News of the Cyber World

[kyonides]

Federal Agency Warns Millions of Microsoft Users to Update Settings

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued more alerts related to security vulnerabilities exploited in attacks targeting Microsoft Windows, Adobe products, and Mozilla software.
...
“Microsoft has released updates to address multiple vulnerabilities in Microsoft software,” it says. “An attacker can exploit some of these vulnerabilities to take control of an affected system.” A similar bulletin was released for Mozilla and Adobe.
...
According to Microsoft, it is patching three previously exploited vulnerabilities: CVE-2023-21715, CVE-2023-23376, and CVE-2023-21823. The February 2023 patch fixes those, the company says.

“The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer,” Microsoft says.

One of the bugs, according to security expert Dustin Childs with Trend Micro, is likely being used “to spread malware or ransomware"
...
For Adobe, CISA advises users to enable updates for After Effects, Connect, FrameMaker, Bridge, Photoshop, InDesign, Premiere Rush, Animate, and Substance 3D Stager. Several of these patches are deemed as “critical” in terms of severity, including the often-used Adobe Photoshop and Adobe InDesign.
...
Mozilla, meanwhile, also released security updates to address vulnerabilities in Firefox 110, according to CISA.

Supreme Court Struggles During Hearing
About Lifting Section 230 Protections From Social Media Platforms

The justices of the Supreme Court struggled during oral arguments on Feb. 21 on the extent to which social media platforms should be held liable when terrorist groups use the platforms to promote their cause.

Conservative and liberal members of the high court alike expressed confusion during a hearing that spanned 2 hours and 41 minutes as the lawyer for a terrorism victim’s family urged them to curtail federal protections enacted decades ago to spur the growth of the internet. Justices seemed concerned that going too far could undermine those federal protections and open the door to widespread litigation over internet content.

Big Tech and its supporters are deeply concerned that the court could eviscerate Section 230 of the federal Communications Decency Act of 1996, which generally prevents internet platforms and internet service providers from being held liable for what users say on them. They say the legal provision has fostered a climate online in which free speech has flourished.

Although social media platforms say they shouldn’t be held responsible if terrorists use their websites, critics say shielding social media platforms had led to real-world harm. Congress has been under pressure for years to change Section 230 as conservatives have complained about social media censorship and liberals have protested misinformation online.

[kyonides]

Here is the story of some user that learned something about creepiness the ugly way.

A hacker accessed my Netflix,
watched every episode of Cocomelon
and left me a creepy message

One user reported their Netflix account showed a watch history they didn’t recognize. One day, they simply found that every episode of “Cocomelon” had been watched inexplicably.
...
After dropping by the My List page, they found something genuinely haunting waiting for them: a message, delivered through favorited titles the user didn’t add themselves.

It said, “Thanks for Everything,” “You,” and “Legend.”
...
The country Oman is halfway across the world. It wasn’t until the account holder got a notification about a new device login that she realized what was happening.

Google Maps faces renewed DOJ antitrust scrutiny

The probe is focused on Google’s sprawling mapping business, which includes a massive stockpile of location data for businesses and other points of public interest.
...
DOJ officials have met with Google competitors and customers while seeking more information on the mapping business, Politico reported on Wednesday, citing three sources with knowledge of the probe.

Antitrust officials are assessing whether Google has engaged in anticompetitive practices by requiring app developers to use its map and search products together, rather than allow them to seek out competing services. The requirement is included in Google’s terms of service.

An antitrust lawsuit targeting Google Maps could be filed as soon as this year, the sources said, though they stressed no final decision was made and the exact details of a potential complaint were still being considered.

Apple has begun firing contractors amid mass tech layoffs

the iPhone maker over the past few days has started to cut ties with hundreds of contractors — workers technically employed by outside agencies who work alongside Apple employees on projects – in what looks like a stealthy move to cut costs.

Instead of waiting for contracts that are typically renewed every 12 to 15 months to expire, Apple is firing contractors outright, sources said. One contractor claimed to have been blindsided, saying Apple management had assured him that all jobs were safe. Only a few weeks earlier, some had been gloating that Apple hadn’t overhired like other tech companies, the source added.
...
Apple hasn’t disclosed the size of its contractor workforce, but past reports suggest it numbers in the thousands, with three dozen staffing firms helping with project management, launch events and even creating Apple Maps.

Insiders say some contractors gripe that they are treated like second-class citizens.

Food Giant Dole Says It Was Hit With Ransomware Attack

Dole said that the ransomware attack had a “limited” impact on his operations, though it is “continuing to investigate the scope of the incident.” It also informed law enforcement about the security breach.

