The Federal Trade Commission will announce Monday that it's launching a new inquiry into the privacy and data collection practices of major tech firms including Amazon, TikTok owner ByteDance, Twitter, YouTube and Facebook as well as its subsidiary WhatsApp, Axios reported Monday. From the report: The move comes amid broader scrutiny for the industry and appears to be a wide-reaching inquiry into everything major tech companies know about their users and what they do with that data, as well as their broader business plans. The FTC is asking for a large trove of information and documents from the above platforms, plus Discord, Reddit and Snap. The agency wants much of the usage and engagement data the platforms collect on their users, the metrics they use for measuring such things and short- and long-term business strategies, among many other areas of inquiry. In launching the study, the FTC is using its authority to do wide-ranging studies for no specific law enforcement purpose.

Sunday Reuters reported that "a sophisticated hacking group" backed by "a foreign government" has stolen information from America's Treasury Department, and also from "a U.S. agency responsible for deciding policy around the internet and telecommunications."

The Washington Post has since attributed the breach to "Russian government hackers," and discovered it's "part of a global espionage campaign that stretches back months, according to people familiar with the matter." Officials were scrambling over the weekend to assess the extent of the intrusions and implement effective countermeasures, but initial signs suggested the breach was long-running and significant, the people familiar with the matter said. The Russian hackers, known by the nicknames APT29 or Cozy Bear, are part of that nation's foreign intelligence service and breached email systems in some cases, said the people familiar with the intrusions, who spoke on the condition of anonymity because of the sensitivity of the matter. The same Russian group hacked the State Department and the White House email servers during the Obama administration... [The Washington Post has also reported this is the group responsible for the FireEye breach. -Ed]

All of the organizations were breached through the update server of a network management system called SolarWinds, according to four people familiar with the matter. The company said Sunday in a statement that monitoring products it released in March and June of this year may have been surreptitiously weaponized with in a "highly-sophisticated, targeted...attack by a nation state." The scale of the Russian espionage operation is potentially vast and appears to be large, said several individuals familiar with the matter. "This is looking very, very bad," said one person. SolarWinds products are used by more than 300,000 organizations across the world. They include all five branches of the U.S. military, the Pentagon, State Department, Justice Department, NASA, the Executive Office of the President and the National Security Agency, the world's top electronic spy agency, according to the firm's website. SolarWinds is also used by the top 10 U.S. telecommunications companies...

APT29 compromised the SolarWinds server that sends updates so that any time a customer checks in to request an update, the Russians could hitch a ride on that update to get into a victim's system, according to a person familiar with the matter. "Monday may be a bad day for lots of security teams," tweeted Dmitri Alperovitch, a cybersecurity expert and founder of the Silverado Policy Accelerator think tank.
Reuters described the breach as "so serious it led to a National Security Council meeting at the White House."

Pig Hogger (Slashdot reader #10,379) writes: Everywhere, every day, thousands of phones are plugged-into forensic tools that will pull out everything a phone has to offer an investigator. The thing is, investigators are not always working for police departments, but for school districts, who have been increasinly buying various phone hacking tools.
Gizmodo writes: Public documents reviewed by Gizmodo indicate that school districts have been quietly purchasing these surveillance tools of their own for years... Known as mobile device forensic tools (MDFTs), this type of tech is able to siphon text messages, photos, and application data from student's devices. Together, the districts encompass hundreds of schools, potentially exposing hundreds of thousands of students to invasive cell phone searches.

While companies like Cellebrite have partnered with federal and local police for years, that the controversial equipment is also available for school district employees to search students' personal devices has gone relatively unnoticed — and serves as a frightening reminder of how technology originally developed for use by the military or intelligence services, ranging from blast-armored trucks designed for use in war zones to invasive surveillance tools, keeps trickling down to domestic police and even the institutions where our kids go to learn. "Cellebrites and Stingrays started out in the provenance of the U.S. military or federal law enforcement, and then made their way into state and local law enforcement, and also eventually make their way into the hands of criminals or petty tyrants like school administrators," Cooper Quentin, senior staff technologist at the Electronic Frontier Foundation, said in a video interview. "This is the inevitable trajectory of any sort of surveillance technology or any sort of weapon...."

