Tuesday, August 24, 2021

Engadget RSS Feed

Engadget RSS Feed


The Morning After: Crypto heist hacker returns all $610 million they stole

Posted: 24 Aug 2021 04:16 AM PDT

It's the weirdest cryptocurrency heist so far. On Monday, Poly Network, a cryptocurrency finance platform, was hacked by "Mr. White Hat" who exploited a vulnerability in its code to steal $610 million in Ethereum, Shiba Inu and other cryptocurrencies. The company now says it has recovered all the money it lost in the theft.

Less than a day after stealing the digital currencies, the hacker started returning millions saying they were "ready to surrender." They subsequently locked more than $200 million in assets in an account that required passwords from both them and Poly Network. They said they would only provide their password once everyone was "ready." At that point, Poly Network offered the hacker a $500,000 reward — a fraction of what they had stolen.

It's not entirely clear why the hacker surrendered, but it may have been difficult to cash out the millions. The hacker says they were trying to contribute to the security of Poly Network. Maybe they just didn't want to get caught. Poly will breathe a sigh of relief as will those that were doing their crypto trading through the platform.

— Mat Smith

A Razer mouse can bypass Windows security just by being plugged in

The company says it's fixing the flaw.

Security researcher Jon Hat posted on Twitter that after plugging in a Razer mouse or dongle, Windows Update will download the Razer installer executable and run it with SYSTEM privileges. It also lets you access the Windows file explorer and Powershell with "elevated" privileges, which means nefarious types could install harmful software — if they can get to your USB ports.

Since this vulnerability requires someone plugging in a mouse, it's not nearly as dangerous as a remote attack, but it's still not great for Razer. The company's security team said it's working on a fix. 

Continue reading.

Finally, the 'Stardew Valley' esports tournament is a thing

Farm, mine and fish your way to glory on Labor Day weekend.

Stardew Valley
ConcernedApe

Esports is most commonly associated with high-octane competitive games, usually with guns. That's not the vibe in Stardew Valley, where you literally tend to crops. It's more agrarian, less aggro.

But soon, some of the world's finest Stardew Valley players will face off for thousands of dollars. Creator Eric Barone said the first official Stardew Valley Cup event will take place on September 4th. "It's a competition of skill, knowledge and teamwork, with a prize pool of over $40k."

More than 100 challenges have been created for competitors to tackle, with four teams of four players each having three hours to complete as many of the tasks as they can. Best start sharpening that hoe.

Continue reading.

NASA's latest video from Mars looks like 'Dune'

A new video from the Curiosity rover is here.

Image taken from a JPL video showing off the interior of the Gale Crater, as shot by the Curiosity Rover.
NASA/JPL-Caltech/MSSS

NASA's Jet Propulsion Laboratory released a breathtaking panorama of the inside of the Gale Crater, as snapped by the Curiosity Rover. It shows off where the rover has been and where it's going. Apparently, on a clear day when there's no dust in the air, you can see up to 20 miles away.

Continue reading.

PayPal brings its cryptocurrency trading feature to the UK

Even in small units.

PayPal is bringing the ability to buy, hold and sell cryptocurrencies across to the other side of the pond, the better part of a year after it launched in the US. In a statement, the company said that UK-based users would be able to buy, hold and sell Bitcoin, Ethereum, Litecoin and Bitcoin Cash via their PayPal account. The company adds that users can buy as little as £1 of cryptocurrency, and while there are no fees to hold the currency, users will have to pay transaction and currency conversion fees. And hey, it's not Poly.

Continue reading.

'Twelve Minutes' ruins a compelling game concept

I've been waiting a while for this, too. 

Twelve Minutes
Annapurna Interactive

Twelve Minutes managed to hook several Engadget editors when it was revealed back in 2015. Even before it gained an all-star cast including Daisy Ridley, James McAvoy and Willem Dafoe, the pitch was easy to understand: a time loop point-and-click adventure. I made a note to keep an eye on the title, and Devindra Hardawar, who reviewed the game, did the same.

Unfortunately, the need to push the story in any — most! — directions leads to some grim choices by the player, and what Devindra calls "mind-numbingly dumb" twists. Tell us how you really feel.

Continue reading.


Apple employees are organizing to push for 'real change' at the company

"We've exhausted all internal avenues," the group says.

A group of current and former Apple employees are calling on colleagues to publicly share stories of discrimination, harassment and retaliation at the company. The collective has started a Twitter account called Apple Workers.

"For too long, Apple has evaded public scrutiny," the group says on its website. "When we press for accountability and redress to the persistent injustices we witness or experience in our workplace, we are faced with a pattern of isolation, degradation and gaslighting." In August, the company put Ashley Gjรธvik, a senior engineering program manager, on paid administrative leave. Apple hasn't yet commented.

Continue reading.

The best streaming gear for students

It's not just laptops and keyboards.

