Subject: Photo of Woody Harrelson helps facial-recognition system catch beer thief
Source: Tribune Media Wire via WPMT FOX43
https://fox43.com/2019/05/17/
Source: Tribune Media Wire via WPMT FOX43
https://fox43.com/2019/05/17/
Clever police work—or an abuse of technology?
When a suspect who looked a lot like a long-haired Woody Harrelson was caught on camera stealing beer from a CVS and the NYPD’s facial-recognition system didn’t provide any matches, a detective used a photo of the actor, according to a report from Georgetown University’s Center on Privacy and Technology.
The study says that instead of the pixelated security footage of the suspect, the detective used a high-quality photo of Harrelson with long hair from 2012’s Hunger Games, and found 11 matches, including a man who was eventually arrested for the crime, the AP reports.
The report says detectives also used a photo of New York Knick JR Smith to search for a man wanted for a Brooklyn assault.
The Georgetown University report—titled “Garbage In, Garbage Out”—is highly critical of the practice of using celebrity photos to find lookalike suspects, as well as the use of artist’s sketches in facial recognition systems, the New York Post reports.
Subject: San Francisco Bans Facial Recognition Technology
Source: The New York Times
https://www.nytimes.com/2019/
SAN FRANCISCO — San Francisco, long at the heart of the technology revolution, took a stand against potential abuse on Tuesday by banning the use of facial recognition software by the police and other agencies.
Source: The New York Times
https://www.nytimes.com/2019/
SAN FRANCISCO — San Francisco, long at the heart of the technology revolution, took a stand against potential abuse on Tuesday by banning the use of facial recognition software by the police and other agencies.
The action, which came in an 8-to-1 vote by the Board of Supervisors, makes San Francisco the first major American city to block a tool that many police forces are turning to in the search for both small-time criminal suspects and perpetrators of mass carnage.
The authorities used the technology to help identify the suspect in the mass shooting at an Annapolis, Md., newspaper last June. But civil liberty groups have expressed unease about the technology’s potential abuse by government amid fears that it may shove the United States in the direction of an overly oppressive surveillance state.
[Facial recognition technology has stoked controversy over the years. Here’s a look back.]
Aaron Peskin, the city supervisor who sponsored the bill, said that it sent a particularly strong message to the nation, coming from a city transformed by tech.
But critics said that rather than focusing on bans, the city should find ways to craft regulations that acknowledge the usefulness of face recognition. “It is ridiculous to deny the value of this technology in securing airports and border installations,” said Jonathan Turley, a constitutional law expert at George Washington University. “It is hard to deny that there is a public safety value to this technology.”
But there is a broader concern. “When you have the ability to track people in physical space, in effect everybody becomes subject to the surveillance of the government,” said Marc Rotenberg, the group’s executive director.
American civil liberties advocates warn that the ability of facial surveillance to identify people at a distance, or online, without their knowledge or consent presents unique risks — threatening Americans’ ability to freely attend political protests or simply go about their business anonymously in public. Last year, Bradford L. Smith, the president of Microsoft, warned that the technology was too risky for companies to police on their own and asked Congress to oversee its use.
…
[I only saw one reference to WRONG and none to FALSE /pmw1]
Subject: Ari Mahairas and Peter Beshar on AI and 5G security risks
Source: Business Insider
https://www.businessinsider.
Source: Business Insider
https://www.businessinsider.
- AI and 5G will lead to an explosion in cybersecurity risks, according to an FBI agent and the general counsel of $50 billion professional services firm Marsh & McLennan.
- Ari Mahairas and Peter Beshar have built a relationship educating the public sector and industry about the risks of cyber attacks, as well as solutions to the threat.
- New tech will make it easier for bad actors to attack things like internet-connected devices, potentially leading to catastrophic attacks on nuclear power plants, they said.
- The pair also discussed protecting 5G networks and the growing demand for privacy regulation in Silicon Valley.
“We’re engaged in a race without a finish line,” Beshar says of the threat. “Cyber is a unique threat that poses a threat to both government and industry both sectors have been breached repeatedly. Neither one of us is immune.”
The pair also discussed protecting 5G networks, in the context of concerns over Chinese tech giant Huawei contributing to infrastructure, and the growing demand for privacy regulation in Silicon Valley.
