US Soldiers Expose Nuclear Weapons Secrets Via Flashcard Apps

For US soldiers tasked with the custody of nuclear weapons in Europe, the stakes are high. Security protocols are lengthy, detailed and need to be known by heart. To simplify this process, some service members have been using publicly visible flashcard learning apps — inadvertently revealing a multitude of sensitive security protocols about US nuclear weapons and the bases at which they are stored.

While the presence of US nuclear weapons in Europe has long been detailed by various leaked documents, photos and statements by retired officials, their specific locations are officially still a secret with governments neither confirming nor denying their presence.

As many campaigners and parliamentarians in some European nations see it, this ambiguity has often hampered open and democratic debate about the rights and wrongs of hosting nuclear weapons.

However, the flashcards studied by soldiers tasked with guarding these devices reveal not just the bases, but even identify the exact shelters with “hot” vaults that likely contain nuclear weapons.

They also detail intricate security details and protocols such as the positions of cameras, the frequency of patrols around the vaults, secret duress words that signal when a guard is being threatened and the unique identifiers that a restricted area badge needs to have.

https://www.bellingcat.com/news/2021/05/28/us-soldiers-expose-nuclear-weapons-secrets-via-flashcard-apps/

#bellingcat #usa #soldiers #expose #nuclear #waepons #secrets #flashcard #apps
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

The Robot Smiled Back

Columbia Engineering researchers use AI to teach robots to make appropriate reactive human facial expressions, an ability that could build trust between humans and their robotic co-workers and care-givers.

https://www.youtube.com/watch?v=1vBLI-q04kM

https://telegra.ph/The-Robot-Smiled-Back-05-28

via www.newswise.com

#research #robots #ai #facial #expressions #video
📽@cRyPtHoN_INFOSEC_FR
📽@cRyPtHoN_INFOSEC_EN
📽@cRyPtHoN_INFOSEC_DE
📽@BlackBox_Archiv

Your iPhone (and iCloud backups) are full of gigabytes-worth of old iMessages that are virtually impossible to read

Many iPhone owners have iMessages from years ago that they can’t access. For example, my wife and I simply want to read the first few messages that we exchanged in 2017, but we can’t.

Yet we pay for the right to read these messages in two ways: precious space our 64GB iPhones (and Macs) and iCloud storage, which Apple charges us for each month. Many other people have had this problem for several years, a quick Google search reveals ...

The cumbersome way Apple lets you (theoretically) access old messages is to “scroll to the top” of your conversation, but it’s extremely time consuming and doesn’t work in practice. Yesterday I tried to scroll to the “top” of my iMessages that were from and to my wife. After just a few minutes, my computer with 16GB of RAM started “beach balling” and the app froze before I could even get to messages from 6 months ago. Meanwhile, my wife tried to access our earliest messages on her iPhone 8 Plus and it was even sadder: after over 45 minutes of scrolling, she got within a year of the conversation’s beginning and then the iMessages app crashed on her.

https://keydiscussions.com/2021/05/28/apple-charges-for-storing-gigabytes-worth-of-old-imessages-you-cant-reliably-access/

#apple #imessages #storage #iCloud
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Embracing and Governing Technological Disruption

There has always existed an interplay between human-kind and technology’s promise to improve our lives. Seldom, and certainly not in modern times, has the adoption of technology accelerated as quickly as it has with the Covid-19 pandemic.

https://docs.ie.edu/cgc/IE-CGC-European-Tech-Insights-2021-%28Part-II%29.pdf

💡 👉🏼 related article:
More than half of Europeans want to replace lawmakers with AI, study says
https://www.cnbc.com/2021/05/27/europeans-want-to-replace-lawmakers-with-ai.html

#eu #tech #insights #pdf
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

The Pirate Bay Remains Resilient, 15 Years After The Raid

Fifteen years ago today The Pirate Bay was raided by dozens of Swedish police officers. The entertainment industries hoped that this would permanently shut down the site, but that was not the case. Instead, the police action inadvertently helped to create one of the most resilient and iconic websites on the Internet.

There are a handful of traditions we have at #TorrentFreak, and remembering the first raid on The Pirate Bay is one of them.

Not only was it the first major story we covered, it also had a significant impact on how the piracy ecosystem evolved over the years. It also changed the lives of the site’s co-founders, who were eventually convicted.

