An anonymous reader quotes a report from TechCrunch: Security researchers have linked to the notorious Clop ransomware gang a new wave of mass-hacks targeting a popular file transfer tool, as the first victims of the attacks begin to come forward. It was revealed last week that hackers are exploiting a newly discovered vulnerability in MOVEit Transfer, a file-transfer tool widely used by enterprises to share large files over the internet. The vulnerability allows hackers to gain unauthorized access to an affected MOVEit server's database. Progress Software, which develops the MOVEit software, has already released some patches. Over the weekend, the first victims of the attacks began to come forward.

Zellis, a U.K.-based human resources software maker and payroll provider, confirmed in a statement that its MOVEit system was compromised, with the incident affecting a "small number" of its corporate customers. One of those customers is U.K. airline giant British Airways, which told TechCrunch that the breach included the payroll data of all of its U.K.-based employees. [...] The U.K.'s BBC also confirmed it was affected by the incident affecting Zellis. [...] The government of Nova Scotia, which uses MOVEit to share files across departments, said in a statement that some citizens' personal information may have been compromised. The Nova Scotia government said it took its affected system offline, and is working to determine "exactly what information was stolen, and how many people have been impacted."

It was initially unclear who was behind this new wave of hacks, but Microsoft security researchers are attributing the cyberattacks to a group it tracks as "Lace Tempest." This gang is a known affiliate of the Russia-linked Clop ransomware group, which was previously linked to mass-attacks exploiting flaws in Fortra's GoAnywhere file transfer tool and Accellion's file transfer application. Microsoft researchers said that the exploitation of the MOVEit vulnerability is often followed by data exfiltration. Mandiant isn't yet making the same attribution as Microsoft, but noted in a blog post over the weekend that there are "notable" similarities between a newly created threat cluster it's calling UNC4857 that has as-of-yet "unknown motivations," and FIN11, a well-established ransomware group known to operate Clop ransomware. "Ongoing analysis of emerging activity may provide additional insights," Mandiant said. "It's likely many more victims of the MOVEit breach will come to light over the next few days," adds TechCrunch.

"Shodan, a search engine for publicly exposed devices and databases, showed that more than 2,500 MOVEit Transfer servers were discoverable on the internet."

SonicSpike shares a report from CBS News: As possible record-setting crowds fill airports nationwide, passengers may encounter new technology at the security line. At 25 airports in the U.S. and Puerto Rico, the TSA is expanding a controversial digital identification program that uses facial recognition. This comes as the TSA and other divisions of Homeland Security are under pressure from lawmakers to update technology and cybersecurity. "We view this as better for security, much more efficient, because the image capture is fast and you'll save several seconds, if not a minute," said TSA Administrator David Pekoske.

At the world's busiest airport in Atlanta, the TSA checkpoint uses a facial recognition camera system to compare a flyer's face to the picture on their ID in seconds. If there's not a match, the TSA officer is alerted for further review. "Facial recognition, first and foremost, is much, much more accurate," Pekoske said. "And we've tested this extensively. So we know that it brings the accuracy level close to 100% from mid-80% with just a human looking at a facial match." The program has been rolled out to more than two dozen airports nationwide since 2020 and the TSA plans to add the technology, which is currently voluntary for flyers, to at least three more airports by the end of the year. There are skeptics. Five U.S. senators sent a letter demanding that TSA halt the program.

The U.S. Securities and Exchange Commission (SEC) has filed an emergency motion seeking to freeze the assets of Binance's U.S. platform and repatriate the funds held by its customers, including both fiat currency and cryptocurrencies. CNBC reports: The freezing order only applies Binance's two U.S. holding companies, not to the non-U.S. regulated international exchange. The order would apply to dozens of accounts held at Axos Bank, the defunct Silvergate Bank, Prime Trust, and other institutions. Two foreign entities also controlled by Zhao, Sigma Chain and Merit Peak, served as conduits for billions of dollars of customer money that was improperly commingled with Binance's funds, the SEC has alleged.

