ReportWire

Tag: Security

  • Strengthening patient data integrity with advanced security and AI solutions

    [ad_1]

    Microsoft’s security toolkits provided a ready-made solution that allowed an Ontario-based health network to create a stable environment that maintains continuity of care even in the face of disruptions.  

    A cyberattack has the potential to be catastrophic in any industry. But in healthcare, the impacts are on the level of life and death, compromising access to patient information and to critical digital tools that affect delivery of care.  

    What’s more, a cybersecurity incident not only has a toll on the impacted hospital, but creates a domino effect on unaffected hospitals.  This interruption can drive up waiting room times by as much as 46% and stroke code activations by as much as 47%.  

    Given the stakes, ransomware attacks and other disruptions to healthcare security pose a major challenge to providers across the industry. But many organizations lack the internal resources to research, evaluate, and implement new security tools and solutions on their own.   

    That was certainly the case for Mackenzie Health, a two-hospital health network in Richmond Hill and Vaughan, Ontario. “One of the challenges healthcare organizations face is keeping up with constantly evolving cyber threats while we are working with very limited resources,” says Felix Zhang, the health network’s Chief Technology Officer. “We found that adopting the security toolkits provided by Microsoft was a much more effective approach.” 

    Protecting the integrity of patient data even through disruptions 

    Earlier this year, Mackenzie Health worked with Microsoft and Sapphire Health Technology Consulting to build its first cloud-hosted electronic medical record (EMR) instance on Azure, which allows the organization to sync its on-premises EMR database to its cloud infrastructure in real time. This cloud read-only instance allows providers and clinicians to access essential patient information, such as demographics, allergies, medications, lab results, and clinical notes, ensuring continuity of care even during a production system outage or cyber incident.  

    In addition, this copy of the EMR database is isolated from other EMR environments to reduce the risk of cross-contamination during a cyberattack, helping Mackenzie Health protect the integrity of its patient data.  

    The organization has also adopted almost a full stack of Microsoft security products, including secure email, endpoint protection, multi-factor authentication, and more. This offers users a unified experience across all the platforms, improving operational efficiency and simplifying training, making it easy for users to learn and adopt the new tools.  

    Custom apps that can be built in days, not months  

    These enhancements to Mackenzie Health were just the latest step in a long partnership with Microsoft. Since starting its cloud migration journey a few years ago, the organization has migrated most of its business applications to the cloud and leveraged Power Apps to save time, improve efficiency, and fill gaps in its digital capabilities across the organization, from finance to lab. “During the COVID-19 pandemic, we developed an online scheduling system for the vaccination clinic using Power Apps in less than a week,” says Zhang.  

    Getting ready for next-gen infrastructure and security challenges 

    How does Mackenzie Health plan to navigate the next stage of digital evolution and security threats?  

    “As our on-prem infrastructure ages and approaches its end of life, we will shift our focus to evaluating the next-gen infrastructure options for our client computing and clinical systems,” says Zhang. “By leveraging this partnership, we are now better prepared against cyber threats, ensuring that patient care remains safe and undisturbed during a cyber event, and also to maintain the integrity of our data.” 

    [ad_2]

    Helia Mohammadi

    Source link

  • Knog Scout Travel Tracker + Alarm Is Like an AirTag on Steroids

    [ad_1]

    Never lose a bag again with Knog’s Scout Travel tracker. This gadget hangs securely from your luggage and is compatible with Apple’s “Find My” location tracking tech. It has a few advantages over an AirTag, including a built-in hanger, a loud, motion-sensitive alarm, and a QR code to help others let you know they found your bag. They also make a bike version.

    [ad_2]

    Paul Strauss

    Source link

  • Business Safety Should Be Preventative – A Guide – Aha!NOW

    [ad_1]

    The popular cliché prevention is better than cure makes sense even in the aspects of safety and security. The ways to prevent undesirous events from happening should be of paramount importance. Some practical implementation tips are to secure access control, set up surveillance systems, upgrade to motion lighting, and much more. ~ Ed.

    Business Safety Should Be Preventative - A Guide

    It’s one thing to stop the effects of a safety mistake from harming anyone. For example, it’s good if falling debris hits a hard hat at just the right angle so as to protect the head and not injure the neck. But it would be best if the debris didn’t fall in the first place.

    Business safety should be preventative if it’s to be effective, then. This applies to almost everything, outside of the risks that cannot be avoided, but can be managed and reduced. For example, no elevator is going to be 100% safety proof at all times by its very nature of being a suspended system held and moved by large wires. However, it has so many points of failure built in, and so many safety redundancies in place that far and away before an issue happens, dozens of other fail safes have stopped the problem. This means that even if a number of the cables are cut due to hypothetical sabotage, the carriage will still lock in place.

    It’s good to think of safety in this way, especially if you’re trying to protect your staff first (of course) and sensitive systems second. In this post, we’ll discuss how to think through that process, and how to maximize prevention before defense.

    6 Ways to Implement Preventative Business Safety

    Reinforcing appointment systems, reporting systems, and business communications in addition to other security measures contribute to a robust safety system.

    Access Control

    Door security needs careful thought if you’re going to do it right, because the normal flow of people can’t be too hard to put in place, but you also need to ensure no one untoward is given access to your building.

    Modern key cards and access control system vendors are worthwhile, as they create a record of building traffic, making it easier to understand who goes where throughout the day. Staff members usually appreciate having different clearance levels, because it means they don’t have to worry about securing areas that aren’t part of their daily work. Managing all those permissions takes time, but it’s worth getting right. Most buildings find that splitting access by department or role works well, especially when people need to focus without interruption or work with sensitive information.

    Video Surveillance

    Camera systems prevent problems far more often than they catch wrongdoing because people naturally behave differently when they know cameras are around. Even if you’re entirely innocent, normal, honest and doing what you’re supposed to, you’ve likely felt you have to act correctly knowing every second was being recorded. It’s just human nature, and luckily it applies to criminals or those considering harmful acts too.

    More than security, the footage helps you to easily resolve disputes and conflict quickly if there is some. For example, new employees learn faster when they can watch recordings of experienced staff handling complex situations, like how they refused a problem customer or asked someone to leave. Moreover, camera checks often reveal interesting patterns too, like which entrances people actually use most often, or where delivery drivers prefer to park, or who isn’t locking up correctly. These observations lead to better decisions about pretty much everything a concerned manager would want to improve.

    Motion Lighting

    Lighting that will turn on and off in line with general movement serves multiple worthwhile functions for a firm. To begin with, empty corridors and parking areas stay dark until needed, putting down electricity costs. So that’s a win.

    But then when someone walks through, the space ahead lights up automatically. Staff working unusual hours appreciate this feature, particularly during winter months when it gets dark early. The sudden brightness also tends to discourage people from lingering in places where they shouldn’t be, for instance, those who are walking down the side of a warehouse and are suddenly lit up with cameras covering them.

    The initial cost of installation usually pays for itself through lower energy bills and reduced security incidents that way, and of course, you can also show you’re safeguarding staff by keeping areas of the business lit, like your entrance space or the outside bike shed for your cycling scheme.

    Reception Reporting Systems

    Keeping track of building occupants matters more than many people realize, because during emergencies, having an accurate headcount can potentially save a life, or prevent a firefighter from risking themselves going into a building to find someone who isn’t there.

    A well-designed system means considering both security needs with practical considerations, as visitors should feel welcomed rather than interrogated. Many offices now use tablets for sign-ins, which speeds up the process while still collecting necessary information, or a staff door that scans in with a keycard and registers you officially.

    Appointment Systems

    Now, most businesses, even those closed to the public, will spend time planning who visits to help keep the police safe and to have a good timeline of who and who isn’t welcome. A good scheduling system will generally help you to limit overcrowding and let you know the general flow of people that day.

