Dateline Moscow, Kyiv, Minsk, and Podgorica: Dispatches from a hybrid war.
Ukraine at D+188: Cyber ops continue during Ukraine's counteroffensive. (CyberWire) Ukrainian forces continue to retake ground in the region around Kherson. Cyber irregulars in Belarus and Ukraine strike against Russian interests. And ordinary cyber crime continues in Ukraine during wartime (and so does ordinary cyber law enforcement).
Russia-Ukraine war: List of key events, day 189 (Al Jazeera) As the Russia-Ukraine war enters its 189th day, we take a look at the main developments.
Ukraine Tries to Make Southern Offensive a Turning Point in War (Wall Street Journal) Kyiv is looking to prove that its forces can retake territory and evict Russian forces from land seized early in the invasion, in an effort to sustain international support and shape the next phase of the conflict.
Zelensky tells Russians 'run for your lives' as Ukrainians break through Kherson defences (The Telegraph) Four villages have been recaptured, official claims, in the most ambitious offensive Kyiv has attempted since the war began
Russia-Ukraine war: Ukraine accuses Russia of shelling town by Zaporizhzhia nuclear plant as inspectors arrive – live (the Guardian) Military leader says ‘provocations are dangerous’ as IAEA inspectors were headed for nuclear plant
Ukraine has ‘good chance’ to retake territory, U.S. assesses (POLITICO) Ukrainian officials announced the operation to liberate Russian-occupied territories in the country’s south on Monday, following weeks of counterattacks on towns in the Kherson region.
A successful Ukrainian counter-attack could provoke a reckless Putin response (The Telegraph) Kherson fightback may boost Ukraine’s morale, but the Kremlin’s reaction will be unpredictable
How dummy Himars are depleting Russia's missile supplies (The Telegraph) Russian drones cannot tell the difference between fake wooden launchers and the real thing when scouting the battlefield for targets
UN inspectors head to Ukraine nuclear plant in war zone (AP NEWS) A team of U.N. inspectors made its way toward Ukraine's Zaporizhzhia nuclear power plant Wednesday on a perilous, long-sought mission to help secure the site and reduce the risk of a catastrophe from the fighting raging around it.
Nuclear inspectors are in Ukraine for a high-stakes visit to the Zaporizhzhia plant. (New York Times) As artillery strikes continued near the complex, the inspectors could reach the nuclear plant as soon as Wednesday.
Zaporizhzhia nuclear plant: EU provides anti-radiation tablets to Ukraine (BBC News) Recent fighting near Zaporizhzhia power plant has increased fears of a nuclear accident.
For Putin and Russia, the Wagner Group Could Be a Recipe for Disaster (World Politics Review) Two historical patterns provide insights into the role that private military contractors like the Wagner Group play within the Russian political system.
Russia ‘locking conscripts in hot rooms without water’ until they sign up to fight in Ukraine (The Telegraph) Pressure tactics reportedly applied by military recruiters are a sign Kremlin is struggling to fill so-called 'volunteer battalions'
Inside occupied Ukraine: a photographer's firsthand account (Washington Post) The call in July came on a Sunday.
The Ukrainian military must reorganize to defeat Russia (Atlantic Council) Ukraine has achieved military miracles to derail Russia's invasion plans but reorganization of the Ukrainian Armed Forces is necessary if the country is to be fully liberated from Russian occupation, writes Richard D. Hooker, Jr.
Inside the IT Army of Ukraine, ‘A Hub for Digital Resistance’ (The Record by Recorded Future) Back in April, cybersecurity officials discovered the notorious “Industroyer” malware in the Ukrainian electrical grid. It might have been the scariest infrastructure hack since malware destroyed centrifuges at an Iranian uranium enrichment plant in 2010 – were it not for a TGIF miracle. Plus, a visit with the IT Army of Ukraine and a different kind of information operation.
Finland Plans Cyber Funding For Companies Amid Rising Security Threats (Wall Street Journal) Vouchers would help defend companies against elevated hacking risks during the war in Ukraine and Finland’s bid to join NATO.