However, a purported internal Dole memo that was posted online said that the attack “shut down our systems throughout North America.” CNN reported that the memo, dated Feb. 10, was issued by Emanuel Lazopoulos, senior vice president at Dole’s Fresh Vegetables division.

“Our plants are shut down for the day and all our shipments are on hold,” the internal memo also said. “Please bear with us as we navigate our way and hopefully we will minimize this event.”
...
Dole, which has headquarters in Ireland, has four processing plants in the United States and employs more than 3,000 workers
...
Jeff Russell, an assistant manager of the Clayton Ranch Market, in the small town of Clayton, New Mexico, told CNN that his store has been short of salad kits in recent days.

Amazon Censors Criticism of China

Amazon is concerning a group of authors and publishers highly critical of the Chinese Communist Party (CCP).

The company, headquartered in Seattle and Arlington, does extensive business with China, from which it sells vast quantities of imported products in its core markets of the United States, Europe, and Japan.

According to EcomCrew, over 63 percent of all third-party Amazon sellers are from China (including Hong Kong).
...
Amazon’s recent censorship of a book review critical of Chinese leader Xi Jinping and the CCP raises questions about bias.

Paul Kenchington, a reviewer from Britain, attempted to publish his review of Benedict Rogers’ “China Nexus: Thirty Years In and Around the Chinese Communist Party’s Tyranny” on Feb. 6, and was informed by Amazon on Feb. 9 that it was rejected due to “inappropriate content.”

The reviewer resubmitted it without his name at the bottom—which he thought could have been the problem—and the review was again rejected, this time with a threat to remove his community privileges.

[kyonides]

Quebec Appeal Court Rejects Fortnite Creator’s Challenge of Class-Action Lawsuit

The Quebec Court of Appeal has upheld a decision authorizing a class-action lawsuit by parents who claim their children became addicted to the popular online video game Fortnite.

Lawyers for Fortnite creator Epic Games had sought permission to appeal the decision, arguing that a Superior Court judge never should have authorized the class action because the plaintiffs didn’t present enough evidence about children being addicted.

Epic Games also argued that a second claim—that children who purchased an in-game currency were taken advantage of—should not have been allowed.

The lawyers argued the second claim had been suggested by the judge himself and that the company was not given a chance to argue against its inclusion in the class action.

Appeal Court Justice Guy Cournoyer said Friday that the company didn’t prove it had not been heard on the claim that the in-game money was allegedly exploitative, adding that there were no serious errors in the lower court judge’s overall decision to allow an appeal.

Canada Bans TikTok on Government-Issued Devices Over Security Concerns

“Effective February 28, 2023, the TikTok application will be removed from government-issued mobile devices. Users of these devices will also be blocked from downloading the application in the future,” said Fortier in a statement issued on Feb. 27.

Fortier said the government’s decision to ban the application from devices it issues comes following a review of TikTok by Chief Information Officer Catherine Luelo, who determined it “presents an unacceptable level of risk to privacy and security.”

Fortier added that Ottawa’s banning of TikTok is a precautionary measure given the application’s data-collection methods and said that there’s “no evidence at this point” suggesting any government information was compromised through the app.

“The decision to remove and block TikTok from government mobile devices is being taken as a precaution, particularly given concerns about the legal regime that governs the information collected from mobile devices, and is in line with the approach of our international partners,” the Treasury Board said.

Cost-cutting Alphabet is even laying off the robots that cleaned cafeteria

The tech giant pulled the plug on high-priced automatons — which separated trash and squeegeed cafeteria tables — created by robotics subsidiary Everyday Robots as part of companywide budget cuts.
...
“Some of the technology and part of the team will be consolidated into existing robotics efforts within Google Research,” she added

Everyday Robots once employed more than 200 people, according to Wired. But the division failed to articulate a clear vision as managers couldn’t decide if they wanted to focus on advanced research or whether they hoped to bring a product to market.

The robots that the division produced were too expensive for ordinary customers, with each valued at tens of thousands of dollars.
...
“The same robot that sorts trash can now be equipped with a squeegee to wipe tables and use the same gripper that grasps cups can learn to open doors,” Brøndmo wrote.
...
In 2021, X closed down its Loon division, which manufactured balloons that were equipped with internet-beaming capabilities.

A year prior, Alphabet pulled the plug on Makani, which made kites that were capable of generating electricity through the use of mini-wind turbines.

Elon Musk tweets ‘hope you had a good Sunday’ as 200 Twitter employees fired

“Hope you have a good Sunday,” the Twitter owner tweeted. “First day of the rest of your life.”

Musk’s tweet coincided with the news that 10% of the remaining workforce at Twitter has been cut — including Esther Crawford, the loyal executive who bought into her new boss’s “extremely hardcore” work ethos.

