Forensics.  Perhaps they should ‘wash it’ through Google translate a few times. 

http://www.securityweek.com/linguistic-analysis-shows-wannacry-authors-speak-chinese

Linguistic Analysis Suggests WannaCry Authors Speak Chinese

A linguistic analysis of more than two dozen ransom notes displayed by the WannaCry ransomware suggests that its authors are fluent Chinese speakers and they also appear to know English.

While malware code similarities suggest that WannaCry has been developed by the North Korea-linked threat actor known as Lazarus, some believe the attack does not fit Pyongyang’s style and interests.

Researchers at threat intelligence firm Flashpoint have analyzed 28 WannaCry ransom notes, including ones written in Chinese (both simplified and traditional), Danish, Dutch, English, French, German, Indonesian, Italian, Japanese, Korean, Norwegian, Portuguese, Romanian, Russian, Spanish, Swedish and Turkish.

The linguistic analysis showed that there are significant differences between the notes written in Chinese and the ones written in other languages.  Evidence suggests that the Chinese note, which mostly uses proper grammar, punctuation and syntax, was actually written with a Chinese-language keyboard.

…   Experts pointed out that the note written in Chinese includes a significant amount of content that is not present in other versions, and they believe it may have served as the source for the English version.

Heartless hackers?  

http://www.securityweek.com/thousands-third-party-library-flaws-put-pacemakers-risk

Thousands of Third-Party Library Flaws Put Pacemakers at Risk

Researchers have conducted a detailed analysis of pacemaker systems from four major vendors and discovered many potentially serious vulnerabilities.

The fact that implantable cardiac devices such as pacemakers and defibrillators are vulnerable to hacker attacks has been known for years, and while steps have been taken to address issues, security experts still report finding flaws in these products.

WhiteScope, a company founded by Billy Rios, one of the first security researchers to analyze medical devices, recently conducted an analysis of the implantable cardiac device ecosystem architecture and implementation interdependencies, with a focus on pacemakers.

…   Tests conducted on devices acquired from eBay showed that reverse engineering their firmware is made easy by the fact that many of them use commercial, off-the-shelf microprocessors.

…   WhiteScope has analyzed four pacemaker programmers and found that they use more than 300 third-party libraries.  Of these components, 174 are known to have a total of more than 8,000 vulnerabilities.

“Despite efforts from the FDA to streamline routine cybersecurity updates, all programmers we examined had outdated software with known vulnerabilities,” Rios said in a blog post.

…   Another potential problem is the fact that programmers do not require any type of authentication for programming implantable cardiac devices.

Am I aiding and abetting the Streisand Effect?  (I certainly hope so.)  “Those who do not understand the Streisand Effect are doomed to repeat it?”  Worth reading, just to list the errors. 

Another day, another litigation threat

I am really out of patience for people threatening me or my site.  Look at this one:

I need to you get rid of an article off of your website: The link is:

https://www.databreaches.net/cytta-reports-online-hacking-of-their-nevada-secretary-of-state-officer-and-director-data/

[ … ]

If Steffan Dalsgaard didn’t like CYTTA’s press release or their 8-K SEC filing, he had remedies available to him.  You threatening my site 2+ years later on his behalf is not among those remedies.  If you had additional information to submit as an update or for a correction, you could have submitted it.  Instead, you just attempted to intimidate me into removing a post.

So, Daniel, how’s that strategy working out for you and Steffan Dalsgaard so far?

How to get your message out when no one really wants to listen?  

http://www.securityweek.com/russias-disinformation-efforts-hit-39-countries-researchers

Russia's Disinformation Efforts Hit 39 Countries: Researchers

Russia's campaign of cyberespionage and disinformation has targeted hundreds of individuals and organizations from at least 39 countries along with the United Nations and NATO, researchers said Thursday.

A report by the Citizen Lab at the University of Toronto revealed the existence of "a major disinformation and cyber espionage campaign with hundreds of targets in government, industry, military and civil society," lead researcher Ronald Deibert said.

The findings suggest that the cyber attacks on the 2016 presidential campaign of Hillary Clinton -- which US intelligence officials have attributed to Russia -- were just the tip of the iceberg.

Citizen Lab researchers said the espionage has targeted not only government, military and industry targets, but also journalists, academics, opposition figures, and activists.

[I think this is the report they reference:  https://citizenlab.org/2017/05/tainted-leaks-disinformation-phish/

Oh hell yes!

http://knowledge.wharton.upenn.edu/article/privacy-a-big-deal/

Is Privacy Still a Big Deal Today?

Americans value their privacy, but they are also resigned to giving up their personal data in order to transact with a company.  Is there a better way for both sides to get what they want?

Perspective.  Amazon is getting into the food market by going brick and mortar?

https://www.geekwire.com/2017/amazonfresh-pickup-opens-prime-members-seattle-automatic-license-plate-recognition/

AmazonFresh Pickup expands to Prime members in Seattle, with automatic license-plate recognition

Amazon is expanding its latest brick-and-mortar retail experiment beyond an internal employee beta today, letting Amazon Prime members order groceries online for pickup during designated windows at two locations in the company’s hometown.

The broader launch of the AmazonFresh Pickup service, in Seattle’s Ballard and SoDo neighborhoods, also brings new details about how the pickup process works.  Amazon says in an online FAQ that it “may use license plates to automatically recognize your vehicle when you arrive,” helping the company quickly match arriving customers with their orders.  Customers can opt-out of automatic check-in from their settings.