Being a student is hard, but just because you're holed up in a dorm room doesn't mean you should settle for mediocre entertainment. Our updated Student Buyer's Guide has everything you could possibly need to upgrade from mindlessly watching Netflix on your laptop. That includes deals for TVs, audio gear and the best streaming devices.

Continue reading.

Take a first look at the live-action 'Cowboy Bebop'

It's coming November 19th.

A still promoting the new live-action Netflix series 'Cowboy Bebop' showing three people and a corgi walking down a water-slicked back alley.
Netflix

Netflix's live-action adaptation of classic anime Cowboy Bebop has been a long time coming, and the show finally has a release date. The 10-episode first season will start streaming on November 19th. There's still no trailer, but we get some stills of the iconic crew, played by John Cho (Spike Spiegel), Mustafa Shakir (Jet Black) and Daniella Pineda (Faye Valentine). There's a corgi, too.

Continue reading.

Virgin Orbit plans to go public

It'll go on the Nasdaq exchange to fund its space satellite project.

Richard Branson's Virgin Orbit, with a rocket underneath the wing of a modified Boeing 747 jetliner, takes off to for a key drop test of its high-altitude launch system for satellites from Mojave, California, U.S. July 10, 2019.       REUTERS/Mike Blake
Mike Blake / Reuters

Virgin Orbit, the less glamorous half of Virgin's space adventures, has announced plans to go public on the Nasdaq stock exchange through a special purpose acquisitions company (SPAC) merger. The deal with NextGen Acquisition Corp. II values Virgin Orbit at $3.2 billion.

The combined company is expected to pull in up to $483 million in cash when the deal closes, and it plans to scale up its rocket manufacturing. The first spaceflight company to go public through a SPAC, and the company that really kicked off the SPAC trend was Virgin Galactic back in 2019, which sought to fund its tourist trips to space. Yeah, the more exciting facet of space companies.

Continue reading.

The biggest stories you might have missed

The best laptops for college students

'Outriders' is perfectly average, making it ideal for Xbox Game Pass

Teardown shows the Playdate won't suffer from controller drift like the Switch

Rare commemorative Game & Watch handheld sells for $9,100 at auction

T-Mobile is giving customers a free year of Apple TV+

Data leak exposed 38 million records, including COVID-19 vaccination statuses

The OnePlus Buds Pro feature smart ANC and a white-noise mode

Facebook test brings voice and video calls back to its main app

Posted: 24 Aug 2021 03:16 AM PDT

Facebook has started testing a feature that gives users a way to place voice and video calls from within the main app itself, according to Bloomberg. Like with any of the social network's experiments, it will only be available to a limited number of accounts. But those who do get access to the test will be able to call friends on the platform without having to fire up the Messenger app. 

As the publication notes, this looks like a move Facebook is exploring to further streamline its services that include Messenger, which became a separate app in 2014, and WhatsApp. Connor Hayes, director of product management at Messenger, told Bloomberg that it's meant to reduce the need to jump back and forth between the company's main app and its Messenger service.

Facebook already has plans to unify its messaging apps. In September 2020, it enabled the ability to chat and send messages between Instagram and Messenger, and the social network previously said that WhatsApp would also get inter-app messaging capabilities. The company tested putting a simpler version of Messenger within the main app last year, as well. That's something the social network been considering since at least 2019 when Jane Manchun Wong found an experimental feature that takes users straight to a "Chats" section when they tap on the messaging icon. Currently, doing so automatically opens the Messenger app. 

Hayes told the publication that Facebook now considers Messenger as a service instead of a standalone app. We may see more of its technologies across the company's other apps in the future — in fact, Instagram, Oculus and Portal devices already use Messenger's technology for voice and video calls. "You're going to start to see quite a bit more of this over time," he said.

Oculus update lets Quest headsets auto-sync VR media to mobile

Posted: 24 Aug 2021 02:00 AM PDT

Oculus is rolling out an update to its Quest VR headsets that includes several tweaks and improvements. The highlight is the ability to auto sync your saved photos and video files directly to the Oculus mobile app. That way, you can manage and share those in-game captures when you're outside of the headset. 

The feature can be activated by opening the Files App from your Quest app library and selecting the cloud icon in the top-right corner of the panel. Your saved files will then be available in the the "Synced Media" section under the Devices tab in the mobile app. Oculus says that media will be unsynced and automatically removed from the app after 14 days.

The improvement is the latest aimed at saved media. In the v29 update earlier this year, Oculus introduced a Browser app that let you download and upload files to websites, making the task more seamless than plugging the headset into a PC.

Additional features include the option to gift games directly from the headset — a process that was previously limited to browsers or the Oculus mobile app. You can now also interact with your Facebook and Oculus friends from the People tab in Messenger.

Finally, Oculus is changing up its fitness-oriented Move feature. It's moving to weekly workout goals instead of daily ones, which will be viewable on the redesigned calendar. Keeping the focus on long-term targets, you'll now see revised suggested calorie goals and move minutes. Plus, you'll be able to share your workout stats to Facebook, including Groups, Messenger, and your timeline. 

