Pete Recommends – Weekly highlights on cyber security issues, March 1, 2025

Subject: On UK vs Apple vs citizen
Source: IP TopicBox, Washington Post, and The Verge
https://ip.topicbox.com/groups/ip/T980bf5554682a6ff/on-uk-vs-apple-vs-citizens

There were reports in the past couple of weeks that the UK government had issued a technical capability notice under the Investigatory Powers Act to Apple demanding that the latter backdoor its Advanced Data Protection encryption to enable UK law enforcement access to data stored on iCloud by users anywhere in the world. This was originally reported in the Washington Post and picked up all over the place: https://archive.ph/Yd3rQ

Last night Apple announced it was removing ADP for UK users:
https://www.theverge.com/news/617273/apple-removes-encryption-advanced-data-protection-adp-uk-spying-backdoor UK priuacy organizations like Big Brother Watch and Open Rights Group will be cacmpaigning to reverse this while supporting UK citizens’ right to access strong encryption..

Some background.
– Under the IPA, TCNs are secret and for a recipient to disclose they have received one is a criminal offense. Apple has not commented on whether it received such a notice, nor has the UK’s Home Office.


Subject: Trump has purged government websites. The Wayback Machine is trying to preserve the record
Source: Vox
https://www.vox.com/culture/400705/internet-purge-offline-government-website-archive-trump

[Editor’s Note – see also Climate and DEI Deleted From Government Websites, Federal Workers Fired]

The man trying to capture the internet before it disappearsThe Trump administration is purging some government websites. The director of the Wayback Machine explains what we can do about it.

It’s an acceleration of a problem known as digital decay — or linkrot. Large quantities of the internet are disappearing as media outlets go under, companies upgrade their web infrastructure, or organizations take down information they believe is no longer valuable or relevant. A recent Pew Research Center study found that 38 percent of webpages that existed in 2013 are no longer available. Because so much of our culture now happens online, losing those pages means losing part of the record of ourselves.
Mark Graham, director of the Wayback Machine, joined Sean Rameswaram on Today, Explained to talk about digital decay, what his team is doing to combat the problem both generally and during Trump’s second term, and why internet preservation is so important.

Below is an excerpt of the conversation, edited for length and clarity. There’s much more in the full podcast, so listen to Today, Explained …


Subject: FCC Commissioner Gomez Pushes Back Against Chairman’s Plan To Investigate Big Tech’s Censorship
Source: Cord Cutters News
https://cordcuttersnews.com/fcc-commissioner-gomez-pushes-back-against-chairmans-plan-to-investigate-big-techs-censorship/

A rift within the Federal Communications Commission (FCC) has emerged as Commissioner Anna M. Gomez publicly criticized the agency’s chairman, Brendan Carr, over reports that he plans to investigate Big Tech’s content moderation practices. Gomez, a Democratic appointee, called the effort “vague and weak,” arguing that the FCC lacks the authority to meaningfully address online censorship—a power she insists rests solely with Congress. Her comments, made during a recent tech-policy conference in Washington, highlight growing tensions within the agency as it navigates its role in the ever-evolving digital landscape.

The timing of Gomez’s dissent is notable. Under the Biden administration, the FCC attempted to assert greater control over the internet by reclassifying broadband as a Title II utility—a move that reinstated net neutrality rules in 2023, only to face reversal under Trump’s appointees. Now, with Carr at the helm, the agency seems to be back tracking its efforts on net neutrality and is not fighting to win its court cases. She argues that the FCC’s jurisdiction—rooted in the Communications Act of 1934 and Section 230 of the 1996 Communications Decency Act—doesn’t extend to dictating how private companies manage their platforms. “The First Amendment and Section 230 are clear,” Gomez said, reinforcing her stance that any substantive change must come from lawmakers, not regulators.

As the FCC adjusts to its new leadership, Gomez’s opposition underscores a deeper philosophical clash: Should the agency wade into the murky waters of online speech, or leave it to Congress and the courts? For now, her call for restraint stands as a counterpoint to Carr’s ambitions, leaving observers to wonder how far the chairman can push before hitting legal or political walls. With Big Tech’s role in public discourse under relentless scrutiny, this internal FCC showdown could shape the debate for months to come.


Subject: YouTube Intensifies Its Crackdown on Piracy-Promoting Videos
Source: Cord Cutters News
https://cordcuttersnews.com/youtube-intensifies-its-crackdown-on-piracy-promoting-videos/

YouTube is ramping up its efforts to purge content that promotes piracy and instructs viewers on how to bypass payment for legal media, signaling a significant escalation in its long-standing battle against copyright infringement. The video-sharing giant, owned by Google, announced this week that it’s deploying enhanced detection tools and stricter enforcement measures targeting channels that teach users how to access movies, music, software, and other digital goods without paying. The move comes amid growing pressure from content creators, studios, and regulators to curb the spread of piracy tutorials that have long thrived in the platform’s gray areas.