Gizmodo analyzed a random sample of 5,000 public school or school district websites across the United States and found that eight district websites mention Cellebrite or another MDFT technology. Because our sample is a relatively small portion of the total number of high schools in the United States — and the ones that stood out did so because they published the purchases as line items in public budget reports — many other school districts may have access to this technology. The Los Angeles Unified School District, the second-largest school district in the country with over 630,000 students enrolled in over 1,000 institutions in the 2018-2019 school year, has a Cellebrite device it says is used by a team that investigates complaints of employee misconduct against students...

Ultimately, Gizmodo's investigation turned up more questions than answers about why school districts have sought these devices and how they use them. Who is subject to these searches, and who is carrying them out? How many students have had their devices searched and what were the circumstances? Were students or their parents ever asked to give any kind of meaningful consent, or even notified of the phone searches in the first place? What is done with the data afterward? Can officials retain it for use in future investigations?

Most of the school districts did not respond to our inquiries.

Reuters reports that "a sophisticated hacking group" backed by "a foreign government" has stolen information from America's Treasury Department, and also from "a U.S. agency responsible for deciding policy around the internet and telecommunications." There is concern within the U.S. intelligence community that the hackers who targeted the Treasury Department and the Commerce Department's National Telecommunications and Information Administration used a similar tool to break into other government agencies, according to three people briefed on the matter.

The hack is so serious it led to a National Security Council meeting at the White House on Saturday, said one of the people familiar with the matter.

"Cloudflare, Apple, and Fastly have co-designed and proposed a new DNS standard to tackle ongoing privacy issues associated with DNS," reports ZDNet.

Cloudflare calls it "a practical approach for improving privacy" that "aims to improve the overall adoption of encrypted DNS protocols without compromising performance and user experience..." Third-parties, such as ISPs, find it more difficult to trace website visits when DNS over HTTPS (DoH) is enabled. DoH deployment is on the cards for many major browser providers, although rollout plans are ongoing. Now, Oblivious DNS over HTTPS (ODoH) has been proposed by Cloudflare — together with partners PCCW Global, Surf, and Equinix — to improve on these models by adding an additional layer of public key encryption and a network proxy...

The overall aim of ODoH is to decouple client proxies from resolvers. A network proxy is inserted between clients and DoH servers — such as Cloudflare's 1.1.1.1's public DNS resolver — and the combination of both this and public key encryption "guarantees that only the user has access to both the DNS messages and their own IP address at the same time," according to Cloudflare... "The client behaves as it does in DNS and DoH, but differs by encrypting queries for the target, and decrypting the target's responses..."

Test clients for the code have been provided to the open source community to encourage experimentation with the proposed standard. It can take years before support is enabled by vendors for new DNS standards, but Eric Rescorla, Firefox's CTO, has already indicated that Firefox will "experiment" with ODoH.

An anonymous Slashdot reader writes: For the past year, hackers have been breaking into MySQL databases, downloading tables, deleting the originals, and leaving ransom notes behind, telling server owners to contact the attackers to get their data back. If database owners don't respond and ransom their data back in nine days, the databases are then put up on auction on a dark web portal.
"More than 85,000 MySQL databases are currently on sale on a dark web portal for a price of only $550/database," reports ZDNet: This suggests that both the DB intrusions and the ransom/auction web pages are automated and that attackers don't analyze the hacked databases for data that could contain a higher concentration of personal or financial information. Signs of these ransom attacks have been piling up over the course of 2020, with the number of complaints from server owners finding the ransom note inside their databases popping up on Reddit, the MySQL forums, tech support forums, Medium posts, and private blogs.

Long-time Slashdot reader zoobab shares this update about the long-standing Foundation for a Free Information Infrastructure, a Munich-based non-profit opposing ratification of a "Unified Patent Court" by Germany: The FFII is crowdfunding a constitutional complaint in Germany against the third attempt to impose software patents in Europe, calling on all software companies, independent software developers and FLOSS authors to donate.

