By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

Whether you’re on the hunt for PS5 restock, Xbox Series X restock, or an Nvidia RTX 3080, you’ve probably had a pretty miserable time of it. Game consoles come and go within minutes, from retailers large and small. GPUs from Nvidia and AMD seem even scarcer, with enthusiasts camping out in front of stores, or simply paying exorbitant prices for third-party gear. On the one hand, we expect newly released electronics to be scarce. Eager early adopters almost always snatch up all available stock on a hot new gadget. But then, over time, the demand levels off, and the supply increases, and you can walk into any store and walk out with a smartphone, or a game console, or a computer part. And yet, gadget-hunting in 2021 feels different so far. More than six months later, finding a PS5 or Xbox Series X requires setting aside hours of your day to constantly refresh a page, and hoping against hope that scalper bots don’t steal a console right out of your shopping cart. GPUs like the Nvidia GeForce RTX 3080 and the AMD RX 6800 are even rarer, thanks to shady cryptocurrency miners. After all, who’s got time to play fun games when you can strike it rich with Dogecoin? Unfortunately, as 2021 continues, it’s beginning to look more and more like game consoles and GPUs won’t be widely available anytime soon, largely due to the worldwide semiconductor shortage. For the moment, high-end gaming systems are, essentially, rare luxury goods, instead of everyday consumer items. And the sooner we start viewing them as such, the happier we’ll all be. The reason why no one can find a PS5, Xbox Series X, or GPU is almost disappointingly prosaic. It’s because manufacturers can’t supply enough parts to get them built. Everything boils down to a type of computer component known as a semiconductor. To simplify things considerably, semiconductors help bridge the gap between metallic conductors and nonreactive insulators. They’re the reason why our electronics don’t short out from too much current or fail to function from a lack of current. In products that rely on sensitive computerized equipment — game consoles and GPUs, yes, but also cars, washing machines, and cameras — semiconductors are arguably as integral as the microchips themselves. At present, the whole world is living through a severe semiconductor shortage. If you guessed that it’s largely due to the COVID-19 pandemic, you guessed correctly. Many factories either shut down or didn’t run at full capacity, for quite some time last year. To exacerbate matters further, consumers didn’t buy much when the pandemic began, leading manufacturers to cut their semiconductor orders. Not only has demand outstripped supply; the supply itself is smaller than it really should have been. There are other reasons for the shortage, too, from then-president Donald Trump’s restrictions on the Chinese semiconductor trade to a fire at a Japanese manufacturing plant, to reduced global shipping causing bottlenecks. In other words, the semiconductor shortage is a perfect storm of public health, international relations, logistics, and bad luck. If you’ve been glued to Twitter, hoping against hope for the next PS5 restock, or perusing your local Best Buy every morning in hopes of an RTX 3080 resupply, you’re very well aware that the odds are against you. The demand for new gaming gear is huge; the supply of new gaming gear is extremely limited. The demand should decrease slightly as more and more people actually find the hardware they’re looking for. But with each new restock still selling out within minutes, it doesn’t seem like the situation is improving quickly enough to make a difference for most prospective buyers. At the risk of being the resident Tom’s Guide doomsayer, I don’t see the situation for PS5, Xbox Series X, or high-end GPUs improving much within the next few months. Readers have two options for dealing with this bad news. They can redouble their efforts, making our friend Matt Swider’s Twitter profile (which tracks console restocks day and night) into their homepage, setting up accounts at every major retailer in advance, keeping multiple machines glued to the Best Buy home page all day, and fighting off the thousands of other people in exactly the same position, every single day until something clicks. And, to be honest, if you treat finding a new console like a second job, you can probably secure one. It’s not hard; it’s just very tedious. More details are posted on OUR FORUM.

