the near future: the latest about the next few months.
The Cybersecurity 202: The cybersecurity stories that rocked 2020 will pose even bigger challenges in 2021 (Washington Post) Election security was the cybersecurity story dominating 2020, and it is likely to dominate 2021 as well. That reflects an old saw about cybersecurity — that it is a race without a finish line.
What does the future of infosecurity entail? (Security Brief) 2020 has presented the world with constant changes, curveballs and shifts in business strategy. This has caused the infosecurity industry to implement real-world solutions which are likely to remain beyond the end of this global pandemic and into 2021.
UK businesses expect surge in COVID-themed phishing attacks (Insurance Business Magazine) Over one-third of firms admit to lacking security measures
Zoom warning as cyber experts say hackers will be watching over Christmas (The Telegraph) Opportunistic hackers are likely to try and replicate the Zoom invite links sent by email
Fraud trends part 2: holiday fraud and account protection (Microsoft Dynamics 365 Blog) In this blog series we are exploring the latest fraud-related events and issues on the rise in our digitized world. The first installment in the series explored account takeovers (ATO) and the $7 billion yearly loss affecting even the largest organizations.
Cyber Attacks, Threats, and Vulnerabilities
Nuclear weapons agency breached amid massive cyber onslaught (POLITICO) Hackers accessed systems at the National Nuclear Security Administration, which maintains the U.S. nuclear weapons stockpile.
Hackers Tied to Russia Hit Nuclear Agency; Microsoft Is Exposed (Bloomberg) Cyber agency warned of attacks on infrastructure, governments. Microsoft says it found ‘malicious binaries’ in its systems.
U.S. Nuclear Weapons Agency Hacked as Part of Massive Cyber-Attack (Time) An investigation has found the hack didn’t affect “mission-essential national security functions,” a Department of Energy spokesperson said in a statement.
US nuclear weapons agency breached in cyber attack (Computing) CISA has warned about the difficulty of completely ridding the government network of malware
NSA Cybersecurity Advisory: Malicious Actors Abuse Authentication Mechanisms to Access Clo (National Security Agency Central Security Service) In response to ongoing cybersecurity events, the National Security Agency (NSA) released a Cybersecurity AdvisoryThursday “Detecting Abuse of Authentication Mechanisms.” This advisory provides
Advanced Persistent Threat Compromise of Government Agencies, Critical Infrastructure, and Private Sector Organizations (CISA) This Alert uses the MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK®) version 8 framework. See the ATT&CK for Enterprise version 8 for all referenced threat actor tactics and techniques.
SolarWinds Isn't the Only Way Hackers Entered Networks, CISA Says (Defense One) The agency warned that ejecting attackers from networks will be tough, especially because they can likely read the email of IT and cybersecurity employees.
CISA: SolarWinds Likely Not The Only Supply Chain Compromise in Massive Hack (My TechDecisions) The U.S. Cybersecurity and Infrastructure Agency beleives there are other IT supply chain compromises in addition to SolarWinds' Orion Platform.
‘It’s going to take a lot of digging’: The Pentagon’s long search to see if anyone’s hiding in its networks (C4ISRNET) A behind-the-scenes look at how the Pentagon hunts for cyber breaches
Cybersecurity agency warns of ‘grave risk’ from hack (San Jose Mercury News) CISA also warned that it will be difficult to remove the malware inserted through network software. “The agency said that removing this threat actor from compromised environments will be high…
Hack Suggests New Scope, Sophistication for Cyberattacks (Wall Street Journal) The suspected Russian hack involving SolarWinds software that compromised parts of the U.S. government was executed on a scale that has surprised even veteran security experts. It has exposed a potentially critical vulnerability in America’s technology infrastructure, investigators say.
Federal investigators find evidence of previously unknown tactics used to penetrate government networks (Washington Post) Federal investigators reported Thursday on evidence of previously unknown tactics for penetrating government computer networks, a development that underscores the disastrous reach of Russia’s recent intrusions and the logistical nightmare facing federal officials trying to purge intruders from key systems.
Russia-Linked Hackers 'Very Methodical' in Finding Exploit: Cybereason (Bloomberg) Cybereason Chief Executive Officer Lior Div discusses the likely methods that were used in a suspected Russian cyber-attack that struck several U.S. federal government agencies and states. He speaks on "Bloomberg Markets:
FBI says significant cyberattacks on US federal agencies still underway, plans response (Republic World) Calling the recent cyberattacks on US federal agencies “a developing situation”, FBI, CISA and ODNI jointly said a coordinated response is being put together.
