Elon Musk Is In Deep Trouble With Germany As Twitter Is About To Get Slapped For Not Taking Down Hate Speech

Posted in Commentary with tags on April 4, 2023 by itnerd

Elon, the legal consequences may be about to start hitting you while you do stupid stuff like change the Twitter symbol to the Dogecoin symbol. Germany is about to slap him silly:

In an early FAFO test for Elon Musk, Germany could be set to fine Twitter for repeatedly failing to comply with a social media hate speech takedowns law, aka the NetzDG, which requires swift removal of illegal content like hate speech.

The Federal Justice Office (BfJ) announced the move in a press release today — saying it’s instigated a proceeding under the country’s Network Enforcement Act (aka, NetzDG) after establishing there are “sufficient indications of failures” in the platform’s complaint management processes.

Under the NetzDG, social media platforms must response to user reports of illegal content, checking what’s been reported and removing content if it confirms it’s illegal, within seven days — or 24 hours for the most obviously illegal stuff. What’s illegal is governed by Germany’s criminal code, which includes hate speech, abuse and threats, and antisemitism.

“Numerous pieces of content was reported to the BfJ that was published on Twitter, which the authority considers illegal and, despite user complaints, was not deleted or blocked by the provider within the legally stipulated periods. The fine proceedings initiated are based on this,” the BfJ said in a statement (which we’ve translated from German with machine translation).

“In the case of individual violations by providers of social networks, of the inspection and deletion obligations in the NetzDG, it cannot generally be assumed that there is no effective procedure for dealing with complaints about illegal content. However, a systemic failure of complaint management is subject to fines, which occurs when violations of the relevant specifications of the NetzDG occur repeatedly in a timely manner and in a manner that is relevant to the subject.”

The Office said the content it’s acting against Twitter over is “closely related in terms of time and substance” — indicting a “systemic failure in the provider’s complaint management”. “They were published on Twitter over a period of around four months and reported to the provider of Twitter as illegal by users,” it added. “All content contains similar, unjustified, defamatory statements of opinion, all directed against the same person. According to the BfJ, they constitute an offence.”

On paper, Germany’s NetzDG law allows for fines up to €50 million for breaches of the regime.

My guess is that the Germans are going to make an example of Elon because they can. Not to mention that Elon isn’t even trying to deal with hate speech. In fact by all reports, it’s out of control on Twitter. So this is going to be a slam dunk for the Germans. And you have to wonder how Elon who is less Tony Stark and more Johnny Knoxville will handle this situation.

Place your bets now.

Leave a comment »

Jscrambler Threat Monitoring Now Available in Splunk Marketplace

Posted in Commentary with tags on April 4, 2023 by itnerd

Jscrambler, the leading solution for JavaScript protection and real-time webpage monitoring, today announces the integration of Jscrambler’s Threat Monitoring to the Splunk marketplace. Through a partnership between Jscrambler and Splunk, organizations can now integrate Jscrambler’s code integrity solution into their Splunk instance, providing them with more visibility into their web applications’ code integrity and a powerful tool to help them stay ahead of potential client-side cyber threats. 

Splunk is a leading data analytics and visualization platform that helps organizations monitor, analyze and visualize their machine data. Splunk’s customers include some of the world’s largest and most complex organizations, spanning a wide range of industries, including healthcare, finance and government. 

Jscrambler’s code integrity solution provides an effective way to protect web and mobile applications against tampering, reverse engineering and code injection attacks. By integrating Jscrambler into a Splunk instance, organizations can monitor the security of their applications in real-time and quickly identify any suspicious activity that may be indicative of a potential client-side  attack. The Jscrambler Threat Monitoring Splunk app enables real-time notifications for any code tampering, reverse engineering or code injection attacks detected by Jscrambler, helping organizations stay one step ahead of potential threats. 

Find out more at: https://jscrambler.com/ or check out their listing on the GitHub Marketplace.

