Microsoft Calls for Federal Laws to Regulate Tech Industry, "Protect" Consumers' Data

Microsoft Calls for Federal Laws to Regulate Tech Industry, "Protect" Consumers' Data

URL: https://www.reddit.com/r/freetalklive/comments/brh34d/microsoft_calls_for_federal_laws_to_regulate_tech/

submitted by /u/celestrion [link] [comments]

You Can't Open the Microsoft Surface Laptop Without Literally Destroying It

You Can't Open the Microsoft Surface Laptop Without Literally Destroying It

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/AiYBfu3C428/you-cant-open-the-microsoft-surface-laptop-without-literally-destroying-it

An anonymous reader quotes a report from Motherboard: Microsoft's latest Surface Laptop may have earned glowing reviews from certain sections of the tech press, but don't tell that to iFixit. The company, which provides repair tools and manuals for popular gadgets like the iPhone and PlayStation, has handed the Surface Laptop a score of 0 out of 10 in terms of user repairability, stating definitively that the laptop "is not meant to be opened or repaired; you can't get inside without inflicting a lot of damage." iFixit's detailed teardown illustrates just how difficult it is to open the Surface. For starters, there are no screws, proprietary or otherwise, on the outside of the laptop. Instead, the laptop is literally welded together using a type of "plastic soldering" that is rare to see in consumer electronics. Anyone hoping to get inside the "beautifully designed and crafted" computer will have to pry it open with a knife or dedicated pick in order to defeat Microsoft's plastic welding. Whether or not it's actually worth going through the trouble of defeating said welding is another matter, given that the "glue-filled monstrosity," as iFixit dubs the laptop, has none of the user-upgradeable parts you'd want to see in a PC, like memory or storage. "It literally can't be opened without destroying it," the repair company concludes. "If we could give it a -1 out of 10, we would," iFixit said in an emailed statement on Friday. "It's a Russian nesting doll from hell with everything hidden under adhesive and plastic spot welds. It is physically impossible to nondestructively open this device."

Read more of this story at Slashdot.

Windows Zero-day Exploit Allows Hackers to Take Over any Installed Application

Windows Zero-day Exploit Allows Hackers to Take Over any Installed Application

URL: https://themerkle.com/windows-zero-day-exploit-allows-hackers-to-take-over-any-installed-application/

Windows 10 Will Download Some Updates Even Over a Metered Connection

Windows 10 Will Download Some Updates Even Over a Metered Connection

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/Dt-8dDqsRoA/windows-10-will-download-some-updates-even-over-a-metered-connection

Reader AmiMoJo writes: Until now Windows 10 has allowed users to avoid downloading updates over metered (pay-per-byte) connections, to avoid racking up huge bills. Some users were setting their ethernet/wifi connections as metered in order to prevent Windows 10 from downloading and installing updates without their permission. In its latest preview version of the OS, Microsoft is now forcing some updates necessary for "smooth operation" to download even on these connections. As well as irritating users who want to control when updates download and install, users of expensive pay-per-byte connections could face massive bills.

Read more of this story at Slashdot.

Windows 10 UAC Bypass Uses Backup and Restore Utility

Windows 10 UAC Bypass Uses Backup and Restore Utility

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/6zqSvclL1JI/windows-10-uac-bypass-uses-backup-and-restore-utility

An anonymous reader writes: "A new User Access Control (UAC) bypass technique relies on altering Windows registry app paths and using the Backup and Restore utility to load malicious code without any security warning," reports BleepingComputer. The technique works when an attacker launches the Backup and Restore utility, which loads its control panel settings page. Because the utility doesn't known where this settings page is located, it queries the Windows Registry. The problem is that low-privileged users can modify Windows Registry values and point to malware. Because the Backup and Restore utility is a trusted application, UAC prompts are suppressed. This technique only works in Windows 10 (not earlier OS versions) and was tested with Windows 10 build 15031. A proof-of-concept script is available on GitHub. The same researcher had previously found two other UAC bypass techniques, one that abuses the Windows Event Viewer, and one that relies on the Windows 10 Disk Cleanup utility

Read more of this story at Slashdot.

