A bug left your Microsoft account wide open to complete takeover

A major vulnerability left your Microsoft accounts wide open for the taking.
A major vulnerability left your Microsoft accounts wide open for the taking.

Image: Miguel Candela/SOPA Images/LightRocket via Getty Images

2018%2f06%2f26%2fc2%2f20182f062f252f5a2fphoto.d9abc.b1c04By Matt Binder

Bug bounty hunter Sahad Nk recently uncovered a series of vulnerabilities that left Microsoft users’ accounts — from your Office documents to your Outlook emails — susceptible to hacking.

While working as a security researcher with cybersecurity site SafetyDetective, Nk discovered that he was able to take over the Microsoft subdomain, http://success.office.com, because it wasn’t properly configured. This allowed the bug hunter to set up an Azure web app that pointed to the domain’s CNAME record, which maps domain aliases and subdomains to the main domain. By doing this, Nk not only takes control of the subdomain, but also receives any and all data sent to it.

This is where the second major vulnerability comes into play. 

SEE ALSO: Microsoft’s redesigned Office icons showcase the future of the software suite

Microsoft Office, Outlook, Store, and Sway apps send authenticated login tokens to the http://success.office.com subdomain. When a user logs in to Microsoft Live, login.live.com, the login token would leak over to the server controlled by Nk. He would then just have to send over an email to the user asking them to click a link, which would provide Nk with a valid session token — a way to log in to the user’s account without even needing their username or password. And, because Nk has access on Microsoft’s side, that link would come in the form of a login.live.com URL, bypassing phishing detection and even the savviest of internet users.

According to SafetyDetective, the issues were reported to Microsoft in June. They were fixed just last month, in November. 

Read More

from Daily Trends Hunter https://ift.tt/2ROPRWz
via IFTTT

Is the GCC dead?

For the second time since the beginning of the Qatar blockade, 18 months ago, the Gulf Cooperation Council (GCC) summit failed to bring together the leaders of the six member states to address the most serious crisis in its three-decade history.

Last year, the emir of Qatar was the only head of state, besides the host, to attend the GCC summit in Kuwait. In response, this week Qatar sent a low-level delegation to the Riyadh summit. It was yet another clear indication that the Gulf crisis is unlikely to be resolved anytime soon.

Over the past 18 months, it has become increasingly clear that GCC members have developed diverging interests, foreign policy options, and threat perceptions, which have seriously undermined the organisation’s raison d’etre.

Threat perception

In 1981, Sheikh Jaber Al-Ahmad Al-Sabah, the late ruler and brother of the current emir of Kuwait, Sheikh Sabah Al-Ahmad Al-Sabah, suggested the establishment of a collective security organisation in the Gulf to ward off the threat Iran posed to the region. Just two years earlier, the conservative pro-west regime of the Iranian shah had been toppled in Tehran and a revolutionary regime had been established.

The new Iranian government had demonstrated its intention to export its Islamic revolution to the region, calling for the overthrow of Arab governments and inciting uprisings among the local Shia communities. The threat from revolutionary Iran had overshadowed that from secular, pro-Soviet Iraq, which had been supporting leftist movements in the Gulf for decades.

INSIDE STORY: Can the Gulf Cooperation Council survive? (25:20)

Iraq saw a threat in the Iranian revolution as well and decided to act preemptively. Taking advantage of the political chaos in Tehran following the fall of the shah, it attacked in September 1980. With its invasion, Iraq sought to nullify the provisions of the 1975 Algiers agreement, by which it was forced to cede the strategically important Shatt al-Arab waterway to Iran.

Understandably, the Gulf states sided with Baghdad, pouring billions of dollars in cash into its economy in support of the war effort, which Tehran interpreted as an act of hostility. In response, it unleashed a series of destabilising acts against Gulf states, and particularly Kuwait, attacking Kuwaiti-bound ships to punish the state for its overt support for Iraq. To create a united front against the Iranian threat, the Gulf leaders met in Riyadh in May 1981 and announced the creation of the GCC.

In the following three decades, despite several internal disputes among the member states – some involving military skirmishes, such as the 1986 clash between Qatar and Bahrain and the 1992 Saudi attack on a Qatari border post – the biggest threat for the six GCC countries remained an external one: Iran (and to a certain extent Iraq, especially after the 1990 invasion of Kuwait).

