ReportWire

Tag: Security

  • CrowdStrike Faces a Potential Tsunami of Lawsuits. Only the Fine Print Can Save It, Experts Say

    CrowdStrike Faces a Potential Tsunami of Lawsuits. Only the Fine Print Can Save It, Experts Say

    [ad_1]

    On July 19, Jonathan Cardi and his family watched as the departures board at Raleigh-Durham International Airport in North Carolina, turned from green to a sea of red. “Oh my gosh, it was insane,” says Cardi. “Delayed, delayed, delayed, delayed.”

    Cardi, a law professor at Wake Forest University and a member of the American Law Institute, was due to fly with Delta Airlines to a conference in Fort Lauderdale, Florida. With thousands of other travelers, he spent the day lining up as staff kept telling people that flights “would be taking off any minute,” he recalls. But when it became clear that planes were going nowhere, he made the 11-hour journey by rental car instead. Others heading to the conference slept at the airport, Cardi later found out.

    The chaos was the result of a software update released by cybersecurity company CrowdStrike, which contained a defect that crashed millions of Microsoft Windows computers. The IT outage, which disrupted airlines, financial services, and various other industries, is estimated to have caused more than $5 billion in financial losses. “Because there was so much money lost, there is going to be legal action,” says Cardi, who specializes in the field of law concerned with civil liability for losses or harm.

    That legal wrangling is already beginning.

    On July 29, Delta informed CrowdStrike and Microsoft of its intent to sue over the $500 million it claims to have lost as a result of the outage. A class action lawsuit has been filed by law firm Labaton Keller Sucharow on behalf of CrowdStrike shareholders, claiming they were misled over the company’s software testing practices. Another law firm, Gibbs Law Group, has announced it is looking into bringing a class action on behalf of small businesses affected by the outage.

    In response to WIRED’s inquiry about the shareholder class action, CrowdStrike says, “We believe this case lacks merit, and we will vigorously defend the company.” In a letter to Delta’s legal counsel seen by WIRED, a legal representative for CrowdStrike said that the company “strongly rejects any allegation that it was grossly negligent or committed willful misconduct.” Microsoft declined to comment. Delta’s legal counsel declined an interview request.

    Those hoping to recover financial losses will need to find creative ways to frame their cases against CrowdStrike, which is insulated to a great extent by clauses typical of software contracts that limit its liability, Cardi says. Though it may seem intuitive that CrowdStrike be on the hook for its mistake, the company is likely to be “pretty well-guarded” by the fine print, he adds.

    Limitation Clause

    Despite CrowdStrike conceding responsibility for the outage, neither direct customers nor businesses disrupted by proximity—i.e., the customers of CrowdStrike customers—will find it easy to recover their losses. The first question will be: What specifically would they be suing CrowdStrike for? There are a handful of theoretical options—breach of contract, negligence, or fraud—but none of them are straightforward.

    Although customers may argue that CrowdStrike breached its contract in some way, “the amount of money they could recover is likely to be severely limited by the limitation clause,” says Paul MacMahon, associate professor of law at the London School of Economics and Political Science. The purpose of any such clause is to act as a sort of get-out-of-jail-free card, limiting the amount of money a software vendor has to pay out. The specific contents of the contracts entered into by CrowdStrike and its customers will differ from case to case, but the general terms and conditions limit CrowdStrike’s liability to only the amount its customers pay for its services.

    [ad_2]

    Joel Khalili

    Source link

  • A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    A New Plan to Break the Cycle of Destructive Critical Infrastructure Hacks

    [ad_1]

    “It’s not just that the water goes out, it’s that when the sole wastewater facility in your community is down really bad things start to happen. For example, no water means no hospital,” he says. “I really encountered a lot of this during my leadership of the Covid Task Force. There is such interdependence across the basic functions of society.”

    UnDisruptable27 will focus on interacting with communities who aren’t reached by Washington DC-based policy discussions or Information Sharing and Analysis Centers (ISACs), which are meant to represent each infrastructure sector of the US. The project aims to communicate directly with people who actually work on the ground in US critical infrastructure, and grapple together with the reality that cybersecurity-related disasters could impact their daily work.

    “There’s a data breach, you get whatever services like identity protection for some period of time, and life carries on, and people think that there’s no long-term impact,” says Megan Stifel, IST’s chief strategy officer. “There’s this expectation that it’s fine, things will just continue. So we’re very interested in getting after this issue and thinking about how do we tackle critical infrastructure security with perhaps a new approach.”

    Corman notes that even though cybersecurity incidents have become a well-known fact of life, business owners and infrastructure operators are often shaken and caught off guard when a cybersecurity incident actually affects them. Meanwhile, when government entities try to impose cybersecurity standards or become a partner on defense initiatives, communities often balk at the intrusion and perceived overreach. Last year, for example, the US Environmental Protection Agency was forced to rescind new cybersecurity guidelines for water systems after water companies and Republicans in Congress filed a lawsuit over the initiative.

    “Time and time again, trade associations or lobbyists or owners and operators have an allergic reaction to oversight and say, ‘We prefer voluntary, we’re doing fine on our own,’ ” Corman says. “And they really are trying to do the right thing. But then also time and time again, people are just shocked that disruption could happen and feel very blindsided. So you can only conclude that the people who feel the pain of our failures are not included in the conversation. They deserve to understand the risks inherent in this level of connectivity. We’ve tried a lot of things, but we have not tried just leveling with people.”

    UnDisruptable27 is launching this week for visibility among attendees at BSides as well as the other conferences, Black Hat and Defcon, that will run through Sunday in Las Vegas. Corman says that the goal is to combine the hacker mentality and, essentially, a call for volunteers with plans to work with creative collaborators on producing engaging content to fuel discourse and understanding. Information campaigns using memes and social media posts or moonshots like narrative podcasts and even reality TV are all on the table.

    “We must prioritize the security, safety, and resilience of critical infrastructure — including water, health care facilities, and utilities,” Craig Newmark, the Craigslist founder whose philanthropy is funding UnDisruptable27, told WIRED. “The urgency of this issue requires affecting human behavior through storytelling.”

    [ad_2]

    Lily Hay Newman

    Source link

  • Gloucester Police welcomes two new officers

    Gloucester Police welcomes two new officers

    [ad_1]

    Two new officers who are also Gloucester natives have joined the ranks of the Gloucester Police Department.

    Officers Ryan Muniz and Kalyn Koller bring a wealth of knowledge, enthusiasm, and a commitment to serving Gloucester, the department said.

    Muniz graduated from the Massachusetts Police Training Committee Northern Essex Community College Police Academy in May. He attended Gloucester Public Schools and graduated from Gloucester High in 2019. In high school, he played hockey, golf, and tennis, and captained the hockey and golf teams.

    After high school, Muniz attended the University of Massachusetts Amherst, graduating in 2023 with a bachelor’s degree. Following his graduation, he worked at the Essex County Sheriff’s Department before joining the Gloucester force. Muniz recently completed his field training and is now eager to make a positive impact and engage with the community he has always called home, the department said.

    Koller graduated from the MPTC Lynnfield Police Academy last Tuesday and began her field training shortly thereafter. Koller, 24, is a Gloucester native who graduated from Rockport High in 2019, where she played softball and basketball. She earned her criminal justice degree from Endicott College, graduating with dean’s lst honors. During her time at Endicott, Koller interned with the Gloucester Police Department, an experience that solidified her dedication to a career in law enforcement.

    “I am honored to announce my appointment as a new officer with the Gloucester Police Department. I look forward to serving and giving back to the community I have always called home,” she said.

    Chief Edward Conley expressed his confidence in the new officers, saying, “We are thrilled to welcome Officers Muniz and Koller to our team. Their dedication, local roots, and commitment to service will undoubtedly strengthen our department and enhance our ability to serve the Gloucester community.”

    [ad_2]

    By Times Staff

    Source link

  • Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

    Sensitive Illinois Voter Data Exposed by Contractor’s Unsecured Databases

    [ad_1]

    Databases containing sensitive voter information from multiple counties in Illinois were openly accessible on the internet, revealing 4.6 million records that included driver’s license numbers as well as full and partial Social Security Numbers and documents like death certificates. Longtime security researcher Jeremiah Fowler stumbled upon one of the databases that appeared to contain information from DeKalb County, Illinois and subsequently discovered another 12 exposed databases. None were password protected nor required any type of authentication to access.

    As criminal and state-backed hacking becomes ever more sophisticated and aggressive, threats to critical infrastructure loom. But often, the biggest vulnerabilities come not from esoteric software issues, but from gaping errors that leave the safe door open and the crown jewels exposed. After years of efforts to shore up election security across the United States, state and local awareness about cybersecurity issues has improved significantly. But as this year’s US election quickly approaches, the findings reflect the reality that there are always more oversights to catch.

    “I’ve found voter databases in the past, so I kind of know if it’s a low-level marketing outreach database that someone has purchased,” Fowler tells WIRED. “ But here I saw voter applications— there were actually scans of documents, and then screenshots of online applications. I saw voter rolls for active voters, absentee voters with email addresses, some of them military email addresses. And when I saw Social Security numbers and driver’s license numbers and death certificates I was like, ‘OK, those shouldn’t be there.’”

