Technology

Facebook on Monday denied that its network and Messenger app were being used to spread ransomware to its users, contradicting the claims of Check Point researchers Roman Ziakin and Dikla Barda.

The two researchers last week reported they had discovered a new method for delivering malicious code to machines, which they dubbed "ImageGate."

Threat actors had found a way to embed malicious code into an image, they said.

Due to a flaw in the social media infrastructure, infected images are downloaded to a user's machine, Ziakin and Barda explained. Clicking on the file causes the user's machine to become infected with a ransomware program known as "Locky," which encrypts all the files on the infected machine. The user then must pay a ransom to the purveyor of the malicious software in order to decrypt the files.

"In the past week, the entire security industry is closely following the massive spread of the Locky ransomware via social media, particularly in its Facebook-based campaign" the researchers wrote in an online post. "Check Point researchers strongly believe the new ImageGate technique reveals how this campaign was made possible, a question which has been unanswered until now."

Bad Chrome Extension

Facebook has disputed Check Point's findings.

"This analysis is incorrect," Facebook said in a statement provided to TechNewsWorld by spokesperson Jay Nancarrow.

"There is no connection to Locky or any other ransomware, and this is not appearing on Messenger or Facebook," the company maintained.

"We investigated these reports and discovered there were several bad Chrome extensions, which we have been blocking for nearly a week," Facebook noted. "We also reported the bad browser extensions to the appropriate parties."

Most social media sites, including Facebook, have protections in place to block spam and dangerous file types, said Marc Laliberte, an information security threat analyst with WatchGuard Technologies.

"This most recent attack bypassed Facebook's protections by using a specific type of image file that supports interactivity via embedded scripts, like JavaScript," he told TechNewsWorld. "Facebook has since added the image file type -- SVG -- used in this attack to their filter."

Cloak of Legitimacy

What makes this attack so devious is that it's cloaked in legitimacy.

"The JavaScript embedded in the image is not malicious," explained Alexander Vukcevic, virus labs director at Avira. "It leads you to a website that looks like YouTube."

At the website, you're told you need to download a browser extension to watch video at the site.

"The browser extension then downloads the ransomware," Vukcevic told TechNewsWorld.

Ransomware like Locky has become a big threat to consumers, observed Javvad Malik, a security advocate for Alien Vault.

"Most are not technically savvy to spot or defend against ransomware," he told TechNewsWorld. "While a lot of effort is put into educating consumers around the dangers of clicking on links in emails or opening attachments, there is an inherent level of trust that people put in social media platforms, which is being abused by this current threat."

Consumer Protection

While Ransomware is always a serious threat to consumers, this new twist on its distribution raises the bar even higher, WatchGuard's Laliberte noted.

"Consumers simply do not expect malware to be delivered via a Facebook message," he said. "Most people probably consider social media sites to be a safe space, so the lack of concern and vigilance makes it powerful as a potential infection channel for malware."

For consumers concerned about an ImagteGate attack, Check Point recommended not opening any files downloaded to a device after clicking any image. The same is true for image files with unusual extensions, such as SVG, JS or HTA.

Users also should keep their operating system and antivirus software up to date, Avira's Vukcevic added, "and make backups. Even if you're never infected with ransomware, you never know when something might go wrong with your machine."

Apple's latest iPhone was barely out of the gate when rumors began percolating about the company's next new phone.

Although the iPhone 7 garnered mostly tepid reviews when it was released this summer, initial inventories sold out quickly, and the company had to scramble to meet demand.

That demand may have peaked, though, which may be why chasers of the next big thing are looking down the road.

"You can rest assured that next year being the 10th anniversary of the original iPhone, Apple will come out with something special," said Wayne Lam, principal analyst for telecom electronics at IHS Markit.

"Whether it's a completely new 10th anniversary model in conjunction with the regular iteration model of the iPhone 7, we'll have to find out -- but most likely, there will be drastic design innovation coming with the iPhones in 2017," he told TechNewsWorld.

"Historically, Apple likes to make a big deal out of decade-length anniversaries," observed Charles King, principal analyst at Pund-IT.

"Since 2017 marks the 10th anniversary of the iPhone, it's easy to assume the company will use the opportunity to prove that it hasn't lost a step, and continues to lead the industry in both design sophistication and delivering value to its customers," he told TechNewsWorld.

Block of Glass and Aluminum

Anticipation for the next model may be higher because the iPhone 7 failed to tick off many items on the wish lists of Apple fans.

"My impression is they were holding back on the 7, so they could make a whiz-bang splash on the 10th anniversary," said David McQueen, a research director at ABI Research.

The next iPhone will be Apple's vision of the smartphone of the future, he added.

"Long term, what the iPhone will be is a block of glass and aluminum with as few buttons, bumps and holes as it can have," McQueen told TechNewsWorld.

Apple may be taking a step toward that phone of the future with the display rumored for the next iPhone. It reportedly will be an OLED display that will occupy most of the front of the phone -- or all of it, by wrapping over its sides.

The OLED part of that rumor is a solid bet, maintained IHS' Lam.

"Apple's move to OLED display is all but assured through our supply-side intelligence," he said. "This opens up lots of design possibilities for them on next year's groundbreaking iPhone design."

Edge-to-Edge Screen

OLED screens have better contrast, brightness and deeper blacks than LCD displays, and they're also more flexible, which would allow Apple to create a curved phone with an edge-to-edge screen.

"I find the edge-to-edge display most credible," Patrick Moorhead, principal analyst at Moor Insights and Strategy, told TechNewsWorld.

Embracing OLED technology will help Apple keep pace with its competitors.

"Samsung has been doing curved OLED screens for years, so it's not a cutting-edge phenomenon by any stretch of the imagination," noted Bob O'Donnell, chief analyst at Technalysis Research.

"This is Apple just playing catch-up to other people," he told TechNewsWorld.

The beauty of the edge-to-edge screen is not expected to be marred by a home button or fingerprint reader. Both will be built into the screen itself, rumor has it.

"I'm particularly intrigued by the idea of a display-enabled fingerprint reader," Pund-IT's King said. "That could simplify both the phone design and authentication processes."

Glass Body

Some Apple watchers, including widely respected analyst Ming-Chi Kuo of KGI Securities, believe there will be three iPhone models: two conventional models with 4.7- and 5.5-inch displays, and one with an edge-to-edge rounded screen.

All of the units will have glass bodies to facilitate wireless charging.

Apple's wireless charging is expected to be truly wireless. Existing wireless chargers require a phone to be placed on the charger. Apple's charger will charge a phone through the air for short distances.

"Wireless charging that requires no contact would be a technology innovation," Technalysis' O'Donnell said.

There are some drawbacks to charging devices through the air, he added. It's very inefficient, so it's not the greenest way to charge a phone.

Then there are possible safety issues.

"Power signals flying through the air could freak people out," O'Donnell said.

Need for a Home Run

Many of the rumors about the next iPhone may be unfounded, suggested Kevin Krewell, a principal analyst at Tirias Research.

"The iPhone 8 rumors are all over the place," he told TechNewsWorld.

The phone seems to have every item from everyone's wish lists.

"It's likely two or maybe three of these ideas will come to pass in the next iPhone, but none of them are groundbreaking innovations," Krewell pointed out.

"They're all very nice enhancements and will keep Apple's iPhone competitive with phones from other vendors," he added.

However, that may not be what the company needs with the next iPhone.

"With sales slipping and margins reportedly under pressure, it's important for Apple to come out swinging with the iPhone 8. The company needs to prove that it's still an elemental force in mobile innovation -- not just one of many companies delivering quality products," noted Pund-IT's King.

"Apple is so profitable and so deeply embedded with millions of customers that the company could survive and even thrive if the iPhone 8 fails in the marketplace," he added, "but the same might not be true of company executives tied to the new device. If the iPhone 8 fails to hit a home run, any number of execs could be headed for the showers."

The San Francisco Municipal Transportation Authority, or SF MTA, was hacked on Friday.

"You Hacked, All Data Encrypted," was the message reportedly displayed on computer screens at the authority's stations throughout the city. "Contact for Key (cryptom27@yandex.com)ID:681 , Enter."

Fare payment machines at underground stations were out of order, resulting in free rides on the subway and light rail system known locally as "SF Muni."

Some SF MTA employees' email systems did not work, The San Francisco Examiner reported.

The MTA locked its subway fare gates in an open position to enable free riding, according to the paper.

The agency was hit by a ransomware attack that disrupted some of its internal computer systems, including email, according to spokesperson Kristen Holland.

The attack didn't affect transit service or buses, she noted. Neither customer privacy nor transaction information were compromised, and the situation was contained.

All About the Dough

A person at the email address provided by the hacker, who identified himself as "Andy Saolis" to the Examiner, demanded 100 bitcoins -- equal to about US$73,000 -- to release data captured from the MTA.

The MTA payment system was inaccessible over the weekend, according to the Examiner, and employees were concerned that the personal data of the agency's nearly 6,000 employees was at risk.

Saolis indicated the attack was "for money, nothing else."

"Andy Saolis" is the name used by the attacker who launched a full disk encryption ransomware package that Morphus Labs discovered earlier this year and dubbed "Mamba."

Open Muni

The MTA's network was penetrated after an employee downloaded a torrented computer file that contained a software key code generator, Saolis reportedly said. That automatically launched an admin-level infection.

The SFMTA network was very open, he maintained.

Saolis threatened to close the email Monday if he hadn't heard from the MTA, which would lock the agency's infected computers out of its network permanently.

"It looks like the Muni scheduling and billing systems are running on the same machines as the employees' email systems," said Michael Jude, a program manager at Stratecast/Frost & Sullivan.

"This implies that the Muni operations are exposed to external attack," he told the E-Commerce Times.

Muni "should have critical operations and management systems running in a secured environment, ideally one not exposed to outside access," Jude suggested.

The Very Real Public Threat

Penetrations of this sort "can easily escalate to life-threatening events," Jude warned. "Simply messing with route scheduling could lead to confusion or, possibly, collisions."

Mass transit and passenger rail systems, including buses, light rail and subways, are one of the seven key subsections in the United States Transportation Systems Sector.

The U.S. Department of Homeland Security, which oversees the sector jointly with the U.S. Department of Transportation, has issued a cybersecurity framework implementation guidance and a companion workbook for owners and operators in the sector to help reduce cyber risks.

Keeping Transit Systems Safe

"The threat environment warrants evaluating security controls for any organization that relies on computer systems for providing a service or running a business," said Tim Erlin, senior director of IT and security at Tripwire.

Ensuring adequate network separation "is a good first step," he told the E-Commerce Times. "Other basic best practices include monitoring for and patching vulnerabilities, validating secure configurations are in place, and watching system logs for indications of malicious activity."

AV Linux could be a music and video lover's dream come true.

AV Linux is a specialty distribution that can turn a new or old PC, or an Intel-powered Mac box, into a workstation for audio/graphics/video enthusiasts. Version 2016.8.30 was released this summer.

AV Linux is one of the few available fully functional Linux distros to give audio and video enthusiasts a professional level collection of tools to enhance their handling of audio-visual files. This is especially significant now that the Musix distro has gone dormant.

AV Linux is a Debian-based project with many applications for working with audio and video formats. The latest update comes with a long list of changes. Most surprising is the complete removal of Kdenlive, KDE 5 runtime components, Openshot and LibreOffice.

AV Linux is a specialty distribution for audio/video/graphics content creation platform based on Debian/GNU Linux Testing Distribution.

AV Linux issues a new release only one or twice each year. It is based on the Debian/GNU Linux Testing Distribution. Debian Testing uses a rolling update method of updating. Upgraded files are pushed out periodically as they are available.

Many of the specialized media packages it bundles are not updated often, so Canadian developer Glen MacArthur, also a musician, has little need to issue new versions more frequently. When he does cobble together an update, though, he does more than provide minor updates. He thrusts the distro to its next bleeding-edge level. AV Linux version 2016.8.30 is no exception.

AV Linux runs a customizable version of the Xfce 4 desktop environment. This is an excellent option to maintain fast and efficient system resource handling, given the wide range of hardware options it supports. You have a choice of either 32- or 64-bit installable ISO Images.

What's Inside AV Linux

My last review of AV Linux version 6 was in May of 2014. That release was a complete makeover of its predecessor. This latest release also is completely different from its predecessor -- to the point that it could be viewed as an alpha or beta release, according to the developer.

It is neither, however. It is simply an initial release for a new direction of AVL. It is a reworked distro from the ground up. So much is different that the developer urges all who download it to read the manual in detail first.

Usually, Linux releases offer users only a link to a live help manual on the developer's website -- that's if you are lucky. Otherwise, your only clues to what to expect are summarized in a Q&A file or a chatty user forum news update on that particular release.

In an effort to provide the best user experience possible, AV Linux offers you a bonus. The manual includes 84 illustrated pages of FAQs and important operational details. New users can gain much insight about this species of Linux and how to install it. More seasoned Linux users can simply use this manual as a reference tool. Once you install the distro, you will find this user manual in the accessories menu.

What's Included

The developer describes AV Linux as not being a Linux distribution in the proper sense. AV Linux targets users needing an audio/video/graphics content creation platform.

Its storehouse of audio-visual applications is impressive, but many of the typical applications available in traditional Debian/GNU testing releases are not included by default. Of course, you can add what you need.

This version ships with a custom RT kernel and JACK Audio Connection Kit. Its toolkit has Linux software developers in mind. It provides a strong development suite, and the leading audio/video/graphics applications either are included or available from the Debian or KXStudio software repositories.

You also will find special software packaging not found in default repositories, including Trulan Martin's Custom Realtime Preempt Kernel, the choice of Liquorix or Debian Kernels, and falkTX's KXStudio repositories for up to date audio applications.

There is no Pulse audio integration, but you can install it yourself. You do get the complete JACK Audio environment, however, with automatic JACK MIDI and ALSA Loopback. Add to that extensive audio/video and administrator-friendly Thunar custom actions.

The powerhouse packaging includes a robust collection of environment tools for developers, such as a choice of GCC4 or GCC5 compilers, package scripts, GIT, SVN, BZR and developer libraries. Also in the mix are Pipelight support for DRM Web Content, and a large assortment of various GTK and window manager themes.

AV Linux uses Systemback as an installation method. That imposes some limitations, such as allowing only UEFI boot on 64-bit systems, and providing no support for GPT partition tables.

Tech Bugaboos

I put AV Linux through its paces as a virtual machine installation. I also ran the ISO as a live session on two of my test bench computers. It installed and ran with no issues in all cases.

Be aware of a heads up the developer posted in his release notes, though. AV Linux will alter the permissions of hard drive partitions for read/write access without your approval. It does this simply as a convenience, to facilitate accessing media files to demo with the audio/video applications.

That was not a problem for me with the VM installation because I could remove the virtual hard drive easily, and the installation was sandboxed from my physical hard drive.

If you decide not to install AV Linux after trying the live session ISO, the developer suggests checking and resetting the permissions of your hard drive partitions afterward.

Another issue involves using the Chrome Web browser on a 32-bit installation. Google dropped 32-bit support for Chrome, so you might want to consider security issues should you run AV Linux in a 32-bit environment. The developer suggests using Synaptic to uninstall the Chrome browser, and using the AV Linux Assistant Repositories button to remove or disable the Google Chrome repository.

Software Solace

One big advantage for audio-visual experts is having more than one package at hand to handle production tasks. It is rare to find every great feature provided in one program. The collection of multimedia and other specialty packages in this distro is huge.

Unlike earlier versions, however, software to perform the more mundane daily computing tasks is sorely lacking. AV Linux comes with WINE preinstalled, so you can run necessary Microsoft Windows programs. You also get a nice assortment of accessory software for taking notes and creating or editing text files.

AV Linux runs a customizable version of the Xfce 4 desktop environment with an impressive collection of graphic creation tools but has few everyday applications included.

You do not get a word processor or complete office suite, which means you'll have to install your choices. You must use Synaptic package manager to add or remove software. A separate system updater tool manages the distro's core packages.

Look and Feel

I like the current desktop appearance a lot less than previous versions of AV Linux. Xfce is a very satisfying and functional desktop environment, but its overall flat look in this integration leaves much to be desired.

The Xfce and QT4 combination here is flat and bland. Even applying some of the customizations leaves the look and feel very uninviting.

I also miss some of the refinements from earlier versions that didn't show up in this latest release. For example, the launch bar on the right edge of the screen was a nice touch. So was the quick launch Wbar that gave the desktop a bit of a Mac OS view.

Bottom Line

If you plan on checking out AV Linux, keep in mind that the live session ISO (which you must run in order to install or even load) requires a user name and a password to log in. You will find these necessities hidden in the ISO file name.

For the 64-bit version, the user name is isotester. The password is avl64. The 32-bit version is similar. Use isotester with avl32. For security reasons, you can not access root accounts on the LiveISO.

Want to Suggest a Review?

Is there a Linux software application or distro you'd like to suggest for review? Something you love or would like to get to know?

Please email your ideas to me, and I'll consider them for a future Linux Picks and Pans column.

And use the Talkback feature below to add your comments!

Proving once again that you can do a lot of damage with a little investment and a lot of ingenuity, security researcher Samy Kamkar recently managed to take down a locked, password-protected computer armed with only a US$5 Raspberry Pi.

The low-tech cookie-siphoning intrusion is one of Kamkar's simplest hacks ever. He previously has unlocked car doors, garages, wireless remote cameras and other devices, with MacGyver-like precision.

Kamkar's latest hack, PoisonTap, uses a Raspberry Pi Zero, a micro SD card, and a micro USB cable or other device that emulates USB, including USB Armory or LAN Turtle.

Windows, OS X and Linux recognize PoisonTap as an Ethernet device, load it as a low-priority network device, and perform a DHCP request across it, even if the computer is locked or password-protected, Kamkar explained.

PoisonTap provides the computer with an IP address. However, the DHCP response tells the machine that the IPv4 space is part of PoisonTap's local network, rather than a small subnet, he said.

If a Web browser is running in the background, one of the open pages will perform an HTTP request in the background, noted Kamkar. PoisonTap responds with a spoof, returning its own address, and the HTTP request hits the PoisonTap Web server.

When the node Web server gets the request, PoisonTap's response is interpreted as HTML or JavaScript.

The attacker is able to hijack all Internet traffic from the machine and siphon and store HTTP cookies from the Web browser or the top 1,000,000 Alexa websites.

Low-Cost Havoc

"The PoisonTap project is an extremely clever and creative attack that can have serious consequences," said Mark Nunnikhoven, vice president for cloud research at Trend Micro.

"The code is public, and hardware required to run it is only a few dollars, which increases the risk to average users," he told TechNewsWorld. "However, it still takes some effort for an attacker to steal the user's data."

For the device to work, the attacker needs physical access to the machine while a Web browser is running in the background, noted a Symantec researcher in comments provided to TechNewsWorld by spokesperson Jenn Foss.

The risk is lower when a machine has restricted physical access. The risk is higher when a machine is in the public domain, where anyone potentially has access to it -- for example, at a sidewalk cafe.

Open Source Factor

It might be easier to build a solution to the hack, given that Kamkar's attack was conducted over an open source language, suggested the Symantec researcher. "If someone slips a secret backdoor into an open source project, chances are someone will find it quickly. Often open source is quicker to address vulnerabilities as an open source community can be very large."

In addition, if someone creates a tool and the source code is publicly available, anyone can read the code and develop proper protection for the future, the Symantec researcher pointed out.

"It's certainly very creative work, and it shows just how many attack vectors exist that we've yet to really consider," remarked Troy Hunt, Microsoft MVP-Developer Security.

"However, it also requires physical access -- and once you get to that point, there's a lot of avenues available to an attacker," he told TechNewsWorld.

The use of HTTPS could have crippled this particular attack, Hunt noted, and we don't normally think of that as being a defense against an adversary with physical access.

Recent high-profile distributed denial of service attacks on the Internet's infrastructure and an investigative journalist's website have spiked concerns over possible disruptions of traffic during the biggest online shopping weekend of the year.

Online spending last year exceeded US$5.8 billion on Black Friday and Cyber Monday, according to Adobe, and that figure is expected to be even higher this year.

"If you want to mess with the economy, that's the most disruptive time to do that," said John Wu, CEO of Gryphon.

"A lot of retail sales have shifted from brick and mortar to online these days," he told TechNewsWorld. "Cyber Monday is a huge day for a lot retailers."

Easy Target for Bot Herders

If hackers want to disrupt shopping during the Black Friday-Cyber Monday weekend, they'll likely use a botnet composed of devices connected to the Internet of Things to do it. Such botnets recently attacked DNS server provider Dyn, disrupting Internet service in the United States.

Attackers also used them to launch one of the largest DDoS attacks ever on the website of security blogger Brian Krebs.

"The reason IoT devices are being used now is because they're so easily attacked," Wu said. "They also have enough processing power on them to carry out these kinds of attacks."

What's more, devices like routers and DVRs are always on, so they're always available for enlistment in an assault on a website.

"You can have a huge effect because you can control lots of the devices -- in some cases hundreds of thousands -- and flood a server," Wu said, "and it's very difficult to prevent these attacks, because they're coming from IP addresses around the world. You can't scale your bandwidth fast enough to prevent it."

During Black Friday-Cyber Monday weekend, the situation will be exacerbated by a legitimate surge in traffic.

"Some sites went down last year because they couldn't handle the spike in traffic to them," Wu explained. "You could compound that effect with a denial of service attack."

10 Million Logins an Hour

Botnets can do more than disrupt shopping traffic during Black Friday-Cyber Monday weekend. They can crack into user accounts at e-commerce sites, using the millions of username and password pairs available on the Internet from hundreds of recent data breaches.

"Because human beings resuse their passwords, that attacker is going to be successful when he uses a password stolen from another website," said Omri Iluz, CEO of PerimeterX.

"On average, a person uses six passwords for all their online activity," he noted.

"These attacks are very successful," Iluz told TechNewsWorld. "With 10,000 bots, thousands of accounts can be compromised in a matter of hours."

Automation is crucial to those kinds of attacks, however, he said. "It's only meaningful if they can run 10 million or more login attempts in an hour to get the success rate they need."

Gift Card Scams on Steroids

Digital desperadoes also have brought the power of bots to another holiday scam: compromising gift cards. After figuring out how gift card numbers are generated for a retailer, an attacker can write a script for the botnet to execute to determine if there's a balance on the card.

A hacker could check tens or hundreds of millions of combinations in that way and then register and sell cards discovered to have a balance.

Unsafe mobile apps also might victimize Black Friday-Cyber Monday shoppers.

Researchers found 5,198 Black Friday apps in global app stores for a recent RiskIQ study. Of those, one in 10 already had been tagged as malicious and unsafe to use.

Be Paranoid

Online bandits also are exploiting the reputation of some of the largest e-commerce sites on the Web to prey on consumers.

The top five brands leading in e-commerce have had a combined total of more than 1,950 blacklisted URLs that contain their branded terms as well as "Black Friday" and are linked to spam, malware or phishing, the RiskIQ report notes.

The same is true of apps from those brands. More than 1 million blacklisted apps reference one of the leading e-commerce brands in either their title or description, according to the study.

While consumers can't do anything about a DDoS attack on one of their favorite shopping sites, they can protect themselves from attacks aimed directly at them.

"Consumers need to be paranoid about what kinds of things people might do to lure them into scams," said Venkat Rajaji, senior vice president for marketing at Core Security.

"You've got to keep your guard up during the holiday season. Don't click on any link in a consumer email unless it's a highly, highly trusted source," he told TechNewsWorld.

"You've got to be paranoid," Rajaji added. "You've got to assume the worst when you're shopping."

