Subject: NY attorney general forces spyware vendor to alert victims
Source: Bleeping Computer
https://www.bleepingcomputer.com/news/security/ny-attorney-general-forces-spyware-vendor-to-alert-victims/
The New York attorney general’s office has announced a $410,000 fine for a stalkerware developer who used 16 companies to promote surveillance tools illegally. Stalkerware (or spyware) platforms allow their customers to monitor other people’s phones without the users’ knowledge. In some, if not most cases, they’re also used to monitor the targets’ online activity and collect sensitive user information like their location that later could be used for blackmail or various other malicious purposes.
These surveillance apps enabled Hinchy’s customers to secretly monitor what other individuals were doing on their mobile devices, including location, browsing history, call logs, text messages, photos and videos, email activity, WhatsApp and Skype chats, and social media activity.
In September 2021, the U.S. Federal Trade Commission also banned stalkerware maker Spyfone from the surveillance business. The settlement also required Spyfone to notify the owners of the devices where the stalkerware was installed that the devices were monitored and no longer secure.
…
Tagged:
Source: Help Net Security
https://www.helpnetsecurity.com/2023/02/05/week-in-review-rail-transport-cybersecurity-verified-oauth-apps-used-to-infiltrate-organizations/
Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: [1st of many summaries … ]
Mounting cybersecurity pressure is creating headaches in railway boardrooms
In this Help Net Security interview, Dimitri van Zantvliet is the Cybersecurity Director/CISO of Dutch Railways, and co-chair to the Dutch and European Rail ISAC, talks about cyber attacks on railway systems, build a practical cybersecurity approach, as well as cyber legislation.
…
[older … ]
https://www.helpnetsecurity.com/tag/week_in_review/
Source: Nexstar Media Wire via NerdWallet
https://www.nxsttv.com/nmw/news/how-to-safely-use-payment-apps/
As a frequent PayPal user, I wasn’t surprised to see a payment request on the app pop up. But when I read it, I knew something was wrong. In the message, a stranger asked me to send them $699 in order to get a “refund.” While I instantly recognized the request as a scam, I still felt vulnerable; I didn’t immediately see any obvious way to flag the request as a scam, and with just one click, I could have accidentally sent this stranger a huge chunk of money.
I’m hardly alone in my worry over security when using peer-to-peer payment apps: According to a Pew Research Center survey published in September 2022, about one-third of people who use payment apps or websites say they are “a little or not at all confident that payment apps or sites keep people’s personal information safe from hackers or unauthorized users.” And an alarming 13% of people who have ever used PayPal, Venmo, Zelle or Cash App say they have made the mistake of sending money to a scam artist.
Fraud prevention experts recommend these strategies to keep your money safe…
Source: WIRED
https://www.wired.com/story/cloudflare-internet-blackouts-report/
The Iranian government’s latest attempts in recent months to stifle protests through internet blackouts, digital curfews, and content blocking have presented a particularly extreme example of how far regimes can go in restricting digital access. But a new report from the internet infrastructure company Cloudflare, released today, highlights the stunning global prevalence of connectivity disruptions and their increasing relevance to people and organizations all around the world.
In 2022, Cloudflare began publishing reports that compile its internal observations about government internet blackouts and notable outages worldwide. As a content delivery network that also provides digital resiliency services, the company sees an array of signals when a chunk of the internet goes dark. For example, Cloudflare can assess internet protocol requests, like those for the routing system Border Gateway Protocol or the internet address book Domain Name System, to get insight into how a government executed a shutdown and where in the internet backbone it implemented the connectivity blocking.
“The interesting thing about internet shutdowns is that we typically don’t see governments shutting down electricity or water or gas. They target the internet because they see shutting down the flow of information as a vital thing to do,” says John Graham-Cumming, Cloudflare’s chief technical officer. “For a lot of us the internet is an essential utility that we can’t live without. These things really do have an impact, including an economic impact.”
…
Source: Fraud of the Day
https://fraudoftheday.com/uncategorized/2023-top-fraud-trends-special-series-department-of-motor-vehicles-fraud/
For the fraudster, one driver’s license is a treasure trove of opportunity. This one little card contains a combination of personally identifiable information that opens the door to a whole new identity. The gateway to crime! Full name, date of birth, and address just to start. That card even has personal physical characteristics, a picture, and a signature. Not always on the card, but somewhere in the driver’s license database is a Social Security number. It has about everything needed for someone to steal your identity. And ruin your life.
A further risk, and unknown to many, is that some DMVs not only share data with outsourced third party contractors, they also sell drivers’ information to third parties, like towing companies or advertising firms. This puts personal data at even more risk, as it is stored on more databases that just the DMV’s
The average stolen ID takes about 600 hours of effort of recovery to get back your life. But victims pay an additional price- the emotional impact of identity theft to address the fallout. A recent survey by the Identity Theft Resource Center (ITRC) took a deep dive into the emotional, physical and physiological effects on fraud victims, and the data show that victims are increasingly dealing with nonfinancial ramifications – from sleep problems to severe mental health effects. This alone makes addressing DMV fraud extremely important for 2023.