    Through public records, Fowler determined that all of the counties appear to contract with an Illinois-based election management service called Platinum Technology Resource, which provides voter registration software and other digital tools along with services like ballot printing. Many counties in Illinois use Platinum Technology Resource as an election services provider, including DeKalb, which confirmed its relationship with Platinum to WIRED.

    Fowler reported the unprotected databases to Platinum on July 18, but he says he didn’t receive a response and the databases remained exposed. As Fowler dug deeper into public records, he realized that Platinum works with the Illinois-based managed services provider Magenium, so he sent a disclosure to this company as well on July 19. Again, he says he did not receive a response, but shortly after the databases were secured, pulling them from public view. Platinum and Magenium did not return WIRED’s multiple requests for comment.

    Platinum began distributing a notification, viewed by WIRED, to impacted counties on Friday. “We have evidence of a claim the file storage containing voter registration documents may have been scanned,” Platinum wrote, adding that the exposed databases do not indicate a deeper compromise of its systems. “There was a thorough investigation executed. The findings support our ongoing belief there is no evidence of voter registration forms being leaked or stolen. … We used this opportunity to deploy new and additional safeguards around voter registration documents.”

    Illinois’s data breach notification law requires notification to the state within 45 days of an incident. A standard version of a Champaign County contract for technology services posted publicly through a Freedom of Information Act request requires a contractor to notify the impacted county within 15 minutes of identifying a data breach.

    Fowler points out that while the exposed information would potentially make impacted individuals more susceptible to identity theft and other scams, it could also be abused to submit multiple absentee ballot requests or to conduct other suspicious activity that could call a voter’s legitimate vote into question and take time to reconcile. But he adds that the death certificates and other documentation contained in the trove reflects the work election officials do all over the country to manage voter registrations and ensure that everyone’s vote is accurately counted.

    “There’s definitely progress on basic data security, and I don’t see stuff like this very often anymore,” Fowler says. “But I used the open and public internet and no specialized tools to find this. And at the end of the day, this is critical infrastructure that was exposed.”

    [ad_2]

    Lily Hay Newman

    Source link

  • Metrasens Entrusted by Public Schools Nationwide as Strategic Partner in Extracurricular Event Safety

    Metrasens Entrusted by Public Schools Nationwide as Strategic Partner in Extracurricular Event Safety

    [ad_1]

    NAPERVILLE, Ill. /PRNewswire-PRWeb/ —  Metrasens, a leading provider of advanced detection systems for security and safety applications, today announced its ongoing strategic partnerships with K-12 public school districts across the United States. By addressing the critical issue of extracurricular event safety, Metrasens solidifies its position as a leader in school safety and the go-to partner for enhancing security at campus events.

    In today’s dynamic security landscape within educational settings, ensuring safety during extracurricular events has become a top priority for school administrators and athletic directors nationwide. According to the  K-12 School Shooting Database, there has been a concerning increase in shooting incidents at these events. From 2022 to 2023 alone, there was a 50% rise in K-12 school shootings during school events, and a staggering 300% increase from 2019 to 2023.

    “School districts adopting safety and security partners like Metrasens are taking practical steps in prioritizing school safety,” stated Ryan Petty, Florida State Board of Education member and father of Alaina Petty, a victim of the 2018 Marjory Stoneman Douglas High School shooting. Post this

    Ryan Petty, Florida State Board of Education member and father of Alaina Petty, a victim of the 2018 Marjory Stoneman Douglas High School shooting, emphasizes the importance of proactive safety measures. “Schools can, and should continue to take practical steps towards building a safer environment for students on campuses, not only during school hours, but also during extracurricular events,” said Petty. “School districts adopting safety and security partners like Metrasens are taking practical steps in prioritizing school safety.”

    Recognizing this critical issue, Metrasens has been chosen by public schools nationwide as a strategic partner in enhancing extracurricular event safety and addressing related challenges, such as the prevalence of vaping on campuses. With 300 systems deployed across more than 30 school districts and 200 individual schools, Metrasens is at the forefront of safeguarding students and staff and prioritizing compliance.

    Fort Worth Independent School District (FWISD) selected Metrasens to bolster safety measures for graduation ceremonies and extracurricular events. Daniel Garcia, Safety & Security Executive Director at Fort Worth ISD stated: “With regards to Fort Worth ISD graduations and other ceremonies, it’s paramount that students, faculty, and visiting families feel assured and confident as they come together to commemorate these special occasions. As we open our facilities to families, it’s essential to offer reassurance that Metrasens Ultra systems provide a completely safe solution for all members of our school community.”

    In Tulsa Public Schools (TPS) independent school district in Oklahoma, Metrasens’ state-of-the-art security screening systems bolster safety protocols across 77 learning communities.

    Dr. Matthias Wicks, former Chief of Police at Tulsa Public Schools, emphasized the district’s unwavering commitment to securing all facilities and events, stating: “To accomplish our safety goals, we deployed Metrasens Ultra technologies and steadfast safety protocols to protect the well-being of everyone in attendance at our extracurricular events.”

    Similarly, Moore Public Schools (MPS), Oklahoma’s fourth-largest public school district, collaborated with Metrasens to bolster safety measures across 35 campus sites and large venues. Embracing a proactive stance towards safety, MPS integrated Metrasens Ultra detection systems to maintain the highest security standards. Dustin Horstkoetter, MPS Safety and Security Director, commended Metrasens for its unmatched reliability and quality, affirming, “the reliability and quality of Metrasens solutions are incomparable.”

    Further solidifying its position as a leader in school security, Barberton High School (BHS), situated within Ohio’s Barberton City School District, chose Metrasens as a pivotal partner in its proactive approach to campus security. Recognizing the need to enhance security protocols in light of recent incidents targeting schools nationwide, BHS aimed to stay ahead of potential risks and ensure the safety of its students and staff through this partnership.

    “We believe having another layer of security that is non-intrusive and is safe to use is a logical step forward,” said Jeff Ramnytz, Superintendent of Barberton City Schools. “We highly recommend Metrasens to other school districts seeking to enhance their security measures.”

    “Extracurricular events such as football games, basketball tournaments, and other school activities often attract individuals from inside as well as outside the immediate community, presenting unique security challenges,” said Todd Hokunson, Chief Commercial Officer at Metrasens. “In response to these concerns, Metrasens is committed to shaping the safety landscape in educational environments through innovative solutions and strategic partnerships.”

    These key partnerships underscore Metrasens’ dedication to providing innovative solutions that prioritize safety and compliance in educational settings. As administrators and safety directors continue to navigate evolving security challenges, whether securing extracurricular school activities or addressing the growing issue of vape usage on campus, Metrasens remains steadfast in its mission to empower educators and protect students, ensuring a secure environment conducive to learning and growth.

    About Metrasens
    Metrasens is the world’s leading provider of advanced magnetic detection technologies. With a technology center and manufacturing facility in the United Kingdom, a North American sales and customer service hub in Chicago and a global network of distributors, the company’s innovative products are designed to address deficiencies in conventional screening methods and make the world safer and more secure. Metrasens’ mission is to take cutting-edge science from the laboratory and use it to create revolutionary, award-winning products that meet the distinct and diverse security needs of its customers. Metrasens’ core technologies have a wide range of real-world applications, embodied by solutions that are easy to adopt and simple to use.

    For more information, visit  http://www.metrasens.com

    eSchool News Staff
    Latest posts by eSchool News Staff (see all)

    [ad_2]

    ESchool News Staff

    Source link

  • How Infostealers Pillaged the World’s Passwords

    How Infostealers Pillaged the World’s Passwords

    [ad_1]

    These platforms take cues in how they are designed and marketed from legitimate information and ecommerce services. Many markets and forums charge a subscription fee to access the platform and then have different pricing structures for data depending on how valuable it might be. Currently, Gray says, Russian Market has so much stolen data available from infostealers that it has been charging a low flat rate, typically no more than $10, for any subset of data users want to download.

    “Organizations have become very good with their security, and people have also gotten more savvy, so they’re not the best targets now,” for traditional tailored attacks, Gray says. “So attackers need something that’s less targeted and more based on what they can make use of. Infostealers are modular and often sold on a subscription basis, and that evolution probably aligns with the rise of modern subscription services like video streaming.”

    Infostealers have been especially effective with the rise of remote work and hybrid work, as companies adapt to allowing employees to access work services from personal devices and personal accounts from work devices. This creates opportunities for infostealers to randomly compromise individuals on, say, their home computers but still end up with corporate access credentials because the person was logged into some of their work systems as well. It also makes it easier for infostealing malware to get around corporate protections, even on enterprise devices, if employees are able to have their personal email or social media accounts open.

    “I started paying attention to this once it became an enterprise problem,” Mandiant’s Carmakal says. “And particularly around 2020, because I started seeing more intrusions of enterprises first starting from compromises of home computers—through phishing of people’s Yahoo accounts, Gmail accounts, and Hotmail accounts that were totally unrelated to any enterprise targeting, but to me look very opportunistic.”

    Victoria Kivilevich, director of threat research at security firm KELA, says that in some instances criminals can use cybercrime markets to search for the domain of potential targets and see if any credentials are available. Kivilevich says the sale of infostealer data can be considered as the “supply chain” for various types of cyberattacks, including ransomware operators looking for the details of potential victims, those involved in business email compromise, and even initial access brokers who can sell the details along again to other cybercriminals.

