I recently wrote about how much I enjoyed testing the OnePlus 7 Pro. One of the nicer things about it was the fact that its in-display fingerprint reader, unlike the one in the last-gen OnePlus handset, works in a timely manner. Too bad that, no matter how quickly it can read a fingerprint, it still isn't smart enough to stand up to a bit of arts and crafts from a determined security hacker.

Now, before anyone goes and loses their minds over this hack, it's important to note that in order for it to work, a digital interloper would need to get hold of the fingerprint belonging to the handset's owner in order to copy it. The best way to secure your phone against a hack like this, or being forced to unlock your smartphone for the authorities is to lock it down with an alphanumeric code.

While using biometrics to unlock your hardware might be convenient, when push comes to shove, it won't keep your digital life secure from professional snoops for long. Read the rest

Some 15 hours of Thom Yorke's demo recordings, dating back to the OK Computer era, were accessed and downloaded by a hacker who then attempted to extort $150,000. Rather than pay up or lose control of the media, Radiohead released it all online instead. Bandmate Jonny Greenwood wrote that the sessions were "only tangentially interesting" and would be offered for the next 18 days, with an optional $18 price tag that would be passed onto Extinction Rebellion, a climate change protest group.

MINIDISCS [HACKED] by Radiohead Read the rest

Kim Zetter reports that Taiwan tech giant Asus unwittingly installed backdoors on half a million of its own customers' computers after hackers compromised its software update servers.

The researchers estimate half a million Windows machines received the malicious backdoor through the ASUS update server, although the attackers appear to have been targeting only about 600 of those systems. The malware searched for targeted systems through their unique MAC addresses. Once on a system, if it found one of these targeted addresses, the malware reached out to a command-and-control server the attackers operated, which then installed additional malware on those machines.

Why hack the consumer when you can hack the manufacturer and get all the consumers for free?

Alt headline: "Republic of Gamers Publicly Owned" Read the rest

Genius! A serving fork would be useful for taller frames.

(Creative Ideas via Kottke) Read the rest

Enjoy this completely perfect keytar made from a Commodore 64. The pickups send sound via an FPGA to the original SID chip to allow a variety of chiptastic effects, applied using the computer's keyboard. Read the rest

Gmail's text-message two-factor authentication is not only insufficiently secure, but "bypassed at scale", reports Joseph Cox.

A new Amnesty International report gives more insight into how some hackers break into Gmail and Yahoo accounts at scale, even those with two-factor authentication (2FA) enabled.

They do this by automating the entire process, with a phishing page not only asking a victim for their password, but triggering a 2FA code that is sent to the target’s phone. That code is also phished, and then entered into the legitimate site so the hacker can login and steal the account.

I use Authy. Read the rest

Stayed at a Starwood hotel in the last five years or so? Every one of you and more—as many as 500 million people, says owner Marriott—are implicated in what would be the second-largest hack of all time.

The company said Friday that credit card numbers and expirations dates of some guests may have been taken. For about 327 million people, the information exposed includes some combination of name, mailing address, phone number, email address, passport number, Starwood Preferred Guest account information, date of birth, gender, arrival and departure information, reservation date and communication preferences. For some guests, the information was limited to name and sometimes other data such as mailing address, email address or other information.

Yahoo holds the record, with 3bn accounts breached. The only other breach in the same league as these would be the 412m accounts dumped from Adult Friend Finder. Marriott and Starwood merged two years ago, but open season at Starwood's servers apparently continued until September this year. Read the rest

An internet engineer at Equifax who coded parts of a breach portal for the credit agency has been sentenced to 8 months of house arrest for insider trading. He was convicted of using insider information about the Equifax breach to make more than $75,000. Read the rest

The good news: Facebook downgrades the number of accounts hit in the breach they disclosed two weeks ago to 29 million, down from 50 million. The bad news: Uh, that's still a LOT. And if you were one of those 29 million Facebook users, A LOT of your intimate personal data was stolen. Read the rest

Facebook says an attack on its network left the personal information of some 50 million users—perhaps you?—exposed to hackers. Who were the hackers, and what did they want? Facebook doesn't know, or won't say. But the company has confirmed that execs Mark Zuckerberg and Sheryl Sanders were among the users affected.