EA pledges not to sue over its accessibility patents and technologies

Posted: 24 Aug 2021 12:00 AM PDT

EA won't be filing any lawsuit against other developers that use the patented accessibility mechanics it uses in its games. The video game giant has announced that it's making a Patents Pledge, which gives rival developers free access to any of its accessibility-related technologies. While not all gameplay mechanics are patented, some companies have taken to making sure competitors aren't legally allowed to use their technologies. Critics condemn the practice, accusing the companies of stifling creativity and innovation in the industry. EA at least won't be suing anybody that incorporate its accessibility features in their games, including Apex Legends' "ping" system.

The feature gives players in the same team a way to communicate with each other without using voice chat. They can simply tap buttons to tell their teammates where they are on a map, to alert others of a threat or to tag targets. Supposedly, Epic Games borrowed Apex's ping system for Fortnite. The Patents Pledge also covers at least four more EA features, three of which make video games more accessible to players with vision issues. Those technologies, already in use in the Madden NFL and FIFA franchises, can automatically detect colors and then modify their brightness and contrast to make them more visible. 

The last patent in the five EA specifically mentioned covers a technology allowing players with hearing issues to modify or create their own music. EA says it will add any future accessibility patents to the pledge and that it hopes the move can "encourage others to build new features that make video games more inclusive."

Chris Bruzzo, EA's EVP of Positive Play, Commercial and Marketing, said in a statement: 

"At Electronic Arts, our mission is to inspire the world to play. We can only make that a reality if our video games are accessible to all players. Our accessibility team has long been committed to breaking down barriers within our video games, but we realize that to drive meaningful change, we need to work together as an industry to do better for our players.

We hope developers will make the most of these patents and encourage those who have the resources, innovation and creativity to do as we have by making their own pledges that put accessibility first. We welcome collaboration with others on how we move the industry forward together."

SpaceX has already shipped 100,000 Starlink satellite internet terminals

Posted: 23 Aug 2021 10:18 PM PDT

Starlink has already shipped 100,000 satellite internet terminals before it has even achieved global coverage. SpaceX chief Elon Musk has revealed the figure on Twitter, where he also listed the 14 regions where the service is currently available. "Our license applications are pending in many more countries. Hoping to serve Earth soon!" he said in a follow-up tweet

SpaceX launched Starlink as a beta service in late 2020, offering potential testers at the time the chance to be the first ones to it for $99 a month. The terminal itself isn't included in the monthly fee: Starlink sells its starter kit with the user terminal or antenna dish, its stand and power supply, as well as a WiFi router for an additional $499, which customers will have to pay up front. You can see what the terminal looks like in the image above, showing a dish installed on the roof of a school in Chile. 

Starlink was designed to serve customers in remote locations where internet options are typically limited or even non-existent. Perhaps that's why customers are willing to pay the rather steep upfront cost. According to CNBC, the company reported having 90,000 users in July, indicating that it signed up 10,000 more customers within just a few weeks.

The service uses thousands of small satellites in orbit to provide internet connection to its customers. SpaceX already deployed almost 1,800 satellites for the Starlink constellation, but it has plans to launch up to 42,000 small internet satellites in the future. Company president Gwynne Shotwell previously said that Starlink will be able to offer continuous global coverage once all the deployed satellites reach their operational orbit, which could happen as soon as September.

Google will tailor Play Store ratings based on location starting in November

Posted: 23 Aug 2021 03:34 PM PDT

Whether you're an Android or iOS user, there's a good chance you look at user reviews and ratings before you decide whether to download an app to your device. In hopes of making those more useful for everyone, Google plans to make two tweaks to the Play Store.

Starting in November, the ratings you see will be based on where you live. So, for example, if your device is registered to Japan, you will first see what other Japanese users think of the app you're about to download. Then, sometime early next year, Google plans to further tweak Play Store ratings to better reflect the device you're using, be that a phone, tablet, foldable, Chromebook or smartwatch. "This will give users a better impression of the experience that they can expect for the device they're using," the company says of the change.

In part, Google is making these tweaks to help developers. It wants to avoid a situation where ratings in one area impact the global perception of an app. This can happen in cases where a bug only affects one localized version of the software. Of course, that compartmentalization means you can learn of those same bugs before you download an app.

Teardown shows the Playdate won’t suffer from controller drift like the Switch

Posted: 23 Aug 2021 02:28 PM PDT

While Panic's pint-sized Playdate handheld won't make its way to early adopters until the end of the year, iFixit got a chance to look inside the device early. "Unfortunately it didn't come with any games, so a teardown was about all it was good for," iFixit said, for those who might be jealous the company got a unit before they did.

Playdate teardown
Panic

Taking apart the handheld, iFixit found a console with mostly modest internal components. The Playdate has a 180MHz CPU supported by 16MB of memory and 4GB of flash storage. Powering everything is a 2.74 Wh battery with about 25 percent of the capacity of the power cell you'll find inside the iPhone 12.