Russian hackers blamed for ongoing Montenegro cyberattack (Tech Monitor) Critical infrastructure including power plants and water supplies have been hit by the ongoing cyberattack on Montenegro.
Cyberattacks Hit Montenegro’s State Infrastructure (OCCRP) Montenegrin officials have announced on Monday their plan to establish a specialized Cyber Security Agency following a series of cyberattacks which targeted the NATO-member Balkan nation’s government digital infrastructure last week.
Click Here: 30. The scariest piece of malware since Stuxnet on Apple Podcasts (Apple Podcasts) Show Click Here, Ep 30. The scariest piece of malware since Stuxnet - Aug 30, 2022
Ukraine takes down cybercrime group hitting crypto fraud victims (BleepingComputer) The National Police of Ukraine (NPU) took down a network of call centers used by a cybercrime group focused on financial scams and targeting victims of cryptocurrency scams under the guise of helping them recover their stolen funds.
War protest: Statues fall as Europe purges Soviet monuments (AP NEWS) In the Latvian capital of Riga, an obelisk that soared high above a park to commemorate the Soviet Army’s capture of that nation in 1944 was toppled last week.
Decolonizing Crimean history (Atlantic Council) A new online educational initiative is aiming to decolonize Crimean history and challenge the problematic international tendency to view the lands of the former Soviet Union through a Russian prism.
A Winner Is Emerging from The War in Ukraine, But It's Not Who You Think (Military.com) Iranian weapons may force Ukraine's Western benefactors to allocate additional billions for counter-drone or air defense systems.
Gorbachev’s Disputed Legacy (Foreign Policy) A hopeful moment in Russian history dies with the former Soviet leader.
Tech giant Atlassian slammed for ongoing ties to Russia as it wages war on Ukraine (News.com.au) Angry demonstrators have accused a major tech company of having blood on its hands as it continues to operate in Russia.
Nord Stream 1: Russia switches off gas pipeline citing maintenance (the Guardian) Shutdown at short notice by state-owned Gazprom disrupts European efforts to stockpile for winter
Russia halts natural gas flows via Nord Stream 1 pipeline, intensifying the pressure on Europe in its energy crisis (Markets Insider) Moscow is choking off Europe's energy supply to hit back against Western sanctions imposed after the invasion of Ukraine.
Attacks, Threats, and Vulnerabilities
Iraqi Hacking Team Claims Cyber Attack On Websites Of Iran-Backed Militias (MEMRI) On August 26, 2022 a Telegram channel affiliated with Iraqi Shi'ite cleric Muqtada Al-Sadr published a statement issued by a hacking team claiming responsibility for cyber attacks on websites affiliated with several Iran-backed militias in Iraq, as well as Lebanese Hizbullah. The statement claimed the sites were disrupted for several hours.
Pro-ISIS Telegram Channel Calls For Cyber Attacks (MEMRI) On August 28, 2022 a Telegram channel belonging to a pro-Islamic State (ISIS) online "raid" group posted a list in English of activities that help support ISIS. Items on the list included carrying out attacks to "weaken the economy" of "infidels", carrying out hacking operations, and sharing ISIS content everywhere online, in addition to creating original pro-ISIS media.
Chinese cyber attack on Australia exposed (News.com.au) Security experts have revealed a highly-complex scam that was used to mine sensitive information from Australia for months.
China-Based Group Uses ScanBox Framework in Espionage Attacks (Decipher) The group activity has overlaps with APT40, which has continued its “operational tempo” despite a previous indictment by the U.S. Department of Justice in 2021.
Chinese Hackers Used ScanBox Framework in Recent Cyber Espionage Attacks (The Hacker News) A Chinese hacker group conducted a months-long cyber espionage campaign against several entities using ScanBox Reconnaissance Framework to gather info
A Chinese database of faces and vehicle license plates spilled online (TechCrunch) Another mass data lapse exposes new weaknesses in China's sprawling surveillance state.
An anatomy of HEAT attacks used by Qakbot campaigns (Menlo Security) The Menlo Labs research team analyzes Qakbot, one of the leading banking Trojans around the globe.