While a lot has changed over the years, The Pirate Bay is still around and there are no signs that this will change anytime soon. What many people may not realize, however, is that without a few essential keystrokes in the site’s early years, the site would be a distant memory today.

This is what happened....

https://torrentfreak.com/the-pirate-bay-remains-resilient-15-years-after-the-raid-210531/

#piratebay #raid
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Shieldy got acquired by 1inch Network

I am announcing the acquisition of Shieldy Telegram bot by 1inch Network and telling you my personal story of how I've built, grown and sold Shieldy in detail.

I'm thrilled to announce that @shieldy_bot is now in better hands that are more suitable to grow it past the 20 000 000 users point. I believe that the new owner of Shieldy has better chances of supporting this open-source solution in the long run and bringing more value to the users. After all, I'm just a single guy standing in front of my computer writing code. 1inch has way more resources than I.

In the previous article, I've described how I calculated an estimated value of Shieldy and how I got three acquisition offers ranging from $100 000 to $150 000, which I rejected. In this article, I'm going to tell you the story of Shieldy. Starting from the beginning and up to the point when I sold it to 1inch for $329 000. How and why I built it, how it became popular, how I could find a better future maintainer and why I picked 1inch to succeed me in owning Shieldy (yes, I was fortunate enough to choose my successor). Keep reading!

https://blog.borodutch.com/shieldy-got-acquired-by-1inch-exchange/

https://1inch.io/

#tg #telegram #bot #shieldy #borodutch
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Mass scale manipulation of Twitter Trends discovered

New EPFL research has found that almost half of local Twitter trending topics in Turkey are fake, a scale of manipulation previously unheard of. It also proves for the first time that many trends are created solely by bots due to a vulnerability in Twitter’s Trends algorithm.

Social media has become ubiquitous in our modern, daily lives. It has changed the way that people interact, connecting us in previously unimaginable ways. Yet, where once our social media networks probably consisted of a small circle of friends most of us are now part of much larger communities that can influence what we read, do, and even think.

One influencing mechanism, for example, is ‘Twitter Trends’. The platform uses an algorithm to determine hashtag-driven topics that become popular at a given point in time, alerting twitter users to the top words, phrases, subjects and popular hashtags globally and locally.

Now, new EPFL research focused on Turkey, from the Distributed Information Systems Laboratory, part of the School of Computer and Communication Sciences has found a vulnerability in the algorithm that decides Twitter Trending Topics: it does not take deletions into account. This allows attackers to push the trends they want to the top of Twitter Trends despite deleting their tweets which contain the candidate trend shortly afterwards.

https://actu.epfl.ch/news/mass-scale-manipulation-of-twitter-trends-discov-2/

💡 Ephemeral Astroturfing Attacks: The Case of Fake Twitter Trends (PDF)
https://arxiv.org/pdf/1910.07783.pdf

#twitter #manipulation #turkey #research #pdf
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

FUJIFILM shuts down network after suspected ransomware attack

FujiFilm is investigating a ransomware attack and has shut down portions of its network to prevent the attack's spread.

FujiFilm, also known as just Fuji, is a Japanese multinational conglomerate headquartered in Tokyo, Japan, which initially started in optical film and cameras. It has grown to include pharmaceuticals, storage devices, photocopiers and printers (XEROX), and digital cameras.

FUJIFILM earned $20.1 billion in 2020 and has 37,151 employees worldwide.

Today, FUJIFILM announced that their Tokyo headquarters suffered a cyberattack Tuesday night that they indicate is a ransomware attack.

"FUJIFILM Corporation is currently carrying out an investigation into possible unauthorized access to its server from outside of the company. As part of this investigation, the network is partially shut down and disconnected from external correspondence," FUJIFILM said in a statement.

"We want to state what we understand as of now and the measures that the company has taken. In the late evening of June 1, 2021, we became aware of the possibility of a ransomware attack. As a result, we have taken measures to suspend all affected systems in coordination with our various global entities."

"We are currently working to determine the extent and the scale of the issue. We sincerely apologize to our customers and business partners for the inconvenience this has caused."