Subject: Prince Harry beat paparazzi using GDPR law, new royal weapon vs. media
Source: Business Insider
https://www.businessinsider.
Source: Business Insider
https://www.businessinsider.
- Prince Harry won a legal dispute with Splash News, a photo agency which used a helicopter to take pictures inside his home.
- As well as arguing that they invaded his privacy, the Duke of Sussex also based his case on the photographers having mishandled his personal data under Europe’s new GDPR law.
- This is an unexpected application of data law, which is more commonly thought of as governing large online databases and spammy mailing lists.
- It opens a new avenue in the royal family’s never-ending struggle to keep parts of their lives out of the public eye.
Subject: Airbnb scam hits some users, charges them for fake reservations
Source: USA Today
https://www.usatoday.com/
Source: USA Today
https://www.usatoday.com/
Airbnb users may want to check their accounts even if they aren’t planning a trip anytime soon – some fellow customers on the rental site have been scammed with reservations they didn’t make.
Account holders have been charged for non-refundable reservations at fake destination homes and in some cases, users report that money was taken from their bank and Paypal accounts.
Airbnb confirms that there have been some occurrences, but said in a statement sent to USA TODAY that “these are isolated incidents and at no point was the Airbnb platform compromised. We have robust systems in place to protect users’ accounts and our team of trust and safety experts work hard to constantly strengthen our defenses.”
Airbnb has resolved a case in which UK-based communications professional Alice Chautard had three non-refundable reservations made in Kiev, Ukraine on her account Saturday and then the hacker cancelled the reservations, and deleted the account that charged her “all within 2 minutes,” she posted on Twitter.
“I travel internationally a lot as a speaker and have loved Airbnb in the past,” she said. But “after this, I’m done with Airbnb not because I was hacked but because it was so difficult to get in touch with anyone, the response I got was subpar and there was no ownership of the issue. I had a credit card on my profile but what about all of the people who have their debit cards linked? Their cash is gone.”
Subject: Age of fraud: Are seniors more vulnerable to financial scams?
Source: Marketplace via WHYY
https://whyy.org/articles/age-
Source: Marketplace via WHYY
https://whyy.org/articles/age-
Not only are older people heavily targeted by scammers, but surprising data suggest that, as we get older, we become more vulnerable to fraud in so many of its forms.
The part that especially floored me is this: Doctors are studying older people who are on the ball, A-OK. People who — when tested — seem to have no diagnosable cognitive impairment, but who may still be at special risk from those who want to take their money, be it strangers or family.
There is brain research about this. In some cases, it’s like a person’s radar for scams goes dark.
Lachs and his colleagues have put a label on what they see as an all-too common condition: “age-associated financial vulnerability.”
“We are learning that there are changes in the aging brain, even in the absence of diseases like Alzheimer’s disease or other neurodegenerative illnesses, that may render older adults vulnerable to financial exploitation.”
In an award-winning paper published by the Brookings Institution, researchers identified a peak age for handling money matters: on average, 53 years old. That astonishing number personally gave me pause now that I am past that summit and, according to that finding, hiking the downward slope myself.
Lawyer and elder rights advocate Marie-Therese Connolly is working on a book about elder abuse to be called “Aging Dangerously”, and worked closely on the drafting and passage, in 2010, of the Elder Justice Act.
A new federal law, the 2017 Elder Abuse Prevention and Prosecution Act, appointed what are called “elder justice coordinators” at U.S. Justice Department offices around the country.
In Florida, a new legal tool makes it much easier for the state’s vulnerable older victims to file paperwork — in the absence of an attorney — to quickly freeze their scammed money without notifying the scammer, a kind of “pause button.”
Subject: DHS warns of ‘strong concerns’ that Chinese-made drones are stealing data
Source: CNNPolitics
https://www.cnn.com/2019/05/
Source: CNNPolitics
https://www.cnn.com/2019/05/
Washington (CNN)Chinese-made drones may be sending sensitive flight data to their manufacturers in China, where it can be accessed by the government there, the US Department of Homeland Security warned in an alert issued Monday obtained by CNN.
The drones are a “potential risk to an organization’s information,” the alert from DHS’s Cybersecurity and Infrastructure Security Agency states. The products “contain components that can compromise your data and share your information on a server accessed beyond the company itself.”
