ReportWire

Tag: Cybersecurity and Infrastructure Security Agency

  • Cyberattack impacts U.S. federal government, NATO allies. Here’s what we know about the breach so far.

    Cyberattack impacts U.S. federal government, NATO allies. Here’s what we know about the breach so far.

    [ad_1]

    Senior government officials are racing to limit the impact of what’s believed to be a global cyberattack affecting U.S. federal agencies and allies, including NATO member countries. 

    The Cybersecurity and Infrastructure Security Agency (CISA) confirmed in a statement Thursday that it was providing support to several federal agencies “that have experienced intrusions affecting their [file transfer] applications.”

    “We are working urgently to understand impacts and ensure timely remediation,” the statement continued.

    Anne Neuberger, deputy national security advisor for cyber and emerging technology for the National Security Council, told CBS News Thursday that the hackers “compromised a vulnerability in a widely used software” that companies worldwide use “to move large files.”

    “They’ve (the hackers) started releasing some of the data that was stolen as part of their work to extort these companies,” Neuberger said. “We strongly encourage anyone who was a user of the software to, of course, patch, lock down their systems.”

    One cybersecurity expert characterized the breach as one of the largest theft and extortion events in recent history. Victims include Johns Hopkins University, the University of Georgia, the BBC and British Airways.

    Cybersecurity experts say the hacking gang has been active since at least 2014 and is believed to operate from Russia with the tacit approval of Moscow’s intelligence services. CISA Director Jen Easterly identified the hackers as CLOP Ransomware.

    “They’re basically taking data and looking to extort it,” Easterly said. 

    Brett Callow, a cyber threat analyst with Emsisoft, told CBS News that there were 47 confirmed victims so far, “plus a number of as yet unidentified U.S. government agencies.” He added that CLOP claimed “hundreds of organizations have been impacted.” 

    Late Thursday afternoon, a senior CISA official declined to identify which government agencies had been affected, but noted that the Energy Department had issued a statement indicating it had reported an incident to CISA. The official also said that at this time, there is no indication that any of the military branches or the intelligence community were impacted. 

    “This is not a campaign like Solar Winds that presents a systemic risk to our national security or our nation’s networks,” the official said, referring to a hugely disruptive cyberattack in 2020 that was traced to Russian military hackers. 

    Further, no federal agencies have so far received extortion demands and no federal data has been leaked, the official said.

    Many organizations had already patched the vulnerability before the cyber actors were able to intrude, according to CISA.

    CLOP works by seizing sensitive data and holding it for ransom, threatening “after 7 days your data will start to be published.” It’s exploiting a vulnerability in a software program called MoveIt Transfer, which is widely used to transfer data. 

    A CISA analyst note described CLOP as a ransomware variant that uses a double extortion ransomware strategy. The cybercriminal gang steals the information before encrypting it and then demands a ransom to head off the leaking of that information on CLOP’s ransomware site.

    At this point, Easterly says the government is “focused specifically on the federal agencies that may be impacted” and is “working hand-in-hand with them to mitigate the risk.”

    “We understand there are businesses, though, around the world,” she added. 

    Researcher Bret Callow says victims also include banks and credit unions.

    The FBI and CISA warned last week that in late May, a ransomware gang began exploiting a vulnerability in a the file-sharing software MoveIt Transfer.

    The FBI declined to comment, but referred CBS News to the security advisory about MoveIt, which also encouraged private sector partners to implement recommended measures to protect themselves from the ransomware and to report any suspicious cyber activity to local FBI offices and CISA.

    — Nicole Sganga and Robert Legare contributed to this report.

    [ad_2]

    Source link

  • Ex-contractor’s computer in Russia breached D.C. Metrorail transit system, watchdog finds

    Ex-contractor’s computer in Russia breached D.C. Metrorail transit system, watchdog finds

    [ad_1]

    A former contractor for the Washington Metropolitan Area Transit Authority (WMATA) was able to remotely access sensitive WMATA data from a computer in Russia because his supervisor failed to revoke his high-level administrative access, a new watchdog memo says.

    A memo released Wednesday by the WMATA Office of Inspector General says the office opened a cyber investigation in early 2023 when it was alerted that WMATA’s cyber group had detected abnormal network activity originating in Russia in January. 

