Xfinity says a data breach likely led to attackers obtaining customers’ usernames and hashed passwords. Other personal information may have been exposed, such as names, contact information, the last four digits of social security numbers, dates of birth and secret questions and answers. The company added that its analysis of the attack is ongoing and it has informed law enforcement about the incident.

In a filing with Maine’s attorney general’s office, Xfinity owner Comcast disclosed that the intrusion has impacted 35.8 million people. As TechCrunch points out, Comcast had 32.3 million broadband customers as of the end of September, indicating that the vast majority of Xfinity customers have been affected by the breach.

On October 10, Citrix disclosed a vulnerability in software that Xfinity and many other businesses use. It provided guidance on how to mitigate the vulnerability on October 23 and Xfinity said it swiftly patched the problem. However, while carrying out a routine cybersecurity check two days later, Xfinity spotted suspicious activity in its systems. It later determined that bad actors accessed its internal network between October 16 and 19.

Xfinity says it’s informing customers of the incident via its website, email and by other means. It’s urging them to change their passwords, to make sure they don’t use the same passwords on different accounts and to enable two-factor or multi-factor authentication. Xfinity also suggested that folks who use the same login credentials on other accounts change their passwords on those.

This isn’t the first security incident Xfinity has had to deal with. Back in 2018, it emerged there was a bug in a Comcast website used to activate Xfinity routers. The issue led to some customers’ home addresses being exposed, along with the name and password for their Wi-Fi networks.

Update 12/19 8:00AM ET: Updated to note the number of people who were impacted by the breach.

This article originally appeared on Engadget at https://www.engadget.com/xfinity-suffered-a-data-breach-but-doesnt-know-quite-how-bad-it-was-100711214.html?src=rss

Source: Engadget – Xfinity breach may have affected as many as 35.8 million customers

Some holiday misery for Apple: It will soon pause sales of its latest Apple Watches in the US due to an International Trade Commission (ITC) ban. The company will suspend sales online this week and at Apple retail locations after December 24. Ho ho ho.

It’s all down to a patent dispute over the wearables’ blood oxygen sensor. Cast your minds back: Medical tech company Masimo sued Apple in 2021 for alleged violations of light-based blood-oxygen monitoring patents. In October, the ITC upheld a judge’s ruling from earlier this year that the Apple Watch did violate Masimo’s patents. The ITC’s order blocks all Apple Watch Series 9 and Ultra 2 imports to the US after December 25.

The case went to the White House for a 60-day Presidential Review Period. Although President Biden has one more week to decide whether to veto the ITC ruling, Apple has pre-emptively complied with the commission’s decision.

President Biden reportedly owns an Apple Watch – but also a load of other watches too.

— Mat Smith

​​You can get these reports delivered daily direct to your inbox. Subscribe right here!​​

The biggest stories you might have missed

An electric car completed the world’s first-ever drive from the North to the South Pole

Adobe terminates its $20 billion Figma acquisition amid regulatory scrutiny

Beats headphones and earbuds are up to 49 percent off right now

2023 in review: The year the economics of tech caught up with reality

Here’s everything you should do to up your digital security before next year

NordVPN comes to the Apple TV

Our top gadgets of 2023

The ones we bought.

We test and review tons of gadgets every year, and (for some reason) we also buy a lot of things for ourselves. This year, those purchases included coffee-making upgrades, fancy keyboards and even pricey digital pianos. But there are plenty of other things we’ve bought and loved this year that have yet to make it on the site. Here, our staff looks back at the things that were worth the money.

Continue reading.

A new picture of Uranus looks like a sci-fi portal

The Webb telescope’s NIRCam filters are to thank for this.

The James Webb Space Telescope (JWST) has a treat to celebrate the upcoming second anniversary of its launch: an image of the icy planet Uranus. The picture, resembling a glowing blue marble rippling in a black ocean, was funneled through the telescope’s infrared filters to capture wavelengths we wouldn’t see with the naked eye.

Yeah, it looks like the CBS logo.

Continue reading.

US lawmakers call for DOJ probe into Apple’s blocking of Beeper’s iMessage app

They asked an assistant attorney general to determine whether Apple violated antitrust laws.