    On various cybercrime marketplaces and Telegram, Kivilevich says, there have been more than 7,000 compromised credentials linked to Snowflake accounts being shared. In one instance, a criminal has been touting access to 41 companies from the education sector; another cybercriminal claims to be selling access to US companies with revenues between $50 million and $8 billion, according to Kivilevich’s analysis.

    “I don’t think there was one company that came to us and had zero accounts compromised by infostealer malware,” Kivilevich says of the threat that infostealer logs provide to businesses, with KELA saying infostealer-related activity jumped in 2023. Irina Nesterovsky, KELA’s chief research officer, says millions of credentials have been collected by infostealing malware in recent years. “This is a real threat,” Nesterovsky says.

    Carmakal says there are multiple steps companies and individuals can take to protect themselves from the threat of infostealers and their aftereffects, including using antivirus or EDR products to detect malicious activity. Companies should be strict on enforcing multifactor authentication across their users, he says. “We try to encourage people to not synchronize passwords on their corporate devices with their personal devices,” Carmakal adds.

    The use of infostealers has been working so well that it is all but inevitable that cybercriminals will look to replicate the success of compromise sprees like Snowflake and get creative about other enterprise software services that they can use as entry points for access to an array of different customer companies. Carmakal warns that he expects to see this result in more breaches in the coming months. “There’s no ambiguity about this,” he says. “Threat actors will start hunting for infostealer logs, and looking for other SaaS providers, similar to Snowflake, where they log in and steal data, and then extort those companies.”

    [ad_2]

    Lily Hay Newman, Matt Burgess

    Source link

  • Stop X’s Grok AI From Training on Your Tweets

    Stop X’s Grok AI From Training on Your Tweets

    [ad_1]

    The fallout from CrowdStrike’s deleterious software update came into full view this week as system administrators and IT staffers scrambled to get digital systems back online and return operations to normal. Elsewhere, the Olympics began this week, and Paris is ready with a controversial new surveillance system that hints at a future of ubiquitous CCTV camera coverage. And researchers revealed new findings this week about the innovative malware Russia used in January to sabotage a heating utility in Lviv and cut heat to 600 Ukrainian buildings at the coldest point in the year.

    The US Department of Defense has a $141 billion idea to modernize US intercontinental ballistic missiles and their silos around the country. Meanwhile, the European Commission is allocating €7.3 billion for defense research—from drones and tanks to battleships and space intelligence—over the next seven years. And hackers have established a “ghost” network to quietly spread malware on the Microsoft-owned developer platform GitHub.

    In more encouraging news, a former Google engineer has built a prototype search engine, dubbed webXray, meant to allow users to find specific privacy violations online, determine which sites are tracking you, and see where all that data goes.

    And there’s more. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    Leaked files obtained by The Guardian reveal that the Israeli government took extraordinary measures to prevent information about the Pegasus spyware system from falling into the hands of US courts, including seizing files directly from the company to prevent legal disclosure. The spyware is the product of the Israel-based NSO Group. It allows users to infect smartphones, extract messages and photos, record calls, and secretly activate microphones. NSO Group faces legal action in the US brought by WhatsApp, which claims the company engineered Pegasus to target users of its messaging software. According to WhatsApp, more than 1,400 of its users were targeted. NSO, whose software has been allegedly tied to the harassment and murder of journalist Jamal Khashoggi, has denied any wrongdoing.

    In an effort to thwart BIOS-based threats, prompted in part by the rollout of a powerful rootkit designed by a Chinese researcher in 2007, Secure Boot became a widely adopted tool. Unfortunately, researchers at the security firm Binarly have revealed that Secure Boot is now “completely compromised” on more than 200 device models, affecting major hardware manufacturers like Dell, Acer, and Intel. The incident was the result of a weak cryptographic key used to establish trust between hardware and firmware systems. AMI, the key’s owner, says it was meant to be used for testing and should never have made its way into production.

    Following in Meta’s footsteps, Elon Musk’s X quietly adjusted its settings this week to give the company’s AI system—known as Grok—access to all of its users’ posts. There is a way to prevent Grok from ingesting your posts; however, you cannot perform this action from the mobile app. You’ll need to access X’s Settings using a desktop computer; select Privacy and Safety, then select Grok, and then uncheck the box. Or just head straight here to go directly to the right settings page. (You can also delete your conversation history with Grok, if you have one, by clicking Delete conversation history.)

    [ad_2]

    Dell Cameron, Lily Hay Newman

    Source link

  • Boost Business Efficiency with Five Years of Control D for $40 | Entrepreneur

    Boost Business Efficiency with Five Years of Control D for $40 | Entrepreneur

    [ad_1]

    Disclosure: Our goal is to feature products and services that we think you’ll find interesting and useful. If you purchase them, Entrepreneur may get a small share of the revenue from the sale from our commerce partners.

    As a business owner, managing your online activities efficiently and securely is crucial for maintaining productivity and protecting your business. The Control D Some Control Plan offers a comprehensive solution with a five-year subscription for just $39.99 (reg. $120)—and an extra $5 off with code CONTROL at checkout.

    This plan not only enhances your browsing speed and security but also helps you enforce a productivity schedule, keep your kids safe online, and manage multiple devices with customized rules.

    Optimize your online activity.

    Control D optimizes your internet connection by blocking ads that can slow things down, helping you get faster browsing speeds. This enables you to work quicker, improving overall efficiency. And with security features, it protects your data and online activities from potential threats, providing peace of mind as you navigate the web.

    The internet can be an entertaining place. It’s very easy to get sucked down a rabbit hole of trending stories. However, that’s a big time waster. Control D allows you to create a productivity schedule that blocks distracting websites and content during work hours to help you stay focused on important tasks and projects.

    Since you get access on up to ten devices, you could use Control D at home, too. If you have little ones at home, it provides tools to help your kids navigate the internet safely. Set age-appropriate restrictions and block harmful content to ensure a safe online environment for your children. You can stay informed about your kids’ online activities and manage their internet usage.

    Well reviewed.

    This tool has 5/5 stars on Product Hunt and allows you to switch your location to any of more than 100 worldwide locations, which can help circumvent censorship while traveling.

    Don’t miss this great deal on five years of Some Control, which is way better than no control.

    The Control D Some Control Plan is on sale for just $39.99 (reg. $120), and you can get an extra $5 off with code CONTROL at checkout for a best-of-web price.

    StackSocial prices subject to change.

    [ad_2]

    StackCommerce

    Source link

  • Huge Microsoft Outage Linked to CrowdStrike Takes Down Computers Around the World

    Huge Microsoft Outage Linked to CrowdStrike Takes Down Computers Around the World

    [ad_1]

    Banks, airports, TV stations, hotels, and countless other businesses are all facing widespread IT outages, leaving flights grounded and causing widespread disruption, after Windows machines have displayed errors worldwide.

    In the early hours of Friday, companies in Australia running Microsoft’s Windows operating system started reporting devices showing Blue Screens of Death (BSODs). Shortly after, reports of disruptions started flooding in from around the world, including from the UK, the Netherlands, and the US: TV station Sky News went offline, and US airlines United, Delta, and American Airlines issued a “global ground stop” on all flights.

    The widespread Windows outages have been linked to a software update from cybersecurity giant ​​Crowdstrike. It is not believed the issues are linked to a malicious cyberattack. Engineers from the company posted to the company’s Reddit forum that it has seen “widespread reports of BSODs on Windows hosts” occurring across its software, is working on the problem, and has advised a workaround for impacted systems.

    The incident, so far, appears to only be impacting devices running Windows and not other operating systems. It is unclear exactly how widespread the issues are and how long they will take to resolve. Microsoft and Crowdstrike did not immediately respond to WIRED’s requests for comment on the outage.

    However, the incident could result in “millions” being lost by organizations impacted who have had to halt their operations or stop business, says Lukasz Olejnik, an independent cybersecurity consultant, who says the Crowdstrike update appears to be linked to its Falcon Sensor product. The Falcon system is part of Crowdstrike’s security tools and can block attacks on systems, according to the company.

    “It reminds us about our dependence on IT and software,” Olejnik says. “When a system has several software systems maintained by various vendors, this is equivalent to placing trust on them. They may be a single point of failure—like here, when various firms feel the impact.”

    This is a developing story and is being updated with new information.