BREAKING: CIA turned every Microsoft Windows PC in the world into spyware. Can activate backdoors on demand, including via Windows update. - r/Bitcoin

BREAKING: CIA turned every Microsoft Windows PC in the world into spyware. Can activate backdoors on demand, including via Windows update. - r/Bitcoin

URL: https://www.reddit.com/r/CryptoCurrency/comments/5y1qrz/breaking_cia_turned_every_microsoft_windows_pc_in/

submitted by /u/CryptoChief
[link] [comments]

Windows DRM-Protected Files Used To Decloak Tor Browser Users

Windows DRM-Protected Files Used To Decloak Tor Browser Users

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/nIC3Uqa_YvI/windows-drm-protected-files-used-to-decloak-tor-browser-users

An anonymous reader writes from a report via BleepingComputer: Downloading and trying to open Windows DRM-protected multimedia files can deanonymize Tor Browser users and reveal their real IP addresses, security researchers from Hacker House have warned. On Windows, multimedia files encoded with special Microsoft SDK will automatically open an IE window and access a URL to check the file's license. Since this request is sent outside of the Tor Browser and without user interaction, this can be used to ping law enforcement servers and detect the user's real IP address and other details. For example, law enforcement could host properly signed DRM-protected files on sites pretending to host child pornography. When a user would try to view the file, the DRM multimedia file would use Internet Explorer to ping a server belonging to the law enforcement agency. The same tactic can also be used to target ISIS militants trying to view propaganda videos, illegal drug and weapons buyers trying to view video product demos, political dissidents viewing news videos, and more. A video of the attack is available here.

Read more of this story at Slashdot.

Windows 10 is not Free – Privacy Issues

Windows 10 is not Free – Privacy Issues

URL: https://www.deepdotweb.com/2017/02/02/windows-10-not-free-privacy-issues/


Did you know that Microsoft records your voice, camera and every keystroke on Windows 10? Of course, it’s all in the Terms of Agreement.

Holding Shift + F10 During Windows 10 Updates Opens Root CLI, Bypasses BitLocker

Holding Shift + F10 During Windows 10 Updates Opens Root CLI, Bypasses BitLocker

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/-ScjETtY1S8/holding-shift--f10-during-windows-10-updates-opens-root-cli-bypasses-bitlocker

An anonymous reader quotes a report from BleepingComputer: Windows security expert and infrastructure trainer Sami Laiho says that by holding SHIFT + F10 while a Windows 10 computer is installing a new OS build, an attacker can open a command-line interface with SYSTEM privileges. This CLI debugging interface also grants the attacker full access to the computer's hard drive data, despite the presence of BitLocker. The CLI debugging interface is present when updating to new Windows 10 and Windows 10 Insiders builds. The most obvious exploitation scenario is when a user leaves his computer unattended during the update procedure. A malicious insider can open the CLI debugger and perform malicious operations under a root user, despite BitLocker's presence. But there are other scenarios where Laiho's SHIFT + F10 trick can come in handy. For example when police have seized computers from users who deployed BitLocker or when someone steals your laptop. Windows 10 defaults help police/thieves in this case because these defaults forcibly update computers, even if the user hasn't logged on for weeks or months. This CLI debugging interface grants the attacker full access to the computer's hard drive, despite the presence of BitLocker. The reason is that during the Windows 10 update procedure, the OS disables BitLocker while the Windows PE (Preinstallation Environment) installs a new image of the main Windows 10 operating system. "This [update procedure] has a feature for troubleshooting that allows you to press SHIFT + F10 to get a Command Prompt," Laiho writes on his blog. "The real issue here is the Elevation of Privilege that takes a non-admin to SYSTEM (the root of Windows) even on a BitLocker (Microsoft's hard disk encryption) protected machine." Laiho informed Microsoft of the issue and the company is apparently working on a fix.

Read more of this story at Slashdot.

Microsoft Signature PC Requirements Now Blocks Linux Installation: Reports

Microsoft Signature PC Requirements Now Blocks Linux Installation: Reports

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/XP5Zxrlegzo/microsoft-signature-pc-requirements-now-blocks-linux-installation-reports

Reader sombragris writes: According to a well-documented forum thread, the Signature PC program by Microsoft now requires to lock down PCs. This user found out that his Lenovo Yoga 900 ISK2 UltraBook has the SSD in a proprietary RAID mode which Linux does not understand and the BIOS is also locked down so it could not be turned off. When he complained that he was unable to install Linux, the answer he got was: "This system has a Signature Edition of Windows 10 Home installed. It is locked per our agreement with Microsoft."Even worse, as the original poster said, "[t]he Yoga 900 ISK2 at Best Buy is not labeled as a Signature Edition PC, but apparently it is one, and Lenovo's agreement with Microsoft includes making sure Linux can't be installed." As some commenter said: "If you buy a computer with this level of lockdown you should be told." There is also a report on ZDNet which looks very understanding towards Lenovo, but the fact remains: the SSD is locked down in a proprietary RAID mode that cannot be turned off.

Read more of this story at Slashdot.

DEF CON 24 - Zack Fasel, Erin Jacobs - Attacks Against Top Consumer Prod...