    The agency found that the credential of a contractor no longer working for the agency had been used in Russia to access a sensitive directory. The former contractor’s supervisor had allowed the man to retain his access to WMATA systems and networks in hopes that his contract would be renewed, the report said.

    “The computer in Russia was turned on at the direction of the former contractor who remotely accessed his computer in Russia,” the report said. “Since the former contractor’s high-level administrative access had not been revoked, he was able to remotely access his personal computer in Russia to log into WMATA systems containing critical and sensitive WMATA data.” 

    WMATA hired the former contractor through a U.S.-based company. The memo doesn’t say whether the individual is a Russian national, but it warned of the contractor’s access to sensitive data. It also noted that the contractor worked on the SmarTrip app, which is used by riders to pay for their fares.   

    The inspector general’s office also warned that Metro’s security failures leave the Metrorail system vulnerable to threats, since it carries about 262,000 people — including some of the world’s most powerful people — every day. 

    It raised concern about a contract signed by WMATA in 2020 for recruiting with a company whose staff operated outside the U.S. It was awarded without cybersecurity provisions or “an assessment of how WMATA’s sensitive data would be accessed or protected.” 

    The agency’s cybersecurity team prepared a memo outlining all of the risks the office would face in executing the contract, but was apparently overruled. The inspector general “continues to assess how these employees are connecting to WMATA data systems from outside the United States, as it does not appear they have ever been issued WMATA owned devices.” 

    And the inspector general also identified a “disconnect” between WMATA IT and cybersecurity staff that it says has endangered its cybersecurity.

    “The disconnect is so large that it has frustrated the cyber team, caused delays in implementation of important cybersecurity changes and threatens WMATA’s ability to protect its critical/sensitive data, networks, and assets,” according to the report. Some of the IT team belongs to a labor union, the report notes, which has declined to put into place some of the changes because of its collective bargaining agreement. 

    The inspector general has for years informed WMATA of its vulnerability to security threats and noted Metro failed to act on 51 cybersecurity-related recommendations from oversight agencies, some of which were issued as early as 2019. 

    The IG pointed out that the agency’s own internal audit and compliance group had recommended that all laptops used by WMATA have “full disk encryption installed” to protect critical and sensitive information.

    “To date this recommendation remains unimplemented and WMATA’s mobile devices are issued and deployed without encryption,” the report says.   

    “Given the current threat environment, the report stated that it can be assumed vulnerabilities do or will exist within WMATA’s systems,” the inspector general said. “These vulnerabilities, if left unaddressed and subsequently become exploited by a threat, could render WMATA susceptible to unacceptable outcomes.” 

    In a response to the inspector general, WMATA acknowledged it has room to grow, but defended its handling of cybersecurity, arguing that the inspector general’s report failed to recognize improvements the IT department has made. WMATA chief information officer Torri Martin and chief audit and risk officer Elizabeth Sullivan also said there was no “concrete indication” that the contents of the OneDrive were downloaded in Russia.

    Kathryn Watson


    kathryn-watson-220x140.png

    Kathryn Watson is a politics reporter for CBS News Digital based in Washington, D.C.

    [ad_2]

    Source link

  • Google supporting passkeys for password-free login

    Google supporting passkeys for password-free login

    [ad_1]

    Google is now offering users the option of using passkeys instead of passwords to sign in. 

    Starting Wednesday, account holders can use passkeys to login to their accounts with a fingerprint, a face scan or a screen lock PIN. Passkeys are safer than passwords, and they are resistant to phishing, Google said.

    “While passwords will be with us for some time to come, they are often frustrating to remember and put you at risk if they end up in the wrong hands,” the company said in a blog post. 

    Passkeys can only exist on specific devices. When someone signs in with a passkey, it proves to Google that the user has access to the device and is able to unlock it. 

    “Together, this means that passkeys protect you against phishing and any accidental mishandling that passwords are prone to, such as being reused or exposed in a data breach,” Google said.

    For now, passkeys are just an option. Users who set them up can still login with passwords. In some instances, they may need to use a password because not all devices support passkeys. 