    [ad_2]

    Matt Burgess

    Source link

  • The stepped-up security around Trump is apparent, with agents walling him off from RNC crowds

    The stepped-up security around Trump is apparent, with agents walling him off from RNC crowds

    [ad_1]

    On the floor of the Republican National Convention Tuesday evening, vice presidential candidate JD Vance greeted and shook hands with excited delegates as he walked toward his seat.Video above: See former President Donald Trump’s entrance at Day 2 of the RNCIt was a marked contrast from former President Donald Trump, who entered the hall a few minutes later and was separated from supporters by a column of Secret Service agents. His ear still bandaged after an attempted assassination, Trump closely hugged the wall. Instead of handshakes or hellos for those gathered, he offered fist pumps to the cameras.The contrast underscores the new reality facing Trump after a gunman opened fire at his rally in Pennsylvania Saturday, raising serious questions about the agency that is tasked with protecting the president, former presidents and major-party candidates. Trump’s campaign must also adjust to a new reality after he came millimeters from death or serious injury — and as law enforcement warns of the potential for more political violence. Trump campaign officials declined to comment on the stepped-up security and how it might impact his interactions going forward. “We do not comment on President Trump’s security detail. All questions should be directed to the United States Secret Service,” said Trump campaign spokesperson Steven Cheung.Homeland Security Secretary Alejandro Mayorkas, whose agency oversees the Secret Service, said Monday that he could not discuss “specifics of the protection or the enhancements made, as they involve sensitive tactics and procedures. I can say, however, that personnel and other protective resources, technology, and capabilities have been added.”Video below: Get the Facts: Verifying claims made about security at Trump rallyThe Secret Service had already stepped up Trump’s protection in the days before the attack following an unrelated threat from Iran, two U.S. officials said Tuesday. But that extra security didn’t stop the gunman, who fired from an adjacent roof, from killing one audience member and injuring two others along with Trump.The FBI and Homeland Security officials remain “concerned about the potential for follow-on or retaliatory acts of violence following this attack,” according to a joint intelligence bulletin by Homeland Security and the FBI and obtained by The Associated Press. The bulletin warned that lone actors and small groups will “continue to see rallies and campaign events as attractive targets.”Underscoring the security risks, a man armed with an AK-47 pistol, wearing a ski mask and carrying a tactical backpack was taken into custody Monday near the Fiserv Forum, where the convention is being held.The attack has led to stepped-up security not only for Trump. President Joe Biden’s security has also been bolstered, with more agents surrounding him as he boarded Air Force One to Las Vegas on Monday night. Independent candidate Robert F. Kennedy Jr. also received Secret Service protection in the shooting’s wake.Related video below: Biden orders Secret Service for RFK Jr.Trump’s campaign has also responded in other ways, including placing armed security at all hours outside their offices in Florida and Washington, D.C.Trump has already scheduled his next rally in Grand Rapids, Michigan, on Saturday. That’s where he will appear with Vance for their first event as a presidential ticket. But the new posture complicates, at least for now, the interactions Trump regularly has with supporters as he signs autographs, shakes hands and poses for selfies at events and on airplane tarmacs.In many cities he visits, the campaign assembles enthusiastic supporters in public spaces like restaurants and fast food joints. Sometimes Trump stops by unannounced. The images and video of his reception and interactions — circulated online by his campaign staffers and conservative media — have been fundamental to his 2024 campaign.During the GOP primaries, in particular, his easy interactions served as a contrast to his more awkward top rival, Florida Gov. Ron DeSantis. But those events can get rowdy and chaotic. While he was in New York during his criminal hush money trial, Trump aides arranged a series of visits to a local bodega, a local firehouse and a construction site. Before his arrival at the bodega in Harlem, thousands of supporters and onlookers gathered behind metal barricades for blocks to watch his motorcade arrive and cheer. But others in the neighborhood were frustrated by the visit, including people being dropped off at a bus stop just in front of the store, and others trying to enter their apartments after work. At one point, an individual who lived in the building started shouting from a window that was just above the entrance where Trump would eventually stand and give remarks to the cameras and answer reporters’ questions.Long before the shooting, convention organizers had clashed with the Secret Service over the location of protest zones at the convention. RNC leaders repeatedly asked officials to keep protesters farther back than had been originally planned, arguing that an existing plan “creates an elevated and untenable safety risk to the attending public.”One person familiar with the dispute said that the original plan would have put protesters “a softball throw away” from delegates and close enough to throw projectiles over the fence.The protest area was eventually moved, but the episode still raises frustrations and suspicions among some Trump allies.___Associated Press writer Colleen Long in Washington contributed to this report.

    On the floor of the Republican National Convention Tuesday evening, vice presidential candidate JD Vance greeted and shook hands with excited delegates as he walked toward his seat.

    Video above: See former President Donald Trump’s entrance at Day 2 of the RNC

    It was a marked contrast from former President Donald Trump, who entered the hall a few minutes later and was separated from supporters by a column of Secret Service agents. His ear still bandaged after an attempted assassination, Trump closely hugged the wall. Instead of handshakes or hellos for those gathered, he offered fist pumps to the cameras.

    The contrast underscores the new reality facing Trump after a gunman opened fire at his rally in Pennsylvania Saturday, raising serious questions about the agency that is tasked with protecting the president, former presidents and major-party candidates. Trump’s campaign must also adjust to a new reality after he came millimeters from death or serious injury — and as law enforcement warns of the potential for more political violence.

    Trump campaign officials declined to comment on the stepped-up security and how it might impact his interactions going forward.

    “We do not comment on President Trump’s security detail. All questions should be directed to the United States Secret Service,” said Trump campaign spokesperson Steven Cheung.

    Evan Vucci

    Republican presidential candidate former President Donald Trump arrives during the second day of the Republican National Convention at the Fiserv Forum, Tuesday, July 16, 2024, in Milwaukee. (AP Photo/Evan Vucci)

    Homeland Security Secretary Alejandro Mayorkas, whose agency oversees the Secret Service, said Monday that he could not discuss “specifics of the protection or the enhancements made, as they involve sensitive tactics and procedures. I can say, however, that personnel and other protective resources, technology, and capabilities have been added.”

    Video below: Get the Facts: Verifying claims made about security at Trump rally

    The Secret Service had already stepped up Trump’s protection in the days before the attack following an unrelated threat from Iran, two U.S. officials said Tuesday. But that extra security didn’t stop the gunman, who fired from an adjacent roof, from killing one audience member and injuring two others along with Trump.

    The FBI and Homeland Security officials remain “concerned about the potential for follow-on or retaliatory acts of violence following this attack,” according to a joint intelligence bulletin by Homeland Security and the FBI and obtained by The Associated Press. The bulletin warned that lone actors and small groups will “continue to see rallies and campaign events as attractive targets.”

    Underscoring the security risks, a man armed with an AK-47 pistol, wearing a ski mask and carrying a tactical backpack was taken into custody Monday near the Fiserv Forum, where the convention is being held.

    The attack has led to stepped-up security not only for Trump. President Joe Biden’s security has also been bolstered, with more agents surrounding him as he boarded Air Force One to Las Vegas on Monday night. Independent candidate Robert F. Kennedy Jr. also received Secret Service protection in the shooting’s wake.

    Related video below: Biden orders Secret Service for RFK Jr.

    Trump’s campaign has also responded in other ways, including placing armed security at all hours outside their offices in Florida and Washington, D.C.

    Trump has already scheduled his next rally in Grand Rapids, Michigan, on Saturday. That’s where he will appear with Vance for their first event as a presidential ticket.

    But the new posture complicates, at least for now, the interactions Trump regularly has with supporters as he signs autographs, shakes hands and poses for selfies at events and on airplane tarmacs.

    In many cities he visits, the campaign assembles enthusiastic supporters in public spaces like restaurants and fast food joints. Sometimes Trump stops by unannounced. The images and video of his reception and interactions — circulated online by his campaign staffers and conservative media — have been fundamental to his 2024 campaign.

    During the GOP primaries, in particular, his easy interactions served as a contrast to his more awkward top rival, Florida Gov. Ron DeSantis.

    But those events can get rowdy and chaotic. While he was in New York during his criminal hush money trial, Trump aides arranged a series of visits to a local bodega, a local firehouse and a construction site.

    Before his arrival at the bodega in Harlem, thousands of supporters and onlookers gathered behind metal barricades for blocks to watch his motorcade arrive and cheer. But others in the neighborhood were frustrated by the visit, including people being dropped off at a bus stop just in front of the store, and others trying to enter their apartments after work.

    At one point, an individual who lived in the building started shouting from a window that was just above the entrance where Trump would eventually stand and give remarks to the cameras and answer reporters’ questions.

    Long before the shooting, convention organizers had clashed with the Secret Service over the location of protest zones at the convention. RNC leaders repeatedly asked officials to keep protesters farther back than had been originally planned, arguing that an existing plan “creates an elevated and untenable safety risk to the attending public.”

    One person familiar with the dispute said that the original plan would have put protesters “a softball throw away” from delegates and close enough to throw projectiles over the fence.

    The protest area was eventually moved, but the episode still raises frustrations and suspicions among some Trump allies.

    ___

    Associated Press writer Colleen Long in Washington contributed to this report.

    [ad_2]

    Source link

  • Pathify Achieves SOC 2 Type I Compliance, Reinforcing Commitment to Data Security

    Pathify Achieves SOC 2 Type I Compliance, Reinforcing Commitment to Data Security

    [ad_1]

    Pathify Continues Customer Commitment to Information Transparency, Safety and Security

    Pathify, the leading digital engagement hub for higher education, is pleased to announce the successful completion of its Systems and Organizational Control (SOC) 2 Type I examination. Conducted by Modern Assurance, the rigorous audit process affirms Pathify’s information security practices, policies, procedures and operations meet the SOC 2 standards for security, availability and confidentiality.  

    The achievement of SOC 2 Type I compliance marks a significant milestone in Pathify’s ongoing commitment to ensuring robust data security and business continuity for its growing roster of customers. 