US cyber-attack: US energy department confirms it was hit by Sunburst hack (BBC News) The department is responsible for managing nuclear weapons, but said their security was not affected.
Russian Hackers Have Been Inside Austin City Network for Months (The Intercept) Russia appears to have used Austin’s network as infrastructure to stage additional cyberattacks.
FBI, CISA officially confirm US govt hacks after SolarWinds breach (BleepingComputer) The compromise of multiple US federal networks following the SolarWinds breach was officially confirmed for the first time in a joint statement released earlier today by the FBI, DHS-CISA, and the Office of the Director of National Intelligence (ODNI).
The Scope of the Latest Russian Hack on the U.S. Is Growing (Intelligencer) The Pentagon, the National Nuclear Security Administration, and more have been comprised, which authorities were reportedly not aware of for months.
How suspected Russian hackers outed their massive cyberattack (POLITICO) A cybersecurity firm says a suspicious log-in prompted it to investigate what turned out to be a gaping security hole for the U.S. government and many large companies.
The SolarWinds hack can directly affect control systems (Control Global) This is arguably one of my most important blogs as it directly relates to how the Russian’s got a “two-fer” in the SolarWinds hack – compromise of the IT infrastructure and direct CONTROL of building control system devices. The Russians also got indirect control of “industrial” control systems via the IT network backdoors.
Behind the News: the SolarWinds Security Attack (Radiflow) Earlier this week it was revealed that SolarWinds, whose Orion software is a very popular tool for managing IT networks, has been a victim of a massive supply chain attack that had affected thousands of businesses as well as US government agencies.
Just how bad is that hack that hit US government agencies? (TechCrunch) "There’s not a single organization who can claim cybersecurity perfection."
Supply Chain Attack: CISA Warns of New Initial Attack Vectors Posing 'Grave Risk' (SecurityWeek) The U.S. government added a new wrinkle to the global emergency response to the SolarWinds software supply chain attack, warning of additional initial access vectors that have not yet been documented.
Microsoft confirms it was also breached in recent SolarWinds supply chain hack (ZDNet) Microsoft denies that hackers pivoted to production systems and abused its software to attack customers.
Microsoft says it found malicious software in its systems (Reuters) Microsoft Corp said on Thursday it found malicious software in its systems related to a massive hacking campaign disclosed by U.S. officials this week, adding a top technology target to a growing list of attacked government agencies.
Microsoft confirms it found compromised SolarWinds code on its systems (Computing) But the major target was the US government
Microsoft was breached in SolarWinds cyberattack, in what one exec calls ‘a moment of reckoning’ (MarketWatch) Microsoft Corp. was breached as part of the massive hack that used a backdoor in SolarWinds software, as part of what the tech giant's president called...
FBI, CISA, ODNI Describe Response to SolarWinds Attack (SecurityWeek) The FBI, CISA and ODNI have described each of their roles in investigating the SolarWinds hack and responding to the incident.
Nation-state hackers breached US think tank thrice in a row (BleepingComputer) An advanced hacking group believed to be working for the Russian government has compromised the internal network of a think tank in the U.S. three times.
FAST THINKING: Why the new Russian hacks are a game-changer (Atlantic Council) A suspected Russian hack targeted the US Department of Homeland Security in addition to the State, Treasury, and Commerce Departments.
Iranian nation-state hackers linked to Pay2Key ransomware (BleepingComputer) Iranian-backed hacking group Fox Kitten has been linked to the Pay2Key ransomware operation that has recently started targeting organizations from Israel and Brazil.
Pay2Kitten – Fox Kitten 2 (ClearSky) During the past four months a wave of cyber-attacks has been targeting Israeli companies. The attacks are conducted by different means and target a range of sectors. We estimate with medium to high confidence that Pay2Key is a new operation conducted by Fox Kitten, an Iranian APT group that began a new wave of attacks in November-December 2020 that entailed dozens of Israeli companies.
Iranian hackers aim to sow panic in Israel - report (Globes) Israeli company ClearSky Cyber Security has traced recent attacks on Israeli companies to a known Iranian hacker group.
Ukraine says faces almost daily hacker attacks (Reuters) Ukraine is facing almost daily hacker attacks on its government resources and intends to sharply strengthen its cyber security, Ukrainian state security service SBU said on Friday.
Bouncy Castle crypto authentication bypass vulnerability revealed (BleepingComputer) A severe authentication bypass vulnerability has been reported in Bouncy Castle, a popular open-source cryptography library. When exploited, the vulnerability (CVE-2020-28052) can allow an attacker to gain access to user and administrator accounts due to a cryptographic weakness in the manner passwords are checked.