    Google noted that when a passkey is created on a shared device, anyone with access to the device who has the ability to unlock it will be able to login to the connected Google account. 

    “While that might sound a bit alarming, most people will find it easier to control access to their devices rather than maintaining good security posture with passwords and having to be on constant lookout for phishing attempts,” Google said in a blog post. 

    Users will be able to use someone else’s device to temporarily access their Google accounts by selecting “use a passkey from another device.” It won’t transfer passkey ownership to the new device, and will just create a one-time sign-in.

    Currently, passkeys only work for personal Google accounts. Google Workspace administrators will soon have the option of enabling passkeys for users. 

    PayPal, Kayak and eBay are among the companies offering passkeys for login purposes. 

    Aliza Chasan

    Aliza Chasan is a digital producer at 60 Minutes and CBS News.

    [ad_2]

    Source link

  • Authorities in China question staff at U.S. consulting firm Bain & Company in Shanghai

    Authorities in China question staff at U.S. consulting firm Bain & Company in Shanghai

    [ad_1]

    Chinese authorities have questioned staff at Bain & Company’s Shanghai office, the U.S. consultancy giant said Thursday.

    “We can confirm that the Chinese authorities have questioned staff in our Shanghai office. We are cooperating as appropriate with the Chinese authorities. At this time, we have no further comment,” the company told CBS News in an emailed statement.

    The Financial Times, which first reported the news Wednesday, said that according to multiple sources, police made a surprise visit to the office two weeks ago. Phones and computers were taken away, but no one was detained, the newspaper said.

    Fog covering Shanghai, China at sunrise.
    A file photo shows the skyline of Shanghai, China, blanketed in thick fog as the sun rises.

    Getty/iStockphoto


    The news will likely fuel concern among U.S. companies operating in China that Beijing might take retaliatory action against them for Washington’s moves against Chinese firms.

    Last month, U.S. due diligence firm Mintz Group said Chinese police had arrested five of its local employees and shut down its Beijing office. Chinese authorities later said the company was being investigated for “illegal” activities. A few days later, China’s top cybersecurity regulator said it was investigating leading U.S. computer chip maker Micron Technology and would review its products over “national security concerns.”


    China sets 5% GDP growth target for 2023, plans to increase military spending

    03:45

    Tensions have escalated in recent months between Washington and Beijing. In February, the U.S. shot down an alleged Chinese spy balloon. Beijing insisted the object was a benign weather monitoring device.

    In March, the chief executive of social media giant TikTok, Shou Zi Chew, was grilled by U.S. lawmakers about the app’s data security and privacy practices amid concern in the U.S. that the company could share data with Chinese authorities. TikTok has insisted that it operates independently from China’s government, but there is a growing belief in Washington that the platform represents a national security threat.

    Just last week, meanwhile, FBI agents arrested two people who have been accused of operating an illegal Chinese police station in New York City. The U.S. Justice Department has called the operation a bid to influence and intimidate dissidents critical of the Chinese government in the U.S.

    As U.S.-China relations have soured, U.S. businesses operating in the country believe they have already suffered from the fallout.

    “There certainly is a chill in the air,” Michael Hart, who heads the American Chamber of Commerce in Beijing, told CBS News in March. “Companies feel like they’re squeezed out of certain industries, and so there is a question mark that many U.S. companies have about, you know, are we really welcome?”

    [ad_2]

    Source link

  • FBI office warns against using public phone charging stations at airports or malls, citing malware risk

    FBI office warns against using public phone charging stations at airports or malls, citing malware risk

    [ad_1]

    The FBI’s Denver office is warning the public against using public charging stations, such as ones you might see at an airport or the mall. 

    “Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices,” the FBI Denver office tweeted in a general alert. “Carry your own charger and USB cord and use an electrical outlet instead.”

    There was no specific incident that caused the public service announcement, FBI Denver told CBS News. Rather, it was meant as a field office warning.

    “Juice jacking” — a term coined in 2011 — remains a concern, according to the U.S. government. FCC officials warn malware installed through a corrupted USB port can lock a device or export personal data and passwords directly to a criminal. The sensitive information can then be used to access online accounts or be sold to other bad actors. In some cases, criminals may have intentionally left infected cables plugged in at charging stations. 