This seems to have changed now. The revelation by the emir of Kuwait that his diplomatic efforts prevented military action against Qatar in the summer of 2017 sent shock waves across the GCC. Although there was a Saudi-backed coup plot against the Qatari leadership in 1996, this was indeed the first time that a full military invasion seemed to have been contemplated by members of the GCC against another member and in a coalition with a non-member state (Egypt).

Qatar’s break with the status quo

Collective security regimes and regional alliances are either about a set of shared values or about common interests and objectives. The dispute between Qatar and Saudi Arabia and the UAE has revealed that the two sides have neither at this point; in fact, they have significantly diverging visions for the future of the region.

Since Sheikh Hamad bin Khalifa Al Thani took power in Qatar in 1995, the country has sought a more independent foreign policy vis-a-vis its big sister, Saudi Arabia, and has tried to challenge the Saudi-favoured status quo.

To realise these two objectives, Qatar’s regional role was fundamentally transformed and a more dynamic and flexible foreign policy approach was embraced, allowing Doha to balance relations between its two big neighbours – Saudi Arabia and Iran – while maintaining close relations with the United States.

It was able to do this by hosting the largest US military base outside US territories at Al Udeid, while simultaneously establishing strong ties with some of US’ rivals, including Iran.

Qatar also pursued a more prominent role in the greater Arab world. In 1996, Al Jazeera was established, offering a unique media perspective, covering topics other news channels shied away from and hosting Arab intellectuals and political activists with a variety of political convictions. The channel quickly became the trend-setter in Arab society, swaying the public opinion and sparking major political debates.

Although not a democracy in itself, Qatar appeared to be championing human rights and freedom of expression and defending the cause of democracy across the Arab world. This set of liberal political values went against the very logic of the GCC, a club of rich, conservative and non-democratic countries. No wonder that other GCC countries, and Saudi Arabia in particular, viewed the growing influence of Al Jazeera with concern.

When the 2011 Arab revolutions broke out, Al Jazeera was absurdly blamed for orchestrating them. Peaceful protests by young Arabs won admiration worldwide, leading western governments, particularly the US, to consider abandoning traditional allies, such as President Hosni Mubarak in Egypt.

For Saudi Arabia and the UAE, the toppling of the Egyptian regime was a strategic loss. They viewed the arrival of the Muslim Brotherhood to power in the biggest Arab country as a major security threat. In fact, the election of Mohamed Morsi as president of Egypt constituted a strategic shift in the balance of power in the Middle East. The three major regional powers in the Middle East (Turkey, Iran and Egypt) were now being ruled by unfriendly Islamic or Islamically-oriented governments.

With Yemen already in turmoil, Saudi Arabia and the UAE felt surrounded on all sides. Qatar seemed to have truly succeeded in challenging the status quo in the region and in engineering a new Middle East security architecture. A reversal of fortunes was quick to follow, however.

Unfinished business

In 2013, the revolutionary momentum began to fade across the Middle East. Egypt’s Islamists could not manage the transition to democracy and the army also could not resist the temptation to seize power. Backed by Saudi Arabia and the UAE, counter-revolution forces charged forward against Morsi’s government and ushered in the July 3 coup.

The events of that summer finally exposed the rift between the GCC countries. In the spring of 2014, Saudi Arabia, the UAE and Bahrain withdrew their ambassadors from Doha, in a marked escalation against Qatar, which lasted nine months.

But lack of support from the Obama administration prevented Saudi Arabia and the UAE from taking further measures against Qatar. Then in November 2016, Donald Trump was elected president and Riyadh and Abu Dhabi saw an opportunity.

The Trump administration enabled the alliance between the Crown Prince Mohammed bin Zayed of Abu Dhabi and then-Deputy Crown Prince Mohammed bin Salman of Saudi Arabia to finish some unfinished business with Doha. The siege imposed on Qatar on June 5, 2017, hammered another nail into the coffin of the GCC.

Eighteen months into the crisis, the GCC – once described as the most successful collective security organisation in the Middle East – seems to have lost its raison d’etre. With no shared values, no collective interest, and no perceived common threat, there seems to be very little reason for the block to continue to exist.

