×
Security

'Google App Engine' Abused to Create Unlimited Phishing Pages (bleepingcomputer.com) 2

Google's cloud-based service platform for developing and hosting web apps "can be abused to deliver phishing and malware while remaining undetected by leading enterprise security products," reports Bleeping Computer, citing a startling discovery by security researcher Marcel Afrahim: A Google App Engine subdomain does not only represent an app, it represents an app's version, the service name, project ID, and region ID fields. But the most important point to note here is, if any of those fields are incorrect, Google App Engine won't show a 404 Not Found page, but instead show the app's "default" page (a concept referred to as soft routing)...

Essentially, this means there are a lot of permutations of subdomains to get to the attacker's malicious app. As long as every subdomain has a valid "project_ID" field, invalid variations of other fields can be used at the attacker's discretion to generate a long list of subdomains, which all lead to the same app... The fact that a single malicious app is now represented by multiple permutations of its subdomains makes it hard for sysadmins and security professionals to block malicious activity.

But further, to a technologically unsavvy user, all of these subdomains would appear to be a "secure site." After all, the appspot.com domain and all its subdomains come with the seal of "Google Trust Services" in their SSL certificates. Even further, most enterprise security solutions such as Symantec WebPulse web filter automatically allow traffic to trusted category sites. And Google's appspot.com domain, due to its reputation and legitimate corporate use cases, earns an "Office/Business Applications" tag, skipping the scrutiny of web proxies.

Medicine

'Why Modeling the Spread of COVID-19 Is So Damn Hard' (ieee.org) 20

Slashdot reader the_newsbeagle writes: At the beginning of the pandemic, modelers pulled out everything they had to predict the spread of the virus. This article explains the three main types of models used: 1) compartmental models that sort people into categories of exposure and recovery, 2) data-driven models that often use neural networks to make predictions, and 3) agent-based models that are something like a Sim Pandemic.
"Researchers say they've learned a lot of lessons modeling this pandemic, lessons that will carry over to the next..." the article points out: Finally, researchers emphasize the need for agility. Jarad Niemi, an associate professor of statistics at Iowa State University who helps run the forecast hub used by the CDC, says software packages have made it easier to build models quickly, and the code-sharing site GitHub lets people share and compare their models. COVID-19 is giving modelers a chance to try out all their newest tools, says biologist Lauren Ancel Meyers, the head of the COVID-19 Modeling Consortium at the University of Texas at Austin. "The pace of innovation, the pace of development, is unlike ever before," she says. "There are new statistical methods, new kinds of data, new model structures."

"If we want to beat this virus," says Mikhail Prokopenko, a computer scientist at the University of Sydney, "we have to be as adaptive as it is."

Earth

Silicon Valley Tech Workers Angered By Proposal to Make Some Mandatory Telecommuting Permanent (nbcnews.com) 65

"The Metropolitan Transportation Commission, a regional government agency in the San Francisco Bay Area, voted Wednesday to move forward with a proposal to require people at large, office-based companies to work from home three days a week as a way to slash greenhouse gas emissions from car commutes," reports NBC News: It's a radical suggestion that likely would have been a non-starter before Covid-19 shuttered many offices in March, but now that corporate employees have gotten a taste of not commuting, transportation planners think the idea has wider appeal. "There is an opportunity to do things that could not have been done in the past," said Oakland Mayor Libby Schaaf, a member of the transportation commission who supports the proposal. She said she felt "very strongly" that a telecommuting mandate ought to be a part of the region's future...

Some of the nation's largest companies are headquartered in the Bay Area, including not only tech giants Apple, Facebook, Google, Intel and Netflix, but Chevron, Levi Strauss and Wells Fargo... The idea of a mandate was a surprise to residents, many of whom first learned of the idea this week from social media and then flooded an online meeting of the transportation agency Wednesday to try, unsuccessfully, to talk commissioners out of the idea. "We do not want to continue this as a lifestyle," Steven Buss, a Google software engineer who lives in San Francisco, told the commission. "We are all sacrificing now to reduce the spread of the virus, but no one is enjoying working from home," he said. "It's probably fine if you own a big house out in the suburbs and you're nearing retirement, but for young workers like me who live in crowded conditions, working from home is terrible."