    “The scary part of juice jacking is that you probably won’t even be able to tell that your phone is infected with malware after plugging it into a compromised USB port,” Matt Swinder, editor-in-chief and founder of TheShortcut.com, told CBS News. 

    According to the 2022 USB Threat report by Honeywell Forge, threats designed to propagate over USB or specifically exploit USB for infection rose to 52% over four years. 

    “You’re much more likely to have your credit card skimmed than be juice jacked, based on the lack of hard evidence of widespread cases,” Swinder explained. “As rare as juice jacking is right now, the threats of identity theft have migrated from being purely physical to being primarily digital over the last decade.”

    While “juice jacking” may be still relatively uncommon, says technology journalist Dan Patterson, it’s also “a fairly easy and low-cost hack — especially in airports and other public locations.” 

    He offers simple advice to follow. “Never use a charger that isn’t yours or someone you know,” he said. 

    Experts who spoke to CBS News say there’s always the chance of unreported cases since some may not even be aware of the risks. 

    “The FBI is going to have access to intelligence and information that the public — even the broader cybersecurity public — will not have access to,” NetRise CEO Thomas Pace told CBS News. 

    Their ability to “monitor underground forums, get intelligence from informants and even intelligence from other agencies” provides the FBI with a better understanding into possible threats.

    It generally boils down to the age-old tradeoff between usability and security. 

    “People want [and] need USB ports in airports and restaurants and just general public spaces, Pace said. “So they are going to continue to exist.”

    He compared the charging stations and juice jacking to ATMs and ATM skimmers. 

    “Are ATM skimmers a problem? Do they exist?” Pace asked. “The answer to both of those questions is yes. Did we remove all ATMs because of it? No, we did not.”

    So what can be done? 

    Like the FBI, the FCC recommends that travelers avoid using a public USB charging station and they use a power outlet instead. Travelers should carry a portable charger or external battery. 

    Pace recommends visually inspecting the charger prior to plugging in. If it appears to have been tampered with in some way, don’t use it.

    He added that people can be careful by using a USB data blocker, a small dongle that adds a layer of protection between a device and the charging point — or as they’re unofficially known, “USB condoms.” He carries one around with him all the time. 

    “Pretty much guarantees you are good to go,” he added. 

    Michael Roppolo

    Michael Roppolo is a CBS News reporter. He covers a wide variety of topics, including science and technology, crime and justice, and disability rights.

    [ad_2]

    Source link

  • TikTok, facing scrutiny, launches

    TikTok, facing scrutiny, launches

    [ad_1]

    TikTok announced on Wednesday that it will be implementing a new security measure in Europe called “Project Clover,” which is intended to strengthen existing protections for user data — and perhaps address concerns in the face of political pressure. 

    The company says the new policies will be implemented throughout the remainder of the year, and into 2024.

    “Over 150 million people across Europe come to our platform every month to express themselves, learn new hobbies or skills and grow their business,” read a press release by TikTok’s vice president of government relations in Europe, Theo Bertram. “With such scale comes significant responsibility — building trust by ensuring the safety, privacy and security of our community and their data is critical.”

    Sen. Mark Warner Discusses Legislation To Allow Banning Of TikTok
    Senate Select Committee on Intelligence Chairman Mark Warner (D-VA) (L) is joined by Senate Minority Whip John Thune (R-SD) to introduce the Restrict Act at the U.S. Capitol on March 07, 2023 in Washington, DC. In reaction to software built in countries hostile to the United States, including TikTok, the new legislation would allow the Commerce Department to take action on suspected foreign spying risks in artificial intelligence, fintech, quantum computing and e-commerce.

    Chip Somodevilla / Getty Images


    According to the social media platform, “Project Clover” will enhance existing data security measures by implementing “security gateways that will determine employee access to European TikTok user data and data transfers outside of Europe.” The gateways will be overseen by a third-party security company in Europe, with more details on this independent verification system to be announced.

    The platform is placing a renewed emphasis on local data storage, opening two new data centers in Ireland and Norway, in addition to an existing data center in Ireland. The operational cost of the centers is over $1.2 billion each year.