But what you want to know about is Playdate's signature fold-out crank. According to iFixit, Panic and Teenage Engineering embedded a cylindrical magnet into the shaft of the component. That magnet works in conjunction with a Hull effect sensor to trigger an input from the crank. It's a simple but effective design that should last. "One thing this crank won't do? Drift. There's no wiper or spring or sensor surface to wear out," the company says, referencing the Nintendo Switch's well-known controller issue.

Playdate
Panic

While it's no Framework laptop, it's clear Panic and Teenage Engineering designed the Playdate with at least one eye toward repairability. A charming sticker iFixit found upon opening the device said "breaking," not removing, the components would void the warranty. Many of the internals most likely to fail first, including the battery and headphone jack, were either modular or easily accessible. Components like the display and USB-C port will be more challenging to replace, but the Playdate looks DIY friendly enough that it could enjoy a modding scene like the Game Boy Advance.

Apple employees are organizing to push for 'real change' at the company

Posted: 23 Aug 2021 01:12 PM PDT

A group of current and former Apple employees are calling on their colleagues to publicly share stories of discrimination, harassment and retaliation they experienced while working at the company. The call to action went up on Monday when the collective started a Twitter account called Apple Workers

"For too long, Apple has evaded public scrutiny," the group says on its website. "When we press for accountability and redress to the persistent injustices we witness or experience in our workplace, we are faced with a pattern of isolation, degradation and gaslighting."

The protesting workers say they've exhausted all internal avenues for a remedy from the company, which is why they're going public with their complaints. "We've talked with our leadership. We've gone to the People team. We've escalated through Business Conduct. Nothing has changed," they say. "It's time to Think Different."

According to The Verge, about 15 individuals were involved in organizing the effort. Earlier today, they shared the news on a 200-person Discord server for Apple employees and contractors. We've reached out to Apple for comment.

The action comes as Apple faces questions over its handling of sexism in the workplace. In August, the company put Ashley Gjรธvik, a senior engineering program manager, on paid administrative leave. In a series of tweets, Gjรธvik shared several interactions with the company's employee relations team. One of those details is an episode in which a manager referred to her "tone" in presentations and said, "I didn't hear you going up an octave at the end of your statements." Apple is currently investigating Gjรธvik's allegations.

"There is much more information about my story and my concerns about Apple work conditions that I have not made public yet," Gjรธvik says on a website she created to chronicle her experience at the company. "I only resorted to this because everything I tried internally has failed."

'Twelve Minutes' ruins a compelling game concept with awful twists

Posted: 23 Aug 2021 01:00 PM PDT

It's rare for a game's concept to hook me within a few seconds, but Twelve Minutes managed to do that way back in 2015. Before it gained an all-star cast including Daisy Ridley, James McAvoy and Willem Dafoe, it was an intriguing indie point-and-click adventure with a Groundhog's Day-esque time loop and a unique, top-down perspective. Its interactive narrative, combined with a wealth of cinematic influences, made it seem as if developer Luis Antonio was crafting something meant just for me.

That's pretty much how I felt at the beginning of the game. You play as a man who comes home to a small apartment. Your wife has some special news, which you celebrate over a romantic dinner. All of a sudden, a cop starts pounding on the door and accuses her of murder. Things go downhill fast, and in an instant you're right back to the beginning of the night. Your mission: Figure out what the hell is happening.

Sounds like a solid thriller, right? But after spending six hours with the game, I was furious. What started out as a fun mystery devolved into a repetitive slog. I was forced to abuse my seemingly lovely wife. Sometimes I had to watch her be repeatedly tortured by that sadistic cop. And I became a murderer myself, several times over. Making things even worse, my reward for that hellish journey was an array of twists so convoluted, so mind-numbingly dumb, I was angry about it for days. Say what you will about the works of M. Night Shyamalan, but at least his twists feel original. (And yes, I know those twists occur less often than you may think.)

I won't spoil where Twelve Minutes ultimately goes. And, to be honest, I'm hesitant to even point out that a story has twists at all. But for a mystery like this, I figure that's to be expected. All of this time looping detective work just has to lead to something truly dramatic! And it's clear that Luis Antonio genuinely wants to blow your mind. It's just a shame almost everything falls flat at the end.

That's not to say Twelve Minutes isn't worth playing. The game's early hours set up a fascinating mystery box. Your small apartment has a cramped kitchen and living space, a bathroom, a bathroom and a closet. That's it. Everything you need to complete the game is there (or gets there later). Some of those puzzle pieces feel organic, like the mugs that you can fill with water, or the large knife tempting you in the kitchen. Some of them, like the light switch that can electrocute people on cue, are hilariously convenient.