D-Link: Multiple Security Vulnerabilities Leading to RCE (Trustwave) On the 30th of October, D-Link published a support announcement and released a new firmware to patch five vulnerabilities that Harold Zang, Technical Security Specialist at Trustwave, identified on the DSL-2888A router. These security vulnerabilities could allow a malicious Wi-Fi or local network user to gain unauthorised access to the router web interface, obtain the router password hash, gain plaintext credentials, and execute system commands on the router.
BioNTech COVID-19 Vaccine Spoofed in Email Campaign (Avanan) Avanan researchers have uncovered a new phishing attack that spoofs the BioNTech COVID-19 vaccine.
Two Malware-Laced Gems Found in RubyGems Repository (SecurityWeek) Two Ruby gems that were found to pack malware capable of running persistently on infected machines were removed recently from the RubyGems hosting service.
People's Energy data breach affects all 270,000 customers (BBC News) The data stolen includes individuals' names, addresses and some dates of birth but not bank details.
Cybersecurity – Is SmartTech Vulnerable to Malware Attacks? (TWinFM) In terms of cybersecurity, is SmartTech in our buildings vulnerable to malware attacks?
Emerson Rosemount X-STREAM (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 7.5
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: Emerson
Equipment: Rosemount X-STREAM Gas Analyzer
Vulnerability: Improper Authentication
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow an attacker through a specially crafted URL to download files and obtain sensitive information.
PTC Kepware KEPServerEX (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 9.8
ATTENTION: Exploitable remotely/low skill level to exploit
Vendor: PTC
Equipment: Kepware KEPServerEX
Vulnerabilities: Stack-based Buffer Overflow, Heap-based Buffer Overflow, Use After Free
2. RISK EVALUATION
Successful exploitation of these vulnerabilities could lead to a server crashing, a denial-of-service condition, data leakage, or remote code execution.
PTC Kepware LinkMaster (CISA) 1. EXECUTIVE SUMMARY
CVSS v3 9.3
ATTENTION: Low skill level to exploit
Vendor: PTC
Equipment: Kepware LinkMaster
Vulnerability: Incorrect Default Permissions
2. RISK EVALUATION
Successful exploitation of this vulnerability could allow a local attacker to globally overwrite the service configuration to execute arbitrary code with NT SYSTEM privileges.
When zombie malware leads to big-money ransomware attacks (Naked Security) SophosLabs investigates SystemBC, a malware utility for launching fileless malware attacks, including big-money ransomware.
Security Patches, Mitigations, and Software Updates
SolarWinds Deploys CrowdStrike To Secure Systems After Hack (CRN) SolarWinds rolled out CrowdStrike’s Falcon Endpoint Protection across the endpoints on its systems to ensure that its internal systems are secure following the massive cyberattack.
Trend Micro Patches Serious Flaws in Product Used by Companies, Governments (SecurityWeek) An update released by Trend Micro for a web security appliance used by companies and governments patches several serious vulnerabilities.
A slightly optimistic tale of how patching went for CVE-2019-19781 (Sesin) Since we could all probably use a little distraction from the current Solarigate/SUNBURST news[1,2,3], I thought it might be good to look at something a little bit more positive today. Specifically, at how patching of CVE-2019-19781 AKA “Shitrix” AKA “one of the more famous named vulnerabilities from the end of 2019” went.
Cyber Trends
State-backed hacks of US, Israel herald new age of cyberwarfare (The Jerusalem Post) CYBER AFFAIRS: One lesson of these latest hacks is that hackers can be like the ancient demon hydra – you lop off one head, and multiple other heads sprout.
How CIOs in 2020 Rallied Their Companies Around Remote Work (Wall Street Journal) Chief information officers in 2020 have had to manage the effects of the coronavirus pandemic by quickly rolling out technology and overseeing new ways of working that will likely continue through next year.
Report: 40% of Parents Give Preschoolers a Head Start in Password Education (PR Newswire) Passwords and online security have become deeply embedded in all aspects of family life, according to new research from 1Password, the world's...
A new Mimecast report shows a steady increase in malicious files in GCC (Intelligent CIO Middle East) Email security vendor Mimecast has released a report from its Threat Intelligence Centre titled ‘Arabian Peninsula as a Cyber Innovator and Associated Cyber Risk to Resilience in the Region. Researchers at the security vendor have observed a month-on-month increase in malicious files detected in the region over the course of 2020. The report highlights how […]
Marketplace
Little-Known SolarWinds Gets Scrutiny Over Hack, Stock Sales (SecurityWeek) Before this week, few people were aware of SolarWinds, but the revelation that it has been targeted by elite cyber spies has put many of its customers on high alert, and it’s raising questions about why its biggest investors sold off stock.