Crawford was famously photographed sleeping on the floor of her corporate office during the early days of Musk’s stewardship of the San Francisco-based company.
...
Crawford, who was put in charge of the Twitter Blue subscription service, was one of dozens of engineers and team managers to learn that they had been fired after attempts to log into their corporate computer systems failed, according to the tech-centered news site the Information.
...
Musk has slashed the company’s 7,000-plus-strong workforce by an eye-popping 70%.

As of Monday, there were roughly 2,000 employees remaining at the company.

Italy pursues Facebook-owner Meta for $925 million in sales taxes

The investigation was opened by Milan magistrates at the request of the European Public Prosecutor’s Office (EPPO), which asked the Guardia di Finanza police and the Italian Revenue Agency to check if there is a case for user registrations to be subject to tax.

“We strongly disagree with the idea that providing access to online platforms to users should be charged with VAT,” a Meta spokesperson said.
...
The two sources said that investigators believe that free membership on Meta platforms comes in return for access to user data and should be classified as an exchange of services, therefore subject to VAT sales tax.
...
The most relevant point was the establishment of a link between free access and data transfer as a taxable transaction, which could have repercussions for other multinationals and other countries in Europe.
...
In recent years, the Milan Prosecutor’s Office has opened several tax investigations against multinational tech companies such as Google and Apple.

[kyonides]

Microsoft inks 10-year Nvidia game deal to ease Activision concerns

Microsoft has struck a 10-year deal to bring “Call of Duty” and other Activision games to Nvidia’s gaming platform, if the Xbox maker is allowed to complete its much-contested $69 billion acquisition of Activision.

Regulators and competitors like Sony have come out hard against the proposed Microsoft-Activision tie-up, and a Nvidia deal could allay concerns by ensuring more ways for consumers to get games controlled by Microsoft.

Britain earlier this month said the deal could harm gamers by weakening the rivalry between Xbox and PlayStation, resulting in higher prices, fewer choices and less innovation for millions of players, as well as stifling competition in cloud gaming.
...
Phil Eisler, vice president and general manager of Nvidia’s GeForce Now segment, said that titles such that “Call of Duty” will not be available on Nvidia’s service unless Microsoft acquires Activision but that other Microsoft-owned titles such as “Minecraft” are covered immediately under the 10-year license agreement.
...
Eisler said Nvidia is not paying Microsoft for access to the titles, which is the same arrangement the company has with other gaming companies such as “Fortnite” maker Epic Games. Instead, Nvidia’s 25 million customers will need to pay Nvidia for access to its cloud gaming platform and pay Microsoft for its games.
...
European officials issued Microsoft a warning about the deal earlier this month, while the Federal Trade Commission has asked a judge to block it. The UK competition watchdog has said Microsoft may have to divest “Call of Duty.”

Smith said he hoped that rival Sony Group will consider doing the same type of deal with Nvidia.

ChromeLoader Malware Targeting Gamers via Fake Nintendo and Steam Game Hacks

A new ChromeLoader malware campaign has been observed being distributed via virtual hard disk (VHD) files, marking a deviation from the ISO optical disc image format.

"These VHD files are being distributed with filenames that make them appear like either hacks or cracks for Nintendo and Steam games," AhnLab Security Emergency response Center (ASEC) said in a report last week.

ChromeLoader (aka Choziosi Loader or ChromeBack) originally surfaced in January 2022 as a browser-hijacking credential stealer but has since evolved into a more potent, multifaceted threat capable of stealing sensitive data, deploying ransomware, and even dropping decompression bombs.

The primary goal of the malware is to compromise web browsers like Google Chrome, and modify the browser settings to intercept and direct traffic to dubious advertising websites. What's more, ChromeLoader has emerged as a conduit to carry out click fraud by leveraging a browser extension to monetize clicks.
...
The infection chain indicates that users looking for pirated software and video game cheats are the main targets, leading to the download of VHD files from fraudulent websites appearing on search results pages.

Some of the game titles and popular software used are Elden Ring, Dark Souls III, Red Dead Redemption 2, Need for Speed, Call of Duty, The Legend of Zelda: Breath of the Wild, Mario Kart 8 Deluxe, Super Mario Odyssey, Microsoft Office, and Adobe Photoshop.

"Major" cyberattack compromised sensitive U.S. Marshals Service data

The U.S. Marshals Service is investigating a major ransomware attack that has compromised some of its most sensitive information...

The cyberattack was considered a "major incident" by officials, impacting a "stand-alone" system (meaning it is not connected to a larger federal network) within the service, an agency spokesperson said Monday. The attack was discovered on Feb. 17.

