


LinkedIn Pauses New Sign-Ups in China To Review Compliance (bloomberg.com) 9

Despite Microsoft Patch, US Gov't Warns of 'Active Threat Still Developing' From Open Back Doors (reuters.com) 26
While Microsoft released a patch last week to shore up flaws in its email software, the remedy still leaves open a so-called back door that can allow access to compromised servers and perpetuating further attacks by others. "We can't stress enough that patching and mitigation is not remediation if the servers have already been compromised, and it is essential that any organization with a vulnerable server take measures to determine if they were already targeted," the White House official said...
The back channels for remote access can impact credit unions, town governments and small business, and have left U.S. officials scrambling to reach victims, with the FBI on Sunday urging them to contact the law enforcement agency. Those affected appear to host Web versions of Microsoft's email program Outlook on their own machines instead of cloud providers, possibly sparing many major companies and federal government agencies, records from the investigation suggest... So far, only a small percentage of infected networks have been compromised through the back door, the source previously told Reuters, but more attacks are expected.

Starlink Will Hit 300Mbps and Expand To 'Most of Earth' This Year (arstechnica.com) 161
Starlink is now available for order to a limited number of users in your coverage area. Placing your order now will hold your place in line for future service. Orders will be fulfilled on a first-come, first-served basis. During beta, users can expect to see data speeds vary from 50Mb/s to 150Mb/s and latency from 20ms to 40ms in most locations over the next several months as we enhance the Starlink system. There will also be brief periods of no connectivity at all. As we launch more satellites, install more ground stations and improve our networking software, data speed, latency and uptime will improve dramatically. The Starlink team will provide periodic updates on availability as we launch more satellites and expand our coverage area. Depending on your location, some orders may take 6 months or more to fulfill. To check availability for your location, visit Starlink.com and re-enter your service address. Thank you for your interest in Starlink and your continued support!

Facebook Is Said to Be Building a Product to Compete With Clubhouse (nytimes.com) 27

The Open-Source Magma Project Will Become 5G's Linux (zdnet.com) 28
The Linux Foundation will help oversee this new stage in Magma's organizational future. Magma will be managed under a neutral governance framework at the Linux Foundation. Arm, Deutsche Telekom, Facebook, FreedomFi, Qualcomm, the Institute of Wireless Internet of Things at Northeastern University, the OpenAirInterface(OAI) Software Alliance, and the Open Infrastructure Foundation (OIF). You may ask, since Magma is already working with OIF, which is something of a Linux Foundation rival, why Magma will be working with both? Arpit Joshipura, the Linux Foundation's general manager of Networking, Edge, and IoT, explained, "Magma has gotten great community support from several ecosystem players and foundations including OIF, OAI etc. What we are announcing today is the next evolution of the project where the actual hosting of the project is being set up under the Linux Foundation with neutral governance that has been accepted by the community for a long time. OIF, OAI, and LF will work with their communities of Software Developers to contribute to Magma's core project."

How DNSpooq Attacks Could Poison DNS Cache Records (zdnet.com) 9
Slashdot reader Joe2020 shared Help Net Security's quote from Shlomi Oberman, CEO and researcher at JSOF. "Some of the bigger users of Dnsmasq are Android/Google, Comcast, Cisco, Red Hat, Netgear, and Ubiquiti, but there are many more. All major Linux distributions offer Dnsmasq as a package, but some use it more than others, e.g., in OpenWRT it is used a lot, Red Hat use it as part of their virtualization platforms, Google uses it for Android hotspots (and maybe other things), while, for example Ubuntu just has it as an optional package."
More from ZDNet: Dnsmasq is usually included inside the firmware of various networking devices to provide DNS forwarding capabilities by taking DNS requests made by local users, forwarding the request to an upstream DNS server, and then caching the results once they arrive, making the same results readily available for other clients without needing to make a new DNS query upstream. While their role seems banal and insignificant, they play a crucial role in accelerating internet speeds by avoiding recursive traffic...
Today, the DNSpooq software has made its way in millions of devices sold worldwide [including] all sorts of networking gear like routers, access points, firewalls, and VPNs from companies like ZTE, Aruba, Redhat, Belden, Ubiquiti, D-Link, Huawei, Linksys, Zyxel, Juniper, Netgear, HPE, IBM, Siemens, Xiaomi, and others. The DNSpooq vulnerabilities, disclosed today by security experts from JSOF, are dangerous because they can be combined to poison DNS cache entries recorded by Dnsmasq servers. Poisoning DNS cache records is a big problem for network administrators because it allows attackers to redirect users to clones of legitimate websites...
In total, seven DNSpooq vulnerabilities have been disclosed today. Four are buffer overflows in the Dnsmasq code that can lead to remote code execution scenarios, while the other three bugs allow DNS cache poisoning. On their own, the danger from each is limited, but researchers argue they can be combined to attack any device with older versions of the Dnsmasq software...
The JSOF exec told ZDNet that his company has worked with both the Dnsmasq project author and multiple industry partners to make sure patches were made available to device vendors by Tuesday's public disclosure.

Twitter's Decentralized Social Network Project Takes a Baby Step Forward (theverge.com) 24
This doesn't tell us how Bluesky itself might operate. If it results in a protocol, that system might be created from scratch, or it might build on an existing standard like ActivityPub â" a possibility Dorsey mentioned in 2019 upon unveiling the initiative. [...] However, the report offers a snapshot of who's been working on Bluesky. It was authored by Jay Graber, creator of event-organizing platform Happening. Other contributors include Mastodon developer Eugen Rochko, peer-to-peer Beaker Browser co-creator Paul Frazee, ActivityPub standard co-editor Christopher Lemmer Webber, and InterPlanetary File System project lead Molly Mackinlay.
It also hints at the fact that decentralization often isn't profitable. The report focuses on monetization options like membership fees and cryptocurrency microtransactions, but it also notes that "many decentralized projects run on volunteer work and donations" -- something that isn't ideal for a platform supporting commercial networks like Twitter.