Microsoft Bitcoin Nightmare

Microsoft Bitcoin Nightmare

URL: http://www.reddit.com/r/Bitcoin/comments/4yontb/microsoft_bitcoin_nightmare/

Yesterday I decided it was time to buy a year's subscription to Xbox Live Gold so the kids could play online with their cousins in Florida. When signing up, Microsoft asks the subscriber to enter credit card information so they can renew the subscription whenever it expires. But I prefer not to use a credit card because I don't want to give my kids (and their visiting friends) the power to make charges against my card. And my Xbox Live account have been hacked before.

Thankfully, Microsoft is one of those progressive companies that accept bitcoin so I have an alternative to using a credit card. But they don't allow you to just buy something and pay with bitcoin. Instead, you have to buy Microsoft Currency in advance, then apply that as credit against whatever you want to buy. So I bought $75 of Microsoft Currency and went to buy my Xbox Live Gold subscription. That's when the nightmare began.

Despite having a $75 account credit, the subscription process provides only one payment option - credit card. I thought this must be a mistake, so I searched around for several minutes looking for support phone number to call. Not finding one, I eventually settled for support chat.

After waiting a few minutes in the queue, a friendly support tech informed me that Microsoft does not allow Microsoft Currency to be used for Xbox Live Gold subscriptions. That's annoying, but not the first time I've encountered a low-level support person forced to enforce an inexplicable, poorly-documented, and counter-intuitive company policy. So I asked for a refund. He tells me they don't offer refunds of Microsoft Currency. "Is there anything else I can help you with?", he asks. I tell him I want to talk to his manager. While we wait, he reminds me that "As consumers, we must be responsible for knowing what we are buying before making a purchase."

The manager confirms the policy - no subscription purchases with Microsoft Currency, no refunds. I reply that accepting payment for something, refusing to provide the requested service, and refusing to provide a refund is illegal. After a pause, he informs me that he would like to provide a refund, but Microsoft Currency refunds can only be processed by the people in the Microsoft Store group, not the Xbox group. He gives me their number and wishes me a good day.

I call the Microsoft Store people, happy to finally have a phone conversation rather than enduring the long pauses and cryptic half-replies in support chat. After explaining the problem I am put on hold for a few minutes, then find myself describing my problem to the Xbox group. Once again I ask for a manager.

This time, the manager is clearly trying to make me a happy customer rather than shuffle me off to someone else. He offers a free month of Xbox Live Gold. I tell him that I'll accept 12 months, since that's what I've been trying to buy all along. Otherwise, I want a refund. After a break to consult with someone else, he tells me he can provide a refund in 24-48 hours, but their system is having problems at the moment - the refund option does not appear in his control panel. He sends me a free month subscription to Xbox Live Gold as an apology. I ask him how the $75 will be refunded since I purchased it with bitcoin. "Bitcoin, is that a kind of credit card?", he asks.

Dinner is an hour late at this point and the kids are complaining, so I end it there.

The lesson here is clear to me. Microsoft caused this problem in the first place with their ridiculous "you can't buy that" rules and illegal "no refunds" policy. And they know "no refunds" would never hold up in court. They clearly have a way to issue refunds. But bitcoin, as implemented today, has no refund mechanism in place by default for the merchant. And the buyer - me - has no option to reverse a charge. Had I bought Microsoft Currency with a credit card they would have the system in place to refund me. Had they refused, I could have easily disputed the payment with my card issuer. Situations like this illustrate a scenario where bitcoin is not a good choice for online purchase.

submitted by /u/mshadel
[link] [comments]

Secure Boot Isn't So Secure After All: The Golden Key Is Out

Secure Boot Isn't So Secure After All: The Golden Key Is Out

URL: http://feedproxy.google.com/~r/Phoronix/~3/P7kxEYlzKtY/scan.php

So much for Secure Boot being so secure... After a mistake by Microsoft, the "golden key" is now out in the wild...

Microsoft Hates Linux: Patent Extortion Continues With New Software Patents Deal (Wistron)

Microsoft Hates Linux: Patent Extortion Continues With New Software Patents Deal (Wistron)

URL: http://www.linuxtoday.com/it_management/microsoft-hates-linux-patent-extortion-continues-with-new-software-patents-deal-wistron-160308071138.html

TechRights: Microsoft is still killing (free) Linux with software patents whilst at the same time telling the media that 'loves Linux'

Another Windows 10 Update Causing Problems

Another Windows 10 Update Causing Problems

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/I4Hv2FjO5vQ/another-windows-10-update-causing-problems

New submitter sexconker writes: The recently-released cumulative update for Windows 10 (KB3140743) is reportedly causing problems. Symptoms include crashes, BSODs, and the inability to boot, even in safe mode. The Windows 10 subreddit has many threads detailing the inability to boot. The only fix seems to be booting to a recovery ISO, uninstalling the update / rolling back, and hoping you don't get hit again. W10Privacy 2 claims to be able to (among other things) give Windows 10 users control over the automatic updates.