Subject: Concern Growing Over ‘Nefarious’ Website Offering Individuals’ Personal Information, Reputation Rating
Source: KDKA via CBS Pittsburgh
https://pittsburgh.cbslocal.
Source: KDKA via CBS Pittsburgh
https://pittsburgh.cbslocal.
PITTSBURGH (KDKA) — Ever Googled yourself?
Were you surprised by what you found?
There are all kinds of websites that try to profit from your personal information.
But there is growing concern over one in particular called MyLife.com.
The California-based website sets itself apart by offering many of those details for free, as well as rating people’s reputations.
In this case, it’s a reputation that you have no say in building. Rather, it’s an arbitrary score assigned to you by the website.
MyLife feeds off the idea that reputation matters.
So how do you remove your profile from MyLife?
Click here for a complete in-depth step-by-step tutorial.
[also other aggregators /pmw1]
KDKA reached out to MyLife for comment, but so far we have not received a response.
NB some more info
https://dfw.cbslocal.com/2019/
https://dfw.cbslocal.com/2019/
Subject: Finland is winning the war on fake news. Other nations want the blueprint
Source: CNN Special Reporthttps://www.cnn.com/
Source: CNN Special Reporthttps://www.cnn.com/
Helsinki, Finland (CNN) – On a recent afternoon in Helsinki, a group of students gathered to hear a lecture on a subject that is far from a staple in most community college curriculums.
Standing in front of the classroom at Espoo Adult Education Centre, Jussi Toivanen worked his way through his PowerPoint presentation. A slide titled “Have you been hit by the Russian troll army?” included a checklist of methods used to deceive readers on social media: image and video manipulations, half-truths, intimidation and false profiles.
…
The course is part of an anti-fake news initiative launched by Finland’s government in 2014 – two years before Russia meddled in the US elections – aimed at teaching residents, students, journalists and politicians how to counter false information designed to sow division.
…
The initiative is just one layer of a multi-pronged, cross-sector approach the country is taking to prepare citizens of all ages for the complex digital landscape of today – and tomorrow. The Nordic country, which shares an 832-mile border with Russia, is acutely aware of what’s at stake if it doesn’t.
…
As the trolling ramped up in 2015, President Sauli Niinisto called on every Finn to take responsibility for the fight against false information. A year later, Finland brought in American experts to advise officials on how to recognize fake news, understand why it goes viral and develop strategies to fight it. The education system was also reformed to emphasize critical thinking.
Subject: Comcast building Amazon Echo-like device, with focus on health care
Source: CNBC via Philadelphia Business Journal
https://www.bizjournals.com/
Source: CNBC via Philadelphia Business Journal
https://www.bizjournals.com/
Instead of being able to ask for the definition of a word, to control a smart device or to set reminders, the device will work as a kind of guardian monitoring users’ activities. The report said it would be marketed to people who may need more health assistance, like people with disabilities or senior citizens. Sensors would be able to tell if users are taking more bathroom trips, for example, or sleeping more than normal. Fall detection and emergency phone calls are also planned features, and it will include a personality-like interface like Alexa.
Like many tech-focused corporations, Comcast has shown an increased interest in the health care space, most recently with a joint venture with Independence Health Group. Named Quil, the digital health partnership has built a cloud-based platformaimed at providing both patients and caregivers with personalized content and information related to their individual health care needs. Pilots are set to begin later this year.
The Hill
May 29,
2019
A
bipartisan group of House members from New York are raising concerns about
Chinese involvement in building New York City subway cars, zeroing in on the
potential that the new train cars could be hacked or controlled remotely. The
group of 15 lawmakers, led by Reps. Kathleen Rice (D-N.Y.) and John Katko
(R-N.Y.), wrote a letter to the New York City Transit Authority and the
Metropolitan Transit Authority (MTA) recently to “raise concerns regarding the
safety and security” of New York City’s transit system following MTA’s decision
to allow a Chinese-owned company to design new rail cars for the city. “As you
may be aware, critical infrastructure systems around the country have been
increasingly targeted in recent years as part of coordinated hacking attempts
and other forms of systematic interference, often stemming directly from
foreign governments,” the lawmakers wrote.