Twelve Minutes

I realized Twelve Minutes was doing something special early on when it managed to work its way into my subconscious. I thought of new things to try during long walks and after sleeping on a particularly annoying problem. That's a sign that, for a while at least, I was genuinely invested in the story. It helps that Twelve Minutes also has some solid voice work, which goes a long way toward connecting you to the characters. You don't get a full look at anyone's face (even if you try to scope out the cop through your front door's peephole), so it's nice to have some human performances grounding the story. If you've got Xbox Game Pass, it's worth checking out the game just to experience its first few hours.

After the novelty wears off, though, the game quickly takes a turn for the worse. Eventually, you'll have to complete a long series of tasks over and over until you figure out your next step. And sometimes that can mean doing the same five tasks dozens of times. Twelve Minutes gives you a few easy ways to speed things up, like a single dialog option that can prove you're actually going through a time loop and that she's genuinely in danger. But a few more narrative shortcuts would make the game's rough last act more tolerable.

One major moment gives you only a few seconds to show one character a specific item. It's easy to miss that's something you can even do. And even when I knew what I had to do, after looking up a few guides, I still failed to trigger the right interaction several times. At that point, the game began to feel less like a puzzle I needed to solve and more like a Saw trap that I needed to escape from.

Twelve Minutes
Annapurna Interactive

I suppose these issues could be overlooked if Twelve Minutes had a better script, but even in that respect it fails. It's stronger toward the beginning, but like a J.J. Abrams story, it has no clear idea where to go at the end. Characters start to act in completely different ways, which is hard to swallow after seeing them in one light for several hours. A sympathetic turn for Dafoe's cop feels particularly out of place, after seeing multiple loops where he kills you and your wife, and that's even after getting the MacGuffin he's looking for. You don't need to have an ACAB tattoo to call him a monster.

I wouldn't write off Twelve Minutes a bad game, but based on where the story goes, it's ultimately disappointing. Luis Antonio and his team spent over seven years working on the game, and it's a shame to see my enthusiasm for it fall apart in six hours.

Roku revives former Quibi original 'Most Dangerous Game' for a second season

Posted: 23 Aug 2021 12:04 PM PDT

Earlier this month, Roku released the last of the TV shows and movies it acquired when Quibi shut down at the end of 2020. Now the company is looking to the future. On Monday, Roku announced it's bringing back Most Dangerous Game, one of the more popular titles it acquired in the transaction, for a second season.

Two-time Academy Award-winner Christoph Waltz will reprise his role as antagonist Miles Sellars, with David Castaรฑeda, best known for his role in Netflix's The Umbrella Academy, joining the cast as the show's new protagonist. Roku describes Castaรฑeda's character, Victor Suero, as a down on his luck fighter who is forced to participate in the deadly contest at the center of the show to protect his sister.

It's not surprising to see Roku decide to bring back Most Dangerous Game. The shorts Roku acquired from Quibi have played a significant role in its plan to find a niche among giants like Netflix and Amazon, and Most Dangerous Game was one of the few shows Quibi renewed before its demise last year. Roku hasn't said when the new season would debut.

Stardew Valley's creator is running a $40,000 esports tournament next month

Posted: 23 Aug 2021 11:11 AM PDT

Esports is most commonly associated with high-octane competitive games such as League of Legends, Rocket League and Call of Duty: Warzone. A chill farming sim might not immediately spring to mind, but very soon, some of the world's finest Stardew Valley players will face off for thousands of dollars.

Creator Eric Barone (aka ConcernedApe) said the first official Stardew Valley Cup event will take place at noon ET on September 4th. "It's a competition of skill, knowledge and teamwork, with a prize pool of over $40k," Barone wrote on Twitter.

Barone and Stardew Valley streamer Zach "UnsurpassableZ" Hartman have concocted more than 100 challenges for competitors to tackle, as Kotaku notes. Four teams of four players will each have three hours to complete as many of the tasks as they can. The challenges include things like giving someone a gift they love at the Feast of the Winter Star (worth 25 points), winning the ice fishing contest (15 points) and completing item bundles in the Community Center (10 points each).

Players will have to prioritize the tasks, since some might not be entirely worth the points at stake. For instance, unless players are able to craft a ton of staircases, it can take an hour or so to reach the bottom of the mines, which is worth 10 points. Hartman will also add five surprise challenges during the event, each of which are worth 50 points, so competitors might have to adjust their plans on the fly.

Barone and Hartman will be commentators for the event, which you can watch on Hartman's Twitch channel.

It's actually not the first competitive Stardew Valley event with cash at stake. A few Stardew Twitch Rivals competitions have taken place. One event in 2019 had $35,000 on the line, and included challenges like catching all five legendary fish as quickly as possible and obtaining the most gold.

Rare commemorative Game & Watch handheld sells for $9,100 at auction

Posted: 23 Aug 2021 10:43 AM PDT

In recent weeks, we've seen one retro Nintendo game after another shatter the record for the most expensive video game sold at auction. At the start of July, a copy of The Legend of Zelda went for $870,000. Days later, a mint version of Super Mario 64 sold for $1.56 million. Now another Nintendo collectible has set a sales record, but this one is a bit different.