Read more of this story at Slashdot.

Bill Gates apoia solicitação do FBI para hackear iPhone de terrorista

Bill Gates apoia solicitação do FBI para hackear iPhone de terrorista

URL: http://redir.folha.com.br/redir/online/mercado/rss091/*http://www1.folha.uol.com.br/tec/2016/02/1742383-bill-gates-apoia-solicitacao-do-fbi-para-hackear-iphone-de-terrorista.shtml

Bill Gates se dissociou do Vale do Silício no impasse entre a Apple e o governo dos Estados Unidos, afirmando que as empresas de tecnologia deveriam ser forçadas a cooperar com as autoridades em investigações sobre terrorismo. Leia mais (02/23/2016 - 16h06)

Microsoft Monitoring How Long You Use Windows 10

Microsoft Monitoring How Long You Use Windows 10

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/XBICu4BuXnE/microsoft-monitoring-how-long-you-use-windows-10

Mark Wilson writes: The various privacy concerns surrounding Windows 10 have received a lot of coverage in the media, but it seems that there are ever more secrets coming to light. The Threshold 2 Update did nothing to curtail privacy invasion, and the latest Windows 10 installation figures show that Microsoft is also monitoring how long people are using the operating system. This might seem like a slightly strange statistic for Microsoft to keep track of, but the company knows how long, collectively, Windows 10 has been running on computers around the world. To have reached this figure (11 billion hours in December, apparently) Microsoft must have been logging individuals' usage times. Intrigued, we contacted Microsoft to find out what on earth is going on.

Read more of this story at Slashdot.

Microsoft Has Your Encryption Key If You Use Windows 10

Microsoft Has Your Encryption Key If You Use Windows 10

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/YfNKeGMMq1o/microsoft-has-your-encryption-key-if-you-use-windows-10

An anonymous reader writes with this bit of news from the Intercept. If you login to Windows 10 using your Microsoft account, your computer automatically uploads a copy of your recovery key to a Microsoft servers. From the article: "The fact that new Windows devices require users to backup their recovery key on Microsoft's servers is remarkably similar to a key escrow system, but with an important difference. Users can choose to delete recovery keys from their Microsoft accounts – something that people never had the option to do with the Clipper chip system. But they can only delete it after they've already uploaded it to the cloud.....As soon as your recovery key leaves your computer, you have no way of knowing its fate. A hacker could have already hacked your Microsoft account and can make a copy of your recovery key before you have time to delete it. Or Microsoft itself could get hacked, or could have hired a rogue employee with access to user data. Or a law enforcement or spy agency could send Microsoft a request for all data in your account, which would legally compel them to hand over your recovery key, which they could do even if the first thing you do after setting up your computer is delete it. As Matthew Green, professor of cryptography at Johns Hopkins University puts it, 'Your computer is now only as secure as that database of keys held by Microsoft, which means it may be vulnerable to hackers, foreign governments, and people who can extort Microsoft employees.'"

Read more of this story at Slashdot.

Windows 10’s broken fall update removes user-installed applications without asking first

Windows 10's broken fall update removes user-installed applications without asking first

URL: http://www.extremetech.com/computing/218570-windows-10s-broken-fall-update-removes-user-installed-applications-without-asking-first


Microsoft's latest Windows 10 update is causing problems for at least some users, and uninstalling programs without the user's consent or evidence of a problem.

Windows 10 Upgrades Are Being Forced On Some Users

Windows 10 Upgrades Are Being Forced On Some Users

URL: http://rss.slashdot.org/~r/Slashdot/slashdot/~3/JpOsLJfTByA/windows-10-upgrades-are-being-forced-on-some-users

grimmjeeper writes: According to Ars Technica the Windows 10 upgrade option is being selected by default for some users. A dialogue box is appearing that only permits them to reschedule the upgrade process, not cancel it. "For the first year of its availability, Windows 10 is available for free to most Windows 7 and 8 users, and Microsoft has been trying to coax those users to make the switch by delivering the operating system through Windows Update. Until now, the OS has been delivered as an optional update; while Windows Update gives it prominent positioning, it shouldn't be installed automatically. This system has already generated some complaints, as Windows Update will download the sizeable operating system installer even if you don't intend to upgrade any time soon, but, over the last couple of days, the situation seems to have become a little more aggressive. We've received a number of reports that people's systems are not merely downloading the installer but actually starting it up." Update: 10/16 11:35 GMT by S : Microsoft said, "In the recent Windows update, this option was checked as default; this was a mistake and we are removing the check."

Read more of this story at Slashdot.