The shift has already led to a wave of takedowns, with dozens of channels receiving strikes or outright bans in recent days. Channels offering step-by-step guides on jailbreaking streaming devices, pirating video games, or using torrent sites to snag blockbuster films have been hit hardest. The sweep has even hit legitimate videos, including our own videos at times.


Subject: Gmail: Google plans to end SMS verification in favor of QR codes
Source: gHacks Tech News
https://www.ghacks.net/2025/02/24/gmail-google-plans-to-end-sms-verification-in-favor-of-qr-codes/

For some time now, Google has been asking for a mobile phone number and verification when new customers create Gmail accounts. SMS verification is also used as part of the login process, to verify that a returning customer is indeed that customer.Google did introduce an option to enable 2-step verification for accounts without phone number in 2024 already.

A report by Forbes suggest that this is going to change in the coming months. Google plans to end SMS verification in favor of another system.
Google told Forbes that it wants to move away from using SMS messages for authentication. Other services, including X, formerly Twitter, have abandoned SMS in the past as well.


Google noted a rise in SMS related criminal activities. One of them, which Google calls traffic pumping, attempts to get online services to send SMS messages to numbers that they control in order to get paid.


Subject: Feds warn hospitals of cybersecurity risk in Chinese-made medical monitor
Source: Becker’s Health IT
https://www.beckershospitalreview.com/cybersecurity/feds-warn-hospitals-of-cybersecurity-risk-in-chinese-made-medical-monitor.html

A widely used medical monitor manufactured in China is under scrutiny due to potential cybersecurity risks, CNBC reported Feb. 23.
The FDA and the Cybersecurity and Infrastructure Security Agency (CISA) have issued warnings about the Contec CMS800, a device used to monitor patients’ vital signs, citing the presence of a “backdoor”—a security vulnerability that hackers could easily exploit.CISA’s investigation revealed that the device was transmitting unusual network data and had a backdoor allowing it to download and execute unverified files from a third-party university—an uncommon and concerning behavior for medical equipment. The agency also found that these downloads overwrite existing files, preventing hospitals from tracking which software is running on the device.Currently, no software patch is available to address the issue. CISA said it is collaborating with government agencies and Contec to mitigate the risk. Contec did not respond to CNBC’s request for comment.

Feds warn of Ghost ransomware targeting healthcare
1 year later: The Change Healthcare cyberattack and its lasting impact on healthcare
Top 5 cybersecurity concerns for healthcare in 2025Filed: https://www.beckershospitalreview.com/cybersecurity.html

Subject: Ron Wyden asks for rules about whether you own your digital purchases
Source: The Verge
https://www.bespacific.com/ron-wyden-asks-for-rules-about-whether-you-own-your-digital-purchases/

Follow up on previous post – Amazon removing the ability to download your purchased booksThe Verge: “Sen. Ron Wyden (D-OR) has sent a letter to Federal Trade Commission (FTC) chair Andrew Ferguson urging the FTC to require that companies admit when you’re not really buying an ebook or video game. Wyden’s letter, shared with The Verge,…



Abstracted from beSpacific
Copyright © 2024 beSpacific, All rights reserved.


Subject: Verizon isn’t doing enough to protect customers from robocall scams
Source: Android Headlines
https://www.androidheadlines.com/2025/02/verizon-isnt-doing-enough-to-protect-customers-from-robocall-scams.html

Last year, Truecaller partnered with The Harris Poll and published a report with findings of the Spam and Scam survey. The details published in the report were eye-opening, as it suggested that major smartphone carriers in the U.S., including Verizon, have been doing a terrible job of protecting customers from robocalls and scam calls.Verizon isn’t helping its customers fight robocalls and scams associated with it..

If you are a Verizon customer, you’d be surprised to know that, despite being one of the top U.S. carriers, it ranks 11 (out of 14) on PIRG’s report card for protection against robocall scams. The worst part is that half of the telecom companies in the U.S. received “D” or “F” grades when it comes to these protection services.

Spectrum, AT&T, and Comcast Xfinity are doing good jobs, though..


