FBI probing attempted hack of Trump Organization, officials
say
The FBI is investigating an attempted overseas
cyberattack against the Trump Organization, summoning [??? Bob] President Donald Trump’s sons, Don Jr. and Eric, for an
emergency session with the bureau’s cybersecurity agents and representatives of
the CIA, officials tell ABC News.
Law enforcement officials who spoke
to ABC News on the condition of anonymity confirmed
the attempted hack and said the subsequent meeting took place at the
FBI’s New York headquarters on May 8, the day before Trump fired FBI director
James Comey. Spokesmen for the FBI, CIA
and Secret Service all declined to comment.
Reached by phone, Eric Trump, an
executive vice president of the family company, would not confirm or deny that
he and his brother had met with the FBI but told ABC News that the company had
ultimately not been infiltrated.
“We
absolutely weren’t hacked,” Eric Trump said during the brief call. “That’s crazy. We weren’t hacked, I can tell you that.” [Sounds a
bit like his father, doesn’t he? Bob]
As federal agencies monitor international computer
networks in order to protect government and private sector computer
infrastructure and data, the Trump
Organization’s networks would be given high priority, according to
Richard Frankel, a retired senior official with the FBI's New York office and
an ABC News contributor.
"If there was a hack or an
attempted hack of ... the company that was owned by the president, that would
be at the top of the list of investigations," Frankel said. "If the FBI saw that kind of hack, they'd
have to track that. There's no telling
what a hacker could get that's connected to the president, corporate records,
financial records, even things that were going on during the transition.”
The FBI’s involvement could come with
some risks, Frankel said, both for the company and the president. In the course of its investigation, the FBI
could get access to the Trump Organization’s computer network, meaning FBI
agents could possibly find records connected to other investigations.
Another airline computer system bites the dust. Are we sure this is coincidence?
British Airways cancels flights as major IT failure causes
worldwide delays
British Airways
has cancelled all flights from Heathrow and Gatwick before 6pm on Saturday due
to a major IT failure that is causing “very severe disruption” to its global
operations.
… The cause of the
issue remained unclear, but passengers on one flight were told by the pilot
that the IT problems were “catastrophic”.
… BA added that
there was no evidence a cyber attack had caused the outage.
Who would be responsible for a leased POS device?
Chipotle Removes Malware After Breach Strikes Payment Systems
Chipotle
Mexican Grill Inc., which warned investors and customers last month that it
had suffered a data breach, gave
the all-clear on Friday, saying it had removed malicious software from its
systems.
… Hackers
installed the software in order to grab customer data from point-of-sale
devices, striking between March 24 and April 18.
“The malware searched for track data (which sometimes has
cardholder name in addition to card number, expiration date and internal
verification code) read from the magnetic stripe of a payment card as it was
being routed through the POS device,” Chipotle said in a statement.
For my Computer Security students.
Organizations Concerned About Medical Device Attacks: Study
Many manufacturers and
healthcare delivery organizations (HDO) are concerned about medical device
attacks, but only few have taken significant steps to address the threat,
according to a study commissioned by electronic design automation solutions
provider Synopsys.
The study, based on a survey of 550 individuals conducted
by the Ponemon Institute, shows that 67 percent of medical device makers and 56
percent of HDOs believe an attack on the medical devices they build or use is likely
to occur in the next 12 months.
In fact,
roughly one-third of respondents said they were aware of cyber incidents that
had a negative impact on patients, including inappropriate therapy or treatment
delivery, ransomware attacks, denial-of-service (DoS) attacks, and hijacking of
medical devices.
On the other hand, only 17 percent of device manufacturers
and 15 percent of HDOs have taken significant steps to prevent attacks. Roughly 40 percent on both sides admitted that
they haven’t done anything to prevent attacks.
… The study shows that more than half of
device manufacturers and HDOs blame the presence of vulnerable code on lack of
quality assurance and testing procedures, while nearly 50 percent also blame
the rush-to-release pressure on the development team, accidental coding errors,
and lack of training on secure coding practices.
Also for my Computer Security students.
Email attacks are cheap, easy, low risk, and high reward. No wonder a “malicious email is the cyber spy’s favored way in.” An email security breach could impact your
organization’s revenue and reputation. Protecting
yourself from a breach can be daunting, given how many emails pass through
your organization each week.
But if you think of cybercriminals as a business, you
can keep up with them more effectively. After
all, most want to make a profit.
That’s why they call it “disinformation.”
Thomas Fox-Brewster reports:
The first evidence that the
hacker crew responsible for the breach of the Democratic National Committee
(DNC) snuck false information into their leaks has been uncovered by a group of
researchers.
