Cyber Attacks, Threats, and Vulnerabilities
Russia, Iran and China exploit Capitol Hill riot to push information operations, US intel concludes (CyberScoop) As America reels from the deadly Capitol Hill insurrection, Russia, Iran and China are using their state media mouthpieces to exploit U.S. divisions and further their interests ahead of Joe Biden’s inauguration, according to a new U.S. intelligence analysis obtained by CyberScoop.
Iranian Cyber Operation Posts Threats (BankInfo Security) The FBI is warning that an Iranian-linked cyber operation called "Enemies of the People" continues to threaten federal and state officials as well U.S.
DNSpooq lets attackers poison DNS cache records (ZDNet) Network administrators urged to apply the latest Dnsmasq updates to prevent the new DNSpooq attacks.
Flaws in widely used dnsmasq software leave millions of Linux-based devices exposed (CSO Online) A set of seven vulnerabilities, called DNSpooq, allows attackers to redirect users or execute malicious code. Patch dnsmasq now.
Dnsmasq vulnerabilities open networking devices, Linux distros to DNS cache poisoning (Help Net Security) Seven vulnerabilities affecting Dnsmasq, a caching DNS and DHCP server used in a variety of networking devices and Linux distributions, could be leveraged
Attackers Eyeing Cloud Platforms (Decipher) Attack groups are increasingly focusing their attention on cloud platforms and services as common entry points for victim networks.
FBI warns of vishing attacks stealing corporate accounts (BleepingComputer) The Federal Bureau of Investigation (FBI) has issued a notification warning of ongoing vishing attacks attempting to steal corporate accounts and credentials for network access and privilege escalation from US and international-based employees.
Hackers 'manipulated' stolen documents to undermine trust in coronavirus vaccines (Computing) The EMA says hackers changed some emails before releasing them online
COVID-19 Vaccine Themes Persist in Fraud Schemes (BankInfo Security) Researchers at the security firm Proofpoint are tracking several fraud schemes leveraging COVID-19 vaccine-themed emails. The schemes include business email
Raindrop: New Malware Discovered in SolarWinds Investigation (Symantec) Tool was used to spread onto other computers in victims’ networks.
FireEye hedges on naming Russians as SolarWinds attackers (GCN) The company has not seen enough evidence to positively trace the hackers behind the ongoing SolarWinds Orion hack to Russian entities, a FireEye executive said.
Don’t overlook the most consequential control system cyber events of 2020 (Control Global) Two of the most consequential control system cyber events (attacks) in 2020 were supply chain attacks.
EU Regulator: Hackers ‘Manipulated’ Stolen Vaccine Documents (SecurityWeek) The European Union’s drug regulator said Friday that COVID-19 vaccine documents stolen from its servers by hackers have been not only leaked to the web, but “manipulated.”
Russia, Iran and China exploit Capitol Hill riot to push information operations, US intel concludes (CyberScoop) As America reels from the deadly Capitol Hill insurrection, Russia, Iran and China are using their state media mouthpieces to exploit U.S. divisions and further their interests ahead of Joe Biden’s inauguration, according to a new U.S. intelligence analysis obtained by CyberScoop.
Researchers Disclose Undocumented Chinese Malware Used in Recent Attacks (The Hacker News) Researchers Disclose Chinese Hackers' Undocumented Backdoor Used in Recent Cyber Attacks
Bad Pods: Kubernetes Pod Privilege Escalation (Bishop Fox) Seth Art discusses the impact of overly permissive pod security policies and the importance of applying restrictive controls around pod creation by default
Higaisa or Winnti? APT41 backdoors, old and new (Positive Technologies) Higaisa or Winnti? APT41 backdoors, old and new
How Law Enforcement Gets Around Your Smartphone's Encryption (Wired) New research has dug into the openings that iOS and Android security provide for anyone with the right tools.
Reserve Bank of New Zealand describes file sharing breach as "significant" (Finextra Research) The Governor of the Reserve Bank of New Zealand, Adrian Orr, says the recent malicious and illegal breach of a file sharing application used by the Bank is "significant".