The emergency restraining order was necessary, the regulator argued, to "prevent the dissipation of available assets for any judgment, given the Defendants' years of violative conduct, disregard of the laws of the United States." The order also compels Binance's founder, Changpeng Zhao, to "show cause why a preliminary injunction" against Zhao and his two holding companies "should not be entered." The restraining order would also prevent all three entities from destroying evidence. On Monday, the SEC filed a lawsuit against Binance and the company's founder, Changpeng Zhao, accusing the exchange of mishandling customer funds as well as lying to regulators and investors about its operations.

Microsoft has agreed to pay $20 million to settle charges by the Federal Trade Commission (FTC) that it illegally collected personal information from children without parental consent and retained it for extended periods. TechCrunch reports: The federal consumer watchdog said Microsoft violated the Children's Online Privacy Protection Act (COPPA), the federal law that governs the online privacy protections for children under the age of 13, which requires companies notify parents about the data they collect, obtain parental consent and delete the data when it's no longer necessary. The FTC said children signing up to Microsoft's Xbox gaming service were asked to provide their personal information -- including their name, email address, phone number and date of birth -- which until 2019 included a pre-filled check box allowing Microsoft to share user information with advertisers. The FTC said Microsoft collected this data before asking for the parent to complete the account setup, but held onto children's data even if the parent abandoned the sign-up process.

"Only after gathering that raft of personal data from children did Microsoft get parents involved in the process," said FTC's Lesley Fair in a corresponding blog post. As a result, the FTC will require Microsoft to notify parents and obtain consent for accounts created before May 2021. Microsoft will also have to establish new systems to delete children's personal information if it hasn't obtained parental consent, and to ensure the data is deleted when it's no longer needed.

The White House has not shared much of anything with lawmakers about who the administration thinks should be the next national cyber director, a top cyber-minded senator told Axios. From the report: It's been nearly four months since Chris Inglis stepped down as the first national cyber director inside the White House, and lawmakers and policy experts have been putting pressure on President Joe Biden in recent weeks to name a replacement.

Last month, Sen. Angus King (I-Maine) and Rep. Mike Gallagher (R-Wis.) sent a letter to Biden questioning the delay in picking a nominee and encouraging the president to nominate current acting director Kemba Walden to the post. Yet in the three weeks since the lawmakers sent their letter, they haven't heard anything from the White House, King told Axios in a recent interview. What they're saying: "I'm really puzzled; I just don't know what's going on," King told Axios. "This is an important job, and it's an important moment and they have a highly qualified, able acting director." Congress created the Office of the National Cyber Director (ONCD) as the Biden administration was taking office in early 2021.

The Securities and Exchange Commission sued crypto exchange Coinbase in New York federal court on Tuesday morning, alleging that the company was acting as an unregistered broker and exchange and demanding that the company be "permanently restrained and enjoined" from continuing to do so. From a report: Coinbase's flagship prime brokerage, exchange and staking programs violate securities laws, the regulator alleged in its complaint. The company "has for years defied the regulatory structures and evaded the disclosure requirements" of U.S. securities law. The SEC has alleged that at least 13 crypto assets available to Coinbase customers were considered "crypto asset securities" by the regulator. Those assets include Solana's SOL token, Cardano's token and Protocol Labs' Filecoin token. "We allege that Coinbase, despite being subject to the securities laws, commingled and unlawfully offered exchange, broker-dealer, and clearinghouse functions," said SEC chair Gary Gensler said in a statement.

schwit1 shares a report from CBS News: When whistleblower Frances Haugen pulled back the curtain on Facebook in the fall of 2021, thousands of pages of internal documents showed troubling signs that the social media giant knew its platforms could be negatively impacting youth, and were doing little to effectively change it. With around 21 million American adolescents on social media, parents took note. Now, families are suing social media. Since we first reported this story last December, the number of families pursuing lawsuits has grown to over 2,000. More than 350 lawsuits are expected to move forward this year against TikTok, Snapchat, YouTube, Roblox and Meta -- the parent company to Instagram and Facebook.