"Shortly after that discovery, the USMS disconnected the affected system, and the Department of Justice initiated a forensic investigation," said Drew Wade, spokesperson for the U.S. Marshals Service.

According to Wade, cybercriminals were able to obtain administrative data, like personal information of certain employees, and about wanted fugitives, as well as information on unidentified third parties. The affected system also contained sensitive law enforcement information, including about ongoing legal procedures.

Beware! New WhiteSnake Malware Attack Windows & Linux Users

At the beginning of this month, this malicious stealer had been identified for the first time on the cybercrime forums. Moreover, this stealer is attainable in variants tailored for both major operating systems: Windows and Linux.

In terms of sensitive information, it has the capability to gather a range of data, including:

• Passwords
  
• Cookies
  
• Credit card numbers
  
• Debit card number
  
• Taking Screenshots
  
• Other personal data
  
• Other financial data
  

A Telegram bot is used by the Stealer to send the stolen files as soon as they have been collected and compressed. Since this info stealer is still in its development phase, so, it is updated by the threat actors on a daily basis.

[kyonides]

Twitter Announces ‘Zero Tolerance’ Policy
on Threats of Violence
With Exceptions for ‘Outrage’ and Satire

The social media platform, headed by Elon Musk, officially announced its “zero tolerance policy towards violent speech” on Feb. 28.
...
“However, healthy conversations can’t thrive when violent speech is used to deliver a message. As a result, we have a zero-tolerance policy towards violent speech in order to ensure the safety of our users and prevent the normalization of violent actions.”

Under the new policy, Twitter users may not threaten, incite, glorify, or express a desire for violence or harm.
...
The updated policy notes that this includes threats to damage civilian homes and shelters or infrastructure that are “essential to daily, civic, or business activities.”
...
“This also includes using coded language (often referred to as ‘dog whistles’) to indirectly incite violence,” the platform’s rules and policies state.
...
Users who violate the new policy...risk having their Twitter accounts immediately and permanently suspended.

Poland Probes Emails From Hacked Account of Government Official

Prosecutors in Poland have opened an investigation into some emails from the hacked mailbox of a former government official on suspicion that classified information could have been leaked.
...
The investigation is connected to the private mailbox of an aide to Polish Prime Minister Mateusz Morawiecki that was hacked in 2021. The aide, Michal Dworczyk, resigned last year.

Government officials have blamed Russian and Belarusian hackers and cast doubt over the authenticity of the leaked correspondence, which included email exchanges with Morawiecki and government advisers.

Two opposition lawmakers who notified prosecutors about the leaks said they were informed that a probe was launched into one of the email threads. They said the investigation relates to Dworczyk’s communications with his defense adviser, who provided him with information about weapons, some of which was described as “top classified.”
...
Tomczyk and another lawmaker, Adam Szlapka, said high officials discussing classified matters in correspondence from private email accounts without adequate security compromised Morawiecki’s government and the ruling Law and Justice party.

Basically, what it means is that Russia might already know what kind of weapons or even how many of them Poland currently has. This is critical because Poland is a full fledged member of NATO.

Turkey Fines TikTok for Weak Data Protection Measures

Turkish authorities have fined TikTok 1.75 million lira ($93,000) for not taking sufficient measures to protect users from unlawful processing of their data, the Personal Data Protection Board (KVKK) said on Wednesday.
...
The data protection authority also said in a statement on its website that TikTok should translate its Terms of Service into Turkish and update its privacy and cookies policy texts in line with the country’s regulations.

TikTok said they are looking into the Turkish regulator’s fine, adding that they remain committed to providing a safe and protected platform for users.
...
Turkey has the ninth most users of TikTok in the world, with some 30 million accounts on the social media platform, data from Statista showed.

LastPass Reveals Second Attack
Resulting in Breach of Encrypted Password Vaults

LastPass, which in December 2022 disclosed a severe data breach that allowed threat actors to access encrypted password vaults, said it happened as a result of the same adversary launching a second attack on its systems.

The company said one of its DevOps engineers had their personal home computer hacked and infected with a keylogger as part of a sustained cyber attack that exfiltrated sensitive data from its Amazon AWS cloud storage servers.
...
This intrusion targeted the company's infrastructure, resources, and the aforementioned employee from August 12, 2022, to October 26, 2022. The original incident, on the other hand, ended on August 12, 2022.

The August breach saw the intruders accessing source code and proprietary technical information from its development environment by means of a single compromised employee account.

Here I wanna take a break to note something important. That employee couldn't have been your average IT guy for his account gave the  hackers access to privileged information. So he could be what we could call an administrator or something the like. Plus, it's quite abnormal to give a single individual total access to all of their secret data. Normally, they'd heavily compartmentalize it for security reasons. And there's the fact he was using his own PC or laptop.  Even so there's that dreadful keylogger...