    “We are extremely proud to announce our SOC 2 certification,” said Chris Hagan, Pathify’s Chief Technology Officer. “We have always ensured our platform’s security, but this verification further validates we are doing all the right things to protect our customers’ data.”

    SOC 2 is an auditing standard created by the American Institute of Certified Public Accountants (AICPA) to evaluate an organization’s controls related to information security, availability, processing integrity, confidentiality, and privacy. SOC 2 Type I assesses an organization’s systems, focusing on the design and implementation of these controls to ensure they meet the relevant trust services criteria. 

    “This successful SOC 2 Type I examination audit provides our customers with the assurance that the controls and safeguards we have in place are in line with industry standards and best practices,” said Chase Williams, Pathify’s Chief Executive Officer. 

    “This has set the groundwork for SOC 2 Type II certification, which we intend to pursue in 2025. Our customers can feel confident we are making every effort to establish and maintain the highest level of security and compliance,” Hagan added. 

    In addition to SOC 2 Type I compliance, Pathify has also achieved a BitSight Security Rating of 760, significantly surpassing the industry average of 680. This score places Pathify in the top quartile of the education industry, highlighting the company’s superior cybersecurity risk management and effectiveness. 

    These accomplishments underscore Pathify’s pursuit of excellence in data security and its commitment to providing a secure, reliable platform for higher education institutions.

    About Pathify

    Obsessed with making great technology while developing incredible long-term relationships with customers, Pathify remains hyper-focused on creating stellar experiences across the entire student lifecycle — from prospect to alumni. Delivering cloud-based, integration-friendly software designed to drive engagement, Pathify pushes personalized information, content, and resources to the right people, at the right time — on any device. Led by former higher ed executives, entrepreneurs, and technology leaders, the team at Pathify focuses every day on the values ImpactWitContrastTechnique and Care

    Learn more at pathify.com.

    Source: Pathify

    [ad_2]

    Source link

  • AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records

    AT&T Paid a Hacker $370,000 to Delete Stolen Phone Records

    [ad_1]

    Despite the payment and deletion, some AT&T customers and those who communicated with them may still be at risk, given that others may have samples of the data that were not deleted.

    The hacker who spoke with WIRED obtained payment from AT&T instead of Binns because, he says, in an odd twist to the case, Binns was arrested in Turkey in May for an unrelated breach dating back to 2021. That one involved a massive theft of data from T-Mobile. AT&T said in its SEC filing that it believed “at least one person” associated with the breach had already been apprehended, but didn’t identify him. 404 Media was first to report on Friday that Binns is allegedly that person.

    Binns was indicted in 2022 on 12 counts related to the 2021 hack of T-Mobile “and theft and sale of sensitive files and information” that involved data on more than 40 million people. Binns, however, had moved from the US to Turkey in 2018 with his Turkish mother, according to an interview he gave three years ago to The Wall Street Journal. The indictment remained sealed until this year. Last September, the US learned he could possibly be arrested in Turkey and extradited to the US because he didn’t have Turkish citizenship. Prosecutors in Seattle, near where T-Mobile is based, asked a US court in December to unseal parts of the indictment so they could give it and an arrest warrant to Turkish authorities who were making the final decision on whether Binns could be extradited legally under Turkish law. The court granted the request to unseal in January.

    The hacker who received payment from AT&T tells WIRED he believes Binns was arrested in Turkey around May 5, since Binns hasn’t responded to any attempts by him and others to contact him. WIRED contacted the Seattle public defender representing Binns in the T-Mobile case but did not receive a reply.

    Binns has had contact with US authorities on a number of occasions and has accused the CIA and other agencies of wild conspiracies to harm and entrap him. As part of a 2020 FOIA lawsuit against the FBI, CIA, and US Special Operations Command to obtain records he claimed they held about him, Binns claimed that CIA contractors spied on him, experimented on him, harassed him, and that one of them pointed a “psychotronic weapon” at his head and used a microwave oven to shock him, among other allegations. He later filed a motion to dismiss his FOIA case, claiming he had filed some documents while “experiencing a psychological episode brought on by intoxication.”

    Last October, in the T-Mobile case, Binns wrote to the US District Court in Seattle and said he believed his actions were affected by a chip that had been implanted in his brain when he was an infant. In a certified letter sent to the court and viewed by WIRED, Binns told the judge that he believed a “wireless brain (basal gangliea) stimulation implant or device implanted” shortly after he was born was responsible for “erratic behavior to include irresistible impulses, artificial neurological problems, and the possible commission of crimes.”

    The timeline suggests that if Binns is responsible for the AT&T breach, he allegedly did it when he was likely already aware that he was under indictment for the T-Mobile hack and could face arrest for it.

    [ad_2]

    Kim Zetter

    Source link

  • The $11 Billion Marketplace Enabling the Crypto Scam Economy

    The $11 Billion Marketplace Enabling the Crypto Scam Economy

    [ad_1]

    That public nature of the criminal transactions is all the more shocking given that Huione Guarantee is operated by Huione Group, a Cambodian financial conglomerate that includes a company linked to the family of Cambodia’s prime minister, Hun Manet. One of the companies’ directors, in fact, is Hun To, the prime minister’s cousin, who has been linked in an Al Jazeera investigation to an alleged scam compound reportedly owned by Heng He, a Cambodian conglomerate owned by two Chinese nationals.

    Crypto scam researchers say that Huione Guarantee, despite its size, is just one of many money laundering methods that pig butcherers use. Given that much of the pig butchering ecosystem has ties to Chinese organized crime, pig butchering revenue is often laundered in a decentralized way by convincing individual Chinese citizens to accept and hand off cryptocurrency through their personal Alipay accounts for a small fee, notes Gary Warner, director of intelligence at cybersecurity firm DarkTower. Markets like Huione Guarantee, however, offer a path for scammers who don’t already have a laundering network they can rely on or who need to diversify their options for liquidating funds.

    A listing on Huione Guaranteed for electrified GPS-tracking shackles for detaining enslaved scam laborers.

    Courtesy of Elliptic

    It’s perhaps no surprise that Huione Guarantee began operating in 2021, given that crypto scams surged during the Covid-19 pandemic. Sophos’ Gallagher notes that in Cambodia, pig butchering operations are largely run out of hotels and resorts that struggled with plummeting tourism in 2020 and 2021. “They were financed heavily or outright owned by Chinese companies in connection with special economic zones and other development tied to Belt and Road,” he says. Gallagher’s research indicates that laborers working on pig butchering in Cambodia—often against their will—are typically not citizens but have come from the surrounding region. “These facilities follow the same playbook as far as taking people’s passports and then using electrical shocks, cattle prods, and other physical punishment for not following the rules.”

    As disturbing as it may be that a service enabling billions of dollars annually in crypto scam industry transactions is being run in the open—and with links to one of Cambodia’s most powerful families—Elliptic’s Robinson suggests that brazenness offers an opportunity to disrupt a keystone of that criminal industry: He proposes international sanctions targeting Huione’s leadership.

    “This has the hallmarks of a darknet marketplace, but it’s run by a large Cambodian conglomerate, which has documented links to the ruling family there,” Robinson argues. “There is surely scope to impose sanctions on a business such as this, to hinder this type of marketplace from operating.”

    [ad_2]

    Andy Greenberg, Lily Hay Newman

    Source link

  • Behold the $150,000 Dog

    Behold the $150,000 Dog

    [ad_1]

    A few years ago, in Bozeman, Montana, a brain surgeon and his wife were walking through a farmers’ market when they came across a booth selling dogs. The breeder, called Svalinn, touted them as a one-of-a-kind hybrid: military-grade protection dogs with elite danger-sensing instincts but the warmth and temperament of a conventional family pet. The surgeon, Regis Haid, took a closer look at the dogs, which did indeed seem magnificent, intelligent, and powerful. Then he saw the cost: at least $150,000 each.

    Haid’s wife, Mary Ellen, was interested. He told her, “There’s no way I’m gonna spend that kind of money. Are you out of your mind?” Many stories about Svalinn dogs begin this way. The Haids couldn’t stop thinking about the animals they’d seen, and before long, they drove to Svalinn’s training facility. Each dog is an undisclosed mix of Dutch shepherd, German shepherd, and Belgian Malinois. “They put the dogs through all these obstacle courses and things,” Haid recalled recently. “I was in the military, I had an Air Force scholarship to med school, and I’ve hunted. These dogs — they’re like humans.” Many high-dollar protection dogs are nothing but menace; Haid approached one of the Svalinn dogs, who nuzzled his hand. He and Mary Ellen now own two.

    Svalinn says that it sells no more than 20 dogs a year, and only about 350 exist around the world. One of the owners, Stephen Mazzola, an airline pilot, read about Svalinn in Mountain Outlaw magazine shortly before moving to the Bitterroot Valley, near the Idaho-Montana border, and scheduled a visit to the breeder. He and his wife, Chris, a retired nurse anesthetist, fell in love with one of the biggest males available, a “door kicker” they named Jet.