Helping my students see what I’m talking about?

https://venturebeat.com/2017/05/26/google-launches-gif-making-tool-to-help-you-tell-simple-stories-using-2-data-points/?google_editors_picks=true

Google launches Data GIF Maker to help storytellers convey information through animations

…   GIFs continue to be used for many purposes, which is why Google has launched the Data Gif Maker, a tool aimed at helping journalists and storytellers convey information visually through simple animations.

“Data visualizations are an essential storytelling tool in journalism, and though they are often intricate, they don’t have to be complex,” said Simon Rogers, data editor at the Google News Lab, in a blog post.  “In fact, with the growth of mobile devices as a primary method of consuming news, data visualizations can be simple images formatted for the device they appear on.”

…   Latvian infographics and data visualization company Infogram offers a slick WYSIWYG editor that converts users’ data into infographics that can be published or embedded anywhere, and it was acquired by Prezi earlier this month.

Other companies are making moves to monetize GIFs, specifically.  Last month, Tenor launched a real-time analytics tool designed to educate marketers about using GIFs.

Sounds like a candidate for study.  Any grants available?  

https://www.bespacific.com/marshall-project-new-tool-that-could-revolutionize-how-we-measure-justice/

Marshall Project – New Tool That Could Revolutionize How We Measure Justice

by Sabrina I. Pacifici on May 25, 2017

Beth Schwartzapfel – The Marshall Project: “The enormity of the country’s criminal justice system — 15,000 state and local courts, 18,000 local law enforcement agencies, more than two million prisoners — looks even more daunting when you consider how little we know about what is actually going on in there.  Want to know who we prosecute and why?  Good luck.  Curious about how many people are charged with misdemeanors each year?  Can’t tell you.  How about how many people reoffend after prison?  We don’t really know that, either.  In an age when everything is measured — when data determines the television we watch, the clothes we buy and the posts we see on Facebook — the justice system is a disturbing exception.  Agencies exist in silos, and their data stays with them.  Instead, we make policy based on anecdote, heavily filtered through a political lens.  This week the nonprofit Measures for Justice is launching an online tool meant to shine a high beam into these dark corners.  It is gathering numbers from key criminal justice players — prosecutors offices, public defenders, courts, probation departments — in each of America’s more than 3,000 counties.  Staffers clean the data, assemble it in an apples-to-apples format, use it to answer a standard set of basic questions, and make the results free and easy to access and understand…”

Are the number of investigations going up this fast or are requests made on a higher percentage of investigations?  (Investigations that did not normally ask for this information before?) 

http://thehill.com/policy/cybersecurity/334945-apple-national-security-requests-skyrocketed-in-second-half-of-2016

Apple: National security requests for data skyrocketed in second half of 2016

…   According to the report, between 5,750 and 5,999 National Security Letters were issued for data from 4,750 to 4,999 different accounts.

…   This marks at least the sixth consecutive half where the number of NSLs rose.  In first half of 2014, there were between 0-249 delivered to Apple.  In second half 2014, there were between 250-499. In 2015, the government issued 750-999 followed by 1,250-1,499.  And in the first half of 216, it issued 2,750-2,999.

According to the report, the government also requested data on 4,254 accounts through more conventional means, like search warrants, subpoenas and other court orders.

Making sense of the GDPR.  An article that details what will be in the course.

https://www.troyhunt.com/free-course-the-gdpr-attack-plan/

Free course: The GDPR Attack Plan

The General Data Protection Regulation is an EU reg that kicks in on 25 May 2018 so we've got bang on a year to get organised.  It's important within the EU because it relates to how data of their citizens and residents is handled and it's important outside the EU because the regulation can impact non-EU organisations too.

Leaks for money or ‘prestige?”

http://www.cnbc.com/2017/05/25/uk-stops-sharing-intelligence-with-us-following-manchester-attack.html?__source=google%7Ceditorspicks%7C&par=google&google_editors_picks=true

‘Furious’ UK reportedly stops sharing intelligence with US following Manchester attack leak

…   British officials were outraged when photos of debris from the attack were leaked and published in the New York Times, the BBC said on Thursday.  The images vividly show part of the explosive device and jacket worn by the suicide bomber.

Though the Times did not disclose how it sourced the images, a senior U.S. law enforcement official authenticated the photos and said they had been provided to American investigators by British authorities.

Leaked information about the identity of the assailant – now confirmed as Salman Abedi - also emerged in U.S. media less than 24 hours after the attack against the U.K.'s wishes.

British Home Secretary Amber Rudd described the leaks as "irritating" and insisted that they "should not happen again."

A Whitehall source added: "We are furious.  This is completely unacceptable," according to the BBC.

