Technology - Google News

Google reveals a new Windows zero-day bug it says is under active attack - TechCrunch

Posted: 30 Oct 2020 02:31 PM PDT

Google has dropped details of a previously undisclosed vulnerability in Windows, which it says hackers are actively exploiting. As a result, Google gave Microsoft just a week to fix the vulnerability. That deadline came and went, and Google published details of the vulnerability this afternoon.

The vulnerability has no name but is labeled CVE-2020-17087, and affects at least Windows 7 and Windows 10.

Google's Project Zero, the elite group of security bug hunters which made the discovery, said the bug allows an attacker to escalate their level of user access in Windows. Attackers are using the Windows vulnerability in conjunction with a separate bug in Chrome, which Google disclosed and fixed last week. This new bug allows an attacker to escape Chrome's sandbox, normally isolated from other apps, and run malware on the operating system.

In a tweet, Project Zero's technical lead Ben Hawkes said Microsoft plans to issue a patch on November 10.

Microsoft didn't independently confirm this date when asked, but said in a statement: "Microsoft has a customer commitment to investigate reported security issues and update impacted devices to protect customers. While we work to meet all researchers' deadlines for disclosures, including short-term deadlines like in this scenario, developing a security update is a balance between timeliness and quality, and our ultimate goal is to help ensure maximum customer protection with minimal customer disruption."

In addition to last week's Chrome/freetype 0day (CVE-2020-15999), Project Zero also detected and reported the Windows kernel bug (CVE-2020-17087) that was used for a sandbox escape. The technical details of CVE-2020-17087 are now available here: https://t.co/bO451188Mk

— Ben Hawkes (@benhawkes) October 30, 2020

But it's unclear who the attackers are or their motives. Google's director of threat intelligence Shane Huntley said that the attacks were "targeted" and not related to the U.S. election.

A Microsoft spokesperson also added that the reported attack is "very limited and targeted in nature, and we have seen no evidence to indicate widespread usage."

It's the latest in a list of major flaws affecting Windows this year. Microsoft said in January that the National Security Agency helped find a cryptographic bug in Windows 10, though there was no evidence of exploitation. But in June and September, Homeland Security issued alerts over two "critical" Windows bugs — one which had the ability to spread across the internet, and the other could have gained complete access to an entire Windows network.

Updated with comment from Microsoft.

Let's block ads! (Why?)

Cut the cord for $10 monthly, but what's the catch? - USA TODAY

Posted: 31 Oct 2020 05:58 AM PDT

Jefferson Graham | USA TODAY

Cutting the cord used to be a way to ditch cable TV and save money. Then the big companies jumped in and mucked it up.

In 2017, YouTube came in with a sweet offer – most of your favorite cable TV channels, no equipment rental or contracts, at just $35 monthly. That didn't last long. In 2020 the platform raised its rates to $65 monthly.

So this week, when T-Mobile said it had a cutting-the-cord package set to debut Sunday for $10 a month, we were all ears.

The plus: If you like channels like AMC, Hallmark, MTV and Nickelodeon, you'll love T-Mobile's "Vibe" offering, because that's all it costs – one Alexander Hamilton. But if you want DVR, that will cost you an extra $5 monthly. And if you can't live without sports, news and some local channels (NBC, ABC and Fox) that's $40 monthly. Oh, and you need to be a subscriber to T-Mobile or Sprint. Verizon and AT&T customers are not eligible.

Update: T-Mobile wants to help more pay-TV customers cut the cord with its new streaming service TVision

More: On Apple iPhone 12, it's a battle of the 5G bands among AT&T, Verizon, T-Mobile

The point is that T-Mobile has come closer to the great dream of à la carte TV, which customers have been dreaming of for years. Why do I need to subscribe to a bloated cable TV bundle with all those channels I don't want?

T-Mobile's move is "causing another little crack in the traditional pay TV bundle, one that its rivals have so far been unwilling or unable to match," says Jared Newman, a Cincinnati-based writer who pens the popular Cord Cutter Weekly newsletter.