'Anti-Facebook' MeWe Social Network Adds 2.5 Million New Members In One Week 71
MeWe claims to be the new mainstream social network with the features people love and no ads, no targeting, and no newsfeed manipulation. MeWe is the most downloaded social app and No. 3 in the list of most downloaded apps as of Jan. 15, 2021. It was knocked off the top slot by WhatsApp alternatives Signal and Telegram, which are benefitting from the brouhaha over WhatsApp's data privacy changes.

Ubiquiti Tells Customers To Change Passwords After Security Breach (zdnet.com) 25
According to Ubiquiti, the intruder accessed servers that stored data on UI.com users, such as names, email addresses, and salted and hashed passwords. Home addresses and phone numbers may have also been exposed, but only if users decided to configure this information into the portal. How many Ubiquiti users are impacted and how the data breach occurred remains a mystery. It is currently unclear if the "unauthorized access" took place when a security researcher found the exposed data or was due to a malicious threat actor. Despite the bad news to its customers, Ubiquiti said that it had not seen any unauthorized access to customer accounts as a result of this incident. The company is now asking all users who receive the email to change their account passwords and turn on two-factor authentication.

D-Link Made a USB Adapter that Adds Wi-Fi 6 To Your Laptop (theverge.com) 38

Parler Sues Amazon For Site Takedown, Alleges Antitrust Violations 339

Ten-Year Long Study Confirms No Link Between Playing Violent Video Games as Early as Ten Years Old and Aggressive Behavior Later in Life (gamesage.net) 95

Citrix Devices Are Being Abused as DDoS Attack Vectors (zdnet.com) 17

Facebook Hits Back at Apple With Second Critical Newspaper Ad (theverge.com) 109

Norman Abramson, Pioneer Behind Wireless Networks, Dies At 88 (nytimes.com) 7
The wireless network in Hawaii, which began operating in 1971, was called ALOHAnet, embracing the Hawaiian salutation for greeting or parting. It was a smaller, wireless version of the better known ARPAnet, the precursor to the internet, which allowed researchers at universities to share a network and send messages over landlines. The ARPAnet was led by the Pentagon's Advanced Research Projects Agency, which also funded the ALOHAnet. "The early wireless work in Hawaii is vastly underappreciated," said Marc Weber, an internet historian at the Computer History Museum in Mountain View, Calif. "Every modern form of wireless data networking, from WiFi to your cellphone, goes back to the ALOHAnet."

Key People Are Leaving Facebook and Torching the Company In Departure Notes (buzzfeednews.com) 104
Using internal Facebook data and projections to support their points, the data scientist said in their post that roughly 1 of every 1,000 pieces of content -- or 5 million of the 5 billion pieces of content posted to the social network daily -- violates the company's rules on hate speech. More stunning, they estimated using the company's own figures that, even with artificial intelligence and third-party moderators, the company was "deleting less than 5% of all of the hate speech posted to Facebook." (After this article was published, Facebook VP of integrity Guy Rosen disputed the calculation, saying it "incorrectly compares views and content." The employee addressed this in their post and said it did not change the conclusion.)
The sentiments expressed in the badge post are hardly new. Since May, a number of Facebook employees have quit, saying they were ashamed of the impact the company was having on the world or worried that the company's inaction in moderating hate and misinformation had led to political interference, division, and bloodshed. Another employee was fired for documenting instances of preferential treatment of influential conservative pages that repeatedly spread false information. But in just the past few weeks, at least four people involved in critical integrity work related to reducing violence and incitement, crafting policy to reduce hate speech, and tracking content that breaks Facebook's rules have left the company. In farewell posts obtained by BuzzFeed News, each person expressed concerns about the company's approach to handling US political content and hate speech, and called out Facebook leadership for its unwillingness to be more proactive about reducing hate, incitement, and false content. In the wake of the 2020 US Election, Facebook's "election integrity" team, which was charged with "helping to protect the democratic process" and reducing "the spread of viral information and fake accounts," was recently disbanded as a stand-alone unit. Company leadership also reportedly shot down a proposal from the company's integrity teams to throttle the distribution of false and misleading election content from prominent political accounts, like President Donald Trump's.

FTC Sues Facebook for Illegal Monopolization (ftc.gov) 122

iPhone Zero-Click Wi-Fi Exploit is One of the Most Breathtaking Hacks Ever (arstechnica.com) 114
"This is a fantastic piece of work," Chris Evans, a semi-retired security researcher and executive and the founder of Project Zero, said in an interview. "It really is pretty serious. The fact you don't have to really interact with your phone for this to be set off on you is really quite scary. This attack is just you're walking along, the phone is in your pocket, and over Wi-Fi someone just worms in with some dodgy Wi-Fi packets." Beer's attack worked by exploiting a buffer overflow bug in a driver for AWDL, an Apple-proprietary mesh networking protocol that makes things like Airdrop work. Because drivers reside in the kernel -- one of the most privileged parts of any operating system -- the AWDL flaw had the potential for serious hacks. And because AWDL parses Wi-Fi packets, exploits can be transmitted over the air, with no indication that anything is amiss.