Consider how difficult this seems.  Would most businesses do better?

https://www.bespacific.com/cia-releases-officially-released-information-system-database-with-50-yrs-of-foia-request-documents/

CIA releases Officially Released Information System database with 50 yrs of FOIA request documents

by Sabrina I. Pacifici on May 24, 2017

Via Muckrock’s work and posting as follows: “The results of the Agency’s ambitious project to track all the information its made public will soon become a valuable tool for government transparency.  In 1985, citing concerns regarding “difficulty determining what has been publicly disclosed,” the CIA had a truly great idea that would serve both the Agency and the public’s interest in government transparency – a “proposal to establish a focal point to record CIA information released to the public.”  The resulting Officially Released Information System, or ORIS, would take years to finally implement, and thanks [to a recent FOIA] (https://www.muckrock.com/foi/united-states-of-america-10/officially-released-information-system-contents-35179/#file-1338090) – and the CIA’s agreement to release and waive all fees – it might finally become the transparency tool it has the potential to be.  The problem of knowing what had already been acknowledged wasn’t a new problem to the Agency, either.  The issue extended back to the 1970s for them, and had been brought up again in 1983.  Previous attempts had all failed or resulted in incomplete division-specific systems.  CIA needed an Agency-wide solution, and it was finally beginning to be technologically feasible.”

Perspective.

http://www.cnbc.com/2017/05/24/goldman-sachs-ride-hailing-companies-will-dwarf-taxis.html

Ride-hailing companies will grow eightfold by 2030, dwarfing the taxi industry: Goldman Sachs

Uber may be under pressure in the press — but its business model is still on track to dominate and "ultimately eclipse" the taxi market, according to a new analysis from Goldman Sachs.

Uber, alongside companies like Lyft and China's Didi Chuxing, are part of a new "pay-as-you-go" car era, Goldman said.  The investment bank predicts that the number of cars on the road will peak in 2030.

Ride-hailing will grow eightfold by then and could be five times the size of the taxi market, justifying the giant valuations, the report said.  At $68 billion and $50 billion, respectively, Uber and Didi are the two most highly valued venture-backed companies, according to data firm CB Insights.

Central to the growth of this industry, according to Goldman Sachs, is the proliferation of self-driving cars.

"We model a scenario in which a fleet manager could generate profit of $14,000 per car over three years, nine times what [a manufacturer] currently makes from selling a car," Goldman's analysts wrote in the report.

(Related).  We don’t need cable TV, landline phones, or cars. 

https://venturebeat.com/2017/05/25/many-uber-and-lyft-riders-are-ditching-their-own-cars/?google_editors_picks=true

Many Uber and Lyft riders are ditching their own cars

…   Nearly a quarter of American adults sold or traded in a vehicle in the last 12 months, according to a Reuters/Ipsos opinion poll published on Thursday, with most getting another car.  But 9 percent of that group turned to ride services like Lyft Inc and Uber Technologies Inc as their main way to get around.

About the same percentages said they planned to dispose of cars and turn to ride services in the upcoming 12 months.

Though a small percentage, the figure of people switching to ride services could be early evidence that more consumers believe that ride sharing can replace vehicle ownership.

It takes a while to settle these things. 

http://www.sfchronicle.com/news/us/article/NY-Attorney-General-18-5-million-settlement-11166995.php 

Target, states reach $18.5 million settlement on data breach

Target Corp. has reached an $18.5 million settlement over a massive data breach that occurred before Christmas in 2013, New York's attorney general announced Tuesday.

The agreement involving 47 states and the District of Columbia is the largest multistate data breach settlement to date, Attorney General Eric T. Schneiderman's office said.  The settlement, which stipulates some security measures the retailer must adhere to, resolves the states' probe into the breach.

…   Target had announced the breach on Dec. 19, 2013, saying it occurred between Nov. 27 and Dec. 15 of that year.  It affected more than 41 million customer payment card accounts and exposed contact information for more than 60 million customers.

…   The settlement requires Target to maintain appropriate encryption policies and take other security steps, though the company has already implemented those measures.

For my Computer Security students. 

http://www.securityweek.com/ceos-and-coffee-shops-are-mobile-computings-biggest-risks-report

CEOs and Coffee Shops Are Mobile Computing's Biggest Risks: Report

The balance between encouraging mobility for business purposes and controlling it for security remains as tricky today as ever.  Ninety-three percent of organizations are now somewhat or very concerned that the mobile workforce is presenting an increasing number of security challenges.  Of these, 47% are 'very concerned'; a figure that has grown from 36% a year ago.

These figures come from the iPass 2017 Mobile Security Report (PDF), published today.  iPass is a global provider of always-on, secure Wi-Fi; with more than 60 million hotspots in more than 120 countries.

Something my students and I will explore.

http://www.securityweek.com/flashpoint-enhances-risk-intelligence-platform

Flashpoint Enhances Risk Intelligence Platform

Just as global intelligence firm Stratfor extracts and presents geopolitical intelligence from the noise of available information, so now does Flashpoint extract cyber business risk intelligence (BRI) from the noise of deep and dark web conversations.

…   That process has now come to fruition with today's launch of the Flashpoint Intelligence Platform 3.0.  It aims to convert and present the raw intelligence gleaned from the deep and dark web as actionable business risk intelligence that will help customers take a more strategic role in security planning.

A very long and very damning illustration of failure at HHS.  So why is the government spending my tax dollars?  Perhaps even they do not know.   

Calling time of death on HHS’s “breach tool”

I was excited back in 2010 when HHS started posting breaches on what some would call the “wall of shame.”  I knew that we’d only learn about breaches involving HIPAA-covered entities, but at least we were finally starting to get some actual data.  Now, more than 6 years later, it’s become clear to me that it’s probably best to just call time of death on the breach tool, despite its popularity with marketers who look for numbers to support their sales pitches.

In this post, I review some of what we are not seeing on HHS’s breach tool, and why it’s really not a source of accurate or helpful information for those who want to understand breaches and incidents involving health or medical data.