    Mazzola, who used to fly F-16s, was stunned by Jet’s abilities. “I feel like we have a gentle Navy SEAL in the house,” he says. “I find myself giving a command and going, ‘Holy cow, that really works.’” He describes standing at a restaurant counter with Jet hovering at his side, “looking the other direction, where all the people are. That’s an automatic thing with them. The training kind of morphs into the instinct to protect the family.” He pauses. “It just — it turns into a very emotional thing.”

    Photo: Sweetgrass Studio

    Svalinn’s founder, Kim Greene, did not set out to create a luxury object. In the aughts, she was living in Nairobi with her then-husband, Jeff, a former Green Beret whose business provided private security to diplomats and NGOs. Nairobi had a carjacking problem, and after Kim gave birth to twins, Jeff asked her to carry a gun. Kim declined, feeling that if she were attacked, she would be unlikely to use it. Instead, she got a pair of Dutch shepherds named Banshee and Briggs. The dogs were “hot,” says Greene, ready to jump through a car window and maul an attacker at the slightest provocation. They were weapons, not pets, “and kind of pains in the ass.”

    In Nairobi the Greenes had a sideline breeding Rhodesian ridgebacks for the expat community, and they also sold dogs to the U.S. They noticed that people became more interested in tactical K-9s after the raid that killed Osama bin Laden, which featured a Belgian Malinois named Cairo. The Greenes moved back to the U.S. in 2013, intent on creating a market for beasts that could rip out an attacker’s trachea yet also function as pets.

    They established Svalinn, which in Nordic mythology refers to a shield protecting the world, at a former equestrian-training facility outside Livingston in Montana’s Paradise Valley. (The couple has since divorced, and Kim Greene now runs the business.)

    Approaching the site recently, amid panoramic views of snowcapped mountains, I see signs warning of danger ahead, then arrive at a converted indoor riding arena at the end of a winding dirt road. Somewhere inside, dogs are barking. This part of Montana is one of the remotest parts of the country, and in Svalinn’s early years, many would-be buyers either resisted making the trip or tried to have someone do it for them. “So many people are used to having their staff do things,” says Greene.

    Today, that happens less often, in part because Montana is now where many of her clients live, at least some of the time. Over the past decade, the state has seen an enormous influx of extreme wealth. Greene’s dogs are especially popular at the Yellowstone Club, the private-equity-owned, members-only ski-resort community in Big Sky, where Justin Timberlake and Jessica Biel reportedly hid out during the pandemic.

    Clients, Greene says, sometimes ask if her dogs are suited for frequent travel by private jet or helicopter. “People say, ‘I have a big motorboat. I need to have my dog climb out of the water on a ladder.’” She makes an expression as if to say of course her dogs can do these things. She believes that most people undertrain their dogs and that both parties would be happier if dogs were asked to do more — much more.

    Greene has a way of talking about dogs that reflects her background as a military contractor; she sometimes refers to them as “assets.” But just as often, she’s a little woo-woo, whether talking about energy transference between dogs and humans or a mystical, all-important canine quality she calls “stability.” The concept seems to combine firmness of nerves, supreme control, and physical balance.

    Stability is bred at the Phoenix, an obstacle course at the Svalinn ranch resembling a jungle gym. The Phoenix looks easy, but its components — swinging tires the dogs have to leap through, balance beams narrower than their paws — are designed to make them pant. Increased athleticism is one result, but the Phoenix is also meant to be a thinking exercise. Its components are reconfigured every day so that the dogs can’t complete it on autopilot.

    The hoped-for result is a dog that “comes through the door with its shoulders thrust forward,” unafraid of new situations yet attuned to its environment. Greene contrasts this with the typical American pet, an “adoring family oaf. We don’t expect them to do anything other than wag their tail and be goofy and cute.”

    Most of a Svalinn dog’s price is derived not from breeding but rather the intensity of its training, which takes two to three years. Once a dog’s personality has been established, partway through that process, it is paired with its future owner — the bank head, the construction magnate, the rancher. Although some want the assurance of a lethal sidekick, Greene says, most are not facing an actual death threat. “People just want their dogs everywhere,” she says. “There’s an entitlement.” Her customers are “high-level people, economically and socially,” with an abundance of disposable income and free time. What’s missing from their life, she says, is “that next-level relationship with an animal.”

    Pets have long been symbols of wealth and power, from Choupette Lagerfeld to J. Paul Getty’s lion, Teresa. Lately, however, pets have also become symbols of politics. Last December, an editor at the New York Times, Alicia P.Q. Wittmeyer, wrote at length about the online world of dog training. Wittmeyer found two camps: those who believe in “aversive” training methods such as shock collars, and those who reject such methods or any attempt to discipline at all. The battle lines mirrored the culture wars “with unsettling precision,” Wittmeyer found. Anti-aversives are prone to linking their beliefs about dogs to larger battles against the patriarchy or colonialism, while their opponents see themselves as standing up to “woke idiots.”

    Greene is an aversive. She is both a disciplinarian and a believer in replicating the harsh conditions of the wild. She wants to civilize dogs — to “give them manners” — at the same time that she hopes to bring out their inner savages. Not all animals in her care survive this process. “If nature takes puppies,” she says, “it takes puppies.” She means that if newborns are abandoned by their mother and seem likely to die — perhaps of exposure — she and her staff refuse to intervene. “If we were a puppy mill, we would sleep with the puppies,” says Greene. “We’d give them heat lamps. But you know what? These are protection assets. And if six of them are going to pass, there’s a reason.”

    She aims to “keep everything as close to nature as possible.” That means choke collars, no toys or treats, and a diet of beef or raw elk meat served on the bone. Dogs grow up in the Pit, a dirt-floored barn with an odor so intense I feel the urge to run outside.

    I’m curious whether Greene believes that natural selection breeds better, more aggressive guard dogs, but she sidesteps the topic. “Any dog can be taught to be aggressive,” she says. Is she selecting for dominance in order to create canine versions of her clients? “A lot of dog people overthink and layer human ideas on things. If we observe the dogs, we will usually learn the way it’s supposed to be done.”

    For an owner looking to show off their Svalinn dog on St. Barts or at the Yellowstone Club, amid designer breeds that cost a mere $10,000, this is surely part of the appeal. Dogs have been bred to be middle class — safe, dumb, and boring. Svalinn gives them their teeth back.

    Greene says she doesn’t care if this turns off some potential buyers. “There are a lot of people who can afford what we do,” she says. Besides, the hardest part of dog ownership isn’t the training of dogs, she says. It’s training the owners. “We have a no-assholes policy,” says Greene. “We’ve done a lot of due diligence on the people who visit. We’re interviewing clients as much as they’re interviewing us.” The Svalinn owners I’ve spoken to seem to enjoy this part of the process. After they purchase and bring home their dog, a Svalinn handler visits within 45 days to see if they have kept up with the dogs’ training or introduced bad habits. After all, luxury objects, like an out-of-tune Steinway, need extra love and care.

    This gets to the question of what Svalinn is — a dog breeder, a dog trainer, or something else. A number of other protection-dog trainers charge six figures for an animal, but Greene positions her company as a full concierge service. “You’re becoming part of a club,” she says. “You’re buying into support and troubleshooting and backstopping. We’re on the phone anytime you need us. It’s like all of a sudden you’ve got a trip to Australia — we can be at your doorstep to collect your animal and redeliver it two weeks later.”

    Being admitted to the club means buying into Svalinn’s philosophy of the dog as a functional organism, born to perform tasks. “Dogs are like humans,” Greene says. “They get pretty spun out when they don’t know what the rules are. They thrive on structure.” Not surprisingly, Greene subscribes to pack theory, the belief that dogs, like wolves, are born innately willing to be led by a dominant leader. Critics say pack theory can be used to justify an aggressive, bullying approach. “I don’t love the word dominance myself,” says Greene. Nevertheless, she adds, “This isn’t a democracy. There is a hierarchy.”

    Her business card reads, “Alpha Female.” At Svalinn, she orchestrates every move to the extent that both dogs and humans seem frozen without her permission. Courtney Guillen, the CEO of Western Hunter, a full-service outdoors company, bought a Svalinn dog seven years ago after seeing one at a trade show. She describes Greene as “incredibly smart and strategic” as well as a friend. She also calls her “the only woman I’ve ever met who intimidated me.”

    Greene and I are standing next to the Phoenix watching a big dog named Niall go through his paces. According to his handler, Matt, Niall is a “no-b.s. dog,” as shown by wounds up and down Matt’s arms. Protection work is a major component of Svalinn’s training, which handlers bear the brunt of.

    Also training on the Phoenix are Pappy, “an old soul” balancing with all four paws on a 2.5-inch wooden plank, and Pua, a younger dog whom Greene calls “a little ballistic fur missile.” In general, Greene prefers smaller, more discreet animals. Her dogs are typically listed at about 60 pounds. “Some of our would-be competitors breed 120-pound German shepherds,” she says. “That might be a deterrent, but it’s not going in the car with you. And it sheds everywhere. And it drools.”

    After a few minutes of commando-type activity, the dogs are summoned to a row of podiums, which they mount one by one. This has the awkwardness of a beauty pageant, but it is impossible not to be impressed by the disciplined, alert calmness of Pappy, Niall, and Pua. Not only is there no drooling; the dogs seem locked in on the salient thing in the room, the single aspect of their environment that has changed, the outsider that their human handlers are focused on. Me.