Leave a comment »

A Simple Developer Mistake Could Have Led To Bing.com Takeover

Posted in Commentary with tags on April 4, 2023 by itnerd

Discovered by the Wiz cloud security firm and dubbed BingBang, this vulnerability allowed researchers to change the top results in Microsoft’s Bing search engine and access any user’s private files by simply logging into an unsecured web page.

The vulnerability is centered on the Microsoft Azure Active Directory and would allow any Azure user in the world to log into it without proper credentials. All it took was a misconfigured app.

In this case it was the Bing trivia app:

After recognizing these issues and their potential impact, the researchers started scanning for vulnerable applications (multi-tenant apps lacking proper validation) on the internet. The results were shocking – approximately 25% of the multi-tenant apps they scanned were vulnerable.  

Most surprisingly, the list included an app made by Microsoft itself, named “Bing Trivia.”
Because this app was misconfigured, the researchers were able to log in to it with their own Azure user.

To verify that this CMS was indeed controlling Bing’s live results, they selected a keyword in the CMS and temporarily altered its content. They chose the “best soundtracks” search query, which returned a list of highly recommended movie soundtracks.

They then proceeded to change the first result, “Dune (2021),” to their personal favorite, “Hackers (1995),” and pushed it to production. Their new result, complete with their title, thumbnail, and arbitrary link, immediately appeared on Bing.com.

Researchers then found they could run Cross-Site Scripting (XSS) attacks, and since Bing and Office 365 are integrated, an attacker could access Bing users’ Office 365 data, including Outlook emails, calendars, Teams messages, SharePoint documents, and OneDrive files. The researchers reported the flaw to Microsoft and it was patched shortly afterward, resulting in a $40,000 bug bounty reward.

Brad Hong, Customer Success Lead, Horizon3.ai had this to say:

   “The BingBang incident is a reminder that passwords and simple misconfigurations are still the number one attack vector for attackers. Seemingly arbitrary in nature, it can have severe consequences on an organization’s security posture. In this case, a misconfigured application made it possible for researchers to not only gain access to Microsoft’s Azure Active Directory without proper credentials, but then from a privileged perspective chain together and execute exploits on additional vulnerabilities after making their way into the castle.

   “Incidents like this validate why the industry is moving away from vulnerability models and into exploitability management, as the misconception is dispelled that attackers are looking to execute zero days, but rather the easiest ways to get in. It additionally highlights the necessity to continuously attack your own infrastructure to identify as the organization’s offerings and architecture change, new or extended vulnerabilities that can be leveraged to get in. It’s also a great reminder that as the world begins to consolidate software offerings, that linkages created between them in the name of convenience and accessibility can also become its greatest downfall.”

Luckily this was caught by a team of security researchers rather than threat actors, otherwise this could have gone very, very sideways. This goes to prove that anyone can screw up and everyone needs to be on their toes when deploying code into a public facing environment.

Leave a comment »

TMX Data Breach Affects nearly 5 million US Customers 

Posted in Commentary with tags on April 4, 2023 by itnerd

TMX Finance and its subsidiaries TitleMax, TitleBucks, and InstaLoan announced a data breach that affected more than 4.8 million customers from 1,000 consumer lending outlets across the US. The data stolen included dates of birth, passport #s, driver’s license #’s, federal/state ID #’s, , SSN’s and financial account information.
 
In a data breach notification letter TMX informs that the breach was discovered on February 13th, 2023, and hackers had been in its systems since early December, 2022 with information stolen between February 3rdand 14th, 2023.
 
TMX has implemented endpoint protection and monitoring and reset all employee account passwords and believes the security incident has now been contained.

Ted Miracco, CEO, Approov had this to say:

   “Unfortunately, data breaches like the TMX security incident are far too common in today’s digital age, and reckless companies often fail to take adequate measures to prevent them, as they rely on their insurers to pay the bill to clean things up. When these security incidents occur, it is often the customers and users who suffer the consequences, as their personal and sensitive information can be compromised, leading to identity theft, financial loss, and other types of harm.