Over the weekend, a special commemorative edition of a Game & Watch system sold for approximately $9,100 on Yahoo Japan. As most Nintendo fans know, the Game & Watch predates the far more successful Game Boy. What makes this unit unique is that it was commissioned by Game & Watch creator Gunpei Yokoi after Nintendo sold more than 20,000 million units of the handheld. Before this weekend, this version of the console had never come on the market before.

What's unclear is just how many units of the commemorative edition Game Nintendo produced. According to Beforemario, a blog devoted to games and toys the company made between the 1960s and 1980s, the unit is "extremely" rare. "If I had to guess, I would say there were more than three made [one for each of the individuals pictured on the plaque], but again, just a guess," John Hardie, the director of the National Videogame Museum in Fresco, Texas, told Ars Technica.

Given the current state of the video game collectibles market, what seems like a one-of-a-kind historical artifact selling for so little is surprising. Part of that could be the result of the Game & Watch market. As Ars Technica points out, you can find common versions of the handheld for about $50. Rarer variants like the Ballon Fight one can go for as much as $2,000 if they're in good condition.

Data leak exposed 38 million records, including COVID-19 vaccination statuses

Posted: 23 Aug 2021 09:54 AM PDT

Around 38 million records from north of a thousand web apps that use Microsoft's Power Apps portals platform were left exposed online, according to researchers. The records are said to have included data from COVID-19 contact tracing efforts, vaccine registrations and employee databases, such as home addresses, phone numbers, social security numbers and vaccination status.

Data from some large companies and institutions was exposed in the incident, according to Wired, including American Airlines, Ford, the Indiana Department of Health and New York City public schools. The vulnerability has mostly been resolved.

Researchers from security company Upguard started looking into the issue in May. They found data from many Power Apps portals that was supposed to be private was available for anyone to access if they knew where to look. 

The Power Apps service aims to make it easy for customers to make their own web and mobile apps. It offers application programming interfaces (APIs) for developers to use with the data they collect. However, Upguard found that using those APIs makes the data obtained through Power Apps Portals public by default, and manual reconfiguration was required to keep the information private.

Upguard says it sent a vulnerability report to the Microsoft Security Resource Center on June 24th, including links to Power Apps portals accounts on which sensitive data was exposed and steps to identify APIs that enabled anonymous access to data. Researchers worked with Microsoft to clarify how to reproduce the issue. However, an Microsoft analyst told the firm on June 29th that the case was closed and they "determined that this behavior is considered to be by design."

Upguard then started notifying some of the affected companies and organizations, which moved to lock down their data. It raised an abuse report with Microsoft on July 15th. By July 19th, the company says that most of the data from the Power Apps portals in question, including the most sensitive information, had been made private. 

Microsoft provided us with the following statement after this story was first published: "Our products provide customers flexibility and privacy features to design scalable solutions that meet a wide variety of needs. We take security and privacy seriously, and we encourage our customers to use best practices when configuring products in ways that best meet their privacy needs."

Earlier this month, Microsoft said Power Apps portals apps will keep data private by default when developers harness the APIs. In addition, it released a tool for developers to check their settings.

There's no indication as yet that any of the exposed data has been compromised. Among the most sensitive information that was left in the open were 332,000 email addresses and Microsoft employee IDs that are used for payroll, according to Upguard. The company also says that more than 39,000 records from portals related to Microsoft Mixed Reality were exposed, including users' names and email addresses.

The incident underscores the fact that a misconfiguration, no matter how seemingly minor, could lead to serious data breaches. That doesn't appear to be the case here, thankfully. Still, it goes to show that developers should probably triple check their settings, especially when plugging in an API they haven't designed themselves.

Update 8/23 3:45PM ET: Added a statement from Microsoft.

Update 8/23 4:30PM ET: Clarified that the issue concerned Power Apps portals, and not Power Apps as a whole. 

Poly Network says it has recovered all $610 million it lost in cryptocurrency heist

Posted: 23 Aug 2021 09:17 AM PDT

One of the most unusual cryptocurrency heists in recent memory has come to a close. On Monday, Poly Network, a decentralized finance platform that saw a hacker named "Mr. White Hat" exploit a vulnerability in its code to steal $610 million in Ethereum, Shiba Inu and other cryptocurrencies, says it has recovered all the money it lost in the theft.

"At this point, all the user assets that were transferred during the incident have been fully recovered," the company said in a Medium post. Poly Network is now working to return control of those digital currencies to their rightful owners, a process the company says it hopes to complete as soon as possible.

The Poly Network hack took one strange turn after another. Less than a day after stealing the digital currencies, the hacker started returning millions and sent a token indicating they were "ready to surrender." Everything was going smoothly until they locked more than $200 million in assets in an account that required passwords from both them and Poly Network. They said they would only provide their password once everyone was "ready." At that point, Poly Network offered the hacker a $500,000 reward.

