Saturday, May 27, 2017

So, the FBI is spreading “fake news?”  Or are they looking for an invitation to browse company records? 
FBI probing attempted hack of Trump Organization, officials say
The FBI is investigating an attempted overseas cyberattack against the Trump Organization, summoning [??? Bob] President Donald Trump’s sons, Don Jr. and Eric, for an emergency session with the bureau’s cybersecurity agents and representatives of the CIA, officials tell ABC News.
Law enforcement officials who spoke to ABC News on the condition of anonymity confirmed the attempted hack and said the subsequent meeting took place at the FBI’s New York headquarters on May 8, the day before Trump fired FBI director James Comey.  Spokesmen for the FBI, CIA and Secret Service all declined to comment.
Reached by phone, Eric Trump, an executive vice president of the family company, would not confirm or deny that he and his brother had met with the FBI but told ABC News that the company had ultimately not been infiltrated.
“We absolutely weren’t hacked,” Eric Trump said during the brief call.  “That’s crazy.  We weren’t hacked, I can tell you that.”  [Sounds a bit like his father, doesn’t he?  Bob] 
As federal agencies monitor international computer networks in order to protect government and private sector computer infrastructure and data, the Trump Organization’s networks would be given high priority, according to Richard Frankel, a retired senior official with the FBI's New York office and an ABC News contributor.
"If there was a hack or an attempted hack of ... the company that was owned by the president, that would be at the top of the list of investigations," Frankel said.  "If the FBI saw that kind of hack, they'd have to track that.  There's no telling what a hacker could get that's connected to the president, corporate records, financial records, even things that were going on during the transition.”
The FBI’s involvement could come with some risks, Frankel said, both for the company and the president.  In the course of its investigation, the FBI could get access to the Trump Organization’s computer network, meaning FBI agents could possibly find records connected to other investigations.  

Another airline computer system bites the dust.  Are we sure this is coincidence?
British Airways cancels flights as major IT failure causes worldwide delays
British Airways has cancelled all flights from Heathrow and Gatwick before 6pm on Saturday due to a major IT failure that is causing “very severe disruption” to its global operations.
   The cause of the issue remained unclear, but passengers on one flight were told by the pilot that the IT problems were “catastrophic”.
   BA added that there was no evidence a cyber attack had caused the outage.

Who would be responsible for a leased POS device?
Chipotle Removes Malware After Breach Strikes Payment Systems
Chipotle Mexican Grill Inc., which warned investors and customers last month that it had suffered a data breach, gave the all-clear on Friday, saying it had removed malicious software from its systems.
   Hackers installed the software in order to grab customer data from point-of-sale devices, striking between March 24 and April 18.
“The malware searched for track data (which sometimes has cardholder name in addition to card number, expiration date and internal verification code) read from the magnetic stripe of a payment card as it was being routed through the POS device,” Chipotle said in a statement.

For my Computer Security students.
Organizations Concerned About Medical Device Attacks: Study
Many manufacturers and healthcare delivery organizations (HDO) are concerned about medical device attacks, but only few have taken significant steps to address the threat, according to a study commissioned by electronic design automation solutions provider Synopsys.
The study, based on a survey of 550 individuals conducted by the Ponemon Institute, shows that 67 percent of medical device makers and 56 percent of HDOs believe an attack on the medical devices they build or use is likely to occur in the next 12 months.
In fact, roughly one-third of respondents said they were aware of cyber incidents that had a negative impact on patients, including inappropriate therapy or treatment delivery, ransomware attacks, denial-of-service (DoS) attacks, and hijacking of medical devices.
On the other hand, only 17 percent of device manufacturers and 15 percent of HDOs have taken significant steps to prevent attacks.  Roughly 40 percent on both sides admitted that they haven’t done anything to prevent attacks.
   The study shows that more than half of device manufacturers and HDOs blame the presence of vulnerable code on lack of quality assurance and testing procedures, while nearly 50 percent also blame the rush-to-release pressure on the development team, accidental coding errors, and lack of training on secure coding practices.

Also for my Computer Security students.
Email attacks are cheap, easy, low risk, and high reward.  No wonder a “malicious email is the cyber spy’s favored way in.”  An email security breach could impact your organization’s revenue and reputation.  Protecting yourself from a breach can be daunting, given how many emails pass through your organization each week.
But if you think of cybercriminals as a business, you can keep up with them more effectively.  After all, most want to make a profit.  