Breach Diary

• Nov. 14. Data breach at Friend Finder Network places at risk personal information in more than 412 million accounts.
• Nov. 14. Adobe agrees to pay $1 million to 15 states to settle case stemming from 2013 data breach at the company, which resulted in unauthorized access to accounts of some 552,000 people.
• Nov. 15. Seventeen-year-old boy pleads guilty in UK to data breach last year at telecommunications provider TalkTalk, which resulted in unauthorized access to personal data of nearly 160,000 people.
• Nov. 15. TalkTalk reports profits more than doubled to $75 million from $31 million during the 12 months following a data breach at the telecommunications provider.
• Nov. 15. Kryptowire discovers several models of Android mobile devices sold through major U.S.-based online retailers, which contain firmware that collects sensitive personal information without the owner's knowledge or consent, and sends it to third-party servers.
• Nov. 16. Workers at Indian security firm AI Solutions discovered selling phone records of Australians from call centers of Optus, Telstra and Vodaphone.
• Nov. 16. Database configuration error exposes to public Internet personal information of nearly 25,000 members of Sheet Metal Workers Local Union No. 104 in California.
• Nov. 16. Protenus reports month-to-month decline in healthcare data breaches to 35 in October from 37 in September, although the number of patient records compromised increased to 776,533 from 246,876.
• Nov. 16. Personal records of more than 34 million residents of the Indian state of Kerala were posted to Facebook by a hacker disenchanted with the security of the state's computer systems, GulfNews reports.
• Nov. 17. Chicago Public Schools notifies families of some 30,000 students that confidential information about them was shared improperly with a charter school operator for use in a mail advertising campaign.
• Nov. 18. The Three mobile network in the UK reports personal information of more than 130,000 customers was compromised by data breach made public earlier in the week and for which three men were arrested on Wednesday.
• Nov. 18. Michigan State University announces it will notify some 400,000 current and former students and staff of data breach that has compromised their personal information.
• Nov. 19. Russian telecom watchdog Roskomnadzor discovers data breaches at 55 websites that contain personal information of children who have written to "Father Frost," the Russian Santa Claus.

Upcoming Security Events

• Nov. 28-30. FireEye Cyber Defense Summit 2016. Washington Hilton, 1919 Connecticut Ave. NW, Washington, D.C. Registration: through Sept. 30, general admission, $495; government and academic, $295; Oct. 1- Nov. 21, $995/$595; Nov. 22-30, $1,500/$1,500.
• Nov. 29, Secure Your Enterprise to Maintain Quality of Care. 5 a.m. ET. Webinar by Alto Networks, Free with registration.
• Nov. 29-Dec. 1. Gartner Identity & Access Management Summit. Caesars Palace, 3570 Las Vegas Blvd., South Las Vegas, Nevada. Registration: $2,850; public sector, $2,350.
• Nov. 30. Smart Cities & Critical Infrastructure Cyber Attack Vulnerabilities. 9 a.m. ET. Webinar by Cyber Education Centre. Free with registration.
• Nov. 30. How is Data Analytics Reducing Payments Fraud? 10 a.m. ET. Webinar by BrightTalk and Fiserv. Free with registration.
• Nov. 30. Cyber Attackers and the Law - Threats, Challenges & Regulations. 11 a.m. ET. Webinar by Centre for Strategic Cyberspace + Security Science. Free with registration.
• Nov. 30. Threat Hunting for Command and Control Activity. 2 p.m. ET. Webinar by Sqrrl. Free with registration.
• Nov. 30. Securing the Cloud: Trends in Cloud, Collaboration & Security. 2 p.m. ET. Webinar by Dropbox. Free with registration.
• Nov. 30. Cyber-Intelligence: Protecting Yourself Against Your Own Worst Enemy. 2 p.m. ET. Webinar by Centre for Strategic Cyberspace + Security Science. Free with registration.
• Nov. 30. Intelligence: The Planners Strategic Edge. 3 p.m. ET. Webinar by Centre for Strategic Cyberspace + Security Science. Free with registration.
• Nov. 30. Cyber Supply Chains: Risks & Protection. 4 p.m. ET. Webinar by U.S. Cyber Defence Advisor to NATO. Free with registration.
• Nov. 30. How Artificial Intelligence Supports Security Science in Security Operations. 5 p.m. ET. Webinar by Centre for Strategic Cyberspace + Security Science. Free with registration.
• Nov. 30. Best Practices for Preparing for Breaches. 1 p.m. ET. Webinar by Centre for Strategic Cyberspace + Security Science. Free with registration.
• Dec. 1. The Big Challenge of Big Data: Untangling the Security Conundrum. 11 a.m. ET. Webinar by Gemalto. Free with registration.
• Dec. 2-3. B-Sides Phliadelphia. Drexel University, 3141 Chestnut St., Philadelphia, Pennsylvania. Free.
• Dec. 6. The 2017 Threatscape. 9 a.m. ET. Webinar by ISF Ltd. Free with registration.
• Dec. 6. Storm on the Horizon -- 2017 Threats Both Foreign and Familiar. 2 p.m. Webinar by OCD Tech. Free with registration.
• Dec. 7. Insider Threats and Critical Infrastructure: Vulnerabilities and Protections. 10 a.m. ET. Webinar by @LKCyber. Free with registration.
• Dec. 7. Weaponizing Data Science for Social Engineering: Automated E2E Spear Phishing. Webinar by ZeroFOX. Free with registration.
• Dec. 7. Quantum Threats: The Next Undefended Frontier of Cybersecurity. 1 p.m. ET. Webinar by Isara Corporation. Free with registration.
• Dec. 7. Trends in Email Fraud, and How to Prevent Enterprise-Facing Email Attacks. 2 p.m. ET. Webinar by Agari. Free with registration.
• Dec. 8. Cybersecurity Trends -- Security Analytics Is the Game Changer. 1 p.m. ET. Webinar by Interset. Free with registration.
• Dec. 8. I Heart Security: Developing Enterprise Security Programs for Millennials. 5 p.m. ET. Webinar by NCC Group. Free with registration.
• Dec. 12. How Cybersecurity, Technology and Risk Is Maturing the Role of the Modern CISO. 5 p.m. ET. Webinar by City of San Diego, California. Free with registration.
• Dec. 13. You CAN Measure Your Cyber Security After All. 1 p.m. ET. Webinar by Allure Security Technology. Free with registration.
• Jan. 12. FTC PrivacyCon. Constitution Center, 400 7th St. SW, Washington, D.C. Free.
• Jan. 16. You CAN Measure Your Cyber Security After All. 1 p.m. ET. Webinar by Allure Security Technology. Free with registration.

Welcome, dear friends, to Gadget Dreams and Nightmares, the column that's distracted itself from the shellshock of the election just long enough to cast a beady eye over the latest gadget announcements.

Spied from inside the comfort of a warm blanket this time around are a curved monitor, a robot with Alexa integration, and a cloud-based DVR from TiVo.

As always, we are sworn to inform you that these are not reviews, and the ratings reflect only how much I'd actually like to try each, assuming my nerves hold up long enough to handle any gizmos.

Around the Bend

A little more than four months after moving to a new apartment, I'm at long last about to start setting up my office. Goodbye, Ikea dining table. Hello, fancy new desk. When I actually have my new setup, I'd like to have a monitor at long last to complement my laptop. AOC's latest is under serious consideration.

The AG352QCX, pictured above, is a 35-inch, curved behemoth with two USB 3.0 ports, one HDMI 2.0 input, VGA, DVI, audio in and out ports, and DisplayPort 1.2. That's plenty enough for most people's purposes, though a second HDMI port would have been welcome.

Do note that when I say I'll have an "office" for "work," I fully intend to spend plenty of time in that little nook playing games as well, so a monitor designed for interactive action is high on the priority list. The 200-Hz refresh rate and 4ms response time, along with FreeSync (which smooths gameplay and reduces screen tearing), should help make sure I get the bad guys before they get me.

The 1080p resolution is not fantastic for the price -- Pounds 699, approximately US$866 -- when we're edging toward 4K and Retina displays becoming commonplace. That's more a concern for desktop usage, though. The lower resolution will be less noticeable for high-refresh rate gaming taking up the entire screen.

It fits my needs, giving me extra screen real estate while working, and a monitor on which to play games in the off hours. It's probably a little too large for me, though, even if the curved screen does look great.

Rating: 4 out of 5 I'm Working, Honestlys

Rolling Robot

Regular readers may note that there is virtually zero chance of me giving a low rating to a cute robots with giant eyes, even if those peepers are on a screen and not physical eyes.

Omate's Yumi has a 5-inch display for a face and can show different expressions, while it has a light ring to alert you to notifications. More practically, it has Alexa integration: A microphone and speakers let you issue commands and receive feedback from Amazon's personal assistant.

It has wheels, so it is somewhat mobile. Unfortunately, it can't rotate its head, and while there's a camera for video calls, Yumi needs to stay in place for that, so you can't chat to a relative through the robot while walking around your home.

The little cherub is winsome and with the helpful Alexa integration, I would not hesitate to bring one home. Still, there are better-looking alternatives already on the market, and I suspect plenty more are on the way.