It’s the messaging app that connects a quarter of the world’s population, but many Americans still have haven’t heard of WhatsApp. That’s because most phone plans in the United States provide a standard flat rate for texting that allows people to communicate freely within the country. But throughout much of the world, including many of the world’s poorest countries, people are charged for every single message they send and receive. That is why, since its launch in 2009, WhatsApp has become a vital resource for billions of people – and they are prepared to defend it. When the Lebanese government tried to bring in a “WhatsApp tax”, charging $0.20 daily for calls made on the app, it helped trigger the mass protests that swept the country in 2019. One thing that does connect Americans to WhatsApp users, however, is Facebook chief executive Mark Zuckerberg and his flagrant disregard for data privacy. Facebook acquired WhatsApp in 2014 in a move to consolidate control over global communications. Now Zuckerberg is moving ahead with a change to WhatsApp’s privacy policy that aims to commercialize our communications in order to feed Facebook’s insatiable greed. At the time of WhatsApp’s purchase in 2014, the app did not collect phone numbers, metadata, or other contact information. Facebook promised to keep it this way. “We are absolutely not going to change plans around WhatsApp and the way it uses user data,” Zuckerberg claimed. “WhatsApp is going to operate completely autonomously.” Yet on 15 May, when Zuckerberg implements a new privacy update, this will be just one more in a series of his broken promises on data privacy. In 2016, WhatsApp implemented an update to its terms and conditions that allowed data like a user’s phone number to be shared with Facebook. Users were technically given 30 days’ notice to opt out. However, many were unaware of the possible opt-out and missed the small window in which they could do so, while the approximately one billion users who joined since were given no choice at all. WhatsApp announced its latest privacy update in January, with changes initially meant to take effect on 8 February. However, a popular outcry pushed the date back to 15 May, with Facebook no doubt hoping that public outrage would fade, paving the way for a quiet implementation. But public outrage has not faded. And so Facebook has opted for a familiar tactic: sow confusion and force through its new policy change anyway. The company is pestering WhatsApp users to accept the policy change by 15 May or, under a new opaque timeframe, a few additional weeks. Those who ignore or refuse the decision will lose access to basic WhatsApp functioning. Time is now running for Zuckerberg to reverse course in this latest assault on global communications – and protect the privacy of all WhatsApp users at this critical hour for democracy and dissent around the world. Facebook, for its part, has spent the months since the announcement downplaying the significance of these privacy updates by arguing that its latest changes will only affect communication with business accounts (WhatsApp Business was launched in January 2018). In truth, the changes will allow Facebook to collect payment and transaction data from WhatsApp users, meaning Facebook will be able to gather even more data and target users with ever more personalized ads. WhatsApp has also removed a passage in its privacy policy about opting out of sharing data with Facebook. Facebook argues that this simply reflects what’s been in place since 2016. That is exactly the problem.Today’s WhatsApp shares a great deal of information with Facebook it promised it wouldn’t, including account information, phone numbers, how often and how long people use WhatsApp, information about how they interact with other users, IP addresses, browser details, language, time zone, etc. This latest incursion has highlighted just how much data sharing has been going on for years without most users’ knowledge. Learn more when you visit OUR Forum.