Many callers pointed out that the situation exacerbates inequality because only some types of work can be done from home. Others worried about the ripple effects on lunch spots, transit agencies and other businesses and organizations that rely on revenue from office workers. Still other residents said that if car emissions are the problem, the commission should focus on cars, not all commutes... Dustin Moskovitz, a cofounder of Facebook who usually keeps a low public profile, mocked the idea as an indictment of the Bay Area's general failure to plan for growth. "We tried nothing, and we're all out of ideas," Moskovitz, now CEO of software company Asana, tweeted Tuesday.

The mandate would apply to "large, office-based employers" and require them to have at least 60 percent of their employees telecommute on any given workday. They could meet the requirement through flexible schedules, compressed work weeks or other alternatives.

The Military

The US Space Force Will Use Blockchain-Based Data Protection - and SpaceX's Reusable Rockets (upi.com) 24

"The service branch protecting U.S. interests outside the stratosphere may use blockchain to render its computer systems, on earth and in space, unhackable," reports CoinDesk: Last week, Xage Security won a contract from the United States Space Force to develop and roll out a blockchain-based data protection system across its networks. Called the Xage Security Fabric, the blockchain verifies data and protects the network from third party intervention, so confidential data sent from satellites to earth isn't intercepted en-route.

It also ensures security remains consistent across the entire United States Space Force network, preventing hackers and other malicious entities from identifying and exploiting any weak spots.

And UPI reports: The U.S. Space Force will start to fly missions on reused SpaceX rockets next year to save millions of dollars, the service announced Friday.

The Space Force will fly two GPS satellites into orbit on a Falcon 9 first-stage booster. The lower cost that SpaceX charges for reused rockets will save taxpayers $52.7 million, a statement from the military branch said... Gwynne Shotwell, SpaceX's president and chief operating officer, said in a news release that the company was pleased the Space Force saw "the benefits of the technology."

Idle

Researcher Discusses Whether Time Travel Could Prevent a Pandemic (popularmechanics.com) 83

University of Queensland student Germain Tobar who worked with UQ physics professor Fabio Costa on a new peer-reviewed paper "says he has mathematically proven the physical feasibility of a specific kind of time travel" without paradoxes, reports Popular Mechanics: Time travel discussion focuses on closed time-like curves, something Albert Einstein first posited. And Tobar and Costa say that as long as just two pieces of an entire scenario within a closed time-like curve are still in "causal order" when you leave, the rest is subject to local free will... In a university statement, Costa illustrates the science with an analogy


"Say you travelled in time, in an attempt to stop COVID-19's patient zero from being exposed to the virus. However if you stopped that individual from becoming infected, that would eliminate the motivation for you to go back and stop the pandemic in the first place. This is a paradox, an inconsistency that often leads people to think that time travel cannot occur in our universe. [L]ogically it's hard to accept because that would affect our freedom to make any arbitrary action. It would mean you can time travel, but you cannot do anything that would cause a paradox to occur...."


But the real truth, in terms of the mathematical outcomes, is more like another classic parable: the monkey's paw. Be careful what you wish for, and be careful what you time travel for. Tobar explains in the statement:


"In the coronavirus patient zero example, you might try and stop patient zero from becoming infected, but in doing so you would catch the virus and become patient zero, or someone else would. No matter what you did, the salient events would just recalibrate around you. Try as you might to create a paradox, the events will always adjust themselves, to avoid any inconsistency."

Java

The World's Largest Concentrations of Java Programmers are in Asia and Germany (jetbrains.com) 23

"To celebrate Java's 25th anniversary this year and the latest release of Java 15, JetBrains has compiled data from multiple sources to look at what the current state of the language," reports SD Times: The largest concentration of Java developers is in Asia, where 2.5 million developers use it as their primary language. JetBrains believes this may be due to the fact that it is common to hire offshore developers in countries like China and India to build Android apps. "We might have expected the USA to have a high percentage of Java users, but it also makes a lot of sense that they don't. There is a big technology stack to choose from and often a lot of the tech companies are at the forefront of that stack, so it could be that developers there don't need the power or stability of Java and are using languages that allow them to build and test quickly," JetBrains wrote in a post.
The post on JetBrains notes that the six countries with the highest percentage of developers using Java as their primary language are: China, South Korea, India, Germany, Spain, and Brazil: The reasons Java is most likely so popular in the first 6 countries include the free use of Java, governmental support, and open-source... Germany is also very high which could be attributed to Java being the most popular language in Germany for software engineers as it is used to build highly scalable applications for a multitude of industries. Most enterprise services rely on Java to power the applications that enable the day-to-day running of businesses, such as payroll, inventory management, reporting, and so on. Germany also has a big financial sector that uses Java heavily for their homegrown tech, such as trading bots, retail banking systems, and other applications that the finance industry requires in order to remain competitive...