Chrome extensions with 1.4 million installs steal browsing data (BleepingComputer) Threat analysts at McAfee found five Google Chrome extensions that steal track users' browsing activity. Collectively, the extensions have been downloaded more then 1.4 million times.
Malicious Cookie Stuffing Chrome Extensions with 1.4 Million Users (McAfee Blog) Authored by Oliver Devane and Vallabh Chole A few months ago, we blogged about malicious extensions redirecting users to phishing sites and inserting
JavaScript bugs aplenty in Node.js ecosystem – found automatically (Naked Security) How to get the better of bugs in all the possible packages in your supply chain?
CVE-2021-38297 - Go Web Assembly Vulnerability (JFrog) CVE-2021-38297 allows attackers to override an entire Wasm module & achieve WebAssembly code execution. Read technical analysis & mitigation from JFrog Security research >
IAM house Okta confirms 0ktapus/Scatter Swine attack (ComputerWeekly.com) Following last week’s disclosureby Group-IB researchers of a major phishing campaign, Okta has warned its customers to be on their guard.
Okta entangled by Twilio phishing attack (Cybersecurity Dive) The threat actor initiated one-time password requests as they searched dozens of phone numbers linked to a single targeted organization.
Hacker used access to Twilio's console to steal Okta-protected phone numbers and OTPs (teiss) Identity and access management solutions provider Okta has confirmed that a security incident suffered by Twilio has compromised the data of some Okta customers.
How 1-Time Passcodes Became a Corporate Liability (KrebsOnSecurity) Phishers are enjoying remarkable success using text messages to steal remote access credentials and one-time passcodes from employees at some of the world's largest technology companies and customer support firms. A recent spate of SMS phishing attacks from one cybercriminal…
Qualys Discovers Two Major Vulnerabilities (Security Boulevard) Bharat Jogi, Director of Security and Threat Research at Qualys, discusses the discovery of two recent vulnerabilities, the 12 year old Linux
A new malware campaign ‘GO#WEBBFUSCATOR’ has been spotted hidden inside the James Webb telescope (The Tech Outlook) Threat researchers have identified a fresh malware campaign called “GO#WEBBFUSCATOR” that disseminates malware via phishing emails, malicious documents, and James Webb telescope images from space. The malware was created using the cross-platform programming language Golang, which is gaining popularity among cybercriminals due to its enhanced resistance to reverse engineering and analysis as well as its …
Microsoft Excel attacks fall out of fashion with hackers (SearchSecurity) Microsoft countermeasures helped to reduce the rate of Excel attacks, according to research from Hornetsecruity.
Starlink suffered a global outage overnight (The Verge) Some are still reporting speed degradations.
Advanced cyber-attack: NHS doctors' paperwork piles up (BBC News) They say it could take months to clear the backlog caused by a continuing cyber-attack.
NHS warns of growing paperwork backlog after cyberattack (Computing) Some services are only now beginning to recover from the ransomware attack on 4th August
Major Library Vendor Disrupted by Ransomware Attack (GovTech) A cyber attack took out a server at Baker & Taylor, a major library books, software and service provider working with the likes of the New York Public Library. The company is still working to restore its systems.
Baker & Taylor's Systems Remain Offline a Week After Ransomware Attack (Infosecurity Magazine) The company said it will proceed to restore its systems as soon as they are sanitized
Walmart Sells Fake 30TB Hard Drive That’s Actually Two Small SD Cards in a Trench Coat (Vice) A cybersecurity researcher bought the same item from AliExpress and took it apart. Walmart removed the hard drive after Motherboard contacted the company.
The urgency of cybersecurity for hardware devices (Security Infowatch) Here are a few innovative solutions to help stem the tide of threats to IoT devices
DHS OIG Warns Public of Fraudsters (HS Today) This U.S. Department of Homeland Security (DHS) Office of Inspector General (OIG) has issued a Public Service Announcement highlighting how scammers impersonating DHS personnel defraud the public and how to avoid becoming another victim.