   “While some companies take security seriously and implement measures to prevent breaches, others prioritize profits over security, which can lead to careless behavior and a lack of investment in security infrastructure. In some cases, companies may even attempt to minimize or cover up security incidents, leaving victims in the dark about the full extent of the damage.

   “This highlights the need for stronger regulations and penalties to hold companies accountable for data breaches and other security incidents, and to ensure that they are taking adequate measures to protect their customers’ information. Companies must understand the gravity of the situation and prioritize security over profits to protect their customers’ information and prevent potential harm.”

The fact that TMX is only now implementing “endpoint protection and monitoring” is a big hint that this was the likely gateway for the threat actors. Thus if you’re responsible for protecting your environment from threats like this, you might want to make sure that this box is checked.

Leave a comment »

TikTok Banned From Government Devices In Australia… And UBC Students Have Been Told That They Might Want To Remove The App Too

Posted in Commentary with tags on April 4, 2023 by itnerd

Australia is joining a growing list of countries who are banning Chinese social media app TikTok from government devices according to Reuters:

 Australia banned TikTok on Tuesday from all federal government-owned devices over security concerns, becoming the latest U.S.-allied country to take action against the Chinese-owned video app.

The ban underscores growing worries that China could use the Beijing-based company, owned by ByteDance Ltd, to harvest users’ data to advance its political agenda, undermining Western security interests.

It also risks renewing diplomatic tension between Australia and its largest trading partner after things eased somewhat since Prime Minister Anthony Albanese took office in May at the head of a Labor government.

TikTok said it was extremely disappointed by Australia’s decision, calling it “driven by politics, not by fact”.

The ban will come into effect “as soon as practicable”, Attorney-General Mark Dreyfus said in a statement, adding that exemptions would only be granted on a case-by-case basis and with appropriate security measures in place.

Not only that, The University Of British Columbia is suggesting to students that they punt the Chinese social media app from their phones as well:

The school said in a statement issued last week that the app is one of UBC’s fastest-growing social media platforms, used by students, staff and faculty for entertainment, research, outreach and recruitment.

 However, it said the video platform has sparked security and privacy concerns about its data collection practices and data sharing with corporate parent ByteDance.

Although UBC said these risks are “not yet” proven, its privacy and information security teams “believe that TikTok does pose a risk to UBC’s systems and its stakeholders.”

It said the university had recently evaluated “the use of certain TikTok marketing features” and concluded they did not comply with British Columbia’s Freedom of Information and Protection of Privacy Act.

This was “due to the sharing of personal information with TikTok without the required contractual protection on TikTok’s use of the data.”

The statement said that “of particular concern” was a reference in TikTok’s terms of service that the app may capture keystroke patterns used on a device, and that this could allow usernames and passwords to be exposed.

The school is recommending that students use a browser to access TikTok content. Now the school does have their own TikTok account which continues to operate. But one has to wonder if they will shut that down for optics reasons.

This illustrates the challenges that TikTok is under. Nobody trusts them. And that’s only going to lead to more bans or more suggestions that you don’t remove it. And it might lead to TikTok being killed via death by a thousand cuts rather than one big ban.

Leave a comment »

Hisense To Bring The NBA To More Fans In North America

Posted in Commentary with tags on April 3, 2023 by itnerd

Hisense, a global leader in Consumer Electronics and Home Appliance industries, and the National Basketball Association (NBA) today announced a collaboration to bring the excitement of the NBA to more fans across North America. 

Hisense will serve as the exclusive partner of “X-Factor Moments,” a weekly content series on the NBA’s social media channels featuring the game changing plays and standout moments throughout the 2023 NBA postseason.  As the Official TV and Home Appliance Partner of the NBA, Hisense will also make NBA League Pass, the league’s premium live game subscription service available on the NBA App, accessible on Hisense TVs in North America beginning with the 2023-24 season.