    Greene demonstrates a “deployment” with Pappy, who is riled up to attack a young trainer named Cullen. “Protect your family!” a trainer shouts. Pappy launches at Cullen, who, as he fights off the frenzied dog, seems to be in considerable pain, despite the protection of a bite suit. When the drill is called off, Pappy disengages immediately.

    I ask Greene if I can experience an attack. For the first time, she seems unsure. “If you promise not to sue us,” she says.

    For protection training to be effective, a dog has to believe the threat is real. Svalinn dogs are trained to disarm, maim, and, potentially, kill. But they cannot be headhunters. They have to be discerning killers. And they have to be able to be overridden, which is why “we build in an ‘off’ switch,” says Greene. The safe words are out and fooey-it.

    The trainers bring out Whistler, a younger if not visibly smaller dog. To protect me from having my femoral artery ripped out, I get the bite suit, which covers much of my body and is made out of what seems to be a cheap rug. Shuffling under its not terribly reassuring thickness, I hide around a corner, per instructions. Then one of the female trainers starts to shriek.

    From my hiding spot, I inch around and make eye contact with Whistler. Matt has him on a leash — barely.

    “Act menacing,” Matt says.

    “Rrrraahhh!”

    “More! Like you mean it!”

    “RRRRAAHHH!”

    Suddenly, Whistler is attached to my tricep, snarling, drooling, writhing, jerking my arm back and forth as she pushes me against a wall. There is no pain; the bite suit dulls most of the pressure. But after 30 seconds, I’ve had enough and signal as much to the handlers, who hit the off switch.

    Nothing happens.

    “Out!” Matt commands. “Fooey-it!”

    I look in Whistler’s adrenaline-blurred eyes, inches from my own. I see nothing.

    “Out, Whistler, out!”

    Eventually, Matt puts the dog in a headlock to get her to release. Greene sighs. Later, she says, “This is why we train them for two and a half years.”

    [ad_2]

    Ben Ryder Howe

    Source link

  • Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    Hackers Leaking Taylor Swift Tickets? Don’t Get Your Hopes Up

    [ad_1]

    Proton, the company behind Proton Mail, launched an end-to-end encrypted alternative to Google Docs, seeking to compete with the cloud giant on privacy. We broke down how Apple is taking a similar approach with its implementation of AI, using a system it calls Private Cloud Compute in its new Apple Intelligence features.

    In other news, we dug into how the US bans on TikTok and Kaspersky software, despite their national security justifications, pose a threat to internet freedom. We went inside a crash course for US diplomats on cybersecurity, privacy, surveillance, and other digital threats. And we published an in-depth investigation into the origins of the world’s most popular 3D-printed gun, which revealed that its creator was a self-described “incel” with fantasies of right-wing terror.

    But that’s not all. Each week, we round up the security news we didn’t cover in depth ourselves. Click the headlines to read the full stories, and stay safe out there.

    The giant hack against Ticketmaster may have taken another twist. In June, criminal hackers claimed they had stolen 560 million people’s information from the ticketing company owned by Live Nation. The company has since confirmed a breach, saying its information was taken from its Snowflake account. (More than 165 Snowflake customers were impacted by attacks on the cloud storage company that exploited a lack of multi-factor authentication and stolen login details).

    Now in a post on cybercrime marketplace BreachForums, a hacker going by the name of Sp1d3rHunters is threatening to publish more data from Ticketmaster. The account claims to be sharing 170,000 ticket barcodes for upcoming Taylor Swift gigs in the US during October and November. The hacker demanded Ticketmaster “pay us $2million USD” or it will leak “680 million” users’ information and publish millions more event barcodes, including for concerts by artists such as Pink and Sting, and sporting events such as NFL games and F1 races.

    The claims appear to be dubious, however, as Ticketmaster’s barcodes aren’t static, according to the company. “Ticketmaster’s SafeTix technology protects tickets by automatically refreshing a new and unique barcode every few seconds so it cannot be stolen or copied,” a Ticketmaster spokesperson tells WIRED in a statement. The spokesperson adds that the company has not paid any ransom or engaged with the hackers’ demands.

    Hacker groups are known to lie, exaggerate, and overinflate their claims as they try to get victims to pay. The 680 million customers that Sp1d3rHunters claimed to have data on is higher than the original figure provided when the Ticketmaster breach was first claimed, and neither number has been confirmed. Even if victims do decide to pay, hackers can still keep the data and try to extort companies for a second time.

    Despite the breach at Ticketmaster originally being publicized in June, the company has only recently begun emailing customers alerting them to the incident, which happened between April 2 and May 18 this year. The company says the database accessed may include emails, phone numbers, encrypted credit card information, and other personal information.

    In recent years, there’s been a sharp uptick in cybercriminals deploying infostealers. This malware can grab all of the login and financial details that someone enters on their machine, which hackers then sell to others who want to exploit the information.

    Cybersecurity researchers at Recorded Future have now published proof-of-concept findings showing these stolen login details can be used to potentially track down people visiting dark-web child sexual abuse material (CSAM) sites. Within infostealer logs, the researchers say they were able to find thousands of login details for known CSAM websites, which they could then cross-reference with other details and identify the potential real-world names connected to the abusive website logins. The researchers reported details of individuals to law enforcement.

    [ad_2]

    Matt Burgess, Andy Greenberg

    Source link

  • How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

    How Apple Intelligence’s Privacy Stacks Up Against Android’s ‘Hybrid AI’

    [ad_1]

    Yet Google and its hardware partners argue privacy and security are a major focus of the Android AI approach. VP Justin Choi, head of the security team, mobile eXperience business at Samsung Electronics, says its hybrid AI offers users “control over their data and uncompromising privacy.”

    Choi describes how features processed in the cloud are protected by servers governed by strict policies. “Our on-device AI features provide another element of security by performing tasks locally on the device with no reliance on cloud servers, neither storing data on the device nor uploading it to the cloud,” Choi says.

    Google says its data centers are designed with robust security measures, including physical security, access controls, and data encryption. When processing AI requests in the cloud, the company says, data stays within secure Google data center architecture and the firm is not sending your information to third parties.

    Meanwhile, Galaxy’s AI engines are not trained with user data from on-device features, says Choi. Samsung “clearly indicates” which AI functions run on the device with its Galaxy AI symbol, and the smartphone maker adds a watermark to show when content has used generative AI.

    The firm has also introduced a new security and privacy option called Advanced Intelligence settings to give users the choice to disable cloud-based AI capabilities.

    Google says it “has a long history of protecting user data privacy,” adding that this applies to its AI features powered on-device and in the cloud. “We utilize on-device models, where data never leaves the phone, for sensitive cases such as screening phone calls,” Suzanne Frey, vice president of product trust at Google, tells WIRED.

    Frey describes how Google products rely on its cloud-based models, which she says ensures “consumer’s information, like sensitive information that you want to summarize, is never sent to a third party for processing.”

    “We’ve remained committed to building AI-powered features that people can trust because they are secure by default and private by design, and most importantly, follow Google’s responsible AI principles that were first to be championed in the industry,” Frey says.

    Apple Changes the Conversation

    Rather than simply matching the “hybrid” approach to data processing, experts say Apple’s AI strategy has changed the nature of the conversation. “Everyone expected this on-device, privacy-first push, but what Apple actually did was say, it doesn’t matter what you do in AI—or where—it’s how you do it,” Doffman says. He thinks this “will likely define best practice across the smartphone AI space.”

    Even so, Apple hasn’t won the AI privacy battle just yet: The deal with OpenAI—which sees Apple uncharacteristically opening up its iOS ecosystem to an outside vendor—could put a dent in its privacy claims.

    Apple refutes Musk’s claims that the OpenAI partnership compromises iPhone security, with “privacy protections built in for users who access ChatGPT.” The company says you will be asked permission before your query is shared with ChatGPT, while IP addresses are obscured and OpenAI will not store requests—but ChatGPT’s data use policies still apply.

    Partnering with another company is a “strange move” for Apple, but the decision “would not have been taken lightly,” says Jake Moore, global cybersecurity adviser at security firm ESET. While the exact privacy implications are not yet clear, he concedes that “some personal data may be collected on both sides and potentially analyzed by OpenAI.”

    [ad_2]

    Kate O’Flaherty

    Source link

  • Proton Is Launching Encrypted Documents to Take On Google Docs

    Proton Is Launching Encrypted Documents to Take On Google Docs

    [ad_1]

    Yen says Proton has been internally using the system for the last month and is now ready to roll it out to consumers. “I feel it is relatively polished,” Yen says. To compete with other online document editors, he says, the team also built in collaboration functionality from the beginning. This includes real-time editing by multiple people, commenting, and showing when someone else is viewing the document.

    In April, Proton acquired encrypted note-taking app Standard Notes, which is a separate product from Docs. “It’s actually not ‘take Standard Notes and stick it into Proton,’” Yen says, adding that the encryption architecture of the two were different, and Proton Docs is “more or less a ground-up, clean build in Proton’s ecosystem on our software stack.” (WIRED was unable to test the Docs before it was launched).

    The big difference Proton is adding when compared to Google Docs is the encryption—something that is challenging to do at scale and also harder when a document has multiple people editing it at the same time. Yen says it’s not just the contents of documents that are being encrypted, so are other elements like keystrokes, mouse movements, and file names and paths.