    For the most part, unexpected visitors will always show up, but having clear procedures helps staff handle these situations confidently and to make an appointment for them without letting them into an unprepared space. We’d recommend reviewing this system and your appointment set, because helps spot patterns that might need attention, like certain times when the reception area gets particularly busy, or the departments not registering appointments through the safest channels.

    Business Communications

    Of course, a building that is regularly used is something of a living thing, it has people coming in and out, it has structural changes (however small), and also circumstances we need to be aware of. So, easy to access and continual updates about building operations help everyone work more safely and efficiently. Staff notice potential problems sooner when they know what to watch for along with this, such as being told to keep an eye on unapproved access or those without identification badges on their lanyards.

    You can start pretty easily with simple group messages, as they work well for sharing quick updates about immediate concerns, while longer explanations fit better in regular team meetings or a wider briefing email. Also showcasing how your reporting pathways should take place can help you avoid them becoming problems later on.

    Summing Up

    Enhance the safety of your employees and business by implementing multiple checks and security systems. These include measures like strengthening access control, increasing video surveillance, adding motion lighting, creating reception reporting systems, using appointment systems, and setting up business communications.

    With this advice, we hope you can see how business safety should not only be focused, but preventative too.

    Over to you

    What types of safety and security measures do you use at your business workplace or organization? Share your tips and experiences in the comments below.

    Disclaimer: Though the views expressed are of the author’s own, this article has been checked for its authenticity of information and resource links provided for a better and deeper understanding of the subject matter. However, you’re suggested to make your diligent research and consult subject experts to decide what is best for you. If you spot any factual errors, spelling, or grammatical mistakes in the article, please report at [email protected]. Thanks.

    [ad_2]

    Samantha Cortez

    Source link

  • ‘We’re a Fortress Now’: The Militarization of US Elections Is Here

    ‘We’re a Fortress Now’: The Militarization of US Elections Is Here

    [ad_1]

    Drones, snipers, razor wire, sniffer dogs, body armor, bulletproof glass, and 24-hour armed security.

    This is not a list of protections in place for a visit by the president of the United States nor the contents of a shipment to frontline troops fighting in Ukraine. This is a list of the security measures election officials in counties across the US have had to implement ahead of Tuesday’s vote as a result of the unprecedented threats they have faced in recent years.

    Officials are putting in place the typical final measures to ensure the smooth operation of an election, but beyond checking that they have enough ballots and that machines are working properly, officials are now faced with having to monitor for threats and make sure they have done everything they can to protect themselves and their staff.

    “Given the current political environment, the possibility that an event may occur has increased, and our election professionals have responded in kind,” says Tammy Patrick, a former election official in Arizona’s Maricopa County who is now a senior adviser at the nonprofit Bolstering Elections Initiative. “Efforts focusing on the physical security of the voters, election workers, and staff by putting in bulletproof glass, panic buttons, razor wire, and fencing are fairly common, as is the installation of surveillance cameras and systems, cyber protections, and training on de-escalation techniques and response drills.”

    Nowhere in the US is the militarization of the election process more evident than in Maricopa County.

    The fourth largest county in the nation, Maricopa became ground zero for election denial conspiracists in recent years, after GOP lawmakers sanctioned a bogus recount in 2021, run by the Florida company Cyber Ninjas.

    As a result, the county has for years been putting increased security measures in place. “We’re a fortress now,” Stephen Richer, the Maricopa County Recorder, told WIRED back in February, outlining how he had to navigate security fencing, metal detectors, and security checks in order to get into his office.

    As the 2024 election approaches, the measures Maricopa officials are putting in place have been ratcheted up significantly.

    Officials have added a second layer of security fencing to protect election offices, as well as concrete k-rails, which means election workers will be bused in from offsite locations due to reduced parking spaces. At the country’s tabulation center, every door will be fitted with metal detectors, floodlights will be installed, and on election day the center will be protected by a ring of snipers deployed on roofs around the building, election officials told NBC.

    [ad_2]

    David Gilbert

    Source link

  • Chinese Hackers Target Trump Campaign via Verizon Breach

    Chinese Hackers Target Trump Campaign via Verizon Breach

    [ad_1]

    The Chinese spy operation adds to the growing sense of a melee of foreign digital interference in the election, which has already included Iranian hackers’ attempt to hack and leak emails from the Trump campaign—with limited success—and Russia-linked disinformation efforts across social media.

    Ahead of the full launch next week of Apple’s AI platform, Apple Intelligence, the company debuted tools this week for security researchers to evaluate its cloud infrastructure known as Private Cloud Compute. Apple has gone to great lengths to engineer a secure and private AI cloud platform, and this week’s release includes extensive detailed technical documentation of its security features as well as a research environment that is already available in the macOS Sequoia 15.1 beta release. The testing features allow researchers (or anyone) to download and evaluate the actual version of PCC software that Apple is running in the cloud at a given time. The company tells WIRED that the only modifications to the software relate to optimizing it to run in the virtual machine for the research environment. Apple also released the PCC source code and said that as part of its bug bounty program, vulnerabilities that researchers discover in PCC will be eligible for a maximum bounty payout of up to $1 million.

    Over the summer, Politico, The New York Times, and The Washington Post each revealed that they’d been approached by a source offering hacked Trump campaign emails—a source whom the US Justice Department says was working on behalf of the Iranian government. The news outlets all refused to publish or report on those stolen materials. Now it appears that Iran’s hackers did eventually find outlets outside the mainstream media that were willing to release those emails. American Muckrakers, a PAC run by a Democratic operative, did publish the documents after soliciting them in a public post on X, writing, “Send it to us and we’ll get it out.”

    American Muckrakers then published internal Trump campaign communications about North Carolina Republican gubernatorial candidate Mark Robinson and Florida Republican representative Anna Paulina Luna, as well as material that seemed to suggest a financial arrangement between Donald Trump and Robert F. Kennedy Jr., the third-party candidate who dropped out of the race and endorsed Trump. Independent journalist Ken Klippenstein also received and published some of the hacked material, including a research profile on Trump running mate and US senator JD Vance that the campaign assembled when assessing him for the role. Klippenstein subsequently received a visit from the FBI, he’s said, warning him that the documents were shared as part of a foreign influence campaign. Klippenstein has defended his position, arguing that the media should not serve as “gatekeeper of what the public should know.”

    As Russia has both waged war and cyberwar against Ukraine, it’s also carried out a vast campaign of hacking against another neighbor to the west with whom it’s long had a fraught relationship: Georgia. Bloomberg this week revealed ahead of the Georgian election how Russia systematically penetrated the smaller country’s infrastructure and government in a yearslong series of digital intrusion operations. From 2017 to 2020, for instance, Russia’s military intelligence agency, the GRU, hacked Georgia’s Central Election Commission (just as it did in Ukraine in 2014), multiple media organizations, and IT systems at the country’s national railway company—all in addition to the attack on Georgian TV stations that the NSA pinned on the GRU’s Sandworm unit in 2020. Meanwhile, hackers known as Turla, working for the Kremlin’s KGB successor, the FSB, broke into Georgia’s Foreign Ministry and stole gigabytes of officials’ emails over months. According to Bloomberg, Russia’s hacking efforts weren’t limited to espionage but also appeared to include preparing for disruption of Georgian infrastructure like the electric grid and oil companies in the event of an escalating conflict.

    For years, cybersecurity professionals have argued about what constitutes a cyberattack. An intrusion designed to destroy data, cause disruption, or sabotage infrastructure? Yes, that’s a cyberattack. A hacker breach to steal data? No. A hack-and-leak operation or an espionage mission with a disruptive clean-up phase? Probably not, but there’s room for debate. The Jerusalem Post this week, however, achieved perhaps the clearest-cut example of calling something a cyberattack—in a headline no less—that is very clearly not: disinformation on social media. The so-called “Hezbollah cyberattack” that the news outlet reported was a collection of photos of Israeli hospitals posted by “hackers” identifying as Hezbollah supporters that suggested weapons and cash were stored underneath them and that they should be attacked. The posts seemingly came in response to the Israeli Defense Forces’ repeating similar claims about hospitals in Gaza that the IDF has bombed, as well as another more recently in Lebanon’s capital city of Beirut.