Source: U.S. GAO
https://www.gao.gov/products/gao-23-106441
Federal systems are vulnerable to cyberattacks. Our High Risk report identified 10 critical actions for addressing federal cybersecurity challenges.In this report, the third in a series of four, we cover the action related to protecting cyber critical infrastructure—specifically, strengthening the federal role in cybersecurity for critical infrastructure. For example, the Department of Energy needs to address cybersecurity risks to the U.S. power grid.
We’ve made 106 public recommendations in this area since 2010. Nearly 57% of those recommendations had not been implemented as of December 2022.
Source: TechRepublic via beSpacific
https://www.bespacific.com/new-cybersecurity-data-reveals-persistent-social-engineering-vulnerabilities/
Tech Republic: “New research from NCC Group and Abnormal Security shows clouds and a bit of silver to line them: Ransomware attacks declined last year, but business email compromises increased — massively for smaller businesses — and a third of toxic emails got through their human gateways. According to risk management firm NCC Group, there was a 5% drop in ransomware attacks last year — from 2,667 attacks in 2021 to 2,531 attacks in 2022 — although between February and April there was an uptick due to LockBit activity during the Russia-Ukraine war. In its just-released 2022 Annual H1 Threat Monitor, which follows incidents identified by its managed detection and response service and global cyber incident response team, the NCC Group reported:…
Subject: Wikipedia Worries Its Volunteer Editors Could Be Liable to Lawsuits Without Section 230
Source: Gizmodo
https://gizmodo.com/wikipedia-section-230-scotus-encyclopedia-1850085090
Source: The Conversation
https://www.bespacific.com/chatgpt-is-a-data-privacy-nightmare/
The Conversation – If you’ve ever posted online, you ought to be concerned: “ChatGPT has taken the world by storm. Within two months of its release it reached 100 million active users, making it the fastest-growing consumer application ever launched. Users are attracted to the tool’s advanced capabilities – and concerned by its potential to cause disruption in various sectors. A much less discussed implication is the privacy risks ChatGPT poses to each and every one of us. Just yesterday, Google unveiled its own conversational AI called Bard, and ……
Subject: Why Switching to a Paid Email Provider Is Better for Online Privacy and Security
Source: MakeUseOf
https://www.bespacific.com/why-switching-to-a-paid-email-provider-is-better-for-online-privacy-and-security/
MakeUseOf: “Free email services have dominated the market for a long time—Gmail alone has more than one and a half billion active users worldwide. However, many users have switched to or are considering switching to a paid email provider for better security. Several paid email services, including Proton Mail, Tutanota, CounterMail, and others, …
—
Abstracted from beSpacific
Copyright © 2023 beSpacific, All rights reserved.
Source: UPI.com
https://www.upi.com/Top_News/World-News/2023/02/09/Australia-cameras-remove-China-Hikvision-Dahua/2501675952751/
Feb. 9 (UPI) — Australian Defense Minister Richard Marles said Thursday that the government would work to remove Chinese-made cameras from government buildings over security concerns.Marles said the cameras would be removed from government buildings following an audit by Australian Cyber Security Shadow Minister James Paterson that found at least 913 cameras made by Chinese companies Hikvision and Dahua were installed at 250 government buildings.
The senator called on the government to immediately remove the cameras, citing “both national security and moral concerns” as he alleged that the companies had been implicated in human rights abuses and mass surveillance of Uyghurs in Xinjiang as well.
Source: gHacks Tech News
https://www.ghacks.net/2023/02/09/is-windows-11-spying-on-you/
Do you know what goes on as you happily turn on your Windows 11 system to perform your regular (and perhaps some irregular) activities? Bingo! Like government agencies and big tech, Microsoft is a bit of a voyeur, too. This might not be news for some. This has been going on for so long that even books have been released about enhancing privacy in Windows 10. However, looks like they have outdone themselves with this latest Windows iteration.
The PC Security Channel has uploaded a YouTube video where they monitored Windows activity via Wireshark while using a brand-new Windows 11 laptop. Wireshark is a network monitoring tool that allows you to check and even analyze data coming and going from your system and into the network.
Aside from this, they monitored a Windows XP computer to gauge how the tide has changed when it comes to Windows’ efforts in spying on you. As it turns out, a lot has changed.
…
Filed: https://www.ghacks.net/category/windows/windows-11/
+ comments
Source: FCW
https://fcw.com/digital-government/2023/02/industry-congress-have-eye-logingov-and-public-private-sector-role-digital-identity/382825/
The Software Alliance and Enterprise Cloud Coalition calls for a “technology neutral” solution to digital identity in a recent letter after Congress directed GSA to promote a policy of multiple credential service providers. Two tech industry groups are pushing the federal government to take a “technology-neutral approach” to digital identity in a recent letter to top White House leaders.
The Software Alliance — also known as BSA — and the Enterprise Cloud Coalition asked top White House actors to “reaffirm” a commitment to “technology neutrality” for digital identity in a Feb. 3 letter shared with FCW to Chris Inglis, national cyber director; Anne Neuberger, deputy national security advisor for cyber and emerging tech; and Eugene Sperling, American Rescue Plan coordinator.
The proposal is potentially at odds with the General Services Administration’s plan to have its Login.gov platform be the primary secure sign-on system in government.
…