Technology

Security researchers have found flaws in four popular connected storage drives that they say could let hackers access a userprivate and sensitive data.

The researchersPaulos Yibelo and Daniel Eshetu said the software running on three of the devices they tested — NetGear Stora, Seagate Home and Medion LifeCloud — can allow an attacker to remotely read, change and delete data without requiring a password.

Yibelo, who shared the research with TechCrunch this week andposted the findings Friday, said that many other devices may be at risk.

The software, Hipserv, built by tech company Axentra, was largely to blame for three of the four flaws they found. Hipserv is Linux-based, and uses several web technologies — including PHP — to power the web interface. But the researchers found that bugs could let them read files on the drive without any authentication. It also meant they could run any command they wanted as &root& — the built-in user account with the highest level of access — making the data on the device vulnerable to prying eyes or destruction.

We contacted Axentra for comment on Thursday but did not hear back by the time of writing.

A Netgear spokesperson said that theStora is &no longer a supported product… because it has been discontinued and is an end of life product.& Seagate did not comment by our deadline, but we&ll update if that changes. Lenovo, which now owns Medion, did not respond to a request for comment.

The researchers also reported a separate bug affecting WD My Book Live drives, which can allow an attacker to remotely gain root access.

A spokesperson for WD said that the vulnerability report affects devices originally introduced in 2010 and discontinued in 2014, and &no longer covered under our device software support lifecycle.& WD added: &We encourage users who wish to continue operating these legacy products to configure their firewall to prevent remote access to these devices, and to take measures to ensure that only trusted devices on the local network have access to the device.&

In all four vulnerabilities, the researchers said that an attacker only needs to know the IP address of an affected drive. That isn&t so difficult in this day and age, thanks to sites like Shodan, a search engine for publicly available devices and databases, and similar search and indexing services.

Depending on where you look, the number of affected devices varies. Shodan puts the number at 311,705, but ZoomEye puts the figure at closer to 1.8 million devices.

Although the researchers described the bugs in moderate detail, they said they have no plans to release any exploit code to prevent attackers taking advantage of the flaws.

Their advice: If you&re running a cloud drive, &make sure to remove your device from the internet.&

Microsoft planned acquisition of Git-based code sharing and collaboration service, GitHub, has been given an unconditional greenlight from European Union regulators.

The software giant announced its intention to bag GitHub back in June, saying it would shell out $7.5 billion in stock to do so. At the time it also pledged: &GitHub will retain its developer-first ethos and will operate independently to provide an open platform for all developers in all industries.&

The European Commissionapproved the plantoday, saying its assessment had concluded there would be no adverse impact on competition in the relevant markets, owing to the combined entitycontinuing to face &significant competition&.

In particular, it said it looked at whether Microsoft would have the ability and incentive to further integrate its own devops tools and cloud services with GitHub while limiting integration with third party tools and services.

The Commission decided Microsoft would have no incentive to undermine the GitHubopenness — saying any attempt to do so would reduce its value for developers, who the Commission judged as willing and able to switch to other platforms.

Microsoft has previously said it expects the acquisition to close before the end of the year.

The team behind mileage-tracking app MileIQ, a company Microsoft acquired a few years ago, is out with a new application. This time, the focus isn&t on tracking miles, but rather expenses. The new app, simply called &Spend,& arrived on the App Store on Thursday, offering automatic expense tracking for work reimbursement purposes or for taxes.

Spend doesn&t appear to be a part of some grand Microsoft plan to take on expense tracking industry giants, like Expensify or SAP-owned Concur, for example. At least, not at this time.

Instead, the app is a Microsoft Garage project, the App Store clarifies.

Microsoft Garage is the companyinternal incubator when employees can test out new ideas to see if they resonate with consumers and business users.

Through the program, a number of interesting projects have gotten their start over the years, like theCortana-based dictation tool, Dictate; mobile design creation app Sprightly; short-form email app Send; the Word Flow keyboard for smartphones; a Bing-backed alternative to Google News; and dozens more.

The new Spend app, at first glance, looks well-designed and easy to use.

Like most expense trackers, it offers features like the ability to take photos of receipts, expense categorization features, and reporting.

However, what makes Spend interesting is the appautomated tracking and matching, and its user interface for working with your receipts.

The app begins by automatically tracking all your expenses from a linked credit card or bank account. You can then swipe on the expenses to mark them as personal or business. These expenses are automatically categorized, and you can add extra tags for added organization.

You can also add notes to purchases,split expenses, and customize expense categories, in addition to tags.

And the app can generate expense reports on a weekly, monthly or custom bases, which can be exported at spreadsheets or PDFs. Therea web dashboard for when you&re using the app at your computer, but Spend doesn&t appear on the MileIQ main website at this time. It does, however, have a support site.

How well this all works, in practice, requires further testing.

MileIQhad been the top-grossing finance app in AppleApp Store for the last 20 months at the time of its acquisition back in 2015. Microsoft had said then the team would work on othermobile productivity solutions going forward.

Since joining Microsoft, the team that created MileIQ has added capabilities to MileIQ, such as MileIQ for Teams, new intelligence features and a partnership with Xero. MileIQ is also nowincluded with Microsoft 365 Business and Office 365 Business Premium plans

However, Spend is the first standalone app built by the team in that time.

The company says the new Spend app is an early version, and they plan to revise it going forward as they make improvements.

Microsoft responded to a request for comment, but didn&t provide any details about its eventual plans for Spend, like whether it will have business model or be included with Office subscriptions.

10/19/18: Updated after publication with information about Microsoftcomments.