feed on feeds - 2017/06/13 - items 0 to 15

An anonymous reader quotes a report from The Verge: The Federal Communications Commission does not have the authority to cap the cost of prison and jail phone calls within states, an appeals court ruled in a decision today, dealing a massive blow to inmates and their advocates who have spent years litigating caps on the cost of such calls. Over several years, the FCC, under Democratic leadership, moved to cap the cost of calls for inmates. Activists argued that prisoners were effectively being extorted by private companies charging exorbitant rates -- a move that benefited private prisons and the states that got cuts of the revenue. Some of those states joined with companies in appealing the FCC's rules. The agency first moved to cap rates across state lines, and then, later, within states. Today, the court ruled that the FCC had overstepped when it attempted to regulate the price of calls within states. In the majority opinion, the court left little wiggle room for advocates of price-capping, with the possible exception of the cross-state caps, which are a minority of calls made by inmates. The opinion vacated not only the agency's proposed caps for in-state calls, but said the agency also lacked justification to require reports on video calling services. It also vacated a provision that would ban site commission payments.

Read more of this story at Slashdot.

US attorney-general calls alleged collusion with Russian officials in the US election 'appalling' in vehement denial.

The future of the two Red Sea islands is causing more controversy in Egypt.

Today, Microsoft and Adobe released their usual monthly security updates. Microsoft patched a total of 96 different vulnerabilities. Three vulnerabilities have already been disclosed publicly, and two vulnerabilities stick out for being already exploited according to Microsoft:

%%cve:2017-8464%%

This vulnerability can be exploited when a user views a malicious shortcut file. Windows shortcuts use small files that describe the shortcut. The file will tell Windows what icon to display to represent the file. By including a malicious icon reference, the attacker can execute arbitrary code. This problem is probably easiest exploited by setting up a malicious file share, and tricking the user into opening the file share via a link. Similar vulnerabilities have been exploited in Windows in the past. Exploits should surface shortly in public. Microsofts description of the vulnerability is a bit contradicting itself. In the past, if a vulnerability had already been exploited in the wild, Microsoft labeled them with an exploitability of 0. In this case, Microsoft uses 1, which indicates that exploitation is likely. But on the other hand, the vulnerability is already being exploited.

%%cve:2017-8543%%

ETERNALBLUE Reloaded? This vulnerability is another one that is already exploited according to Microsoft. The vulnerability is triggered by sending a malicious Search message via SMB. The bulletin does not state if exploitation requires authentications. The attacker will have full administrative access to the system, so this vulnerability can also be exploited for privilege escalation.

---
Johannes B. Ullrich, Ph.D. , Dean of Research, SANS Technology Institute
STI|Twitter|

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.

An anonymous reader shares a Recode report: The New York Times says it is going to expand the availability of online comments from 10 percent of articles to 80 percent by the end of the year, without adding more moderators to its staff. How are they going to do this? With a machine-learning algorithm, of course. The Times today is rolling out a new structure of comment moderation using software from Google called Perspective, developed by the company's incubator, Jigsaw. The Moderator tool will automatically approve some comments and help moderators wade through others more quickly.