Rating: 4 out of 5 Adorabots

TV Everywhere

Less of a product announcement than a leak, the first few details of TiVo's cloud-based DVR have seeped into the world. It seems the Mavrik saves all the shows you want to watch later in the cloud, and you'll be able to stream them whenever you want.

Certainly, there are streaming services around, like Hulu and HBO Go, which provide consumers a way to watch shows soon after they air. These services are decentralized, though, and without paying for a whole bundle of them, it's unlikely you'll find it easy to watch all of your favorite shows.

A system like Mavrik should cut out the wait time, and save the shows you want instead of relying on each service's cherry-picked portfolio -- as long as you have the cable package to match, that is.

The box connects directly to a TV antenna, according to the leak, though it appears you can stream both live and recorded shows and movies using an app. Mavrik would have been dead on arrival if TiVo didn't allow users to stream content to whichever device they prefer to watch on, so in-app streaming is heartening.

There are other cloud-based DVR systems around, though none really have the brand value of TiVo, meaning this could become a commonplace setup in relatively short order. It will require a subscription, of course, but the likely utility of Mavrik just might make it worthwhile. The cost of the subscription plus a cable package nullifies the convenience for me, but it just might stick for others.

Rating: 3 out of 5 Bad Sitcoms

I had a fascinating experience last week. I got to see and experience the new Jaguar I-Pace, the company's electric answer to the as-yet-unannounced Tesla Y SUV, long before I'll actually get to see the prototype. I didn't just get to see the car -- I got to understand intimately why the car was created and what went into its design. I got to experience aspects of the vehicle viscerally, without actually getting into it.

My experience was possible due to an alliance between Dell, HTC and Jaguar. It dovetails with a project that Nvidia and Audi have undertaken to showcase cars in dealerships without the dealerships actually having to floor the car. It opens the door, ironically, to an even more localized experience than Tesla has with its store front dealerships.

I think VR eventually will change how we buy most physical things, and I find it amazing that it is starting with cars first. I'll focus on that this week and close with my product of the week, which has to be this amazing new car from Jaguar. I loved it so much I got on a list to order it.

Virtual Reality

There are three visual technologies in the process of coming to market right now. There's augmented reality, which Google Glass showcased and nearly killed. AR overlays information over the real world -- usually through some kind of small head-mounted projector muck like a heads-up display. Like heads-up displays, AR doesn't really change what you see -- it enhances or augments it.

The newest of the new visual technologies is mixed-reality, which uses massive computing power to render and blend the real world with what is rendered. In its final form, you can't tell the difference. It is pretty rough and more proof-of-concept now, with Microsoft's Hololens the closest to production. That's largely because it cheats, though -- it is more an augmented reality device.

Virtual Reality is a fully rendered technology that places you in an environment. There are low-end offerings that use smartphones, which actually are surprisingly good. High-end versions use high-end PCs, as well as workstations and headsets from firms like HTC and Facebook subsidiary Oculus Rift. They now can create experiences that are ever harder to distinguish from reality. This is the technology that Jaguar, Dell and HTC demonstrated.

Car Showcase

Firms like Audi and Jaguar are working to figure out how to get people more excited about new cars, how to find new ways to engage and drive purchases, and how to assist in the car ordering process. This last is where Audi and Nvidia focused their effort.

Their project enables a space in dealerships where a prospective buyer can put on a VR headset and then see the full range of options. It's as if the customer's perfect car were right there. Options include not only interior and exterior finishes and colors, but also features. Customers then can experience each feature or package as they would if they actually were driving the car. They can figure out, before paying for it, whether the car is worth their money.

This is particularly important for newly launched cars. Mistakes often are made in ordering, because people either don't realize they want a feature or it accidentally gets left out. That happened to me last month, when I got the Mercedes I'd ordered. A feature I'd asked for was left off the final order sheet due to changes made to the ordering system.

Had I been able to see the rendering of the car I'd ordered, I would have caught the omission and not have missed this important feature (built in garage door opener and self-dimming mirrors).

This is just the start, though, and Jaguar, Dell and HTC took it further. (I should point out that the Dell workstations used to create and show this technology used Nvidia graphics solutions, so Nvidia is in both systems.)

VR on Steroids

What Jaguar did was add significantly to this experience by changing the presentation from just a showcase for the car to a showcase for the whole story that surrounds the car. Manufacturers can hope we fall in love with a car at first sight, and some of us certainly do, but a far more powerful way to sell us on a car is to build a compelling story around it. It's like the difference between seeing actors' head shots vs. getting to know them and experiencing their art.

They started our tour by taking us up above Earth to about where the Space Station orbits. That gave us an amazing, almost god-like view as they walked us through the birth of the car and built the car out with each storied major component, while both showcasing and telling us the back story.

We then plunged to Earth were we could see the rendered car perform on roads. We got to sit in the car and have each major feature showcased, with Jaguar's top designer explaining why each feature existed and, in some cases, why particular decisions were made.

As a result, the car wasn't two dimensional for us. We left understanding deeply why the car was the way it was, and that helped drive a higher level of lust in us.

The Future

I think this is only the tip of the iceberg, because VR will allow you to do this wherever VR capability exists, potentially turning your future living room into a dealership. In addition, you could build driving experiences into presentations and embed cars into other content -- like VR games.

The next time you play a driving game, might actually play it with the car you own or the car the advertiser wants to sell you. Finally, they could actually give cars virtual personalities, much like in the movie Cars. Your car, or the car the firm wants to sell you, could be the hero of a coming virtual movie. That would get your kids wedded to the cars you drive and go well beyond what many of us did when young and named them (yes, I did that).

Wrapping Up: Massive Change

This is only one of the massive changes we will see -- not only in the automotive market, but also in the appliance market, the home market, and anyplace where seeing something rendered could assist in the offering's sale or use.

These experiences won't be limited to VR. As we move to mixed reality, we'll be able to see products as they would exist in our homes and cities long before they are actually built.

As we move to self-driving cars, this may be how we gain back the fun of driving -- by virtually driving in game-like settings while the real-world car we're riding in safely transports us to where we want to go. I've seen the future of cars -- and most of everything else -- and that future is virtual!!

It is rare I get this excited about a car that doesn't yet exists. The last time it happened was when Infiniti brought out the FX-45 and made it look just like the amazing show car. I fell in love and bought the first one that came to Silicon Valley.

Well, it happened again with the Jaguar I-Pace, an amazing all-electric SUV that makes the Tesla X look stupid.

Granted, one reason the I-Pace makes the Tesla X look stupid is that Tesla apparently missed the meeting that explained "SUV" means "sport utility vehicle." The X is not sporty -- you'd never take it off-road -- and it has poor utility, because the back seat doesn't fold down.

The X is also incredibly unreliable because of an excess of tech, like the electric gull wing doors, which not only are wicked expensive, but also seem to break constantly.

The I-Pace, in contrast, uses more advanced batteries that help give it a range of 300-plus miles. Its focus is on performance: Its zero-to-60 time is 4 seconds, and if delivers far improved on- and off-road handling. It's all wrapped in an extremely attractive body.

Jaguar I-Pace Concept Car

The only sad thing for me is that this car likely won't have the advanced rain and snow eliminating headlights Jaguar has been developing with Intel. They're due in 2020, while the car arrives in 2018.

Although this is a concept car, I spoke with some of the engineers, and it is almost identical to the final car. The only big difference is that it will have a fold-down back seat, so Jaguar clearly didn't miss the "utility" part of the "SUV" class name.

One of the interesting aspects of the I-Pace is that it uses water cooling. Heat is the enemy of batteries, so that decision allows the company not only to make the car look more like others, but also to gain value as a result.

In the end, the I-Pace is a drop-dead gorgeous car. I loved it so much I signed up to order one. Further, it is a showcase for how VR can be used to sell cars, so I had two reasons for making it my product of the week.

Hackers have stolen information of more than 400 million users of Friend Finder Networks, which runs several adult dating and pornography websites, LeakedSource reported earlier this week.

This is Friend Finders' second breach in two years. Last year, hackers accessed 4 million accounts, exposing information on users' sexual preferences and extramarital affairs.

Data of more than 412 million users was compromised in the latest breach, LeakedSource reported. Passwords taken in the breach were either in plain text or SHA1 hashed, and neither method could be considered secure.