ADMINISTRATION
E&E
News
May 31,
2019
A blue icon
with a cannon in the center is floating on Rita Foster's computer screen at the
Department of Energy's technology lab in the Idaho desert. The icon looks like
a piece from the board game Stratego, and it stands for the malicious strain of
Russian malware called CrashOverride that blacked out parts of Kiev, Ukraine,
in 2016. More icons on Foster's screen represent other elements of
CrashOverride, including a description of tactics used by the hacker group
behind the blackout in Eastern Europe. For a utility operator in the United
States, accessing the information behind the icon could be the difference
between suffering a major breach at the hands of a sophisticated hacking group
and stopping the hackers cold. This is no board game, Foster explained, but
rather a first-of-its-kind program that allows utility operators to display and
analyze threats on their computer screens. It emerged from a $33 million,
five-year research project that teamed DOE national laboratories and private cybersecurity
firms with California's three largest investor-owned utilities, Pacific Gas and
Electric Co., Southern California Edison Co., and San Diego Gas & Electric
Co. Through the project, called California Energy Systems for the 21st Century,
or CES-21, utilities can access the growing body of cybersecurity knowledge
amassed during investigations of specific hacking campaigns.
CyberScoop
May 30,
2019
In the wake
of the Baltimore ransomware attack, a senior adviser at the National Security
Agency said Thursday there is no “indefensible” nation-state-built tool that is
responsible for the spread of ransomware and network administrators have a
responsibility to patch their systems, especially when patches have been
released for critical flaws. The comments come after The New York Times
reported this past week that RobbinHood, the ransomware strain behind the
Baltimore ransomware attack, was able to spread on the city IT infrastructure
partly due to its use of a leaked NSA tool known as EternalBlue. The Times
report, which cites security experts briefed on the matter, states EternalBlue
was discovered as incident response teams fixed the issues that had crippled a
number of the city’s online services. “The characterization that there is an
indefensible nation-state tool propagating ransomware is simply untrue,” Rob
Joyce, a senior adviser at the NSA, said Thursday according to prepared remarks
obtained by CyberScoop. “That is not true.”
Nextgov
Thousands
of devices from Huawei, ZTE and other foreign makers that were explicitly
banned in the National Defense Authorization Act for fiscal 2019 are still
operating in government networks, according to new data from the security firm
Forescout. The company recently counted 2,712 Huawei and 1,374 ZTE devices
currently deployed in the public sector from local, state and federal
government clients who opted to share their data. But the NDAA’s Aug. 13
deadline to have those devices removed from federal networks is approaching.
“The bottom line is that they are not allowed to have these manufacturers on
their networks so they’ll have to get on track to do that by the
deadline,” Katherine Gronberg, Forescout’s vice president of government
affairs, told Nextgov. She said Forescout manages millions of federal devices
and the number of those prohibited but still being used by the government are
only in the thousands.
The
Baltimore Sun
May 30,
2019
Baltimore’s
information technology office issued a detailed warning that the city was using
computer systems that were out of date, highly vulnerable to attack and not
backed up, calling them “a natural target for hackers and a path for more
attacks in the system.” The warning, in an undated risk assessment obtained by
The Baltimore Sun, foreshadowed the attack this month that brought down the city’s
network. It specifically highlights the danger posed by ransomware, saying
“extortionists are an increasing threat to any internet-connected systems.”
Senior city IT officials had said publicly in recent months that the city’s
security systems were out of date — they also were struck by ransomware in
2018. But the risk assessment report lays out a specific vulnerability in
greater detail. “If and when the systems are materially compromised, it is no
doubt that addressing the fallout from the compromise would be a drain on an
already tight budget,” the IT office wrote in the risk assessment.
CyberScoop
May 30,
2019
Gen. Paul
Nakasone, head of U.S. Cyber Command, has selected the organization’s chief of
staff as his top deputy, a decision that coincides with an ongoing effort to
fortify digital readiness before the next election. Rear Adm. Ross Myers, who
began his role as the command’s chief of staff last May, was confirmed by the
Senate last week and is now a Vice Admiral and a three-star Deputy Commander.