Due to the partial network outage, FUJIFILM USA has added an alert to the top of their website stating that they are experiencing network problems that are impacting their email and phone systems.

https://www.bleepingcomputer.com/news/security/fujifilm-shuts-down-network-after-suspected-ransomware-attack/

#fujifilm #ransomware #attack
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

NortonLifeLock Unveils Norton Crypto

New Feature Enables a Safe and Easy Way to Mine Cryptocurrency

TEMPE, Ariz.--(BUSINESS WIRE)-- NortonLifeLock (NASDAQ: NLOK), a global leader in consumer Cyber Safety, today announced the launch of Norton™ Crypto, a new feature designed to enable consumers to safely and easily mine cryptocurrency through its trusted Norton™ 360 platform. Starting tomorrow, select Norton 360 customers in Norton’s early adopter program will be invited to mine for Ethereum.

“As the crypto economy continues to become a more important part of our customers’ lives, we want to empower them to mine cryptocurrency with Norton, a brand they trust,” said Vincent Pilette, CEO of NortonLifeLock. “Norton Crypto is yet another innovative example of how we are expanding our Cyber Safety platform to protect our customers’ ever-evolving digital lives.”

For years, many coinminers have had to take risks in their quest for cryptocurrency, disabling their security in order to run coinmining and allowing unvetted code on their machines that could be skimming from their earnings or even planting ransomware. Earnings are commonly stored directly on miners’ hard drives, where their digital wallet could be lost should it fail.

Norton Crypto delivers a secure, reliable way for consumers to mine for Ethereum without opening themselves and their devices up to these pitfalls. Once cryptocurrency has been earned, customers can track and transfer earnings into their Norton Crypto Wallet, which is stored in the cloud so it cannot be lost due to hard drive failure.

“We are proud to be the first consumer Cyber Safety company to offer coinminers the ability to safely and easily turn the idle time on their PCs into an opportunity to earn digital currency,” said Gagan Singh, chief product officer at NortonLifeLock. “With Norton Crypto, our customers can mine for cryptocurrency with just a few clicks, avoiding many barriers to entry in the cryptocurrency ecosystem.”

https://investor.nortonlifelock.com/About/Investors/press-releases/press-release-details/2021/NortonLifeLock-Unveils-Norton-Crypto/default.aspx

#norton #crypto #mining
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

German IT company that serves banks experiences DDoS hack attack

A German company that operates technology for the nation's cooperative banks said on Friday that it was experiencing continued distributed denial-of-service (DDoS) attacks throughout the night.

In such attacks, hackers attempt to flood a network with unusually high volumes of data traffic in order to paralyse it.

The company, Fiducia & GAD IT AG, said the attacks began on Thursday morning, shutting down or hindering the websites of some cooperative banks in parts of the country.

The issue stabilized by the afternoon, but picked up again in the evening with "further major attacks into the night".

"Fiducia & GAD's crisis team continues to monitor the systems closely in order to be able to react quickly to any new attacks," the company said in a statement.

The company noted that such attacks weren't uncommon in the industry.

A spokeswoman for Fiducia & GAD IT AG couldn't immediately say how many banks were affected.

The banking blog Finanz-Szene earlier reported about the attack.

https://www.reuters.com/technology/german-it-company-that-serves-banks-experiences-ddos-hack-attack-2021-06-04/

#germany #it #company #ddos #attack
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

Brit retailer Furniture Village confirms 'cyber-attack' as systems outage rolls into Day 7

Sofa, not-so-good: Angry customers still can't access systems, phones, and deliveries delayed

Furniture Village – the UK's largest independent furniture retailer with 54 stores nationwide – has been hit by a "cyber-attack", the company confirmed to The Register.

Details are still sketchy, but it emerged late last week that some of the retailer’s internal systems had been taken offline.

Although its website remains up and running, this is not the case for the back end. The problems emerged last weekend on 29 May when Furniture Village admitted it was experiencing "technical issues" and it was unable to answer calls. This is still the case at the time of publication, 6 days later.

By Wednesday, Furniture Village revealed it was “still experiencing technical issues with [its] internal systems” and that the team was working to resolve them as quickly as possible. These included delivery systems, phone systems, and according to customers, payment mechanisms.

https://www.theregister.com/2021/06/04/furniture_village_confirms_cyberattack/

#cyberattack #uk #FurnitureVillage
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

The 4th largest mobile browser exfiltrates users’ data even in Incognito mode

Executive summary

UCWeb, a Chineses mobile internet company owned by Alibaba Group is exfiltrating user browsing and search history from its products distributed on mobile devices around the world even when the browser is used in incognito mode. This behavior is consistent on both Android and iOS devices.