The hashed passwords appeared changed to all lowercase before storage, making them easier to attack, the LeakedSource team noted. However, it also makes them less easy to use in the real world.

Whatever Hackers Want, Hackers Get

Friend Finder reportedly has been aware of potential security vulnerabilities for several weeks and has been taking steps to investigate them. Several reports of flaws apparently were extortion attempts, but one was an injection vulnerability that the company fixed.

Friend Finder did not respond to our request to comment for this story.

Friend Finder maintains that it takes the security of its customers seriously, as is typical of companies that suddenly find millions of their users' accounts hacked.

"It is hard to tell if a company that has been breached is lax in their security," said Jon Clay, director of global threat communications at Trend Micro.

"History has proven that hackers are able to penetrate many organizations regardless of their security controls," he told TechNewsWorld.

However, this case doesn't merit the benefit of the doubt, according to Stu Sjouwerman, CEO of KnowBe4.

"This is criminal negligence, as it's not the first time," he told TechNewsWorld.

"This hack is very similar to the data breach they had last year," Sjouwerman said. "Their procedures and policies are severely lacking. Even users who believed they deleted their accounts have had them stolen again. "

There were nearly 16 million accounts with @deleted1.com appended to them, LeakedSource said, which could mean Friend Finder decided to store information on accounts that users wanted deleted.

Friend Finder wouldn't be alone in such treatment of customers who asked to have their accounts deleted, noted Tony Anscombe, the security evangelist at Avast.

"It's very difficult to have a company delete your account data. Typically, the settings to do it are hidden. They don't want to delete you because they want to market to you going forward," he told TechNewsWorld.

"There has to be a better method across the whole industry of allowing somebody to remove their data from a database," he added.

Get Ready for Extortion

The consequences for users from the breach at Friend Finder likely will be similar to those suffered by users of the infidelity site Ashley Madison after its data was breached.

"Identity theft and extortion are two of the main consequences for the victims whose information was stolen," said Trend Micro's Clay.

Anyone with an email address in the stolen data can expect to receive harassing or threatening emails, as well as click bait offers to "see if your name and password are on the list," KnowBe4's Sjouwerman added.

"Do not go looking for your data," warned Avast's Anscombe.

"Lots of scammers will say they've got it. There will be sites popping up saying 'check to see if you were part of this breach.' Those sites are gathering data," he explained.

"When you type in your email address to see if you were part of the breach -- guess what? -- you just gave a cybercriminal somewhere your email address," he said.

Short Attention Span

Consumers aren't the only ones who suffer from gigantic breaches.

"Data sets of credentials that contain user names, emails, passwords, and answers to secret questions are sold to attackers targeting enterprises," noted Israel Barak, CISO of Cybereason.

"They're looking to take advantage of users that re-use their passwords," he told TechNewsWorld.

"Those users use the same password for the dating site, as well as for their corporate email, corporate VPN, personal email, personal bank account and so forth," Barak said.

"This scenario has been shown to be extremely effective after the LinkedIn breach that led to numerous secondary breaches based on reused passwords," he added. "This will be a very likely outcome of the Adult Finder breach as well."

And what about the damage to Friend Finder? The breach likely will be no more than a near-term setback for Friend Finder, if Ashley Madison is any indicator. Traffic bounced back in a short period of time following its massive hack attack.

However, the impact is "broader than these sites," said Rami Essaid, CEO of Distil Networks.

It affects "how we are as a society in general," he said.

"Target rebounded; Home Depot rebounded," Essaid told TechNewsWorld. "The repercussions of being a victim of a breach are short-lived. We have a very short memory as a society and are not holding people accountable long-term."

GoPro's ambitious plans to be a player in the fledgling drone market crashed last week when it had to announce a product recall due to Karma UAV units falling from the sky.

The company needed to resolve a performance issue related to loss of power during operation, it said. It indicated it would resume shipment of Karma at some point, but didn't suggest when.

The Karma recall likely will have a significant financial impact on GoPro.

"With the amount of competition in the consumer drone space, it is imperative to satisfy demand, or that demand will shift to another product," said Michael Blades, a senior industry analyst at Frost & Sullivan.

"The longer Karma is sidelined, the less chance it has of grabbing significant market share," he told TechNewsWorld.

Revenue Hit

GoPro's stock price had begun slipping before the recall and has continued to decline steadily, Blades added.

"The impact will be on stock price and revenue," he said.

GoPro already had lowered its fourth-quarter revenue forecasts because it launched Karma later than planned, explained Ken Hyers, director of wireless device strategies at Strategy Analytics.

"In the two weeks it was available, GoPro sold around 2,500 Karma drones and surely had been anticipating strong sales for the Karma drone from Thanksgiving on. That revenue is now lost," he told TechNewsWorld.

"Worse, GoPro had been counting on the Karma to drive sales of its new GoPro Hero5 and Hero5 Session cameras, and now that opportunity has also been lost," Hyers added.

Black Eye

Since Karma was GoPro's first UAV, the drone was supposed to establish the company's reputation in the market. It has done that -- but not in a good way.

"Given that the Karma is GoPro's first drone, and in many ways was seen as the future of the company, it's recall has to be viewed as devastating for its reputation as a drone maker and its ambitions in the drone space," said Hyers.

"Drone buyers are more likely to avoid GoPro in the future, with severe consequences for the company's future drone and camera sales," he noted. "There are simply too many very good drone alternatives available on the market for buyers to risk giving GoPro another chance."

The recall emphasizes the fact that GoPro is a camera company and not a drone company, Frost's Blades added.

"GoPro should not have been expected to develop a perfect product with its first drone," he said. "However, the market is innovating so quickly that if your product is not better or more capable than the latest products, you will likely fail."

Flawed Strategy

Consumer interest in UAVs has been less than anticipated by the industry, and the Karma recall isn't going to improve that, observed Brad Russell, a research analyst with Parks Associates.

Less than 5 percent of U.S. broadband households own a drone, and less than 4 percent said they were interested in owning one at the beginning of the year, he noted.

"Negative drone stories in the press and mechanical failures, such as GoPro's recent troubles, are likely stifling consumer interest outside of film and video professionals and enthusiasts," he told TechNewsWorld.

Even without the recall of Karma, GoPro's prosumer drone strategy may be flawed, suggested Philip Solis, a research director at ABI Research.

Although revenues from prosumer drones amount to about half of the $1 billion consumer drone market, those drones represent only 6 percent of drones shipped in the space.

"GoPro's strategy should be to use drones to expand the sales of their cameras, but they're pricing themselves into the prosumer space, which is low volume, which means a very tiny amount of additional cameras sold," Solis told TechNewsWorld.

Debacle for GoPro

What's more, by selling Karma at $799, GoPro is going head-to-head with the established leaders in the market, DJI and 3DR. "If you're not DJI or 3DR, it's awfully hard to compete in the market," Solis said.

"If they had a product at $400 to $600, they could compete better in the market and sell a lot more cameras," he maintained.

"The Karma drone has been a debacle for GoPro, and it will be extremely challenging for them to bounce back in the drone market after such an awful start," said Strategy Analytics' Hyers. "Going forward, GoPro should partner with another drone maker and outsource drone development. It's clearly not ready to do it on its own."

The JuJu cloud platform developed by Canonical integrates a wide variety of cloud services and servers on both public and private clouds using an innovative model-driven software approach.

That success has changed fundamentally the nature of software operations as organizations move to cloud-scale services, according to Mark Shuttleworth, founder of Canonical.

The impact on cloud operations is very much like the transition that happened with the big data community, Shuttleworth told technology writers and analysts during a teleconference earlier this week.

"That brought about a velocity of change in the data field -- the same thing we believe is happening with the cloud software," he said.

Juju is an interesting approach to managing installation and configuration in a visual or model-driven way, observed Al Hilwa, program director for software development research at IDC.

"In this sense, it brings many of the benefits of modeling which have typically been used in software development to the realm of software configuration and life cycle management," he told LinuxInsider.

What It Does

Canonical developed JuJu as an open source service orchestration management tool. The platform facilitates fast deployment, integration and scaling of software using a wide choice of cloud services or servers.

JuJu is built around a service modeling tool that provides a quick way to model, configure, deploy and manage applications in the cloud with only a few commands. JuJu can deploy hundreds of preconfigured services, OpenStack, or an organization's own code to any public or private cloud.