It sure looks like blackmail…  The “Program” consists of an App and some hardware. 

NY: Police are blackmailing motorists into installing cellphone monitoring devices

Joe Cadillic writes:

Since 2016, New York motorists are being forced asked to let the police spy on their cellphones for a minimum of 90 days.

In Nassau County, motorists are asked, wink, wink to pay hundreds of dollars to enter the ‘Distracted Driver Education Program’ (DDEP). The Feds, claim to offer motorists a choice, either dispute the texting while driving ticket in court, accept a 5 point moving violation or enter the DDEP.

Before a motorist can enter the DDEP they have to pay a distracted driving citation which can be anywhere from $50 and $400 and have to pay an installation fee of $125.00 for the in-car device.

Read more on MassPrivateI.

[From the article: 

"A device called DriveID is installed in the motorist’s primary vehicle and an app is installed on the motorist’s phone.  The app receives information from the device which causes the keyboard of the phone to deactivate and the screen to be blocked.  The motorist is broken of the habit of reaching for the device.  However, voice commands are not disabled, so the motorist can still use apps like “Hey Siri”, which don’t require the user to touch or even look at their device, to control their device legally while driving."

We can, therefore we must!

Class Claims BART Snoops on Its Riders

Helen Christophi reports:

Even trains are spying on us now, a woman claims in a federal class action accusing the Bay Area Rapid Transit District of tracking passengers’ movements by duping them into downloading a seemingly benign crime-reporting app.

Pamela Moreno claimed Monday that BART collects personal information from riders’ cellphones and tracks their location through its BART Watch app, without consent.

Read more on Courthouse News.

Perhaps the “administration” should actually walk around their school?  What else have they missed? 

Ca: Potential privacy breach after Collingwood Collegiate students secretly recorded for five years

CTV reports:

The Simcoe County District School Board  is warning students and parents of a possible privacy breach after discovering surveillance cameras were secretly installed in some of the music classrooms at Collingwood Collegiate Institute.

The discovery was made late last year and the board has been investigating the matter with Collingwood OPP and the Information and Privacy Commissioner of Ontario (IPC).

All of the monitoring equipment was removed by school board staff after being discovered and is now secured at the board office.

An internal investigation determined the surveillance cameras were installed approximately five years ago by two staff members to address issues of alleged instrument theft.  The school’s administration was unaware that the equipment was installed or in place during the five year period, the board said.

Read more on CTV.

So, they could clone you?

Ancestry.com takes DNA ownership rights from customers and their relatives

Joel Winston writes:

Don’t use the AncestryDNA testing service without actually reading the Ancestry.com Terms of Service and Privacy Policy.  According to these legal contracts, you still own your DNA, but so does Ancestry.com.

The family history website Ancestry.com is selling a new DNA testing service called AncestryDNA.  But the DNA and genetic data that Ancestry.com collects may be used against “you or a genetic relative.”  According to its privacy policies, Ancestry.com takes ownership of your DNA forever.  Your ownership of your DNA, on the other hand, is limited in years.

It seems obvious that customers agree to this arrangement, since all of them must “click here to agree” to these terms.  But, how many people really read those contacts before clicking to agree?  And how many relatives of Ancestry.com customers are also reading?

Read more on ThinkProgress.org.

And so it goes…

http://thehill.com/policy/cybersecurity/334809-appeals-court-decision-keeps-lawsuit-against-nsa-surveillance-alive

Appeals court decision keeps lawsuit against NSA surveillance alive

A federal appeals court on Tuesday reversed a lower court’s decision to dismiss Wikimedia’s lawsuit challenging the National Security Agency’s (NSA) mass interception of Americans’ international digital communications.

The lower court had ruled in 2015 that the case, filed by the American Civil Liberties Union (ACLU) on behalf of the Wikimedia Foundation, The Nation magazine, Amnesty International USA, Human Rights Watch and other groups, failed to demonstrate that their communications were being monitored by the NSA.

A panel of three judges on the 4th Circuit Court of Appeals unanimously disagreed with this on Tuesday, allowing Wikimedia to continue its lawsuit.

Google gets “anonymized” data and immediately matches it to your online identity?  They get “encrypted” data and can tell who you are and what you purchased?  I don’t think the authors of these articles knew much about their topic.   

http://fortune.com/2017/05/24/google-track-offline-purhcases/

Google’s New Feature Can Match Ad Clicks With In-Store Purchases

…   A new feature, born out of partnerships between Google and credit and debit card companies, links in-store purchases to your online identity, CNN reports.  That means Google could tell whether you clicked an online ad before buying the product in a shop later.

Companies that Google partners reportedly account for 70% of all credit and debit card purchases in the U.S.  According to CNN, credit and debit card companies will send Google encrypted information about store purchases, that can then be compared to collective online profiles of users who clicked on corresponding ads.

Google said that encryption means it cannot see identifiable payment information such as the customer's name or what they bought.  The tool also doesn't work for cash payments

This columnist makes an interesting point.

Huge Profits Aren't Enough For Car Companies Anymore

Mark Fields’ abrupt removal from Ford should come as something of a warning to other traditional automakers, especially ones whose shareholders demand answers as to why they aren’t valued as highly as Tesla: profits aren’t enough anymore.  Record sales aren’t enough anymore.  Making the goddamn F-150, which will always sell in huge volumes even in the event of the apocalypse, somehow isn’t enough.