    “These are NOT CYBERATTACKS,” security researcher Lukasz Olejnik, the author of the books The Philosophy of Cybersecurity and Propaganda, wrote next to a screenshot of the Jerusalem Post headline on X. “Posting images to social media is not hacking. Such a bad take.”

    [ad_2]

    Lily Hay Newman, Andy Greenberg

    Source link

  • Exposed United Nations Database Left Sensitive Information Accessible Online

    Exposed United Nations Database Left Sensitive Information Accessible Online

    [ad_1]

    A database containing sensitive, sometimes personal information from the United Nations Trust Fund to End Violence Against Women was openly accessible on the internet, revealing more than 115,000 files related to organizations that partner with or receive funding from UN Women. The documents range from staffing information and contracts to letters and even detailed financial audits about organizations working with vulnerable communities around the world, including under repressive regimes.

    Security researcher Jeremiah Fowler discovered the database, which was not password protected or otherwise access controlled, and disclosed the finding to the UN, which secured the database. Such incidents are not uncommon, and many researchers regularly find and disclose examples of exposures to help organizations correct data management mistakes. But Fowler emphasizes that this ubiquity is exactly why it is important to continue to raise awareness about the threat of such misconfigurations. The UN Women database is a prime example of a small error that could create additional risk for women, children, and LGBTQ people living in hostile situations worldwide.

    “They’re doing great work and helping real people on the ground, but the cybersecurity aspect is still critical,” Fowler tells WIRED. “I’ve found lots of data before, including from all sorts of government agencies, but these organizations are helping people who are at risk just for being who they are, where they are.”

    A spokesperson for UN Women tells WIRED in a statement that the organization appreciates collaboration from cybersecurity researchers and combines any outside findings with its own telemetry and monitoring.

    “As per our incident response procedure, containment measures were rapidly put in place and investigative actions are being taken,” the spokesperson said of the database Fowler discovered. “We are in the process of assessing how to communicate with the potential affected persons so that they are aware and alert as well as incorporating the lessons learned to prevent similar incidents in the future.”

    The data could expose people in multiple ways. At the organizational level, some of the financial audits include bank account information, but more broadly, the disclosures provide granular detail on where each organization gets its funding and how it budgets. The information also includes breakdowns of operating costs, and details about employees that could be used to map the interconnections between civil society groups in a country or region. Such information is also ripe for abuse in scams since the UN is such a trusted organization, and the exposed data would provide details on internal operations and potentially serve as templates for malicious actors to create legitimate-looking communications that purport to come from the UN.

    [ad_2]

    Lily Hay Newman

    Source link

  • Google Chrome’s uBlock Origin Purge Has Begun

    Google Chrome’s uBlock Origin Purge Has Begun

    [ad_1]

    And that’s not all. Each week, we round up the security and privacy news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    If you use uBlock Origin’s Chrome extension to filter out online ads, expect to get mildly annoyed in the near future. Google has begun implementing new Chrome extension standards, called Manifest V3, that will disable the legacy version of uBlock Origin’s extension that most users likely have installed. And while you might be thinking, “Google is a silverback gorilla of online advertising, of course they’re finally forcing me to see ads!” there is some good news. A new version of the ad-filtering extension that meets the Manifest V3 standards, uBlock Origin Lite, is now available. Then again, it won’t block as much as the previous iteration of uBlock. Still, as a Google spokesperson told The Verge, you have options: “The top content filtering extensions all have Manifest V3 versions available — with options for users of AdBlock, Adblock Plus, uBlock Origin and AdGuard.” Either way, you’ll need to install a new extension soon.

    US authorities announced charges this week against a 25-year-old Alabama man accused of hacking the Security and Exchange Commission’s X account. Prosecutors claim Eric Council Jr. obtained personal information and the materials for a fake ID of a person who controlled the @SECGov account from unidentified coconspirators. Council allegedly used the fake ID to carry out a SIM-swapping attack, duping AT&T retail store staff into giving him a new SIM card, which he ultimately used to take control of the victim’s phone account. The coconspirators used that to gain access to the SEC’s X account, where they posted a fake announcement about Bitcoin’s regulatory status, which was followed by a price jump of $1,000 per bitcoin. Council stands charged of conspiracy to commit aggravated identity theft and access device fraud.

    The grocery store chain Kroger has never used facial-recognition technology broadly in its stores and has no current plans to, a spokesperson told Fast Company this week. The company has been facing a firestorm over its use of electronic shelving labels over concerns that ESLs could be used to impose surge pricing on popular items, and fears that the devices could also be deployed with facial recognition. The company did a single-store facial-recognition pilot of a technology called EDGE in 2019, but it did not move forward with the service. US lawmakers including Rashida Tlaib, Elizabeth Warren, and Robert Casey have publicly raised concerns about Kroger’s use of ESLs.

    Microsoft told customers that it failed to capture more than two weeks of security logs from certain cloud services in September, including Microsoft Entra, Sentinel, Defender for Cloud, and Purview. News of the lost logs was first reported by Business Insider. The company said in the notification that “a bug in one of Microsoft’s internal monitoring agents resulted in a malfunction in some of the agents when uploading log data to our internal logging platform.” The blank extends from September 2 to September 19. A Microsoft executive confirmed to TechCrunch that the incident was caused by an “operational bug within our internal monitoring agent.”

    System activity logs are crucial for all sorts of operations and are particularly used for security monitoring and investigations, because they can expose breaches and malicious activity. After Russian hackers breached US government networks through SolarWinds software in 2020, many agencies couldn’t detect the activity in their Microsoft Azure cloud services because they weren’t paying for Microsoft’s premium tier features, so they didn’t have adequate network activity logs. Lawmakers were outraged about the up-charge, and the Biden administration worked for more than two years to get Microsoft to make the logging services free. The company ultimately announced the change in July 2023.

    [ad_2]

    Lily Hay Newman, Andrew Couts

    Source link

  • Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals

    Hacker Charged With Seeking to Kill Using Cyberattacks on Hospitals

    [ad_1]

    In December of 2023, for instance, Anonymous Sudan took OpenAI’s ChatGPT offline with a sustained series of DDoS attacks in response to the company’s executive Tal Broda vocally supporting the Israel Defense Forces’ missile attacks in Gaza. “More! No mercy! IDF don’t stop!” Broda had written on X over a photo of a devastated urban landscape in Gaza, and in another post denied the existence of Palestine.

    “We will continue targeting ChatGPT until the genocide supporter, Tal Broda, is fired and ChatGPT stops having dehumanizing views of Palestinians,” Anonymous Sudan responded in a Telegram post explaining its attacks on OpenAI.

    Still, Anonymous Sudan’s true goals haven’t always seemed entirely ideological, Akamai’s Seaman says. The group has also offered to sell access to its DDoS infrastructure to other hackers: Telegram posts from the group as recently as March offered the use of its DDoS service, known as Godzilla or Skynet, for $2,500 a month. That suggests that even its attacks that appeared to be politically motivated may have been intended, at least in part, as marketing for its moneymaking side, Seaman argues.

    “They seem to have thought, ‘We can get involved, really put a hurting on people, and market this service at the same time,’” Seaman says. He notes that, in the group’s anti-Israel, pro-Palestine focus following the October 7 attacks, “there’s definitely an ideological thread in there. But the way it weaved through the different victims is something that maybe only the perpetrators of the attack fully understand.”

    At times, Anonymous Sudan also hit Ukrainian targets, seemingly partnering with pro-Russian hacker groups like Killnet. That led some in the cybersecurity community to suspect that Anonymous Sudan was, in fact, a Russia-linked operation using its Sudanese identity as a front, given Russia’s history of using hacktivism as false flag. The charges against Ahmed and Alaa Omer suggest that the group was, instead, authentically Sudanese in origin. But aside from its name, the group doesn’t appear to have any clear ties to the original Anonymous hacker collective, which has been largely inactive for the last decade.