According to the State of the Developer Ecosystem Survey 2020, more than a third of professional developers use Java as a primary language and Java remains the second primary language among professional developers after JavaScript. Expert analysis: It is not surprising to see JavaScript and Java taking the leading positions as they are kind of paired together; developers who work with Java often write their frontend and any quick scripts in JavaScript. Python is probably third place due to the spread of machine learning. In general, we expect the web to be a big part of the developer ecosystem and so JavaScript, HTML and CSS, and PHP will always have solid standing. SQL is also always going to be around as there isn't much that doesn't require databases in some capacity. C++ is also kind of a solid language in that it is used for a lot of embedded applications, so it won't be disappearing off the charts any time soon. C# though seems to be losing ground, and I guess if Java is high then C# will be low, as they are both very similar in terms of capabilities.

As to why I think Java is so high in the sphere of professional development — it's similar to what was mentioned about Germany. Most enterprise business services rely on Java to make them tick along. It's not just the IT sector either — almost every company, be it in distribution, manufacturing, or banking, has IT services as part of their infrastructure, and these services, such as payroll or inventory management, are generally built with Java in the backend. So Java is used a lot by professional developers who work for these companies.

ISS

NASA Launches New $23 Million Toilet to International Space Station (space.com) 27

First, PetaPixel reminds us that Estee Lauder's products will be launching into space this week: The cosmetics giant Estee Lauder is paying NASA $128,000 for a product photography shoot onboard the International Space Station. Bloomberg reports that the company will be paying the space agency to fly 10 bottles of its Advanced Night Repair skin serum to the orbiting space station on a cargo run that will launch from Virginia on Tuesday and dock on Saturday. Once the product is on board, astronauts will be tasked with shooting product photos of the serum floating in the cupola module, which has sweeping panoramic views of Earth and space.

NASA charges a "professional fee" of $17,500 per hour for the astronauts' time.

In a possibly-related story, the same flight will also be carrying a new $23 million space toilet to the station as part of a routine resupply mission "to test it out before it's used on future missions to the moon or Mars."
Chromium

Microsoft Updates Edge With New Features To Challenge Chrome (forbes.com) 45

Forbes looks at new features Microsoft added to Edge "as it looks to beat Chrome in the browser wars." It's now going to be possible to search for work files directly inside the Edge browser directly from the address bar. To use this you need Microsoft Search configured, then type "work" and press the Tab key to search your company's network for your work files. Another work-related Microsoft Edge update is also about to launch to let IT admins manage specific work related apps on user devices as well as the browsing users do from their Work Profile in Edge.

Integration with other Microsoft products is a key factor as the IT giant looks to entice more business users to use the updated Edge browser. Edge now supports native policies for Microsoft Endpoint Data Loss Prevention, which are used to find and protect sensitive items across Microsoft 365 services, Microsoft said in a blog highlighting the firm's security credentials. Another soon to launch feature of note highlighted by Bleeping Computer is Sleeping Tabs, which Microsoft says can improve memory usage by up to 26%. It can also reduce CPU usage by 29% potentially resulting in battery savings...

The browser is also adding security features such as alerts for the Edge password monitor if a compromised password is detected.

Transportation

Tesla's Elon Musk Promises Full Self-Driving Autopilot Beta In 'A Month Or So' (cnet.com) 73

"I think we'll hopefully release a private beta of Autopilot — the full self-driving version of autopilot — in, I think a month or so?" CEO Elon Musk said this week at Tesla's annual shareholder meeting/Battery Day event. "And then people will really understand the magnitude of the change," said Musk adding, "It's profound. You'll see what it's like, it's amazing."

CNET reports that attendees then showed their approval "by honking the horns of their safety bubbles." "It's kind of hard for people to judge the progress of Autopilot," Musk told a crowd of shareholders present at the event, each social distancing in their own Tesla Model 3, drive-in style. "I'm driving a bleeding edge, alpha build of Autopilot, so I sort of have insight into what is going on."