The Unitary Patent and its Court will promote patent trolls, without any appeal possible to the European Court of Justice, which won't be able to rule on patent law, and software patents in particular. The FFII also says that the proposed court system will be more expensive for small companies then the current national court system.
The stakes are high — so the FFII writes that they're anticipating some tricky counter-maneuvering: Stopping the UPC in Germany will be enough to kill the UPC for the whole Europe... German government believe that they can ratify before the end of the year, as they consider the UK still a member of the EU till 31st December. The agenda of next votes have been designed on purpose to ratify the UPC before the end of the year. FFII expects dirty agenda and political hacks to declare the treaty "into force", dismiss "constitutional complaints", while the presence of UK is still problematic.

An anonymous reader quotes a report from Ars Technica: Facebook said it has linked an advanced hacking group widely believed to be sponsored by the government of Vietnam to what's purported to be a legitimate IT company in that country. The so-called advanced persistent threat group goes under the monikers APT32 and OceanLotus. It has been operating since at least 2014 and targets private sector companies in a range of industries along with foreign governments, dissidents, and journalists in South Asia and elsewhere. It uses a variety of tactics, including phishing, to infect targets with fully featured desktop and mobile malware that's developed from scratch. To win targets' confidence, the group goes to great lengths to create websites and online personas that masquerade as legitimate people and organizations.

Earlier this year, researchers uncovered at least eight unusually sophisticated Android apps hosted in Google Play that were linked to the hacking group. Many of them had been there since at least 2018. OceanLotus repeatedly bypassed Google's app-vetting process, in part by submitting benign versions of the apps and later updating them to add backdoors and other malicious functionality. FireEye published this detailed report on OceanLotus in 2017, and BlackBerry has more recent information here. On Thursday, Facebook identified Vietnamese IT firm CyberOne Group as being linked to OceanLotus. The group lists an address in Ho Chi Minh city.

Email sent to the company seeking comment returned an error message that said the email server was misconfigured. A report from Reuters on Friday, however, quoted a person operating the company's now-suspended Facebook page as saying: "We are NOT Ocean Lotus. It's a mistake." At the time this post went live, the company's website was also unreachable. An archive of it from earlier on Friday is here.

"It's taken over 50 years, but the solution to the Zodiac Killer's cipher has been found," writes Slashdot reader quonset. CNN reports: Dubbed the "340 cipher," the message was unraveled by a trio of code breakers -- David Oranchak, a software developer in Virginia, Jarl Van Eycke, a Belgian computer programmer, and Sam Blake, an Australian mathematician. The Zodiac Killer is most known for leaving a trail of five unsolved murders between 1968 and 1969. He was never caught, but he gained notoriety by writing letters to police and local media up until 1974, sometimes in code, boasting of the killings. Bloody bits of clothing were included with his letters as proof of his actions. He claims he killed as many as 37 people.

Oranchak detailed the process for cracking the cipher on his website and in a YouTube video, where he used a specifically developed decryption software and a bit of luck to finally make the connection. The team used a unique program to sift through 650,000 variations of the message. In one, a couple of words appeared. "We got really lucky and found one that had part of the answer, but it wasn't obvious," Oranchak said, explaining that they then had to handpick their way through to decipher the rest of the message. The only disappointing part, Oranchak said, is that the missive contained no personally identifying information. Oranchak holds out no hope for solving the two remaining ciphers. He described the mission as "almost hopeless," as both are very short, with thousands of different names and phrases that could fit.

Friday night America's Food and Drug Administration finally authorized Pfizer and BioNTech's coronavirus vaccine for emergency use in the United States, reports CNN.

The Verge calls it "a landmark moment in the fight to suppress a virus that has killed nearly 300,000 people in the United States and sickened tens of millions around the world." The vaccine is authorized in the U.S. for people over the age of 16. It was found to be 95 percent effective at preventing symptomatic COVID-19 in clinical trials. "That is extraordinary," Anthony Fauci, director of the National Institute for Allergy and Infectious Diseases, said in a press conference at the end of November. It's far better than experts had dared hope for. The FDA was prepared to authorize a vaccine as long as it was at least 50 percent effective. "We were shocked," Pfizer's chief executive officer, Albert Bourla, told The New York Times. "We couldn't believe it."

