Microsoft is rolling out upgrades to its sales software that integrates data from LinkedIn, an initiative that Microsoft CEO Satya Nadella told Reuters was central to the company's long-term strategy for building specialized business software. From the report: The improvements to Dynamics 365, as Microsoft's sales software is called, are a challenge to market leader Salesforce.com and represent the first major product initiative to spring from Microsoft's $26 billion acquisition of LinkedIn, the business-focused social network. The new features will comb through a salesperson's email, calendar and LinkedIn relationships to help gauge how warm their relationship is with a potential customer. The system will recommend ways to save an at-risk deal, like calling in a co-worker who is connected to the potential customer on LinkedIn. [...] The artificial intelligence, or AI, capabilities of the software would be central, Nadella said. "I want to be able to democratize AI so that any customer using these products is able to, in fact, take their own data and load it into AI for themselves," he said. On Monday, LinkedIn said it has surpassed 500 million members globally, one of the first big milestones for the business social network since its acquisition.

Read more of this story at Slashdot.

Microsoft is rolling out upgrades to its sales software that integrates data from LinkedIn, an initiative that Microsoft CEO Satya Nadella told Reuters was central to the company's long-term strategy for building specialized business software. From the report: The improvements to Dynamics 365, as Microsoft's sales software is called, are a challenge to market leader Salesforce.com and represent the first major product initiative to spring from Microsoft's $26 billion acquisition of LinkedIn, the business-focused social network. The new features will comb through a salesperson's email, calendar and LinkedIn relationships to help gauge how warm their relationship is with a potential customer. The system will recommend ways to save an at-risk deal, like calling in a co-worker who is connected to the potential customer on LinkedIn. [...] The artificial intelligence, or AI, capabilities of the software would be central, Nadella said. "I want to be able to democratize AI so that any customer using these products is able to, in fact, take their own data and load it into AI for themselves," he said. On Monday, LinkedIn said it has surpassed 500 million members globally, one of the first big milestones for the business social network since its acquisition.

Read more of this story at Slashdot.

Top US military officials allude to increasing concerns over Moscow's role in Afghanistan.

Top US military officials allude to increasing concerns over Moscow's role in Afghanistan.

Linux kernel creator Linus Torvalds said over the weekend that v4.11 version of Linux has hit a speed bump in the form of "NVMe power management that apparently causes problems on some machines." The Register adds: "It's not entirely clear what caused the [NVMe] issue (it wasn't just limited to some NVMe hardware, but also particular platforms), but let's test it." Which sounds like a good idea, given that flash memory on the PCIe bus is increasingly mainstream. That problem and "a couple of really annoying" bugs mean that Torvalds has decided to do an eighth release candidate for Linux 4.11. "I did get fixes for the issues that popped up, so I could have released 4.11 as-is," Torvalds wrote, "but it just doesn't feel right."

Read more of this story at Slashdot.

From a report on Mac Stories: Today, Apple announced that it is reducing the commissions it pays on apps and In-App Purchases from 7 percent to 2.5 percent effective May 1st. The iTunes Affiliate Program pays a commission from Apple's portion of the sale of apps and other media when a purchase is made with a link that contains the affiliate credentials of a member of the program. Anyone can join, but the Affiliate Program is used heavily by websites that cover media sold by Apple and app developers.

Read more of this story at Slashdot.

Reader epiphani writes: The Ontario Government will pilot universal basic income in a $50M program supporting 4,000 households over a 3 year period. While Slashdot has vigorously debated universal basic income in the past, and even Elon Musk has predicted it's necessity, experts continue to debate and gather data on the approach in the face of increasing automation. Ontario's plan will study three communities over three years, with participants receiving up to $17,000 annually if single, and $24,000 for families.

Read more of this story at Slashdot.

[This is a guest post submitted by Remco Verhoef. Got something interesting to share? Please use our contact form to suggest your topic]

Today I got lucky walking around within a phishing site and found some left-over deployment files, containing the complete source code of the site. This gives a unique insight into the inner workings and complexity of the site. Ive analyzed many phishing site source codes before, but this one is definitely more sophisticated than usual.

The site has been called Scam Paypal v1.10 by the author Shadow Z118.

Ill walk you through the source code and my findings. The source code consists of 127 files, 6MB in size, with date ranges from the September 2016 till now. The author is definitely using the Agile development process here.

The `.htaccess` file contains several measures against (automated) analysis for known anti-phishing tools:

• it will rewrite to the actual phishing page
• deny rules for ip ranges and domains for e.g. google.com, paypal.com, firefox.com, apple.com
• an environment variable called stealthed
• rewrite conditions on referer (Google, Paypal and Firefox)
• rewrite on user agent
• rewrites to paypal.com when coming from specific IPs
• set the environment variable bad_bot for specific user-agents
• deny from all kind of av vendors
• disable Indexes (which wasnt applied to root, yay!)

There is also a duplicate of this file, called htaccess (without the usual leading dot). I assume this is a mistake.

Phishtank had an issue last week where the kinds of redirects were causing incorrect flagging safe domains as phishing.