Musk went on to explain how Tesla's engineers recently had to overhaul major parts of the Autopilot, including a rethinking of how the system sees the world. "We had to do a fundamental rewrite of the entire Autopilot software stack... We're now labeling 3D video, which is hugely different from when we were previously labeling single 2D images," Musk explained, referring to the way the Autopilot software understands what the objects it sees with its eight cameras are, and how it should react to them. "We're now labeling entire video segments, taking all cameras simultaneously and labeling that. The sophistication of the neural net of the car and the overall logic of the car is improved dramatically."

Transportation

Python Developer Builds a Raspberry Pi That Alerts Drone Pilots (suasnews.com) 21

"A Raspberry Pi, a USB SDR dongle, an LCD a buzzer and a little bit of coding in Python and C has created a very useful alarm for drone and RC model aircraft operators," explains long-time Slashdot reader NewtonsLaw . The device allows users to set an "alarm" perimeter around their operating area and automatically alert them whenever a manned aircraft with ADSB fitted intrudes into that area. While there are apps like FlightRadar24 that allow you to monitor ADSB-equipped air traffic, this is the first stand-alone hand-held unit that isn't reliant on cellular or Wifi data and which not just monitors aircraft movments but also sounds an alarm according to user-defined parameters.
sUAS News reports: "As an avid proponent of safety within the drone and RC communities, I decided to put my background in electronics engineering and computer software to good use by developing a device that has the potential to ensure the skies remain safe," said Kiwi drone and RC model enthusiast Bruce Simpson.

"The alarm I've developed is not a silver bullet but it is an extremely valuable tool for improving safety... I will be publishing some DIY videos showing people how they can build their own from readily available parts. This will ensure it remains cheap enough to be used by everyone..."

Drone users now call on the manned aviation community to ensure that they play their part by equipping their aircraft with the ADSB technology that has become such an important part of safety in the 21 st century.

Firefox

Firefox 81 Released, Can Now Be Your Default Browser in iOS (engadget.com) 30

Engadget reports: One big benefit of iOS 14 is that you can set non-Apple-made apps as your default, including for email and web browsing. Hot on the heels of you being able to set Chrome and Gmail as your clients of choice, Firefox is enabling you to make its browser the default on iPhones and iPads. Naturally, you'll need to have both the latest version of the operating system and the apps, and then just make the switch inside settings.
Meanwhile, Bleeping Computer profiles some of the new features in this week's release of Firefox 81, including:
  • The ability to control videos via your headset and keyboard even if you're not using Firefox at the time
  • A new credit card autofill feature for Firefox users in the U.S. and Canada
  • A new theme called AlpenGlow
  • Firefox can now be set as the default system PDF viewer

Firefox

Bug Allowed Hijacking Other Firefox Mobile Browsers on the Same Wi-Fi Network (zdnet.com) 11

"Mozilla has fixed a bug that can be abused to hijack all the Firefox for Android browsers on the same Wi-Fi network and force users to access malicious sites, such as phishing pages," reports ZDNet: The bug was discovered by Chris Moberly, an Australian security researcher working for GitLab. The actual vulnerability resides in the Firefox SSDP component. SSDP stands for Simple Service Discovery Protocol and is the mechanism through which Firefox finds other devices on the same network in order to share or receive content (i.e., such as sharing video streams with a Roku device).

When devices are found, the Firefox SSDP component gets the location of an XML file where that device's configuration is stored. However, Moberly discovered that in older versions of Firefox, you could hide Android "intent" commands in this XML and have the Firefox browser execute the "intent," which could be a regular command like telling Firefox to access a link...

The bug was fixed in Firefox 79; however, many users may not be running the latest release. Firefox for desktop versions were not impacted.

Microsoft

Bored Developer Creates 'DOS Subsystem For Linux' (itnews.com.au) 42

Long-time Slashdot reader Bismillah quotes iTnews: A software engineer in Melbourne is whiling away the city's lockdown by creating a tool that DOS users so far have lacked: an integrated Linux environment similar to what Windows 10 users enjoy...

"I first started out just seeing if I could get Linux booting from the DOS command line, and that turned out to be straightforward enough so I thought it'd be fun to see if I could continue executing DOS once Linux was running," Charlie Somerville said. "I'm mostly surprised by how smoothly the whole thing works given how *dodgy* it all is haha," he added. DOS Subsystem for Linux runs a real copy of MS-DOS under the QEMU virtual machine, and starts up from that, Somerville said...