NZ Reserve Bank Governor Says He 'Owns' Breach (BankInfo Security) The governor of New Zealand’s Reserve Bank says he “personally owns” responsibility for a data breach that exposed private and sensitive stakeholder
AnyVan confirms digital break-in, says customer names, emails and hashed passwords exposed (Register) Burglary took place 3 months before biz discovered unauthorised entry
SEPA systems knocked offline by 'ongoing' ransomware attack (Digit) SEPA has confirmed it is responding to an ongoing ransomware attack, believed to be launched by an organised international cybercrime group.
SEPA cyber-attack 'likely to be work of global organised crime groups' (Northern Scot) Agency says flood forecasting and warnings continue
Report: X-Rated Social Media App Exposes Users in Massive Data Breach (vpnMentor) vpnMentor’s research team, led by cybersecurity analyst Noam Rotem, recently uncovered a data breach originating from the Fleek social media app.
Queensland Police accidentally reveal personal details of gun owners (ABC) The Queensland Police Service apologises to gun owners after a mass data breach in the state's Moreton district.
Atlanta synagogue says it was the target of a cyber attack before MLK Shabbat service with Raphael Warnock (CNN) The president of an Atlanta synagogue says its website was the target of a cyberattack during its annual Martin Luther King Jr. Shabbat service with US Sen.-elect Raphael Warnock's Ebenezer Baptist Church.
All That for a Coinminer? (The DFIR Report) A threat actor recently brute forced a local administrator password using RDP and then dumped credentials using Mimikatz. They not only dumped LogonPasswords but they also exported all Kerberos tickets. …
A security researcher commandeered a country’s expired top-level domain to save it from hackers (TechCrunch) Fredrik Almroth hoped the government would buy back the critical domain name, but nobody ever did.
Expired Domain Allowed Researcher to Hijack Country's TLD (SecurityWeek) An expired domain allowed a researcher to hijack the country code top-level domain (TLD) of Congo.
Magecart Groups Hide Behind 'Bulletproof' Hosting Service (GovInfo Security) Several Magecart groups hide their JavaScript skimmers, phishing domains and other malicious tools behind a "bulletproof" hosting service called Media
Biden Inauguration: Defending Against Cyberthreats (BankInfo Security) As thousands of National Guard troops pour into Washington to provide security for the Jan. 20 inauguration of Joe Biden as president, cybersecurity analysts are
Cyber-attack cripples Okanogan County computer system (iFIBER One News) The flow of information technology has been dammed at Okanogan County’s government offices because of a cyber-attack on Monday.
Signal is back after an outage that lasted more than 24 hours (The Verge) The company didn’t explain what caused the outage
AKVA still dealing with aftermath of cyber attack (Fish Farmer Magazine) Aquaculture technology group AKVA says its experts have detected the “root cause” of the malware which caused the shutdown of key IT systems in the company, but the system is still not up and running.
Cyber-attack to cost AKVA ‘significant’ one-off costs (Undercurrent News) The aquaculture equipment firm is now in the process of gradually restoring systems, eight days after important areas of its IT network were shut down
Vulnerability Summary for the Week of January 11, 2021 (CISA) The CISA Weekly Vulnerability Summary Bulletin is created using information from the NIST NVD. In some cases, the vulnerabilities in the Bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Security Patches, Mitigations, and Software Updates
Cisco fixes clutch of high-impact bugs in latest patch cycle (The Daily Swig) Patch batch includes borderline critical flaw in WiFi location services tech
Linux users should patch now to block new "FreakOut" malware which exploits new vulnerabilities (Check Point Software) Recently, Check Point Research (CPR) encountered several attacks that are exploiting multiple vulnerabilities on Linux devices, including some recently
Cyber Trends
Hundreds of health care facilities were hit by ransomware last year amid pandemic (CNN) At the University of Vermont Medical Center in October, a cyberattack knocked out 5,000 computers on the hospital's IT network, disrupting everything from its financial systems to its radiology services and sleep studies. Patient care ground to a halt -- and the outage lasted for weeks.