The `index.php` file contains several more checks for bots:

• A function is_bitch is used to identify various bots. Worth to mention that curl is included in the list.
• user-agent google will get a 404 response. Google will not index the site as a result.
• Google is not only identified by User-Agent, but also by the hostname the IP address resolves to.

This index will copy the code from a source/template folder to a random folder per user (/customer_center/customer-IDPP00C followed by a random number). After the copy, the user will be redirected to this new location. Not completely sure why this hasnt been done with rewrites.

The `robots.txt` contains disallow all rules for folders to disable indexing by robots.txt respecting bots.

The source code contains quite some aversive methods against automated analyzed by a/v vendors and bots. The `bots` folder contains more scripts that will return 404s for all kind of checks.

• known ip ranges
• part of domains (including tor-exit, google and amazonaws)
• user-agents
• list of banned ips

For every request, a global hit counter will be incremented on each hit. When the counter exceeds 30 it will create a deny record for that specific remote address, user-agent and hostname.

Track all user-agents and ip addresses for bots, depending on a list of words. This will create a database with all user-agents and ip addresses for specific a/v vendors.

An `HTTP/1.0 404 Not Found` will be returned, sometimes accompanied by the friendly message `HELLOOOOO BITCHES | I FUCKING LOVE YOU HAHAHAHAHAHAHA 3 | TRY BYPASS ME NEXT TIME BB 3.`. Note the HTTP/1.0 it will return, even when the request has been made with HTTP/1.1

All emails will be sent to both `yacineh1604@mail.ru` and `tartor88@gmail.com`, accompanied by the text `PUT UR FUCKING E-MAIL BRO`. There is also a reference to `chrome10.0.1@yandex.com`, which is somewhat obfuscated that will receive a copy of each email. It looks like that the maker of the software want to keep track of things without the phishers knowledge. Within the code I find references to `Mr-YcN Z.1.1.8` and `SHADOW Z.1.1.8`.

Code contains the following api calls, for checking credit cards and country detections and uses the micro services of api.bincodes.com and ip-api.com and includes an api_key as well.

* https://api.bincodes.com/creditcard-checker.php?api_key=2d974e94811161f1dda14bbf63aa9790cc

* http://ip-api.com/json/

There is a file which will detect the browser specific os and browser family using the user-agent.

A file containing language entries. Currently, only English is supported.

The lib folder contains all scripts and css files.

The actual phishing flow is as follows:

* first the user will have to sign in, using her email and password

* next the user will be asked to verify the account, by entering card number, card type, c_valid, expiry dates, csc, name on card, fullname, address, zipcode, city, state, country

* then it will check if the credit card type is visa, mastercard or maestro and if you are from France, Spain or Norway the next step will be skipped

* youre being asked to upload your identity photos, with allowed extensions (gif, jpeg, jpg and png)

* social security number details, day of birth, and country-specific social security numbers

* a success page containing a summary of all entered data, redirecting you to PayPal after 5 second

Each step the user will go through will result in sending an email to the noted addresses. This email will contain all entered information and is distinguishable by different subjects and different senders.

* NEW BB XD ? LOGIN INFO FROM : .$_SESSION[_forlogin_]. ? .$_POST[login_email]. ?

* .$_SESSION[_cardholder_]. ? FULLZ : .$_SESSION[_ccglobal_]. ? .$_SESSION[_global_]. ? .$_SESSION[_login_email_]. ?

* .$_SESSION[_cardholder_]. ? VBV FULLZ : .$_SESSION[_ccglobal_]. ? .$_SESSION[_global_]. ? .$_SESSION[_login_email_]. ?

* .$_SESSION[_cardholder_]. ? NEW ID CARD - ENJOY BTC ? .$_SESSION[_global_]. ?

* some of the comments are in french

* the html contains a randomiziation routine for class names

* all userdata will be saved in php sessions for persistence between the steps

* the forms contain validation

* emails will be send only when there has been entered useful data, eg password, creditcard number

* all pages contain anti bots measures

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
STI|Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

[This is a guest post submitted by Remco Verhoef. Got something interesting to share? Please use our contact form to suggest your topic]

Today I got lucky walking around within a phishing site and found some left-over deployment files, containing the complete source code of the site. This gives a unique insight into the inner workings and complexity of the site. Ive analyzed many phishing site source codes before, but this one is definitely more sophisticated than usual.

The site has been called Scam Paypal v1.10 by the author Shadow Z118.

Ill walk you through the source code and my findings. The source code consists of 127 files, 6MB in size, with date ranges from the September 2016 till now. The author is definitely using the Agile development process here.

The `.htaccess` file contains several measures against (automated) analysis for known anti-phishing tools:

• it will rewrite to the actual phishing page
• deny rules for ip ranges and domains for e.g. google.com, paypal.com, firefox.com, apple.com
• an environment variable called stealthed
• rewrite conditions on referer (Google, Paypal and Firefox)
• rewrite on user agent
• rewrites to paypal.com when coming from specific IPs
• set the environment variable bad_bot for specific user-agents
• deny from all kind of av vendors
• disable Indexes (which wasnt applied to root, yay!)