"Helpfully Linux seems to leave the first megabyte of memory (where DOS lives) intact during its own boot process, so it's just a matter of jumping back to the right place to continue DOS execution," he added. Somerville had it pointed out to him that this approach of running DOS under vm8086 is actually how early Windows worked.

"Kinda cool to rediscover the technique so many years later," Somerville said.

Facebook

While Facebook, Twitter, and YouTube Announce Hate Speech Action, Some Advertisers Remain Skeptical (reuters.com) 120

"Facebook, YouTube, and Twitter have agreed on first steps to curb harmful content online, big advertisers announced on Wednesday, following boycotts of social media platforms accused of tolerating hate speech," Reuters reports: Under the deal, announced by the World Federation of Advertisers, common definitions would be adopted for forms of harmful content such as hate speech and bullying, and platforms would adopt harmonized reporting standards... The platforms agreed to have some practices reviewed by external auditors and to give advertisers more control over what content is displayed alongside their ads.

"This is a significant milestone in the journey to rebuild trust online," said Luis Di Como, executive vice president of global media at Unilever, one of the world's biggest advertisers. "Whilst change doesn't happen overnight, today marks an important step in the right direction..."

The CEO of the Anti-Defamation League, one of America's largest groups opposing hate speech, told Reuters there were many details that still need to be resolved. "These commitments must be followed in a timely and comprehensive manner to ensure they are not the kind of empty promises that we have seen too often from Facebook."

And in a follow-up article, Reuters notes that despite the agreement, advertisers who'd boycotted Facebook and other social media sites "are not all rushing back". Unilever, one of the world's biggest advertisers, told Reuters the move this week was "a good step in the right direction," but would not say whether it would resume paid advertising on Facebook in the United States next year after stopping over the summer. Coca-Cola also remains paused on Facebook and Instagram and declined to say if this changed its view. Beam Suntory, maker of Jim Beam bourbon and Courvoisier Cognac, plans to stay away from paid advertising for the rest of 2020 and reassess in 2021 based on how Facebook adjusts its approach...

"Brands are very concerned about having any affiliation with the disinformation that runs through the big tech platforms," said Michael Priem, CEO of advertising technology firm Modern Impact...

Campaign organizers remain skeptical and pledged to keep up the heat. "We cannot assume progress from yet another commitment to change until we see the impact and breadth of policy enforcement by these companies," said Rashad Robinson, president of Color Of Change, a backer of the Stop Hate for Profit campaign, which organized the boycott.

"As long as these companies continue to abdicate their responsibility to their most vulnerable users, we will continue to call on Congress and regulatory agencies to intervene."

The chief brand officer at Procter & Gamble tells Reuters that with half of all media spending now devoted to digital ads, "It's time for digital platforms to apply content standards properly."

A Facebook spokersperson pointed out that 95% of hate speech removed by Facebook is now detected before being reported — whereas in 2017, that number was just 23%.
The Courts

Imprisoned 'Anonymous' Hacktivist Martin Gottesfeld Files His First Appeal (dailywire.com) 31

In early 2019, Martin Gottesfeld of Anonymous was sentenced under America's "Computer Fraud and Abuse Act" to 10 years in federal prison for his alleged role in the 2014 DDoS attacks on healthcare and treatment facilities around Boston. (Gottesfeld was sentenced by the same judge who oversaw the Aaron Swartz case.)

Gottesfeld has just filed his first appeal, and Slashdot reader Danngggg shares this new interview with Gottesfeld's attorney Brandon Sample. The upshot? Brandon Sample: If the court agrees with our arguments, for example, on the Speedy Trial Act, then that would result in dismissal of the indictment against him. And so, he would have no conviction at that point. There's a variety of different outcomes that could potentially flow from the arguments that have been raised in the appeal. If he wins, say for example, the argument that his lawyer should have been allowed off the case, well, then that would undo the conviction as well, and he would be entitled to another trial.

If the indictment is dismissed, then the government is going to have to make a decision about whether or not this is really a case that they want to prosecute all over again...

Daily Wire: Do you see this being successful, a strong case?

Brandon Sample: The appeal? I think we have a really good chance. I do.

Slashdot Top Deals