How does it really compare to rivals?

Let's take a closer look at the lower priced offerings:

► Philo: The streaming service that specializes in entertainment, sans sports and news, had been the lowest priced of the cable TV alternatives, at $20 monthly. It offers twice the number of channels as Vibe, with channels like Discovery, A&E and Animal Planet that you won't see with T-Mobile. And no charge for DVR.

►Sling: Rates start at $30 monthly, but signing up can be confusing, with some channels offered in a "blue" package (includes CNN and E!) and others in "orange," (ESPN) for $30 monthly, plus $5 for DVR service.

From there, you've got AT&T Now and Hulu with Live TV at $55 monthly, or YouTube TV and Fubo (which specializes in sports) at $65 monthly.

Andrew McCollum, CEO of Philo TV noted "it's great" that T-Mobile is "trying to bring more flexibility to the market and offer new options to people at lower price points. Hats off to them for this."

But the extra charge for the DVR, fewer channels than Philo and more importantly, no availability on the No. 1 streaming TV platform, Roku, makes it not as sweet a deal, he added. Plus, add that only T-Mobile subscribers can get it.

Meanwhile that more expensive T-Vision from T-Mobile $40 package does include NBC, ABC and Fox local channels. That is one more network than is available with Sling – which only has the local NBC and Fox channels, and not nationally. And unlike Sling, T-Vision bundles all the sports and news in one package.

"You can't under-estimate how many people just want sports, news and local stations," says Newman. "That's a breakthrough of sorts."

Of course, the folks at Sling tell you that if you really want all the local channels, you should buy an antenna, and pick up the channels that way. The old rabbit ears of yore have been replaced by newer, more powerful antennas that plug into the power outlet and usually come with a portable tuner for a way stronger signal reception.

Many smart TVs aimed at the cutting the cord crowd, like the Amazon Fire TV Edition brand of TVs from Insignia and Toshiba, even show on the menu screen what's playing now locally, via the antenna.

Of course, if you really want to save money by cutting the cord, just buy the $50 antenna, skip the cable TV alternatives altogether and just stick with Netflix and Amazon Prime.

But, ahem, did you hear that Netflix is also planning to raise its rates?

The most popular plan, which lets subscribers watch in high-def on two screens at the same time, has increased by $1 to $13.99, up from $12.99 monthly, for new subscribers, while the premium plan ($15.99), which lets you watch up to four screens with Ultra HD, will now cost $17.99.

Time to cut this cord too?

This week's tech headlines

Apple sold more Macs in the summer and fall than ever before. During its quarterly earnings call Thursday, Apple said it sold $9 billion worth of Macs, up from $6.9 billion in the year ago quarter, fueled by the pandemic and need for work and education tools. "These are tremendous numbers," said Apple CEO Tim Cook on the call with investors. Speaking of Apple, Friday it launched the Apple One subscription bundle, which offers discounts on multiple services. For $14.95, you get Apple Music, TV and the Arcade gaming service (normally $19.99) plus News+, Fitness+ and 2 TB of storage with iCloud for $29.99.

The CEOs of Twitter, Google and Facebook testified to Congress, and many senators had a hard time pronouncing Google parent Alphabet CEO Sundar Pichai's name. That included Sen. Roger Wicker, chairman of the Senate Commerce, Science and Transportation Committee. Pichai is pronounced "pitch" like in baseball and "chai" like the latte – or "pih-chai" – but lawmakers came up with endless variations, addressing him as "Mr. Pick Eye," "Mr. Pish Eye" and more.

Biking is in, eating is out. The Hollywood lunch has hit a snag with pandemic techies, who have turned to bike and walk and talk meetings as a way to both get exercise and be social distant. At least in Los Angeles anyway.

Echo speakers for TV. We tested out hooking Amazon's new 4th generation Echo and Dot speakers into the TV to ditch the soundbar with a less expensive, and wireless approach. Verdict: sounds great, but there's some things you need to know first.