Year to date through February, Hisense is the no. 2 TV brand in the North American market based on unit share and is the fastest growing TV brand in Canada. With its lineup earning 50+ awards in 2022, Hisense is taking its ULED technology even further with the limited edition release of ULED X – the first television in its lineup to carry the new designation of The Official Television of the NBA.  ULED X revolutionizes LED televisions, bringing viewers a vivid picture and sound quality that puts them right at center court.  This groundbreaking advancement pushes LED TV to its limit and creates the most realistic and immersive entertainment experience to date.

Fans will see milestones of the collaboration come to life around the league’s marquee events, at retailers, on packages and through point-of-sale promotions, trade shows and more, leveraging Hisense’s high-quality, premium products to connect fans with the sport they love most.

For more information, please visit hisense-canada.com. 

Leave a comment »

Wages Dominate Cybercrime Groups’ Operating Expenses: Trend Micro

Posted in Commentary with tags on April 3, 2023 by itnerd

 Trend Micro Incorporated today published new research detailing how criminal groups start behaving like corporations as they grow bigger, but that this comes with its own attendant costs and challenges.

To read a full copy of the report, Inside the Halls of a Cybercrime Business, please visit:  

https://www.trendmicro.com/vinfo/us/security/news/cybercrime-and-digital-threats/inside-the-halls-of-a-cybercrime-business

A typical large organization allocates 80% of its operating expenses to wages, with the figure similarly high (78%) for small criminal organizations, according to the report. Other common expenses include infrastructure (servers/routers/VPNs), virtual machines, and software.

The study outlined three types of organizations based on size, using examples where Trend Micro collected the most data from law enforcement and insider information.

Small criminal businesses (e.g., Counter Anti-Virus service Scan4You):

  • Typically, one management layer, 1-5 staff members, and under $500K in annual turnover.
  • Their members often handle multiple tasks within the group and also have a day job on top of this work.
  • Comprise the majority of criminal businesses, often partnering with other criminal entities.

Medium-sized criminal businesses (e.g., bulletproof hoster MaxDedi):

  • Typically have two management layers, 6-49 employees, and up to $50m in annual turnover.
  • They usually have a pyramid-style hierarchical structure with a single person in charge.

Large criminal business (e.g., ransomware group Conti):

  • Typically have three management layers, 50+ staff, and $50m+ in annual turnover.
  • Feature relatively large numbers of lower management and supervisors.
  • Implement effective OPSEC and partner with other criminal organizations.
  •  Those in charge are seasoned cyber-criminals and hire multiple developers, administrators, and penetration testers – including short-term contractors.
  • They may have corporate-like departments (e.g., IT, HR) and even run employee programs, such as performance reviews.

According to the report, knowing the size and complexity of a criminal organization can provide critical clues to investigators, such as what types of data to hunt for. 

For example, larger criminal entities may store employee lists, financial statements, company guides/tutorials, M&A documents, employee crypto wallet details, and even shared calendars to probe.

Understanding the size of targeted criminal organizations can also allow law enforcers to prioritize better which groups should be pursued for maximum impact.

Leave a comment »

Guest Post: It’s World Cloud Security Day – And Lookout Says That Remote Work Could Be Risky for Your Organization

Posted in Commentary with tags on April 3, 2023 by itnerd

Today, April 3rd, is World Cloud Security Day which raises awareness of the emerging threats individuals and organizations face when team members use their personal cell phones and computers to access corporate data remotely. These threats include malware, denial of service, and password attacks.

According to Lookout’s The State of Remote Work Security 2023 survey – a study of 3,000 remote and hybrid workers from enterprise companies in the United States, United Kingdom, France, and Germany — data results presented below highlight the behaviors of remote workers that put an organization at risk.

  • 81% of CIOs report their company had experienced a Wi-Fi-related security incident in the last year, with 62% of Wi-Fi-related security incidents occurring in cafes and coffee shops.
  • 43% of remote workers have downloaded, saved, or sent work-related materials to a personal account for convenience; and
  • 57% of remote workers have sent an email from their work account to a personal one for convenience.
  • 56% say they often do work and personal tasks on the same device.
  • Fully remote workers (72%) are more likely to do personal tasks during work hours than hybrid workers (54%); and
  • 32% of remote workers use apps or software for convenience reasons, which are not approved by their IT department. 

