Dr. T's security brief
dtau...@gmail.com
North Korean Hackers Again Exploit Internet Explorer's Leftover Bits
Ars Technica
Kevin Purdy
December 8, 2022
Google's Threat Analysis Group (TAG) claims a North Korean government-backed hacker group continues to exploit persisting flaws in Microsoft's Internet Explorer (IE) browser. TAG analysts said the APT37 group targeted visitors to the South Korean website Daily NK, focusing on the Halloween crowd crush in Seoul's Itaewon district. The group allegedly circulated a potentially malware-bearing Microsoft Word .docx document related to the tragedy that exploited a long-known flaw in Office and WordPad rooted in IE's JavaScript (JScript) engine. APT37 has previously issued exploits that activated BLUELIGHT, ROKRAT, and DOLPHIN malware aimed at North Korean political and economic interests. Microsoft patched the exploit in the JScript engine, but the persistence of remote-code Word doc attacks suggests such hacks will linger.
Apple Details Plans to Beef Up Encryption of Data in iCloud
The New York Times
Tripp Mickle
December 7, 2022
Apple will expand its end-to-end encryption system in order to render most iCloud data unreadable, even when stored in datacenters. Although Apple had not fully encrypted the data so customers can more easily retrieve information for users who were locked out or lost account access, escalating breaches and more data migrating to the cloud prompted the company to fortify its security. The optional Advanced Data Protection framework was designed to shield data of public figures who hackers may target. The upgrade could potentially conflict with the U.S. government and other regimes. Apple has refused to help law enforcement unlock iPhones, while meeting many requests for iCloud backups that include unencrypted messages and photos.
*May Require Paid Registration
Go-Based Botnet Exploiting Dozens of IoT Vulnerabilities to Expand Network
The Hacker News
Ravie Lakshmanan
December 7, 2022
Researchers at Fortinet FortiGuard Labs identified a Go-based botnet that is taking advantage of 21 security vulnerabilities in Internet of Things devices and other software, singling out Windows and Linux operating systems in its efforts to assume control of the affected devices. Fortinet's Cara Lin said the Zerobot botnet "contains several modules, including self-replication, attacks for different protocols, and self-propagation. It also communicates with its command-and-control server using the WebSocket protocol." The vulnerabilities affect a range of devices, including TOTOLINK routers, Zyxel firewalls, F5 BIG-IP, Hikvision cameras, FLIR AX8 thermal imaging cameras, D-Link DNS-320 NAS, and Spring Framework. Added Lin, "Within a very short time, it was updated with string obfuscation, a copy file module, and a propagation exploit module that make[s] it harder to detect and gives it a higher capability to infect more devices."
Deepfake Detector Spots Fake Videos of Ukraine's President Zelensky
New Scientist
Jeremy Hsu
December 7, 2022
A deepfake detector can accurately identify fraudulent videos of Ukraine's president Volodymyr Zelensky, and can be trained to flag deepfakes of other prominent figures. Researchers at the University of California, Berkeley and the Czech Republic's Johannes Kepler Gymnasium trained a computer model on more than eight hours of publicly posted videos featuring Zelensky. The detector vets 10-second clips from a single video, analyzing up to 780 behavioral characteristics. Flagging multiple clips from the same video as false indicates human analysts should look closer. The University at Buffalo in New York's Siwei Lyu said the deepfake detector's holistic head-and-upper-body analysis is uniquely suited to identifying doctored videos.
Never-Before-Seen Malware Nuking Data in Russia's Courts, Mayors' Offices
Ars Technica
Dan Goodin
December 2, 2022
Researchers at Russian cybersecurity company Kaspersky and news service Izvestia warned of never-before-encountered CryWiper malware besieging mayors' offices and courts in Russia. The Kaspersky researchers named the malware after the .cry extension appended to corrupted data. Izvestia said once infecting a victim, CryWiper leaves a ransom note demanding 0.5 bitcoin and a wallet address to send the payment; the Kaspersky analysts said the Trojan then permanently destroys the target data. CryWiper uses the same algorithm as the IsaacWiper malware directed against targets in Ukraine, which generates pseudo-random numbers that infect files by overwriting data within them. "In many cases, wiper and ransomware incidents are caused by insufficient network security, and it is the strengthening of protection that should be paid attention to," the Kaspersky researchers said.
How China's Police Used Phones, Faces to Track Protesters
The New York Times
Paul Mozur; Claire Fu; Amy Chang Chien
December 2, 2022
China's police used an advanced surveillance system to track protesters who rallied against the government's pandemic policies this past week. The system enables authorities to target, detain, and intimidate protest organizers and vocal dissidents. Its tools include millions of cameras, facial recognition software programmed to identify local citizens, phone monitors, and data- and image-crunching applications. The phone trackers connect to and record data on the phones of passersby for police to review. Many protesters said they now avoid using virtual private networks or other foreign apps like Telegram and Signal out of fear their phones' software might be more closely monitored.
*May Require Paid Registration
TikTok Ban Unlikely To Be Included In NDAA
Roll Call 
(12/7, Newhouse) reports Republicans seeking to ban TikTok from “federal electronic devices may have missed their chance this Congress.” Rep. Ken Buck (R-CO) had hoped to “attach his bill to prohibit federal employees from downloading or using the app on a government-issued device to the fiscal 2023 defense authorization measure,” but a new draft of the bill “released late Tuesday doesn’t include such a provision.” Lawmakers could attach the “proposal to the fiscal 2023 omnibus spending package or, if that isn’t finished, a continuing resolution to avert a government shutdown when current funding expires Dec. 16.” Both chambers also could “pass the legislation as a stand-alone bill, but time is running out on the current Congress.”