    TikTok has been been facing increased scrutiny in the West over security concerns, as officials express mistrust about the platform and its Chinese parent company. The European Parliament, European Commission and the EU Council have all imposed bans on TikTok on staff devices; the app has also been banned on U.S. government devices.

    In the U.S., lawmakers are considering legislation that would ban the platform nationwide.

    C Mandler


    1630512655666.jpg

    C Mandler is a social media producer and trending topics writer for CBS News, focusing on American politics and LGBTQ+ issues.

    [ad_2]

    Source link

  • TikTok banned on U.S. government devices, and the U.S. is not alone. Here’s where the app is restricted.

    TikTok banned on U.S. government devices, and the U.S. is not alone. Here’s where the app is restricted.

    [ad_1]

    Hong Kong — The U.S. and Canada both issued orders this week banning the use of TikTok on government-issued mobile devices amid growing privacy and cybersecurity concerns about the Chinese-owned video-sharing app. TikTok, owned by the larger tech company Bytedance, has long maintained that it does not and will not share data with the Chinese government and that its data is not held in China.

    The company also disputes accusations that it collects more user data than other social media companies and insists that it’s run independently.
     
    But many countries remain cautious, and Shawn Henry, chief security officer for the cybersecurity company CrowdStrike, told “CBS Mornings” those concerns are “absolutely valid.”  


    CrowdStrike’s chief security officer on global cyber threat landscape

    06:36

    “China wants to be the No. 1 superpower in the world and they have been targeting U.S. technology, U.S. personal information. They’ve been doing electronic espionage for several decades now,” Henry said, describing the hugely popular app as “another opportunity for them [China] to gain access to people’s information, to see what people are thinking about, to potentially influence the way people think” through deliberate misinformation.

    Below is a look at the countries and regions that have implemented partial or total bans on TikTok so far:

    United States

    This week, the Biden administration gave all government agency staff 30 days to delete TikTok from federal devices and systems over data security concerns. The White House directive came after the U.S. Congress officially banned the app on all federal government devices in December.

    Despite the repeated assurances from TikTok executives that the company will not do so, U.S. Deputy Attorney General Lisa Monaco said the ruling Communist Party requires companies doing business in China to provide access to their data. 


    Congress weighs nationwide ban of TikTok

    05:44

    While the ban applies only to government devices, some U.S. lawmakers are pushing for an outright ban on the app. China lashed out at the U.S. over the ban on government devices, describing it as an abuse of state power and a suppression of foreign businesses.

    More than half of U.S. states also have also banned TikTok from their government devices.

    European Union

    The European Parliament, European Commission and the EU Council, three top EU bodies, have imposed bans on TikTok on staff devices. The European Parliament’s ban, announced Tuesday, takes effect on March 20. It has recommended lawmakers and staff remove the app from their personal devices.

    European legislators have also voiced increasing concern about the app’s data policies and its influence on young people, and as CBS News’ Emmet Lyons reported, Europe’s regulators may have more potent legal weapons at their disposal to challenge the company than some of their international counterparts.

    Wide-ranging EU data protection laws, stricter than anything on the books in the U.S., for instance, could pose increasing challenges for TikTok bosses on the continent. The app is already the subject of two investigations by Ireland’s data protection regulator over alleged transfers of user data to China that may breach the country’s laws, as well as possible violations of children’s privacy.

    The company may also come under a direct audit and face fines of up to 6% of the platform’s annual revenue under the EU’s new Digital Services Act, if it’s found to have failed to comply with that law.

    Canada

    After the U.S. announcement, Canada announced Monday that government-issued devices must not use TikTok, saying the app presents an “unacceptable” risk to privacy and security. 

    Employees will also be blocked from downloading the application in the future.

    India

    India imposed a ban on TikTok and dozens of other Chinese apps, including the messaging app WeChat, in 2020 over privacy and security concerns. The ban came shortly after a clash between Indian and Chinese troops at a disputed Himalayan border killed 20 Indian soldiers and injured dozens.

    As CBS News’ Arshad Zargar reported at the time, it was the first deadly border clash between the Asian giants in decades, but the tension had been simmering for months. India has a growing middle class and is expected to eclipse China this year as the most populous nation on Earth.
     