The shot appears to protect people against the most severe forms of the disease. It is also highly effective in people over the age of 65, who are particularly vulnerable to COVID-19. Scientists will continue to monitor the vaccine after it's deployed to see how well it works in the real world.... The Pfizer and BioNTech vaccine has already been authorized by regulatory authorities in the United Kingdom, Canada, and Bahrain.

The authorizations of this vaccine, which have come less than a year after development began, shatter the record for the fastest vaccine developed. The record was previously held by the mumps vaccine, which took four years.

Earlier this week, Florida state police raided the home of Rebekah Jones, the data scientist who ran the state's coronavirus dashboard until she was fired in June. "Jones has alleged in a whistleblower lawsuit that her firing was in retaliation for her refusal to manipulate data to make the state's COVID-19 outbreak last spring appear less severe," reports Yahoo News. Florida Gov. Ron DeSantis angrily defended the handling of the search warrant, saying: "Obviously, she has issues." From the report: Later, when another reporter asked about Monday's incident -- a recording of which was made by Jones and went viral on social media, drawing widespread outrage -- DeSantis grew visibly irritated. "It was not a raid," the governor said, at one point thrusting a finger and raising his voice at the reporter who asked about the Jones case. "They went, they followed protocol." He said the Gestapo comparison was especially offensive. In keeping with his Trumpian approach to politics, DeSantis also denounced the "fever swamps" of the internet -- his apparent term for mainstream media outlets like the New York Times and Washington Post -- for turning Jones into a "darling" of, presumably, anti-Trump progressives. ("He threw me into the public spotlight," Jones told Yahoo News in response to that accusation. "I never wanted it.")

Officers executed a search warrant on Jones's home on Monday morning, after knocking on her door for several minutes before she opened it and came outside with her hands up. Jones has said she wanted to settle her children before acknowledging the officers. It is not clear why the officers drew their weapons to go inside. They left with laptops and cellphones, which were being sought as part of an investigation into a Nov. 10 message sent to Florida Department of Health employees, encouraging them to resist DeSantis. State authorities allege that digital fingerprints indicate that Jones, who now runs a coronavirus dashboard of her own, was behind the message. Jones denies she was the author and maintains she did not have the means to access the department's emergency notification system, through which the note was sent. Users on Reddit have discovered that the emergency system would have been easy to access, and that anyone else -- not just Jones -- could have accessed the system and sent the Nov. 10 message with relative ease.

Republican senator Thom Tillis has introduced a proposal to turn unauthorized commercial streaming of copyrighted material into a felony offense with a possible prison sentence. It's currently being included in a must-pass spending bill. Kotaku reports: Currently, such violations, no matter how severe, are considered misdemeanors rather than felonies, because the law regards streaming as a public performance. With Twitch currently in the crosshairs of the music industry, such a change would turn up the heat on streamers and Twitch even higher -- perhaps to an untenable degree. Other platforms, like YouTube, would almost certainly suffer as well. According to [Politico offshoot Protocol], House and Senate Judiciary Committees have agreed to package the streaming felony proposal with other controversial provisions that include the CASE act, which would establish a new court-like entity within the U.S. Copyright Office to resolve copyright disputes, and the Trademark Modernization Act, which would give the U.S. Patent and Trademark Office more flexibility to crack down on illegitimate claims from foreign countries.

It's not difficult to see why Tillis would push a proposal that benefits big companies in the entertainment industry to the detriment of regular people; The American Prospect points out that in the past couple years, Tillis' campaign committee and leadership received donations totaling out to well over $100,000 from PACs with ties to the Motion Picture Association, Sony Pictures, Universal Music Group, Comcast & NBC Universal, The Internet and Television Association, Salem Media Group, and Warner Music, among many others.