"The big challenge today is for corporations to operate the same way on the public clouds and the private infrastructure," said Shuttleworth. "JuJu solves that problem."

JuJu lets users integrate complex software to scale very quickly. It gives operators an effective way to share the cost of integration and operations across all of the consumers of the software, he said.

How It Works

JuJu employs preconfigured bundles and customized charms, which are available from the JuJu app store.

Charms are sets of scripts that simplify the deployment and management tasks of a service. They are regularly reviewed and updated.

Bundles are collections of charms that link applications together. That enables the deployment of whole chunks of infrastructure in one action.

"While the tool is competitive with other configuration management tools in some ways, it is really intended to operate at a higher-level of abstraction across multiple software domains," said Hilwa.

Juju's success will rely on two factors, according to Hilwa. One is its support for multiple environments. The second is the ecosystem support it receives to install and connect more and more products.

Costly Operations

"The cost of operating software today is shifting. Organizations have to learn to optimize operations cost rather than purchasing strategy effectively," said Shuttleworth.

Ubuntu is the platform that most people use as they move into the cloud. That is true just as in the previous generation Linux started replacing Windows and Solaris, largely on RedHat and Suse, he said.

"In this generation, Ubuntu is very much the lead platform," Shuttleworth claimed. "We see more than 50 percent of software consumers, like big banks, moving to Ubuntu today. They are moving to Ubuntu because of the operations in the cloud we are talking about today."

Playing With Models

Software is becoming more complex because of microservices, noted Shuttleworth. Today's software has massive components that run on hundreds of nodes instead of a few nodes. The pace of change has never been seen before.

"The way to handle all this is to change to a model-driven operation," he said.

JuJu is the open source version of the model-driven software approach used for data operations of companies like Google, Amazon and Goldman Sachs, noted Shuttleworth. All of these large companies have their own homegrown versions.

"JuJu solves the problem of how do you operate on a public cloud and on a private infrastructure in exactly the same way," said Shuttleworth. "The big picture story today is operations across two widely different domains."

While not quite at the level of a parting of the waters, the news that Microsoft has joined The Linux Foundation may seem miraculous to those aware of the past enmity between the company and the open source community.

Microsoft has joined The Linux Foundation as a platinum member, it announced Wednesday at its Microsoft Connect conference in New York.

Google has joined the .Net foundation, Scott Guthrie, executive vice president of Microsoft Cloud and Enterprise, also told attendees. Further, Microsoft and Samsung Electronics have joined forces to allow .NET developers build apps for millions of Samsung devices.

The first demo during the Connect conference was with Visual Studio Code, which has attracted more than 1 million developers, Guthrie said -- a sign of how the company has embraced open source.

The number of people who created their first GitHub repository has doubled in the past year from 5,000 to 10,000 per day, GitHub CEO Chris Wanstrath told attendees.

"More and more, we're seeing not just pure open source companies, but companies that have either not embraced open source in the past or sort of done it here and there, really fully embracing open source, particularly the developer communities," he said.

Microsoft over the past two years has transformed the way it uses open source with the launch of .Net, he said, showing data indicating that Microsoft was the No. 1 company with contributors on GitHub, at 16,419.

Shock and Skepticism

Linux Foundation Executive Director Jim Zemlin told Guthrie on the conference stage that when he told a few people in advance that he would be announcing the move, they responded, "What's the catch?"

The foundation and Microsoft have had disagreements in the past, Zemlin acknowledged, but with the growing importance of mobile and cloud, there is "too much software to be written for one organization or individual to write it by themselves," he said.

John Gossman, architect of the Microsoft Azure team, will join The Linux Foundation's board of directors.

Microsoft previewed several new products that show their capabilities across multiple platforms, including SQL Server on Linux, Visual Studio for Mac, Azure App Service on Linux with support for containers, Visual Studio Mobile Center, Visual Studio 2017, and Azure Data Lake Services, which allows developers and data scientists to store petabyte-size files.

"From what we see, Microsoft continues to recognize the importance of Linux and other open source technologies in the marketplace," observed Mike Ferris, vice president of business development and architecture at Red Hat.

"Microsoft has been progressing towards putting more and more of its platform software in open source," said Al Hilwa, program director for software development research at IDC.

"I think putting software in open source is the first step, but to get the true benefits of the process, you have to engage community and recruit contribution," he told LinuxInsider.

The move also reflects the work done by The Linux Foundation to include other prominent open source projects and communities, ranging from Cloud Foundry to Cloud Native Computing Foundation, node.js and Open Container Initiative, 451 Research Principal Analyst Jay Lyman told LinuxInsider.

The bad blood between Microsoft and Linux ran deep for many years, as the company viewed open source as a threat to its Windows operating system dominance.

Samsung Mobile

Samsung announced a new collaboration with Microsoft on open source projects, including .Net core and Xamarin.Forms, to enable .Net support for Tizen, the company's Linux-based open source operating system for more than 50 million Samsung devices.

Samsung released a preview of Visual Studio Tools for Tizen, which will allow developers to build applications for a variety of Samsung devices, ranging from smartphones to smart TVs, wearables like the Gear S3, and IoT devices.

The preview supports development for mobile apps, Samsung said, through device emulators and an extension to Visual Studio with full IntelliSense and debugging capabilities. Tizen's .Net support will become available for all devices in 2017.

Russian digital forensics firm ElcomSoft on Thursday reported that Apple automatically uploads iPhone call logs to iCloud remote servers, and that users have no official way to disable this feature other than to completely switch off the iCloud drive.

The data uploaded could include a list of all calls made and received on an iOS device, as well as phone numbers, dates and times, and duration, the firm said.

Apple retains the cloud-based data for up to four months, according to ElcomSoft's report. It includes calendars, wallet, books, notes and other data synced with iCloud. Even photos may be retained remotely longer than Apple has indicated.

Apple currently relies on a two-factor authentication system that requires an iCloud token along with an Apple ID and password, but ElcomSoft's new Phone Breaker 6.20 software can allow law enforcement to bypass those checks.

For its part, Apple has defended the fact that the data is backed up on the cloud.

"We offer call history syncing as a convenience to our customers so that they can return calls from any of their devices," an Apple spokesperson said in a statement provided to TechNewsWorld by company rep Ryan James.

"Apple is deeply committed to safeguarding our customers' data," the spokesperson added. "That's why we give our customers the ability to keep their data private. Device data is encrypted with a user's passcode, and access to iCloud data including backups requires the user's Apple ID and password. Apple recommends all customers select strong passwords and use two-factor authentication."

Privacy or Security?

ElcomSoft made its announcement not so much to call attention to the potential weaknesses in Apple's data storage practices, as to address how easily its own software can obtain the information. It is billed as a tool for law enforcement, but it's not too hard to imagine that hackers could utilize similar tools for nefarious purposes.

"It is very concerning, as this can't be something that is a surprise to Apple; it is baked into their design for the product and services," said Jim Purtilo, associate professor of computer science at the University of Maryland.

"Only Apple can speak to its motive for orchestrating this behavior, but this is a way to project an image of security to consumers," he told TechNewsWorld.

These iPhone users may believe their data are encrypted and secure, "which is mostly true, even if only on their actual device, while [Apple] is still working accommodatingly with the feds, who get tremendous value from the traffic analysis made possible by these saved data," Purtilo added.

Standard Practices

The fact that Apple is being called out this week is somewhat notable in its own right.

"Apple doesn't seem to be walking its talk in the sense of actually doing what it publicly claims to be doing," noted Charles King, principal analyst at Pund-IT.

The other part of this is in the lack of transparency customers have into the process, and the fact that there is no easy way to opt out, he told TechNewsWorld.

"If you use iCloud, you're in whether you want to be or not," King added.

However, "as several reports on Apple's situation mention, the company isn't alone in syncing or saving call data," King explained, adding that it is standard practice for U.S. carriers to retain call data for up to 12 months.

"Where Apple could run into problems is in foreign markets that restrict retention of caller data," he said. "The company also risks some egg on its face if ElcomSoft's contention that more data is collected and that some is retained for longer than Apple says is the case."

Who Guards the Guards?

The fact that this information is being uploaded to the iCloud is noteworthy, given the showdown that Apple had with the FBI over its ability to obtain information from an iPhone belonging to Syed Rizwan Farook, who carried out last December's terrorist attack in San Bernardino.

