Houseguests, technological literacy, and the goddamned wifi: a single chart

Randal Munroe nails it again in an XKCD installment that expresses the likelihood that your houseguests will be able to connect to your wifi (I confess to having been the "firmware" guide -- but also, having been reminded to do something about my own firmware when other difficult houseguests came to stay). Read the rest

TV news report about unwanted Alexa orders triggers unwanted Alexa orders

Television anchors on San Diego's CW6 were discussing how a young girl "accidentally" ordered a dollhouse and four pounds of cookies by talking to Amazon's Alexa when one of the anchors said "I love the little girl, saying ‘Alexa ordered me a dollhouse." Oops. From CW6 San Diego:

As soon as (anchor Jim) Patton said that, viewers all over San Diego started complaining their echo devices had tried to order doll houses...

Amazon says shopping settings can be managed via its Alexa app, including turning off voice purchasing and creating a confirmation code before any order.

The company also says any “accidental” physical orders can be returned for free.

Read the rest

FBI arrest the VW executive who stonewalled on the first Dieselgate reports for defrauding the US Government

Oliver Schmidt led Volkswagen regulatory compliance office from 2014 to Mar 2015, and it was he who issued statements dismissing the initial West Virginia University reports of cheating in the emissions control systems of the company's cars, lying to US regulators and insisting that the systems were merely buggy, and not deliberately designed to get around emissions testing; after the company admitted to the fraud, he appeared before the British Parliament and insisted that the fraud didn't violate EU law. Read the rest

Watercooler won't dispense until it finishes updating Windows

Intel Director of Incident Response Jackie Stokes has captured the entirety of 2017 in a single image: a watercooler that won't dispense water until it has installed a Windows upgrade (caption: "I just wanted some water..."). Read the rest

Your smart meter is very secure (against you) and very insecure (against hackers)

In On Smart Cities, Smart Energy, And Dumb Security -- Netanel Rubin's talk at this year's Chaos Communications Congress -- Rubin presents his findings on the failings in the security of commonly deployed smart meters. Read the rest

Cryptomancer: RPG based on real crypto fundamentals

In Cryptomancer, players inhabit a fantasy world populated with elves, dwarves and humans, but they win out by designing and undermining cryptographically secured networks of magical gems that allow different factions to coordinate their actions over distance. Read the rest

The Mirai worm is gnawing its way through the Internet of Things and will not stop

The Mirai worm made its way into information security lore in September, when it was identified as the source of the punishing flood of junk traffic launched against Brian Krebs in retaliation for his investigative reporting about a couple of petty Israeli criminals; subsequent analysis showed Mirai to be amateurish and clumsy, and despite this, it went on to infect devices all over the world, gaining virulence as it hybridized with other Internet of Things worms, endangering entire countries, growing by leaps and bounds, helped along by negligent engineering practices at major companies like Sony. Read the rest

The kickstarted Pebble smartwatch is now a division of Fitbit, so they may "reduce functionality" on all the watches they ever sold

If you're one of the 60% of Pebble employees who didn't get a job offer from Fitbit, the company's new owner, you're probably not having a great Christmas season -- but that trepedation is shared by 100% of Pebble customers, who've just learned (via the fine print on an update on the Pebble Kickstarter page) that the company may soon "reduce functionality" on their watches. Read the rest

Not just crapgadgets: Sony's enterprise CCTV can be easily hacked by IoT worms like Mirai

The unprecedented denial-of-service attacks powered by the Mirai Internet of Things worm have harnessed crappy, no-name CCTVs, PVRs, and routers to launch unstoppable floods of internet noise, but it's not just faceless Chinese businesses that crank out containerloads of vulnerable, defective-by-design gear -- it's also name brands like Sony. Read the rest

DDoS attack on Finnish automated buildings disabled heating controls

When the heat goes out during Finnish winter, it's a matter of life and death, so when two automated buildings controlled by Valtia systems suffered DDoS attacks that shut off the heat, Finns were understandably alarmed about the new threat. Read the rest

Two hackers are selling DDoS attacks from 400,000 IoT devices infected with the Mirai worm

The Mirai worm -- first seen attacking security journalist Brian Krebs with 620gbps floods, then taking down Level 3, Dyn and other hardened, well-provisioned internet giants, then spreading to every developed nation on Earth (and being used to take down some of those less-developed nations) despite being revealed as clumsy and amateurish (a situation remedied shortly after by hybridizing it with another IoT worm) -- is now bigger than ever, and you can rent time on it to punish journalists, knock countries offline, or take down chunks of the core internet. Read the rest

A lightbulb worm could take over every smart light in a city in minutes

Researchers from Dalhousie University (Canada) and the Weizmann Institute of Science (Israel) have published a working paper detailing a proof-of-concept attack on smart lightbulbs that allows them to wirelessly take over the bulbs from up to 400m, write a new operating system to them, and then cause the infected bulbs to spread the attack to all the vulnerable bulbs in reach, until an entire city is infected. Read the rest

Winter Denial of Service attack knocks out heating in Finnish homes

A DDoS attack that incidentally affected the internet connections for at least two housing blocks in Lappeenranta, Finland caused their heating systems to shut down, leaving their residents without heat in subzero weather. Read the rest

Internet of Things botnet threatens to knock the entire country of Liberia offline

The various Mirai botnets, which use "clumsy, amateurish code to take over even more clumsy and amateurish CCTVs, routers, PVRs and other Internet of Things devices, have been responsible for some eye-popping attacks this season: first there was the 620Gbps attack on journalist Brian Krebs (in retaliation for his coverage of a couple of petty Israeli crooks); then there was the infrastructure attack that took out Level 3, Netflix, Twitter, Dyn, and many more of the internet's best-defended services. Read the rest

New, fast-spreading IoT botnet hybridizes two less-effective strains to achieve quick dominance

Linux/IRCTelnet is a new strain of Internet of Things malware that borrows its password-guessing routines from Mirai, the malware that helped take down Paypal, Netflix and Twitter, and adds them to the scanning routines from a newer IoT bot called Bashlight. Read the rest

Unsecured Internet of Things gadgets get hacked within 40 minutes of being connected to the net

The Atlantic's Andrew McGill set up a virtual server on Amazon's cloud that presented to the internet as a crappy, insecure Internet of Things toaster; 41 minutes later, a hacked IoT device connected to it and tried to hack it. Within a day, the "toaster" had been hacked more than 300 times. Read the rest

Sneaky ultrasonic adware makes homes vulnerable to ultrasonic hacking

Earlier this year, companies like Silverpush were outed for sneaking ultrasonic communications channels into peoples' devices, so that advertisers could covertly link different devices to a single user in order to build deeper, more complete surveillance profiles of them. Read the rest

More posts