August, 2018:

Computer security researchers have discovered that computer screens emit sounds that may reveal information being processed as shared in links below:

http://www.eweek.com/security/researchers-discover-computer-screens-emit-sounds-that-reveal-data

NEWS ANALYSIS: Using a computer version of synesthesia, researchers demonstrate a new vulnerability present in most flat-panel monitors that can reveal contents to a remote party.

Audio Screen Data Capture — For some people with the neurological condition, synesthesia can be a lovely thing when the sounds they hear also produce colors. But computer scientists from Tel Aviv University, the University of Pennsylvania and the University of Michigan have discovered a computer version of synesthesia that allows them to determine what’s being displayed on a monitor by listening to sounds emitted by the monitor.

As you might suspect, those sounds are very faint and not easily detected by human hearing. But they are there as tiny high-pitched tones produced by a monitor’s power supply in response to the varying demands of the screen display. But special equipment isn’t required to exploit the vulnerability that’s produced by this characteristic of most monitors.

In their paper, which was released on Aug. 21, the scientists showed that those sounds could be recorded using the microphone in a standard consumer webcam, by a smartphone or by a digital assistant such as an Amazon Echo or Google Home device.  Furthermore, this exploit does not require the presence on site of the attacker. They can record the sounds over a remote call, such as one from Google Hangouts.

DETAILS in this 31 page (9MB) in-depth research report

https://www.cs.tau.ac.il/~tromer/synesthesia/synesthesia.pdf

Apple Insider offers a highly in-depth preview & photos of known expected items for Apple’s major product Fall 2018 launch.  More complete announcements are planned for September 12, 2018 by Apple:

https://appleinsider.com/articles/18/08/30/beyond-the-iphone-what-to-expect-from-apples-sept-12-gather-round-special-event

AppleInsider will be bringing you all of the facts and testing the rumors up to the September 12 date itself. Then of course on the day you’ll be able to follow every detail as Apple unveils it.  You can of course also watch Apple unveiling everything. As is now normal, the entire event is going to be streamed online and on Apple TV.  This time, though, it’s rumored that Apple will also stream the event via Twitter —but we’ll see about that part.

The SANS ISC shares that Crypto Mining attacks are popular & continue to circulate in-the-wild.  They are designed to steal CPU cycles in order to harvest cypro-currencies based on mining algorigthms.  When visiting a site where CPU fan starts to run excessively & PC slows down it may one which is infected with adware, trackers, malware and even Crypto Mining attacks

https://isc.sans.edu/forums/diary/Crypto+Mining+Is+More+Popular+Than+Ever/24050/

We already wrote some diaries about crypto miners and they remain more popular than ever. But crypto miners are not only installed on workstations, servers are juicy targets too… because that’s where the real CPU power is available! The recent Apache Struts remote code execution vulnerability (amongst other like SOLR reported by Renato a few months ago[1]) is heavily used to drop crypto miners on vulnerable systems. The classic behaviour of a crypto miner dropper is to try to gain as much as available resources. To do so, they usually try to kill competitors

Firefox 63 will provide a beneficial privacy feature that blocks web trackers by default

https://venturebeat.com/2018/08/30/mozilla-announces-firefox-will-block-trackers-by-default/

Mozilla today announced that Firefox will soon block web trackers by default. In conjunction, Firefox will also let users control what information they share with sites. Web trackers are used mainly for targeted advertising and broad user data collection. Mozilla wants to protect users from websites using abusive trackers, improving both performance and privacy. Mozilla shared details on three tracker-blocking features it is building into Firefox:

• Blocking trackers that slow down page loads. This feature, aimed at improving page load performance, will be tested in September. If it performs well, Firefox 63 (slated for October 2018) will start blocking slow-loading trackers by default.

• Removing cross-site tracking that follow users around the web. This feature, which strips cookies and blocks storage access from third-party tracking content, will be tested with some Firefox beta users in September. Mozilla plans to bring this protection to all users in Firefox 65 (slated for January 2019).

• Mitigating harmful practices such as trackers that fingerprint users (to identify users by their device properties) and cryptomining scripts. Mozilla didn’t share when future versions of Firefox will stop these practices, but it did say they will also be blocked by default.

Microsoft has recently announced Office 365 improvements for it’s consumer version offerings 

Microsoft Improves Consumer Versions of Office 365

First up, Microsoft is raising the number of device install limits to be unlimited. Previously, Office 365 Personal subscribers could install Office on 1 PC or Mac and 1 tablet. And Office 365 Home subscribers could install Office on a total of 10 devices across five users.

Second, Microsoft is raising the number of users on the Office 365 Home subscription from 5 to 6 starting on October 2. Microsoft is also integrating Office 365 Home subscription more deeply into the Microsoft Family service. Now, anyone who has subscribed to Office 365 Home will automatically share the subscription with all of the people in their Microsoft Family.  Finally, Microsoft is moving management of Office 365 Home and Personal to the Microsoft Account website.