    The companies were given a chance to respond to questions about privacy and security requirements on the apps at the time, but the ban was made permanent in January 2021.

    Taiwan

    In December 2022, Taiwan imposed a public sector ban on TikTok after the FBI warned that TikTok posed a national security risk.

    Government devices, including cell phones, tablets and desktop computers, are not allowed to use Chinese-made software, which include apps like TikTok, its Chinese equivalent Douyin, or Xiaohongshu, a Chinese lifestyle content app.

    Taiwan is a tiny, democratically governed island that functions independently but sits just 110 miles across the Taiwan Strait from China. Beijing claims Taiwan as its own territory and has vowed to exert control over the island, by force if necessary.


    U.S. lawmakers visit Taiwan amid tensions with China

    06:51

    President Biden told “60 Minutes” late last year that Taiwan makes its “own judgments” about its independence and the U.S. wasn’t “encouraging… their being independent,” but he said he would use American military power to help defend the island if China were to launch “an unprecedented attack.”

    Pakistan

    Pakistani authorities have temporarily banned TikTok at least four times since October 2020, citing concerns that app promotes immoral content. 

    Afghanistan

    Afghanistan’s Taliban rulers banned TikTok and the Chinese game PUBG in 2022 on the grounds of protecting young people from “being misled,” but like its neighbor Pakistan the country made no reference to security concerns.

    [ad_2]

    Source link

  • TikTok vs. Europe: Could EU data privacy law slay the

    TikTok vs. Europe: Could EU data privacy law slay the

    [ad_1]

    London — The social media platform TikTok has been in American lawmakers’ crosshairs for months, and the sentiment is spreading across the Atlantic. European legislators are voicing increasing concern about the Chinese-owned app’s data policies and its influence on young people, and Europe’s regulators may have more potent legal weapons at their disposal to challenge the company.

    French President Emmanuel Macron has been the highest-profile European leader to criticize the social platform whose parent company ByteDance is based in China. At an event on mental health in December, Macron called TikTok “the most disruptive” social media outlet for young people, warning that it was “deceptively innocent” and addictive.

    “We remain vigilant in any situation that would lead to a compromise in the protection of our citizens’ data,” Jean-Noel Barrot, France’s Minister for Digital Transition and Telecommunications, told CBS News, adding that he meets “on a regular basis” with TikTok managers in France to discuss “data protection issues and content moderation and protection of minors.”

    German Member of the European Parliament Moritz Körner has been pushing EU regulators to get tough on TikTok for years.

    “From a geopolitical perspective, the EU’s inactivity towards TikTok has been naïve,” he told CBS News. “The data dragon TikTok must be placed under the surveillance of the European authorities.”


    ByteDance probe finds employees gained access to some of TikTok’s U.S. user data

    04:26

    Körner said the EU has been slow to implement oversight of the platform, arguing that Tiktok “poses several unacceptable risks” for users, including “data access by Chinese authorities, censorship and the tracking of journalists.”

    Maximilian Funke-Kaiser, a spokesman for Germany’s liberal FDP party, told CBS News that TikTok has been guilty of “systematic data misuse” and said that security concerns about the app are “justified.” 

    “To be clear: If you do business here and earn a lot of money with it, you must also comply with applicable law. Otherwise, there is no room for the company here,” he said. 

    Funke-Kaiser said steps taken by the U.S. government to ban the platform for employee use were something that should be replicated in Germany. 

    “I consider the ban on TikTok on working equipment of officials of the U.S. government to be appropriate in view of the data protection and security risks,” he said. 

    Responding to the concerns voiced by European officials, a TikTok spokesperson told CBS News in an email that the company had responded to the ban in the U.S. by putting together “a comprehensive package of measures with layers of government and independent oversight to ensure that there are no backdoors into TikTok that could be used to manipulate the platform.”

    “These measures go beyond what any peer company is doing today on security,” the TikTok spokesperson said. 

    Legal challenges

    While the United States has taken the step of banning TikTok on government devices in the name of national security, wide-ranging EU data protection laws already on the books could become an even bigger headache for TikTok executives.