It's unclear why the perpetrator had a change of heart, though some experts believe they may have found it difficult to launder and cash out the money they had on their hands. All we have to go on from the hacker is that they were trying to help in their own way.

"My actions, which may be considered weird, are my efforts to contribute to the security of the Poly project in my personal style," the hacker said in a message they included with the final transaction, according to CNBC. "The consensus was reached in a painful and obscure way, but it works."

Lumen's metabolism tracking app comes to the Apple Watch

Posted: 23 Aug 2021 08:45 AM PDT

Lumen is a crowdfunded tracking device which purports to analyze your breath to determine what state your metabolism is in. Now, the company behind it is launching an app for the Apple Watch to make it easier for you to use the hardware when you're on the go. Users will be able to use the device and then see the results on their wrist, in a way that CTO and co-founder Avi Smila says "seamlessly integrated into daily life."

The pitch for Lumen is, essentially, to enable you to learn as and when you should be eating and in what quantities. The system can tell you when you should eat, based on your metabolism, and suggests carb servings, meal plans and macros for the day. Should it be a lack of a smartwatch app has held you back from buying a Lumen thus far, you can pick up a unit for as little as $199, plus a monthly subscription of $19 a month.

Netflix's live-action 'Cowboy Bebop' series arrives on November 19th

Posted: 23 Aug 2021 08:20 AM PDT

Netflix's live-action adaptation of classic anime Cowboy Bebop has been a long time coming, and the show finally has a release date. The 10-episode first season will start streaming on November 19th.

Although Netflix hasn't posted a trailer just yet, it provided a first proper look at Cowboy Bebop in a bunch of photos. The images show John Cho (Spike Spiegel), Mustafa Shakir (Jet Black) and Daniella Pineda (Faye Valentine) in character, as well as an adorable corgi.

Live-action adaptations of anime haven't typically been well-received (here's looking at you, Ghost in the Shell). There's pressure on Netflix to get this take on Cowboy Bebop right, but things are looking promising. The core cast looks great in the first batch of images, while some key creatives from the 1998 anime are involved. Legendary composer Yoko Kanno returns, while original director Shinichirล Watanabe consulted on the Netflix show.

Production started in 2019 but it was paused for eight months after Cho sustained a knee injury on the set. Filming eventually wrapped in March.

Cowboy Bebop
Netflix

T-Mobile is giving customers a free year of Apple TV+

Posted: 23 Aug 2021 08:08 AM PDT

For a few years now, wireless carriers in the US have offered their customers all manner of video and music freebies. Verizon (Engadget's parent company) has offered free subscriptions to Disney+, Apple Music and AMC+ recently, while T-Mobile has long offered its customers free Netflix access. Today, T-Mobile is adding another freebie to its offerings: Apple TV+. Starting on August 25th, customers on the carrier's Magenta or Magenta Max plans (as well as some Sprint legacy plans) will get one year of free Apple TV+ access. 

If you're already paying for Apple TV+, you can still take advantage of this deal. It'll just add a free year of access and pause billing until the trial is up. If you haven't used Apple TV+ yet, it is naturally available on basically all current Apple hardware, but it's also available on a pretty large number of third-party set-top boxes, gaming consoles and TVs, as well. 

This move comes as Apple itself has cut back on the length of its Apple TV+ free trials. Ever since the service launched, Apple offered a year free to basically anyone who bought new hardware from the company, and it extended that free period multiple times. But lately, people have noticed that Apple is finally charging them for the service, and the free trial period has been cut down to three months. That's still quite generous, but all these changes indicate Apple is keen to start collecting money for Apple TV+. Unless, of course, you're a T-Mobile subscriber, in which case it's a perfect time to start your Ted Lasso binge.

‘Outriders’ is perfectly average, making it ideal for Xbox Game Pass

Posted: 23 Aug 2021 08:00 AM PDT

Square Enix might have just found its next big franchise in Outriders. The third-person shooter has become a hit for the publisher (though that hasn't been reflected in royalties for the developer, People Can Fly.) It's easy to see why: the core gameplay is bags of fun, especially when you're playing with friends.

However, it doesn't quite stick the landing. A by-the-numbers story and limited replayability drag things down a bit. As such, before you pay full price, it might be worth checking out Outriders on Xbox Game Pass first.

You play as an Outrider, an elite soldier who helps prepare another planet for what's left of humanity to colonize it, but something goes drastically wrong. Get past the middling first couple of hours (and some iffy writing and acting), and Outriders kicks into a higher gear once your character becomes mutated. You can select one of four classes, each with their own set of unlockable abilities.

The powers and weapon abilities are a blast to play around with, especially when you team up with a friend and combo your special moves. There are a vast number of potential loadouts and character builds you can run with. You can also switch up your gear, abilities and skill tree at any time. The cover system works well enough, but it's better to play aggressively, since you'll only heal by killing enemies.