Nakasone, who is both the commander of Cyber Command and the Director of the
National Security Agency, promoted Myers on Memorial Day. Myers has previously
served as director of plans and policy at Cyber Command. He also served in
several roles for the Joint Chiefs of Staff, including as assistant deputy
director for Global Operations and executive assistant to vice chairman of the
Joint Chiefs of Staff. He also is a career naval aviator. The number two
position has been open since earlier this year, when Lt. Gen. Vincent Stewart
retired. Army Maj. Gen. John Morrison, who has been serving as the commander of
Fort Gordon and the Army’s Cyber Center of Excellence, will be taking on Myers’
previous position as the command’s chief of staff.
CBS
Philly 3
May 30,
2019
Officials
are battling a possible cyber attack on Philadelphia’s judicial website. In
addition to creating headaches for employees, it’s causing some delays and
confusion for those who access the courts. “We’ve been told there’s no end in
sight as of right now,” criminal defense attorney Brian Fishman said. There is
anxiety and agitation as a cyber shutdown hits its second week for
Philadelphia’s courts. Last Thursday, officials with the First Judicial
District announced that a computer virus forced them to take the courts’
website, electronic filing system and employee emails offline. Courtrooms,
offices and most phone lines continue to operate, but the digital dilemma has
certainly slowed down the wheels of justice.
FCW
The U.S.
strategy of penalizing norm-busting behavior in cyberspace centers around
attribution of individuals and the nations sponsoring attacks. This approach
raises concerns that foreign governments will retaliate by outing U.S.
intelligence and cyber operators and generates skepticism that the culprits
will ever see the inside of a U.S. courtroom. Officials often talk about
attribution as the necessary first step on the road to deterring malicious
foreign cyber activity. "Investigations and intelligence … are a step
toward identifying who is responsible and holding them accountable. That could
be through indictments, but it also informs a whole host of whole-of-government
actions: sanctions, diplomatic actions, maybe military or other operational
activity," said Tonya Ugoretz, deputy assistant director of the FBI's
Cyber Division, at a May 29 Aspen Institute event. "I think you see
international partners, like-minded countries coalescing around this approach,
and we can't have those norms or means of deterrence if we don't have that
underlying attribution," Ugoretz said.
Ars
Technica
May 29,
2019
Huawei is
asking a federal judge in Texas to strike down federal legislation passed last
year that banned Huawei—by name—from selling telecommunications equipment to
the federal government. Huawei argues that the legislation violates the
Constitution's rule against bills of attainder, laws that single out particular
people for punishment. Congress passed the most recent National Defense
Authorization Act last August; Huawei launched its legal challenge against the
law in March. The company filed a motion for summary judgment in the case on
Tuesday. This is a motion that asks the judge to rule on the legal merits in
the case prior to the discovery phase, when the two parties get to demand
documents from one another to help them build their cases. Huawei hopes to
avoid discovery because it could drag on for many months while Huawei is frozen
out of competing for federal telecommunications business. The ban passed last
year empowers the Secretary of Defense to ban companies from supplying
equipment to the federal government—or contractors using federal funds—if he
determines they have ties to the Chinese government. Companies put on this list
have an opportunity to appeal the decision to the courts.
CyberScoop
The risk
posed by foreign-made virtual private network (VPN) applications must be
accounted for — even if government device users have avoided such apps —
because adversaries are interested in exploiting the software, according to a
senior Department of Homeland Security official. “Open-source reporting
indicates nation-state actors have demonstrated intent and capability to
leverage VPN services and vulnerable users for malicious purposes,” Chris
Krebs, director of DHS’s Cybersecurity and Infrastructure Security Agency
(CISA), wrote in a May 22 letter to Sen. Ron Wyden, D-Ore., obtained by
CyberScoop. There is no overarching U.S. policy preventing government mobile
device users from downloading foreign VPN apps, according to Krebs. “Even with
the implementation of technical solutions, if a U.S. government employee
downloaded a foreign VPN application originating from an adversary nation,
foreign exploitation of that data would be somewhat or highly likely,” Krebs
wrote. “This exploitation could lead to loss of data integrity and
confidentiality of communications transmitted over the application.” Exposed
phone data would likely include geolocation, contacts, and user history, he
added.
The New
York Times
For nearly
three weeks, Baltimore has struggled with a cyberattack by digital
extortionists that has frozen thousands of computers, shut down email and
disrupted real estate sales, water bills, health alerts and many other services.