CNBC (12/7, Feiner) reports that on Wednesday, analysts have “predicted that Meta, Google’s YouTube and Snap would stand to gain from a TikTok ban in the U.S.”
Indiana Sues TikTok For Misleading About Chinese Access To Data, Mature Content. Reuters (12/7, Singh) reports Indiana sued TikTok on Wednesday “over allegations that it is deceiving users about China’s access to their data and exposing children to mature content.” The office of Indiana Attorney General Todd Rokita, a Republican, “said the popular app, owned by ByteDance, violates the state’s consumer protection laws by not disclosing the Chinese government’s potential to access sensitive consumer information.” The complaint “added that inappropriate sexual and substance-related content can easily be found and are pushed by the company to children using TikTok.”
South Dakota Bans TikTok From State Agencies Over National Security Concerns. The Wall Street Journal (12/7, Woo, Kesling, Subscription Publication) reports that last week, South Dakota Gov. Kristi Noem (R) issued an executive order banning TikTok from state agencies over national-security concerns, due to the app’s Chinese ownership. The state tourism department has since deleted its TikTok account. South Dakota’s public broadcaster did the same. The state’s six public universities are evaluating next steps this week.
Rocket Lab, SpaceX Debut New Services For National Security
Aviation Week (12/6) reports that SpaceX and Rocket Lab “both kicked off December by unveiling government-oriented departments and services that stress reliability, security and adaptable or responsive-space capabilities for U.S. and allied governments.” Rocket Lab debuted Rocket Lab National Security to handle the company’s national security-linked services, like launching spysats and experimental military spacecraft.
CNET News (12/6, Anders) reports SpaceX and founder Elon Musk “have created a satellite network specifically for government use called Starshield to aid in national security, according to a recently published SpaceX webpage.” According to SpaceX, the program “will use Starlink technology, which delivers high-speed internet to consumers and businesses via thousands of low-orbiting satellites.” The satellites are capable “of bringing broadband internet to underserved areas minus the high latency and data restrictions that come with traditional, geostationary satellite internet services.”
Forbes Councils Member Discusses Responses To Cybersecurity Staff Shortage
In a piece for Forbes (12/6), Forbes Councils Member Anurag Lal, President & CEO of Netsfere, writes, “Cybersecurity and IT job positions are growing in demand faster than companies can hire,” and “a massive staffing shortage is plaguing the industry, particularly due to rapidly changing job requirements and qualifications.” Lal adds, “there are several ways businesses can lessen the IT labor shortage” including recruiting overseas, providing training for existing employees, and working “with high schools and universities to get more young professionals educated and into the workforce sooner.” Lal recommends “internships, student hires and mentorship programs” to “help feed the industry with eager new talent.” Lal concludes, “Employers want to turn the bright minds of the younger generations into their team members working to protect against hackers, not become them.”
Hacker Uses Exploit To Steal Crypto Funds From 8,000 Solana Wallets
Fortune (8/3) reports, “On Tuesday, Solana owners reported that their funds were vanishing – and by evening it became clear a hacker was draining millions from online wallets.” The hacks seem to be tied to an exploit of Slope wallets, a cryptocurrency wallet built for Solana. The hacker “has made off with at least $5.2 million worth of assets,” according to estimates by security companies. Solana Foundation Head of Communications Austin Federa said engineers “continue to investigate the root cause of an incident that resulted in approximately 8,000 wallets being drained.”
dtau...@gmail.com
NIST Revises Guidelines for Digital Identification in Federal Systems
U.S. National Institute of Standards and Technology
December 16, 2022
The U.S. National Institute of Standards and Technology (NIST) has drafted revised federal guidelines that support risk-informed management of Americans' digital identities. The draft publication encompasses technical requirements for establishing and authenticating digital identities of individuals, including employees of government contractors or members of the general public. They cover privacy requirements, factors for cultivating equity and usability of digital identity solutions, and supporting technologies and protocols, with risks faced by individuals accessing services and by service-providing organizations considered in parallel. Updates include a section on biometric information usage for identity proofing; more phishing-resistant authentication methods; and recommendations for sharing/exchanging user identity information between different systems. NIST's Laurie E. Locascio said the guidelines are designed to "get the right services to the right people while preventing fraud, preserving privacy, fostering equity, and delivering high-quality, usable services to all."
NIST Retires SHA-1 Cryptographic Algorithm
U.S. National Institute of Standards and Technology
December 15, 2022
Security experts at the U.S. National Institute of Standards and Technology (NIST) say the agency has retired the secure hash algorithm (SHA)-1 and recommends information technology professionals switch to more secure algorithms. SHA-1 has been in use for nearly 30 years as part of the Federal Information Processing Standard (FIPS) 180-1, but as it is increasingly vulnerable to ever-more-powerful computers, NIST's Chris Celi said users should migrate to the SHA-2 and SHA-3 groups of algorithms as soon as possible. NIST will discontinue use of SHA-1 in its last remaining specified protocols by Dec. 31, 2030, by which time the agency intends to publish FIPS 180-5 to remove the specification; amend NIST publications to reflect the algorithm’s phase-out, and develop and publish a transition process for validating cryptographic modules and algorithms.