Security researcher Mathy Vanhoef, who loves to poke holes in Wi-Fi security, is at it again, this time finding a dozen flaws that stretch back to cover WEP and seemingly impact every device that makes use of Wi-Fi. Thankfully, as Vanhoef explained, many of the attacks are hard to abuse and require user interaction, while others remain trivial. Another positive is Microsoft shipped its patches on March 9, while a patch to the Linux kernel is working its way through the release system. The details of FragAttacks follow a nine-month embargo to give vendors time to create patches. "An adversary that is within radio range of a victim can abuse these vulnerabilities to steal user information or attack devices," Vanhoef said in a blog post. "Experiments indicate that every Wi-Fi product is affected by at least one vulnerability and that most products are affected by several vulnerabilities." Several of the identified flaws relate to the ability to inject plaintext frames, as well as certain devices accepting any unencrypted frame or accept plaintext aggregated frames that look like handshake messages. Vanhoef demonstrated how this could be used to punch a hole in a firewall and thereby take over a vulnerable Windows 7 machine. "The biggest risk in practice is likely the ability to abuse the discovered flaws to attack devices in someone's home network," the security researcher wrote. "For instance, many smart homes and internet-of-things devices are rarely updated, and Wi-Fi security is the last line of defense that prevents someone from attacking these devices. Unfortunately ... this last line of defense can now be bypassed." Other vulnerabilities relate to how Wi-Fi frames are fragmented and how receivers reassemble them, allowing an attacker to exfiltrate data. Even devices that do not support fragmentation were at risk. "Some devices don't support fragmentation or aggregation but are still vulnerable to attacks because they process fragmented frames as full frames," Vanhoef wrote. "Under the right circumstances, this can be abused to inject packets." Some networking vendors such as Cisco and Juniper are starting to push patches for some of their impacted products, while Sierra has planned some of its products to be updated over the next year, and others will not be fixed. The CVEs registered to due FragAttacks have been given a medium severity rating and have CVSS scores sitting between 4.8 to 6.5. "There is no evidence of the vulnerabilities being used against Wi-Fi users maliciously, and these issues are mitigated through routine device updates that enable detection of suspect transmissions or improve adherence to recommended security implementation practices," the Wi-Fi Alliance wrote. Vanhoef said anyone with unpatched devices can protect against data exfiltration by using http connections. "To mitigate attacks where your router's NAT/firewall is bypassed and devices are directly attacked, you must assure that all your devices are updated. Unfortunately, not all products regularly receive updates, in particular smart or internet-of-things devices, in which case it is difficult (if not impossible) to properly secure them," the researcher wrote. "More technically, the impact of attacks can also be reduced by manually configuring your DNS server so that it cannot be poisoned. Specific to your Wi-Fi configuration, you can mitigate attacks (but not fully prevent them) by disabling fragmentation, disabling pairwise rekeys, and disabling dynamic fragmentation in Wi-Fi 6 (802.11ax) devices." Follow this thread on OUR FORUM.

Five serious vulnerabilities in a driver used by Dell devices have been disclosed by researchers. On Tuesday, SentinelLabs said the vulnerabilities were discovered by security researcher Kasif Dekel, who explored Dell's DBUtil BIOS driver -- software used in the vendor's desktop and laptop PCs, notebooks, and tablet products. The team says that the driver has been vulnerable since 2009, although there is no evidence, at present, that the bugs have been exploited in the wild. The DBUtil BIOS driver, which comes pre-installed on many Dell machines running Windows, contains a component -- the dbutil_2_3.sys module -- which was subject to Dekel's scrutiny. Dell has assigned one CVE (CVE-2021-21551), CVSS 8.8, to cover the five vulnerabilities disclosed by SentinelLabs. Two are memory corruption issues in the driver, two are security failures caused by a lack of input validation, and one logic issue was found that could be exploited to trigger denial-of-service. "These multiple critical vulnerabilities in Dell software could allow attackers to escalate privileges from a non-administrator user to kernel mode privileges," the researchers say. The team notes that the most crucial issue in the driver is that access-control list (ACL) requirements, which set permissions, are not invoked during Input/Output Control (IOCTL) requests. As drivers often operate with high levels of privilege, this means requests can be sent locally by non-privileged users. "[This] can be invoked by a non-privileged user," the researchers say. "Allowing any process to communicate with your driver is often a bad practice since drivers operate with the highest of privileges; thus, some IOCTL functions can be abused "by design." Functions in the driver were also exposed, creating read/write vulnerabilities usable to overwrite tokens and escalate privileges. Another interesting bug was the possibility to use arbitrary operands to run IN/OUT (I/O) instructions in kernel mode. "Since IOPL (I/O privilege level) equals to CPL (current privilege level), it is obviously possible to interact with peripheral devices such as the HDD and GPU to either read/write directly to the disk or invoke DMA operations," the team noted. "For example, we could communicate with ATA port IO for directly writing to the disk, then overwrite a binary that is loaded by a privileged process." Proof-of-Concept (PoC) code is being withheld until June to allow users time to patch. Dell was made aware of Dekel's findings on December 1, 2020. Following triage and issues surrounding some fixes for end-of-life products, Dell worked with Microsoft and has now issued a fixed driver for Windows machines.  The PC giant has issued an advisory (DSA-2021-088) and a FAQ document containing remediation steps to patch the bugs. Dell has described the security flaw as "a driver (dbutil_2_3.sys) packaged with Dell Client firmware update utility packages and software tools [which] contains an insufficient access control vulnerability which may lead to escalation of privileges, denial of service, or information disclosure. "We remediated a vulnerability (CVE-2021-21551) in a driver (dbutil_2_3.sys) affecting certain Windows-based Dell computers," a Dell spokesperson said. "We have seen no evidence this vulnerability has been exploited by malicious actors to date. We appreciate the researchers working directly with us to resolve the issue."For more navigate to OUR FORUM.