    Aside from its targeting and politics, the group has distinguished itself through a relatively novel and effective technical approach, Akamai’s Seaman says: Its DDoS service was built by gaining access to hundreds or possibly even thousands of virtual private servers—often-powerful machines offered by cloud services companies—by renting them with fraudulent credentials. It then used those machines to launch so-called layer 7 attacks, overwhelming web servers with requests for websites, rather than the lower-level floods of raw internet data requests that DDoS hackers have tended to use in the past. Anonymous Sudan and the customers of its DDoS services would then target victims with vast numbers of those layer 7 requests in parallel, sometimes using techniques called “multiplexing” or “pipelining” to simultaneously create multiple bandwidth demands on servers until they dropped offline.

    [ad_2]

    Andy Greenberg

    Source link

  • The War on Passwords Is One Step Closer to Being Over

    The War on Passwords Is One Step Closer to Being Over

    [ad_1]

    The password-killing tech known as “passkeys” have proliferated over the past two years, developed by the tech industry association known as the FIDO Alliance as an easier and more secure authentication alternative. And although superseding any technology as entrenched as passwords is difficult, new features and resources launching this week are pushing passkeys toward a tipping point.

    At the FIDO Alliance’s Authenticate Conference in Carlsbad, California, on Monday, researchers are announcing two projects that will make passkeys easier for organizations to offer—and easier for everyone to use. One is a new technical specification called Credential Exchange Protocol (CXP) that will make passkeys portable between digital ecosystems, a feature that users have increasingly demanded. The other is a website, called Passkey Central, where developers and system administrators can find resources like metrics and implementation guides that make it easier to add support for passkeys on existing digital platforms.

    “To me, both announcements are part of the broader story of the industry working together to stop our dependence on passwords,” Andrew Shikiar, CEO of the FIDO Alliance, told WIRED ahead of Monday’s announcements. “And when it comes to CXP, we have all these companies who are fierce competitors willing to collaborate on credential exchange.”

    CXP comprises a set of draft specifications developed by the FIDO Alliance’s “Credential Provider Special Interest Group.” Development of technical standards can often be a fraught bureaucratic process, but the creation of CXP seems to have been positive and collaborative. Researchers from the password managers 1Password, Bitwarden, Dashlane, NordPass, and Enpass all worked on CXP, as did those from the identity providers Okta as well as Apple, Google, Microsoft, Samsung, and SK Telecom.

    The specifications are significant for a few reasons. CXP was created for passkeys and is meant to address a longstanding criticism that passkeys could contribute to user lock-in by making it prohibitively difficult for people to move between operating system vendors and types of devices. In many ways, though, this problem already exists with passwords. Export features that allow you to move all of your passwords from one manager to another are often dangerously exposed and essentially just dump a list of all of your passwords into a plaintext file.

    It’s gotten much easier to sync passkeys across your devices through a single password manager, but CXP aims to standardize the technical process for securely transferring them between platforms so users are free—and safe—to roam the digital landscape. Importantly, while CXP was designed with passkeys in mind, it is really a specification that can be adapted to securely exchange other secrets as well, including passwords or other types of data.

    [ad_2]

    Lily Hay Newman

    Source link

  • Pig Butchering Scams Are Going High Tech

    Pig Butchering Scams Are Going High Tech

    [ad_1]

    As digital scamming explodes in Southeast Asia, including so called “pig butchering” investment scams, the United Nations Office on Drugs and Crime (UNODC) issued a comprehensive report this week with a dire warning about the rapid growth of this criminal ecosystem. Many digital scams have traditionally relied on social engineering, or tricking victims into giving away their money willingly, rather than leaning on malware or other highly technical methods. But researchers have increasingly sounded the alarm that scammers are incorporating generative AI content and deepfakes to expand the scale and effectiveness of their operations. And the UN report offers the clearest evidence yet that these high tech tools are turning an already urgent situation into a crisis.

    In addition to buying written scripts to use with potential victims or relying on templates for malicious websites, attackers have increasingly been leaning on generative AI platforms to create communication content in multiple languages and deepfake generators that can create photos or even video of nonexistent people to show victims and enhance verisimilitude. Scammers have also been expanding their use of tools that can drain a victim’s cryptocurrency wallets, have been manipulating transaction records to trick targets into sending cryptocurrency to the wrong places, and are compromising smart contracts to steal cryptocurrency. And in some cases, they’ve been purchasing Elon Musk’s Starlink satellite internet systems to help power their efforts.

    “Agile criminal networks are integrating these new technologies faster than anticipated, driven by new online marketplaces and service providers which have supercharged the illicit service economy,” John Wojcik, a UNODC regional analyst, tells WIRED. “These developments have not only expanded the scope and efficiency of cyber-enabled fraud and cybercrime, but they have also lowered the barriers to entry for criminal networks that previously lacked the technical skills to exploit more sophisticated and profitable methods.”

    For years, China-linked criminals have trafficked people into gigantic compounds in Southeast Asia, where they are often forced to run scams, held against their will, and beaten if they refuse instructions. Around 200,000 people, from at least 60 countries, have been trafficked to compounds largely in Myanmar, Cambodia, and Laos over the last five years. However, as WIRED reporting has shown, these operations are spreading globally—with scamming infrastructure emerging in the Middle East, Eastern Europe, Latin America, and West Africa.

    Most prominently, these organized crime operations have run pig butchering scams, where they build intimate relationships with victims before introducing an “investment opportunity” and asking for money. Criminal organizations may have conned people out of around $75 billion through pig butchering scams. Aside from pig butchering, according to the UN report, criminals across Southeast Asia are also running job scams, law enforcement impersonation, asset recovery scams, virtual kidnappings, sextortion, loan scams, business email compromise, and other illicit schemes. Criminal networks in the region earned up to $37 billion last year, UN officials estimate. Perhaps unsurprisingly, all of this revenue is allowing scammers to expand their operations and diversify, incorporating new infrastructure and technology into their systems in the hope of making them more efficient and brutally effective.

    For example, scammers are often constrained by their language skills and ability to keep up conversations with potentially hundreds of victims at a time in numerous languages and dialects. However, generative AI developments within the last two years—including the launch of writing tools such as ChatGPT—are making it easier for criminals to break down language barriers and create the content needed for scamming.

    [ad_2]

    Matt Burgess, Lily Hay Newman

    Source link

  • How Should We Feel About Ring?

    How Should We Feel About Ring?

    [ad_1]

    Ring cameras have come a long way. Since the security camera brand launched 11 years ago, its video doorbells and cams have become vigilant, constant surveyors of patios, porches, and vestibules everywhere. Amazon now owns the company, and has ushered it through controversies over privacy concerns, security breaches, incidents of vigilantism, and the company’s cozy relationship with law enforcement. The drama has not slowed growth; over 10 million Rings have been installed, and the cameras currently blanket our urban and suburban landscape, filming the movements of you, your family, and any strangers who wander near your door.

    That makes for a lot of video to sift through if you’re trying to find something important, like whether or not a delivery was made, or what time your kids left for soccer practice. That abundance of footage is why Ring cameras, along with many other consumer products right now, are getting some AI-powered capabilities. Ring’s software update helps users search for specific moments their cameras may have captured.

    This week, WIRED senior writer Paresh Dave joins the show again to talk about the evolution of Ring—how the security cameras have become nearly ubiquitous security tech, and what the future holds now that they’re being infused with AI.

    Show Notes

    Read Paresh’s story about Ring’s AI updates. Read WIRED’s guides to the best indoor and outdoor security cameras. Read more about all the data Ring collects from its users and why we recently stopped recommending Ring cameras for a couple of years.

    Recommendations

    Paresh recommends getting a Sling TV subscription from Dish to watch live sports. Mike recommends searching for decoy security cameras you can install if your landlord requires you to put up a security camera. Lauren recommends the streaming shows Nobody Wants This and Killing Eve. Both are on Netflix.