This local private equity firm has raised billions — and it's raising more (Washington Business Journal) Grain Management is focused on communications infrastructure and the internet — and the increasing demand for high-speed bandwidth.
DigitalOcean Joins MANRS Initiative to Combat Routing Security Threats (DigitalOcean Blog) Today we are pleased to announce that DigitalOcean has joined the Mutually Agreed Norms for Routing Security (MANRS) initiative for CDN and Cloud Providers to reduce common routing security threats. T
Centronix Joins the Mobile Communications America Family (PR Newswire) Mobile Communications America (MCA), the leading provider of wireless communication solutions that enhance the safety, security, and operating...
Red Snapper Group Awarded ISO 27001 Certification (Acumin) We are proud to announce that Red Snapper Group (RSG) have been awarded ISO 27001 certification within the scope of...
Why CrowdStrike Now Matters More Than Ever (Nasdaq) Earlier this week, the email systems at the U.S. Treasury and Commerce Departments were infiltrated by hackers. According to The New York Times, this was one of the largest and most sophisticated attacks in recent years.
Mimecast (MIME) CEO Peter Bauer Sold $3.1 million of Shares (Yahoo) CEO of Mimecast (30-Year Financial, Insider Trades) Peter Bauer (insider trades) sold 62,500 shares of MIME on 12/15/2020 at an average price of $49.52 a share.
Cisco Systems Layoffs 2020: Networking Company Confirms 3,500 Job Cuts (ChannelE2E) Cisco Systems layoffs for 2020 span 3,500 employee job cuts -- fewer than the 8,000 cuts alleged by a Washington Post report.
Cisco operations chief exits post to return to Singapore (NASDAQ:CSCO) (SeekingAlpha) Cisco Systems (NASDAQ:CSCO) says in an SEC filing that its executive VP and Chief of Operations Irving Tan has exited, electing to return to Singapore.
F5 Welcomes Haiyan Song as Executive Vice President of Security (Yahoo) F5 Networks (NASDAQ: FFIV) today announced that Haiyan Song will be joining the company as Executive Vice President of Security, starting January 4, 2021. Song joins F5 from Splunk where she led the Security business as Senior Vice President and General Manager of Security Markets. Song will build on F5’s position as the second-largest global application security player, with over $750 million in security revenues, and drive the company’s next phase of growth in security.
Cybersecurity Company Deep Instinct Expands Executive Team with Appointment of Chief Marketing Officer (BusinessWire) Cybersecurity company, Deep Instinct, announces Ryan Shopp has been named to the newly created position of chief marketing officer.
Products, Services, and Solutions
Firedome Recognized as First Cybersecurity Software to Achieve UL's Secure IoT Component Qualification (PR Newswire) UL, the safety science leader, today announced that Firedome is the first cybersecurity software to achieve UL's Secure IoT Component...
Check Point Software Ensures Security of Vital Public Health Data and Services in the Cloud for NHS Scotland (GlobeNewswire) Check Point secures and streamlines management of NHS Scotland’s sensitive health data in the public cloud, and gives hyperscalability to support rapid roll-out of Covid-19 related apps and vaccine management systems
Check Point Becomes Trainer With ISACA To Provide CISOs With New Ways To Attain Certified Cyber Skills (Security Informed) Check Point® Software Technologies Ltd., a provider of cyber-security solutions globally, announces that it has become an accredited trainer with ISACA, a global learning organization and...
CloudPassage adds Google Cloud Platform support for Halo Cloud Secure (Help Net Security) CloudPassage announced the addition of Google Cloud Platform support for Halo Cloud Secure, the CSPM service of Halo cloud security platform.
Anomali automates and speeds essential tasks performed by threat intelligence (Help Net Security) Anomali has added new features and capabilities across its product suite that further automate and speed essential tasks.
ThetaRay's Correspondent Banking AML Solution to Enable Cecabank to Safely Connect Small/Medium-sized Banks to the Global Financial System (PR Newswire) ThetaRay, a leading provider of AI-based Big Data analytics, today announced that its Anti-Money Laundering (AML) for Correspondent Banking...
LucidLink Rapidly Rolls Out Single Sign-on with Identity Management Firm - Okta (GlobeNewswire) Enhances Filespaces with Pinning Feature
Grammarly Joins the Cloud Security Alliance (Grammarly Blog) At Grammarly, we’re committed to the security of the individuals and businesses who use our product. Protecting your data is a responsibility we…
Offensive Security announces bounty program for user generated content (Help Net Security) Offensive Security announced a new bounty program for user generated content. Cash rewards to be offered for vulnerable machine submissions.