Fields wasn’t perfect but he was far from being a bad CEO, and right now it’s all about “mobility” and “technology” for Wall Street—even though no one really has a clear view of what that means or how to make it profitable.

Researching the Twits?

https://www.bespacific.com/twitter-as-a-data-source-an-overview-of-tools-for-journalists/

Twitter as a data source: An overview of tools for journalists

by Sabrina I. Pacifici on May 23, 2017

Data Driven Journalism: “Journalists may wish to use data from social media platforms in order to provide greater insight and context to a news story.  For example, journalists may wish to examine the contagion of hashtags and whether they are capable of achieving political or social change.  Moreover, newsrooms may also wish to tap into social media posts during unfolding crisis events.  For example, to find out who tweeted about a crisis event first, and to empirically examine the impact of social media.  Furthermore, Twitter users and accounts such as WikiLeaks may operate outside the constraints of traditional journalism, and therefore it becomes important to have tools and mechanisms in place in order to examine these kinds of influential users.  For example, it was found that those who were backing Marine Le Pen on Twitter could have been users who had an affinity to Donald Trump.  There remains a number of different methods for analysing social media data.  Take text analytics, for example, which can include using sentiment analysis to place bulk social media posts into categories of a particular feeling, such as positive, negative, or neutral.  Or machine learning, which can automatically assign social media posts to a number of different topics…” 

A place for my students to share their skills? 

https://venturebeat.com/2017/05/24/ifttt-launches-new-maker-tier-to-let-any-developer-build-and-publish-their-own-applets/?google_editors_picks=true

IFTTT now lets any developer build and publish applets for others to use

IFTTT, the platform that allows users to create customized, conditional interactions between apps, online services, digital assistants, and devices, has announced that it’s opening its platform to individual developers, allowing them to build and publish their own applets for others to use.

…   From today, IFTTT is making this available to individual developers too, via a free “maker” tier that lets anyone build and publish applets.

…   It’s worth noting here that up until now, anyone has been able to build applets that work with two IFTTT services for personal use.  But with this new offering they can publish their applets for others to use, and showcase everything on a dedicated maker profile page.

Additionally, they can create applets that work on any connected device, regardless of whether they own one of these devices themselves.  And above all else, makers can now build applets with multiple actions, as partner companies have been able to do since last year.

…   In a way, this launch is a little like smartphone app stores allowing any developer to build and create apps.  It enables IoT companies to tap a gargantuan developer pool, with some potentially interesting connected device and service integrations coming to the fore.  By opening to individuals, developers could have their applets picked up and featured by some big name partner companies, including Domino’s or Adobe.

Stealing a little from a lot of people?  Good in theory, but it still sends you to jail.  

http://www.securityweek.com/russian-hackers-infected-1-million-phones-banking-trojan

Russian Hackers Infected 1 Million Phones With Banking Trojan

…   The cybercrime gang targeted by Russian authorities used spam SMS messages to deliver the Trojan to individuals in Russia.  The messages informed recipients that their ads or photos had been posted on a website, and included links to a site that tricked users into downloading and installing the malware.  The threat had been disguised as various apps, including Avito, Pornhub, Framaroot and Navitel.

Once it infected a device, the Trojan allowed the cybercrooks to steal and hide SMS messages coming from banks, and send SMSs to specified numbers.  Since many Russian banks allow their customers to conduct transactions via SMS, these features allowed the fraudsters to transfer money from the victims’ accounts into their own.

According to Group-IB, the gang opened more than 6,000 bank accounts to which they transferred the stolen funds.  Investigators said the Cron malware was used to steal an average of $100 (8,000 rubles) from 50-60 bank customers each day.

The cybercriminals managed to infect more than one million smartphones and stole nearly $900,000 (50 million rubles).

Not a large breach, but one that points to people/places where one could steal a gun.  

Hackers may have names of thousands of Florida gun owners

Andrew Ruiz reports:

The Florida Department of Agriculture and Consumer Services is warning customers that hackers may have obtained the names of more than 16,000 people who have Florida concealed weapon permits.

The data breach that appears to have originated from overseas affects people who entered information through the department’s online payment system.

Read more on WPTV.  While the story leads with the number of names, it’s important to note that 469 Social Security numbers were also acquired by the hackers.

For the Ethical Hacking toolkit.

http://www.zdnet.com/article/ultrasecure-samsung-galaxy-s8-iris-scanner-can-be-easily-tricked-say-hackers/

'Ultrasecure' Samsung Galaxy S8 iris scanner can be easily tricked, say hackers

…   A CCC video shows how simple the trick is.  In it, someone uses the night mode on a regular Sony digital camera to surreptitiously take an infrared shot of the phone user's eyes, from a moderate distance.

The image is cropped and printed out on, cheekily, a Samsung printer at life size.  A contact lens is placed on the printed iris, to give it the appropriate curvature, and the Galaxy S8 accepts this as authentication for unlocking the phone.

For my Forensics students.

Court Applies Work Product Protection to Breach Investigation Reports

Al Saikali of Shook Hardy & Bacon LLP writes about a key issue that has come up a number of times in discussing incident response and liability:

One of the most significant questions in data security law is whether reports created by forensic firms investigating data breaches at the direction of counsel are protected from discovery in civil class action lawsuits.  They are, at least according to an order issued last week in In re Experian Data Breach Litigation. 15-01592 (C.D. Cal. May 18, 2017).  This post analyzes the decision, identifies important practical takeaways for counsel, and places it in context with the two other cases that have addressed this issue.