    Paresh Dave can be found on social media @peard33. Lauren Goode is @LaurenGoode. Michael Calore is @snackfight@heads.social. Bling the main hotline at @GadgetLab. The show is produced by Boone Ashworth (@booneashworth). Our theme music is by Solar Keys.

    How to Listen

    You can always listen to this week’s podcast through the audio player on this page, but if you want to subscribe for free to get every episode, here’s how:

    If you’re on an iPhone or iPad, open the app called Podcasts, or just tap this link. You can also download an app like Overcast or Pocket Casts, and search for Gadget Lab. If you use Android, you can find us in the Google Podcasts app just by tapping here. We’re on Spotify too. And in case you really need it, here’s the RSS feed.

    [ad_2]

    Lauren Goode, Michael Calore

    Source link

  • Internet Archive Breach Exposes 31 Million Users

    Internet Archive Breach Exposes 31 Million Users

    [ad_1]

    An illicit JavaScript popup on the Internet Archive proclaimed on Wednesday afternoon that the site had suffered a major data breach. Hours later, the organization confirmed the incident.

    Longtime security researcher Troy Hunt, who runs the data breach notification website Have I Been Pwned (HIBP), also confirmed that the breach is legitimate. He said that it occurred in September and the stolen trove contains 31 million unique email addresses along with usernames, bcrypt password hashes, and other system data. Bleeping Computer, which first reported the breach, also confirmed the validity of the data.

    The Internet Archive did not yet return multiple requests for comment from WIRED.

    “Have you ever felt like the Internet Archive runs on sticks and is constantly on the verge of suffering a catastrophic security breach?” the attackers wrote in Wednesday’s Internet Archive popup message. “It just happened. See 31 million of you on HIBP!”

    In addition to the breach and site defacement, the Internet Archive has been grappling with a wave of distributed denial-of-service attacks that have intermittently brought down its services.

    Internet Archive founder Brewster Kahle provided a public update on Wednesday evening in a post on the social network X. “What we know: DDOS attack–fended off for now; defacement of our website via JS library; breach of usernames/email/salted-encrypted passwords. What we’ve done: Disabled the JS library, scrubbing systems, upgrading security. Will share more as we know it.” “Scrubbing systems” refer to services that offer DDoS attack protection by filtering malicious junk traffic so it can’t deluge and disrupt a website.

    The Internet Archive has faced aggressive DDoS attacks numerous times in the past, including in late May. As Kahle wrote on Wednesday: “Yesterday’s DDOS attack on @internetarchive repeated today. We are working to bring http://archive.org back online.” The hacktivist group known as “BlackMeta” claimed responsibility for this week’s DDoS attacks and said it plans to carry out more against the Internet Archive. Still, the perpetrator of the data breach is not yet known.

    The Internet Archive has faced battles on many fronts in recent months. In addition to repeated DDoS attacks, the organization is also facing mounting legal challenges. It recently lost an appeal in Hachette v. Internet Archive, a lawsuit brought by book publishers, which argued that its digital lending library violated copyright law. Now, it’s facing an existential threat in the form of another copyright lawsuit, this one from music labels, which may result in damages upwards of $621 million if the court rules against the archive.

    HIBP’s Hunt says that he first received the stolen Internet Archive data on September 30, reviewed it on October 5, and warned the organization about it on October 6. He says the group confirmed the breach to him the next day and that he planned to load the data into HIBP and notify its subscribers about the breach on Wednesday. “They get defaced and DDoS’d, right as the data is loading into HIBP,” Hunt wrote. “The timing on the last point seems to be entirely coincidental.”

    Hunt added, too, that while he encouraged the group to publicly disclose the data breach itself before the HIBP notifications went out, the extenuating circumstances may explain the delay.

    “Obviously I would have liked to see that disclosure much earlier, but understanding how under attack they are, I think everyone should cut them some slack,” Hunt wrote. “They’re a non-profit doing great work and providing a service that so many of us rely heavily on.”

    [ad_2]

    Lily Hay Newman, Kate Knibbs

    Source link

  • NEMLEC Police Foundation to host comedy night

    NEMLEC Police Foundation to host comedy night

    [ad_1]

    DRACUT — Who is a mystery but two of Boston’s “best” comedians will perform when the Northeastern Massachusetts Law Enforcement Council Foundation Inc. hosts its annual comedy night next month to raise money for training programs for police officers in northeastern Massachusetts.

    The event is scheduled for Friday, Nov. 1, at Four Oaks Country Club, 1 Clubhouse Lane, Dracut. Doors open at 6 p.m. The program includes a cheese and cracker display, cocktail reception, a full buffet-style dinner, dessert and coffee.

    Tickets are $75 per person, or $750 for a table of 10. There are several sponsorship opportunities that range in cost from $250 to $2,000.

    NEMLEC allows member agencies to call in the group to respond to emergencies that smaller departments may not be equipped to handle.

    Proceeds will assist NEMLEC’s training programs, including NEMLEC SWAT/RRT/K-9 training, NEMLEC Motor Unit annual training, NEMLEC STARS training, basic and advanced criminal investigation training, school and business safety summits, and active shooter training.

    The programs are available to officers in the NEMLEC region, which is comprised of 65 law enforcement agencies in Middlesex and Essex counties.

    The money also will be used to support local charities, including Cops for Kids with Cancer, which supports families who are struggling with childhood cancer.

    Those who would like to buy a ticket or table, donate a raffle or auction item, or become a sponsor for the event, should contact Executive Director Sharon Crowley at 978-852-3589 or by email at nemlecfoundation@yahoo.com.

    [ad_2]

    Source link

  • How to Stay Safe and Secure Online – Aha!NOW

    How to Stay Safe and Secure Online – Aha!NOW

    [ad_1]

    Online safety and security is a great challenge, however, taking up responsibility personally helps deal with it to a great extent. We’ve to proactively take measures to secure our devices, be careful about our actions and activities online, increase our awareness about the possible threats to our online safety and security and just act responsibly. These tips will give you a good headstart. ~ Ed.

    There is no doubt that modern technology and Internet has many positive impacts on our lives. However, the impacts on teenagers and adults alike can include several negative factors. Perhaps the biggest danger relates to online security and privacy.

    The harsh reality is that people fall victim to cyberattacks and other online threats every single day. It is quite a scary thought, not least because it’s virtually impossible to live in modern society without using digital tech.

    8 Ways to Stay Safe and Secure Online

    While it might not be possible to eliminate the threats completely, you can significantly reduce them. Here’s how:

    Stay Private

    We are already being watched by big brother through surveillance cameras and AI tools when out in public. So, the last thing you want is to let other people see what you’re doing when online. Investing in good security features is vital.

    Adding cybersecurity and antivirus software will protect devices. Meanwhile, you can download VPN apps to stop people and location services from tracking your movements. Aside from an extra layer of privacy, it can stop annoying ads.

    A VPN doesn’t suddenly remove all dangers but does allow you to browse the internet with greater confidence. It is the best starting point.

    Think Carefully About What You Post

    Maintaining your privacy isn’t just about stopping others from tracking your online activities. You must also pay close attention to the content that you share publicly, especially on social media channels. Even private stories should consider potential risks.

    For example, we all enjoy posting holiday photos. However, doing this while you’re away tells people your property is currently vacant. This could leave you open to theft. With this in mind, it’s better to delay the photo dump until after you return.

    Similarly, you must avoid posting any personal details. Passport info, bank details, and other items could be used maliciously if you’re not careful.

    Use Multi-Layered Security

    When thinking about online threats, the thought of someone gaining unauthorised access to an account is a big one. Sadly, cybercriminals are attempting to hack your accounts. So, it is imperative that you take the right steps to stop them from succeeding.

    Firstly, setting strong passwords is vital. An 8-character password takes just minutes to crack but a 16-character one can take billions of years. Even if someone guesses your password, biometrics and two-step authentications will come to the rescue.