Legacy Security Architectures Threaten to Disrupt the Remote Workforce, Finds Cato Networks Survey (Cato Networks) Annual survey of 2,376 IT leaders finds network security of prime concern as most companies continue with work-from-home policies
The State of Email Phishing: A Look Back at 2020 and Forward to 2021 (INKY) Each year, INKY rounds up some of their best email phishing threat catches. Measure their sophistication alongside INKY’s ingenuity to see why we’re leaders in the war against phishing.
55% of Americans more worried about getting hacked than being murdered (Atlas VPN) According to the Atlas VPN investigation, US citizens worry much more about becoming a victim of identity theft (or getting hacked) than getting murdered. With headlines being dominated by government security breaches, data leaks, and similar cybersecurity issues, the concerns seem to be justified.
Mind the (skills) gap: Cybersecurity talent pool must expand to take advantage of quantum computing opportunities (The Daily Swig) Experts at the CES 2021 conference stress importance of security education
Cybersecurity in 2021: Looking ahead to another unpredictable year (Computing) The big topics will be the cloud, social engineering, automation and security budgets, as firms work to address corners cut in the pandemic
Webcast: Move Aside Script Kiddies - Malware Execution in the Age of Advanced Defenses (Black Hills Information Security) A few short years ago, penetration testers did not have to work too hard for their malware command channels to execute. Fast forward to today in the age of Endpoint Detection and Response, User Behavior Analytics, and advanced built-in O/S defenses, your standard toolkit for malware generation/execution does not work anymore. All is not lost! […]
Marketplace
Swimlane Raises $40M Growth Round to Deliver Hyper Automated Security Operations (BusinessWire) Today, Swimlane announced it has raised a $40M growth round to deliver hyper automated security operations.
Qohash Secures $8M in Funding With Cutting-Edge Data Security Solutions Helping Companies Stop Global Increase in Data Breaches (Qohash - Modern Data Security) Qohash Secures $8M in Funding With Cutting-Edge Data Security Solutions Helping Companies Stop Global Increase in Data Breaches
Southfield Cyber Security Firm NuArx Acquired by Irish Enterprise (DBusiness Magazine) NuArx Inc., a cyber security company based in Southfield, has been acquired by Sysnet Global Solutions of Dublin, Ireland.
Rewind Closes USD $15 Million Series A to Meet Mounting Market Demand (PRWeb) Rewind today announced the close of a USD $15 million Series A round of financing led by Inovia Capital. Based on a dramatic spike in businesses’ reliance
Fusion Connect Divests Wholly-Owned Primus Subsidiary in Canada to Focus on Core US Business Operations (PR Newswire) Fusion Connect, a trusted partner for enabling the connected enterprise, announced today the sale of its wholly-owned Primus subsidiary in...
Ivanti acquisitions strengthen its security stance to fight pandemic cybercrime onslaught (SiliconANGLE) Ivanti acquisitions strengthen its security stance to fight pandemic cybercrime onslaught - SiliconANGLE
Early-stage cybersecurity investment flowing, despite pandemic (SC Media) While most industries saw a significant dip in seed and Series A investments last year, cybersecurity investment remained resilient.
Cyber technology shares soar as security attacks pile up (ETCIO.com) Shares in FireEye Inc, Palo Alto Networks and Crowdstrike Holdings all raced ahead after Microsoft said on Thursday that it found malicious software i..
The past, the present and the future of the cyber insurance space (Insurance Business Magazine) How can the sector prevent a talent shortage?
WhatsApp Delays New Privacy Policy Rollout After User Backlash, Confusion (Wall Street Journal) The Facebook-owned messaging service acknowledged confusion among its users over changes in the handling of data.
Massive backlash to Facebook's Whatsapp changes due to user clarity or confusion, as Facebook claims? (NASDAQ:FB) (SeekingAlpha) As reported earlier, Facebook (NASDAQ:FB) is delaying a controversial update to WhatsApp's privacy policy after it was greeted with massive user backlash, resulting in millions of users migrating to Signal and Telegram.Facebook has tried to present the cause of the massive user backlash as confusion, as reported in our earlier story.