The European Commission is issuing antitrust charges against Apple over concerns about the company’s App Store practices. The Commission has found that Apple has broken EU competition rules with its App Store policies, following an initial complaint from Spotify back in 2019. Specifically, the Commission believes Apple has a “dominant position in the market for the distribution of music streaming apps through its App Store.” The EU has focused on two rules that Apple imposes on developers: the mandatory use of Apple’s in-app purchase system (for which Apple charges a 30 percent cut), and a rule forbidding app developers to inform users of other purchasing options outside of apps. The Commission has found that the 30 percent commission fee, or “Apple tax” as it’s often referred to, has resulted in higher prices for consumers. “Most streaming providers passed this fee on to end-users by raising prices,” according to the European Commission. “Apple’s rules distort competition in the market for music streaming services by raising the costs of competing music streaming app developers,” says a statement from the Commission. “This, in turn, leads to higher prices for consumers for their in-app music subscriptions on iOS devices.” The EU has also sent Apple a statement of objections, which is essentially a list of how the Commission believes Apple has violated competition rules. This is the initial, formal stage of antitrust proceedings against Apple, and the company will have the chance to respond to the Commission’s list of objections within the next 12 weeks. This specific case is limited to Apple’s App Store practices for music streaming, and the EU is investigating additional separate cases on ebooks and the App Store in general. “This is not the last case we will have when it comes to the App Store,” said European commissioner Margrethe Vestager in a press conference this morning. Vestager also revealed the Commission is taking an interest in Apple’s policies around games on the App Store. “We also take an interest in the gaming app market,” said Vestager, responding to a question about the money involved in gaming apps on the App Store. “That’s really early days when it comes to that,” Microsoft called on regulators to investigate the App Store last year, just a couple of months before a public spat with Apple over its xCloud game streaming service. Apple now faces a fine of up to 10 percent of its annual revenue if it’s found guilty of breaking EU rules, which could be as high as $27 billion based on Apple’s annual revenue of $274.5 billion last year. Apple could also be forced to change its business model, which has more damaging and lasting effects than a fine. Spotify has welcomed the initial charges. “Ensuring the iOS platform operates fairly is an urgent task with far-reaching implications,” says Horacio Gutierrez, Spotify’s chief legal officer. “The European Commission’s statement of objections is a critical step toward holding Apple accountable for its anticompetitive behavior, ensuring meaningful choice for all consumers and a level playing field for app developers.” Central to this entire case is the 30 percent cut that Apple takes on subscriptions. Companies like Netflix and Spotify have long opposed this so-called Apple tax, but Apple has argued that the revenue contributes toward the costs of maintaining the App Store and enforcing its various content, privacy, and security policies. Spotify previously claimed that Apple uses its App Store to stifle innovation and limit consumer choice in favor of its own Apple Music service. That complaint was followed up with a similar one by Rakuten, alleging that it’s anti-competitive for Apple to take a 30 percent commission on ebooks sold through the App Store while promoting its own Apple Books service. Epic Games also joined many developers and companies opposing Apple’s App Store policies and filed an antitrust complaint with the EU earlier this year. It’s part of an ongoing dispute with Apple after the Fortnite developer publicly criticized Apple’s App Store policies around distribution and payments. This resulted in Epic attempting to circumvent Apple’s 30 percent cut on in-app purchases in Fortnite, and Apple quickly removing the game from its App Store. For more please visit OUR FORUM.
