Amazon confirms it keeps your Alexa recordings basically forever

If you (like so many of us) hate listening to recordings of your own voice, you may be in for an unpleasant future, as Amazon has confirmed it hangs on to every conversation you’ve ever had with an Alexa-enabled device until or unless you specifically delete them. That confirmation comes as a response to a list of questions Sen. Chris Coons (D-Delaware) sent to Amazon CEO Jeff Bezos in May expressing ‘concerns’ about how Amazon uses and retains customers’ Alexa voice assistant data. Amazon’s response to Coons, as first reported by CNET, confirms that the company keeps your data as long as it wants unless you deliberately specify otherwise.

Kubernetes CLI tool security flaw lets attackers run code on host machine

The Kubernetes project has patched today a dangerous security flaw that could allow for clever hacks where attackers may run code on the host machine. The vulnerability doesn’t impact the Kubernetes system itself, but kubectl (Kube control), the official command-line utility for working with Kubernetes installations. Security researchers have discovered a security flaw in the kubectl cp (copy) operation that is used to transfer files from containers to a user’s host machine.

A Second U.S. City Has Banned Facial Recognition

Somerville, Massachusetts just became the second U.S. city to ban the use of facial recognition in public space. The ‘Face Surveillance Full Ban Ordinance,’ which passed through Somerville’s City Council on Thursday night, forbids any “department, agency, bureau, and/or subordinate division of the City of Somerville” from using facial recognition software in public spaces. The ordinance passed Somerville’s Legislative Matters Committee on earlier this week.

DARPA’S $1.5-Billion Remake of U.S. Electronics

About a year ago, the U.S.Defense Advanced Research Projects Agency pulled back the covers on its five-year, $1.5-billion scheme to remake the U.S. electronics industry. The Electronics Resurgence Initiative included efforts in “aggressive specialization” for chip architectures, systems that are smart enough to reconfigure themselves for whatever data you throw at them, open-source hardware, 24-hour push-button system design, and carbon-nanotube-enabled 3D chip manufacturing, among other cool things. As always with DARPA, this is high-risk research;but if even half of it works out, it could change the nature not just of what kinds of systems are designed but also of who makes them and how they’re made.

Key Conjurer: Our Policy of Least Privilege

Hi, my name is Reza Nikoopour and I’m a security engineer on the Security team at Riot. My team is responsible for securing Riot infrastructure wherever we’re deployed – whether that means internal or external data centers or clouds. We provide cloud security guidance to the rest of Riot, and we’re responsible for Key Conjurer, our open source AWS API programmatic access solution.

It’s Surprisingly Easy to Hack the Precision Time Protocol

When it comes to synchronizing large and important networks, for instance in the energy or financial sectors, every microsecond counts. Different protocols have been designed and implemented to achieve such precision. One of the most effective approaches is called IEEE 1588-2008 or the Precision Time Protocol (PTP).

But while PTP can in theory help networks synchronizetheir actions to within a microsecond, a team of computer scientists recently demonstrated that PTP also makes it possible—in multiple ways—to hack such a system. In a network using PTP, one central clock, referred to as a “master” clock, is responsible for coordinating and communicating time to “slave” clocks across the network (these controversial terms were recently removed fromthe popular programming language Python, but continue to be used in many fields). The master clock accomplishes this by sending time-stamped data packets to the slaves.

For two hours, a large chunk of European mobile traffic was rerouted through China

For more than two hours on Thursday, June 6, a large chunk of European mobile traffic was rerouted through the infrastructure of China Telecom, China’s third-largest telco and internet service provider (ISP). The incident occurred because of a BGP route leak at Swiss data center colocation company Safe Host, which accidentally leaked over 70,000 routes from its internal routing table to the Chinese ISP. The Border Gateway Protocol (BGP), which is used to reroute traffic at the ISP level, has been known to be problematic to work with, and BGP leaks happen all the time.

Household Radar Can See Through Walls and Knows How You’re Feeling

When I was a boy, I secretly hoped I would discover latent within me some amazing superpower—say,X-ray vision or the ability to read people’s minds. Lots of kids have such dreams. But even my fertile young brain couldn’t imagine that one day I would help transform such superpowers into reality.

Nor could I conceive of the possibility that I would demonstrate these abilities to the president of the United States. And yet two decades later, that’s exactly what happened. There was, of course, no magic or science fiction involved, just new algorithms and clever engineering, using wireless technology that senses the reflections of radio waves emanating from a nearby transmitter.

SEC suing Kik for unregistered ICO

The Securities and Exchange Commission today sued Kik Interactive Inc. for conducting an illegal $100 million securities offering of digital tokens. The SEC charges that Kik sold the tokens to U.S. investors without registering their offer and sale as required by the U.S. securities laws. As alleged in the SEC’s complaint, Kik had lost money for years on its sole product, an online messaging application, and the company’s management predicted internally that it would run out of money in 2017.

