Mr. Robot is back, and the C Y B E R is back, too. The show takes a special interest in showing off the details that usually get glossed over, often drawing on real hacks and real cybersecurity problems. So after every episode, I’ll be breaking down who got hacked, how, and with what. It turns out, there’s a lot more to each one than you can see on-screen.
This episode was a bit of a breather after last week’s doomfest. Elliot goes on a semi-suicidal trip to the ocean, meets a little kid, watches Back to the Future, and recovers his will to live. Along the way, we get a peek at the steady creep of martial law and general chaos on the Robot universe, with a general curfew and Children of Men-style checkpoints in the background. It’s getting bad out there!
If you own a Mac computer and run the latest version of Apple's operating system, macOS High Sierra, then you need to be extra careful with your computer.
A serious, yet stupid vulnerability has been discovered in macOS High Sierra that allows untrusted users to quickly gain unfettered administrative (or root) control on your Mac without any password or security check, potentially leaving your data at risk.
Discovered by developer Lemi Orhan Ergin on Tuesday, the vulnerability only requires anyone with physical access to the target macOS machine to enter "root" into the username field, leave the password blank, and hit the Enter a few times—and Voila!
Phones. Pffft! They’re so passive. They just sit there, warming your sweaty palm in a crowded subway or elevator as mouth breathers shoulder-surf your PINs or swipe patterns – or your texts, or what should be your private, confidential web browsing – out from under your nose.
But not for much longer, if two Google researchers have any say about it! They’re working on a machine-learning, facial recognition system that will pick up on when some nosey snoop – one who’s definitely not you, given that it’s a facial recognition system and knows what its master or mistress looks like – is staring at your screen.
Researchers Hee Jung Ryu and Florian Schroff show in a demo use case video that when the system detects that somebody’s gaze is pointed at a phone, a Hangouts messaging conversation will come to a screeching halt.
Karim Baratov, a 22-year-old Kazakhstan-born Canadian citizen, has pleaded guilty to hacking charges over his involvement in massive 2014 Yahoo data breach that affected all three billion yahoo accounts.
In March, the US Justice Department announced charges against two Russian intelligence officers (Dmitry Dokuchaev and Igor Sushchin) from Russia's Federal Security Service (FSB) and two hackers (Alexsey Belan and Karim Baratov) for breaking into yahoo servers in 2014.
While Karim Baratov (Kay, a.k.a Karim Taloverov, a.k.a Karim Akehmet Tokbergenov) was arrested in Toronto at his Ancaster home by the Toronto Police Department in March this year, Alexsey Belan and both FSB officers currently reside in Russia, unlikely to be extradited.
Hackers have stolen another $30.9m in cryptocurrency.
In a “critical announcement” on Monday, cryptocurrency startup Tether said the funds had been removed from the Tether Treasury wallet on 19 November and sent to an unauthorized bitcoin address.
But things aren’t as bad as they seem, Tether said – technically the money is not yet out of reach.
In a Bitcoin theft we might expect the thief to try and launder the stolen cash via a so-called tumbler service, something that makes following the money through the currency’s anonymous but transparent transaction logging very difficult.
Only after a few days of Uber admitting last year's data breach of 57 million customers, the popular image sharing site disclosed that it had suffered a major data breach in 2014 that compromised email addresses and passwords of 1.7 million user accounts.
In a blog post published on Friday, Imgur claimed that the company had been notified of a three-year-old data breach on November 23 when a security researcher emailed the company after being sent the stolen data.
Imgur Chief Operating Officer (COO) then alerted the company's founder and the Vice President of Engineering to the issue before began working to validate that the data belonged to Imgur users.
After completing the data validation, the company confirmed Friday morning that the 2014 data breach impacted approximately 1.7 million Imgur user accounts (a small fraction of its 150 million user base) and that the compromised information included only email addresses and passwords.
New electric supercar will break records according to Elon Musk, with blistering acceleration and 630-mile range.
Tesla announced a new version of its very first car, the Roadster, turning it into an electric supercar described as a “hardcore smackdown to gasoline cars” by company founder Elon Musk.
The new sports car was unveiled alongside Tesla’s new electric truck, and promises to wow drivers with some extraordinary statistics that make it look like a Top Trumps card turned into an electrified reality.
Here’s everything we know about the new Tesla Roadster.
A series of recently disclosed critical Bluetooth flaws that affect billions of Android, iOS, Windows and Linux devices have now been discovered in millions of AI-based voice-activated personal assistants, including Google Home and Amazon Echo.
As estimated during the discovery of this devastating threat, several IoT and smart devices whose operating systems are often updated less frequently than smartphones and desktops are also vulnerable to BlueBorne.
BlueBorne is the name given to the sophisticated attack exploiting a total of eight Bluetooth implementation vulnerabilities that allow attackers within the range of the targeted devices to run malicious code, steal sensitive information, take complete control, and launch man-in-the-middle attacks.