UCWeb advertises the product incognito mode to be a private & secure way of browsing the internet. However, they are exfiltrating the users activity to UCWeb’s servers.

https://hookgab.medium.com/ucbrowser-privacy-study-ecff96fbcee4

#UCWeb #ucbrowser #privacy #study
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

TikTok just gave itself permission to collect biometric data on US users, including ‘faceprints and voiceprints’

A change to TikTok’s U.S. privacy policy on Wednesday introduced a new section that says the social video app “may collect biometric identifiers and biometric information” from its users’ content. This includes things like “faceprints and voiceprints,” the policy explained. Reached for comment, TikTok could not confirm what product developments necessitated the addition of biometric data to its list of disclosures about the information it automatically collects from users, but said it would ask for consent in the case such data collection practices began.

The biometric data collection details were introduced in the newly added section, “Image and Audio Information,” found under the heading of “Information we collect automatically” in the policy.

This is the part of TikTok’s Privacy Policy that lists the types of data the app gathers from users, which was already fairly extensive.

The first part of the new section explains that TikTok may collect information about the images and audio that are in users’ content, “such as identifying the objects and scenery that appear, the existence and location within an image of face and body features and attributes, the nature of the audio, and the text of the words spoken in your User Content.”

While that may sound creepy, other social networks do object recognition on images you upload to power accessibility features (like describing what’s in an Instagram photo, for example), as well as for ad targeting purposes. Identifying where a person and the scenery is can help with AR effects, while converting spoken words to text helps with features like TikTok’s automatic captions.

https://techcrunch.com/2021/06/03/tiktok-just-gave-itself-permission-to-collect-biometric-data-on-u-s-users-including-faceprints-and-voiceprints

#tiktok #DeleteTikTok #privacy #usa #biometric #data #faceprints #voiceprints
📡@cRyPtHoN_INFOSEC_FR
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_DE
📡@BlackBox_Archiv

A Death in Cryptoland

When the young CEO of Canada’s largest cryptocurrency exchange is reported to have died while honeymooning in India, it sets off a cataclysmic chain of events that would leave about 76,000 people out of a quarter of a billion dollars and a trail of conspiracy theories around whether Gerald Cotten is dead or alive. A Death in Cryptoland is an original podcast series about a crypto-tycoon, his secret past, his sudden demise, and an online sleuth’s obsession to unravel the truth behind QuadrigaCX.

#truecrime #HuntingWarhead #podcast
🎙@cRyPtHoN_INFOSEC_DE
🎙@cRyPtHoN_INFOSEC_EN
🎙@cRyPtHoN_INFOSEC_FR
🎙@BlackBox_Archiv

Nigeria to suspend Twitter 'indefinitely'

Nigeria's government is suspending Twitter operations in the country "indefinitely", the country's information minister has announced.

The ban is due to "the persistent use of the platform for activities... capable of undermining Nigeria's corporate existence", a statement said.

Twitter said the announcement on Friday was "deeply concerning".

It comes just days after a tweet by President Muhammadu Buhari was removed for breaching the site's rules.

The statement from the Nigerian government did not mention the row over the removed tweet.

But Information Minister Lai Mohammed previously criticised the US social media giant's decision to take it down, calling it "double standards".

https://www.bbc.com/news/world-africa-57363779

#twitter #nigeria
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

Valid Signal privacy issues shrugged off while patches quietly rolled out - vulnerability still active on macOS

Intro
Signal provides a free, cross-platform private messenger app. Folks in all kinds of unsafe situations rely on Signal, as a highly visible and popular app which the security and privacy professional communities endorse. Journalists rely on Signal to ensure confidential communication with their sources.

What privacy guarantees does one really have though if you can't prove the identity of who you're communicating with?

The problem
Mid-May, I got a new phone. At the time I understood that with *any change* to the device or installation of either party in a chat with message history, the Signal chat "safety number" changes. This used to be but (following an involved email back-and-forth with the Signal team over the course of a month) is no longer reflected in the Signal support documentation.

When a safety number changes, Signal shows a message to both parties in the conversation. The most recent alert I recall seeing prior to this adventure (which I believe was initially received April 14, about a month before I changed phones) looks like this:

https://403forbiddenblog.blogspot.com/2021/06/signal-safety-numbers.html

#signal #messenger #privacy #issue
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

FBI sought info on who read USA Today news article for case

The FBI sought information about readers of an online article as part of an investigation, it has emerged.