Cyberattacks on Hospitals Thwart India's Push to Digitize Healthcare
NPR
Raksha Kumar
December 17, 2022
Massive cyberattacks targeting hospitals in India have undermined the nation's healthcare digitization initiatives. Last month, hackers compromised the health data of millions of patients at the All India Institute of Medical Sciences with ransomware. The breach has unsettled observers about Prime Minister Narendra Modi's National Digital Health Mission to digitize all Indians' health records, since India lacks resilient cybersecurity systems and strong data protection laws. The mission makes hospitals responsible for storing and protecting patient data, but Srinivas Kodali with the Free Software Movement of India says the government should provide such protection if the goal is to establish a unique national health ID.
Security Researchers Cite Theorem of Infinitely Typing Monkeys
Ruhr-Universität Bochum (Germany)
Julia Weiler
December 14, 2022
An international team of scientists led by Germany's Ruhr-Universität Bochum (RUB) is developing new techniques to efficiently identify coding errors in embedded systems via a system called Fuzzware. The researchers use fuzzing algorithms to feed random inputs to software to try to crash the application. The researchers expedite the fuzzing process by narrowing down possible inputs, which RUB's Thorsten Holz said involves employing only those inputs "that the firmware expects and can handle." Holz explained the process resembles the Infinite Monkey Theorem in that the fuzzer eventually, by chance, will use meaningful inputs after enough attempts. The team tested 77 firmwares with Fuzzware, checking up to three times more code than conventional fuzzing methods in the same amount of time.
Researcher Exploits Power Supply to Transmit, Steal Data from PC
PC Magazine
Michael Kan
December 12, 2022
Mordechai Guri at Israel's Ben-Gurion University of the Negev transmitted stolen data from a personal computer by manipulating the device's power supply. "By regulating the workload of the CPU [central processing unit], it is possible to govern its power consumption and hence control the momentary switching frequency of the SMPS (switch-mode power supplies)," Guri explained. "The electromagnetic radiation generated by this intentional process can be received from a distance using appropriate antennas." Guri said malware installed on a universal serial bus drive could infect the target PC, but suggested banning smartphone use around the computer as a countermeasure.
Blockchain Fails to Gain Traction in the Enterprise
The Wall Street Journal
Isabelle Bousquette
December 15, 2022
Blockchain technology's widespread enterprise adoption has failed to materialize, with a project by Danish shipping company A.P. Moller-Maersk and IBM's TradeLens to create a shipment-tracking platform the latest to be discontinued. Blockchain's complexity, the time needed to get a blockchain running, and problems recruiting participants have stymied major initiatives. IBM's Kathryn Guarini said blockchain demands changes to technology and business models that are difficult to drive forward, adding that enterprise blockchain has taken longer to bring change to business than originally predicted. Some experts maintain smaller projects involving fewer participants, with definite returns on investment and no sector-wide transformative ambitions, could reap greater success.
A Faster Way to Preserve Privacy Online
MIT News
Adam Zewe
December 7, 2022
Researchers at the Massachusetts Institute of Technology have developed a method for retrieving private information from a database that is approximately 30 times faster than comparable methods. Using this technique, users could search online databases without the server seeing their query, communicate without messaging apps knowing what they are saying or to whom, or access relevant online ads without sharing their interests with advertising servers. The researchers created the Simple PIR protocol to perform the bulk of the cryptographic work prior to the client sending a query. This involves producing a data structure that holds compressed information about database contents, which serves as a hint for the client. They developed the Double PIR scheme to reduce the size of the hint, generating a more compact hint with a fixed size.
Biden Signs Quantum Computing Cybersecurity Bill
FedScoop (12/21, Jones) reports President Biden on Wednesday signed “legislation to encourage federal government agencies to adopt technology that is protected from decryption by quantum computing.” The newly enacted legislation comes “amid fears that significant leaps in quantum technology being made by countries hostile to the United States, including China, could allow existing forms of secure encryption to be cracked much more quickly.” In particular, the Quantum Computing Cybersecurity Preparedness Act “requires the Office of Management and Budget to prioritize federal agencies’ acquisition of and migration to IT systems with post-quantum cryptography.” It mandates “also that the White House create guidance for federal agencies to assess critical systems one year after the National Institute of Standards and Technology issues planned post-quantum cryptography standards.”
Hacker Group Emails Knox College Students, Gains Access To Student Data
NBC News (12/20, Collier) reports that on December 12th at Knox College, a “hacker group known as Hive had broken into the college’s computer system and gained access to student data, a common ransomware tactic.” An email from Hive that went out to students said, “We have compromised your collage networks. The data we have includes your personal information, medical records, psychological assessments, and many other sensitive data. Additionally all of your SSN and Medical records will be put for sale, for every hacker to gain access and use your data in whatever illegal activity they want. To us, this is a normal business day. For you, its a sad day where everyone will see your personal and private info.”
Experts Question Whether Crypto Industry Can Recover From Downturn
The Washington Post (12/18, Mark) says that “cryptocurrency prices have fallen by more than half, trading volume has cratered, and several high-profile companies have collapsed in liquidity crises” over the past year. The arrest of former FTX CEO Sam Bankman-Fried “has only deepened the sense that the crypto bubble has definitively popped, taking with it billions of dollars of investments made by regular people, pension funds, venture capitalists and traditional companies.” Meanwhile, governments “are suddenly pressing for more oversight. ... The crypto industry is calling this moment its ‘crypto winter.’” But, while the industry says it is “cyclical,” and “will eventually blow over,” experts “say the ferocity and scale of this downturn could end up leading to more of an ice age.” The Wall Street Journal (12/18, Banerji, Subscription Publication) provides similar coverage.