    The company, which last month announced it is moving toward a nonprofit status, uses open source encryption, and Yen says building the Docs system required encryption key exchange and synchronization to happen across multiple users. Part of this was possible, Yen says, because last year the company added version history for documents stored in its Drive system, which the Docs are built on top of.

    There are relatively few—if any—major end-to-end encrypted document editors online. Other existing services, which WIRED has not tried, include CryptPad and various note-taking or notepad-style apps. There are also apps that encrypt files locally on your machine, such as Cryptee and Anytype.

    Recently, Proton has been moving quickly to launch new encrypted products—adding cloud storage, a VPN, a password manager, and calendar alongside its original ProtonMail email service. The company has also faced scrutiny over some information it has provided to law enforcement, such as recovery emails that have been added to accounts. It changed some of its policies in 2021 after being ordered to collect some user metadata. While the company is based outside of the US and EU, it still responds to thousands of Swiss law enforcement requests.

    Ultimately, Yen says, the company is trying to offer as many private alternatives to Big Tech services, particularly Google, as it can. “Everything Google’s got, we’ve got to build as well. That’s the road map. But the challenge, of course, is the order in which you do it,” Yen says. “In some sense, taking privacy to a more mainstream audience also requires going further afield, trying different things, and being a bit more adventurous in the things that we build and things that we launch.”

    [ad_2]

    Matt Burgess

    Source link

  • The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks

    The US Wants to Integrate the Commercial Space Industry With Its Military to Prevent Cyber Attacks

    [ad_1]

    THIS ARTICLE IS republished from The Conversation under a Creative Commons license.

    The US military recently launched a groundbreaking initiative to strengthen ties with the commercial space industry. The aim is to integrate commercial equipment into military space operations, including satellites and other hardware. This would enhance cybersecurity for military satellites.

    As space becomes more important to the world’s critical infrastructure, the risk increases that hostile nation-states will deploy cyberattacks on important satellites and other space infrastructure. Targets would include not just spy satellites or military communications satellites, but commercial spacecraft too.

    The US Department of Defense believes its new partnership, called Commercial Augmentation Space Reserve (CASR), would enhance US national security and the country’s competitive advantage in space. It would go some way beyond the relationship between government and private contractor that already exists.

    In some cases, the commercial sector has advanced rapidly beyond government capabilities. This situation exists in numerous countries with a space capability and may apply in certain areas in the US too.

    The governments of some nation-states are therefore confronted with a choice. They could utilize bespoke systems for protecting their satellites, even though these may be outdated, or they could use other commercial—and potentially more advanced—“off-the-shelf” components. However, the commercial hardware may be less well understood in terms of its vulnerabilities to cyberattacks.

    Nevertheless, the US military believes that CASR will give it advanced strategic capabilities, and that potential risks can be minimized by actively avoiding overreliance on any single commercial entity.

    The supply chain aims to transition the US military from a restricted pool of commercial suppliers to a broader spectrum of partners. However, there are risks with a bigger pool of commercial suppliers too. Some might be unable to meet the demands of military contracts, could run into financial instability, or encounter other pressures that hinder their ability to supply critical components.

    New Priorities

    In 2022 there was a cyberattack on the KA-Sat consumer satellite broadband service. It targeted the satellites delivering the broadband and disrupted the service.

    There are many ways to attack another state’s satellites, such as anti-satellite (ASAT) weapons, which are often designed to physically destroy or disable the spacecraft. However, compared to ASATs, cyberattacks can be carried out in ways that are cheaper, quicker, and more difficult to trace.

    Part of the critical need to prioritize cybersecurity as a result of this strategy is that the US is an attractive market for global players in space. This strategic shift by the US Department of Defense is therefore likely to encourage more global companies to participate.

    Resilience to cyberattacks in the space industry has not always been a top priority. It is likely to take time for this to enter the thinking of major players in the space sector.

    This historical lack of emphasis on cybersecurity in space highlights an obvious need. There are also inconsistencies and gaps regarding the basic cyber requirements for government and industry, which vary depending on the stance of each nation-state.

    [ad_2]

    Sharon Lemac-Vincere

    Source link

  • Ripple’s Legal Battle’s Focus Shifts to CEO’s 2017 XRP Comments

    Ripple’s Legal Battle’s Focus Shifts to CEO’s 2017 XRP Comments

    [ad_1]

    A US federal court judge has allowed a civil securities lawsuit against Ripple Labs to proceed.

    This decision came after Judge Phyllis Hamilton of the California District Court denied Ripple’s request for summary judgment in a case involving allegations that its CEO, Brad Garlinghouse, violated California securities laws.

    “Misleading Statements” on XRP

    The allegations focus on claims that the exec made “misleading statements” about XRP’s status during a televised interview while at the same time expressing skepticism about the utility of other digital assets.

    The official court document said that this statement was shared on Ripple’s official Twitter account, which amplified its reach.

    The plaintiff argued that Garlinghouse’s statement was misleading and claimed that the exec had been selling millions of XRP throughout 2017 on various cryptocurrency exchanges despite publicly announcing that he remains “very, very, very long XRP” and his intention to “hodl” the asset.

    “I’m long XRP, I’m very, very long XRP as a percentage of my personal balance sheet. . . . . [I am] not long on some of the other [digital] assets, because it is not clear to me what’s the real utility, what problem are they really solving . . . if you’re solving a real problem if it’s a scaled problem, then I think you have a huge opportunity to continue to grow that. We have been really fortunate obviously, I remain very, very, very long XRP, there is an expression in the industry HODL, instead of hold, it’s HODL . . . I’m on the HODL side.”

    Court Ruling Challenges XRP’s Status for Non-Institutional Investors

    Judge Hamilton’s ruling addressed Ripple’s argument that the “misleading statement” allegation should be dismissed since XRP does not meet the criteria of security under the Howey test. The blockchain firm had cited Judge Analisa Torres’ decision from July 2023 in its lawsuit involving the Securities and Exchange Commission.

    However, Hamilton took a different stance in her recent order and instead determined that XRP could potentially be classified as a security when sold to individual investors, as opposed to institutional ones.

    As noted in the filing, she reasoned that these non-institutional investors would have anticipated profits resulting from Ripple’s efforts, which is one of the important factors considered in the Howey test for determining whether an asset qualifies as a security.

    “Overall, given the relative novelty of cryptocurrency, and given the lack of any controlling law regarding the motivation of a reasonable cryptocurrency investor, the court declines to find as a matter of law that a reasonable investor would have derived any expectation of profit from general cryptocurrency market trends, as opposed to Ripple’s efforts to facilitate XRP’s use in cross-border payments, among other things

    SPECIAL OFFER (Sponsored)

    Binance Free $600 (CryptoPotato Exclusive): Use this link to register a new account and receive $600 exclusive welcome offer on Binance (full details).

    LIMITED OFFER 2024 at BYDFi Exchange: Up to $2,888 welcome reward, use this link to register and open a 100 USDT-M position for free!

    [ad_2]

    Chayanika Deka

    Source link

  • Salem State gets $624K grant for cybersecurity training center

    Salem State gets $624K grant for cybersecurity training center

    [ad_1]

    SALEM — Salem State University announced this week that it received a $624,437 grant to establish and operate a cybersecurity training facility on campus.

    The grant is part of the state’s Security Operations Center (SOC) Cyber Range Initiative, a program managed by Mass Tech’s MassCyberCenter that aims to help build a diverse generation of cybersecurity professionals through education, training and workforce development, according to a news release.

    “Massachusetts is committed to leading in cybersecurity and ensuring that all communities have the skills, resources and capacity to protect their businesses and residents,” Gov. Maura Healey said. “Congratulations to Salem State on this award and their efforts to grow the cyber workforce.”

    Lt. Gov. Kim Driscoll said how proud she is, “as Salem’s former mayor and a Salem State graduate … of the work the university is doing to teach students critical cybersecurity skills.

    “Cybersecurity affects every part of our community whether you are a small business, elementary school or local government office. The more cybersecurity professionals we have, the more we can ensure our communities are protected online,” Driscoll said.

    “Salem State is grateful to the Healey-Driscoll Administration and the MassCyberCenter for selecting us for this important partnership,” Salem State President John Keenan said. “This type of investment and professional relationships are a win-win for everyone involved.

    “Like our nursing and occupational therapy simulation labs, the CyberRange will imitate real-world problems for students to solve in real time,” he said.

    The funding is expected “to promote cybersecurity while also ensuring Massachusetts stays competitive in modern economic development,” said Yvonne Hao, state secretary of economic development and board chair of the Massachusetts Technology Collaborative.

    Salem State will join Bridgewater State University, Springfield Technical Community College and MassBay Community College as a critical part of a statewide network of cybersecurity educators, MassCyberCenter Director John Petrozzelli said.

    The award will support capital expenditures to construct the CyberRange and expenditures for the first year of operations.

    The center is expected to promote the Massachusetts cybersecurity ecosystem by working to build a strong cyber talent pipeline and to strengthen the defense of local communities.

    More information is available online at https://masscybercenter.org.

    [ad_2]

    By Buck Anderson | Staff Writer

    Source link