UPS Breached

Credit and debit card information belonging to customers made purchases at 51 UPS Store Inc. locations in 24 states this year may have been illegally accessed as the result of an intrusion into the company’s networks.

In a statement on Wednesday, UPS said it was recently notified by law enforcement officials about a “broad-based malware intrusion” of its systems.

A subsequent investigation by an IT security firm showed that attackers had installed previously unknown malware on systems in more than four-dozen stores to gain access to cardholder data. The affected stores represent about 1% of the 4,470 UPS Store locations around the country.

The intrusion may have exposed data on transactions conducted at the stores between Jan. 20 and Aug. 11, 2014. “For most locations, the period of exposure to this malware began after March 26, 2014,” UPS said in a statement.

In addition to payment card information, the hackers also appear to have gained access to customer names, as well as postal and email addresses.

Each of the affected locations is individually owned and runs private networks that are not connected to other stores, UPS added. The company provided alist of affected locations.

The breach is the third significant one to be disclosed in the past week. Last Thursday, grocery store chain Supervalu announced it had suffered a malicious intrusion that exposed account data belonging to customers who had shopped at about 180 of the company’s stores in about a dozen states. The breach also affected customers from several other major grocery store chains for which Supervalu provides IT services.

Source

Opera Mini Goes To Windows Phone

Norwegian software maker Opera inked a deal to take over the browser building unit of Microsoft’s Nokia cellular phone unit and reported second-quarter earnings above expectations on Thursday, sending it shares sharply higher.

“We have signed a strategic licensing deal with Microsoft. We are basically taking over the browser building department in Nokia,” Opera Chief Executive Lars Boilsesen said. “This means that Opera Mini will become the default browser for Microsoft’s feature phone product lines and the Asha phones product lines.”

The deal will be profitable from the start, he added.

“All the current user base will be encouraged to upgrade to Opera Mini and all the new phones will come with Opera Mini pre-installed as a default browser. This is a great deal for us. We have dreamed of this for more than 10 years.”

In a separate statement, Opera said the licensing agreement applies to mobile phones based on the Series 30+, Series 40 and Asha software platforms.

“As part of the agreement, people who use the current browser for these phones, Xpress, will be encouraged to upgrade to the latest Opera Mini browser. Factory-new devices will have Opera Mini pre-installed.”

Source

Is Windows ‘Threshold’ Enroute?

Microsoft will unveil a preview of “Threshold,” the current code name for Windows 8′s successor, as soon as next month, according to an online report on Monday.

ZDNet’s Mary Jo Foley, citing unnamed sources, said that Microsoft will deliver a “technical preview” of Threshold late in September or early in October. Previously, Foley had reported that Microsoft would offer a preview of some kind this fall.

Threshold may be officially named “Windows 9″ by Microsoft — the company has said nothing about either the code name or labeled the next iteration of its desktop and tablet OS — although there are arguments for dumping a numerical title because of the possible association with Windows 8, which has widely been pegged as a failure.

“Technical Preview” is a moniker that Microsoft has used in the past for its Office suite. For both Office 2013 and Office 2010, Microsoft used the term to describe an invitation-only sneak peek. Both application suites were later released as public betas prior to their official launch.

Windows, however, has used a different nomenclature. For 2012′s Windows 8, Microsoft called the early looks ”Developer Preview,””Consumer Preview” and “Release Preview,” all open to everyone. The first was analogous to an alpha, the second to a beta, and the third to a done-but-not-approved release candidate.

Windows 7, however, had used the more traditional “Beta” to describe the first public preview in early 2009. The previous fall, when Microsoft unveiled Windows 7, the firm had seeded an invite-only “pre-alpha” version, also dubbed a Developer Preview, of the OS to programmers and some influential bloggers.

Within hours, the Windows 7 Developer Preview leaked to file-sharing websites. Microsoft may have changed its practices for Windows 8, letting anyone download the first preview, because of the inevitably of leaks.

In an update to her blog of earlier today, Foley added that the “Technical Preview” nameplate notwithstanding, Microsoft would allow anyone to download Threshold/Windows 9 when it becomes available in the next few weeks.

If Microsoft does ship a preview soon and sets its sights on a second-quarter 2015 final release, it will have significantly accelerated the tempo from past practice. With Windows 7 and Windows 8, Microsoft offered its first previews 12 and 13 months, respectively, and the public beta 8 or 9 months, before launching the operating system.

Eight or nine months from September would be May or June 2015; that, however, assumes that the Technical Preview is of beta quality. The name itself hints at something less.

Microsoft appears eager to put Windows 8 behind it. It has stopped beating the drum about the OS and recently announced that it would not issue any additional major updates. Instead, the firm said last week, it will include improvements or new features in small packets using the same Windows Update mechanism that regularly serves security patches.