In the age of remote work, it's easier than ever to blur the lines between our personal and professional tech. Maybe it's sending personal texts or emails from your work phone, editing personal documents or photos on your work laptop, or joining a virtual happy hour with friends from your work tablet. None of these actions may sound like a particularly risky activity, but as a former "IT guy" I'm asking, nay pleading, with you to stop doing them. At least the potentially more hazardous activities, such as storing personal data on your work machine or storing sensitive company data on your personal devices. Do it for the security of your employer. But more importantly, do it for the safety, privacy and wellbeing of yourself, your family and friends. Cybersecurity incidents can have serious negative consequences for both your employer and you. And even if an actual security breach or data leak doesn't occur, you could be reprimanded, demoted, fired, sued or even criminally prosecuted. Take the case of former CIA director John M. Deutch. In 1996, as Deutch was leaving his position as Director of Central Intelligence, he asked if he could keep his government-issued computers because they contained his personal financial information, and he did not own a personal computer to which the data could be transferred. (This seems incomprehensible today, but it was very common at the time.) The government agreed to loan the computers to Deutch basically under the condition that he become an unpaid government consultant, not use the computers for personal work and buy a computer to which he could transfer his personal data. Fast forward a few years and it's discovered that the government computers, now at Deutch's Maryland home, had been connected to the Internet and that their hard drives contained classified information. Deutch also told government investigators that family members had access to the computers, including his wife, who "used this computer to prepare reports relating to official travel" with Deutch and another family member who used the computer "to access a university library." It was also reported at the time, that the "other family member" was Deutch's son, who in addition to accessing those university resources also visited several "high-risk" porn sites, one of which had placed cookies on the computer. A survey conducted in August 2020 by antivirus vendor Malwarebytes asked respondents how they used their work devices. The company found that 53% reported sending or receiving personal email, 52% read news, 38% shopped online, 25% accessed their social media and 22% downloaded or installed non-company software. And then of course there's the flip side, using a personal device for work. A report from cybersecurity vendor Morphisec released in June 2020 found that 56% of employees reported using their personal computer as their work device. And according to a 2020 survey by antivirus software maker Kaspersky, 57% of respondents said they checked work email on their personal smartphone and 36% did work on their personal laptop or desktop. Only 30% said they never used a work device for personal activities. Keep in mind however, survey respondents don't always provide completely accurate data. They may have forgotten past events or omit information due to embarrassment or fear of potential negative consequences. As such, I suspect these figures undercount the number of folks who are actually blending their work and personal tech. Even if nothing "bad" happens, there are still headaches from blurring the lines between your personal and professional tech. What happens when you get a new machine? What happens if you change jobs? In both cases you'll need to clean your personal data off the work machine before you give it back to IT. And depending how much personal data has accumulated on the device and how you've organized it, the process can be extremely complicated and take a significant amount of time. Also, simply copying and deleting the personal data won't completely protect your privacy. To really keep your personal information personal, you'd need to wipe the machine's hard drive or physically destroy the drive, something which will likely raise red flags with your company's IT department. You also run the risk of losing access to your data permanently if you fail to copy it all and the machine's drive is wiped or destroyed as part of your employer's computer equipment disposal policy.Further details can be found on OUR FORUM.