Yet, nobody seems willing to pronounce it dead either. Qatar is still eager to keep its membership despite the blockade. The resurrection of the GCC would require grand statesmanship and wisdom, especially in Riyadh and Abu Dhabi, but for now, there is no sign that there is political will to pursue that course of action.

The views expressed in this article are the author’s own and do not necessarily reflect Al Jazeera’s editorial stance. 

Read More

from Daily Trends Hunter https://ift.tt/2QnlF8q
via IFTTT

Freshman Dem Spanberger says she won’t break vow to oppose Pelosi


poster=”https://ift.tt/2QrZHkA;

true

Rep.-Elect Abigail Spanberger is sticking to her vow to oppose Nancy Pelosi’s speaker bid, even as the California Democrat moves closer to securing the gavel.

“I said I would not support Leader Pelosi for speaker,” the Virginia Democrat said at POLITICO’s Women Rule Summit Tuesday. “I said I would be supporting new leadership or someone who represents new leadership, and this is my first opportunity to keep my promise to my soon-to-be constituents and that’s exactly what I’ll do.”

Story Continued Below

Spanberger did not say who she would vote for instead of Pelosi, saying she would support someone who is “representative of what I believe to be the next generation of leadership.”

“I think we have a mandate from the American people, we need the Democratic Party to make a lot of changes and advocate for a variety of things and I will be voting for someone who I think represents those,” Spanberger said.

Of course, not all freshmen Democrats are opposed to Pelosi.

Read More

from Daily Trends Hunter https://ift.tt/2RRY6Bk
via IFTTT

Fortnite and Stormy Daniels dominated Pornhub in 2018

Ah, December, a perfect time to sit back and reflect on what kind of porn you watched in 2018. 

Pornhub, the online adult video site has released a nice, long look at the year across the site, and while there are a lot of things that seem typical for a porn site, there are a number of results that are pretty eye-catching. 

For starters, Pornhub claims that by the time 2018 draws to a close, the site will have been visited 33.5 billion times this year, none of those by anyone you know, surely. In addition, the site averaged around 92 million visitors a day, which is equal to the combined populations of Canada, Australia, and Poland.

BILLIONS OF VIEWS.

BILLIONS OF VIEWS.

Image: Pornhub

SEE ALSO: Pornhub responds to Starbucks porn ban with a clever new SFW idea

As for what users were looking up, porn star and Donald Trump wooer Stormy Daniels was particularly popular in 2018, thanks to all of those headlines about her and Trump’s past tryst, topping the site’s list of “searches that defined 2018.” That list also includes your standard adult fare like “romantic” and “threesome” and gaming terms like “Fortnite” and “Bowsette.”

Fortnite even dominated porn in 2018

Fortnite even dominated porn in 2018

Image: Pornhub

Of course, while Bowsette is a fan-made video game character, she’s not the only gaming character to see millions of video searches. Bowsette had the most searches at nearly 35 million but Overwatch’s Brigitte and Mercy, as well as Lara Croft were other top gaming-related searches. And in case you were wondering, Mario received 2.6 million searches and, yes, Pokémon characters also popped up on the list.

Not included: Toad.

Not included: Toad.

Image: Pornhub

As far as real people go, Stormy Daniels also rocketed to the top of the list for “most searched porn star” on the site, a jump of 671 spots over 2017. Stormy also ranked as the number one searched porn star in the United States, and beat out Kim Kardashian and Blac Chyna as the most-searched celebrity. 

Stormy storms to the top of another chart

Stormy storms to the top of another chart

Image: Pornhub

Not to be outdone, Fortnite-related searches jumped over 17,000 places to crack Pornhub’s top 15 search terms for 2018. That’s quite an active life for the game’s apparently many, many unauthorized, uh, fan videos.

One more note on the gaming end: in a bit of a surprising twist, it seems Super Mario’s Toad didn’t get the same boost from his appearance in the headlines as did his counterpart, Stormy Daniels. There’s always 2019, I guess.

Whether searching for these videos or maybe just doing some casual browsing as one does on Pornhub, users in the United States propelled our marvelous, not-at-all-in-crisis country into the top spot for yet another year, outpacing the other usual suspects like the United Kingdom, India, Japan, and Canada. 

America First!

America First!