Farook's phone was protected cryptographically. Apple challenged more than 11 orders to assist in providing access to the phone, issued by the United States district courts under the All Writs Act of 1789.

The question is whether the FBI showdown was necessary, based on ElcomSoft's findings. Much of the data may have been on the iCloud and hence accessible.

"If most users rely on iCloud services, then police largely don't need the actual device in order to investigate someone; the data have already been disclosed for far more convenient access by whoever asks," explained Purtilo.

"Consumers should be so lucky that only the police are accessing their data; in this news, we more or less need to presume other less upstanding groups have been accessing the data too," he added.

For the vast majority of users, this may be a nonissue, noted Pund-IT's King.

"Most criminals and ne'er-do-wells probably know enough not to use their personal phones for conducting illegal business," he suggested.

"How threatening the practice may be is hard to say, but with Apple actively trying to pitch its products for enterprise applications and use cases, companies considering deploying iPhones and iPads may want to question how their employees' call data is being collected and secured," King added. "Personal communication is the lifeblood of many businesses, to the point that any threat of injury and hemorrhage should be avoided."

The JuJu cloud platform developed by Canonical integrates a wide variety of cloud services and servers on both public and private clouds using an innovative model-driven software approach.

That success has changed fundamentally the nature of software operations as organizations move to cloud-scale services, according to Mark Shuttleworth, founder of Canonical.

The impact on cloud operations is very much like the transition that happened with the big data community, Shuttleworth told technology writers and analysts during a teleconference earlier this week.

"That brought about a velocity of change in the data field -- the same thing we believe is happening with the cloud software," he said.

Juju is an interesting approach to managing installation and configuration in a visual or model-driven way, observed Al Hilwa, program director for software development research at IDC.

"In this sense, it brings many of the benefits of modeling which have typically been used in software development to the realm of software configuration and life cycle management," he told LinuxInsider.

What It Does

Canonical developed JuJu as an open source service orchestration management tool. The platform facilitates fast deployment, integration and scaling of software using a wide choice of cloud services or servers.

JuJu is built around a service modeling tool that provides a quick way to model, configure, deploy and manage applications in the cloud with only a few commands. JuJu can deploy hundreds of preconfigured services, OpenStack, or an organization's own code to any public or private cloud.

"The big challenge today is for corporations to operate the same way on the public clouds and the private infrastructure," said Shuttleworth. "JuJu solves that problem."

JuJu lets users integrate complex software to scale very quickly. It gives operators an effective way to share the cost of integration and operations across all of the consumers of the software, he said.

How It Works

JuJu employs preconfigured bundles and customized charms, which are available from the JuJu app store.

Charms are sets of scripts that simplify the deployment and management tasks of a service. They are regularly reviewed and updated.

Bundles are collections of charms that link applications together. That enables the deployment of whole chunks of infrastructure in one action.

"While the tool is competitive with other configuration management tools in some ways, it is really intended to operate at a higher-level of abstraction across multiple software domains," said Hilwa.

Juju's success will rely on two factors, according to Hilwa. One is its support for multiple environments. The second is the ecosystem support it receives to install and connect more and more products.

Costly Operations

"The cost of operating software today is shifting. Organizations have to learn to optimize operations cost rather than purchasing strategy effectively," said Shuttleworth.

Ubuntu is the platform that most people use as they move into the cloud. That is true just as in the previous generation Linux started replacing Windows and Solaris, largely on RedHat and Suse, he said.

"In this generation, Ubuntu is very much the lead platform," Shuttleworth claimed. "We see more than 50 percent of software consumers, like big banks, moving to Ubuntu today. They are moving to Ubuntu because of the operations in the cloud we are talking about today."

Playing With Models

Software is becoming more complex because of microservices, noted Shuttleworth. Today's software has massive components that run on hundreds of nodes instead of a few nodes. The pace of change has never been seen before.

"The way to handle all this is to change to a model-driven operation," he said.

JuJu is the open source version of the model-driven software approach used for data operations of companies like Google, Amazon and Goldman Sachs, noted Shuttleworth. All of these large companies have their own homegrown versions.

"JuJu solves the problem of how do you operate on a public cloud and on a private infrastructure in exactly the same way," said Shuttleworth. "The big picture story today is operations across two widely different domains."

Russian digital forensics firm ElcomSoft on Thursday reported that Apple automatically uploads iPhone call logs to iCloud remote servers, and that users have no official way to disable this feature other than to completely switch off the iCloud drive.

The data uploaded could include a list of all calls made and received on an iOS device, as well as phone numbers, dates and times, and duration, the firm said.

Apple retains the cloud-based data for up to four months, according to ElcomSoft's report. It includes calendars, wallet, books, notes and other data synced with iCloud. Even photos may be retained remotely longer than Apple has indicated.

Apple currently relies on a two-factor authentication system that requires an iCloud token along with an Apple ID and password, but ElcomSoft's new Phone Breaker 6.20 software can allow law enforcement to bypass those checks.

For its part, Apple has defended the fact that the data is backed up on the cloud.

"We offer call history syncing as a convenience to our customers so that they can return calls from any of their devices," an Apple spokesperson said in a statement provided to TechNewsWorld by company rep Ryan James.

"Apple is deeply committed to safeguarding our customers' data," the spokesperson added. "That's why we give our customers the ability to keep their data private. Device data is encrypted with a user's passcode, and access to iCloud data including backups requires the user's Apple ID and password. Apple recommends all customers select strong passwords and use two-factor authentication."

Privacy or Security?

ElcomSoft made its announcement not so much to call attention to the potential weaknesses in Apple's data storage practices, as to address how easily its own software can obtain the information. It is billed as a tool for law enforcement, but it's not too hard to imagine that hackers could utilize similar tools for nefarious purposes.

"It is very concerning, as this can't be something that is a surprise to Apple; it is baked into their design for the product and services," said Jim Purtilo, associate professor of computer science at the University of Maryland.

"Only Apple can speak to its motive for orchestrating this behavior, but this is a way to project an image of security to consumers," he told TechNewsWorld.

These iPhone users may believe their data are encrypted and secure, "which is mostly true, even if only on their actual device, while [Apple] is still working accommodatingly with the feds, who get tremendous value from the traffic analysis made possible by these saved data," Purtilo added.

Standard Practices

The fact that Apple is being called out this week is somewhat notable in its own right.

"Apple doesn't seem to be walking its talk in the sense of actually doing what it publicly claims to be doing," noted Charles King, principal analyst at Pund-IT.

The other part of this is in the lack of transparency customers have into the process, and the fact that there is no easy way to opt out, he told TechNewsWorld.

"If you use iCloud, you're in whether you want to be or not," King added.

However, "as several reports on Apple's situation mention, the company isn't alone in syncing or saving call data," King explained, adding that it is standard practice for U.S. carriers to retain call data for up to 12 months.

"Where Apple could run into problems is in foreign markets that restrict retention of caller data," he said. "The company also risks some egg on its face if ElcomSoft's contention that more data is collected and that some is retained for longer than Apple says is the case."

Who Guards the Guards?

The fact that this information is being uploaded to the iCloud is noteworthy, given the showdown that Apple had with the FBI over its ability to obtain information from an iPhone belonging to Syed Rizwan Farook, who carried out last December's terrorist attack in San Bernardino.

Farook's phone was protected cryptographically. Apple challenged more than 11 orders to assist in providing access to the phone, issued by the United States district courts under the All Writs Act of 1789.

The question is whether the FBI showdown was necessary, based on ElcomSoft's findings. Much of the data may have been on the iCloud and hence accessible.

"If most users rely on iCloud services, then police largely don't need the actual device in order to investigate someone; the data have already been disclosed for far more convenient access by whoever asks," explained Purtilo.

"Consumers should be so lucky that only the police are accessing their data; in this news, we more or less need to presume other less upstanding groups have been accessing the data too," he added.

For the vast majority of users, this may be a nonissue, noted Pund-IT's King.

"Most criminals and ne'er-do-wells probably know enough not to use their personal phones for conducting illegal business," he suggested.

"How threatening the practice may be is hard to say, but with Apple actively trying to pitch its products for enterprise applications and use cases, companies considering deploying iPhones and iPads may want to question how their employees' call data is being collected and secured," King added. "Personal communication is the lifeblood of many businesses, to the point that any threat of injury and hemorrhage should be avoided."