DuckDuckGo surpasses 100 million daily search queries for the first time (ZDNet) DuckDuckGo reaches historic milestone in a week when both Signal and Telegram saw a huge influx of new users.
Facebook blocks users from creating new events near White House, Capitol and state houses
(CNBC) In a blog post that was updated Friday, the company said the action was meant to prevent people from using its platform to incite violence.
Facebook Said It Would Pause US Ads For Gun Accessories And Military Gear After Complaints (BuzzFeed News) But on Sunday, BuzzFeed News continued to find ads for firearm accessories on the social network, more than 22 hours after Facebook announced its temporary suspension.
Inside Twitter’s decision to cut off Trump (Silicon Valley Business Journal) The call to block President Donald Trump from his favored means of communication was driven by a group of Twitter CEO Jack Dorsey’s lieutenants who overcame their boss’ reservations — but only after a deadly rampage at the Capitol.
Parler partially reappears with support from Russian technology firm (Reuters) Parler, a social media website and app popular with the American far right, has partially returned online with the help of a Russian-owned technology company.
Parler returns as a simple static website - with help from Russia (Computing) But the app remains banned on app stores
Parler's partial return is supported by a Russian tech firm with links to racist and conspiracy-theory sites (Business Insider) Parler's new static webpage uses an internet protocol address owned by DDoS-Guard, which Parler critics say could be a potential security risk.
GitHub admits ‘significant mistakes were made’ in firing of Jewish employee (The Verge) The company’s head of HR is also resigning.
GitHub still won’t explain if it fired someone for saying "Nazi," and employees are pissed (The Verge) Now, workers are saying the word "Nazi" in Slack to protest what is being perceived as unfair treatment.
IRONSCALES Grows ARR 72% in 2020 Driven by Market Expansion and Produc (PRWeb) IRONSCALES, the pioneer of self-learning email security, today announced that it increased annual recurring revenue by 72% in 2020, driven by a 44% inc
Researchers Earn $50,000 for Hacking Apple Servers (SecurityWeek) A couple of researchers claim they have earned $50,000 from Apple for finding some serious vulnerabilities that gave them access to the tech giant’s servers.
ERP Data Security Leader, Appsian, Opens New Office in Turkey, Expanding International Presence (PR Newswire) Appsian, the global leader in Enterprise Resource Planning (ERP) data security and compliance solutions, today announced that it has increased...
Products, Services, and Solutions
Check Point Software Partners with Orange Cyber Defense to offer WIFI hacking course to cyber experts - Check Point Software (Check Point Software) Check Point has teamed up with SensePost (ethical hacking team within Orange Cyberdefense) to deliver one of their leading offensive courses, giving
Socure to Power Responsible Growth for Online Gaming Operators in Eleven U.S. States with Intelligent KYC (BusinessWire) Socure, the leader in Day Zero identity verification, today announced that its Socure ID+ identity verification platform will be available to digital
Druva Receives Cyber Catalyst Designation for Outstanding Product Security and Ability to Combat Ransomware - Security Boulevard (Security Boulevard) Druva Cloud Platform’s simplified interface, comprehensive offering, security integrations and ability to minimize data risk help the company secure the
Liongard announces launch of its own Licensing Inspector for ESET MSP Administrator 2 (ESET) Company news from the maker of legendary NOD32 technology.
Signal endures 'technical difficulties' amid new popularity (CyberScoop) Signal users have been having issues sending messages in the mobile application since Thursday amid the app's newfound popularity.
Switching to Signal? Turn on these settings now for greater privacy and security (ZDNet) Switching to Signal because you're worried about privacy? Here are a few settings you should tweak to add even more security to your messaging.
IronNet's Collective Defense platform designated as a Cyber Catalyst by Marsh (PR Newswire) IronNet Cybersecurity Inc., the leader in Collective Defense and network detection and response (NDR), today announced that the IronNet...