Subject: Signal CEO Warns of Swedish Exit if Backdoor Legislation Passes
Source: The Sweden Herald via gHacks Tech News
https://www.ghacks.net/2025/02/26/signal-ceo-warns-of-swedish-exit-if-backdoor-legislation-passes/

Signal, the encrypted messaging app, has announced it may cease operations in Sweden if proposed legislation requiring message storage is enacted. The Swedish government is considering a bill that would mandate apps like Signal and WhatsApp to store user messages, allowing law enforcement agencies to access message histories of individuals suspected of crimes. Signal’s CEO, Meredith Whittaker, expressed strong opposition to this proposal, stating that implementing such measures would necessitate introducing vulnerabilities, or “backdoors,” into their software. Whittaker emphasized that complying with these requirements would compromise the security of Signal’s global network, making it susceptible to exploitation. Consequently, Signal would prefer to withdraw from the Swedish market rather than undermine its encryption standards.This is not the first time a decision made by a Government has opted to protect the Country over users’ privacy. In the United Kingdom, the government has demanded that Apple create a backdoor to its encrypted cloud services, challenging the company’s commitment to user privacy.


Subject: LibreOffice: Windows vulnerability affects links in documents, patch available
Source: gHacks Tech News
https://www.ghacks.net/2025/02/27/libreoffice-windows-vulnerability-affects-links-in-documents-patch-available/

LibreOffice is a popular open source Office suite that is used by millions of users as an alternative to Microsoft Office. We have followed LibreOffice for almost 15 years here on this blog. The developers of the free tool have just confirmed a new security issue in LibreOffice that affects users on Windows only.

The details:

  • LibreOffice 24.8 to 24.8.4 are affected by the issue.
  • Attackers may exploit the issue to launch executable files when users activate links in LibreOffice documents.
  • The severity is high.

Subject: Mozilla’s new Terms of Use causes confusion among Firefox users
Source: gHacks Tech News
https://www.ghacks.net/2025/02/27/mozillas-new-terms-of-use-causes-confusion-among-firefox-users/

Mozilla has updated the Terms of Use for Firefox, alongside an update to its Privacy Notice. This move comes as the organization wants to provide transparency about its commitment to user privacy.Among the new stipulations, users are required to grant Mozilla a “nonexclusive, royalty-free, worldwide license” to use information entered through the browser. This vague terminology has triggered alarm bells, as it leaves ambiguous the nature of the data Mozilla may access, potentially including personal information, saved passwords, or browsing history.

Here is the clause in question:

When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox.

Users were puzzled by the new terms, as they believed Mozilla could modify these Terms of Use at any time, while they continue to use the browser. Some called it reminiscent of practices commonly associated with big tech companies, starkly contrasting with the ideals of openness that Mozilla professes to uphold. These accusations were further compounded by Mozilla’s right to reserve the ability to terminate user access to Firefox at its discretion. Several people in the community wanted the organization to consider revising its recent Terms of Use to avoid losing the confidence of its user base altogether.

However, the situation is not as alarming as some users might have perceived it. An updated statement from Mozilla clarified the issue. The organization insists that Firefox remains open-source software, these new terms only apply to the official version of the browser, arguably establishing a disconnect between the source code and user experience.

+ comments


Subject: You can now easily remove personal info from Google Search results
Source: Android Headlines
https://www.androidheadlines.com/2025/02/you-can-now-easily-remove-personal-info-from-google-search-results.html

Imagine spotting your personal information in the Google Search results. If that sounds frustrating and scary, you are among us. Google seems aware of that, which is why it announced the “Results about you” tool. This tool detects users’ personal information such as addresses and phone numbers, that appear in the Google Search results. Well, the good news is that the company has updated it, making it even easier for users to sign up and request removals of personal information directly from the Google Search page….


Subject: Turn off your read receipts. They’re a security risk
Source: VOX
https://www.vox.com/technology/401506/iphone-read-receipts-turn-off-android

For a decade, my wife’s read receipts have been on without her knowing it. She kept checking her phone’s settings to see if they were turned off, and they were. But every time I sent her a text, I’d see that my message got delivered, and what time she read it. Suffice it to say, this led to some awkward moments. Read receipts are a sore spot for a lot of couples, friends, family members, employers — really anyone who sends and receives text messages these days. It wasn’t always like this. Just a few years ago, you could send a text and not expect the unwelcome and day-ruining reminder that the recipient had read but failed to respond to your message.

But these days, bad manners isn’t the only reason why read receipts are bad. They can be an invitation for scammers to target you. And while you can turn them off on iOS and Android’s default messaging apps, you might even consider using an entirely different app for your day-to-day texting needs that allow you even more privacy protections….

Filed: https://www.vox.com/technology

Posted in: Cybercrime, Cybersecurity, Email Security, Encryption, Privacy