Read more on Data Security Law Journal.

Potential jobs for my Computer Security students.

Where is the future of HIPAA enforcement headed?

Ira Parghi of Ropes & Gray writes:

Since January 2016, the OCR has entered into resolution agreements with, and imposed Corrective Action Plans (CAPs) on, providers and others in at least 12 matters involving the Security Rule.  It has also imposed a Civil Monetary Penalty on one entity.  Most of these cases involve stolen, unencrypted laptop computers (at least six cases), mobile devices such as iPads or iPhones, office computers, or portable storage devices.

[…]

Notably, while the underlying facts of these cases vary somewhat, their CAPs do not.  All 12 of the CAPs hone in on the obligation under the Security Rule to perform an annual Risk Analysis and Risk Management Plan.

Read more on MedCityNews.

For my students.  

Prevent WannaCry Malware Variants by Disabling This Windows 10 Setting

…   We now know that the ransomware spread due an exploit in the Windows Server Messaging Block (SMB) protocol version 1.  This is an outdated version of SMB, used to share files and printers among networked computers, that Windows still supports for backwards compatibility.  Microsoft patched this issue in March, but affected computers were still vulnerable to attack if they were running the archaic Windows XP or hadn’t applied updated in Windows 7 for months.

On your own system, you can disable SMB 1.0 in just a moment — and because 99 percent of home users don’t need the old and insecure version of this protocol, you can shut it off without any loss of functionality.

Type Turn Windows features into the Start Menu and click the entry for Turn Windows features on or off.  Scroll down to SMB 1.0/CIFS File Sharing Support and uncheck the box.  Give Windows a moment to apply the changes, then you’ll have to restart your computer to complete the action.  Once that’s done, you’ve disabled the awful, insecure protocol from running on your computer.

Hey!  Whatever works!  Nothing new there. 

http://knowledge.wharton.upenn.edu/article/uber-waymos-race-capture-self-driving-market/

How the Waymo-Uber Lawsuit Could Rewrite Intellectual Property Rules

…   According to Wagner, trade secret law has traditionally not been seen as “a particularly reliable or useful way to protect technology,” partly because it is difficult to keep such technology secret when it is implemented and products based on it are sold.  But that conventional wisdom is up for a reexamination.  “If Google is successful at putting a dent in Uber’s ability to compete in this field as a result of this case, then people will take notice of that and you will probably see more people using trade secrets” as part of their intellectual property strategies, said Wagner.  “On the other hand, if Google is not successful, or even if they win this case and they don’t slow Uber down very much, then people are going to go back to what we traditionally think of in IP, which is unless you have a patent covering the technology, you don’t have a lot of protection.”

Perspective.  Does this suggest that everyone is upgrading or are there still people like me who don’t yet own a smartphone? 

https://www.androidheadlines.com/2017/05/gartner-worldwide-smartphone-sales-grew-9-yoy-q1-2017.html

Gartner: Worldwide Smartphone Sales Grew 9% YoY In Q1 2017

Gartner has just released its smartphone sales report for the first quarter of this year, and according to the provided info, worldwide smartphone sales grew by 9 percent this time around.  Companies sold a total of 380 million smartphones in Q1 2017, which is a 9.1 percent increase compared to the same quarter last year.  Gartner also says that consumers are spending more to get a better phone now, which actually caused a rise in average selling price for smartphones.

Might be useful in my Statistics class.

https://www.bespacific.com/dataset-aggregates-info-on-food-spending-habits-using-3-million-grocery-orders/

Dataset aggregates info on food spending habits using 3 million grocery orders

by Sabrina I. Pacifici on May 22, 2017

Center for Data Innovation – “Online grocery service Instacart has published a dataset containing information on 3 million grocery orders from more than 200,000 de-identified users from 2017.  The dataset contains information on what products users purchased, the sequence they bought them in, when they placed the order, and the amount of time between Instacart orders.  Instacart is releasing this dataset in the hopes that others will use it to develop algorithms that can predict what items shoppers will buy again or may be interested in.”

What are you listening to?  NOT FREE.

8 Websites to Help You Discover New Music Genres

…   You need some websites and apps that take you out of your comfort zone.  With that in mind, here are eight essential websites for broadening your musical knowledge.

We’re going to have to schedule more classes. 

https://www.wsj.com/articles/all-it-jobs-are-cybersecurity-jobs-now-1495364418?mod=rss_Technology

All IT Jobs Are Cybersecurity Jobs Now

The rise of cyberthreats means that the people once assigned to setting up computers and email servers must now treat security as top priority

Trying to create a single, simple set of rules to define what is acceptable in every community around the world?  Good luck with that. 

https://www.theguardian.com/news/2017/may/21/revealed-facebook-internal-rulebook-sex-terrorism-violence?CMP=share_btn_tw

Revealed: Facebook's internal rulebook on sex, terrorism and violence

Facebook’s secret rules and guidelines for deciding what its 2 billion users can post on the site are revealed for the first time in a Guardian investigation that will fuel the global debate about the role and ethics of the social media giant.