But here is what frustrated city employees and residents do not know: A key
component of the malware that cybercriminals used in the attack was developed
at taxpayer expense a short drive down the Baltimore-Washington Parkway at the
National Security Agency, according to security experts briefed on the case.
Since 2017, when the N.S.A. lost control of the tool, EternalBlue, it has been
picked up by state hackers in North Korea, Russia and, more recently, China, to
cut a path of destruction around the world, leaving billions of dollars in
damage. But over the past year, the cyberweapon has boomeranged back and is now
showing up in the N.S.A.’s own backyard.
INDUSTRY
Gov Info
Security
May 31,
2019
Checkers
Drive-In Restaurants, which also runs Rally's, says 102 of its 900 U.S.
locations were hit with point-of-sale malware, with one California restaurant
infected over a more than two-year period starting in December 2015. Checkers,
which was acquired by private equity firm Oak Hill Capital Partners in 2017,
says it "recently" became aware of the malware and is taking steps to
remove it. "After discovering the issue, we quickly engaged leading data
security experts to conduct an extensive investigation and coordinated with
affected restaurants and federal law enforcement authorities to address the
matter," according to a statement from Adam Noyes, who is chief
administrative officer and executive vice president of Checkers. Retailers,
restaurant chains and hotels have been frequent victims of POS malware, which
seeks to collect card details during payment processing. POS systems are
attractive targets due to the large volumes of card data that are processed.
Wired
May 31,
2019
Two weeks
have passed since Microsoft warned users about a critical vulnerability in a
common Windows protocol that could enable a hacker to remotely take over
machines without even a click from their owners, potentially allowing an
infectious worm to rip through millions of PCs. That bug might be fading from
the headlines, but it still lingers in at least 900,000 computers. And that
vulnerable herd is getting Microsoft's patch at a glacial pace—as a wave of
contagion that will likely soon hit all of them looms. BlueKeep, as the bug has
come to be known, is a hackable vulnerability in Microsoft’s Remote Desktop
Protocol, or RDP, that affects Windows 7 and earlier as well as older versions
of Windows Server. The insecure code was spotted and reported by the UK's
National Cybersecurity Center, and Microsoft released a patch on May 14.
BlueKeep is so serious—rating 9.8 out of 10 in severity, according to
Microsoft—that the company even pushed out a rare patch for Windows XP, which
it doesn't otherwise support. Microsoft's director of security incident
response compared the potential fallout to WannaCry, the North Korean
ransomware worm that caused up to $8 billion in damage when it rampaged across
the internet in 2017.
Gov Info
Security
May 30,
2019
A security
researcher has found a significant flaw in all versions of Docker, an open
source container platform, that can give attackers read and write access to all
the files within the host system, allowing them to execute arbitrary code. As
of now, there's no fix for this particular vulnerability, which has been given
the designation of CVE-2018-15664, and some proof-of-concept attacks have
already been spotted, Aleksa Sarai, a senior software engineer with SUSE Linux
GmbH who spotted the flaw, writes in a Tuesday blog. Still, the Docker
community decided to allow Sarai to publish his finding this week while a patch
is being developed. Containers, which have grown in popularity with developers
over the last several years, are a standardized way to package application
code, configurations and dependencies into what's known as an object, according
to Amazon Web Services.
CyberScoop
May 30,
2019
New York
venture capital and private equity firm Insight Partners has acquired a
controlling stake in threat intelligence company Recorded Future for $780
million. The cash deal, announced Tuesday, is the highest sale price ever for a
firm that provides clients with threat intelligence about the digital risks
they need to mitigate. Recorded Future now works with more than 400 clients,
including Bank of America, Target and SC Johnson. The firm previously raised
$57.9 million from sources including Insight, and it says this deal will
accelerate its growth. “This partnership lays the foundation to take our products
and software to the next level to best serve our clients, changing the face of
our industry as we drive an intelligence-led strategy to help reduce risk and
enable business operations for clients around the globe,” Christopher Ahlberg,
CEO and co-founder of Recorded Future, said in the announcement.
Gov Info Security
May 30,
2019
News
aggregator Flipboard has initiated a systemwide password reset affecting as
many as 150 million users following two database intrusions. The company says
it is taking the password reset precaution "even though the passwords were
cryptographically protected and not all users' account information was
involved." Flipboard engineers discovered the situation on April 23.