Vulnerability Summary for the Week of August 22, 2022 (CISA) The CISA Vulnerability Bulletin provides a summary of new vulnerabilities that have been recorded by the National Institute of Standards and Technology (NIST) National Vulnerability Database (NVD) in the past week. NVD is sponsored by CISA. In some cases, the vulnerabilities in the bulletin may not yet have assigned CVSS scores. Please visit NVD for updated vulnerability entries, which include CVSS scores once they are available.
Security Patches, Mitigations, and Software Updates
Hitachi Energy FACTS Control Platform (FCP) Product (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: FACTS Control Platform (FCP) Product Vulnerability: Inconsistent Interpretation of HTTP Requests, Use After Free, Classic Buffer Overflow, Integer Underflow, Improper Certificate Validation, Observable Discrepancy. 2.
Hitachi Energy Gateway Station (GWS) Product (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: Gateway Station (GWS) Product Vulnerability: Inconsistent Interpretation of HTTP Requests, Use After Free, Classic Buffer Overflow, Integer Underflow, Improper Certificate Validation, Observable Discrepancy 2.
Hitachi Energy MSM Product (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: MSM Product Vulnerability: Reliance on Uncontrolled Component 2. RISK EVALUATION Successful exploitation of this vulnerability could disrupt the functionality of the MSM web interface, steal sensitive user credentials, or cause a denial-of-service condition.
Hitachi Energy RTU500 series (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.5 ATTENTION: Exploitable remotely/low attack complexity Vendor: Hitachi Energy Equipment: RTU500 series Vulnerability: Improper Input Validation 2. RISK EVALUATION Successful exploitation of this vulnerability could cause an internal buffer overflow, which can reboot the product.
Fuji Electric D300win (CISA) 1. EXECUTIVE SUMMARY CVSS v3 8.7 ATTENTION: Exploitable remotely/low attack complexity Vendor: Fuji Electric Equipment: D300win Vulnerabilities: Out-of-bounds Read, Write-what-where Condition 2. RISK EVALUATION Successful exploitation of these vulnerabilities could result in loss of sensitive data and manipulation of information.
Honeywell ControlEdge (CISA) 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: ControlEdge Vulnerability: Missing Authentication for Critical Function CISA is aware of a public report known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors.
Honeywell Experion LX (CISA) 1. EXECUTIVE SUMMARY CVSS v3 9.1 ATTENTION: Exploitable remotely/low attack complexity Vendor: Honeywell Equipment: Experion LX Vulnerability: Missing Authentication for Critical Function CISA is aware of a public report known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors.
Honeywell Trend Controls Inter-Controller Protocol (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7.1 ATTENTION: Low attack complexity Vendor: Honeywell Equipment: Trend Controls IQ Series that utilize Inter-Controller (IC) protocol Vulnerability: Cleartext Transmission of Sensitive Information CISA is aware of a public report, known as “OT:ICEFALL” that details vulnerabilities found in multiple operational technology (OT) vendors.
Omron CX-Programmer (CISA) 1. EXECUTIVE SUMMARY CVSS v3 7,8 ATTENTION: Low attack complexity Vendor: Omron Equipment: CX-Programmer Vulnerability: Use After Free 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code. 3. TECHNICAL DETAILS 3.1 AFFECTED PRODUCTS The following Omron product, part of a software automation suite, is affected:
PTC Kepware KEPServerEX (CISA) 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: PTC Equipment: Kepware KEPServerEX Vulnerabilities: Heap-based Buffer Overflow, Stack-based Buffer Overflow 2. RISK EVALUATION Successful exploitation of these vulnerabilities could allow an attacker to crash the device or remotely execute arbitrary code.
Sensormatic Electronics iSTAR (CISA) 1. EXECUTIVE SUMMARY CVSS v3 10.0 ATTENTION: Exploitable remotely/low attack complexity Vendor: Sensormatic Electronics, a subsidiary of Johnson Controls Inc. Equipment: iSTAR Ultra Vulnerability: Command Injection 2. RISK EVALUATION An unauthenticated user could use a malicious request to run arbitrary commands as root user.