The hackers, a group called Fancy
Bear that U.S. intelligence and law enforcement claim to be sponsored by
Russia’s intelligence unit, the GRU, planted the information inside a leak of
emails belonging to a journalist and critic of the Putin regime, according to a
report from Citizen Lab, a University of Toronto-based organization. That formed part of a massive hacking campaign
attempting to steal Google passwords from 218 targets across 39 countries,
including former American defense officials.
Read more on Forbes.
(Related)
Why no announcement?
The Windows Malicious Software Removal Tool has been updated
for WannaCry
… all Windows
users have access to the Malicious Software Removal Tool (MSRT) even though
they may not be aware of it.
… What changed?
Initially, Microsoft didn't say, the home
page for MSRT, had not been updated as of the 25th.
However, when asked, a company representative said that the
May 22nd update was "to detect and remove WannaCrypt malware." WannaCrypt is another name for WannaCry.
You can run MSRT manually by simply typing "MRT"
into the Run box. Or, you can find it at
C:\Windows\system32\MRT.exe
It used to be done with the Mark 1 eyeball. Is automating it really that much more evil?
Throughout New York state, police
agencies have for years been using automated license plate readers (ALPR, also
known as ANPR in Europe) without the sanction of the legislature or the courts.
Earlier this month, the New York Court
of Appeals — the state’s highest court — took up the question for the first
time and sided with the use of plates to track members of the public, even if
they are not suspected of committing any crime.
The town of Rhinebeck, for
example, has a population of just 7548, but over the course of three months in
2011, it photographed 164,043 license plates. Of these, just eight were in any way linked to
suspicious activity, according to documents obtained by the American Civil
Liberties Union. Nonetheless, the
movements of all motorists were stored in a long-term database. There are no statewide rules limiting how long
such information can be stored.
Read more on TheNewspaper.com.
From the people who bring “double secret probation” to
government?
Tim Johnson reports:
U.S. intelligence agencies
conducted illegal surveillance on American citizens over a five-year period, a
practice that earned them a sharp rebuke from a secret court that called the
matter a “very serious” constitutional issue.
The criticism is in a lengthy
secret ruling that lays bare some of the frictions between the Foreign
Intelligence Surveillance Court and U.S. intelligence agencies obligated to
obtain the court’s approval for surveillance activities.
The ruling, dated April 26 and bearing the label “top secret,” was
obtained and published Thursday by the news site Circa.
It is rare that such rulings see
the light of day, and the lengthy unraveling of issues in the 99-page document opens a window on how the secret
federal court oversees surveillance activities and seeks to curtail those that
it deems overstep legal authority.
Read more on Miami
Herald.
An article for my students to consider.
Rethinking Ethics Training in Silicon Valley
Interesting... Perhaps they could find a search engine to
help?
Accused of underpaying women, Google says it's too expensive
to get wage data
Google
argued that it was too financially burdensome and logistically challenging to
compile and hand over salary records that the government has requested,
sparking a strong rebuke from the US Department of Labor (DoL), which has accused
the Silicon Valley firm of underpaying women.
Google officials testified in federal court on Friday that
it would have to spend up to 500 hours of work and $100,000 to comply with
investigators’ ongoing demands for wage data that the DoL believes will help
explain why the technology corporation appears to be systematically discriminating against women.
Noting Google’s nearly $28bn annual income as one of the
most profitable companies in the US, DoL attorney Ian Eliasoph scoffed at the
company’s defense, saying, “Google would be able to absorb the cost as easy as
a dry kitchen sponge could absorb a single drop of water.”
Smarter than I was at that age. (And I’ve clearly gone downhill from there.)
11-year-old claims classroom punishment violates Geneva
Convention
How to get my students interested in AI? My pick would be of interest to Auditors,
too.
Here are some companies Google’s new AI investment arm might
be interested in
Google is launching a new investment arm aimed at
artificial intelligence, according
to a report in Axios. A source
familiar with Google’s plans says the new program will focus on early-stage
startups.
Where the new investment seems to differ most
from Google’s existing investing groups is that it’s led by engineers, not venture capitalists. Google VP of engineering Anna Patterson, whose
focus as an executive is AI, is in charge of the effort, according to Axios.
… Here are a few
startups that reflect areas in which Google may be interested in investing:
Anodot
Anodot
automates the detection of outliers in large datasets. This could be a useful for enterprise companies
crunching data in the the cloud. Anodot has raised $12.5 million
in funding.
For my geeks!
Virtualization allows one operating system (OS) to run on
another OS. But did you know that a Virtual Machine (VM) clone of your hard drive can
put your entire computer inside of another computer? With VMs, the possibilities are endless. For most people, though, virtualization
enables playing older games using
emulation, the ability to sandbox, running multiple OSes, and much more (practical VM uses). You
can even set up a Windows virtual machine in Linux.
This article covers how to create a VM clone of your
system and how to use it once you’ve managed to create the virtual machine.
No comments:
Post a Comment