Leading Cybersecurity Companies Developing Unified Standard For Sharing Cyberattack Data
CNN Business (8/10, Fung) reports more than a dozen cybersecurity companies “are developing a single, open standard for sharing data about hacking threats, a project the companies say could help organizations detect cyberattacks more quickly.” The initiative led by Amazon, “Cloudflare, Crowdstrike, IBM, Okta and Salesforce, among others, aims to solve a critical bottleneck in the sharing of threat information: The different data formats currently in use across multiple cybersecurity tools and products.”
dtau...@gmail.com
Even the FBI Says You Should Use an Ad Blocker
TechCrunch
Zack Whittaker
December 22, 2022
The U.S. Federal Bureau of Investigation has issued an alert advising online users to install and use ad blockers. The advisory warns of hackers buying online ads highly placed in search results to pose as legitimate brands, in order to steal or extort money from targets. Malicious ads also are used to fool victims into installing malware masked as genuine applications. Ad blockers bar the display of any advertising, making it easier for browsers to find and access the websites of authentic brands. Ad-blocking Web browser extensions also prevent the tracking code within ads from loading, and some of the most effective ad blockers are available to consumers for free.
Twitter Security Flaw May Expose Videos in Direct Messages
New Scientist
Matthew Sparkes
December 21, 2022
Old Dominion University's Michael Nelson discovered a vulnerability in Twitter that could expose any video sent in a direct message to anyone online if a hacker correctly guesses the unique Web address for accessing the file. Nelson said attackers could generate a hash of a known video, then search for people who are sharing it. They also could exploit vulnerabilities in other software like browsers to track the addresses a person visits, then view any Twitter videos they had accessed. Twitter told Nelson the flaw is not a problem, as it requires users to disclose the URL publicly, although it might leave videos open to theft. "Just be aware that while your images enjoy a really impressive array of authentication protection [on Twitter], your videos do not," said Nelson.
Hackers Used Software Flaw to Take Down County Computer System
The New York Times
Sarah Maslin Nir; Nate Schweber
December 21, 2022
Suffolk County, NY, officials disclosed that hackers planned this fall's crippling ransomware attack on the county more than a year ago. Forensic analysis indicated the professional hacker gang BlackCat exploited a vulnerability in an obscure but common piece of software to infiltrate Suffolk's computer system on Dec. 19, 2021. Last year, the U.S. Cybersecurity & Infrastructure Security Agency published an advisory about the software flaw, recommending vulnerable organizations update their systems. Several Suffolk departments created a patch, but the county lacks a centralized interdepartmental cybersecurity protocol, while information technology teams are siloed. Suffolk executive Lisa Black said the office of the county clerk failed to patch the bug, enabling the hackers to orchestrate their infiltration and attack.
Critical Windows Code-Execution Vulnerability Undetected Until Now
Ars Technica
Dan Goodin
December 19, 2022
Microsoft has elevated a recently discovered Windows code-execution vulnerability from important to critical. The CVE-2022-37958 bug resembles the EternalBlue flaw used to set off WannaCry ransomware; it allows attackers to execute malware without requiring authentication, while a single exploit can trigger a chain reaction of self-replicating follow-on exploits on other susceptible systems. The bug allows attackers to remotely detonate malware by accessing the SPNEGO Extended Negotiation security mechanism while the victim uses an authenticating Windows application protocol. CVE-2022-37958 also exists in a wider range of network protocols, offering hackers more flexibility than they had when exploiting EternalBlue. Microsoft corrected the flaw in September, but elevated its threat status when IBM's Valentina Palmiotti found its remote-code-execution capability.
Police in Australia Co-Opted COVID-19 Apps to Fight Crime
Associated Press
Rod McGuirk
December 20, 2022
Law enforcement officials in Western Australia ordered the state Health Department to provide information from the SafeWA COVID-19 contract tracing app as part of an investigation into a murder at a speedway in Perth. The QR code check-in data included the names, phone numbers, and arrival times of 2,439 fans who attended the December 2020 race. Provided under a government order requiring contact tracing information in the event of a COVID-19 outbreak, the data was supposed to be accessible only to contact tracing personnel. The matter has raised concerns over privacy, particularly since Australia's 1988 Privacy Act was implemented before widespread use of the Internet and smartphones.
Inventor of World Wide Web Wants Us to Reclaim our Data from Tech Giants
CNN
Daniel Renjifo
December 16, 2022
World Wide Web inventor and 2016 ACM A.M. Turing Award recipient Tim Berners-Lee founded the startup Inrupt with John Bruce to help users reclaim their personal data. The company's Personal Online Data Store (Solid Pod) allows people to store their data in one location and govern its access, rather than have it stored by applications and websites across the Web. Users can obtain Pods from certain providers, hosted by Web services like Amazon, or operate their own server. Bruce says this setup protects user data from corporations and governments, while also reducing the chances of hacker theft. Said Berners-Lee, "I think what [users are] missing sometimes is the lack of empowerment. You need to get back to a situation where you have autonomy, you have control of all your data."
California Lawmakers Pass Children’s Online Safety Bills
The New York Times (8/30, Singer) report that California lawmakers “have passed the first statute in the nation requiring apps and sites to install guardrails for users under 18.” The California Age-Appropriate Design Code Act “would compel many online services to curb the risks that certain popular features – like allowing strangers to message one another – may pose to child users.” The Times says the measure “could herald a shift in the way lawmakers regulate the tech industry.” The new rules would take effect in 2024 and could potentially “prompt some online services to introduce nationwide changes, rather than treat minors in California differently.”