After more than a few leaks and not-so-subtle teasers, the OnePlus 5T is official -- and it's at once everything you expected and a bit more. The centerpiece, as you've no doubt guessed, is the 6-inch, 18:9 ratio 2,160 x 1,080 AMOLED display. The fingerprint reader is now on the back as a result of the taller screen, but it means a larger canvas for your apps and videos in a device that's roughly the same size as its predecessor. It can auto-adapt to bright sunlight and other harsh conditions, and you can tune the display's colors for accuracy (such as DCI-P3 or sRGB) or vividness. And thankfully, the trendy tall display isn't the only improvement.
Robot maker Boston Dynamics, now owned by Japanese telecom and tech giant SoftBank, just published a short YouTube clip featuring a new, more advanced version of its SpotMini robot. SpotMini, first unveiled in June 2016, started out as a giraffe-looking chore bot that was pretty terrible at performing tasks around the house, and, in one short clip, hilariously ate it on a cluster of banana peels like a character straight out of a slapstick cartoon.
Just a week after Apple released its brand new iPhone X on November 3, a team of hackers has claimed to successfully hack Apple's Face ID facial recognition technology with a mask that costs less than $150.
Yes, Apple's "ultra-secure" Face ID security for the iPhone X is not as secure as the company claimed during its launch event in September this year.
"Apple engineering teams have even gone and worked with professional mask makers and makeup artists in Hollywood to protect against these attempts to beat Face ID," Apple's senior VP of worldwide marketing Phil Schiller said about Face ID system during the event.
"These are actual masks used by the engineering team to train the neural network to protect against them in Face ID."
However, the bad news is that researchers from Vietnamese cybersecurity firm Bkav were able to unlock the iPhone X using a mask.
The Robot crew showed off their camera chops this week, folding the entire episode into a single shot spread across multiple characters and locations. Now it makes sense why it was all commercial free. As we learned on the after show, it was actually a couple shots shot out of order and stitched together, but that’s still pretty cool.
It also means there was really just one big hack — Angela’s full-frontal assault on Evil Corp’s hardware security module — clearing the way for the Stage Two attack. So in keeping with the cinematography, I’m going to spend the whole Hack Report just talking about that.
Today I will explain how to do traffic limit with OpenBSD and PF. This is not hard at all if you want something easy, the man page pf.conf(5) in QUEUEING section is pretty good but it may disturbing when you don’t understand how it works. This is not something I master, I’m not sure of the behaviour in some cases but the following example works as I tested it ! :)
Use case
Internet is down at home, I want to use my phone as 4G router trough my OpenBSD laptop which will act as router. I don’t want the quota (some Gb) to be eaten in a few seconds, this connection allow to download up to 10 Mb/s so it can go quickly !
We will limit the total bandwidth to 1M (~ 110 kb/s) for people behind the NAT. It will be slow, but we will be sure that nothing behind the NAT like a program updating, cloud stuff synchronizing or videos in auto play won’t consume our quota.
Mac and Linux versions of the Tor anonymity browser just received a temporary fix for a critical vulnerability that leaks users' IP addresses when they visit certain types of addresses.
TorMoil, as the flaw has been dubbed by its discoverer, is triggered when users click on links that begin with file:// rather than the more common https:// and http:// address prefixes. When the Tor browser for macOS and Linux is in the process of opening such an address, "the operating system may directly connect to the remote host, bypassing Tor Browser," according to a brief blog post published Tuesday by We Are Segment, the security firm that privately reported the bug to Tor developers.
On Friday, members of the Tor Project issued a temporary work-around that plugs that IP leak. Until the final fix is in place, updated versions of the browser may not behave properly when navigating to file:// addresses. They said both the Windows versions of Tor, Tails, and the sandboxed Tor browser that's in alpha testing aren't vulnerable.
A well-placed noise box solves a lot of problems Mr. Robot is back, and the C Y B E R is back, too. The show takes a special interest in showing off the details that usually get glossed over, often drawing on real hacks and real cybersecurity problems. So after every episode, I’ll be breaking down who got hacked, how, and with what. It turns out, there’s a lot more to each one than you can see on-screen.
This week was huge for Darlene, as she managed to talk her way out of a tight bind with Elliot and track Mr. Robot back to Tyrell’s secret hacking cave. Stage Two seems troubled, but still basically viable? Both Angela and Darlene came extremely close to getting exposed — Darlene for her FBI connect, and Angela for her Dark Army gig — but both were able to get through unscathed, at least for now.
Do you know? Thousands of websites use HTML5 Canvas—a method supported by all major browsers that allow websites to dynamically draw graphics on web pages—to track and potentially identify users across the websites by secretly fingerprinting their web browsers.
Over three years ago, the concern surrounding browser fingerprinting was highlighted by computer security experts from Princeton University and KU Leuven University in Belgium.
In 2014, the researchers demonstrated how browser's native Canvas element can be used to draw unique images to assign each user's device a number (a fingerprint) that uniquely identifies them.