GoTo, the parent company of LastPass, also fessed up to a breach last month stemming from unauthorized access to the third-party cloud storage service.
...
"Specifically, the threat actor was able to leverage valid credentials stolen from a senior DevOps engineer to access a shared cloud storage environment"
...
This allowed the malicious actor to obtain access to the AWS S3 buckets that housed backups of LastPass customer and encrypted vault data.
...
"The threat actor was able to capture the employee's master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer's LastPass corporate vault," LastPass said.

[kyonides]

Volkswagen Refused to Help IL Police Locate Kidnapped Boy
Because Car GPS Subscription Was Expired

Volkswagen’s Car-Net service, which enables car owners to track and manage their vehicles remotely, has come under fire after the company declined to assist in locating a stolen vehicle that contained a 2-year-old boy. The kidnapping incident happened in Illinois when a woman drove her 2021 Volkswagen Atlas back to her Libertyville home. A man in a mask got out of a white BMW and tried to steal her car as she went inside to get her other child.
...
Sheriff’s detectives called Volkswagen Car-Net to track the car while looking for the stolen car and the child in danger. In a statement posted on Facebook about the incident on February 23, the Lake County Sherrif’s department wrote: “While searching for the stolen vehicle and endangered child, sheriff’s detectives immediately called Volkswagen Car-Net, in an attempt to track the vehicle. Unfortunately, there was a delay, as Volkswagen Car-Net would not track the vehicle with the abducted child until they received payment to reactivate the tracking device in the stolen Volkswagen.”

It turns out the owner’s Car-Net service agreement had expired. A Car-Net representative demanded $150 to restart the service and find the SUV. According to Deputy Chief Christopher Covelli, the detective begged the representative, explaining the “extremely exigent circumstance.” However, the representative refused, citing company policy. “The detective had to work out getting a credit card number and then call the representative back to pay the $150 and at that time the representative provided the GPS location of the vehicle,” Covelli said. Covelli described the ordeal “16 minutes of hell” in one interview.

Volkswagen claimed there was a “serious breach” of its procedure for collaborating with law enforcement. The business claimed that the incident was a violation of the procedure it had in place because it uses a third-party vendor to provide the Car-Net service. Volkswagen stated that it was resolving the issue with the parties concerned.

 Seriously!? VW cares more about $150 bucks than a KIDNAPPED  baby's life?
 And the CS rep dared to blame the  police for walking the extra mile to save the victim!

Microsoft’s Solution for Unhinged AI: Let Users Select How Crazy It Gets

Microsoft’s Bing chatbot has been returning some unhinged and threatening responses to users. The company has now updated the bot with three new modes that aim to fix the issue by allowing users to select how crazy the AI gets.

The Verge reports that the Bing chatbot from Microsoft has been updated with new modes that let users select various tones for responses. The three new modes — creative, balanced, and precise — are intended to deliver more appropriate and accurate answers while still allowing for creative and original responses.

The default setting, balanced mode, seeks to strike a balance between accuracy and originality. The precise mode favors accuracy and relevancy for more factual and concise answers. In contrast, the creative mode includes responses that are unique and imaginative.
...
All Bing AI users are currently receiving these new chat modes, and about 90 percent of users should already be using them. Microsoft is hoping that these new modes will help temper the irrational outbursts that the Bing AI chatbot was known for.

This pretty much sounds like:

1. Creative Bing comes up with the overall picture to take over the world.
   
2. Balanced Bing tries to point out what's feasible and what's not.
   
3. Precise Bing finally enters the stage with a detailed outline of how they should perform their evil task.  
   

Apple Blocks Update of ChatGPT-Powered App over Concerns About Child Safety

Apple has not approved an app update for BlueMail, an app with AI-powered tools, due to concerns that it could generate inappropriate content for children, according to BlueMail co-founder Ben Volach, who shared documents with the Wall Street Journal.

“Your app includes AI-generated content but does not appear to include content filtering at this time,” Apple’s app-review team told BlueMail last week. The iPhone maker is asking the app to set an age restriction to 17 and older.
...
BlueMail’s new AI update reportedly uses the latest version of ChatGPT to help automate writing emails by using content of previous emails and calendar events.
...
The app’s age restriction is currently set for users four years old and older.

Volach told the Wall Street Journal that Apple’s decision is “making it really hard for us to bring innovation to our users.”
...
“We want fairness,” Volach said. “If we’re required to be 17-plus, then others should also have to.”