That’s why they call it “disinformation.”
Thomas Fox-Brewster reports:
The first evidence that the hacker crew responsible for the breach of the Democratic National Committee (DNC) snuck false information into their leaks has been uncovered by a group of researchers.
The hackers, a group called Fancy Bear that U.S. intelligence and law enforcement claim to be sponsored by Russia’s intelligence unit, the GRU, planted the information inside a leak of emails belonging to a journalist and critic of the Putin regime, according to a report from Citizen Lab, a University of Toronto-based organization.  That formed part of a massive hacking campaign attempting to steal Google passwords from 218 targets across 39 countries, including former American defense officials.
Read more on Forbes.


Why no announcement? 
The Windows Malicious Software Removal Tool has been updated for WannaCry
   all Windows users have access to the Malicious Software Removal Tool (MSRT) even though they may not be aware of it.
   What changed? Initially, Microsoft didn't say, the home page for MSRT, had not been updated as of the 25th.
However, when asked, a company representative said that the May 22nd update was "to detect and remove WannaCrypt malware."  WannaCrypt is another name for WannaCry.
You can run MSRT manually by simply typing "MRT" into the Run box.  Or, you can find it at

It used to be done with the Mark 1 eyeball.  Is automating it really that much more evil?
Throughout New York state, police agencies have for years been using automated license plate readers (ALPR, also known as ANPR in Europe) without the sanction of the legislature or the courts.  Earlier this month, the New York Court of Appeals — the state’s highest court — took up the question for the first time and sided with the use of plates to track members of the public, even if they are not suspected of committing any crime.
The town of Rhinebeck, for example, has a population of just 7548, but over the course of three months in 2011, it photographed 164,043 license plates.  Of these, just eight were in any way linked to suspicious activity, according to documents obtained by the American Civil Liberties Union.  Nonetheless, the movements of all motorists were stored in a long-term database.  There are no statewide rules limiting how long such information can be stored.

From the people who bring “double secret probation” to government?
Tim Johnson reports:
U.S. intelligence agencies conducted illegal surveillance on American citizens over a five-year period, a practice that earned them a sharp rebuke from a secret court that called the matter a “very serious” constitutional issue.
The criticism is in a lengthy secret ruling that lays bare some of the frictions between the Foreign Intelligence Surveillance Court and U.S. intelligence agencies obligated to obtain the court’s approval for surveillance activities.
The ruling, dated April 26 and bearing the label “top secret,” was obtained and published Thursday by the news site Circa.
It is rare that such rulings see the light of day, and the lengthy unraveling of issues in the 99-page document opens a window on how the secret federal court oversees surveillance activities and seeks to curtail those that it deems overstep legal authority.
Read more on Miami Herald.

An article for my students to consider.
Rethinking Ethics Training in Silicon Valley

Interesting... Perhaps they could find a search engine to help?
Accused of underpaying women, Google says it's too expensive to get wage data
Google argued that it was too financially burdensome and logistically challenging to compile and hand over salary records that the government has requested, sparking a strong rebuke from the US Department of Labor (DoL), which has accused the Silicon Valley firm of underpaying women.
Google officials testified in federal court on Friday that it would have to spend up to 500 hours of work and $100,000 to comply with investigators’ ongoing demands for wage data that the DoL believes will help explain why the technology corporation appears to be systematically discriminating against women.
Noting Google’s nearly $28bn annual income as one of the most profitable companies in the US, DoL attorney Ian Eliasoph scoffed at the company’s defense, saying, “Google would be able to absorb the cost as easy as a dry kitchen sponge could absorb a single drop of water.”

Smarter than I was at that age.  (And I’ve clearly gone downhill from there.)
11-year-old claims classroom punishment violates Geneva Convention

How to get my students interested in AI?  My pick would be of interest to Auditors, too. 
Here are some companies Google’s new AI investment arm might be interested in
Google is launching a new investment arm aimed at artificial intelligence, according to a report in Axios.  A source familiar with Google’s plans says the new program will focus on early-stage startups.
Where the new investment seems to differ most from Google’s existing investing groups is that it’s led by engineers, not venture capitalists.  Google VP of engineering Anna Patterson, whose focus as an executive is AI, is in charge of the effort, according to Axios.  
   Here are a few startups that reflect areas in which Google may be interested in investing:
Anodot automates the detection of outliers in large datasets.  This could be a useful for enterprise companies crunching data in the the cloud.  Anodot has raised $12.5 million in funding.

For my geeks!
Virtualization allows one operating system (OS) to run on another OS.  But did you know that a Virtual Machine (VM) clone of your hard drive can put your entire computer inside of another computer?  With VMs, the possibilities are endless.  For most people, though, virtualization enables playing older games using emulation, the ability to sandbox, running multiple OSes, and much more (practical VM uses).  You can even set up a Windows virtual machine in Linux.
This article covers how to create a VM clone of your system and how to use it once you’ve managed to create the virtual machine.

No comments: