the hole. "This one seems to be very, very easy to exploit," she said. Rapid7 said it had found more than 100,000 computers running vulnerable versions of the software, Samba, free networking software developed for Linux and Unix computers.

An anonymous reader quotes a report from The Guardian: Facebook's policies on Holocaust denial will come under fresh scrutiny following the leak of documents that show moderators are being told not to remove this content in most of the countries where it is illegal. The files explain that moderators should take down Holocaust denial material in only four of the 14 countries where it is outlawed. One document says the company "does not welcome local law that stands as an obstacle to an open and connected world" and will only consider blocking or hiding Holocaust denial messages and photographs if "we face the risk of getting blocked in a country or a legal risk." A picture of a concentration camp with the caption "Never again Believe the Lies" was permissible if posted anywhere other than the four countries in which Facebook fears legal action, one document explains. Facebook contested the figures but declined to elaborate. Documents show Facebook has told moderators to remove dehumanizing speech or any "calls for violence" against refugees. Content "that says migrants should face a firing squad or compares them to animals, criminals or filth" also violate its guidelines. But it adds: "As a quasi-protected category, they will not have the full protections of our hate speech policy because we want to allow people to have broad discussions on migrants and immigration which is a hot topic in upcoming elections." The definitions are set out in training manuals provided by Facebook to the teams of moderators who review material that has been flagged by users of the social media service. The documents explain the rules and guidelines the company applies to hate speech and "locally illegal content," with particular reference to Holocaust denial. One 16-page training manual explains Facebook will only hide or remove Holocaust denial content in four countries -- France, Germany, Israel and Austria. The document says this is not on grounds of taste, but because the company fears it might get sued.

bricko quotes a report from Recode: The GOP's leading campaign and fundraising arm, the Republican National Committee, has quietly thrown its support behind a proposal at the Federal Communications Commission that would pave the way for marketers to auto-dial consumers' cellphones and leave them prerecorded voicemail messages -- all without ever causing their devices to ring. Under current federal law, telemarketers and others, like political groups, aren't allowed to launch robocall campaigns targeting cellphones unless they first obtain a consumer's written consent. But businesses stress that it's a different story when it comes to "ringless voicemail" -- because it technically doesn't qualify as a phone call in the first place. In their eyes, that means they shouldn't need a customer or voter's permission if they want to auto-dial mobile voicemail inboxes in bulk pre-made messages about a political candidate, product or cause. And they want the FCC to rule, once and for all, that they're in the clear. Their argument, however, has drawn immense opposition from consumer advocates.

One of the new tools Google has announced for its advertisers today promises to tie your offline credit card data together with all your online viewing to tell advertisers exactly what's working as they try to target you and your wallet. Consumerist reports: That return, for decades, was hard to measure in all but the most vaguely correlative of ways. Did people buy your product after seeing your TV ad? After seeing your billboard? On a whim after seeing neither? Who knows! But in the age of highly targeted, algorithmic advertising, the landscape is completely different. The apps on your phone know what you looked at and when, and can tie that in to what you see on other devices you're also logged into their services on (like your work computer). Meanwhile, you're leaving tracks out in the physical world -- not only the location history of your phone, but also the trail of payments you leave behind you if you pay with a credit card, debit card, or app (as millions of us do). Google also introduced some offline measurements to its online tool suite back in 2014, when it started using phone location data to try to match store visit location data to digital ad views. But a store doesn't make any money when you simply walk into it; you need to buy something. So Google's tracking that very granularly now, too. "In the coming months, we'll be rolling out store sales measurement at the device and campaign levels. This will allow you to measure in-store revenue in addition to the store visits delivered by your Search and Shopping ads," Google explains to advertisers. That's very literally a collection of spending data matched to the people who spent it, matched in turn to people who saw ads.

The legendary computer scientist and founder of Java, James Gosling, is joining forces with Amazon Web Services. Gosling made the announcement today on Facebook saying that he's "starting a new Adventure" with the cloud computing juggernaut as a Distinguished Engineer. GeekWire reports: Gosling wrote Java, one of the most widely used programming languages in the history of computing, while at Sun Microsystems in the early 1990s. After leaving Sun following its acquisition by Oracle, Gosling did a short stint at Google before settling in for almost six years at Liquid Robotics, which is working on an autonomous boat called the Wave Glider. He likely ruffled a few feathers in Seattle last year after speaking out about fears of cloud vendor lock-in. "You get cloud providers like Amazon saying: 'Take your applications and move them to the cloud.' But as soon as you start using them you're stuck in that particular cloud," he said at IP Expo according to The Inquirer, echoing the sentiment of some skeptical IT organizations burned by enterprise vendors in the past.

An anonymous reader writes: Netgear's latest firmware update for the R7000 includes new support for collecting analytics data. The update release notes include this caution:

An article on Netgear's KB states updated last week that Netgear collects information including IP addresses, MAC, certain WiFi information, and information about connected devices.