Flipboard says one intrusion occurred between June 2, 2018, and March 23, 2019,
and another over a shorter period, between April 21 and 22 this year. An
unauthorized person "accessed and potentially obtained copies of certain
databases containing Flipboard user information," the firm says, noting it
has notified law enforcement. "In response to this discovery, we
immediately launched an investigation and an external security firm was engaged
to assist," Flipboard says in an advisory. The data exposed included
usernames and passwords that were hashed and salted. For some users, email
addresses and tokens used to connect their Flipboard accounts to third-party
applications also were exposed. Those tokens have now been invalidated,
Flipboard says.
Ars Technica
May 29,
2019
Hackers
have been actively exploiting a recently patched vulnerability in some websites
that causes the sites to redirect to malicious sites or display misleading popups,
security researchers warned on Wednesday. The vulnerability was fixed two weeks
ago in WP Live Chat Support, a plugin for the WordPress content management
system that has 50,000 active installations. The persistent cross-site
scripting vulnerability allows attackers to inject malicious JavaScript into
sites that use the plugin, which provides an interface for visitors to have
live chats with site representatives. Researchers from security firm Zscaler's
ThreatLabZ say attackers are exploiting the vulnerability to cause sites using
unpatched versions of WP Live Chat Support to redirect to malicious sites or to
display unwanted popups. While the attacks aren't widespread, there have been
enough of them to raise concern. "Cybercriminals actively look for new
vulnerabilities in popular content management systems such as WordPress and
Drupal, as well as popular plugins that are found in many websites,"
Zscaler's Prakhar Shrotriya wrote in a post. "An unpatched vulnerability
in either the CMS or associated plugins provides an entry point for attackers
to compromise the website by injecting malicious code and impacting the
unsuspecting users visiting these sites."
INTERNATIONAL
The Hill
May 31, 2019
Secretary
of State Mike Pompeo reportedly warned German authorities on Friday that the
U.S. could withhold some information related to national security if the
country adopts 5G wireless networks run by Chinese firm Huawei. Pompeo told
reporters after a meeting with Germany's foreign minister that it was "not
possible" to mitigate the risk that the Chinese government would be able
to obtain data in Huawei's networks, Reuters reported. “They [Germany] will
take their own sovereign decisions, [but we] will speak to them openly about
the risks ... and in the case of Huawei the concern is it is not possible to
mitigate those anywhere inside of a 5G network,” Pompeo said. The Trump
administration has actively urged European nations against adopting Huawei
technology in recent months, amid worries about security. The U.S. intelligence
community says the company's technology and data could be accessed by the
Chinese government, claims Huawei denies.
The Hill
May 31, 2019
China is
set to establish an “unreliable entity list” of foreign companies and
individuals that “seriously damage” Chinese enterprises, a spokesperson for
China’s Commerce Ministry announced Friday. The move is seen as retaliation
against efforts by the Trump administration to block Chinese telecom company
Huawei from doing business in the U.S. “Foreign enterprises, organizations or
individuals that fail to comply with market rules, deviate from the spirit of
the contract, and impost a blockade or confiscation of Chinese enterprises for
non-commercial purposes, which seriously damage the legitimate rights and
interests of Chinese enterprises, will be included in the list of ‘unreliable
entities,'" the spokesperson said, adding that “specific measures will be
announced in the near future.” President Trump signed an executive order
earlier this month that allows his administration to block foreign tech
companies from doing business in the U.S. if they are deemed a national
security threat. Shortly after, the U.S. Department of Commerce added Huawei to
its “entity list,” effectively banning the company from buying components from
American companies without government approval.
CyberScoop
May 30, 2019
A proposal
from a British spy agency to allow law enforcement access to encrypted
communications in certain cases “poses serious threats to cybersecurity and
fundamental human rights including privacy and free expression,” a group of
security researchers, civil liberties groups, and tech giants like Apple,
Google, and Microsoft, have warned. In an open letter to GCHQ, the United
Kingdom’s signals intelligence agency, the coalition of tech organizations
rejected the agency’s suggestion that adding a law enforcement official to a
group chat or call would not threaten civil liberties or the security of
encrypted messaging services. If implemented, the GCHQ proposal would
“undermine the authentication process that enables users to verify that they
are communicating with the right people, introduce potential unintentional
vulnerabilities, and increase risks that communications systems could be abused
or misused,” states the letter, which was made public this week. Other
signatories include Human Rights Watch, Reporters Without Borders, the Tor
Project, and WhatsApp.