Mitsubishi Electric GT SoftGOT2000 (CISA) 1. EXECUTIVE SUMMARY CVSS v3 9.8 ATTENTION: Exploitable remotely/low attack complexity Vendor: Mitsubishi Electric Equipment: GT SoftGOT2000 Vulnerabilities: Infinite Loop, OS Command Injection 2. RISK EVALUATION Successful exploitation of these vulnerabilities could create a denial-of-service condition or enable arbitrary code execution.
Trends
2022 Unit 42 Network Threat Trends Research Report (Palo Alto Networks) The 2022 Unit 42 Network Threat Trends Research Report provides insight into newly reported network vulnerabilities and advanced threats observed in the wild.
The State of Dark Web Cybercrime Threat Intelligence 2022 (KELA) Here are seven of the key insights we learned from the security team members we surveyed
Incognia Mobile App Fraud Insights Report Reveals Food Delivery Apps are Major Target for Location-Based Fraud (GlobeNewswire News Room) With millions of food delivery app users worldwide, data shows high volume of location spoofing on driver apps resulting in fraud losses...
Ransomware gangs' favorite targets (Help Net Security) Barracuda released a research report which looks at ransomware attack patterns that occurred between August 2021 and July 2022.
China and Russia attack U.S. civilians daily. Collective cyber defense can protect them | Opinion (Newsweek) The more we can collectively strengthen our cyber defenses, the more costly, time-consuming and unappealing the process will be for hackers.
Cyber Attack Costs Have Risen by 80% for US Businesses, Reveals Hiscox Cyber Readiness Report™ 2022 (Hiscox) Hiscox, the international specialist insurer, reports that both the frequency and cost of cyber attacks are rising for US businesses, and the pandemic is continuing to have lasting effects on the cyber security landscape.
New Research from Axonius Finds Despite SaaS Spend Eclipsing IaaS, SaaS Security Not a Priority...Yet (PR Newswire) Axonius, the leader in cybersecurity asset management and SaaS management, today released the results of a new research study focused on SaaS...
Marketplace
Who Pays for an Act of Cyberwar? (WIRED) Cyberinsurance doesn't cover acts of war. But even as cyberattacks mount, the definition of "warlike" actions remains blurry.
Google announces open source vulnerability reward program after Log4j, Codecov issues (The Record by Recorded Future) Google announced on Tuesday that it is launching an open source software vulnerability bug bounty program, offering rewards from $100 to $31,337.
SonarSource Expands the Clean Code Movement to Asia Pacific (Business Wire) SonarSource, the leading platform for Clean Code, today announced it has expanded its presence in APAC with the creation of a Singapore regional headq
Cylitic Security Places First in Tanium's Inaugural Partner Capture the Flag (PR Newswire) Cylitic Security, a cyber security services provider, took first place in the inaugural Capture the Flag event hosted by Tanium, the industry's...
State of Tennessee Treasury Department Invests $1.65 Million in CyberArk Software Ltd. (NASDAQ:CYBR) (Defense World) State of Tennessee Treasury Department purchased a new position in CyberArk Software Ltd. (NASDAQ:CYBR – Get Rating) during the first quarter, according to its most recent Form 13F filing with the Securities and Exchange Commission (SEC). The institutional investor purchased 9,780 shares of the technology company’s stock, valued at approximately $1,650,000. A number of other […]
Rubrik Surpasses $400 Million in Subscription ARR and Launches Rubrik Zero Labs, Data Threat Research Unit to Help Combat Global Cyber Events (Rubrik) Rubrik has achieved tremendous growth over the past year, surpassing $400 million in annual recurring revenue (ARR), and announced a new cybersecurity research unit, Rubrik Zero Labs.
Radware launches new cloud security center in Taiwan (DIGITIMES) InfoSec provider Radware has announced that it is launching a new cloud security center in Taiwan, its 16th global location. The new center can provide clients services with even lower latency to speed up the response to security attacks.