CNBC (8/30, Feiner) reports on its website that the bill “would require online services to install additional safeguards for users under 18, including by defaulting to the highest possible privacy settings in most cases and providing ‘an obvious signal’ to the minor when their location is being monitored (such as by a parent or guardian).” In addition, it would “prohibit the use of so-called dark patterns – essentially design tricks made to steer users toward a specific choice – that would encourage minors to give away personal information that would not be necessary to provide the service.”
Data Brokers Lobby For Changes To Privacy Bill
Politico (8/28, Ng) reports that as lawmakers move toward passage of a federal data privacy law, “the brokers that profit from information on billions of people are spending big to nudge the legislation in their favor.” According to lobbying disclosure records, “five prominent data brokers boosted their collective spending on lobbying by roughly 11 percent in the second quarter of this year compared with the same period a year ago.” The brokers “including U.K.-based data giant RELX and credit reporting agency TransUnion, want changes to the bill – such as an easing of data-sharing restrictions that RELX says would hamper investigations of crimes. Some data brokers also want clearer permission to use third-party data for advertising purposes.” But, “privacy advocates say these requested changes would entrench practices in the data broker industry that have raised years of concerns about information collected en masse and shared without proper consent.”
Twitter Whistleblower To Testify Before Senate Panel
The Washington Post (8/24) reports the Senate Judiciary Committee announced Wednesday that pursuant to a subpoena, Twitter whistleblower Peiter Zatko will testify at a Sept. 13 hearing “about his allegations of security failures at the social network.” The announcement came one day after the Post “reported on Zatko’s whistleblower complaint to federal regulators that alleges ‘extreme, egregious deficiencies’ in its defenses against hackers, as well as meager efforts to fight spam.” Bloomberg (8/24, Birnbaum) reports Committee Chair Dick Durbin and Sen. Chuck Grassley (R-IA), the top Republican on the panel, said in a statement, “Mr. Zatko’s allegations of widespread security failures and foreign state actor interference at Twitter raise serious concerns. ... If these claims are accurate, they may show dangerous data privacy and security risks for Twitter users around the world.”
Politico (8/24, Kern) says the hearing “could be the first of many” as lawmakers “probe the implications of the cybersecurity vulnerability claims Zatko” made against Twitter. House Homeland Security Chair Bennie Thompson “said he has concerns about how the security allegations could impact the November midterms.” Thompson said Tuesday, “Our adversaries have a history of exploiting social media to disrupt our elections — and with the midterms only three months away, there is no time to waste.”
Reuters (8/24) reports aides to Sen. Richard Blumenthal (D-CT), who sits on the Senate Commerce Committee and the Judiciary Committee “also met Zatko this week.” Blumenthal, who “has a keen interest in Big Tech ,” wrote in a letter to FTC chair Lina Khan, “According to disclosures and evidence provided by Peiter ‘Mudge’ Zatko, a highly-respected cybersecurity expert who served as Twitter’s Security Lead from 2020 to 2022, Twitter executives allegedly failed to address significant security vulnerabilities, neglected the mishandling of personal data, and ignored known privacy risks to users for more than a decade.” Blumenthal “called for an FTC investigation in the letter.”
Twitter Executives Push Back On Zatko’s Allegations. The New York Times (8/24, Mac, Conger) reports Twitter executives “pushed back on Wednesday against what they said was a ‘false’ narrative being created” around Zatko’s allegations. At a weekly companywide meeting, Twitter chief executive Parag Agrawal, said Zatko’s whistleblower complaint “is foundationally, technically and historically inaccurate. ... There are accusations in there without any evidence and many points made without important context.” The TImes, which listened to the meeting, says “other executives – including Sean Edgett, the general counsel, and the privacy and security executives Damien Kieren and Lea Kissner – echoed Mr. Agrawal.”
Lawsuit Accuses Oracle Of Creating “Digital Dossiers” On Internet Users
Bloomberg Law (8/22, Vittorio, Subscription Publication) reports that Oracle “is accused in a new lawsuit of invading people’s privacy by using tracking technologies to build ‘digital dossiers’ on individual Internet users for marketing purposes.” According to Bloomberg Law, “The cloud infrastructure provider, also registered as a data broker in California, allegedly gathers and sells personal information without people’s permission in violation of state law and federal wiretap law, according to a class action complaint filed Friday in the US District Court for the Northern District of California.”
TechCrunch (8/22, Lomas) reports that the suit alleges that the tech giant’s “worldwide surveillance machine” has amassed detailed dossiers on some five billion people, accusing the company and its adtech and advertising subsidiaries of violating the privacy of the majority of the people on Earth.
Apple Discloses Security Vulnerabilities In Certain Devices
The AP (8/18, Klepper) reports Apple discovered and “disclosed serious security vulnerabilities for iPhones, iPads and Macs that could potentially allow attackers to take complete control of these devices.” The company “released two security reports about the issue on Wednesday, although they didn’t receive wide attention outside of tech publications.” According to Apple’s explanation of what is happening, “a hacker could get ‘full admin access’ to the device,” allowing “intruders to impersonate the device’s owner and subsequently run any software in their name, said Rachel Tobac, CEO of SocialProof Security.” CNN (8/18, Iyengar, Business) reports Apple “said the vulnerability affects iPhones dating back to the 6S model, iPad 5th generation and later, iPad Air 2 and later, iPad mini 4 and later, all iPad Pro models and the 7th generation iPod touch.”