Kathleen Spence: They're holding our children hostage and they're seeking and preying on them. Sharyn Alfonsi: Preying on them? Kathleen Spence: Yes. The Spence family is suing social media giant Meta. Kathleen and Jeff Spence say Instagram led their daughter Alexis into depression and to an eating disorder at the age of 12. [...] Attorney Matt Bergman represents the Spence family. He started the Social Media Victims Law Center after reading the Facebook papers and is now working with more than 1,800 families who are pursuing lawsuits against social media companies like Meta. Matt Bergman: Time and time again, when they have an opportunity to choose between safety of our kids and profits, they always choose profits.

This summer, Bergman and his team plan on starting the discovery process for the federal case against Meta and other social media companies, a multi-million dollar suit that he says is more about changing policy than financial compensation. This summer, Bergman and his team plan on starting the discovery process for the federal case against Meta and other social media companies, a multi-million dollar suit that he says is more about changing policy than financial compensation. Matt Bergman: They have intentionally designed a product that is addictive. They understand that if children stay online, they make more money. It doesn't matter how harmful the material is.

The Securities and Exchange Commission has accused Binance, the world's largest cryptocurrency exchange, of mishandling customer funds as well as lying to regulators and investors about its operations in a sweeping case filed in federal court on Monday. From a report: The Wall Street regulator said Binance had been mixing "billions of dollars" in customer funds and secretly sending them to a separate company controlled by Binance's founder, Changpeng Zhao. The charges included misleading investors about the adequacy of its systems to detect and control manipulative trading. Regulators also said Binance did not take sufficient steps to restrict U.S. investors from accessing Binance's unregulated exchange.

"We allege that Zhao and the Binance entities not only knew the rules of the road, but they also consciously chose to evade them and put their customers and investors at risk," said Gurbir S. Grewal, director of the S.E.C.'s enforcement division. The nation's top securities regulator filed 13 charges against Binance and Mr. Zhao, better known in the crypto world as "C.Z." The S.E.C. is taking action a little over a month after the Commodities Futures Trading Commission filed its own civil enforcement action against Binance and Mr. Zhao.

An anonymous reader shared this report from Boston.com. On Thursday, Massachusetts Attorney general Andrea Campbell "began enforcing the state's new right-to-repair law following years of bitter debate and a wildly expensive ballot initiative that was approved by voters in 2020." In a nutshell, the law requires automakers selling cars in the state to provide customers and independent repair businesses with access to a type of information called "telematics." The term refers to information that is first detected by a car and then transmitted wirelessly elsewhere. This information can be used to easily ascertain problems with a vehicle...

Now, new car dealers must tell buyers what kind of data is being collected by a car's telematics system and provide them with a way to access that data. It must also be accessible to independent auto repair shops. If this does not happen, car owners and repairs shops can sue carmakers either triple damages or $10,000, whichever is greater. Manufacturers must equip vehicles starting with model year 2022 with a standardized platform for telematics data that owners can access through a mobile application. Owners can then make this information available to independent repair shops and dealers...

The lawsuit has yet to be resolved, and last week carmakers asked US District Judge Douglas Woodlock to issue a temporary restraining order that would prevent Campbell from enforcing the law. In a hearing Woodlock took issue with the law, calling its goal "likely unattainable" and that its enforcement could harm carmakers, according to the Globe. But ultimately Woodlock said that he would not block enforcement.

"The people have voted on this and that's the result," he said. "I am loath to impose my own views on the initiative."

The Associated Press reports: Customers of Venmo, PayPal and CashApp should not store their money with those apps for the long term because the funds might not be safe during a crisis, the [U.S.] Consumer Financial Protection Bureau warned Thursday...

The Federal Deposit Insurance Corporation insures bank accounts up to $250,000. But money stored in Venmo or CashApp or Apple Cash is not being held in a traditional bank account. So, if there is an event similar to a bank run with those payment apps, those funds may not be protected. Some of the funds may be eligible for pass-through insurance coverage if customers do certain activities with the apps, the CFPB said, but generally by default the apps are not covered by deposit insurance.

For example, if a customer opened a PayPal Savings account, it would have deposit insurance through PayPal's partner bank, Synchrony Bank. But the general PayPal account is not covered by insurance. For Apple Cash, which can be insured through Green Dot Bank, it requires a user to verify their identity to get deposit insurance. "We find that stored funds can be at risk of loss in the event of financial distress or failure of the entity operating the nonbank payment platform, and often are not placed in an account at a bank or credit union and lack individual deposit insurance coverage," the CFPB said in its report.