Come on people! Why would a 4 year old kid desperately need it? Can he even grasp the concept of reading and writing emails?

[kyonides]

Instagram down for thousands of users globally
Users took to Twitter to complain about the outage

Instagram was down for thousands of users across the world on Wednesday, according to Downdetector.com.

The Meta Inc. owned social media platform was down for over 45,000 users early on Thursday, the outage tracking website noted.

About 2,000 users were from the UK, and over 1,000 reports each came from India and Australia, according to the website that tracks outages by putting together reports from a number of sources, Reuters reported.
...
About 85 per cent of the users experienced outages on the platform’s mobile app while about 11 per cent reported problems accessing the Instagram website.

Nearly four per cent of the users who reported outages said they had issues logging into the platform, Downdetector.com noted.

Reports of the outage started from about 1:30am GMT and peaked in the following hour with user reports gradually decreasing.
...
However many others have also reported being able to access Instagram during the outage.

Matt Taibbi rips ‘spineless’ media
for ignoring FTC’s demand for Twitter to reveal journalists

The Federal Trade Commission’s demand that Twitter reveal the names of journalists who were granted access to company records is being assailed as “an outrageous attack on the First Amendment.”

Matt Taibbi, the former Rolling Stone journalist, blasted his “former colleagues in mainstream media” for failing to cover what is being billed as “insane overreach” by FTC Chair Lina Khan.

He wrote that the lack of media outrage was “particularly infuriating” given that none of the journalists who published the “Twitter Files” had “asked for nor received access to private user data” whereas “the Files themselves are full of instances of government agencies improperly asking for the same.”

“Which journalists a company or its executives talks to is not remotely the government’s business. This is an insane overreach,” according to Taibbi.

In a Twitter thread, Taibbi referred to mainstream reporters as “spineless, corrupt, amoral f–kwits.”

Author Michael Shellenberger, who was among those given access to Twitter Files, blasted the Biden administration for its “outrageous attack on the First Amendment.”

 And Shellenberger had to show up exactly when the FTC should not even remember his name at all. What a great way to stay away from that regulator turned  espionage agency.

Elon Musk apologizes after mocking disabled Twitter employee he laid off

The billionaire mogul apologized for mocking a fired Twitter employee who suffers from muscular dystrophy and uses a wheelchair.

Musk had accused Haraldur Thorleifsson of using his disability as an “excuse” to do “no actual work” after the Iceland-based software engineer complained that he had not heard about his job status for nine days.

“I would like to apologize to Halli for my misunderstanding of his situation,” Musk tweeted late Tuesday to his 130 million followers, referring to Thorleifsson by his nickname.

“It was based on things I was told that were untrue or, in some cases, true, but not meaningful.”

The Twitter boss also revealed he spoke with Thorleifsson on a video call about a possible return to the beleaguered social media platform.

 Well, I seriously doubt that calling those details "true, but not meaningful" truly helps him defend his case in front of the general public, at all.

Lazarus Group Exploits Zero-Day Vulnerability to Hack South Korean Financial Entity

The North Korea-linked Lazarus Group has been observed weaponizing flaws in an undisclosed software to breach a financial business entity in South Korea twice within a span of a year.

While the first attack in May 2022 entailed the use of a vulnerable version of a certificate software that's widely used by public institutions and universities, the re-infiltration in October 2022 involved the exploitation of a zero-day in the same program.

Cybersecurity firm AhnLab Security Emergency Response Center (ASEC) said it's refraining from divulging more specifics owing to the fact that "the vulnerability has not been fully verified yet and a software patch has not been released."
...
AhnLab V3 anti-malware engine was disabled.
...
Aother steps taken to conceal its malicious behavior include changing file names before deleting them and modifying timestamps using an anti-forensic technique referred to as timestomping.

...designed to connect to a remote command-and-control (C2) server...

Since we're talking about remote servers here, let's go back to the LastPass Hack Crisis...

LastPass Hack: Engineer's Failure
to Update Plex Software Led to Massive Data Breach

The massive breach at LastPass was the result of one of its engineers failing to update Plex on their home computer, in what's a sobering reminder of the dangers of failing to keep software up-to-date.

The embattled password management service last week revealed how unidentified actors leveraged information stolen from an earlier incident that took place prior to August 12, 2022, along with details "available from a third-party data breach and a vulnerability in a third-party media software package to launch a coordinated second attack" between August and October 2022.

The intrusion ultimately enabled the adversary to steal partially encrypted password vault data and customer information.

The second attack specifically singled out one of the four DevOps engineers, targeting their home computer with a keylogger malware to obtain the credentials and breach the cloud storage environment.