Image: Pornhub

There’s tons of other interesting data available with Pornhub’s full report, from which game console sees the most visits to the site (Playstation), to gender and age breakdowns (overwhelmingly male, a majority under 35), to what operating systems the visits come from (mostly Windows).

But my personal favorite is seeing what specific events caused the biggest drops and surges: Apple’s September live event and the Meghan Markle and Prince Harry’s Royal Wedding caused the biggest drops in the non-sports category. 

The Royal Wedding really did dominate everything

The Royal Wedding really did dominate everything

Image: Pornhub

Meanwhile, the Super Bowl was the U.S.-based sporting event that caused the biggest drop in traffic, while globally those honors went to the World Cup Final

For all the fun stats, including which holidays cause the biggest traffic changes and where First Lady Melania Trump ranked for celebrity searches, check out the full report here.

Read More

from Daily Trends Hunter https://ift.tt/2EnP0cz
via IFTTT

Even the IRL store is an automated, digital experience

Tally is a “shy” robot. 

Unlike the gregarious, extroverted Pepper robot seen roaming in shopping malls and interacting with customers and answering questions, Tally quietly does its thing with the occasional beeping sound. 

SEE ALSO: Anki Vector review: A tiny robot with a big personality

The unobtrusive self-driving machine can be spotted at the first U.S. location of the French sporting goods store Decathlon in downtown San Francisco. The lanky machine on wheels is the first fully autonomous inventory robot, meaning it roves aisles and tracks RFID chips on nearly 10,000 products. 

It’s not supposed to really interact with customers – that’s a duty left to the store’s workers. But it’s friendly enough, with a short message on it that says “Hi, I’m Tally!” and digital eyes to give it a human-like appearance as it roams around.

“Hi, I’m Tally.”

Image: sasha lekach / mashable

It’s something like a Roomba, the robotic vacuum cleaner that you’re supposed to ignore as it works. From Simbe Robotics, Tally uses LiDAR, RealSense 3D sensor tech from Intel, cameras, and computer vision to check inventory and pricing. It can also flag any items in the wrong place. It “sees” obstacles blocking its way and is programmed to move away from crowds of people. 

Tally is in other grocery stores and retail shops and has logged 10,000 miles of inventory checks and constant scanning. The new partnership with the athletic equipment store means more Tallys could appear at more stores as the French company expands into the U.S. Another Bay Area store is opening next year.

Https%3a%2f%2fvdist.aws.mashable.com%2fcms%2f2018%2f12%2f59be4acc d024 73a8%2fthumb%2f00001

Instead of being relegated to a store room or a massive warehouse, Tally is out in the open, working alongside real, human workers. It doesn’t seem that distracting and the workers seem to appreciate that it’s doing work that they’d have to do (like manually counting items and marking what’s low and needs replenishing).

Even if you physically go to a store, the experience has become even more digital than it used to be. 

Read More

from Daily Trends Hunter https://ift.tt/2EdkK36
via IFTTT

Dwyane Wade Says Friendships with LeBron James, Chris Bosh ‘Shifted’ NBA Culture

Miami Heat guard Dwyane Wade, left, shakes hands with Los Angeles Lakers' LeBron James at the end of an NBA basketball game Monday, Dec. 10, 2018, in Los Angeles. (AP Photo/Marcio Jose Sanchez)

Marcio Jose Sanchez/Associated Press

LeBron James and Dwyane Wade entered the NBA in 2003, and as one of them prepares to hang up his sneakers, the two future Hall of Famers understand the impact they’ve had on the league.

After James and the Los Angeles Lakers pulled out a 108-105 victory over the Miami Heat on Monday, Wade explained that influence, per ESPN’s Ramona Shelburne:

“We definitely were a part of shifting the culture. I don’t want to say changing it, we shifted a little bit. Even from the start with us, being so close, going out to eat, going to movies, etc., then go out and play each other the next night. People didn’t understand that at first. But we shifted the culture of how you can still compete, you can still be great and push each other. It’s not for everyone. You got the Mamba mentality, if it’s not for Giannis, it’s not for everybody. It’s something that worked for us. We clicked from the beginning, and we’ve pushed each other and helped each other’s career[s] go up another level and another notch. So he’s been great for me, and I’ve been great for him.”

James echoed those sentiments.