Source

Applied Materials Makes A Profit

Chip-equipment maker Applied Materials has surprised most of the cocaine nose jobs of Wall Street with a better-than-expected third-quarter profit. It appears that contract manufacturers are spending more on technology used to make smartphone and memory chips.

The company also forecast current-quarter adjusted profit largely above analysts’ average estimate. Chief Executive Gary Dickerson said that demand for DRAM chips is expected to grow in the current quarter.

Applied Materials, which also provides equipment to make flat panel displays and solar cells, forecast an adjusted profit of 25-29 cents per share for the fourth quarter. Wall Street was expecting a profit of 26 cents per share.

Applied Materials expects revenue growth of about 10 to 17 percent, implying revenue of $2.19 billion to $2.33 billion for the quarter. Analysts on average were expecting $2.28 billion. Applied Materials’ net income rose to $301 millionin the third quarter ended July 27, from $168 milliona year earlier. Revenue rose 14.7 percent to $2.27 billion.

Revenue in the company’s silicon systems business, which brings in about two-thirds of total sales, rose 16 percent to $1.48 billion.

Source

Will Sprint Cut It’s Staff?

Sprint’s new CEO Marcelo Claure addressed employees for the first time and promised price reductions are coming very soon, according to a report.

Sprint didn’t deny the report of Marcelo’s comments. A spokesman also confirmed Friday that Sprint is “focusing on providing the best value in the market.”

According to the account of Claure’s comments, he told workers, “We’re going to change our plans to make sure every customer in America thinks twice about signing up to a competitor.” The report, which first appeared in LightReading.com, also said that “very disruptive” rate plans are coming this week.

Sprint didn’t dispute Light Reading’s report, but a spokesman said Sprint is not commenting on “any potential pricing plans before they are announced.”

The spokesman, Doug Duvall, said Marcelo held his first all-employee town hall meeting before a standing-room-only crowd. He added: “He shared his passion for his family, work and soccer team and his commitment to leading Sprint. He discussed Sprint’s challenges and pledged to get Sprint ‘back in the game’ by focusing on providing the best value in the market, completing our network build and optimizing Sprint’s cost structure.”

By confirming Sprint wants to offer the “best value in the market,” it’s pretty clear that Sprint, the third-largest U.S. carrier, will soon wage a price war with the T-Mobile, the fourth-largest U.S. carrier that has quickly been gaining on Sprint.

Analysts recently said Sprint’s recent “Framily plan” isn’t competitive in the market, which former CEO Dan Hesse acknowledged in late July before his departure on Monday.

The Sprint Framily plans costs $160 a month for 4GB of data, but comes with overage charges and won’t allow tethering. Meanwhile, T-Mobile has a family plan offered through September that costs $100 a month for four lines and 10GB of data, although each line is limited to 2.5GB.

Hesse had earlier described subscriber plans Sprint was testing that have tiers of data and unlimited data.

According to Light Reading, Claure also told employees that price cuts are needed because Sprint’s network isn’t at the level of performance and reach that it should be. “When you have a great network, you don’t have to compete on price,” he reportedly said. “When your network is behind, unfortunately you have to compete on value and price.”

Source

The FCC Extends Deadline

U.S. Federal Communications Commission has said it would accept public comments on its proposed new “net neutrality” rules through Sept. 15, giving the American public extra time to voice their opinions and concerns on how they think Internet traffic should be regulated.

The FCC has received more than 1 million comments already on new rules for how Internet services providers should be allowed to manage web traffic on their networks.

The FCC had set a deadline of July 15 for the initial comments and then September 10 for replies to those initial comments. However, the surge in submissions overwhelmed the FCC’s website and the agency had delayed the first deadline by three business days.

“To ensure that members of the public have as much time as was initially anticipated to reply to initial comments in these proceedings, the Bureau today is extending the reply comment deadline by three business days,” the FCC said on Friday, delaying the final deadline for comments to September 15.

Source

Is Epic Turla Exploiting Windows XP?

Kaspersky Lab has discovered an espionage network that successfully attacked government institutions, intelligence agencies and European companies.

The firm has dubbed the spy operation Epic Turla, and said that it is in no doubt about its capabilities.

“Over the last 10 months, Kaspersky Lab researchers have analyzed a massive cyber-espionage operation which we call ‘Epic Turla’,” it said.

“The attackers behind Epic Turla have infected several hundred computers in more than 45 countries, including government institutions, embassies, military, education, research and pharmaceutical companies.”

Kaspersky said that Epic Turla used two zero-day exploits that affected Adobe and Microsoft software, along with some backdoor and social engineering tricks.