Slashdot reader snydeq shares an InfoWorld article identifying "The Working Dead: IT Jobs Bound For Extinction." Here's some of its predictions.

• The president of one job leadership consultancy argues C and C++ coders will soon be as obsolete as Cobol programmers. "The entire world has gone to Java or .Net. You still find C++ coders in financial companies because their systems are built on that, but they're disappearing."
• A data scientist at Stack Overflow "says demand for PHP, WordPress, and LAMP skills are seeing a steady decline, while newer frameworks and languages like React, Angular, and Scala are on the rise."
• The CEO and co-founder of an anonymous virtual private network service says "The rise of Azure and the Linux takeover has put most Windows admins out of work. Many of my old colleagues have had to retrain for Linux or go into something else entirely."
• In addition, "Thanks to the massive migration to the cloud, listings for jobs that involve maintaining IT infrastructure, like network engineer or system administrator, are trending downward, notes Terence Chiu, vice president of careers site Indeed Prime."
• The CTO of the job site Ladders adds that Smalltalk, Flex, and Pascal "quickly went from being popular to being only useful for maintaining older systems. Engineers and programmers need to continually learn new languages, or they'll find themselves maintaining systems instead of creating new products."
• The president of Dice.com says "Right now, Java and Python are really hot. In five years they may not be... jobs are changing all the time, and that's a real pain point for tech professionals."

But the regional dean of Northeastern University-Silicon Valley has the glummest prediction of all. "If I were to look at a crystal ball, I don't think the world's going to need as many coders after 2020. Ninety percent of coding is taking some business specs and translating them into computer logic. That's really ripe for machine learning and low-end AI."

Li Yuan, writing for the WSJ: Apple's latest predicament centers on its App Store. Last month, Apple told several Chinese social-networking apps, including the wildly popular messaging platform WeChat, to disable their "tip" functions to comply with App Store rules (Editor's note: the link could be paywalled; alternative source), according to executives at WeChat and other companies. That function allows users to send authors and other content creators tips, from a few yuan to hundreds, via transfers from mobile-wallet accounts. Those transfers are offered by the social-networking apps free of charge, as a way to inspire user engagement. Now, those tips will be considered in-app purchases, just like buying games, music and videos, entitling Apple to a 30% cut. For Apple, which has been observing slowing growth in mature markets, China is increasingly becoming important. But the company's my way or high-way approach might hurt the company's image in China. And that image as well as fortunes of local companies, is what the Chinese authorities deeply care about. As Yuan adds, "while it's understandable that Apple wants to tap the App Store for more money, its pressure on the app platforms risks alienating powerful Chinese companies, turning off Chinese iPhone users and drawing unnecessary attention from the regulators." Executives of these IM messaging apps tell WSJ that Apple has threatened that it would kick their apps out of the App Store if they don't comply. The problem is, WeChat is way more popular in China than Apple -- or its iPhones or its services or both combined, analysts say. WeChat is insanely popular in China, and people love to use the app to pay for things they purchase and send money to friends. Apple's greed could end up resulting in millions of new Android users, analysts said.

An anonymous reader quotes a report from Washington Post: Federal regulators will move to roll back one of the Obama administration's signature Internet policies this week, launching a process to repeal the government's net neutrality rules that currently regulate how Internet providers may treat websites and their own customers. The vote on Thursday, led by Federal Communications Commission Chairman Ajit Pai, will kick off consideration of a proposal to relax regulations on companies such as Comcast and AT&T. If approved by the 2-1 Republican-majority commission, it will be a significant step for the broadband industry as it seeks more leeway under government rules to develop new business models. For consumer advocates and tech companies, it will be a setback; those groups argue that looser regulations won't prevent those business models from harming Internet users and website owners. The current rules force Internet providers to behave much like their cousins in the legacy telephone business. Under the FCC's net neutrality policy, providers cannot block or slow down consumers' Internet traffic, or charge websites a fee in order to be displayed on consumers' screens. The net neutrality rules also empower the FCC to investigate ISP practices that risk harming competition. Internet providers have chafed at the stricter rules governing phone service, which they say were written for a bygone era. Pai's effort to roll back the rules has led to a highly politicized debate. Underlying it is a complex policy decision with major implications for the future of the Web.

According to the Wall Street Journal, the access codes to United's cockpit doors were accidentally posted on a public website by a flight attendant. "[United Continental Holdings], which owns United Airlines and United Express, asked pilots to follow security procedures already in use, including visually confirming someone's identity before they are allowed onto the flight deck even if they enter the correct security code into the cockpit door's keypad," reports TechCrunch. From the report: The Air Line Pilots Association, a union that represents 55,000 pilots in the U.S. and Canada, told the WSJ on Sunday that the problem had been fixed. The notable thing about this security breach is that it was caused by human error, not a hack, and illustrates how vulnerable cockpits are to intruders despite existing safety procedures. The Air Line Pilots Association has advocated for secondary barriers made from mesh or steel cables to be installed on cockpits doors to make it harder to break into, but airlines have said that they aren't necessary.