ESET takes business endpoint security to the cloud, with new launch (ITP.net) The move reflects the growing move to cloud based solutions in the enterprise tech sector
Aztek Technologies licenses odix FileWall to protect its customers from Microsoft 365 focused ransomware threats (PRWeb) Aztek will deploy FileWall licenses to its customers in order to protect them from file-based email cyber attacks
Fugue Announces Container Runtime Security Capabilities for Amazon Web Services and Microsoft Azure (Fugue) Fugue announced new capabilities for bringing public cloud container resources into compliance and ensuring the continuous security of container runtime configurations.
Advanced Cloud-Native Container Security Added to Trend Micro's Cloud One Services Platform (PR Newswire) /PRNewswire/ -- January 19, 2020 – Trend Micro Incorporated (TYO: 4704; TSE: 4704), the leader in cloud security, today announced its advanced container...
Keyfactor Announces Strategic DevSecOps Partnership with Infinite Rang (PRWeb) Keyfactor, the leader in PKI as-a-Service and crypto-agility solutions, today announced a strategic partnership with digital transformation solutions provider I
Digital Shadows integrates with Microsoft Azure AD enabling rapid response to exposed company credentials (PR Newswire) Digital Shadows, the leader in digital risk protection, today announces that customers using Microsoft Azure Active Directory services will now...
Axis Security Sets the Standard for Zero Trust Network Access Market (Axis Security) Delivers Broadest Range of Agentless-first App Support; Enables Smooth, Secure Transition from VPN and Immediate ROI
New Stealthbits Identity-Centric Data Privacy Engine Simplifies and Speeds Compliance with Growing Privacy Regulations (PR Newswire) Stealthbits (now part of Netwrix), a cybersecurity software leader that protects sensitive data and credentials from attackers, today unveiled...
Technologies, Techniques, and Standards
How to reboot a broken or outdated security strategy (CSO Online) CISOs talk about how they identify when they need a new security strategy and the process of developing it and selling the reboot to stakeholders.
Soon, Quantum Computing Could Break Your Encryption (Security Boulevard) Soon, quantum computing will render traditional cryptography obsolete. The sooner you mitigate risks to standard encryption, the better.
OPM Releases New Security Vetting Principles (Meritalk) The Office of Personnel Management (OPM) published an updated doctrine on Jan. 13 that details new core security vetting principles for the government to use in managing security clearances.
Is compliance to PSD2's SCA a bridge too far for B2B merchants? (Adflex) With the rollout of PSD2's Secure Customer Authentication (SCA) across Europe, we discuss the impact for B2B merchants and review B2B exemptions and exceptions.
Online scams: How to give scammers a taste of their own medicine (HackRead) Cyberspace, a.k.a the internet, has seen its fair share of safety issues over the years, which fall into the category of what we would call cybercrime.
Competing for Influence: Operations in the Information Environment (Modern War Institute) Information in its many forms has become a significant component of national power—the primary medium of competition between the United States and its adversaries. Our guests today are both experts in their respective fields, each looking at this competition from opposing perspectives—one as a practitioner focused on the employment of military information power toward US […]
It Costs $25 Million Daily in Electricity to Process Bitcoin Transactions (Adam Grunwerg Site) Data presented by Trading Platforms indicates that it costs $25.2 million daily in electricity to process Bitcoin transactions.
Design and Innovation
Social-Media Algorithms Rule How We See the World. Good Luck Trying to Stop Them. (Wall Street Journal) We’re still at the mercy of the algorithms. That needs to change, and it’s up to social-media companies to change it, writes columnist Joanna Stern.
Online speech and publishing (Benedict Evans) Facebook has 2bn users posting 100bn times a day. The global SMS system had 20-25bn messages a day. So is this a publisher? A platform? A telco? No. We don’t really know what we think about speech online, nor how to think about it, nor who should decide.
How Social Media’s Obsession with Scale Supercharged Disinformation (Harvard Business Review) Facebook and Twitter’s business models have led to astronomical growth — but at what cost?
