Over the past decade, the emergence and rapid adoption of cryptocurrencies have led many to hold their assets in cryptowallets, purpose-built software and devices that store the public and private cryptographic keys to track ownership of cryptocurrencies so users can send, receive and store digital currency.

While cryptocurrencies and wallets are legal, they are often used in ransomware attacks, where criminals demand payment in virtually untraceable Bitcoin. Even if a hardware cryptowallet — one of the most secure wallet types that is often used for storing large amounts of cryptocurrency — is submitted as evidence in a criminal investigation, law enforcement has no way to access the data if its owner is unwilling or unable to unlock the wallet.

Now, the IRS’ Criminal Investigation unit will be working to unlock cryptocurrency wallets so investigators can more easily track the movement of cryptocurrencies and potentially recover stolen assets and prevent theft of digital currency.

IRS will be working with VTO Inc., a Colorado-based firm specializing in device forensics, to research and develop techniques for gaining access to cryptowallets by exploiting hardware, software and firmware vulnerabilities that may exist in the secure devices.

…

• Read more about the project here.
• Filed: https://gcn.com/portals/emerging-tech.aspx
• RSS: https://gcn.com/rss-feeds/emerging-tech.aspx

---

---

Subject: Mozilla VPN boosted with multi-hop, blocking and custom DNS features
Source: gHacks Tech News
https://www.ghacks.net/2021/09/18/mozilla-vpn-boosted-with-multi-hop-blocking-and-custom-dns-features/

In recent months, we’ve seen payment processors, web hosts and other corporations brazenly take coordinated action in lock-step with government priorities to financially freeze out disfavored businesses online. The elimination of a sitting president from social media, whatever its perceived merit or rationale, opened the door to a regime where those who can cancel and suspend accounts do so at whim and in unison. This logic has led directly from one payment platform, Stripe, zapping away Donald Trump to a much bigger one, PayPal, blacklisting customers to purify its user base. Feeding the beast makes it stronger…

Facebook has criticized a series of investigations published by the Wall Street Journal as containing “deliberate mischaracterizations” which “confer egregiously false motives to Facebook’s leadership and employees.”Recently, the WSJ has published “The Facebook Files,” a set of articles based on a review of the social media giant’s internal documents, research, draft presentations, and online employee discussions.

Among the reports is an allegation made by the news outlet that the company knows its platforms — including Facebook and Instagram — are “riddled” with flaws that “cause harm, often in ways only the company fully understands” and these alleged issues are known all the way up to the chief executive, Mark Zuckerberg.

Among its reports, the WSJ says that changes made by Facebook to its algorithms three years ago to improve user connectivity and well-being made the platform “angrier” instead, with staff members warning of the potential damage being done. Changes were then allegedly resisted due to concerns surrounding declining user engagement.

In addition, the publication says that researchers inside Instagram have found that the app is “harmful” and “toxic” for some younger users; in particular, teenage girls.

In response, former UK politician and now Facebook Vice President of Global Affairs Nick Clegg said in a blog post on Saturday that the series “contained deliberate mischaracterizations of what we are trying to do, and conferred egregiously false motives to Facebook’s leadership and employees.”

…

Previous and related coverage

• Quick, easy (and free) way to make Facebook more bearable
• Facebook is the AOL of 2021
• Facebook says Chinese hackers used its platform in targeted campaign to infect, surveil user devices

RSS Security feed: https://www.zdnet.com/topic/security/rss.xml

Subject: Landlords Use Secret Algorithms to Screen Potential Tenants. Find Out What They’ve Said About You
Source: ProPublica
https://www.propublica.org/article/landlords-use-secret-algorithms-to-screen-potential-tenants-find-out-what-theyve-said-about-you#1123694

A report has found that troll farms, dedicated to peddling misinformation, were able to reach over 100 million Americans.

Jeff Allen, a former senior-level data scientist at Facebook who authored the report, said the following: “This is not normal. This is not healthy. We have empowered inauthentic actors to accumulate huge followings for largely unknown purposes.”

Social media businesses used to hide behind Section 230, a US law that declared social media companies to be separated from their users posts. For example, if someone posted COVID-19 misinformation on a social media platform, that platform would not be at risk.

However, that veil is starting to disappear, as judges are beginning to rule for exemptions from Section 230, putting pressure on social media to police their content.

