The Category5.TV Newsroom

Here are the stories we're following for the week of Wednesday January 24, 2018

OnePlus confirmed on Friday that thieves have siphoned tens of thousands of credit card numbers from its online store.

OnePlus confirmed on Friday that thieves have siphoned tens of thousands of credit card numbers from its online store.

The Chinese phone company admitted after a week of probing that about 40,000 of its customers had their payment card details nicked while they were buying stuff from its web shop.

Crooks were quick to start plundering victims' accounts using the swiped information—going on shopping sprees with the stolen card data.

Here's how it went down: One of the store's servers was hacked, and its code modified so that between mid-November, 2017, and January 11th of this year, bank card details that were typed into oneplus.net by shoppers, were copied, and then sent over to miscreants.

Specifically, the software was tampered with to harvest the numbers, names, and security codes on cards before they were encrypted and sent to OnePlus's payment processor. The server has since been quarantined, and the malicious code removed.

OnePlus said people who opted to use PayPal were not affected, nor was anyone who had paid with a credit card they had "saved" to the site prior to November 11th, because those cards had already been encrypted by the payment provider and saved only as tokens by OnePlus.

Source: www.theregister.co.uk

Sent to us by: Roy W. Nash

Buses used to transport Apple employees to their offices have had their windows smashed, possibly by pellet guns.

Buses used to transport Apple employees to their offices have had their windows smashed, possibly by pellet guns.

There have been several such attacks on the morning and evening commutes to and from Apple headquarters in the Californian city of Cupertino.

Local news website SFGate reported that a Google bus had also been targeted.

There have been no reported injuries and there is no suggestion that the perpetrator is targeting a particular company.

The attacks could be linked to previous ill-feeling about how the tech sector is causing a gentrification of San Francisco and the surrounding area.

In 2013, a bus carrying Google employees also had its windows smashed, followed by protests over how the well-paid tech sector had pushed up house prices in the city.

The current attacks all took place on Highway 280 with reports suggesting that Apple is now diverting its buses from that road; adding 30 to 45 minutes to the commute.

Source: www.bbc.com

Sent to us by: Roy W. Nash

A new botnet is infecting cryptocurrency mining computers and replacing wallet addresses with its own.

Satori—the malware family that wrangles routers, security cameras, and other Internet-connected devices into potent botnets—is crashing the cryptocurrency party with a new variant that secretly infects computers dedicated to the mining of digital coins.

A version of Satori that appeared earlier this month exploits weaknesses in the Claymore Miner.

After gaining control of the coin-mining software, the malware replaces the wallet address the computer owner uses to collect newly minted currency with an address controlled by the attacker. From then on, the attacker receives all the coins generated, and owners are none the wiser unless they take time to manually inspect their software configuration.

Records show that the attacker-controlled wallet has already cashed out slightly more than 1 Etherium coin that was valued at as much as $1,300 when the transaction was made.

The records also showed that the attacker is actively mining more, with a calculation power of about 2.1 billion hashes per second. That's roughly equivalent to the output of 85 computers each running a Radeon Rx 480 graphics card—or more than 1,100 computers running a GeForce GTX 560M.

It's not clear precisely how the new variant is infecting mining computers. What is known is that Satori "works primarily on the Claymore Mining equipment that allows management actions on 3333 ports with no password authentication enabled (which is the default config)."

Source: arstechnica.com

Sent to us by: Roy W. Nash

A remote controlled drone in Australia saved 2 boys in the water on its first day of use by lifeguards.

We've reported in the past about neat ways that drones can be used—like a combination defibrillator and first aid kit than can fly into disaster areas much more quickly than emergency responders . . . but now, put to the test in Australia, "Little Ripper," the lifeguard drone, saved not one but two young boys on its first day in service.

Little Ripper is a remote controlled multicopter that carries a floatation device. On its first day of service off the coast of Lennox Head in Australia, the drone was used to drop a floatation device for two boys in distress.

Traditionally, life guards would have had a great deal of trouble reaching the boys, who were struggling in the waves far out from shore. It's estimated that it would have taken lifeguards at least 6 minutes to reach them. But the drone, controlled by an on-shore lifeguard, reached them in only 70 seconds.

The lifeguard launched the drone, spotted the boys, flew it over to them, and remotely dropped the flotation device. The boys were able to grab it and swim to shore.

The drone is manufactured by a company called Little Ripper Lifesaver, founded by Kevin Weldon, after he witnessed a drone canvassing the streets of New Orleans after Hurricane Katrina and realized its lifesaving potential. The Marine Pod that was dropped in this case contained a water-triggered flotation device, which is repackable and reusable. The company is now testing a saltwater-activated electromagnetic shark-repellent device, with plans to include it in future kits.

Source: boingboing.net

Sent to us by: Rachel Xu