There is also a duplicate of this file, called htaccess (without the usual leading dot). I assume this is a mistake.

Phishtank had an issue last week where the kinds of redirects were causing incorrect flagging safe domains as phishing.

The `index.php` file contains several more checks for bots:

• A function is_bitch is used to identify various bots. Worth to mention that curl is included in the list.
• user-agent google will get a 404 response. Google will not index the site as a result.
• Google is not only identified by User-Agent, but also by the hostname the IP address resolves to.

This index will copy the code from a source/template folder to a random folder per user (/customer_center/customer-IDPP00C followed by a random number). After the copy, the user will be redirected to this new location. Not completely sure why this hasnt been done with rewrites.

The `robots.txt` contains disallow all rules for folders to disable indexing by robots.txt respecting bots.

The source code contains quite some aversive methods against automated analyzed by a/v vendors and bots. The `bots` folder contains more scripts that will return 404s for all kind of checks.

• known ip ranges
• part of domains (including tor-exit, google and amazonaws)
• user-agents
• list of banned ips

For every request, a global hit counter will be incremented on each hit. When the counter exceeds 30 it will create a deny record for that specific remote address, user-agent and hostname.

Track all user-agents and ip addresses for bots, depending on a list of words. This will create a database with all user-agents and ip addresses for specific a/v vendors.

An `HTTP/1.0 404 Not Found` will be returned, sometimes accompanied by the friendly message `HELLOOOOO BITCHES | I FUCKING LOVE YOU HAHAHAHAHAHAHA 3 | TRY BYPASS ME NEXT TIME BB 3.`. Note the HTTP/1.0 it will return, even when the request has been made with HTTP/1.1

All emails will be sent to both `yacineh1604@mail.ru` and `tartor88@gmail.com`, accompanied by the text `PUT UR FUCKING E-MAIL BRO`. There is also a reference to `chrome10.0.1@yandex.com`, which is somewhat obfuscated that will receive a copy of each email. It looks like that the maker of the software want to keep track of things without the phishers knowledge. Within the code I find references to `Mr-YcN Z.1.1.8` and `SHADOW Z.1.1.8`.

Code contains the following api calls, for checking credit cards and country detections and uses the micro services of api.bincodes.com and ip-api.com and includes an api_key as well.

* https://api.bincodes.com/creditcard-checker.php?api_key=2d974e94811161f1dda14bbf63aa9790cc

* http://ip-api.com/json/

There is a file which will detect the browser specific os and browser family using the user-agent.

A file containing language entries. Currently, only English is supported.

The lib folder contains all scripts and css files.

The actual phishing flow is as follows:

* first the user will have to sign in, using her email and password

* next the user will be asked to verify the account, by entering card number, card type, c_valid, expiry dates, csc, name on card, fullname, address, zipcode, city, state, country

* then it will check if the credit card type is visa, mastercard or maestro and if you are from France, Spain or Norway the next step will be skipped

* youre being asked to upload your identity photos, with allowed extensions (gif, jpeg, jpg and png)

* social security number details, day of birth, and country-specific social security numbers

* a success page containing a summary of all entered data, redirecting you to PayPal after 5 second

Each step the user will go through will result in sending an email to the noted addresses. This email will contain all entered information and is distinguishable by different subjects and different senders.

* NEW BB XD ? LOGIN INFO FROM : .$_SESSION[_forlogin_]. ? .$_POST[login_email]. ?

* .$_SESSION[_cardholder_]. ? FULLZ : .$_SESSION[_ccglobal_]. ? .$_SESSION[_global_]. ? .$_SESSION[_login_email_]. ?

* .$_SESSION[_cardholder_]. ? VBV FULLZ : .$_SESSION[_ccglobal_]. ? .$_SESSION[_global_]. ? .$_SESSION[_login_email_]. ?

* .$_SESSION[_cardholder_]. ? NEW ID CARD - ENJOY BTC ? .$_SESSION[_global_]. ?

* some of the comments are in french

* the html contains a randomiziation routine for class names

* all userdata will be saved in php sessions for persistence between the steps

* the forms contain validation

* emails will be send only when there has been entered useful data, eg password, creditcard number

* all pages contain anti bots measures

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
STI|Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

An anonymous reader shares an article: Scientists and data experts are closely tracking the websites of federal agencies, noting changes to pages dealing with climate change and energy since President Donald Trump took office. On Monday, they noticed an alarming message posted to the Environmental Protection Agency's (EPA) open data website, indicating it would shut down on Friday, April 28. [...] By Monday afternoon, visitors to Open Data received a different pop-up notification, which clarifies that data on the site will still be available come Friday.

Read more of this story at Slashdot.

An anonymous reader shares an article: Scientists and data experts are closely tracking the websites of federal agencies, noting changes to pages dealing with climate change and energy since President Donald Trump took office. On Monday, they noticed an alarming message posted to the Environmental Protection Agency's (EPA) open data website, indicating it would shut down on Friday, April 28. [...] By Monday afternoon, visitors to Open Data received a different pop-up notification, which clarifies that data on the site will still be available come Friday.

Read more of this story at Slashdot.