New Research Says TikTok Browser Can Track Users’ Keystrokes
The New York Times (8/19, Mozur, Mac, Che) reported the web browser “used within the TikTok app can track every keystroke made by its users, according to new research that is surfacing as the Chinese-owned video app grapples with US lawmakers’ concerns over its data practices.” The research from Felix Krause, a privacy researcher and former Google engineer, “did not show how TikTok used the capability, which is embedded within the in-app browser that pops up when someone clicks an outside link.” But Krause “said the development was concerning because it showed TikTok had built in functionality to track users’ online habits if it chose to do so.” Jane Manchun Wong, an independent software engineer and security researcher, said, “Based on Krause’s findings, the way TikTok’s custom in-app browser monitors keystrokes is problematic, as the user might enter their sensitive data such as login credentials on external websites.”
Carnegie Mellon, University Of British Columbia Students Win Hacker World Championship
Reuters (8/17) reports that “a team of hackers from two U.S. universities won the ‘Capture the Flag’ championship, a contest seen as the ‘Olympics of hacking,’ which draws together some of the world’s best in the field.” In the “carpeted ballroom of one of the largest casinos in Las Vegas, the few dozen hackers competing in the challenge sat hunched over laptops from Friday through Sunday during the DEF CON security conference that hosts the event.” The winning team “included participants from Carnegie Mellon University, its alumni, and the University of British Columbia.” The contest “involves breaking in to custom-built software designed by the tournament organizers.” Participants “must not only find bugs in the program but also defend themselves from hacks coming from other competitors.”
Colleges Emphasize Student Digital Privacy After Roe Overturn
Inside Higher Ed (8/17) reports that “in the weeks following the Supreme Court’s overturn of Roe v. Wade – the nearly 50-year federal right to abortion access – digital privacy advocates warned of government access to and weaponization of private health information found on period-tracking apps.” Now, some colleges “are warning students that the government is not the only entity that may seek to surveil reproductive health information, and period-tracking apps are not the only digital means for doing so.” College students’ intimate partners, “parents, dorm mates and their colleges, in addition to the government and hackers, may gain access to digital trails that paint a picture of reproductive health decisions.” Further, “web search histories, text messages and location tracking, in addition to apps, all hold potential to expose students’ private health information.” As colleges “adapt to the post-Roe landscape, many have offered students a range of direct, indirect and sometimes outdated messaging about how to protect their virtual privacy.”
Whitworth University Confirms Cyberattack After Weeks Of Rumors
Inside Higher Ed (8/18) reports that “in late July, Whitworth University undergraduate Byron Gustafson tried to access information on his university’s website, but his request did not go through.” At first, he “assumed the glitch was temporary.” But three days later, he “saw a brief post from the university indicating that the institution was experiencing technical difficulties.” In search of more information “than the university provided, he checked the ‘Whitworth Confessions’ Instagram account, where reports circulated widely that the university had been hit by a ransomware attack.” On Wednesday, “nearly three weeks later, Whitworth acknowledged for the first time what many concerned and frustrated students and faculty had suspected all along: the institution had been hit by a cyberattack.” The university “has neither confirmed nor denied rumors that the cyberattack involved ransom.”
dtau...@gmail.com
Code-Generating AI Can Introduce Security Vulnerabilities
TechCrunch
Kyle Wiggers
December 28, 2022
Software engineers who use code-generating artificial intelligence (AI) systems are more likely to cause security vulnerabilities in the apps they develop, according to researchers affiliated with Stanford University. Their study looked at Codex, an AI code-generating system developed by research lab OpenAI. The researchers recruited developers to use Codex to complete security-related problems across programming languages, including Python, JavaScript, and C. Participants who had access to Codex were more likely to write incorrect and “insecure” solutions to programming problems compared to a control group, and they were more likely to say that their insecure answers were secure compared to the people in the control.
Apple Fixes Bug That Let Malicious Apps Skirt macOS' Security Protections
Tech Crunch
Carly Page
December 20, 2022
Microsoft researchers have determined that a flaw in a core macOS security feature could enable attackers to deploy malware on affected devices. The "Achilles" vulnerability exploits the Gatekeeper security feature's Access Control Lists file permissions model, which quarantines apps and files downloaded from a web browser until Gatekeeper checks them. The vulnerability adds extremely restrictive permissions to downloadable files that prevents the quarantine attribute from being set. This means users could download and open malicious files on macOS without Gatekeeper's security protections being triggered. Apple recently reported that the flaw, which was identified in July, had been fixed.
To the Highest Bidder: A Military Database of Fingerprints, Iris Scans
The New York Times
Kashmir Hill; Ismay, John; Christopher F. Schuetze
December 27, 2022; et al.
German security researcher Matthias Marx successfully bid on eBay for a Secure Electronic Enrollment Kit, or SEEK II, which contained the names, nationalities, photographs, fingerprints, and iris scans of 2,632 people, mostly from Afghanistan and Iraq. Many were known terrorists and wanted individuals but others appeared to be people who had worked with the U.S. government or had been stopped at checkpoints. Over the past year, Marx and other researchers at the Chaos Computer Club, a European hacker association, bought six biometric capture devices on eBay, most for less than 200 Euro. Of the six, two of the SEEK II devices had sensitive data on them. The second SEEK II, with location metadata showing it was last used in Jordan in 2013, appeared to contain the fingerprints and iris scans of U.S. service members. “It was disturbing that they didn't even try to protect the data,” Marx said, referring to the U.S. military.