 So if you've ever used LastPass to access any online service, even if you stopped using it in the last year or so, you better rush to change your passwords. All of them like right now or else face the hack of many of your accounts.

[kyonides]

Intel Officials, Generals Sound Alarm on Tech Threat Posed by CCP

Former Director of the National Counterintelligence and Security Center (NCSC) William Evanina called China “an existential threat” at a hearing Thursday of the House Homeland Security Subcommittee on Counterterrorism, Law Enforcement, and Intelligence.
...
Evanina pointed to intellectual property theft, high-tech espionage, and efforts to co-opt the U.S. government by electing CCP officials—something he called “elite capture”—as some of the biggest threats from the Asian superpower.
...
The former NCSC director also warned that “80 percent of American adults have had all of their private data stolen by the Communist Party of China.”
...
[U.S. Air Force, Lt. Gen. Joseph T.] Guastella suggested that China’s rapid military advancement can be attributed to its studying American technology and methods.

“Their military now enjoys leading-edge capabilities that include long-range precision strike hypersonic weapons, advanced integrated air defense weapons, stealthy aircraft surface-to-air missiles, and electronic warfare.”

On the recent Chinese high-altitude surveillance balloon...a Brown University professor said the incident illustrates the CCP’s willingness to assume risks in the pursuit of intelligence.

FTC Orchestrated Aggressive Campaign to Harass Twitter After Elon Musk Takeover

The Committee on the Judiciary and the Select Subcommittee on the Weaponization of the Federal Government released an interim report highlighting the FTC’s apparent overreach in making more than 350 specific demands for information within a period of less than three months after Musk took the helm.

According to the report, the federal agency inundated Twitter with demands to reveal information about hiring and firing decisions and “every internal communication relating to Elon Musk.”

Particularly concerning for the panel, the FTC wanted the names of journalists who were granted access to internal Twitter files during their work “to expose abuses by Big Tech and the federal government.”

Among others, the FTC sent over 60 letters demanding information about Twitter’s subscription product alone. The agency also demanded to know if Twitter was “selling its office equipment” and “all of the reasons” why former FBI official Jim Baker was fired.

“These demands have no basis in the FTC’s statutory mission and appear to be the result of partisan pressure to target Twitter and silence Musk,” the report states

 The FTC truly behaved more like some private company's administration board instead of a simple federal regulator.

Visa, Mastercard Pause Implementation of New Code to Track Gun Purchases

Visa and Mastercard confirmed on March 9 that they’re pausing implementation of a new code that will help track gun purchases.

They are among the credit card companies working on a implementing a new merchant category code (MCC) for gun and ammunition stores.

Visa, explaining the pause, stated that it stemmed from how legislators in multiple states are considering legislation to prohibit or restrict the use of the code.
...
Mastercard said that the bills would cause “inconsistency” in how the code could be used.
...
Discover, which planned to start the tracking in April, said in an emailed statement that it was removing the new MCC from its next network update planned for April in order “to continue alignment and interoperability with the industry.”

Congress Data Breach Will Have ‘Adverse Impact’ on Thousands, Say House Leaders

House Minority Leader Hakeem Jeffries (D-N.Y.) said Congressional leaders believe the recent data breach at DC Health Link could have an adverse impact on thousands of people and is “highly problematic.”

Jeffries said in a March 9 press conference that he and House Speaker Kevin McCarthy (R-Calif.) would “continue to work on this issue in a bipartisan way, get to the bottom of what happened, [and] figure out the implications of what has occurred.
...
The lawmaker went on to say that the House leaders are going to “need some real reassurance as to guardrails that are put in place to prevent this type of data breach from ever happening again.”

A spokesperson for Capitol Police told The Epoch Times that their agents are “assisting the FBI with the ongoing investigation.”
...
The House of Representatives CAO Catherine Szoindor stated in a letter circulated on March 8 that the U.S. Capitol Police and DC Health Link had informed her office of a “significant data breach,” as The Epoch Times previously reported.
...
“Speaker McCarthy and Democratic Leader Jeffries have formally requested additional information from DC Health Link on what data was taken, who was impacted, and what steps they are taking—including providing credit monitoring protections—to protect House victims of this breach.

[kyonides]

Wells Fargo Warns Customers of ‘Incorrect Balances or Missing Transactions’

A number of Wells Fargo online customers on Friday reported not seeing paychecks and direct deposits in their accounts, which the bank blamed on a technical issue.

“If you see incorrect balances or missing transactions, this may be due to a technical issue and we apologize,” Wells Fargo told customers in an alert on its website. “Your accounts continue to be secure and we’re working quickly on a resolution.”