    TikTok is currently the subject of two investigations by Ireland’s data protection regulator over transfers of user data to China that may breach the country’s laws, as well as possible violations of children’s privacy.


    Amid concerns about smartphone apps collecting data, how can users protect their privacy?

    06:56

    The company may also come under a direct audit and face fines of up to 6% of the platform’s annual revenue under the EU’s new Digital Services Act, if it’s found to have failed to comply with that law.

    It was in this context that TikTok CEO Shou Zi Chew flew last week to Brussels. The head of the social media outlet was on a charm offensive, trying to assuage concerns, but high-level European policy chiefs sent him home with stark warnings.

    “I count on TikTok to fully execute its commitments to go the extra mile in respecting EU law and regaining trust of European regulators. There cannot be any doubt that data of users in Europe are safe and not exposed to illegal access from third-country authorities,” European Commission Vice-President for Values and Transparency Věra Jourová told media after the meeting.

    A TikTok spokesperson told CBS News that the company has a “clear plan that we’re already implementing to reassure our community that they can trust us with their data… This includes storing European user data in our data center operations in Ireland, starting this year; further reducing employee access to data; and minimizing data flows outside of Europe.”  

    “Europe must finally wake up” 

    Tiktok’s relationship with the Chinese government is complex. The platform’s parent company ByteDance is based in Beijing, and while the company has denied sharing data with Chinese authorities, TikTok admitted in a policy update last November that Chinese employees could be granted “remote access” to European user data.

    That admission sparked fears that the Chinese government could legally force ByteDance to hand over any user data to which the company has access. Given that China’s ruling Communist Party has complete control over all business conducted on the country’s soil — with no checks or balances on that power, it’s not a far-fetched concern.

    ByteDance collects a sizable amount of data through TikTok and other digital properties. According to the company’s own privacy policy, TikTok collects the names of users, passwords, phone numbers, private messages on the app, the mobile networks used by its users, their contacts, satellite location information, and payment details such as credit card info.

    And TikTok is growing fast. As of June 2022, there were 227.81 million users in Europe. To put that in context, there were fewer than 100 million Twitter users in Europe as of 2022, according to DataReportal. 

    Körner believes it’s high time for European lawmakers to reign in the video sharing app by simply enforcing existing laws.

    “TikTok’s success is the result of a European policy failure,” he told CBS News. “Europe must finally wake up… If TikTok refuses to abide by EU laws, it should be banned.”

    [ad_2]

    Source link

  • Russian oligarch Yevgeny Prigozhin, “Putin’s chef,” admits interference in U.S. elections

    Russian oligarch Yevgeny Prigozhin, “Putin’s chef,” admits interference in U.S. elections

    [ad_1]

    Russian businessman Yevgeny Prigozhin, a close ally of President Vladimir Putin and a key figure in the war in Ukraine, admitted bluntly on Monday to interfering in U.S. elections.

    “Gentlemen, we interfered, we are interfering, and we will interfere,” declared Prigozhin in a statement quoted by his company, Concord. The oligarch has been sanctioned by Washington for running a “troll factory” to influence the outcome of votes in the U.S. and elsewhere.

    “Accurately, precisely, surgically, and the way we do it, the way we know how to,” Prigozhin quipped in response to a request for comment on the specifics of the interference from a Russian news outlet.

    Prigozhin is the financial benefactor behind a so-called Russian “troll farm” previously called the Internet Research Agency. The group, which has changed it’s name multiple times, creates and uses inauthentic social media pages to spread misinformation or incendiary speech to affect voters and sow discord. Such organizations are believed to exist in Russia, China and Iran, at least, with the same intent.


    Concerns over China’s efforts to influence U.S. elections

    05:13

    The U.S. Treasury Department accused Prigozhin and the Internet Research Agency of interfering in the 2016 presidential election and the 2018 midterm elections. The organization was frequently mentioned by U.S. Special Counsel Robert Mueller in his probe into Russia’s election interference.

    In July, the State Department offered a reward of up to $10 million for information on Prigozhin in connection with his “engagement in U.S. election interference.”