"Consumers may not fully appreciate when, or under what conditions, they would be protected by deposit insurance," the agency added in its report.

Longtime Slashdot reader MightyMartian shares a report from the New York Times: Arizona has determined that there is not enough groundwater for all of the housing construction that has already been approved in the Phoenix area, and will stop developers from building some new subdivisions (Source paywalled, alternative source), a sign of looming trouble in the West and other places where overuse, drought and climate change are straining water supplies. The decision by state officials very likely means the beginning of the end to the explosive development that has made the Phoenix area the fastest growing metropolitan region in the country. The state said it would not revoke building permits that have already been issued and is instead counting on new water conservation measures and alternative sources to produce the water necessary for housing developments that have already been approved.

Maricopa County, which includes Phoenix and its suburbs, gets more than half its water supply from groundwater. Most of the rest comes from rivers and aqueducts as well as recycled wastewater. In practical terms, groundwater is a finite resource; it can take thousands of years or longer to be replenished. The announcement of a groundwater shortage means Arizona would no longer give developers in some areas of Maricopa County new permits to construct homes that rely on wells for water.

Phoenix and nearby large cities, which must obtain separate permission from state officials for their development plans every 10 to 15 years, would also be denied approval for any homes that rely on groundwater beyond what the state has already authorized. The decision means cities and developers must look for alternative sources of water to support future development -- for example, by trying to buy access to river water from farmers or Native American tribes, many of whom are facing their own shortages. That rush to buy water is likely to rattle the real estate market in Arizona, making homes more expensive and threatening the relatively low housing costs that had made the region a magnet for people from across the country.

An anonymous reader quotes a report from TorrentFreak: A Virginia jury held Cox liable for pirating subscribers because it failed to terminate accounts after repeated accusations, ordering the company to pay $1 billion in damages to the labels. This landmark ruling is currently under appeal. As part of the appeal, Cox informed the court of a supplemental authority that could support its position. The case in question is Twitter vs. Taamneh, in which the U.S. Supreme Court recently held that the social media platform isn't liable for ISIS terrorists, who used Twitter to recruit and raise funds. The Supreme Court rejected (PDF) the claim that Twitter aided-and-abetted terrorist activity, because it didn't "consciously and culpably" participate in the illegal activity. According to Cox, the same logic applies in its case, where the ISP was held liable for the piracy activities of subscribers.

"These same aiding-and-abetting principles animate copyright law's contributory liability doctrine, and they likewise foreclose liability here," an attorney for Cox informed the court. Cox argues that the Supreme Court ruling confirms that aiding-and-abetting liability only applies when parties knowingly took part in the activity. That runs contrary to the finding in its own dispute with the record labels, where "culpable expression and conduct" or "intent" were not required. "Though Twitter arises in a different context, its reasoning applies with full force and supports reversal of the contributory infringement verdict," Cox added. The two cases are indeed quite different, but ultimately they are about imposing liability on third-party services.

According to Cox, the Twitter terrorist ruling clearly shows that it isn't liable for pirating subscribers, but the music companies see things differently. Earlier this week, the music labels responded in court (PDF), countering Cox's arguments. They argue that the Twitter ruling doesn't apply to their piracy dispute with Cox, as the cases are grounded in different laws. While the music industry certainly isn't happy with pirates, the Cox case is a copyright matter while the Twitter lawsuit fell under the Justice Against Sponsors of Terrorism Act. And for now, pirates are not categorized as terrorists. After establishing the difference between pirates and terrorists, the music companies point out that Twitter wasn't directly connected to the misconduct. The platform's role was more passive and its connection to ISIS was more distant than Cox's connection to its subscribers. Cox took a more active role and materially contributed to the pirating activities, which stands no comparison to the Twitter case, plaintiffs argue.