Advanced Linux backdoor found in the wild escaped AV detection

Researchers say they’ve discovered an advanced piece of Linux malware that has escaped detection by antivirus products and appears to be actively used in targeted attacks. HiddenWasp, as the malware has been dubbed, is a fully developed suite of malware that includes a trojan, rootkit, and initial deployment script, researchers at security firm Intezer reported on Wednesday. At the time Intezer’s post went live, the VirusTotal malware service indicated Hidden Wasp wasn’t detected by any of the 59 antivirus engines it tracks, although some have now begun to flag it.

Google Just Gave 2 Billion Chrome Users A Reason To Switch To Firefox

Google is planning to restrict modern ad blocking Chrome extensions to enterprise users only, according to 9to5Google. This is despite a backlash to an announcement by Googlein January proposing changes that will stop current ad blockers from working efficiently. And the software giant is not backing down: It says the only people that can use ad blockersfollowing the change will be Google’s enterprise users.

Docker Bug Allows Root Access to Host File System

All of the current versions of Docker have a vulnerability that can allow an attacker to get read-write access to any path on the host server. The weakness is the result of a race condition in the Docker software and while there’s a fix in the works, it has not yet been integrated. The bug is the result of the way that the Docker software handles some symbolic links, which are files that have paths to other directories or files.

Stolen NSA hacking tool now victimizing US cities

A hacking tool developed by the US National Security Agency is now being used to shut down American cities and towns, says a Saturday report in The New York Times. Code-named EternalBlue, the hacking exploit involves malicious software and was leaked in 2017 by a group called Shadow Brokers. Hackers used the tool that same year in the worldwide WannaCry ransomware attacks, which locked up computer systems at hospitals, banks and phone companies and required a ransom to set the networks free.

First official version of Tor Browser for Android released on the Play Store

Today, the Tor Project released on the Google Play Store the first stable version of the Tor Browser for Android. This new mobile browser integrates the Tor protocol stack into a standalone browser and replaces Orfox as the main way to navigate the Tor network from an Android device. Tor Project developers have been working on this browser for eight months now, since September 2018, when they first released an alpha version for public testing.

Baltimore ransomware nightmare could last weeks more, with big consequences

It’s been nearly two weeks since the City of Baltimore’s networks were shut down in response to a ransomware attack, and there’s still no end in sight to the attack’s impact. It may be weeks more before the city’s services return to something resembling normal—manual workarounds are being put in place to handle some services now, but the city’s water billing and other payment systems remain offline, as well as most of the city’s email and much of the government’s phone systems. The ransomware attack came in the midst of a major transition at City Hall.

San Francisco just banned facial-recognition technology

San Francisco, long one of the most tech-friendly and tech-savvy cities in the world, is now the first in the US to prohibit its government from using facial-recognition technology. The ban is part of a broader anti-surveillance ordinance that the city’s Board of Supervisors approved on Tuesday. The ordinance, which outlaws the use of facial-recognition technology by police and other government departments, could also spur other local governments to take similar action.

Google pulls Huawei’s Android license

Following the US crackdown on Chinese technology companies, Google has cut off Huawei’s Android license, dealing a huge blow to the besieged phonemaker. Reuters first reported the news, and The Verge subsequently confirmed Google’s suspension of business with Huawei with a source familiar with the matter. Reached for comment, a Google spokesperson said only “We are complying with the order and reviewing the implications.”

The order, in this case, appears to be the US Commerce Department’s recent decision to place Huawei on the “Entity List,” which as Reuters reports is a list of companies that are unable to buy technology from US companies without government approval. Speaking to Reuters, a Google spokesperson confirmed that “Google Play and the security protections from Google Play Protect will continue to function on existing Huawei devices.” So while existing Huawei phones around the world won’t be immediately impacted by the decision, the future of updates for those phones as well as any new phones Huawei would produce remains in question.

Google’s Sensorvault Is a Boon for Law Enforcement. This Is How It Works.

Law enforcement officials across the country have been seeking information from a Google database called Sensorvault — a trove of detailed location records involving at least hundreds of millions of devices worldwide, The New York Times found. Though the new technique can identify suspects near crimes, it runs the risk of sweeping up innocent bystanders, highlighting the impact that companies’ mass collection of data can have on people’s lives. Why does Google have this data?The Sensorvault database is connected to a Google service called Location History.

Post-mortem and remediations for Apr 11 security incident

On April 11th we dealt with a major security incident impacting the infrastructure which runs the Matrix.org homeserver – specifically: removing an attacker who had gained superuser access to much of our production network. We provided updates at the time as events unfolded on April 11 and 12 via Twitter and our blog, but in this post weâll try to give a full analysis of what happened and, critically, what we have done to avoid this happening again in future.

A serious hack hit WhatsApp

A security flaw in WhatsApp’s audio calling feature let hackers install spyware on iPhones and Androids. The attack is expected to have a limited reach but you should update WhatsApp straight away WhatsApp’s default end-to-end encryption is one of Facebook’s biggest security assets – but even this doesn’t help when the app itself is attacked. Mark Zuckerberg’s company has found a sophisticated cyberattack has been used to exploit a weakness in the messaging app that’s used by more than 1.5 billion people worldwide.