The new Microsoft Surface Go model with WIN 10S is reviewed in this informal evaluation, focusing mainly on usability.

https://www.zdnet.com/article/review-surface-go-running-windows-10-home-in-s-mode/

Microsoft began shipping the newest and least expensive member of its Surface family, the Surface Go, on August 2. I didn’t receive a review unit from Microsoft; the official word was there just weren’t enough of them to go around. (See my ZDNet colleague Ed Bott’s initial impressions of his review unit here.) I decided, given the 30-day return policy on Microsoft devices, to buy one from the NYC flagship Microsoft Store on August 2.

I didn’t go for the lower-end Go model. Instead, I bought the $549 8 GB RAM/128 GB SSD storage version, which looks and feels like a quality device. I decided to spring for the $130 Alcantara (fuzzy premium fabric covered) keyboard in Cobalt Blue. I didn’t buy a pen or mouse, as I wanted to keep my configuration as PC-like and lightweight as possible and I don’t need/want to use a pen with a computer.

I also have opted to keep my device in Windows 10 Home in S Mode (for now, anyway) meaning I can run Microsoft Store apps only and am limited to the Edge browser. This is how Microsoft ships the consumer versions of the Go, though users do have the option to switch to full Windows 10 Home for free.

Petri labs shares an EXCELLENT overview of Windows Server 2016’s Disaster Recovery Features

Understanding Windows Server 2016’s Disaster Recovery Features

A solid understanding of the Disaster Recovery (DR) options that your systems have can help you build a reliable DR plan for your organization. Most businesses are using some version of Windows Server as core part of their IT infrastructure and understanding Windows Server’s built-in DR capabilities can definitely help you protect your mission-critical systems and applications from data loss and downtime. Let’s take a closer look at Windows Server’s built-in DR features.

1. Windows Server Backup
2. Windows Failover Clustering
3. Storage Replica
4. Hyper-V Replica

The latest version of Google Assistant now has new bilingual capabilities built into product as described below

https://www.theverge.com/2018/8/30/17798096/the-google-assistant-can-understand-two-languages-at-once

Google Assistant can now understand two languages at once.  It’s bilingual without changing settings.  Essentially, if you ask Assistant a question, it will automatically recognize what language you’re speaking and respond in kind. It’s a step toward the goal that Google announced back in February to make Assistant fully multilingual without requiring you to dig into the settings and manually change its language.  You’ll be able to set up Assistant to understand and respond to any two of the following languages: English, German, French, Spanish, Italian, and Japanese. Google adds that it intends on “expanding to more languages in the coming months

MORE DETAILS CAN BE FOUND HERE:

https://ai.googleblog.com/2018/08/Multilingual-Google-Assistant.html

While the “attack scope” is narrow & it is difficult to create exploits — this POC represents a different vector for future Windows patching needs:

https://www.kb.cert.org/vuls/id/906424

https://www.bleepingcomputer.com/news/security/exploit-published-for-unpatched-flaw-in-windows-task-scheduler/

US-CERT VU#906424 — Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the ALPC interfaceOverview

Microsoft Windows task scheduler contains a local privilege escalation vulnerability in the Advanced Local Procedure Call (ALPC) interface, which can allow a local user to obtain SYSTEM privileges. The Microsoft Windows task scheduler SchRpcSetSecurity API contains a vulnerability in the handling of ALPC, which can allow a local user to gain SYSTEM privileges. We have confirmed that the public exploit code works on 64-bit Windows 10 and Windows Server 2016 systems. We have also confirmed compatibility with 32-bit Windows 10 with minor modifications to the public exploit code. Compatibility with other Windows versions is possible with further modifications.

The “Phase One” digital camera is top-of-the-line & very expensive at $50,000.  Still, it offers top capabilities for professional photographers including up to 150 megapixel capabilities.

https://www.pcmag.com/news/363367/phase-one-shatters-the-100mp-barrier

Phase One cameras are the highest of the high end, used to capture runway models draped in the latest haute couture and create the finest of fine art landscape prints. Today the company is announcing the IQ4, its latest generation of digital back for use with its XF camera body.

The IQ4 system offers some upgrades over the previous generation IQ3, including what Phase One is calling Capture One Inside. It’s an improved image processor with some real benefits for pro photographers, including improved quality of preview images shown on the rear LCD (so you have a better idea what the camera is capturing), a better Live View experience, and a JPG engine. Previously, photographers could only shoot in the IIQ Raw format with a Phase One system.

An IQ4 system includes the back of your choice, an XF camera body, a lens of your choice, and a five-year warranty with guaranteed uptime. But this type of camera doesn’t come at a low price. The XF IQ4 150MP Camera System is priced at $51,990, the XF IQ4 150 Achromatic prices in at $54,990 and the XF IQ4 100MP Trichromatic is the relative bargain of the bunch at $47,990.