An anonymous reader quotes a report from Reuters: A federal judge in Texas is now requiring lawyers in cases before him to certify that they did not use artificial intelligence to draft their filings without a human checking their accuracy. U.S. District Judge Brantley Starr of the Northern District of Texas issued the requirement on Tuesday, in what appears to be a first for the federal courts. In an interview Wednesday, Starr said that he created the requirement to warn lawyers that AI tools can create fake cases and that he may sanction them if they rely on AI-generated information without verifying it themselves. "We're at least putting lawyers on notice, who might not otherwise be on notice, that they can't just trust those databases. They've got to actually verify it themselves through a traditional database," Starr said.

In the notice about the requirement on his Dallas court's website, Starr said generative AI tools like ChatGPT are "incredibly powerful" and can be used in the law in other ways, but they should not be used for legal briefing. "These platforms in their current states are prone to hallucinations and bias. On hallucinations, they make stuff up -- even quotes and citations," the statement said. The judge also said that while attorneys swear an oath to uphold the law and represent their clients, the AI platforms do not. "Unbound by any sense of duty, honor, or justice, such programs act according to computer code rather than conviction, based on programming rather than principle," the notice said.

Starr said on Wednesday that he began drafting the mandate while attending a panel on artificial intelligence at a conference hosted by the 5th Circuit U.S. Court of Appeals, where the panelists demonstrated how the platforms made up bogus cases. The judge said he considered banning the use of AI in his courtroom altogether, but he decided not to do so after conversations with Eugene Volokh, a law professor at the UCLA School of Law, and others. Volokh said Wednesday that lawyers who use other databases for legal research might assume they can also rely on AI platforms. "This is a way of reminding lawyers they can't assume that," Volokh said. Starr issued the requirement days after another judge threatened to sanction a lawyer for using ChatGPT to help write court filings that cited six nonexistent cases.

Microsoft has warned investors about a "non-public" draft decision by Irish regulators against LinkedIn for allegedly dodgy ad data practices, explaining it had set aside some cash to pay off any potential fine. From a report: How much? Oh, a mere $425 million. The software giant said the funds were connected to a 2018 investigation by the Irish Data Protection Commission (IDPC) looking into whether LinkedIn's targeted advertising practices violated the the European Union's General Data Protection Regulation (GDPR). At the time of the complaint, the 2016 law had been recently implemented and the watchdog was just settling into its role as EU overlord of judging data practices of the tech giants. Microsoft denies it broke any GDPR rules and said it "intends to defend itself vigorously in this matter."

Google Wallet on Android is finally getting ready for your digital driver's license and other US state IDs. Google says the feature is rolling out this month, and it will slowly start bringing states online this year. From a report: Of course, your state has to be one of the few that actually supports digital IDs. Google says Maryland residents can use the feature right now and that "in the coming months, residents of Arizona, Colorado and Georgia will join them." The road to digital driver's license support has been a long one, with the "Identity Credential API" landing in Android 11 back in 2020. Since then it has technically been possible for states to make their own ID app.

Now Google Wallet, Google's re-re-reboot of its payment app, is providing a first-party way to store an ID on your phone. Some parts of the Identity Credential API landed in Google Play Services (Google's version-agnostic brick of APIs), so Wallet supports digital IDs going back to Android 8.0, which covers about 90 percent of Android devices. Maryland has supported Digital IDs on iOS for a while, which gives us an idea of how this will work. An NFC transfer is enough to beam your credentials to someone, where you can just tap against a special NFC ID terminal and confirm the transfer with your fingerprint. Wallet has an NFC option, along with a "Show code" option that will show the traditional driver's license barcode.

Stock photo provider Getty Images has asked London's High Court for an injunction to prevent artificial intelligence company Stability AI from selling its AI image-generation system in Britain, court filings show. From a report: The Seattle-based company accuses the company of breaching its copyright by using its images to "train" its Stable Diffusion system, according to the filing dated May 12. Stability AI has yet to file a defence to Getty's lawsuit, but filed a motion to dismiss Getty's separate U.S. lawsuit last month. It did not immediately respond to a request for comment.