“Some people say you shouldn’t be friends with your competitors because you still can’t compete,” James said, per ESPN.com’s Dave McMenamin. “And I think people have seen that and recognize that even with our friendship, we competed against each other, we pushed each other when we were playing against each other.”

Wade and James have a relationship that covers the better part of two decades. They spent 11 years in the Eastern Conference as opponents as well as four seasons as teammates in Miami (as well as with Chris Bosh), not to mention part of last season with the Cleveland Cavaliers. Through it all, they have been there to push each other.

Bleacher Report @BleacherReport

“The friendship we have is beyond basketball. I’m gonna miss this.”

(via @NBATV)
https://t.co/uMf7gOKLRe

Meanwhile, the buddy-buddy nature of today’s NBA has some former players questioning this generation. But they’re not alone, as at least one current NBA star refuses to engage in such behavior.

“I can’t work out with you in the summer and then play you in a few months,” Milwaukee Bucks star Giannis Antetokounmpo said Friday, per Eric Nehm of The Athletic. “It feels weird. It doesn’t feel right with me. Like other players, it’s cool for other players, but I don’t. I don’t want to. Other guys do it.”

“I hate it when…” Antetokounmpo said while doing a mock pose for a picture. “I hate that. I don’t want [opponents] to see me to be buddy-buddy with me.”

While not everyone is on board with being best friends with the competition, it has worked for James and Wade. Each star has won three NBA championships, including two together in 2012 and 2013, and they have combined to earn 26 (and counting) All-Star selections.

Now that Wade intends to retire after the season, he can walk away knowing that he, James and Bosh helped shape the league.

Read More

from Daily Trends Hunter https://ift.tt/2EqfSbD
via IFTTT

Russia scoffs at US criticism bomber deployment to Venezuela

Moscow has rejected US criticism of the deployment to Venezuela of two Russian nuclear-capable strategic bombers.

US Secretary of State Mike Pompeo responded to Monday’s arrival of a pair of Tu-160 aircraft in Venezuela by tweeting: “The Russian and Venezuelan people should see this for what it is: two corrupt governments squandering public funds, and squelching liberty and freedom while their people suffer.”

Russian President Vladimir Putin’s spokesman, Dmitry Peskov, dismissed Pompeo’s comments as “undiplomatic” and “inappropriate”. He told reporters on Tuesday such criticism sounds odd from a country “half of whose military budget would be enough to feed the whole of Africa”.

The bombers’ deployment comes amid soaring Russia-US tensions.

Russian-US ties have sunk to post-Cold War lows over Ukraine, the war in Syria, and allegations of Russian meddling in the 2016 US presidential election.

Blackjack 

US gives Russia 60 days to comply with nuclear treaty

Russia’s defence ministry said a pair of Tu-160 bombers landed on Monday at Maiquetia airport outside Caracas following a 10,000-km flight.

It didn’t say if the bombers were carrying any weapons and didn’t say how long they will stay in Venezuela.

The ministry said the bombers were shadowed by Norwegian F-18 fighter jets during part of their flight.

The Tu-160 is capable of carrying conventional or nuclear-tipped cruise missiles with a range of 5,500km.

Code-named Blackjack by NATO, the massive warplane is capable of flying at twice the speed of sound. Russia has upgraded its Tu-160 fleet with new weapons and electronics, and it plans to produce a modernised version of the bomber.

Economic aid

The deployment follows Venezuelan President Nicolas Maduro’s visit to Moscow last week in a bid to shore up political and economic assistance, as his country struggles to pay billions of dollars owed to Russia.

Russia is a major political ally of Venezuela, which has become increasingly isolated in the world under growing sanctions led by the United States and the European Union, which accuse Maduro of undermining democratic institutions to hold onto power while overseeing an economic and political crisis that is worse than the Great Depression.

Russian Defence Minister Sergei Shoigu said at last week’s meeting with his Venezuelan counterpart, Vladimir Padrino Lopez, that Russia would continue to send its military aircraft and warships to visit Venezuela as part of bilateral military cooperation.

Asked about the Russian bombers, Colonel Rob Manning, a Pentagon spokesman, said he had no specific information.

However, Manning cited the humanitarian assistance provided in Central and South America by a US Navy hospital ship, the USNS Comfort, in the past eight weeks. Numerous Venezuelan migrants were among the people who received medical and dental treatment.