WPost: Schools Should Use Infrastructure Funds To Improve Cybersecurity
A Washington Post (10/18) editorial says, “Ransomware gangs are taking Americans to school. So far this year, hackers have taken hostage the sensitive data of at least 1,735 schools in 27 districts.” The Post argues, “The tech industry can at least slow this scourge. But educators should not rely only on outside help to fix this problem for them. ... Educational institutions can harden their defenses: Last year’s bipartisan infrastructure law authorized $1 billion to help local governments improve their cybersecurity capabilities – and public schools should be top candidates for fortification. ... Building capacity to oust ransomware attackers from the systems they have locked up is another important line of defense. The same bipartisan law created the Cyber Response and Recovery Fund to provide federal aid to breach victims. It has $20 million per year for five years that, if spent on helping schools after” cyberattacks, “could help liberate computer systems in institutions that failed...to observe good cybersecurity hygiene.”
HHS Report: Hackers Using Providers’ Security Tools To Conduct Cyberattacks
HHS recently released a report revealing tools similar to those “that healthcare providers use to operate and maintain secure IT systems can also be weaponized by hackers,” MedCity News (10/11, Adams) reports. HSS’ “report flagged legitimate security tools that are commonly used by providers, including Cobalt Strike and PowerShell.” According to Cerberus Sentinel cybersecurity expert Chris Clements, “cybercriminals’ methods rely on controlling remote computers and avoiding detection.” HHS “clarified that it is not suggesting healthcare organizations abandon the use of these tools altogether, but rather calling providers to evaluate their use based on the ‘merits and drawbacks’ of each tool.”
Uber CSO Convicted Of Covering Up 2016 Data Breach
The Washington Post (10/5, Menn) reports former Uber Chief Security Officer Joe Sullivan was found guilty “of federal charges stemming from payments he quietly authorized to hackers who breached the ride-hailing company in 2016.” Sullivan was convicted Wednesday “of obstructing justice for keeping the breach from the Federal Trade Commission, which had been probing Uber’s privacy protections at the time, and of actively hiding a felony.” The case against him began “when a hacker emailed Uber anonymously and described a security lapse that allowed him and a partner to download data from one of the company’s Amazon repositories.” It came to light “that they had used a stray digital key Uber had left exposed to get into the Amazon account, where they found and extracted an unencrypted backup of data on more than 50 million Uber riders and 600,000 drivers.”
The Verge (10/5, Lawler) reports that the hackers “contacted Uber and negotiated a ransom payment in exchange for a promise to delete the stolen information, paid out in $100,000 worth of Bitcoin, and treated as part of the company’s Bug Bounty program.”
Founder Of “Black Girls In Cyber” Profiled For Her Work Helping Increase Diversity In STEM
The Hill (10/3, Kagubare) reports that “the cybersecurity workforce famously lacks diversity, but for Talya Parker, constantly seeing herself on pandemic-era video conferences as one of the few – if not the only – Black woman was a wake-up call.” Parker, “currently a privacy engineer at Google, said she started conducting a Facebook Live series called ‘Black Girls in Cyber’ where she would invite other Black women in security, privacy and other STEM industries to share their journeys and experiences.” The Facebook events “became popular, garnering a lot of attention, prompting one of her peers to suggest that she start a nonprofit organization to address the diversity challenges in the cyber workforce.”
In 2021, she “founded a nonprofit with the same name as her Facebook Live series, seeking to help women of color transition into cybersecurity, privacy and science, technology, engineering and math (STEM) careers.” The organization “provides mentors, scholarships, training and networking opportunities for its members, often collaborating with historically Black colleges and universities (HBCUs) that offer cyber and STEM programs.” The nonprofit also “partners with corporations to create internships and full-time employment opportunities for members interested in pursuing careers in those fields.”
Senate Majority Leader Calls On FTC, DOJ To Boost Protections Against Cybersecurity Breaches
CNN (10/2, Pellish) reports Senate Majority Leader Schumer called on federal officials on Sunday to boost efforts to protect US consumers from cybersecurity breaches. Speaking to reporters, Schumer said, “I am calling on the Federal Trade Commission, first, to ensure that companies do everything they can to protect consumer data, and on the Department of Justice to fully investigate and go after the hackers that aim to harm Americans.” According to CNN, “Schumer said he wants a stricter requirement for companies to report data breaches to make as many consumers as possible aware of any possible exposure.”
Microsoft Says Hackers Are Using Open Source Software And Fake Jobs For Phishing. ZDNet (9/30, Tung) reported, “Microsoft is warning that hackers are using open source software and bogus social media accounts to dupe software engineers and IT support staff with fake job offers that in reality lead to malware attacks.” A hacking crew linked to North Korean has been using open-source apps and LinkedIn recruitment bait to hit tech industry employees with trojan horses, said Microsoft’s advanced persistent threat (APT) research group.
Hackers Release Los Angeles Unified Data After District Refuses To Pay Ransom
The Wall Street Journal (10/2, Otis, Subscription Publication) reports a criminal group suspected of hacking the Los Angeles public school system released over the weekend some illegally obtained data after Superintendent Alberto Carvalho declined to pay a ransom. The district said it has set up a hotline for students, families, and employees to call with questions and added it would notify anyone whose personal data was impacted by the breach. Carvalho said in a statement Sunday, “Unfortunately, as expected, data was recently released by a criminal organization. In partnership with law enforcement, our experts are analyzing the full extent of this data release.”
The Los Angeles Times (10/2) reports the release of the data “came two days earlier than the deadline set by the syndicate that calls itself Vice Society – and happened in apparent response to what it took as Carvalho’s final answer. Hackers demand ransom to prevent the release of private information and also to receive decryption keys to unlock computer systems.” Screenshots reviewed by the Times “appear to show some Social Security numbers. But the full extent of the release remains unclear.”