Outriders
People Can Fly/Square Enix

Outriders looks good, with a grimy tone that's more Gears of War than Destiny. There are a bunch of different biomes, each with a distinct aesthetic, though many parts of levels are just tunnels that funnel you from one encounter to the next. It's easy to make comparisons with Destiny 2: Both games are futuristic shooters in which you can mow down waves of enemies and constantly hunt for better gear.

Outriders isn't a live service game, though, nor can you battle other players. It has a focused story, with side missions and endgame challenges you can go on after you finish the campaign. They do get repetitive, though. At a certain point, grinding for better items means little more than seeing higher numbers on your weapon stats and floating above enemies when you attack them. It might have actually been better as an ongoing game with frequent content additions.

Outriders

Still, there's nothing to lose by checking out Outriders on Xbox Game Pass, where it has been available since its launch day.

For at least the last year or so, there's been a common refrain about Xbox Game Pass: it's one of the best deals in gaming. There's definitely some merit to that, as the service includes a ton of major first-party games, like Microsoft Flight Simulator, as well as Bethesda titles and a bunch of killer indies for a single monthly fee. Offering players easier access to Game Pass on more devices through the cloud sweetens the deal.

Big third-party games are an important aspect of the service as well, including a bunch of EA titles games and, of course, Outriders, which is practically a perfect fit for Game Pass.

Square Enix and People Can Fly deserve props for putting out a lengthy Outriders demo that's long enough for you to get a good sense of each classes' powers. If you have Game Pass Ultimate, though, you can keep going without having to pay extra.

Outriders is solid. It's exactly the kind of thing Microsoft could use more of on Game Pass, a fun, big third-party game you might be interested in, but don't want to spend $60 on. Sure, the library has plenty of far better games, but whenever you and a couple of buddies are in the mood for some relatively mindless alien-murdering carnage without having to fire up Destiny 2 yet again, Outriders hits the spot.

Virgin Orbit is going public to fund its space satellite program

Posted: 23 Aug 2021 07:23 AM PDT

Virgin Orbit has announced plans to go public on the Nasdaq stock exchange through a special purpose acquisitions company (SPAC) merger. The deal with NextGen Acquisition Corp. II values Virgin Orbit at $3.2 billion.

The combined company is expected to pull in up to $483 million in cash when the deal closes, which Virgin Orbit believes will happen by the end of this year. Around $383 million of that is expected to come from funds NextGen holds in trust, and the other $100 million from a common stock PIPE (private investment in public equity) offering at $10 per share. Virgin Orbit's existing stakeholders will own around 85 percent of the combined company, with NextGen shareholders owning about 10 percent, PIPE investors (which will include Boeing) holding roughly three percent and the SPAC sponsor owning the remaining two percent or so.

Virgin Orbit will use the funds to scale up its rocket manufacturing endeavors and bolster the company's space solutions business and Virgin Orbit's ongoing product development initiatives. An SPAC merger with a company (usually a shell corporation) that's already listed on a stock exchange allows a business to go public without going through the usual initial public offering process.

The first spaceflight company to go public through an SPAC, and the company that really kicked off the SPAC trend, was Virgin Galactic back in 2019, which sought to fund its tourist trips to space. Virgin Galactic spun out Virgin Orbit as a separate company in 2017 so they could respectively focus on space tourism and small satellite launches. Virgin Galactic held its first fully crewed flight in July (with founder Richard Branson on board), while Virgin Orbit had its first successful satellite deployment in January.

Virgin Orbit launches its satellites from a custom Boeing 747, with the LauncherOne rocket taking payloads into space. The company says this approach offers a "significant performance advantage" over traditional ground launches (an approach adopted by the likes of SpaceX) while lowering "local carbon emissions and acoustic impacts" at launch sites.

Razer is fixing a serious Windows security flaw caused by its mice

Posted: 23 Aug 2021 07:17 AM PDT

A rather unusual vulnerability in Razer mice has been identified and the company is currently working on a fix. Over the weekend, security researcher Jon Hat posted on Twitter that after plugging in a Razer mouse or dongle, Windows Update will download the Razer installer executable and run it with SYSTEM privileges. It also lets you access the Windows file explorer and Powershell with "elevated" privileges — which essentially means someone with physical access to the computer could install harmful software.

Since this vulnerability requires direct, physical access to a computer, it's not nearly as dangerous as a security issue that can be carried out remotely, but it's still a troubling find. Hat said on Twitter that Razer eventually reached out and told him that the company's security team was working on a fix. 

Razer provided us with the following statement:

"We were made aware of a situation in which our software, in a very specific use case, provides a user with broader access to their machine during the installation process.

We have investigated the issue, are currently making changes to the installation application to limit this use case, and will release an updated version shortly. The use of our software (including the installation application) does not provide unauthorized third-party access to the machine.

We are committed to ensuring the digital safety and security of all our systems and services, and should you come across any potential lapses, we encourage you to report them through our bug bounty service, Inspectiv: https://app.inspectiv.com/#/sign-up."

Update, 2PM ET: Added a statement from Razer.

No comments:

Post a Comment