The Guardian has seen more than 100 internal training manuals, spreadsheets and flowcharts that give unprecedented insight into the blueprints Facebook has used to moderate issues such as violence, hate speech, terrorism, pornography, racism and self-harm.

…   The Facebook Files give the first view of the codes and rules formulated by the site, which is under huge political pressure in Europe and the US.

They illustrate difficulties faced by executives scrabbling to react to new challenges such as “revenge porn” – and the challenges for moderators, who say they are overwhelmed by the volume of work, which means they often have “just 10 seconds” to make a decision.

I’m shocked, shocked I tell you!  Oh wait, I don’t do it either. 

https://www.bespacific.com/pew-not-everyone-in-advanced-economies-is-using-social-media-2/

Pew – Not everyone in advanced economies is using social media

by Sabrina I. Pacifici on May 21, 2017

“Despite the seeming ubiquity of social media platforms like Facebook and Twitter, many in Europe, the U.S., Canada, Australia and Japan do not report regularly visiting social media sites.  But majorities in all of the 14 countries surveyed say they at least use the internet.  Social media use is relatively common among people in Sweden, the Netherlands, Australia and the U.S.  Around seven-in-ten report using social networking sites like Facebook and Twitter, but that still leaves a significant minority of the population in those countries (around 30%) who are non-users.  At the other end of the spectrum, in France, only 48% say they use social networking sites.  That figure is even lower in Greece (46%), Japan (43%) and Germany (37%).  In Germany, this means that more than half of internet users say they do not use social media.  The differences in reported social media use across the 14 countries are due in part to whether people use the internet, since low rates of internet access limit the potential social media audience.  While fewer than one-in-ten Dutch (5%), Swedes (7%) and Australians (7%) don’t access the internet or own a smartphone, that figure is 40% in Greece, 33% in Hungary and 29% in Italy…”

Another disruption! 

https://venturebeat.com/2017/05/20/can-zillow-uber-ize-the-hundred-billion-dollar-real-estate-brokerage/?google_editors_picks=true

Can Zillow ‘Uber-ize’ the hundred-billion-dollar real estate brokerage?

Earlier this month, when Zillow announced a record high quarter, projecting to surpass a billion dollars in revenue by the end of this year, many wondered whether the company, with its 75 percent online real estate audience market share and 171 million monthly users, can “Uber-ize” real estate agents, cutting out traditional brick-and-mortar brokerage middlemen in the same way Uber bypassed taxi dispatchers.

The answer is perhaps yes, but it’s not quite that straightforward.

…   So-called “super agents,” who spend over $60,000 a year buying leads from Zillow and driving the company’s growth, are already spending more with Zillow than with Re/Max in desk fees, prompting accusations that Zillow is effectively collecting a “brokerage fee” without legally being a broker.

…   Traditionally, brokerages have flaunted their trusted brands as a key value to agents.  But even as brokerages spend billions in marketing, with the Internet today providing most of the vital information brokers once did, as many as 97 percent of homebuyers and sellers now consider their branding to be irrelevant in hiring an agent.

Given that 3 out of 4 home shoppers now start their search with Zillow, the company sees a well-timed opportunity to close the “search-to-transaction” loop.  If Zillow is able to assume all the roles of a broker without legally being a broker, then brokers could find their role increasingly limited until, like notaries, they exist only to fulfil a simple legal function: an agent must be affiliated with a broker to be paid.

The laddie doth protest too much, methinks.  Note that he says, “am not” not “will not.”  He is starting to talk like a politician. 

https://www.washingtonpost.com/business/mark-zuckerberg-im-not-running-for-public-office/2017/05/22/ea7d4ef4-3edc-11e7-b29f-f40ffced2ddb_story.html?utm_term=.645454e9e4f5

Mark Zuckerberg: I’m not running for public office

For my Spreadsheet students.

10 Easy Excel Timesavers You Might Have Forgotten

Microsoft has packed Excel with all kinds of different ways to get things done quicker.  However, you can’t take advantage of these features if you don’t know about them.

These ten techniques may only save you a few seconds every time you use them.  That might not sound like much, but if you can integrate them into your workflow, you’re sure to reap the benefits over time.

Probably not in my case, but a noble effort.

You Can Now Comprehend Any Scientific Paper Using This Site

The web has brought scientific knowledge at our fingertips.  But how do you make sense of it all?  How can you even begin to understand complex papers without the requisite education and training?

Call upon the aid of artificial intelligence and meet Iris.AI.  It’s a tool that gives you a shortcut to all the science that’s out there on the web.  It acts as a science assistant and makes sense of any openly available scientific paper you come across.

…   Iris makes research a lot simpler.  It identifies key points in the abstracts of a paper.  The algorithm then organizes concept maps with the key points.  And finally, it gives you access to the most relevant research papers which it groups by the concepts.

I rarely look at my blog statistics.  Last time I looked, Poland read my blog more than any other country.  This time it’s Russia.  What am I doing wrong/right?   

“To update or not to update” that is the question any Board of Directors must answer.

http://fortune.com/2017/05/20/microsoft-ransomware-legal/

Microsoft’s Old Software Is Dangerous. Is There a Duty to Fix It?

A global ransomware epidemic is winding down, but questions over the fallout are just beginning.  Who's to blame for the crisis that hijacked hundreds of thousands of computers?  And can anyone stop such criminals, whose victims included hospitals and police, from striking again?