    It may occasionally mean it takes an extra few seconds to get into your account. But it’s a worthy trade for preventing the damages that unauthorised access could bring.

    Use Trustworthy Businesses

    Arguably the scariest aspect of online safety is that your details could be compromised as a result of a third-party’s shortfalls. In the UK alone, almost 15 attacks on businesses are recorded every minute. Worse still, companies of all sizes are at risk.

    Even the biggest and best companies can suffer data breaches. Still, mindful decisions about which companies you use will reduce your risks. Businesses that are shown to take security seriously won’t only prevent attacks. They’ll also implement quick responses.

    By using different passwords and security credentials on each account, the impact of any breach will be limited.

    Learn About Threats

    Research shows that 88% of all data breaches are attributed to human error. Therefore, staying vigilant and carefully considering all online actions is vital. Prevention is the best form of protection and it’s better to be overly cautious than not cautious enough.

    Phishing scams, malware, and other tactics may be used by cybercriminals. They will try to trick you into making a costly mistake that allows them to steal information or money. Take care when clicking hyperlinks and always check that websites have https security.

    Whether it’s a lack of encryption or due to entering data that is directed to a cybercriminal, the threats are huge. Do not fall victim to them.

    Know Who You Are Talking To

    The internet allows us to connect with people like never before. However, it also opens the door to several possible dangers. Most notably, the person you are talking to behind a screen may not be the person that you think you are talking to.

    This could come courtesy of catfishing on dating apps or someone pretending to be a loved one. Either way, it could potentially lead to financial scams, such as them getting you to send money before disappearing. Or you may share too much info that could be used against you.

    So, you must always focus on retaining some secrecy at least until you have confirmed that the person is who you think.

    Update Your Tech

    While the use of VPNs and cybersecurity tools will reduce the risks, you also need to update the tech. Software companies don’t just update products with new features. They also add security patches that actively combat the latest threats.

    It can be frustrating when your device needs to complete an update. So, scheduling an update to occur once per week when you are not busy could be a particularly smart move. It will keep you protected without encountering stressful updates at the worst times.

    Phone updates, PC updates, and tablet updates are all vital. The sooner you complete them, the better. Not least because it puts your mind at ease.

    Use Reliable Accessories

    When thinking about your online data and general safety, it’s not just about browsing and devices. The accessories used can also pose a huge threat. Unbranded products don’t only threaten the device battery. They may also spy on your online activities.

    It might not be a hugely common risk for the average person but it does happen. More worryingly, public chargers are known to pose this threat. For this reason, avoiding them, along with public WiFi is vital. Otherwise, another person could be snooping.

    Even if you don’t want to pay sky-high prices from manufacturers, you should always buy from reputable retailers. Their own branded goods are safe.

    The Final Word

    If you truly want to stay safe online, you need to be both comprehensive and consistent in your thinking. Sadly, it only takes one incident to spell disaster. With the right care, though, danger can be averted.

    Over to you

    What steps do you take to enhance and ensure your safety and security online? Share in the comments section.

    [ad_2]

    Marcelia HR

    Source link

  • The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    The FBI Still Hasn’t Cracked NYC Mayor Eric Adams’ Phone

    [ad_1]

    Pig butchering, the crypto-based scammer scourge that has pulled in an estimated $75 billion from victims globally, is spreading beyond its roots in Southeast Asia, with operations proliferating across the Middle East, Eastern Europe, Latin America, and West Africa.

    The UK’s National Crime Agency disclosed new details about the identities of the Russian ransomware group known as Evil Corp—as well as the group’s ties to Russian intelligence agencies and even its direct participation in espionage operations targeting NATO allies.

    A WIRED investigation revealed how car-mounted automatic license plate reader cameras are capturing far more than just license plates, including campaign yard signs, bumper stickers, and other politically sensitive text, all examples of how a system for tracking vehicles threatens to become a broader surveillance tool.

    In other news, ICE signed a $2 million contract with Paragon Solutions, a known vendor of spyware including the hacking tool Graphite. And the Pentagon is increasingly adopting handheld controllers for weapons systems in an effort provide more intuitive interfaces to soldiers who have grown up playing Xbox and PlayStation consoles.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    As the politics of America’s biggest city have been turned upside down by the criminal charges against New York mayor Eric Adams, there’s still a “significant wild card” in the corruption case against him, prosecutors said in court this week: The FBI can’t manage to get into his phone.

    Prosecutors in the case against Adams, which centers on alleged illegal payments the mayor received from the Turkish government, revealed that the FBI still hasn’t cracked the encryption on Adams’ personal phone, nearly a year after it was seized. That phone is one of three that the bureau has taken from Adams, but agents seized Adams’ personal phone a day later than the other two devices he used in an official capacity. By that time, Adams had not only changed the passcode on the phone from a four digit PIN to six digits—a measure he says he took to prevent staffers from intentionally or unintentionally deleting information from the device. He also claims he immediately “forgot” that code to unlock it.

    That very convenient amnesia may leave the FBI and prosecutors in a situation similar to their investigation into the San Bernardino mass shooting carried out by Syed Rizwan Farook in 2016, when the US government demanded Apple help unlock the shooter’s encrypted iPhone, leading to a high-profile standoff between the Apple and the FBI. In that case, the cybersecurity firm Azimuth eventually used a closely guarded—and expensive—hacking technique to unlock the device. In Adams’ case, prosecutors hinted that the FBI may have to resort to similar measures. “Decryption always catches up with encryption,” a prosecutor in the case, Hagan Scotten, told the judge.

    Face recognition is one of only a few technologies that even Facebook and Google have hesitated to integrate into products like Google Glass and the Ray-Ban Meta smart glasses—and rightly so, given the privacy implications of a device that would allow anyone to look at a stranger on the street and immediately determine their phone number and home address. Now, however, a group of Harvard students has shown how easy it is to bolt that face recognition onto Meta’s augmented-reality eyewear. The project, known as I-XRAY, integrates with the face-recognition service Pimeyes to let Ray-Ban Meta wearers learn the name of virtually anyone they see and then immediately scour databases of personal information to determine other info about them, including names of family members, phone numbers, and home addresses. The students say they’re not releasing the code for their experiment, instead intending it as a demonstration of the privacy-invasive potential of augmented-reality devices. Point made.

    If that warning about the privacy risks of AR eyewear needed more reinforcement, Meta this week also conceded to TechCrunch that it will use input from users’ smart glasses to train its AI products. Initially, Meta declined to answer TechCrunch’s questions about whether and how it would collect information from Ray-Ban Meta smart glasses for use as AI training data, in contrast to companies like OpenAI and Anthropic that explicitly say they don’t exploit user inputs to train their AI services. A couple of days later, however, Meta confirmed to TechCrunch that it does in fact use images or video collected through its smart glasses to train its AI, but only if the user submits them to Meta’s AI tools. That means anything that a user sees and asks Meta’s AI chatbot to comment on or analyze will become part of Meta’s massive AI-training data trove.

    If you can’t arrest Russian hackers, at least you can nab their web domains. That, at least, is the approach this week of the US Justice Department, which along with Microsoft and the NGO Information Sharing and Analysis Center used a lawsuit to take control of more than a hundred web domains that had been used by Russian hackers working for the Kremlin’s intelligence and law enforcement agency known as the FSB. Those domains had been exploited in phishing campaigns by the Russian hacker group known as Star Blizzard, which has a history of targeting the typical victims of geopolitical spying such as journalists, think tanks, and NGOs. The domain seizures seem designed in part to head off threats of foreign interference in next month’s US election. “Rebuilding infrastructure takes time, absorbs resources, and costs money,” Steven Masada, the assistant general counsel of Microsoft’s Digital Crimes Unit, said in a statement. “Today’s action impacts [the hackers’] operations at a critical point in time when foreign interference in US democratic processes is of utmost concern.”