Please download the the full report here to find out: 

  • What are the implications for IT security in the wake of the transition to remote work? 
  • What sort of employee practices increase the risk of sensitive data falling into an insecure environment?
  • How does an organization best protect its data when employees spend 20+ hours per week on their personal mobile devices. 

Leave a comment »

Elon Musk Has Created A Real Mess With His Verification Scheme

Posted in Commentary with tags on April 3, 2023 by itnerd

Remember last year when Elon Musk rushed out Twitter Blue? And that became a train wreck next to a dumpster fire in short order with rampant occurrences of impersonation among other things that made Elon look like a loser, and forcing him to pull Twitter Blue for a few weeks? We might be seeing another round of that. There is now a lot of confusion over what being “verified” actually means on Twitter. Part of that is due to Elon being forced to backpedal pulling legacy verifications from people because of the epic backlash that this move has generated. In effect giving them more time to pay him, unless Elon doesn’t like you:

As I type this, the vast majority of legacy verified accounts still have their blue checkmark. On top of that there’s checkmarks for the few Twitter Blue subscribers that are out there. And if you click on any of the checkmarks, you get this message:

In the past, this message said “This account is verified because it’s notable in government, news, entertainment, or another designated category.” What that means is that it’s no longer possible to see whether the blue checkmark is for a notable account, or someone who has paid Elon. Which means anyone to pretend to be anyone yet again for $8 a month. Lovely.

What’s worse is that various people are saying that removing the legacy checkmarks is a manual process. Which means that this confusion might last weeks or months. That is another sign that Elon really didn’t think this through before pulling the trigger on this. Though he never thinks anything through before doing it because he not that guy. Not to mention that he’s desperate for cash.

And here’s the final part of this that is bad for Elon. I imagine a scenario where the continuation of Twitter’s policy of getting people to pay for blue checkmarks next to their name would make an account LESS valuable because it would be seen as less legitimate. Which I am sure is the exact opposite of what Elon would expect to happen. And further illustrates that Elon doesn’t really think these sorts of things through.

The bottom line is that Elon has really dropped himself in it again. And there’s no clear path that I can see to get himself out of it without having to eat some metaphorical crow in the process. And his ego is too fragile to eat some crow by saying that he got it wrong. Thus this situation is likely to be a gong show for a very long time.

Leave a comment »

EQT And Context Labs Announce Strategic Partnership

Posted in Commentary with tags , on April 3, 2023 by itnerd

EQT Corporation and Context Labs today announced the establishment of a strategic partnership to advance the commercialization of verified low carbon intensity natural gas products and carbon credits. The partnership brings together EQT, the largest natural gas producer in the U.S., and Context Labs, an expert in distributed ledger technology, advanced climate data and analytics, machine learning and AI-capabilities. 

Through tracking, reporting and verification of critical emissions data, the strategic partnership will support EQT in achieving its industry-leading emissions reduction targets, which include a commitment to reach net zero greenhouse gas (GHG) emissions by 2025. With a focus on emissions quantification, operational analysis and the certification of natural gas production, the companies will work to scale emissions mitigation across the full energy value chain.

Context Labs will provide an enterprise-wide deployment of their Decarbonization-as-a-Service (DaaSTM) platform across EQT’s asset footprint, with the goal of achieving full digital integration of EQT’s emissions data. The resulting creation of certified low-carbon intensity products will add a next dimension to EQT’s already robust and digitally-enabled organization.

Context Labs’ enterprise data fabric platform, DaaSTM, will enable certification and verification of the carbon intensity of EQT’s operating assets, with certificates registered in Context Labs’ CLEAR PathTMRepository. Additionally, the relationship will afford EQT the opportunity to integrate carbon credit projects into CLEAR PathTM in support of generating asset-grade, data-backed carbon credits.

Find out more about these companies here:

Leave a comment »

« Older Entries
Newer Entries »