Lookout Appoints Deborah Wolf as Chief Marketing Officer (Lookout) Lookout, Inc. today announced the appointment of marketing executive Deborah Wolf as its new chief marketing officer (CMO). Wolf will lead the global go-to-market functions for Lookout including revenue marketing, integrated campaigns, digital marketing, field and event marketing, product marketing, corporate communications and marketing operations, as well as its team of business development representatives. Wolf’s hire comes at a pivotal time for the Company as it accelerates its commitment to design and deliver digital security solutions for the intersection of enterprise and personal data.
Yellowbrick Hires Robert Potts as VP of North American Sales (GlobeNewswire News Room) Former Snowflake Executive Joins Yellowbrick in Newly Created Role to Accelerate Go-to-Market Motions...
AFCEA DC Names Iron Bow Technologies’ Chief Strategy Officer, Larry Frazier, to Executive Board for 2022-2023 (Business Wire) Iron Bow Technologies, the leading technology solutions provider to government, commercial, and healthcare markets, today announced that the company’s
One Identity Bolsters Executive Team to Capitalize on Market Leadership and Accelerate Growth (GlobeNewswire News Room) The new leadership will help fortify One Identity’s position as a global market leader in the identity security market...
Products, Services, and Solutions
Blumira Launches New Managed Service Provider (MSP) Portal to Automate and Streamline Security (PR Newswire) Blumira, a leading cybersecurity provider of automated threat detection and response technology, today announced the launch of new managed...
BKW Selects Omada Identity and SECURIX to Improve Identity and Access Management (PR Newswire) Omada A/S ("Omada"), a global leader of Identity Governance and Administration (IGA) software, announced today that, along with its strategic...
Netlify Bolsters Enterprise-Level Security of its Platform with ISO 27001 Certification (Netlify) A powerful serverless platform with an intuitive git-based workflow. Automated deployments, shareable previews, and much more. Get started for free!
Nvidia, Dell, VMware add AI, zero-trust security into new data center package (ZDNET) Dell servers containing Nvidia DPUs, GPUs, and VMware vSphere 8 use multiple firewalls to improve security for cloud-based workloads.
Coalfire Federal becomes authorized to conduct CMMC assessments (KMWorld) Cyber leader fortifies its ability to help organizations prepare and obtain CMMC certification
SecureAuth Announces General Availability of Arculix, its Next-Gen Passwordless Continuous Authentication Platform (SecureAuth) SecureAuth announces general availability of Arculix Next Generation Continuous Authentication and Access Management
Next Generation of Telos’ Cyber Risk Management Platform Enables Financial Expression of Cyber Risks and Accelerates Workflow Automation (Telos Corporation) Telos Corporation, a leading provider of cyber, cloud and enterprise security solutions for the world’s most security-conscious organizations, today announced the launch of the latest enhancements of Xacta®, its cyber risk management and compliance analytics platform. This release introduces new features that allow Xacta users to quantify and... Read more
Tigera Announces General Availability of Container Security Features on Calico Cloud (PR Newswire) Tigera, which provides the industry's only active Cloud-Native Application Protection Platform (CNAPP) with full-stack observability for...
Ushering in the Passwordless Future at Dashlane (Dashlane Blog) With a passwordless future on the horizon, Dashlane is excited to introduce integrated passkey support in our password manager and unveil the first in-browser passkey solution.
Styra Further Shifts Security Left With New Policy-as-Code Repository Scanning (Business Wire) Styra introduces Repo Scan as the newest feature in the Styra Declarative Authorization Service (DAS).
Technologies, Techniques, and Standards
Perimeter Security Isn't Dead: New Solutions to Consider (Techopedia.com) COVID-19 rendered many current perimeter security measures obsolete. Luckily, these four s
Why do people overshare online? 5 expert tips for avoiding social media scandal (The Conversation) Research shows strong emotions are what drives oversharing online – but there are simple things you can do to keep your social media professional.
Design and Innovation
What does GPT-3 “know” about me? (MIT Technology Review) Large language models are trained on troves of personal data hoovered from the internet. So I wanted to know: What does it have on me?
Research and Development
Air Force mulls 10-year half-billion-dollar program for anti-tamper technologies in hardware and software (Military & Aerospace Electronics) Project seeks to prevent reverse-engineering that may compromise critical program information leading to technology transfer, or system alteration.