…

Police have dismantled an organised crime group linked to the Italian mafia which defrauded hundreds of victims through phishing attacks and other types of online fraud.The joint operation was led by the Spanish National Police (Policía Nacional), with support from the Italian National Police (Polizia di Stato), Europol and Eurojust and has resulted in 106 arrests across Spain and Italy. According to Europol, the crime operation used phishing, SIM swapping and BEC attacks and it’s estimated that this led to profits of around €10 million ($11.7 million) during last year alone.Described as “very well organised”, the group included a number of experts in computer crime tasked with creating phishing domains and carrying out cyber fraud. Other individuals involved in the criminal network included money mules and money laundering experts, including experts in cryptocurrency….

Topic: Security

Nine Democratic Senators led by Senator Richard Blumenthal have called on the Federal Trade Commission to conduct a rulemaking process to “protect consumer privacy, promote civil rights, and set clear safeguards on the collection and use of personal data in the digital economy.” “Americans’ identities have become the currency in an unregulated, hidden economy of data brokers that buy and sell sensitive information about their families, religious beliefs, healthcare needs, and every movement to shadowy interests, often without their awareness and consent,” the Senators said. Senators Schatz, Wyden, Warren, Coons, Luján, Klobuchar, Booker, and Markey joined Senator Blumenthal on the letter. EPIC has long urged the FTC to impose clear privacy obligations on companies that collect and use personal data, including by exercising the Commission’s underused rulemaking power. In 2020, EPIC filed a petition with the FTC calling on the Commission to conduct a rulemaking on the use of artificial intelligence in commercial settings. “By defining unfair and deceptive practices ex ante, and with specificity, a trade regulation rule would make it easier for the FTC to take action against parties that harm consumers,” EPIC explained.

• Filed:
  Consumer FTC

Subject: Crypto funding for Palestine’s Hamas nears $1 million and far outstrips hauls for other militant groups, Coinbase says
Source: Markets Insider
https://markets.businessinsider.com/news/currencies/hamas-crypto-funding-bitcoin-militant-group-million-terrorist-financing-coinbase-2021-9

The Ninth Circuit announced today police violated a defendant’s Fourth Amendment rights when they warrantlessly searched files that Google automatically reported using a proprietary algorithm designed to detect child sexual abuse material (“CSAM”). Prosecutors in the case, United States v. Wilson, had argued that the police officer’s search of the defendant’s files did not violate the Fourth Amendment because Google, a private party, had conducted the initial search. The district court agreed, finding that there was a “virtual certainty” that the files Google sent to police were identical to files previously identified by a Google employee as CSAM. But no Google employee reviewed the defendant’s files before sending them to police—instead, Google automatically forwarded the files to law enforcement after a proprietary algorithm matched the files to previously-identified CSAM images. EPIC filed an amicus brief in the Ninth Circuit appeal to explain that prosecutors had failed to show that the proprietary Google algorithm reliably matched images. EPIC also urged the court to narrowly apply the private search exception. The Ninth Circuit found that the police search “allowed the government to learn new, critical information” and “expanded the scope of the antecedent private search because the government agent viewed Wilson’s email attachments even though no Google employee—or other person—had done so.” The Ninth Circuit also echoed EPIC’s amicus brief: “on the limited evidentiary record, the government has not established that what a Google employee previously viewed were exact duplicates of Wilson’s images.” The decision in this case diverges from previous federal appeals and state court decisions on the issue and may lead the Supreme Court to review the important privacy implications of mass automatic file scanning programs.

Microsoft has opened the lid on a large-scale phishing-as-a-service (PHaaS) operation that’s involved in selling phishing kits and email templates as well as providing hosting and automated services at a low cost, thus enabling cyber actors to purchase phishing campaigns and deploy them with minimal efforts.

“BulletProofLink (also referred to as BulletProftLink or Anthrax by its operators in various websites, ads, and other promotional materials) is used by multiple attacker groups in either one-off or monthly subscription-based business models, creating a steady revenue stream for its operators.”

Phishing-as-a-service differs from traditional phishing kits in that unlike the latter, which are sold as one-time payments to gain access to packaged files containing ready-to-use email phishing templates, they are subscription-based and follow a software-as-a-service model, while also expanding on the capabilities to include built-in site hosting, email delivery, and credential theft.

Subject: Microsoft Exchange protocol can leak credentials
Source: The Register
https://www.theregister.com/2021/09/22/microsoft_exchange_autodiscover_protocol_found/

Subject: Leading Cyber Officials Favor Fines Over Subpoenas to Enforce Incident Reporting
Source: Nextgov
https://www.nextgov.com<cybersecurity/2021/09/leading-cyber-officials-favor-fines-over-subpoenas-enforce-incident-reporting/185579/

Subject: NSA, Other Federal Agencies Are Using Ad Blockers
Source: Gizmodo
https://gizmodo.com/even-the-nsa-agrees-targeted-ads-are-terrifying-1847733298