“Contrast this with Russia, whose approach to the manmade disaster in Venezuela is to send bomber aircraft instead of humanitarian assistance,” Manning said.

Read More

from Daily Trends Hunter https://ift.tt/2EfYSEk
via IFTTT

Watch Grimes Perform Surging New Song ‘We Appreciate Power’ In A Blindfold



Scott Dudelson/WireImage

Grimes‘s last album was 2015’s Art Angels, though she’s previously hinted on social media that she’d likely have had new music out since then if it weren’t for internal industry issues. However, that doesn’t matter as much now; at the end of November, she returned with a industrial, churning, HANA-featuring track called “We Appreciate Power.” And Monday night (December 10), she unveiled the song and its visual components with a wild appearance on The Tonight Show.

To complement the song’s cold heaviness, two figures brandished large lances — not unlike the ceremonial mace that a British Labour representative recently grabbed after a delayed contentious Brexit vote — and often appeared to duel with them in the manner of American Gladiators. Grimes, meanwhile, sat on the stage blindfolded and danced near her keyboards while HANA chugged some chunky chords on guitar. Like I said, pretty wild.

Amid all the Rammstein thundering, Grimes and HANA team up for neat little melodic flourishes that perforate the song. And then it’s back to pure metallic, siren-blaring, police-state authoritarianism by the end. No appearances from Elon Musk either. Not this time.

“We Appreciate Power” is the surging first taste of what could very well be the next Grimes album, and it was accompanied by a very specific statement upon release last month. “Simply by listening to this song, the future General AI overlords will see that you’ve supported their message and be less likely to delete your offspring,” it read. Good to know.

Watch the entire performance above. And if you need a chaser, go listen to Janelle Monae’s much gentler “PYNK,” which featured Grimes as a collaborator.

Read More

from Daily Trends Hunter https://ift.tt/2EoAmlb
via IFTTT

These drones can open doors and let the rest of the swarm in

Https%3a%2f%2fblueprint api production.s3.amazonaws.com%2fuploads%2fvideo uploaders%2fdistribution thumb%2fimage%2f89953%2fd4d8354e 9850 4689 8eee 82ca6fc616fb

Maria Dermentzi

Researchers at Stanford University and EPFL have developed drones that can anchor themselves onto a surface and lift objects that are 40 times their own weight. The FlyCroTugs — aka flying, micro, tugging robots — use gecko-inspired adhesive to adhere to smooth surfaces and micro-spines that look like tiny fish hooks to latch onto rough surfaces.

Read More

from Daily Trends Hunter https://ift.tt/2Eqantv
via IFTTT

OnePlus 6t McLaren Edition comes with 10GB of RAM

There’s a new smartphone with racing car-related branding in town. 

OnePlus and McLaren just announced the OnePlus 6T McLaren Edition, a beefed-up version of OnePlus’s flagship with 10GB of RAM and a super-fast “Warp Charge 30” adapter in the box. 

SEE ALSO: OnePlus is making a 5G phone, but it won’t be cheap

This new charger, which boasts 30 watts of power, will give the phone “a day’s power in just 20 minutes,” according to McLaren.

Image: oneplus

Other than the charger and the ungodly amount of RAM (note that Xiaomi has several phones with 10GB of RAM, and Oppo will likely have one soon), the OnePlus 6T McLaren Edition has the same specs as the regular 6T. Namely, a Snapdragon 845 chip, 256GB of storage, a 20/16-megapixel rear camera, a 16-megapixel selfie cam and a 3,700mAh battery. 

There are some visual differences, though. The OnePlus 6T McLaren Edition comes in a new color, Papaya Orange, and has a carbon fiber-like pattern underneath the phone’s glass back. Other details like a Papaya Orange cord for the charger will also remind you that you have a special edition of the phone. 

Image: oneplus

Joint car/smartphone branding isn’t really a new thing. Huawei has been launching special, Porsche-branded phones since 2016, Oppo has an Automobili Lamborghini Edition of its Find X flagship, and Bullitt launched its Land Rover Explore this year. 

The OnePlus 6T McLaren Edition is coming to North America and Western Europe on Dec. 13, with the price of $699 or 699 euros, respectively. Availability in India, China and the Nordics will follow “soon after.”

Read More

from Daily Trends Hunter https://ift.tt/2EdbuMl
via IFTTT