    Prigozhin’s own admission came on the eve of this week’s round of U.S. midterm elections, which will be key to shaping the rest of President Joe Biden’s presidency. It was the first such admission from an individual who has been formally accused by Washington of efforts to influence American politics.

    Speaking on Sunday to CBS’ “Face the Nation” moderator Margaret Brennan, Chris Krebs, the former director of the U.S. government cybersecurity agency said, “we’ve seen reports of Russia, China, Iran back at their old tricks,” referring to online interference operations.


    Former employee of Russian “troll farm” on special counsel indictment

    02:22

    Krebs said two U.S. research firms had released information suggesting trolls linked to Russia’s Internet Research Agency “are back at it and are undermining Democratic candidates for Senate” in this week’s midterms. 

    Combined with Elon Musk’s tumultuous takeover of Twitter, Krebs said it was all “going to create a very chaotic environment” for the U.S. democratic process.   

    The Kremlin has repeatedly denied ever seeking to influence elections in the U.S. or any other outside nation. Russian President Vladimir Putin ridiculed Mueller’s 2018 indictment of 13 Russians accused of a conspiracy to meddle in the presidential election that put Donald Trump in the White House.

    “How low the Western information and political environment has fallen if a restauranteur from Russia could influence elections in the United States or a European country,” the Russian leader said at the time, referring to Prigozhin.

    Trump Russia Probe
    Yevgeny Prigozhin, left, with Russian President Vladimir Putin.

    Alexei Druzhinin/Sputnik/Kremlin Pool/AP


    The businessman is sometimes called “Putin’s chef” for the lucrative catering contracts he received from the Russian state.

    The oligarch has kept a low profile for years, but recently Prigozhin has emerged as an increasingly public figure as the mercenaries from his Wagner Group have become a key force in bolstering Putin’s invasion of Ukraine.

    Prigozhin denied bankrolling the Wagner Group for years, but in September he admitted to funding the pseudo-military company since 2014. Since then, the private Wagner army has helped advance the Kremlin’s geopolitical and business objectives in conflicts from Syria and Africa to Ukraine.

    [ad_2]

    Source link

  • Uber dealing with

    Uber dealing with

    [ad_1]

    Uber said Thursday that it reached out to law enforcement after a hacker apparently breached its network. A security engineer said the intruder had provided evidence of obtaining access to crucial cloud systems at the ride-hailing service.

    Uber tweeted Thursday night that it was “currently responding to a cybersecurity incident. We are in touch with law enforcement.” 

    It said it would provide updates on its Uber Comms twitter feed. When reached by CBS News, an Uber spokesperson declined to provide any details. 

    There was no indication that Uber’s fleet of vehicles or its operation was in any way affected.  

    “It seems like they’ve compromised a lot of stuff,” said Sam Curry, an engineer with Yuga Labs who communicated with the hacker. That includes obtaining complete access to the Amazon and Google-hosted cloud environments where Uber stores its source code and customer data, he said.

    Curry said he spoke to several Uber employees who said they were “working to lock down everything internally” to restrict the hacker’s access. That included the company’s Slack internal messaging network, he said.

    He said there was no indication that the hacker had done any damage or was interested in anything more than publicity. “My gut feeling is that it seems like they are out to get as much attention as possible.”

    The hacker had alerted Curry and other security researchers to the intrusion by using and an internal Uber account to comment on vulnerabilities they had previously identified on the company’s network through its bug-bounty program, which pays ethical hackers to identify vulnerabilities.

    The hacker provided a Telegram account address and Curry and other researchers then engaged them in a separate conversation, sharing screenshots of various pages from Uber’s cloud providers to prove they broke in.

    The Associated Press attempted to contact the hacker at the Telegram account where Curry and the other researchers chatted with them. But no one responded.

    One screenshot posted on Twitter and confirmed by researchers shows a chat with the hacker in which they say they obtained the credentials of an administrative user and then used social engineering to access Uber’s internal network.

    In 2016, a massive cybersecurity breach at Uber saw hackers steal the personal data of 57 million Uber customers and drivers.

    As a result, Uber was forced to pay $148 million to settle a lawsuit with all 50 states and the District of Columbia over the breach.  

    [ad_2]

    Source link