These aren't easy questions, but one company, Microsoft, has more explaining to do than most.  After all, it was flaws in Windows systems that allowed hackers to carry out the ransomware attacks, which also struck companies and governments.  In some cases, like the U.K.'s National Health Service, the frozen computers put lives at risk.

If this was a different industry, Microsoft would likely face lawsuits for selling a faulty product.  But its product is software, and suing over flawed software is difficult.  This means the legal case against Microsoft is feeble—even if the moral one may be strong.

…   There's also the fact Windows is a closed software platform.  This means any defects in its source code are hard to detect because the internal workings that make it run—the source code—are all but invisible to those outside the company.  This is why some people like Eban Moglen, a noted computer law professor at Columbia University, considers platforms like Windows to be intrinsically dangerous.

"Proprietary software is an unsafe building material," he explained in a published speech.  "You can’t inspect it.  You can’t assess its complex failure modes easily, by simply poking at the finished article.  And most important of all, if you were aware of a problem that was of a safety-enhancing kind, that you could fix, you couldn’t fix it."

…   Cyber law professor Jennifer Granick of Stanford University suggests auto-industry style liability is not appropriate for software.

"While it is true that companies need to start to prioritize security in coding, it is unreasonable to ask Microsoft to be liable for anything that can be done with the 50 million lines of code in Windows 10," Granick told Fortune by email.

Not specifically targeted, but generally more vulnerable? 

Health Care Task Force Pre-Releases Report on Cybersecurity Days Before Ransomware Attack

Dena Feldman and Christopher Hanson write:

Last week, the Health Care Industry Cybersecurity (HCIC) Task Force (the “Task Force”) published a pre-release copy of its report on improving cybersecurity in the health care industry.  The Task Force was established by Congress under the Cybersecurity Act of 2015.  The Task Force is charged with addressing challenges in the health care industry “when securing and protecting itself against cybersecurity incidents, whether intentional or unintentional.”

The Task Force released its report mere days before the first worldwide ransomware attack, commonly referred to as “WannaCry,” which occurred on May 12.  The malware is thought to have infected more than 300,000 computers in 150 jurisdictions to date.  In the aftermath of the attack, the U.S. Department of Health and Human Services (HHS) sent a series of emails to the health care sector, including a statement that government officials had “received anecdotal notices of medical device ransomware infection.”  HHS warned that the health care sector should particularly focus on devices that connect to the Internet, run on Windows XP, or have not been recently patched.  As in-house counsels understand, the ransomware attack raises a host of legal issues.  For example, a recent Covington alert addresses insurance coverage for ransom attacks.

Read more on Covington & Burling Inside Medical Devices.

A more general question: Do we stifle creativity by insisting on security?  I really doubt it.  Companies that can deliver both will find the premium price they can charge will more than compensate for extra development time.

Potential HIPAA Pitfalls for Developers of Healthcare Apps

From PerkinsCoie:

As federal and state governments struggle to address future healthcare regulation, demand for healthcare that is cheaper, better and faster continues to surge.  Every day, new healthcare apps are being developed to respond creatively to this demand.  But pitfalls may await unsuspecting app developers where the lightning-fast technology sector meets the highly-regulated healthcare industry.  Failure to comply with the Health Insurance Portability and Accountability Act (HIPAA) is one such pitfall.

In this update, we highlight several HIPAA issues that all developers in the healthcare app field should consider, as well as healthcare plans, insurers and others parties contracting with developers.

Their update covers a number of issues, but I thought I’d pull out just one for you that highlights some of the complexities in working in this space:

From whom will the developer be gathering data?  A customer or consumer?

Consumer-facing products that are not made available on behalf of a covered entity or business associate generally will not be subject to HIPAA, but may be subject to stringent privacy and security requirements under the Federal Trade Commission Act and state law.  Products created for a covered entity or business associate customer that gather data from or provide data to consumers, however, may cause the developer to be subject to HIPAA.

Read their full alert on PerkinsCoie.

Perhaps we need an “encryption revolution” to break from the evil government issuing such warrants? 

Computer Searches: A ‘General’ Warrant Can No Longer Satisfy Requirements

Roger L. Stavis writes:

The “Warrant Clause” of the Fourth Amendment provides that “no Warrants shall issue, but upon probable cause, supported by Oath or affirmation, and particularly describing the place to be searched, and the persons or things to be seized.”  In a recent opinion requiring search warrants for “smart phones,” U.S. Supreme Court Chief Justice John G. Roberts expounded on the history behind the Fourth Amendment:

Our cases have recognized that the Fourth Amendment was the founding generation’s response to the reviled ‘general warrants’ and ‘writs of assistance’ of the colonial era, which allowed British officers to rummage through homes in an unrestrained search for evidence of criminal activity.  Opposition to such searches was in fact one of the driving forces behind the Revolution itself.

Riley v. California , 134 S. Ct. 2473, 2494 (2014).

Unfortunately, “general” warrants, authorizing “rummaging” searches without specification, are alive and well in the 21st Century.  More often than not, such “general warrants” are relied upon to authorize “rummaging” searches of computers.

Read more on New York Law Journal (free sub. required).

[From the Journal article: 

One commentator has noted that computers "are postal services, playgrounds, jukeboxes, dating services, movie theaters, daily planners, shopping malls, personal secretaries, virtual diaries and more."  Kerr, "Searches and Seizures in a Digital World," 119 Harv. L. Rev. 531, 569 (2005).