Academia
NCSC launches CyberFirst Girls Competition - aims to boost female representation in cyber security (Computing) Women make up just eight per cent of the cyber workforce in the UK
U of O team participates in global cyber security finals (The Fulcrum) Computer Science Club Wins CPTC Regionals and is Invited to Global Competition. “I looked at the roster of schools who were invited to [the regional] [competition], [and] I wasn’t really expecting to win,” said Logan Rodie.
Legislation, Policy, and Regulation
Australia's tangle of electronic surveillance laws needs unravelling (ZDNet) The government agrees: Australia needs a whole new electronic surveillance Act to sort out the mess. But a bunch of ad hoc laws are already making their way through parliament.
Uganda has cut off its entire internet hours to its election polls opening (Quartz Africa) “This suspension should take effect at 7pm this day of 13th January 2021 and continue until otherwise directed
How to Save Democracy From Technology (Foreign Affairs) Ending Big Tech’s Information Monopoly
For better or worse, web infrastructure is not a public good (Quartz at Work) When Google, Apple, and Amazon's AWS took action against Parler, a much wider section of the public began paying attention to an ongoing debate: Should the public be able to hold web infrastructure companies accountable?
War on Terror Teaches How to Fight Hate Groups (Bloomberg) The strategy: Mix intelligence sharing with hard and soft power and technology.
Cyber ‘Deterrence’: A Brexit Analogy (Lawfare) How “imposing costs on our adversaries” has become the “Brexit means Brexit” of cyberspace
Hacking Back Unpacked: An Eye For An Eye? Not So Fast - Analysis (Eurasia Review) It had to happen eventually. Out of all the countries in the world, the hacking back debate has finally entered the political discourse in neutral
American Public Reticent to Retaliate Against SolarWinds Hack (The National Interest) As the United States moves towards developing a more comprehensive doctrine that could delineate when cyber operations do or do not justify a retaliatory response, public attitudes about these questions should remain a point of consideration.
SolarWinds hack is quickly reshaping Congress’s cybersecurity agenda (CSO Online) More cybersecurity funding for states and Capitol, new breach reporting rules, and ransomware-related bills will likely be on the agenda for the 117th Congress.
Exclusive: Trump admin slams China's Huawei, halting shipments from Intel, others - sources (Reuters) The Trump administration notified Huawei suppliers, including chipmaker Intel, that it is revoking certain licenses to sell to the Chinese company and intends to reject dozens of other applications to supply the telecommunications firm, people familiar with the matter told...
Trump White House Finalizes 5G Network Security Plan (Law360) The White House announced Friday it has finalized a four-pronged strategy to help the U.S. roll out safe and effective 5G networks, including promoting "core security principles" in new wireless infrastructure and encouraging global allies to do the same.
Statement from National Security Advisor Robert C. O’Brien (The White House) Today, the White House is announcing the finalization of the Implementation Plan associated with the National Strategy to Secure 5G. This Implementation Pl
The Biden administration must re-evaluate Chinese 5G data security (VentureBeat) Trump policies that tarred Chinese tech companies as agents of the Communist Party should be quickly re-examined by the new administration.
Brazil ditches US drive to strangle Huawei: report (Global Times) The telecommunications sector will see a back-to-square-one moment, in which business considerations regain their rightful position from political considerations, Chinese analysts said on Sunday, after reports that the Brazilian government became the first in the world to backtrack on its opposition to Huawei’s 5G bid.
Statement from the Press Secretary Regarding the National Security Presidential Memorandum on Research and Development Security (The White House) Today, President Trump signed a National Security Presidential Memorandum on Securing United States Government-Supported Research and Development. This Pre
Huawei ban timeline: Trump administration reportedly restricts its US suppliers at last minute (CNET) Here's a breakdown of the controversial Chinese telecom giant's saga so far.
NSA Releases Appendix to Rules Governing SIGINT Collection (Lawfare) The National Security Agency (NSA) released on Jan. 13 a document pertaining to the rules governing signals intelligence (SIGINT) collection.