Airbnb has sued New York City in an attempt to overturn strict new regulations that restrict short-term rentals, claiming that the rules are "extreme and oppressive." The New York Times reports: A new law, passed by the city in 2021, sought to prevent illegal short-term rentals by requiring hosts to register with the city. Short-term rentals -- for fewer than 30 consecutive days -- have largely been barred if hosts are not present, according to state law, though the city and Airbnb have disagreed about how expansive such prohibitions and other complicated city codes should be. The city said it would start enforcing the law in July.

In the lawsuit filed on Thursday, Airbnb called the new scheme "extreme and oppressive" and said it clashes with a federal law that has shielded many tech platforms from liability for content posted by its users. Three Airbnb hosts also filed similar lawsuits, arguing that the rules were so complicated that nearly all hosts, even those who intended to be present when guests were around, would be unable to use the platform. The city said it was reviewing the lawsuit. "This administration is committed to protecting safety and community livability for residents, preserving permanent housing stock, and ensuring our hospitality sector can continue to recover and thrive," Jonah Allon, a spokesman for the mayor, said in a statement.

Apple is denying claims made by Russia's Federal Security Service (FSB) that it cooperated with American spies to surveil Russian iPhone users. From a report: In a statement, the company said it has "never worked with any government to insert a backdoor into any apple product and never will."

The US Department of Energy has announced that eight American companies working on nuclear fusion energy will receive $46 million in government funding to pursue pilot plants aimed at generating power from fusion reactions. Reuters reports: The Energy Department's Milestone-Based Fusion Development Program hopes to help develop pilot-scale demonstration of fusion within a decade. "The Biden-Harris Administration is committed to partnering with innovative researchers and companies across the country to take fusion energy past the lab and toward the grid," Energy Secretary Jennifer Granholm said in a release. The awardees are: Commonwealth Fusion Systems, Focused Energy Inc, Princeton Stellarators Inc, Realta Fusion Inc, Tokamak Energy Inc, Type One Energy Group, Xcimer Energy Inc, and Zap Energy Inc

The funding, which comes from the Energy Act of 2020, is for the first 18 months. Projects may last up to five years, with future funding contingent on congressional appropriations and progress from the companies in meeting milestones.

Looking to launch fusion plants that use lasers or magnets, private companies and government labs spent $500 million on their supply chains last year, according to a Fusion Industry Association (FIA) survey. They plan to spend about $7 billion by the time their first plants come online, and potentially trillions of dollars mainly on high-grade steel, concrete and superconducting wire in a mature industry, estimated to be sometime between 2035 and 2050, the survey said.

A new report has revealed that a government agency in the US, namely the Drug Enforcement Agency (DEA), is allegedly using a spyware called Paragon Graphite that shares similarities with the notorious Pegasus spyware. From a report: Pegasus was sold off to the government and other law firms. Moreover, we saw the firm making plenty of purchases through the likes of hackers. The software tends to give in to exploitation that can be achieved through zero clicks, all thanks to the great skill of hackers. Moreover, such software can produce its target without any interaction. [...] New reports by the Financial Times stated how the American Government makes use of this technology as it can pierce all sorts of protections linked to modern-day smart devices. Similarly, it can evade various forms of encryption for messaging applications such as WhatsApp and harvest data thanks to the likes of cloud backups. And yes, it's very similar to its counterpart Pegasus in this ordeal.

For now, the DEA is awfully hushed on the matter and not releasing any more comments on this situation. But it did reveal how its agency ended up purchasing Graphite to be used by agencies in Mexico so they could curb the drug cartel situation. "According to four [industry figures], the US Drug Enforcement and Administration Agency is among the top customers for Paragon's signature product nicknamed Graphite," reports the Financial Times. "The malware surreptitiously pierces the protections of modern smartphones and evades the encryption of messaging apps like Signal or WhatsApp, sometimes harvesting the data from cloud backups -- much like Pegasus does."

The report adds: "Congressman Adam Schiff, the chair of the House Intelligence Committee, wrote to the DEA in December asking for more details on the purchase. Mexico is among the worst abusers of NO's Pegasus which it bought nearly a decade ago.

Schiff wrote: "such use [of spyware] could have potential implications for US national security, as well as run contrary to efforts to deter the broad proliferation of powerful surveillance capabilities to autocratic regimes and others who may misuse them."