More socks for Apple’s legal department this Christmas. A bipartisan group of US senators and representatives have urged the Department of Justice to investigate whether Apple violated antitrust laws by attempting to block Beeper Mini’s access to iMessage. Senators have asked an assistant attorney general to look into Apple’s “potentially anticompetitive conduct.”

Hopefully, senators will have learned lessons from the other times they’ve tried to grill technology companies without the technical expertise for their questions to make sense.

Continue reading.

This article originally appeared on Engadget at https://www.engadget.com/the-morning-after-apple-pauses-apple-watch-series-9-and-ultra-2-sales-121539726.html?src=rss

Source: Engadget – The Morning After: Apple pauses Apple Watch Series 9 and Ultra 2 sales

Meta’s Oversight Board has published its decision for its first-ever expedited review, which only took 12 days instead of weeks, focusing on content surrounding the Israel-Hamas war. The Board overturned the company’s original decision to remove two pieces of content from both sides of the conflict. Since it supported Meta’s subsequent move to restore the posts on Facebook and Instagram, no further action is expected from the company. However, the Board’s review cast a spotlight on how Meta’s reliance on automated tools could prevent people from sharing important information. In this particular case, the Board noted that “it increased the likelihood of removing valuable posts informing the world about human suffering on both sides of the conflict in the Middle East.”

For its first expedited review, the Oversight Board chose to investigate two particular appeals that represent what the users in the affected region have been submitting since the October 7th attacks. One of them is a video posted on Facebook of a woman begging her captors not to kill her when she was taken hostage during the initial terrorist attacks on Israel. The other video posted on Instagram shows the aftermath of a strike on the Al-Shifa Hospital in Gaza during Israel’s ground offensive. It showed dead and injured Palestinians, children included.

The Board’s review found that the two videos were mistakenly removed after Meta adjusted its automated tools to be more aggressive in policing content following the October 7 attacks. For instance, the Al-Shifa Hospital video takedown and the rejection of a user appeal to get it reinstated were both made without human intervention. Both videos were later restored with warning screens stating that such content is allowed for the purpose of news reporting and raising awareness. The Board commented that Meta “should have moved more quickly to adapt its policy given the fast-moving circumstances, and the high costs to freedom and access to information for removing this kind of content…” It also raised concerns that the company’s rapidly changing approach to moderation could give it an appearance of arbitrariness and could put its policies in question.

That said, the Board found that Meta demoted the content it reinstated with warnning screens. It excluded them from being recommended to other Facebook and Instagram users even after the company determined that they were intended to raise awareness. To note, a number of users had reported being shadowbanned in October after posting content about the conditions in Gaza.

The Board also called attention to how Meta only allowed hostage-taking content from the October 7th attacks to be posted by users from its cross-check lists between October 20 and November 16. These lists are typically made up of high-profile users exempted from the company’s automated moderation system. The Board said Meta’s decision highlights its concerns about the program, specifically its “unequal treatment of users [and] lack of transparent criteria for inclusion.” It said that the company needs “to ensure greater representation of users whose content is likely to be important from a human-rights perspective on Meta’s cross-check lists.”

“We welcome the Oversight Board’s decision today on this case. Both expression and safety are important to us and the people who use our services. The board overturned Meta’s original decision to take this content down but approved of the subsequent decision to restore the content with a warning screen. Meta previously reinstated this content so no further action will be taken on it,” the company told Engadget in a statement. “As explained in our Help Center, some categories of content are not eligible for recommendations and the board disagrees with Meta barring the content in this case from recommendation surfaces. There will be no further updates to this case, as the board did not make any recommendations as part of their decision.”

This article originally appeared on Engadget at https://www.engadget.com/oversight-board-says-metas-automated-tools-took-down-israel-hamas-war-content-that-didnt-break-its-rules-110034154.html?src=rss

Source: Engadget – Meta’s automated tools removed Israel-Hamas war content that didn’t break its rules

On top of fighting (and losing to) Epic Games over Play Store antitrust concerns, Google has been fighting a similar lawsuit filed by 36 states and the District of Columbia in 2021. A settlement for that suit was announced in September, but a judge still had to confirm the terms. Now, Google has announced that it will pay a $700 million fine and make what amounts to fairly minor changes to the Play Store. 