Biden proposal calls investments in federal IT ‘an urgent national security issue’ (Federal News Network) President-elect Joe Biden announces his American Rescue Plan that includes significant funding increases for federal technology and cybersecurity to address long-standing challenges.
Rob Joyce named new NSA cybersecurity director (CyberScoop) Rob Joyce, the NSA’s Special Liaison Officer at the U.S. Embassy in London, will replace Anne Neuberger as Cybersecurity Director.
Biden to invest in cyber workforce, but without plan to overcome lingering staffing hurdles (SC Media) Cybersecurity experts remain skeptical that the newfound funding focus will be enough to draw the necessary talent.
Biden's $10 Billion Cybersecurity Proposal: Is It Enough? (BankInfo Security) President-elect Joe Biden’s $1.9 trillion plan for COVID-19 relief includes nearly $10 billion in cybersecurity and IT spending. Some security experts hope the
Presidential Advisers Expected to Push Software-Defined Networking for Secure Comms (Nextgov.com) Senate Commerce Committee is stockpiling legislation for coordinated investments in the tech.
NY, FTC Lead Charge To Expand Biometric Privacy Shields (Law360) New York lawmakers and the Federal Trade Commission are the latest to step up pressure on companies to be upfront with consumers about the use of their biometric data, signaling that more laws and regulatory scrutiny are expected for the increasingly popular technology, attorneys say.
The NSA is ‘moving forward’ to install Michael Ellis, a former GOP operative, as its top lawyer, the agency said Sunday (Washington Post) The National Security Agency is “moving forward” to install Michael Ellis, a former GOP political operative and White House official, as the agency’s top lawyer, the agency said Sunday.
Acting secretary of defense orders NSA chief to install Trump loyalist as agency's general counsel (CNN) Acting Secretary of Defense Christopher Miller is trying to install a Trump loyalist, Michael Ellis, as the top lawyer at the National Security Agency, according to three sources familiar.
The Cybersecurity 202: Biden has options to remove former GOP operative as NSA top lawyer (Washington Post) The National Security Agency's move to install former GOP political operative and White House official Michael Ellis as the agency's top lawyer has raised concerns that President Trump is making one last effort to politicize the intelligence community before leaving office.
U.S. Chamber Letter on the Nomination of Alejandro Mayorkas to be Secretary of the Department of Homeland Security (U.S. Chamber of Commerce) This Hill Letter was sent to the Senate Committee on Homeland Security and Governmental Affairs, on the nomination of Alejandro Mayorkas to be Secretary of the Department of Homeland Security.
HHS Names First Ever Chief Artificial Intelligence Officer (Nextgov.com) It marks the agency’s recognition of the emerging technology’s importance.
U.S. lawmakers aim to curtail face recognition even as the technology IDs Capitol attackers (Reuters) U.S. lawmakers are moving ahead with efforts to ban facial recognition software even as the technology helps identify supporters of President Donald Trump who ransacked their workplace and forced them to evacuate this month.
Singapore PDPA Vs. GDPR: How do they stack up? (Lexology) On 25th May 2018, Europe’s GDPR (General Data Protection Regulation) laws were put into effect, to help guard users’ personal data which companies…
Litigation, Investigation, and Law Enforcement
FBI investigating whether woman stole laptop from Pelosi's office to sell it to Russia (POLITICO) The Pennsylvania woman was seen in footage near Pelosi's office Jan. 6.
Woman accused of taking laptop from Pelosi’s office has been arrested, officials say (Washington Post) A witness who claimed to be a former partner of Riley June Williams told the FBI that friends of Williams played a video of her stealing a drive or computer
The Cybersecurity 202: Pelosi laptop theft highlights 'real counterintelligence concerns' of Capitol riot, lawmaker says (Washington Post) There are growing concerns that U.S. adversaries may be seeking ways to benefit from the Capitol assault – and that some of rioters may have been looking to work with them.