“We have a responsibility to protect your data, and if we can’t then we don’t deserve to serve you,” Zuckerberg said about Facebook's Cambridge Analytica scandal earlier this year.

Well. You heard the man. Read the rest

wideNES is an ingenious tool that lets you zoom out of the NES game you're playing. It's a feature of ANESE, a new NES emulator developed by Daniel Prilik.

wideNES is a novel technique to automatically and interactively map-out NES games, in real time.

As players move within a level, wideNES records the screen, gradually building-up a map of what’s been explored. On subsequent playthroughs of the level, wideNES syncs the action on-screen to the generated map, effectively letting players see more of the level by “peeking” past the edge of the NES’s screen! Best of all, wideNES’s approach to mapping games is totally generalized, enabling a wide range of NES games to work with wideNES right out of the box!

The technical description of how it works is well-worth reading. It's like a primer on how memory-challenged early game consoles managed to keep things smooth and sweet--and why it's better to employ such an elaborate technique of observation than to try and pre-emptively decode the internal geography of each game.

Why not extract levels directly from ROMs?

Trying to extract level data from a NES ROM would be equivalent to determining which sections of the ROM are code (as opposed to data), which is hard, since finding all code in a given binary is equivalent to the Halting problem!

wideNES takes a much simpler approach: Instead of guessing how games pack level data in ROM, wideNES will simply run the game and watch the output!

An excellent suggestion from ArtWomb on Hacker News: set up a high-resolution monitor that has the entirety of a game world on it, letting it remain static whole your tiny sprite (Link, for example, in Hyrule) quests forth. Read the rest

Karateka is not just a classic game, but one of the most well-documented thanks to Jordan Mechner's memoirs and his habit for maintaining archives. 34 years after its release, Charles Mangin studied the game's source code and patched it to allow a second player to control the enemies—effectively adding a vs. battle mode.

I’ve taught myself 6502 assembly after getting back into the Apple II, through the thriving community online. The idea of a two player version of Karateka came back to me while at KansasFest a couple of years ago. I noodled a little on it back then, getting distracted by finding the code that created the unique music in the game. Long story short: I finally found the places in the game code that needed patching to allow a second player to control the enemies in the game, and create a functioning two player version of Karateka. The resulting patch is only 42 bytes long

42, the meaning of life! You can play the two-player Karateka at the Internet Archive.

I'd love to see this done to Great Gurianos (sometimes renamed Gladiator), another 80s' fighter with an interesting combat system whose attract mode suggested vs. battles that were not in the game itself. Read the rest

Ticketmaster UK today admitted that an unknown number of customers' data may have been stolen in a malware attack. Read the rest

NEW REPORTING CONFIRMS what previous stories speculated: chief of staff John Kelly's phone was hacked, and now they know where. They still don't know by whom, or how, or why, or what the damage was. Read the rest

The Department of Homeland Security today revealed which states were targeted by Russian hackers trying to break into voting systems during the 2016 election cycle. DHS said "most" states were unsuccessfully attacked, but didn't make clear how and where the hackers were successful, or whether the sustained cyberattacks helped Donald Trump win the presidency. Read the rest

Behold the most amazing arcade hack in existence: Matt Brailsford, AKA Circuitbeard, crammed Sega's OutRun into a Tomy Turnin' Turbo dashboard. [via]

Some key features are an integrated 3.5” TFT screen, fully usable steering wheel and gear shifter (dashboard turbo light comes on when in high gear), working ignition key for power, true MPH speed and rev counter displays, and a fuel gauge to represent the stage time remaining.

The project itself was quite a big one for me, filled with several moments of frustration, from burnt out potentiometers, to soldering LEDs backwards, multiple TFT screen purchases and more than one change in direction as approaches to problems were found to be inadequate.

All the toy's hardware is hooked up to the game, running on a Raspberry Pi with a PiCade board and Kookye 3.5" display. He worked around the lack of pedals by using the gearshift to accelerate and brake. How he made a physical LED dashboard to show the in-game speed completely escapes me. Genius!

Here's the original mechanical toy, for reference:

Read the rest

Gabriella Coleman is the hacker anthropologist whose work on the free software movement, Anonymous and the Arab Spring, the politicization of hacking, and the true role of alt-right dank memes in the 2016 elections are critical reading for the 21st century. Read the rest