By continuing to use the site or forum, you agree to the use of cookies, find out more by reading our GDPR policy

A serious Apple iOS bug has been discovered that allows FaceTime users to access the microphone and front-facing camera of who they are calling even if the person does not answer the call. To use this bug, a caller would FaceTime another person who has an iOS device and before the recipient answers, add themselves as an additional contact to Group FaceTime. This will cause the microphone of the person you are calling to turn on and allow the caller to listen to what is happening in the room. Even worse, if the person that is being called presses the power button to mute the FaceTime call, the front-facing camera would turn on as well. What this means, is if someone is calling you on FaceTime, they could be listening and seeing what you are doing without you even knowing. BleepingComputer has tested and confirmed that this bug works in iOS 12.1.2 and we were able to hear and see the person. When testing it against an Apple Watch, though, we were not able to get the audio portion of the bug to work. While it is not known who first discovered this bug, numerous people have been posting about it on social media and making video demonstrations as shown below. When 9to5Mac first reported on the bug, they were only able to get the microphone snooping working. Later, BuzzFeed reported that they could also access the front-facing camera and that Apple stated that they are "aware of this issue and we have identified a fix that will be released in a software update later this week." We have the video and instructions on disabling Facetime posted on OUR FORUM.

The new operating system could look more like Windows 7 than 10. Rumors that Microsoft has been developing a simplified and locked down version of Windows for budget devices have been surfacing for a while now. First, the name “Windows Lite” was spotted in a Windows 10 SDK, and then reporter Brad Sams claimed he’d discussed it with Microsoft employees. Now it seems that in addition to structural changes, Windows Lite will also get an aesthetic change that includes dropping live tiles.
According to sources that spoke with Windows Central, Windows Lite will feature a static app launcher in place of Windows 10’s Start menu, much like Chrome OS, Android and iOS. This means that Windows Lite will likely drop support of Live Tiles, a current Windows 10 feature that lets apps stream information in the place of its icon, like live weather information or how much unread email you have. Microsoft apparently has two reasons for cutting the feature: first, no one was using it. Very few users open the start menu to look at live tiles and this means that even major apps aren't focused on taking advantage of the feature. Second, the overall design language of Windows Lite will be simpler to reduce system requirements, and redesigning the Start menu is part of that. As shown in the concept image above, Windows Lite is likely to be more colorful and bring back some of the soft curves and comfortable feel of Windows 7. It’ll also bring back smooth performance on budget systems. Like Google’s Chrome OS, it is expected that Windows Lite will be designed for systems which may only have 32GB of storage or 2GB of RAM. To accomplish this feat Windows Lite may exclusively use Progressive Web Apps, which are apps that are built on a web browser, and Universal Windows Platform apps, which are meant to work on any Microsoft operating system from Windows 10 Mobile to Xbox. This will limit Windows Lite to just the Microsoft Store, but it will save on storage and provide a decent Windows on ARM experience.
Via Techspot

Ignorance is bliss, and it’s often the most ignorant who make the surest decisions, not being encumbered by the knowledge that they could be wrong. In many situations, this is all fine and good, but at the current level of self-driving car development having a Tesla confidently crash into a fire truck or white van (both of which happened) can be rather dangerous. The issue is that self-driving cars are just smart enough to drive cars, but not to know when they are entering a situation outside their level of confidence and capability. Microsoft Research has worked with MIT to help cars know exactly when situations are ambiguous. As MIT news notes, a single situation can receive many different signals, because the system perceives many situations as identical. For example, an autonomous car may have cruised alongside a large car many times without slowing down and pulling over. But, in only one instance, an ambulance, which appears exactly the same to the system, cruises by. The autonomous car doesn’t pull over and receives a feedback signal that the system took an unacceptable action. Because the unusual circumstance is rare cars may learn to ignore them when they are still important despite being rare. The new system, to which Microsoft contributed, will recognize these rare systems with conflicted training and can learn in a situation where it may have, for instance, performed acceptably 90 percent of the time, the situation is still ambiguous enough to merit a “blind spot.” Read much more on OUR FORUM.

Disclosure of proof-of-exploit code for security bugs in Cisco routers for small businesses prompted hackers to scan for vulnerable devices in an attempt to take full control of them. Cisco this week announced updates for router models RV320 and RV325 that fix a command injection (CVE-2019-1652) and an information disclosure (CVE-2019-1653) vulnerability; both of them are in the routers' web management interface. Exploiting the former requires authentication and admin privileges to allow a remote attacker to execute arbitrary commands on the system. The latter security issue is also remotely exploitable, but it does not need authentication to get sensitive information from the router. A hacker chaining the two bugs could target RV320 and RV325 routers available online to obtain hashed access credentials for a privileged account and thus be able to run arbitrary commands as root. Germany company RedTeam Pentesting found the issues in Cisco RV320 and reported them privately to Cisco. The researchers also found that RV320 exposes diagnostic data. A superficial search on Shodan shows that there are about 20,000 Cisco RV320/RV325 routers reachable over the internet. Not all of them may be vulnerable, though. According to information today from Troy Mursch, chief research officer at Bad Packets, more than 9,500 of them were found to be affected by the information disclosure glitch, most of them in the United States. Learn more on OUR FORUM.

A European Commission Statement says that Data Protection Authorities across Europe received 95,180 complaints regarding the mishandling of personal data and companies reported a record number of 41,502 data breaches since the General Data Protection Regulation (GDPR) was enacted on 25 May 2018. According to the GDPR provisions, businesses have the obligation to report data breaches to their national DPA in under 72 hours if personal data of European citizens is unlawfully or accidentally disclosed. Following the 95,180 complaints introduced by both individuals and organizations mandated by individuals since the enactment of the GDPR, a number of 255 investigations were initiated by national Data Protection Authorities. 41,502 data breaches reported by companies since 25 May 2018. It is important to mention though that out of those, a couple of dozen GDPR investigations were also initiated outside the scope of the complaints advanced by individuals. Moreover, the European Commission's statistics say that the most common types of GDPR complaints were related to telemarketing, promotional e-mails, and to video surveillance/CCTV, which were found to violate multiple provisions.  Further details are posted on OUR FORUM.

As reported by Cisco in its Data Privacy Benchmark Study, companies that follow the requirements of the General Data Protection Regulation (GDPR) experience benefits such as lower frequency and effect of data breaches, as well as fewer records being impacted in the attacks, shorter downtimes and lower overall costs. GDPR is a user and data privacy regulation which came into effect in the European Union on May 25, addressing data protection of EU residents and the export of personal data outside the EU and EEA areas. The report used the data collected via a double-blind survey which was answered by over 3200 security professionals from 18 countries from all over the world and from all major industries. "Organizations have a long way to go to maximize the value of their private investments. Our research shows that the market is set and ready for those willing to invest in data assets and privacy may be the path forward to get there," according to Michelle Dennedy, Cisco's Chief Privacy Officer. When it comes to the level of GDPR readiness among the respondents, 59% of them said that they are meeting either all or most of GDPR’s provisions, while 29% of them stated that GDPR-readiness is one year away and another 9% indicated that they would need more than a year to be ready. Learn more by visiting OUR FORUM.