Purges force extremists off social media sites. That can complicate investigators’ work. (Washington Post) The dramatic move by big technology firms to evict tens of thousands of users from their social media accounts because of concerns over violence is posing a challenge for law enforcement, which has lost a valuable resource to monitor the growing threat.
With Parler ban, Utah police and others may have lost a window into planned protests (The Salt Lake Tribune) The ban on Parler may have cost Utah law enforcement a key look in gathering intelligence on plans for protests.
Local Police Force Uses Facial Recognition to Identify Capitol Riot Suspects (Wall Street Journal) An Alabama police department is using facial recognition software to help identify people who were present during the riot at the U.S. Capitol this week, one of its officers said.
On social media, amateur digital sleuths try to help track violent Capitol rioters (Los Angeles Times) Amateur detectives working to identify violent rioters that stormed the U.S. Capitol don't want the process to turn into an online witch hunt.
Doxxing insurrectionists: Online extremism researchers divided (Protocol — The people, power and politics of tech) The uprising has sparked a tense debate about the right way to stitch together the digital scraps of someone's life to publicly accuse them of committing a crime.
Selfie-Snapping Rioters Leave FBI a Trail of Over 140,000 Images (Bloomberg) Citizens and police sift online trove to find Capitol mob. Facial recognition software used by one police department.
Dating apps are using images from the siege to ban rioters’ accounts (Washington Post) Bumble, Tinder and others are freezing out rioters with help from law enforcement — and, in some cases, their own photos. Other app users have taken matters into their own hands by striking up conversations with potential rioters and relaying their information to the FBI.
Capitol riot exposed shortcomings of the Trump DHS, say ex-officials (NBC News) Trump's DHS staffers "tend to be younger, with not as much experience," says an ex-Trump DHS official. "So many protocols were not followed" on Jan. 6.
Swalwell announces return to Homeland Security panel following Chinese spy sandal (The Post Millennial) Democratic Rep. Eric Swalwell announced Friday in a tweet that he will be rejoining the House Committee on Homeland Security, despite his discovered relationship with an alleged Chinese spy who used him to infiltrate the U.S. government.
Underground Carding Marketplace Joker's Stash Announces Shutdown (SecurityWeek) Joker’s Stash, a large underground marketplace for stolen payment card data, has announced plans to shut down operations on February 15, 2021.
Excellus will pay $5.1M to OCR after data breach affects 9.3M people (Healthcare IT News) The breach lasted for more than a year and resulted in the disclosure of individuals' names, Social Security numbers and other protected health information.
GDPR: Fines increased by 40% last year, and they're about to get a lot bigger (ZDNet) Non-compliant businesses, beware: analysts say that regulators are about to get much tougher with GDPR enforcement.
GDPR: German laptop retailer fined €10.4m for video-monitoring employees (ZDNet) NBB (notebooksbilliger.de) described the GDPR fine "as wrong as it is irresponsible."
Former Florida Covid-19 Data Analyst Rebekah Jones Arrested (Wall Street Journal) Florida law-enforcement officials arrested a former state Department of Health data analyst suspected of illegally accessing a state-run messaging system used by emergency personnel.
Delhi: How gang duped 40,000 people via malware app of marketing scheme (The Times of India) Twelve people, including two Chinese women and a Tibetan, were arrested by Cyber Cell of Delhi Police for duping people of crores by making them insta
FCC Inks $10M Fine For Racist Political Robocaller (Law360) After sending out thousands of racist robocalls in an attempt to sway public opinion against Black and Jewish political candidates, an Idaho white supremacist is being hit with nearly $10 million in fines from the Federal Communications Commission.
Dominion threatens MyPillow CEO Mike Lindell with lawsuit over ‘false and conspiratorial’ claims (Washington Post) Lawyers for election technology company Dominion Voting Systems have warned prominent Trump ally and MyPillow chief executive Mike Lindell of “imminent” litigation over “false and conspiratorial” claims that the firm somehow rigged the 2020 election against President Trump, demanding in letters late last year and this month that Lindell make a public apology.