In particular, Kaspersky said a vulnerability in Windows XP and Windows 2003 – CVE-2013-5065 – termed a “privilege escalation vulnerability” is being used. “The CVE-2013-5065 exploit allows the backdoor to achieve administrator privileges on the system and run unrestricted. This exploit only works on unpatched Microsoft Windows XP systems.”

The use of this Windows XP flaw underlines the risk that the unsupported Windows XP OS poses. Kaspersky went on to explain that, once inside, attackers install their own rootkits and other malware tools and begin their surveillance.

“Once the attackers obtain the necessary credentials without the victim noticing, they deploy the rootkit and other extreme persistence mechanisms,” it said. “The attacks are still ongoing as of July 2014, actively targeting users in Europe and the Middle East.”

The attacks are just the latest in a long line of incidents that businesses need to be aware of as cyber attacks continue at an alarming rate.

In June the security firm Crowdstrike alerted the industry to Putter Panda, a cute-sounding but nasty piece of malware. That firm pointed an accusatory finger at China and charged it with espionage on the US and Europe.

Crowdstrike CEO George Kurtz said at the time, “China’s decade-long economic espionage campaign is massive and unrelenting. Through widespread espionage campaigns, Chinese threat actors are targeting companies and governments in every part of the globe.” Chinese authorities disputed this.

The report comes in the same week Hold Security reported uncovering a huge trove of 1.2 billion web passwords and login details that have been gathered by Russian cyber criminals.

Source

Is Snapdragon A Security Flaw?

Security researcher Dan Rosenberg has told a Black Hat conference how it is possible to permanently unlock the bootloader on Android phones – provided they use a Qualcomm Snapdragon chip.

Rosenberg said that the flaw is in ARM’s TrustZone technology, which runs a trusted operating system and another for normal apps. This is supposed to improve device security, but in Qualcomm’s implementation, they cocked it up. It means that if a hacker gets access to the trusted operation part of the chip, it can run whatever application he or she likes.

This affects all known Android devices with a Qualcomm Snapdragon SoC, including the Nexus 5, the HTC One, and Samsung’s Galaxy Note 3, as well as the Moto X. The Samsung Galaxy S5 and the HTC One M8 have already been patched.

Source

OpenSSL Gets Updated

OPENSSL, the web security layer at the center of the Heartbleed vulnerability, has been issued with a further nine critical patches.

While none are as serious as Heartbleed, patching is recommended for all users according to an advisory released today. The vulnerabilities stem from various security research teams around the web including Google, Logmein and Codenomicom, based on their reports during June and July of this year.

Among the more interesting fixes involves a flaw in the ClientHello message process. If a ClientHello message is badly fragmented, it is vulnerable to a man-in-the-middle attack which could be used to force the server to downgrade itself to the TLS 1.0 protocol, a fifteen year old and therefore pre-Heartbleed patch variant.

Other reports include memory leaks caused by denial of service attacks (DoS) and conversely, crashes caused by an attempt to free up the same portions of memory twice.

OpenSSL now has two full time coders as a result of investment by a consortium of Internet industry companies to form the Core Infrastructure Initiative, a not-for-profit group administered by the Linux Foundation. The Initiative was set up in the wake of Heartbleed, as the industry vowed to ensure such a large hole would never be left unplugged again.

While OpenSSL is used by a large number of encrypted sites, there are a number of forks of the project including LibreSSL and the recently launched Google BoringSSL.

Google recently announced that it would be lowering the page rankings of unencrypted pages in its search results as an added security measure.

Source

Judge Rejects Silicon Valley Settlement

A California judge has rejected the proposed settlement in a lawsuit over no-hire agreements used by top Silicon Valley tech firms, saying the amount being offered to compensate workers is too low.

The remaining defendants in the case — Apple, Google, Intel and Adobe Systems — had reached a deal with the worker’s lawyers to settle the case for US$324.5 million, but Judge Lucy Koh of the federal district court in San Jose, California, said that amount is too low.

After subtracting the fees for the workers’ lawyers — they’re allowed to keep up to a quarter of the award, or $81 million, as well as other money — each worker would be left with an average of only $3,750.

“The Court finds the total settlement amount falls below the range of reasonableness,” Koh wrote in her order, issued Friday.

She said she was troubled that the workers would get less money than under a previous settlement with companies that settled earlier in the case, even though the case has been progressing in the workers’ favor since then.

Last year, Intuit, Lucasfilm and Pixar settled with the workers before the case came to trial.

All of the companies were accused of striking secret deals to not poach each others’ workers, a violation of the Sherman Antitrust Act that reduced the workers’ potential to earn higher wages.

An expert hired for the case has estimated that the workers’ should receive damages of $3 billion, for wages they could have earned if the no-hire agreements hadn’t been in place.

Source

« Previous Page — Next Page »