this week in security — july 28 edition
THIS WEEK, TL;DR
FTC hits Facebook with $5 billion penalty and new privacy measures
FTC: A record fine for a record screw-up. The FTC's settlement with Facebook will mean it pays $5B in fines and will have to improve its privacy record. The fine comes in the wake of several significant security lapses and breaches and the scandal embroiling Cambridge Analytica, which was also fined after it siphoned off millions of records for voter profiling. The analytics firm . Former FTC chief technologist @ashk4n had a good tweet thread on the case and what it means. In short, now the buck really stops with Zuck.
More: NPR | @leakissner
Marcus Hutchins sentenced to time served for selling Kronos malware
TechCrunch: Marcus Hutchins, the malware researcher who stopped the WannaCry ransomware attack, is a free man. He was sentenced to time served by a judge in Milwaukee after he pleaded guilty to two counts of creating and selling the Kronos malware. The judge said he was young, has done good work since, and putting him away would be harmful for security. "Security is everything," said the judge. Great lawyering by @marciahofmann and @brianeklein who represented him pro-bono. (Disclosure: I wrote this story.)
More: TechCrunch | Cyberscoop
Government contractor drops exploit code for the BlueKeep flaw
Motherboard: A cybersecurity firm and government contractor has released exploit code for the highly dangerous and "wormable" BlueKeep vulnerability. So far it's only accessible to paying subscribers of the pen-testing firm's but many have criticized the decision to allow others to use it. More than a million internet-exposed machines are affected — not to mention the many more that are behind firewalls.
More: @GossiTheDog | @ImmunityInc
Equifax to pay at least $575 million over 2017 data breach
FTC: A double-whammy for the FTC this week: Equifax will pay at least $525M and up to $700M for its 2017 data breach. Remember it took four months(!) for the company to even come clean that its servers had been raided, exposing close to 150M Americans' credit files. The breach was entirely preventable had the company installed the necessary security patches, according to a House committee, which Equifax didn't do. You can check to see if you are affected and can claim through the FTC's website.
More: FTC | Background: TechCrunch
NSA forms cybersecurity directorate
Wall Street Journal ($): The NSA has a new cybersecurity directorate, soon to be run by Anne Neuberger. It's part of a new effort by the NSA to align the agency's cyber offensive and defensive operations, reports @dnvolz. The directorate opens October 1. The NSA even has a handy FAQ on what the directorate does... but doesn't really say that much (unsurprisingly).
More: NSA | Cyberscoop
QuickBooks host hit by ransomware attack
Krebs on Security: Cloud hosting firm Insynq was hit by ransomware that shut down its networks and left customers unable to get access to their tax and financial backups. Many complained on Twitter about the lack of communication. Insynq's chief executive eventually came clean in a statement. At the time of writing, the company claims 96% of its customers have access to their files.
More: Insynq
Apple contractors 'regularly hear' Siri conversations, says whistleblower
The Guardian: Apple contractors regularly hear confidential medical information, drug deals, and recordings of couples having sex, as part of their job providing quality control, or "grading," the company’s Siri voice assistant, according to The Guardian. Although the recordings are said to be anonymous and are used to make Siri better, the company does not explicitly state that that work is undertaken by humans who listen to the pseudonymised recordings. Some of the recordings include user location, contact details and app data, the whistleblower said.
More: Ars Technica
Advanced mobile surveillanceware, made in Russia, found in the wild
Ars Technica: New powerful malware, said to be developed by a Russian defense contractor, has been uncovered. The malware, known as Monokle, can reset a user’s pincode, make calls, take photos and screenshots, record calls, log passwords and more. It's believed the malware was developed for both Android and iOS, the researchers said.
More: Cyberscoop | Lookout
~ ~
THE STUFF YOU MIGHT'VE MISSED
Robinhood admits to storing some passwords in cleartext
ZDNet: This is starting to get embarrassing... Robinhood follows in the footsteps of GitHub, Twitter, Facebook and Google inadvertently storing user passwords in plaintext. The finance app wouldn't say how many accounts were affected but that passwords had since been secured with bcrypt.
Ransomware knocks South African city's electricity offline
BBC News: In a rare if not unprecedented incident, ransomware infected a major electricity supplier in Johannesburg, South Africa's largest city, leaving some residents without power. "It has encrypted all our databases, applications and network," the energy company tweeted. As many as a quarter of a million residents may have been affected.
New York to consider ban of phone location data
The New York Times ($): After the location data sharing scandal last year, New York is mulling a ban on cell phone companies selling that data to third-parties. The bill was introduced Tuesday.
U.K. police copied EU crime database data ahead of Brexit
The Guardian: The U.K.'s National Crime Agency — a bit like the British FBI — harvested data on 54,000 files including criminals, terrorists and missing persons from an EU database ahead of what's expected to be a no-deal Brexit, a leaked document has confirmed. The data will give police access to EU data if the U.K. falls out of the EU without a deal. EU lawmaker @SophieintVeld has filed several questions with the EU to find out what happened.
~ ~
OTHER NEWSY NUGGETS
U.K. government announces its Telecoms Supply Chain Review
Per BBC security correspondent @gordoncorera, the U.K. has a new telecoms supply chain review program that outlines security requirements and the need for tech diversity for critical systems. This was throwing shade at Huawei, but deferred any decision on whether to allow its technology in the U.K.
Facebook flaw let thousands of kids chat with unauthorized users
Facebook's Messenger Kids had one job — don't let kids talk to unauthorized users — but a design flaw allowed exactly that. "We turned off the affected chats and provided parents with additional resources on Messenger Kids and online safety," said Facebook. The news literally came two days before the aforementioned FTC settlement.
U.S. attorney general: Americans should accept crypto backdoor risks
William Barr said at a speech this week that Americans should effectively allow backdoors because the risks are slim and it's not like consumers are storing the U.S. nuclear codes on their phone. Yeah, that happened. (Disclosure: I also wrote this story.) Barr continues to push for backdoors but fails to mention all the hacking tools the DOJ has at its disposal. Cryptographer @mattblaze said Barr's argument was "flat-earth bizarre" and Sen. Ron Wyden said if the U.S. had those backdoor access they would inevitably be abused.
Synology warns of flaw amid worry over ransomware
Synology, a maker of networked drives, warned of an attack that could compromise user's devices and data was encrypted — essentially like a ransomware attack. The company warned users to change their device passwords. There have already been several victims, according to the company.
~ ~
THE HAPPY CORNER
Here's some good news from the week:
I mentioned earlier that Anne Neuberger is set to take on the cybersecurity helm at the NSA — that now means DHS, FBI, CIA, and NSA all have women in senior leadership positions across the U.S. intelligence and law enforcement space. I'd say that's a pretty big win for diversity.
And, per @MalwareJake and on a similar note, the @DianaInitiative has announced its lineup for its 2019 conference. @RayRedacted has the details: 52 speakers and the majority are women and non-binary folk.
If you want to nominate some good news from the week, feel free to reach out: zack.whittaker@gmail.com.
~ ~
THIS WEEK'S CYBER CATS
This week's cybercats are Natasha (left) and Boris (right). В России кот шпионит за тобой! A big thanks to @Riana_Crypto for the submission! (You may need to enable images in this email.)
And an honorable mention to Larry, the U.K. government's cat (it's a thing, really), who got a new prime minister this week. Larry's official title is Chief Mouser to the Treasury.
If you want your cybercat featured, please submit them here!
~ ~
SUGGESTION BOX
That's all for now. Hope you have a great week. If you have any feedback, feel free to drop it in the suggestion box. And safe travels to Vegas!
~ ~