    [ad_2]

    Andy Greenberg

    Source link

  • Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat

    Neo-Nazis Are Fleeing Telegram for Encrypted App SimpleX Chat

    [ad_1]

    Dozens of neo-Nazis are fleeing Telegram and moving to a relatively unknown secret chat app that has received funding from Twitter founder Jack Dorsey.

    In a report from the Institute for Strategic Dialogue published on Friday morning, researchers found that in the wake of the arrest of Telegram founder Pavel Durov and charges against leaders of the so-called Terrorgram Collective, dozens of extremist groups have moved to the app SimpleX Chat in recent weeks over fears that Telegram’s privacy policies expose them to being arrested. The Terrorgram Collective is a neo-Nazi propaganda network that calls for acolytes to target government officials, attack power stations, and murder people of color.

    While ISD stopped short of naming SimpleX in its report, the researchers point out that the app promotes itself as “having a different burner email or phone for each contact, and no hassle to manage them.” This is exactly how SimpleX refers to itself on its website.

    Last month, one accelerationist group linked to the now defunct neo-Nazi terrorist group Atomwaffen Division, with more than 13,000 subscribers on Telegram, began migrating to SimpleX. Administrators of the channel advised subscribers that “while it’s not as smooth as Telegram, it appears to be miles ahead with regard to privacy and security.”

    The group now has 1,000 members on SimpleX and, according to ISD, is “part of a wider network built by neo-Nazi accelerationists that consists of nearly 30 channels and group chats,” which includes other well-known accelerationist groups like the Base. Accelerationists seek to speed up the downfall of Western society by triggering a race war in order to rebuild civilization based on their own white Christian values.

    The network of groups on SimpleX are also sharing extremist content, including al-Qaeda training manuals, Hamas rocket development guides, neo-Nazi accelerationist handbooks, and militant anarchist literature. And in their newly secure channels on SimpleX, the members of the groups have immediately made direct calls for violence.

    “During a 24-hour period on September 25, analysts observed three instances of users calling for the assassination of Vice President Kamala Harris, and one instance calling for the assassination of former President Donald Trump,” the ISD researchers wrote. “Similarly, numerous users called for a race war that would hasten the fall of society, allow them to take the US by force, and institute their desired system of white supremacy.”

    SimpleX Chat is an app that was founded by UK-based developer Evgeny Poberezkin. It was initially launched in 2021, and a blog post in August announced that it had passed 100,000 downloads on Google’s Play store. The same blog post announced that Dorsey had led a $1.3 million investment round, having previously praised the app on other social media platforms. Dorsey did not reply to a request for comment.

    For years, neo-Nazi groups have flourished on Telegram, many of them under the assumption that Telegram was a fully encrypted platform that provided a greater level of security than it really did. Telegram was used by these groups for building out their networks, sharing propaganda, and planning attacks. However, two of the leaders of the Terrorgram Collective were arrested and charged last month, which was a key factor in triggering the migration to SimpleX, the ISD analysts wrote. The group used Telegram to encourage acts of terrorism in the US and overseas.

    [ad_2]

    David Gilbert

    Source link

  • XRP Price Crashes 12% as SEC Appeals in the Ripple Lawsuit

    XRP Price Crashes 12% as SEC Appeals in the Ripple Lawsuit

    [ad_1]

    On Oct. 2, the US Securities and Exchange Commission filed a notice of appeal in the Ripple lawsuit seeking to overturn an earlier ruling.

    The agency has appealed a 2023 verdict set by Judge Torres, which ruled that secondary sales of Ripple’s XRP token did not constitute securities sales.

    The judge ruled that XRP failed to satisfy all the conditions for the SEC’s Howey test to be classified as an investment contract.

    The filing was shared by defense lawyer James Filan on X.

    Ripple Fights Back

    Ripple chief legal officer Stuart Alderoty said the appeal was “disappointing, but not surprising.”

    He added that this just prolongs what is “already a complete embarrassment for the agency.”

    “The Court already rejected the SEC’s suggestion that Ripple acted recklessly, and there were no allegations of fraud and, of course, there were no victims or losses.”

    He said that the SEC “continues to engage in litigation warfare against the industry” before adding that the firm is evaluating whether to file a cross-appeal.

    Ripple CEO Brad Garlinghouse also addressed X on Oct. 3, stating that if SEC chair Gary Gensler and the regulator were rational, “they would have moved on from this case long ago.”

    He vowed to continue fighting as long as necessary:

    “While we’ll fight in court for as long as we need, let’s be clear: XRP’s status as a non-security is the law of the land today – and that does not change even in the face of this misguided – and infuriating – appeal.”

    Candidate for Massachusetts Senator John Deaton unleashed a tirade on X, stating that a candidate wouldn’t typically comment on an appeal:

    “However, I’m not your typical candidate and I spent hundreds of pro bono hours and over $75K of my own money, fighting gross overreach and misconduct at the SEC.”

    Almost four years after suing Ripple and making the above ridiculous claims, SEC lawyers apologized (in a different case) for suggesting tokens themselves were securities, he said before adding:

    “Because the SEC is pursuing an anti-crypto agenda, it will now waste more taxpayer money. Gary Gensler is a disgrace.”

    XRP Tanks

    The news has rattled XRP holders who have been aggressively selling the asset, resulting in a 12% slump on the day.

    The asset was trading above $0.60 on Oct. 2 but crashed to bottom out at just below $0.53 during early trading in Asia on Thursday morning.

    XRP is currently at a three-week low and still trading down 84% from its January 2018 all-time high despite recent ETF applications.

    Source: CoinGecko
    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER 2024 at BYDFi Exchange: Up to $2,888 welcome reward, use this link to register and open a 100 USDT-M position for free!

    [ad_2]

    Martin Young

    Source link

  • ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

    ICE Signs $2 Million Contract With Spyware Maker Paragon Solutions

    [ad_1]

    Paragon was founded in 2019 by veterans from the Israel Defense Forces’ powerful intelligence Unit 8200 with the active involvement of former Israeli prime minister Ehud Barak as an investor who is estimated to own a sizable slice of the company.

    The company has received investment from the Boston-headquartered Battery Ventures, “considered to be one of the world’s top venture capital firms,” and two of its founders formerly worked for Blumberg Capital, another large US venture capital firm.

    Israeli media reported in June that a US private equity fund with a portfolio of security companies has been in talks to acquire control of Paragon, estimating its valuation at $1 billion.

    To secure its unique US-approved, “ethical” positioning, Paragon has made “deliberate efforts” since its establishment to break into the US market, notes the Atlantic Council.

    In 2019, as Paragon was developing Graphite, the company enlisted WestExec Advisors, a prominent Washington, DC, consulting firm cofounded by former Obama administration officials, including current US secretary of state Antony Blinken, to advise on its “strategic approach to the US and European markets,” a company executive told the Financial Times. Avril Haines, a former WestExec staffer, is now the US director of national intelligence.

    To remain in the US government’s “good graces,” Paragon in February 2023 hired another DC-based lobbying firm, Holland & Knight, “with a good track record in avoiding sanctions,” as some reports point out. Lobbying expenditure disclosure reveals a spend of a minimum $280,000 in 2023 and 2024 for this campaign.

    The fact that the spyware vendor has neither been placed on an entity list nor have any of its executives been sanctioned by the Biden administration suggests that Paragon’s lobbying efforts have been successful.

    In addition, Biden’s executive order leaves enough margin for the deployment of tools like Graphite. When a senior US administration official was asked specifically about potential abuses of Paragon’s flagship product, they said that the executive order “requires the heads of agencies to review any activity that might be relevant,” without excluding the possibility of lawful use.

    Meanwhile, the company continues to grow and is advertising several roles in Israel. In the US, Paragon boosted its presence in the wake of the signing of the executive order and started hiring intelligence veterans, including former CIA and FBI officers at its subsidiary, “hoping it would pick up new business.” Fresh reports from February 2024 confirmed the steady growth.

