Is the US treasury ready? Would Wall Street panic?
https://www.databreaches.net/brazilian-national-treasury-hit-with-ransomware-attack/
Brazilian National Treasury hit with ransomware attack
Angelica Mari reports:
The Brazilian government has released a note stating the National Treasury has been hit with a ransomware attack on Friday (13).
According to a statement from the Ministry of Economy, initial measures to contain the impact of the cyberattack were immediately taken. The first assessments so far have found there was no damage to the structuring systems of the National Treasury, such as the platforms relating to public debt administration.
Read more on ZDNet.
(Related) This is the Department charged with securing the Treasury…
Secret terrorist watchlist with 2 million records exposed online
A secret terrorist watchlist with 1.9 million records, including classified "no-fly" records was exposed on the internet.
The list was left accessible on an Elasticsearch cluster that had no password on it.
… The researcher discovered the exposed database on July 19th, interestingly, on a server with a Bahrain IP address, not a US one.
However, the same day, he rushed to report the data leak to the U.S. Department of Homeland Security (DHS).
"I discovered the exposed data on the same day and reported it to the DHS."
"The exposed server was taken down about three weeks later, on August 9, 2021."
A California law, gleefully followed by British e-news…
https://www.theregister.com/2021/08/17/ccpa_blackbaud/
Blackbaud – firm that paid off crooks after 2020 ransomware attack – fails to get California privacy law claim dropped
A judge in South Carolina has struck out a number of claims in a consolidated class-action suit alleging cloud CRM provider Blackbaud didn't do enough to prevent a 2020 ransomware attack, but allegations under California's Consumer Privacy Act (CCPA) will move forward.
Blackbaud, a cloud software provider that sells CRM systems for fundraising and communications to charities and educational institutions, admitted last year that it had paid off a ransomware attacker that hit its servers with file-encrypting software in May.
It said at the time: "The cybercriminal did not access credit card information, bank account information, or social security numbers."
However, in a September 2020 US stock market 8-K filing [PDF ], Blackbaud said the ransomware infection had potentially resulted in miscreants making off with banking details.
According to an order filed last week by the judge hearing the consolidated class-action case in the district of Columbia, South Carolina, the complainants allege the CRM firm "failed to comply with industry and regulatory standards by neglecting to implement security measures to mitigate the risk of unauthorized access, utilizing outdated servers, storing obsolete data, and maintaining unencrypted data fields."
The case – which deals with more than 15 lawsuits by 34 plaintiffs across 20 states – was consolidated into a single complaint in April by the Judicial Panel on Multidistrict Litigation.
US district judge J Michelle Childs said in a 33-page ruling [PDF ] that "Blackbaud's alleged registration as a 'data broker' suggests that it is also a 'business' under the CCPA." The firm had previously argued it did not qualify as a "business" regulated by the CCPA,
… The CCPA claim, if successful, could net statutory damages of up to $750 per violation for the California plaintiffs.
Potential hacking tools for self-driving vehicles?
https://www.unite.ai/optical-adversarial-attack-can-change-the-meaning-of-road-signs/
Optical Adversarial Attack Can Change the Meaning of Road Signs
Researchers in the US have developed an adversarial attack against the ability of machine learning systems to correctly interpret what they see – including mission-critical items such as road signs – by shining patterned light onto real world objects. In one experiment, the approach succeeded in causing the meaning of a ‘STOP’ roadside sign to be transformed into a ’30mph’ speed limit sign.
The opposite of one worldwide legal environment.
Data sovereignty laws place new burdens on CISOs
More than 100 countries now require data on their citizens be stored or processed within their boundaries, presenting new data protection challenges.
… Oracle describes how “the exponential growth of data crossing borders and public cloud regions [has seen], more than 100 countries now have passed regulations.” There is no one-size-fits-all set of rules and therein lays the conundrum for CISOs, especially those whose customer base or digital infrastructure crosses political boundaries.
In a paper published on August 3. Professor Susan Ariel Aaronson of George Washington University commented how under the guise of digital sovereignty, “governments are seeking to regulate commercial use of personal data without enacting clear rules governing public sector use of data.”
In a 2020 “ideas paper,” the EU described digital sovereignty as “Europe's ability to act independently in the digital world and should be understood in terms of both protective mechanisms and offensive tools to foster digital innovation (including in cooperation with non-EU companies).”
I’m sure the FBI is upset, because this is also true for domestic terrorists and the political party in opposition to President Biden.
WhatsApp Can't Ban the Taliban Because It Can't Read Their Texts
As it quickly took control of the county, the Taliban used Facebook-owned chat app WhatsApp to spread its message and gain favor among local citizens, according to news reports as well as Afghan citizens and observers on the ground,
A WhatsApp spokesperson declined to answer a series of specific questions about WhatsApp's role and response to the Taliban using its platform.
The company spokesperson said that WhatsApp complies with U.S. sanctions law, so if it encounters any sanctioned people or organizations using the app, it will take action, including banning the accounts. This obviously depends on identifying who uses WhatsApp, without having access to any of the messages sent through the platform, given that the app uses end-to-end encryption. This would explain why WhatsApp hasn’t taken action against some account spreading the Taliban’s message in Afghanistan.
Perspective.
https://mindmatters.ai/2021/08/whats-behind-chinas-crackdown-on-big-tech/
WHAT’S BEHIND CHINA’S CRACKDOWN ON BIG TECH?
In a previous article I looked at Chinese regulators’ crackdown on Didi Global, China’s ride-hailing service. Didi is one of several Chinese tech giants that have been tamed in the past nine months. Prior to Didi, Ant Group, Tencent, Meituan, and Pinduoduo were all quelled by regulators. After Didi, regulators targeted Full Truck Alliance and Kanzhun. They recently shut down online for-profit tutoring and have banned mining cryptocurrencies in China.
Thus far, the Chinese government’s actions have resulted in almost $1 trillion net losses for the Chinese tech sector.
The two big questions are, Why now? and, relatedly, Who’s next?
SupChina has a well-organized explainer on China’s Big Tech Crackdown here.
Another helpful resource is this video from DW, “How China is tightening control of its tech companies”: https://www.youtube.com/watch?v=4l7m7OYO5Is
(Related)
Didi’s business slows from break-neck pace as on-site probes by China’s cybersecurity regulators gum up operations
The Chinese government’s unprecedented probes into Didi-Chuxing, also involving public security investigators, have gummed up business operations at the platform that dominated 90 per cent of the country’s ride-hailing industry, according to several employees.
Engineers and product managers at the Beijing company, whose smartphone apps were removed from Android and Apple app stores in early July, are now busy writing up patches to close what Chinese regulators called technical loopholes in Didi’s data management system, according to staff who spoke on condition of anonymity.
… Investigators, who sequestered themselves into Didi’s head office in the Zhongguancun Software Park in the northwestern corner of the Chinese capital, have called mid-level staff in for hours of questioning, even on weekends and at short notice, employees said.
Tools & Techniques. It’s not just for stalkers…
https://www.makeuseof.com/chrome-extensions-finding-email-addresses/
The 7 Best Chrome Extensions for Finding Anyone’s Email Address
No comments:
Post a Comment