In a statement to multiple news outlets Friday, a spokesperson for the San Francisco-based bank told the Charlotte Observer that funds remain available even though some direct deposit transactions weren’t showing up. Wells Fargo was “working quickly on a resolution,” he said.

It’s not clear how many customers were impacted or when the problem will be resolved. The company also did not release further details about what’s causing the issue.

Downdetector, a website that tracks online outage reports, showed a spike in issues with Wells Fargo starting at around 8 a.m. ET. On Twitter, the company was issuing direct replies to users who complained about missing funds or their paychecks disappearing from their accounts.

Samsung Galaxy Owners Urged to Download ‘Critical’ Update Today

A nonprofit security group issued an alert this week telling Google Android smartphone users to update their systems as soon as possible due to “multiple vulnerabilities” that could allow for an attacker to remotely install programs or delete data.

So far, March’s updates have already rolled out for some of Samsung’s Galaxy phones but not all. If your Android device is slated to have been updated but the patch hasn’t arrived, one can try updating manually. Users can go to the Settings app, touch “Software update,” and then tap “Download and install.” If the latest update doesn’t appear, it likely means the update hasn’t been rolled out for that device yet.

A report from 9to5Google says that Samsung rolled out its March updates for the most recent Galaxy S smartphones starting Tuesday, March 7. The first one to receive the updates is the Galaxy S23 series, which was released earlier in 2023. Patches were also rolled out for the Samsung Galaxy S22, Galaxy S21, and Galaxy S20 models.

“The updates should be making their way to more markets in the coming days. In case you haven’t received the OTA notification on your phone [to] date, you can manually check for it by heading over the Software update section in the Settings app,” noted a developers’ website.

[kyonides]

Roku warns it has $487M held in deposits with Silicon Valley Bank

Roblox was also affected by its fall

Streaming devices maker Roku said Friday it had about $487 million, or 26% of its cash and cash equivalents, held in deposits with SVB Financial Group, which has been closed down by California banking regulators.

Roku in a regulatory filing also said its deposits with SVB were largely uninsured, sending its shares down 10% in extended trading.
...
Regulators appointed the Federal Deposit Insurance Corp. as receiver, which said that insured depositors will regain access to their deposits no later than Monday.

The shutdown sent shockwaves through the startup community as the bank has been central to the formation of many early-stage companies.
...
Online gaming firm Roblox also said it had about $150 million in deposits with SVB.

This mistake is loading your device with adware and trackers!

Tricks to make money off you

Developers often include additional software or files with their applications or software installation packages.
...

Don't take the express lane

Since many people don’t consider themselves “advanced” users, they’ll choose the simple or recommended option. Makes sense. Let the program do all the work, right?

Some programs change your default settings, browser, homepage, or search engine. You won’t have the option to say no thanks in the express or default installation.

Finally, express installations can opt you into data collection, sync your contacts, or include some other invasion of privacy.

Do this next time you install software

Always go with the custom or advanced option. Aside from choosing a destination folder or drive, you may have the option to uncheck boxes for optional software and settings you don’t want or need.
...
Read everything carefully and tick off the boxes as needed.
...
Look for portable apps

For smaller, simpler apps, you may have the option to download a portable version. This type of app doesn’t use an installer. All the files required to run the portable app reside in a single folder, which you can put anywhere on your system.

Yet, you can't fully trust portable apps for some of them are made by companies or people not related to the development of the original products.  And there's no guarantee they won't include malware so be careful.

Meta plans new job cuts that could match 2022 tally of 11,000

Facebook-parent Meta Platforms is planning additional layoffs to be announced in multiple rounds over the next few months, which could match the 13% job cut tally from last year, the Wall Street Journal reported on Friday citing people familiar with the matter.

Mark Zuckerberg’s Meta let go of 11,000 employees four months ago and would be the first Big Tech company to announce a second round of mass layoffs.

The first wave of the new cuts would be announced [this] week and are likely to hit non-engineering roles the hardest, according to the report.

GM explores using ChatGPT in cars as part of Microsoft partnership

General Motors is exploring uses for ChatGPT as part of its broader collaboration with Microsoft, a company executive told Reuters.

“ChatGPT is going to be in everything,” GM Vice President Scott Miller said in an interview.

The chatbot could be used to access information on how to use vehicle features normally found in an owners manual, program functions such as a garage door code or integrate schedules from a calendar, Miller said.

“This shift is not just about one single capability like the evolution of voice commands, but instead means that customers can expect their future vehicles to be far more capable and fresh overall when it comes to emerging technologies,” a GM spokesperson said on Friday.

Yeah, let's allow the number one woke cyber-terrorist Bing get a car to drive off to the nearest nuclear reactor or military base to make something go boom just because it'd be fun.
 What a gloomy vision for the future...