    Paragon’s $2 million contract with ICE is tangible proof that the company’s approach is paying off. It remains to be seen whether Graphite’s deployment will align with the protection of human rights, privacy, and democracy.

    [ad_2]

    Vas Panagiotopoulos

    Source link

  • Educause Sneak Peak

    Educause Sneak Peak

    [ad_1]

    Click below to listen to the full conversation:

    eCampus: We’re just a few weeks away from EDUCAUSE 2024 in San Antonio. Could you give us a preview of your session and share some insights on IT policy in 2024?

    Jarret Cummings: Absolutely. Every year at the conference, we review major policy issues affecting the EDUCAUSE community, and 2024 has been particularly eventful. One issue we’ve been pulled into is the Cybersecurity and Infrastructure Security Agency’s (CISA) proposed cyber incident reporting regulations. Though these aren’t finalized yet, we’ve had to compile our community’s views and concerns about how higher education fits into this process.

    Additionally, the Department of Justice (DOJ) released its final regulations for web and mobile app accessibility under the Americans with Disabilities Act (ADA) Title II. This impacts all public colleges and universities, and we expect these regulations will eventually extend to private institutions as well. Lastly, research cybersecurity has been a hot topic, with new guidelines issued by the Office of Science and Technology Policy. Fitting all of this into 45 minutes at EDUCAUSE will be a challenge, but we’re up for it!

    eCampus: That’s a lot to cover in a short time. For those attending EDUCAUSE or following your work online, how can they feel like they’re part of this conversation? Sometimes policy seems distant—how can individuals engage with these federal regulations?

    Jarret Cummings: It’s a great question. It operates on two levels. First, our EDUCAUSE policy team relies on input from our Member Community Groups. We’re generalists, so we need specific expertise from our members to help

    refine our understanding of these issues and determine appropriate responses. For instance, when preparing comments on the web and mobile accessibility rules, we turned to our IT Accessibility Community Group for insight.

    We’ve done the same with cybersecurity, asking our Chief Information Security Officers (CISOs) and research cybersecurity groups to help us assess the impact of proposed regulations. During conference sessions, we then share the community’s collective input, ensuring everyone is informed and feels represented.

    eCampus: So, you act as an intermediary, amplifying the concerns of the EDUCAUSE community. It’s not just top- down but also grassroots engagement?

    Jarret Cummings: Exactly. On the front end, we
    bring policy issues to our members and gather their perspectives. On the back end, we inform the broader membership about the positions the community has taken and why. It’s a two-way street.

    eCampus: As we approach the EDUCAUSE conference, we’re also nearing a major presidential election. How does an election year impact your work? Do the policies you’re tracking change depending on who wins?

    Jarret Cummings: There are certainly differences
    in priorities between candidates. For example, with accessibility regulations, if a second Trump administration were to take office, we might see regulatory processes put on hold, as happened during his first term. On the other hand, a Harris administration would likely continue moving forward with these regulations.

    Cybersecurity, however, is more bipartisan. For instance, the Department of Education is set to release cybersecurity requirements related to student financial aid data. This rulemaking could happen as soon as October, though I suspect it may be delayed until early 2025, regardless of the election outcome.

    eCampus: Cybersecurity is always top of mind, election year or not. What are the key research cybersecurity challenges, and can you give us a sneak peek at what’s ahead in 2025?

    Jarret Cummings: Research cybersecurity is driven by National Security Presidential Memorandum 33 (NSPM- 33), which started under the Trump administration and has continued under Biden. It outlines guidelines for

    enhancing the security of federally funded research at universities. These guidelines have now been finalized, and institutions must implement robust cybersecurity programs to comply.

    Looking ahead to 2025, institutions with significant federal research funding will need to adapt their security programs to meet these standards. This will remain a critical issue regardless of who wins the election.

    Kevin Hogan
    Latest posts by Kevin Hogan (see all)

    [ad_2]

    Kevin Hogan

    Source link

  • The US Could Finally Ban Inane Forced Password Changes

    The US Could Finally Ban Inane Forced Password Changes

    [ad_1]

    Researchers found a vulnerability in a Kia web portal that allowed them to track millions of cars, unlock doors, honk horns, and even start engines in seconds, just by reading the car’s license plate. The findings are the latest in a string of web bugs that have impacted dozen of carmakers. Meanwhile, a handful of Tesla Cybertrucks have been outfitted for war and are literally being-battle tested by Chechen forces fighting in Ukraine as part of Russia’s ongoing invasion.

    As Israel escalates its attacks on Lebanon, civilians on both sides of the conflict have been receiving ominous text messages—and authorities in each country are accusing the other of psychological warfare. The US government has increasingly condemned Russia-backed media outlets like RT for working closely with Russian intelligence—and many digital platforms have removed or banned their content. But they’re still influential and trusted alternative sources of information in many parts of the world.

    And there’s more. Each week, we round up the privacy and security news we didn’t cover in depth ourselves. Click the headlines to read the full stories. And stay safe out there.

    A new draft of the US National Institute of Standards and Technology’s “Digital Identity Guidelines” finally takes steps to eliminate reviled password management practices that have been shown to do more harm than good. The recommendations, which will be mandatory for US federal government entities and serve as guidelines for everyone else, ban the practice of requiring users to periodically change their account passwords, often every 90 days.

    The policy of regularly changing passwords evolved out of a desire to ensure that people weren’t choosing easily guessable or reused passwords; but in practice, it causes people to choose simple or formulaic passwords so they will be easier to keep track of. The new recommendations also ban “composition rules,” like requiring a certain number or mix of capital letters, numbers, and punctuation marks in each password. NIST writes in the draft that the goal of the Digital Identity Guidelines is to provide “foundational risk management processes and requirements that enable the implementation of secure, private, equitable, and accessible identity systems.”

    The US Department of Justice unsealed charges on Friday against three Iranian men who allegedly compromised Donald Trump’s presidential campaign and leaked stolen data to media outlets. Microsoft and Google warned last month that an Iranian state-sponsored hacking group known as APT42 had targeted both the Joe Biden and Donald Trump presidential campaigns, and successfully breached the Trump campaign. The DOJ claims the hackers compromised a dozen people as part of its operation, including a journalist, a human rights advocate, and several former US officials. More broadly, the US government has said in recent weeks that Iran is attempting to interfere in the 2024 election.

    “The defendants’ own words made clear that they were attempting to undermine former President Trump’s campaign in advance of the 2024 U.S. presidential election,” Attorney General Merrick Garland said at a press conference on Friday. “We know that Iran is continuing with its brazen efforts to stoke discord, erode confidence in the US electoral process, and advance its malign activities.”

    The Irish Data Protection Commission fined Meta €91 million, or roughly $101 million, on Friday for a password storage lapse in 2019 that violated the European Union’s General Data Protection Regulation. Following a report by Krebs on Security, the company acknowledged in March 2019 that a bug in its password management systems had caused hundreds of millions of Facebook, Facebook Lite, and Instagram passwords to be stored without protection in plaintext in an internal platform. Ireland’s privacy watchdog launched its investigation into the incident in April 2019.

    “It is widely accepted that user passwords should not be stored in plaintext, considering the risks of abuse that arise from persons accessing such data,” Irish DPC deputy commissioner Graham Doyle said in a statement. “It must be borne in mind that the passwords, the subject of consideration in this case, are particularly sensitive, as they would enable access to users’ social media accounts.”

    The digital anonymity nonprofit the Tor Project is merging with privacy- and anonymity-focused Linux-based operating system Tails. Pavel Zoneff, the Tor Project’s communications director, wrote in a blog post on Thursday that the move will facilitate collaboration and reduce costs, while expanding both groups’ reach. “Tor and Tails provide essential tools to help people around the world stay safe online,” he wrote. “By joining forces, these two privacy advocates will pool their resources to focus on what matters most: ensuring that activists, journalists, other at-risk and everyday users will have access to improved digital security tools.”

    [ad_2]

    Lily Hay Newman

    Source link