Administration, TikTok Reportedly Near Agreement On National Security Issues
The New York Times (9/26, Hirsch, McCabe, Benner, Thrush) reports the Administration and TikTok have “drafted a preliminary agreement to resolve national security concerns posed by the Chinese-owned video app but face hurdles over the terms, as the platform negotiates to keep operating in the United States without major changes to its ownership structure, four people with knowledge of the discussions said.” Under the deal, TikTok would “make changes to its data security and governance without requiring its owner, the Chinese internet giant ByteDance, to sell it, said three of the people, who spoke on the condition of anonymity because the negotiations are confidential.” If completed, an agreement with the Biden Administration “is likely to be highly scrutinized, as TikTok has become a symbol of the Cold War-like atmosphere in relations between Beijing and Washington.” Completing an agreement “may also be difficult at a tricky political moment for the Biden administration, which has stepped up its cadence of criticism and executive actions addressing China.”
TikTok May Face $29M Fine For Failing To Protect Children’s Privacy. The New York Times (9/26, Singer) reports TikTok “may face a fine of £27 million, or about $29 million, for failing to protect children’s privacy in the United Kingdom.” In the “first major case under new British rules protecting minors online, British regulators on Monday sent a warning notice to TikTok saying the company had handled youngsters’ information without appropriate permission from their parents, processed sensitive details without the legal grounds to do so and failed to explain the platform’s data practices in ways that children could easily understand.” While the findings “are provisional, the legal document sent to TikTok by Britain’s data protection agency, the Information Commissioner’s Office, constitutes a formal notification that regulators intend to impose a fine.” The British announcement “comes as the US government is working to resolve national security concerns with TikTok, which is owned by the Chinese internet giant ByteDance.” In a statement, TikTok “said it disagreed with the findings of the Information Commissioner’s Office, noting that they were provisional.”
Big Tech Increasingly Embraces Zero Trust Architecture
The Wall Street Journal (9/24, Mims, Subscription Publication) reports that as hackers increasingly turn to social engineering to dupe Big Tech insiders into giving up information they need to breach corporate systems, industry leaders are embrace zero-trust architecture – a cybersecurity approach that assumes that no matter how robust a company’s external defenses are, hackers can get in.
Proposed Class-Action Suits Allege Facebook Dodged Apple Protections Against Tracking Internet Activity
USA Today (9/22, Schulz) reports that, in a proposed class-action complaint, two Facebook users are suing the company’s parent, Meta Platforms, alleging it worked around Apple’s requirement that users consent to their Internet activity being tracked. Links clicked on in the Facebook app are sent to an in-app browser instead of the smartphone’s default browser, which the lawsuits say allows Facebook to “track their internet activity and collect personally identifiable information, private health details, text entries and other sensitive confidential facts.”
TechCrunch (9/22, Hatmaker) reports the plaintiffs “allege that Meta is not only violating Apple’s policies, but breaking privacy laws at the state and federal level, including the Wiretap Act.” Engadget (9/22, Fingas) reports Meta “claimed its in-app browsers honor privacy decisions, including for ads.”
White House Releases Crypto Regulation Framework
CNBC (9/16, Sigalos) reported the White House on Friday “released its first-ever framework on what crypto regulation in the U.S. should look like – including ways in which the financial services industry should evolve to make borderless transactions easier, and how to crack down on fraud in the digital asset space.” According to CNBC, “The new directives tap the muscle of existing regulators such as the Securities and Exchange Commission and the Commodity Futures Trading Commission, but nobody’s mandating anything yet.” CNBC adds that “the framework follows an executive order issued in March, in which President Biden called on federal agencies to examine the risks and benefits of cryptocurrencies and issue official reports on their findings.”
Federal Regulators Recommend Safeguards For Cryptocurrency Markets
The AP (10/3, Hussein) reports that federal regulators on Monday “recommended a series of new safeguards to ensure that a growing and unregulated cryptocurrency market doesn’t imperil U.S. financial stability.” As part of a package of seven recommendations, regulators “called on Congress to pass legislation that would address the systemic risks caused by the growth of stablecoins, which are a form of cryptocurrency pegged to the price of another financial asset, like the U.S. dollar or gold.” High volatility in cryptocurrency markets, “especially in stablecoins, has made regulators particularly wary about the need for regulation as usage of the digital asset continues to grow.”
Uber Computer System Breached
The New York Times (9/15, Conger, Roose) reports Uber discovered its computer network “had been breached on Thursday,” including “many of Uber’s internal systems, and a person claiming responsibility for the hack sent images of email, cloud storage and code repositories to cybersecurity researchers and The New York Times.” The Washington Post (9/15) reports Uber’s computer systems were breached “and the company has alerted authorities, the ride-hailing giant said Thursday.” In a tweet, the company said that it was “responding to a cybersecurity incident.” Internal screenshots obtained “by The Washington Post showed the hacker claiming to have wide-ranging access insider Uber’s corporate networks and appeared to indicate the hacker was motivated by the company’s treatment of its drivers.”
Uber Cites Hacker Group Lapsus$ As Responsible For Cybersecurity Incident
Reuters (9/19, Balu) reports Uber on Monday linked a “hacker affiliated with the Lapsus$ hacking group [as] responsible for its cyber attack last week which forced the ride-hailing company to shut several internal communications temporarily.” The company “said it was in close coordination with the FBI and the U.S. Department of Justice on the matter.” CNN