The agency demanded the newspaper USA Today hand over records on who had read an article about the killing of two FBI agents.

The newspaper's owner is resisting the request and asked a judge to quash the demand.

It says the FBI's demand is a "clear violation" of protections to press freedom.

The FBI issued a subpoena - an order to submit evidence - to USA Today's owner Gannett, asking it for information about anyone who clicked on an article published in February about the fatal shooting of two of the bureau's agents in Florida.

The subpoena sought the IP addresses and phone numbers for readers of the piece during a 35-minute window. IP addresses can be used to find a computer's location and owner.

https://www.bbc.co.uk/news/world-us-canada-57367093

#usa #fbi #subpoena #investigation #usatoday #pressfreedom
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

Mail-in-a-Box (v0.53a / May 8, 2021)

Take back control of your email with this easy-to-deploy mail server in a box.

What is it?

Mail-in-a-Box lets you become your own mail service provider in a few easy steps. It’s sort of like making your own gmail, but one you control from top to bottom.

Technically, Mail-in-a-Box turns a fresh cloud computer into a working mail server. But you don’t need to be a technology expert to set it up.

💡 Here’s how you can get a Mail-in-a-Box running:
https://www.youtube.com/watch?v=9WOmkoEYMIg

Current Version: v0.53a / May 8, 2021

– install

– release notes

– upgrade instructions

💡 Need Help?
- Check the maintenance guide.
- Ask on the forum. Other users may be able to help.
- Found a bug? Open an issue on github.
- Or try our Slack chatroom.

https://mailinabox.email/

#mailinabox #email #server #guide #tool #download
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

Bypassing an Outlook Dark Pattern

Tldr: Outlook on Android tries to force you into linking Outlook to your Google Account, giving itself access to more data than you might want. I found out that can be bypassed by quickly toggling the internet connection off at the right time.

https://palone.blog/bypassing-an-outlook-dark-pattern/

#palone #outlook #dark #pattern #bypass
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

EFF 30 Fireside Chat Surveillance, With Edward Snowden

Democracy, social movements, our relationships, and your own well being all require private space to thrive. But state actors and law enforcement reach for persistent mass surveillance tech with disturbing frequency. Privacy activists and ordinary people around the world stand before a growing arsenal of invasive tools in the hands of criminals and state actors alike. How has mass surveillance changed us and what are our odds in fighting back?

In this livestream conversation, NSA whistleblower Edward Snowden joins EFF Executive Director Cindy Cohn, EFF Director of Engineering for Certbot Alexis Hancock, and EFF Policy Analyst Matthew Guariglia as they weigh in on surveillance in modern culture, activism, and the future of privacy.

https://archive.org/details/eff-30-fireside-chat-surveillance-with-edward-snowden

#surveillance #digital #rights #nsa #EFF #police #spy #technology #privacy #PRISM #snowden
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv

ODO - the “swiss army knife” for the development of distributed communication apps

What is ODO?

ODO wants to become the “swiss army knife” for the development of distributed communication apps. It will allow developing such apps for various platforms: mobile, desktop, server, maybe even IoT devices. A layered API will allow quick development of simple apps in a low-code-manner, or complex apps using all the features of modern software development environments.

Get rid of Backend Servers

One of the key ideas is to get rid of central servers, meaning the app is really just the app on the device it is running on, no backends, no serers. All data is encrypted and distributed over all devices having ODO installed (using IPFS). This means that an app with ODO can be run with minimal resources on the operator side, as you don’t need AWS, Firebase, Azure or whatever.

Make Privacy and Security easy

One of the main goals of the layered API is to make it easy to develop secure apps with good privacy by design. Of course it is not possible, to have an API which technically prevents all possible security vulnerabilities and privacy problems. But an API can focus on privacy and security, and make these things easy. And while categories of privacy problems arising from a single entity controlling a central server, these kinds of problems simply does not exist with ODO.

💡 Have a closer look at the top level design document for more info about the technical ideas.

👉🏼 I want to contribute! 👈🏼

If you would like to contribute, start with this document, and the go on with onboarding. Also have a look at your code of conduct.

https://straightway.codeberg.page/odo/

#odo
📡@cRyPtHoN_INFOSEC_DE
📡@cRyPtHoN_INFOSEC_EN
📡@cRyPtHoN_INFOSEC_FR
📡@BlackBox_Archiv