Of that sum, Google will distribute $630 million to consumers who may have overpaid for apps or in-app purchases on Google Play (after taxes, lawyers’ fees, etc.). That covers around 102 million people, according to The Washington Post. It will also pay $70 million into a “fund that will be used by the states,” according to Google’s blog. 

The other major change is that Google must allow developers to steer consumers toward sideloading to avoid Google’s Play Store fees on subscriptions and the like. It’ll do that via updated “language that informs users about these potential risks of downloading apps directly from the web for the first time.” However, these actions will be time limited to seven years for the sideloading and five years for the updated language, according to settlement’s wording spotted by The Verge. 

Google will also include language stating that “OEMs can continue to provide users with options out of the box to use Play or another app store.” Starting with Android 14, third-party stores will be allowed to handle future app updates, including automatic installs. It’s also expanding user choice billing that will allow Android apps and games to offer their own payment system in the US. “Developers are also able to show different pricing options within the app when a user makes a digital purchase,” Google states. 

The company will only be required to make these changes for five or six years maximum (seven years for alternate means to download apps). In other words, it could feasibly cut off access to sideloading or third-party app stores after that point, or make it harder for the average consumer to find the option. 

Another big thing missing is exterior payment links. “Google is not required to allow developers to include links that take a User outside an app distributed through Google Play to make a purchase,” the settlement agreement reads. 

The settlement sum represents a miniscule portion of Google’s turnover and the other terms are relatively minor changes over what it already does. It also doesn’t include Epic Games, which won its own lawsuit against Google earlier this month (Google has vowed to appeal). A court still needs to formally approve the states’ settlement.  

Google also argued at its Epic trial that consumers were able to get games by sideloading and other means, but that failed to sway the jury. When the settlement with the states was announced in September, Epic CEO Tim Sweeny said that if it “left the Google tax in place” his company would fight on. “Consumers only benefit if antitrust enforcement not only opens up markets, but also restores price competition,” he said at the time.

This article originally appeared on Engadget at https://www.engadget.com/googles-multi-state-lawsuit-settlement-will-cost-it-700-million-103512109.html?src=rss

Source: Engadget – Google’s multi-state lawsuit settlement will cost it 0 million

On December 12, Rhysida, a ransomware group, announced it had taken 1.67 terabytes of data — over 1.3 million files — from Sony’s Insomniac Games and requested $2 million. Now, the one-week deadline for Insomniac Games to pay Rhysida has passed, and the group has made good on its threat to release the stolen information, Cyber Daily reports.

The data includes internal HR documents, screenshots of employees’ Slack conversations, and more, but the main focus is the yet-to-be-released Wolverine video game. The released files contain details about level design, characters and actual screenshots from the game. There’s also a signed publishing agreement between Sony and Marvel that lays out three upcoming X-Men games, the first being Wolverine, with the other two still unnamed. However, it details that Sony — which plans to spend $120 million per game — must release Wolverine by September 1, 2025, with the others due by the end of 2029 and 2033, respectively. 

Rhysida claims that it took the group only 20 to 25 minutes to get the domain administrator and that money was their sole motivation. “We knew that developers making games like this would be an easy target,” a Rhysida spokesperson told Cyber Daily. “Sony has launched an investigation, but it would be better in the backyard.”

Notably, Rhysida’s initial ransom notice allowed anyone to bid on the data, not just Insomniac Games, and it appears some of it was bought. The ransomware group stated that any unsold data was released — but only 98 percent of stolen information is publicly available. Rhysida stipulated that any data purchased must not be resold, but who knows if the new owners will follow that rule.

Rhysida only targeted Insomniac Games within Sony, but in May, a separate attack gained access to 6,800 current and former employees’ personal data. The attack, which ransomware group CLOP took credit for, became public knowledge in October.

This article originally appeared on Engadget at https://www.engadget.com/insomniac-games-hackers-leak-13-million-files-after-demanding-2-million-ransom-102134429.html?src=rss

Source: Engadget – Insomniac Games hackers leak 1.3 million files after demanding million ransom