Hard-coded key vulnerability in Logix PLCs has severity score of 10 out of 10

Enlarge (credit: Rockwell Automation)

Hardware that is widely used to control equipment in factories and other industrial settings can be remotely commandeered by exploiting a newly disclosed vulnerability that has a severity score of 10 out of 10.

The vulnerability is found in programmable logic controllers from Rockwell Automation that are marketed under the Logix brand. These devices, which range from the size of a small toaster to a large bread box or even bigger, help control equipment and processes on assembly lines and in other manufacturing environments. Engineers program the PLCs using Rockwell software called Studio 5000 Logix Designer.

On Thursday, the US Cybersecurity & Infrastructure Security Administration warned of a critical vulnerability that could allow hackers to remotely connect to Logix controllers and from there alter their configuration or application code. The vulnerability requires a low skill level to be exploited, CISA said.

Read 9 remaining paragraphs | Comments

TikTok agrees to proposed $92 million settlement in privacy class action

Enlarge (credit: Mateusz Slodkowski | SOPA Images | LightRocket | Getty Images)

TikTok parent company ByteDance has agreed to a $92 million deal to settle class-action lawsuits alleging that the company illegally collected and used underage TikTok users' personal data.

The proposed settlement (PDF) would require TikTok to pay out up to $92 million to members of the class and to change some of its data-collection processes and disclosures going forward.

The suit, which rolled up more than 20 related lawsuits, mostly filed on behalf of minors, alleged that TikTok violated both state and federal privacy laws, including the Computer Fraud and Abuse Act and the Video Privacy and Protection Act, through its use of data.

Read 10 remaining paragraphs | Comments

Report: Stadia undershot to the tune of “hundreds of thousands” of users

Enlarge / As we learn more about Stadia's inner workings, we've begun adding some "flair" to this Stadia-branded PUBG parachute. (credit: PUBG / Getty Images / Aurich Lawson)

In the wake of Google shutting down its Stadia Games & Entertainment (SG&E) group, leaks about the underwhelming game-streaming service have started to emerge. A Friday Bloomberg report, citing unnamed Stadia sources, attaches a new number to the failures: "hundreds of thousands" fewer controllers sold and "monthly active users" (MAU) logging in than Google had anticipated.

The controller sales figure is central to the story told Friday by Bloomberg's Jason Schreier: that internally, Google was of two minds about how Stadia should launch. One idea looked back at some of the company's biggest successes, particularly Gmail, which launched softly in a public, momentum-building beta while watching how it was received over time. The other, championed by Stadia lead Phil Harrison, was to treat Stadia like a console, complete with some form of hardware that could be hyped and pre-sold. In Stadia's case, the latter won out, with Harrison bullishly selling a Stadia Founder's Bundle—and this worked out to be a $129.99 gate to the service. Without it, you couldn't access Stadia for its first few months.

As Schreier reports, Harrison and the Stadia leadership team "had come from the world of traditional console development and wanted to follow the route they knew."

Read 10 remaining paragraphs | Comments

Netflix drops extended Shadow and Bone teaser, announces release date

Jessie Mei Li stars as Alina Starkov in Shadow and Bone, a new Netflix fantasy series adapted from Leigh Bardugo's worldwide bestselling "Grishaverse" novels, premiering April 23.

Netflix unexpectedly dropped an extended teaser trailer for its forthcoming fantasy series Shadow and Bone during a panel at IGN Fan Fest. The hotly anticipated series is adapted from Leigh Bardugo's bestselling "Grishaverse" novels and will premiere on April 23.

(Mild spoilers for the books below.)

Bardugo published Shadow and Bone, the first of a trilogy, in June 2012, followed by Siege and Storm in 2013 and Ruin and Rising in 2014. She told Entertainment Weekly in 2012 that she deliberately avoided the usual medieval fantasy motifs and drew inspiration instead from the Russian Empire in the early 1800s. "As much as I love broadswords and flagons of ale—and believe me, I do—I wanted to take readers someplace a little different," she said. "Tsarist Russia gave me a different point of departure."

Read 6 remaining paragraphs | Comments

Pokémon Legends: Arceus’ stealth-infused open world hits Switch in 2022

• 

  A vast, ancient wilderness ready to be explored.

Today's online Pokémon Presents stream, which celebrated the series' 25th anniversary, included at least one major surprise: the announcement of a new, more action-oriented Pokémon game set in a period resembling feudal Japan. Pokémon Legends: Arceus is in full development by Game Freak and is targeting an early 2022 release, according to the announcement.

While the new game will be set in the now-familiar Sinnoh region, it will move things back to "a long, long time ago, when the Sinnoh region was still only a vast wilderness." Players will operate from a base in a feudal-style village, starting out with one of three familiar starter pokémon (Rowlett, Cyndaquil, or Oshawott) to explore that wilderness and fill in the region's first pokédex.

A short trailer for the game showed a few changes from the series' usual RPG format. Using a Sword and Shield-style over-the-shoulder camera, players can "study the pokémon’s behaviors, sneak up to them, then throw pokéballs" to catch them directly, as the game's official description puts it.

Read 4 remaining paragraphs | Comments

A 3rd shot? A new booster? Vaccine makers race to trials to beat variants

Enlarge / COVID-19 vaccine at a vaccination center in Madrid on Feb. 26, 2021. (credit: Getty | NurPhoto)

With worrisome coronavirus variants seemingly emerging and spreading everywhere, lead vaccine makers are wasting no time in trying to get ahead of the growing threat.

This week, Moderna and partners Pfizer and BioNTech announced they have kicked off new vaccine clinical trials aimed at boosting the effectiveness of their authorized vaccines against new, concerning SARS-CoV-2 variants—primarily B.1.351, a variant first identified in South Africa.

In a set of studies published last week in the New England Journal of Medicine, both the Moderna mRNA vaccine and Pfizer/BioNTech mRNA vaccine spurred antibodies in vaccinated people that could neutralize the B.1.351 variant. But the levels of those neutralizing antibodies were significantly lower than what was seen against past versions of the virus. (Both vaccines performed well against the B.1.1.7 variant, first identified in the UK, which is expected to become the dominant strain in the US next month.)

Read 9 remaining paragraphs | Comments

Texas woman sues Griddy after being charged $9,546 for 19 days of power

Enlarge / The US and Texas flags fly in front of high-voltage transmission towers on February 21, 2021 in Houston, Texas. (credit: Getty Images | Justin Sullivan )

A Texas woman who was charged $9,546 for power this month has filed a class-action lawsuit against Griddy, alleging that the variable-rate electricity provider violated a state law against price gouging during disasters.

Lisa Khoury, a retiree in Mont Belvieu, signed up with Griddy in June 2019 and typically received monthly bills of $200 to $250 until this month's power disaster sent rates soaring. Griddy charged Khoury and her husband $9,546 from February 1 to 19, 2021, the lawsuit said, noting that "some customers received bills as high as $17,000."

Khoury's lawsuit, filed Monday in Harris County District Court, seeks certification of a class of thousands of Texas residents who bought power from Griddy, claiming they're entitled to damages of over $1 billion.

Read 16 remaining paragraphs | Comments