A key Food and Drug Administration advisory panel on Thursday recommended the approval of Pfizer and BioNTech's coronavirus vaccine for emergency use in people over 16 years old, the last step before the FDA gives the final OK to broadly distribute the first doses throughout the United States. CNBC reports: If the FDA accepts the nonbinding recommendation from the Vaccines and Related Biological Products Advisory Committee -- which is expected -- it would mark a pivotal moment in the Covid-19 pandemic, which has infected more than 15.4 million people and killed roughly 290,000 in the U.S. in less than a year. The committee plays a key role in approving flu and other vaccines in the U.S., verifying the shots are safe for public use. While the FDA doesn't have to follow the advisory committee's recommendation, it often does.

The FDA could grant emergency use authorization of Pfizer's vaccine as early as Friday, James Hildreth, a member of the committee, told NBC's "Weekend Today" on Saturday. An emergency use authorization, or EUA, generally allows a drug or vaccine to be administered to a limited population or setting, such as to hospitalized patients, as the agency continues to evaluate safety data. It's unclear whether the FDA will authorize Pfizer and BioNTech's vaccine for use in certain groups. Some people, including pregnant women and young children, will likely have to wait to get the vaccine in the U.S. until Pfizer can finish trials on those specific groups. The FDA said Tuesday that there is currently insufficient data to make conclusions about the safety of the vaccine in children under age 16, pregnant women and people with compromised immune systems. Regulators in Canada, the U.K. and Bahrain have all cleared the vaccine for use by most adults.

An anonymous reader quotes a report from Ars Technica: Brave Software, maker of the Brave Web browser, is introducing a news reader that's designed to protect user privacy by preventing parties -- both internal and third party -- from tracking the sites, articles, and story topics people view. Brave Today, as the service is called, is using technology that the company says sets it apart from news services offered by Google and Facebook. It's designed to deliver personalized news feeds in a way that leaves no trail for Brave, ISPs, and third parties to track. The new service is part of Brave's strategy of differentiating its browser as more privacy-friendly than its competitors'.

Key to Brave Today is a new content delivery network the company is unveiling. Typically, news services use a single CDN to cache content and then serve it to users. This allows the CDN or the service using it to see both the IP address and news feed of each user, and over time, that data can help services build detailed profiles of a person's interests. The Brave Today CDN takes a different approach. It's designed in a way that separates a user's IP address from the content they request. One entity offers a load-balancing service that receives TLS-encrypted traffic from the user. The load balancer then passes the traffic on to the CDN that processes the request.

The load balancer knows the user's IP address but, because the request is encrypted, has no visibility into the content the user is seeking. The CDN, meanwhile, sees only the request but has no way of knowing the IP address that's making it. Responses are delivered in reverse order. To prevent the data from being combined, Brave says that it will use one provider for load balancing and a different one for content delivery. To prevent the load-balancing provider from using the size of the requests and responses to infer the contents of the encrypted data, the service will also use a technique called padding, which adds characters to the plaintext before it's encrypted. The CDN uses several other techniques to preserve the anonymity of users. Among them: stripping out various headers that could be used to identify the person making the request. Furthermore, Brave is also taking steps to shield user information from its own employees. "... [T]he company has configured its account with the load-balancing provider to restrict access to its logging resources," reports Ars. "The load-balancing provider also doesn't provide the ability for customers to use the proxy protocol to inject the requester's IP address into outgoing requests. In case that changes, however, Brave has also entered into a contract with the load balancer that restricts access to logs or use of the protocol, even if Brave asks."

The iPhone's original -- and unofficial -- app store has sued Apple, accusing the company of having a monopoly on the distribution of apps. Cydia, an app store created and launched in 2007 by Jay "Saurik" Freeman, one of the original jailbreakers filed the lawsuit against Apple on Thursday. From a report: "Were it not for Apple's anti competitive acquisition and maintenance of an illegal monopoly over iOS app distribution, users today would actually be able to choose how and where to locate and obtain iOS apps, and developers would be able to use the iOS app distributor of their choice," the lawsuit reads. Before Apple created the App Store, Freeman and a group of iPhone hackers created an unofficial app store where users that were willing to jailbreak -- a technique to exploit one or more bug to disable the iPhone security mechanism called code-signing enforcement that allows for only Apple-approved code to run on the phone -- could download and install apps. In 2010, according to Freeman, Cydia had around 4.5 million users.