Academia
College Students from Research Outreach Programs Solve Hard Mission Problems, Present Findings to GEN Nakasone (National Security Agency/Central Security Service) College interns from the National Security Agency's (NSA) Director’s Summer Program (DSP) and Graduate Mathematics Program (GMP) recently briefed top Agency leaders on their work to address
Legislation, Policy, and Regulation
EU and Greece veer toward standoff over wiretapping scandal (POLITICO) ‘Democracy and rule of law are at stake,’ says MEP Saskia Bricmont.
UK mobile/broadband carriers face fines if cybersecurity rules not followed (TechCrunch) The cybersecurity rules are the first enforcement directives to come out of the Telecommunications (Security) Act, which was voted into law in November 2021.
UK telecom companies face tough new cybersecurity rules (Tech Monitor) A new code of conduct for UK telecom companies will require them to ensure the safety of network equipment and data in case of cyberattacks.
New Cybersecurity Regulations Are Coming. Here’s How to Prepare. (Harvard Business Review) A whole suite of new cybersecurity regulations and enforcement are in the offing, both at the state and federal level in the U.S. and around the world. Companies don’t need to just sit by and wait for the rules to be written and then implemented, however. Rather, they need to be working now to understand the kinds of regulations that are presently being considered, ascertain the uncertainties and potential impacts, and prepare to act.
Pentagon Releases its First Departmental Social Media Policy (FEDmanager) Acting Assistant to the Secretary of Defense for Public Affairs Gordon Trowbridge issued a new policy outlining how official social media accounts should advance the mission of the U.S. military.
Almost No One Has Been Hired Through DHS' Much-Hyped Cyber Talent Program (Defense One) With a month left in the fiscal year, program is 146 new hires short of its 150-person goal.
GCHQ seeks to increase number of female coders to tackle threats (the Guardian) UK intelligence service funding ‘nano-degree’ courses in effort to improve diversity in technology roles
Litigation, Investigation, and Law Enforcement
On Pegasus, Supreme Court panel failed its mandate, missed an opportunity (The Indian Express) Yashovardhan Azad and Anand Venkatnarayanan write: Technical committee did not probe origin and nature of the malware found on phones, and meekly accepted government's non-cooperation.
FTC lawsuit spotlights a major privacy risk: From call records to sensors, your phone reveals more about you than you think (The Conversation) Even a burner phone paid for with cash can reveal your identity and where you’ve been. A data privacy expert explains.
Police investigate electronic theft of federal funds (City of Lexington) The theft involved approximately $4 million in federal rent assistance and transitional housing funds.
FBI, Secret Service join Kentucky investigation into $4 million cybercrime theft (The Record by Recorded Future) Lexington, Kentucky is working with the FBI and Secret Service to investigate $4 million in federal rent assistance that was allegedly stolen by cybercriminals.
Elon Musk Attacks Twitter Deal Over Whistle-Blower as Feud Escalates (Bloomberg) Former Twitter security head raised questions about user data. Twitter lawyers say Musk’s case is “invalid and wrongful.”
FBI responds to Mark Zuckerberg claims in Joe Rogan show (NBC News) Zuckerberg told Rogan that Facebook limited the exposure of a story ahead of the 2020 election after the FBI warned him to beware of polarizing content.
Deloitte Just Lost a Quiet Cybersquatting Dispute With a Privacy-Focused Crypto Company (Going Concern) Have you heard of DYKC? We haven’t. It’s not like it’s our job to know what giant accounting firms are doing across the globe at any given moment. Apparently Penultimate Media Systems hadn’t heard of Deloitte’s “Know Your Customer” services either when they registered DontKYC.com in August 2021. Deloitte decided to stomp that out lest […]
Monkees Member Micky Dolenz Sues FBI For Hoover-Era Files (Law360) The only living member of the 1960s group The Monkees sued the U.S. Department of Justice on Tuesday to compel the FBI to fulfill a records request for any documents the agency created or possesses about the band and its members, hinting that the material may be used in a book or documentary.