BBC
May 30,
2019
New
Zealand's Treasury has admitted that details of its budget - leaked earlier
this week - were not stolen by hackers but accidentally made available through
its website. The government called in police after parts of its budget were
released two days early by the opposition National Party. Treasury Secretary
Gabriel Makhlouf said it had been "deliberately hacked". But on
Thursday he admitted police had found no evidence of illegal activity. "On
the available information, an unknown person or persons appear to have
exploited a feature in the website search tool, but ... this does not appear to
be unlawful," Mr Makhlouf said in a statement. He said the Treasury had
prepared a "clone" website ahead of the budget's release on Thursday.
While the cloned site was never online, part of the information was accidentally
indexed on the live website. As a result, typing in key search-terms revealed
the embargoed budget details.
Defense One
May 29,
2019
For the first time, Russia has granted its highest security rating to a
domestically developed operating system, deeming Astra Linux suitable for
communications of “special importance” across the military and the rest of the
government. The designation clears the way for Russian intelligence and
military workers who had been using Microsoft products on office computers to
use Astra Linux instead. “There is hope that the domestic OS [operating system]
will be able to replace the Microsoft product. Of course, this is good news for
the Russian market,” said German Klimenko, former IT advisor to Russian
President Vladimir Putin and chairman of the board of Russia’s Digital Economy
Development Fund, a venture capital fund run by the government. Klimenko spoke
to the Russian newspaper Izvestia on Friday. Although Russian officials used
Windows for secure communications, they heavily modified the software and
subjected Windows-equipped PCs to lengthy and rigorous security checks before
putting the computers in use. The testing and analysis was to satisfy concerns
that vulnerabilities in Microsoft operating systems could be patched to prevent
hacking from countries like the United States. Such evaluations could take
three years, according to the newspaper.
Gov Info Security
May 29,
2019
The United
Kingdom has seen the number of data breach notifications more than quadruple
since Europe's tough new privacy law went into full force. The EU's General
Data Protection Regulation went into full effect on May 25, 2018. For the first
time, it began requiring all organizations that suffer a data breach that put
Europeans' personal data at risk to notify relevant authorities. The
Information Commissioner's Office, which enforces GDPR in the U.K., says that
from May 25, 2018, until the beginning of this month, it received 14,072 data
breach reports, compared to receiving just 3,311 from April 2017 through April
2018. The increase in data breach notification is a result of mandatory
reporting driving better visibility, security experts say. Before last May,
most organizations faced no legal obligation to publicly disclose a data
breach. Now, however, they do, which means that more data breach discoveries
have been coming to light.
The Guardian
May 28,
2019
People
accessing the internet at McDonald’s and Westfield in Australia could be
targeted for surveillance by police under new encryption legislation, according
to the home affairs department. A briefing by the department, obtained under
freedom of information, reveals that police can use new powers to compel a
broad range of companies including social media giants, device manufacturers,
telcos, retailers and providers of free wifi to provide information on users.
The Telecommunications Access and Assistance Act, which passed parliament in
December, prompted warnings of legislative overreach, particularly due to the
large number of offences with a prison sentence of three years, which bring
suspects within reach of the new powers. Despite warnings from the tech sector
it would harm Australian companies and a promise from Labor to amend the law,
the re-election of the Morrison government means it will continue in its
current form – at least for this term of parliament.
TECHNOLOGY
Ars Technica
May 30,
2019
Researchers
say they’ve discovered an advanced piece of Linux malware that has escaped
detection by antivirus products and appears to be actively used in targeted
attacks. HiddenWasp, as the malware has been dubbed, is a fully developed suite
of malware that includes a trojan, rootkit, and initial deployment script,
researchers at security firm Intezer reported on Wednesday. At the time
Intezer’s post went live, the VirusTotal malware service indicated Hidden Wasp
wasn’t detected by any of the 59 antivirus engines it tracks, although some
have now begun to flag it. Time stamps in one of the 10 files Intezer analyzed
indicated it was created last month. The command and control server that
infected computers report to remained operational at the time this article was
being prepared.