An anonymous reader writes: Google today shared details about a security flaw in Windows, just 10 days after disclosing it to Microsoft on October 21. To make matters worse, Google says it is aware that this critical Windows vulnerability is being actively exploited in the wild. That means attackers have already written code for this specific security hole and are using it to break into Windows systems.In a blog post, security researchers at Google write, "The Windows vulnerability is a local privilege escalation in the Windows kernel that can be used as a security sandbox escape. It can be triggered via the win32k.sys system call NtSetWindowLongPtr() for the index GWLP_ID on a window handle with GWL_STYLE set to WS_CHILD. Chrome's sandbox blocks win32k.sys system calls using the Win32k lockdown mitigation on Windows 10, which prevents exploitation of this sandbox escape vulnerability."

Earlier this year, we learned about China's first "intelligent security robot," which was said to include "electrically charged riot control tool." We now know what this robot is up to, and what its developed unit looks like. Reader dcblogs writes: China recently deployed what it calls a "security robot" in a Shenzhen airport. It's named AnBot and patrols around the clock. It is a cone-shaped robot that includes a cattle prod. The U.S.-China Economic and Security Review Commission, which look at autonomous system deployments in a report last week, said AnBot, which has facial recognition capability, is designed to be linked with China's latest supercomputers. AnBot may seem like a 'Saturday Night Live' prop, but it's far from it. The back end of this "intelligent security robot" is linked to China's Tianhe-2 supercomputer, where it has access to cloud services. AnBot conducts patrols, recognizes threats and has multiple cameras that use facial recognition. These cloud services give the robots petascale processing power, well beyond onboard processing capabilities in the robot. The supercomputer connection is there "to enhance the intelligent learning capabilities and human-machine interface of these devices," said the U.S.-China Economic and Security Review.

"Investigators are calling it a 'digital canvass' -- the high-tech equivalent of knocking on thousands of doors for information," reports the CBC, describing how an Ontario police department sent text messages to 7,500 potential witnesses of a homicide using phone numbers from a nearby cell tower's logs. Police obtained the numbers through a court order, and sent two texts -- one in English, and another one in French -- asking recipients to "voluntarily answer a few simple questions..." Slashdot reader itamblyn writes: On one hand, this seems like the natural progression from the traditional approach of canvassing local residents by putting up flyers and knocking on doors. On the other hand, I think one can reasonably ask -- Are we OK with this approach...? Do we want this to happen whenever there is a major crime?
The article adds that the police force "will keep the numbers on file until the killing is solved, officers said at a news conference on Wednesday... Investigators will also consider calling the numbers of people who don't respond voluntarily, but they would be required to obtain another court order to do so."

An anonymous reader writes: An RFID-based access control system called IClass is used across the globe to provide physical access controls. This system relies on cryptography to secure communications between a tag and a reader. Since 2010, several academic papers have been released which expose the cryptographic insecurity of the IClass system. Based on these papers, Martin Holst Swende implemented the IClass ciphers in a software library, which he released under the GNU General Public License.

The library is useful to experiment with and determine the security level of an access control system (that you own or have explicit consent to study). However, last Friday, Swende received an email from INSIDE Secure, which notified him of (potential) intellectual property infringement, warning him off distributing the library under threat of "infringement action." Interestingly, it seems this is not the first time HID Global has exerted legal pressure to suppress information.