At Chrome Dev Summit 2020 today, Google announced it will change how extensions access data and how extension permissions work in 2021. On January 18, a day before the release of Chrome 88, Google will require that every extension publicly display its privacy practices and will limit what developers can do with the data they collect. From a report: The first change means that Chrome users next year will determine which websites an extension can access when they browse the web. Once you grant an extension permission to access a website's data, that preference can be saved for that domain. Today, the extension makes that call. In 2021, you will still be able to grant an extension access to all the websites you visit, but that won't be the default. Google outlined the second change last month: "each extension's detail page in the Chrome Web Store will show developer-provided information about the data collected by the extension, in clear and easy to understand language." The company also updated its user data privacy policy with an addition to how extension developers use data they collect.

An anonymous reader quotes a report from Reuters: Germany, France, Spain and ten other EU countries have joined forces to invest in processors and semiconductor technologies, key to internet-connected devices and data processing, in a push to catch up with the United States and Asia. Europe's share of the 440-billion-euro ($533 billion) global semiconductor market is around 10%, with the EU currently relying on chips made abroad. The 13 countries said they would work together to bolster Europe's electronics and embedded systems value chain. The group will reach out to companies to form industrial alliances for research and investment into designing and making processors and look into funding for such projects. It will also come up with a European-wide scheme known as an Important Project of Common European Interest which allows for funding under looser EU state aid rules. The group will seek to set up common standards and certification for electronics. The signatories include Belgium, Croatia, Estonia, Finland, Greece, Italy, Malta, the Netherlands, Portugal and Slovenia.

A French judge has sentenced the founder of the now-defunct BTC-e cryptocurrency exchange to five years in prison and a fine of $121,000 for laundering funds for cybercriminals, including ransomware gangs, ZDNet France reported today. From the report: Alexander Vinnik, 41, a Russian national, dodged a bigger sentence after French prosecutors failed to prove that the BTC-e founder was directly involved in the creation and the distribution of Locky, a ransomware strain that was active in 2016 and 2017. "Mr. Vinnik, the court acquitted you of the offenses relating to the cyber-attacks linked to Locky, as well as the offenses of extortion and association to criminal activities, but finds you guilty of organized money laundering," the judge said when reading the sentence. innik was trialed in Paris this fall after a long and complicated legal battle. He was initially arrested in July 2017 while vacationing in a summer resort in northern Greece. He was taken into custody by Greek police under an international warrant issued by the US for his involvement in running BTC-e, a cryptocurrency exchange that Vinnik founded in 2011, together with fellow Russian national Aleksandr Bilyuchenko. US authorities said Vinnik operated BTC-e as a front company for a money-laundering operation, knowingly receiving funds from hacks and other forms of cybercrime and helping crooks cash out stolen funds into fiat currency.

FriendlySolipsist writes: Independent journalist Rebekah Jones, a scientist fired by the Florida state government because, she said, of her refusal to manipulate official COVID-19 data releases to coincide with political considerations and who now operates website floridacovidaction.com, had her home raided by the FL state police who seized computers and cellphones, the Miami Herald reported. The FDLE affidavit in support of the raid was published by the Miami Herald and asserts that an unauthorized internal message was sent to the "ReadyOps" system within the state Department of Health from an IPv6 address associated with the Comcast account at Jones residence. "The Florida Department of Law Enforcement on Monday raided the home of a former Department of Health data analyst who has been running an alternative web site to the state's COVID dashboard, alleging that she may have broken into a state email system and sent an unauthorized message to employees," reports the Miami Herald. "But Rebekah Jones, who was was fired from her job in May as the geographic information system manager for DOH's Division of Disease Control and Health Protection and who has since filed a whistleblower complaint against the state, denied having any role in the alleged intrusion into the state web site and instead said she believes Monday's action was intended to silence her."

Slashdot reader mtrachtenberg shares a thread on Twitter of Jones describing what happened.

Copyright lawyer Richard Liebowitz has been repeatedly sanctioned by federal courts. The controversial attorney has a long track record of disregarding court orders. To protect the public from future missteps, the grievance committee of the Southern District of New York has decided to suspend Liebowitz until further order.