Technologies, Techniques, and Standards
ICT SCRM Task Force Year Two Report (CISA) This report provides an update on the ICT Supply Chain Risk Management (SCRM) Task Force’s progress in Year Two to advance meaningful partnerships and analysis around supply chain security and resilience. The report summarizes the work of the Task Force’s five working groups to address challenges to information sharing, threat analysis, qualified bidder and qualified manufacturer lists, vendor assurance, and impacts of the COVID-19 pandemic on ICT supply chains.
Cybersecurity Insights Blog: Year-In-Review 2020 (NIST) We can all agree that 2020 has been a year we won’t forget anytime soon.
How to protect your organization following the SolarWinds compromise (TechRepublic) Whether your organization uses the vulnerable SolarWinds software or you want to defend yourself against similar exploits, here are recommendations from four sources.
How the US military used a creepy island to test cyberattacks on the grid — in the middle of a pandemic (CyberScoop) The U.S. government officials trying to test the country’s ability to respond to a major cyberattack thought they had pulled out all the stops.
Port of Los Angeles Plans Cyber Intelligence Facility as Maritime Threats Grow (Wall Street Journal) The Port of Los Angeles is building a multimillion-dollar facility designed to share intelligence on cyber threats between the public and private sectors amid increasing attacks on the maritime and logistics industries.
NAB ramps up control of privileged system access (iTnews) To protect against security threats.
Setting 5G standards (Verizon) Learn how 5G standards are set. Verizon has an explanation of the 3GPP 5G standards and how they impact the overall future of 5G technology.
You Need a Security Operations Center – and You Can Afford It (CIO) Think that Security Operations Centers are just for bigger enterprises? Think again. SOCs are here to fit all business sizes.
Design and Innovation
Our plans to relaunch verification and what’s next (Twitter) Today we're sharing our new verification policy as well as what you can expect when we relaunch public applications for verification in 2021, and more details about our work in this space.
Facebook reverses postelection algorithm changes that boosted news from authoritative sources. (New York Times) Facebook confirmed that it has in the past few days rolled back a change that lifted news from authoritative outlets over hyperpartisan sources after November’s election, signaling a return to normalcy for the social network.
Research and Development
Bitglass Bags Second Patent for Cloud Access Control (Enterprise Security) Bitglass has bagged U.S. Patent No. 10,855,671 for another fundamental invention in transparent, contextual access control of cloud services.
Legislation, Policy, and Regulation
Russia’s massive hack demands a reckoning for U.S. cyber defenses (Washington Post) The disclosure from software vendor SolarWinds that “fewer than 18,000 customers” were compromised by a Russian hack announced this week was apparently meant to be reassuring — a sign of just how big and just how bad this attack is. Responsible officials must explain how it happened, as well as how they plan to prevent such a thing from happening again.
A moment of reckoning: the need for a strong and global cybersecurity response (Microsoft On the Issues) The recent spate of cyberattacks require the government and the tech sector in the United States to look with clear eyes at the growing threats we face. At Microsoft, we are committed to being at the forefront of these efforts.
Putin: Arms race with US ‘has already begun’ (Washington Examiner) An arms race between Washington and Moscow “has already begun,” according to Russian President Vladimir Putin.
India, EU reaffirm commitment to open, free, accessible cyberspace (Hindustan Times) According to an official release by Ministry of External Affairs (MEA), the Indian delegation was led by Dr S Janakiraman, Joint Secretary, Cyber Diplomacy Division, Ministry of External Affairs, while the EU delegation was led by Joanneke Balfoort, Director Security and Defence, EEAS.
Saudi Arabia in partnership deal with UN agency to empower children in cyberspace (Arab News) Saudi Arabia on Thursday signed a cybersecurity cooperation deal with a specialist UN telecoms agency to help strengthen child online safety. The strategic partnership agreement was inked between the Saudi National Cybersecurity Authority (NCA) and the UN’s International Telecommunication Union (ITU) to coincide with the launch of a global program to create a safe and prosperous cyberspace for children.
Competition With China Could Be Short and Sharp (Foreign Affairs) The Risk of War Is Greatest in the Next Decade
As China Tracked Muslims, Alibaba Showed Customers How They Could, Too (New York Times) The website for the tech titan’s cloud business described facial recognition software that could detect members of a minority group whose persecution has drawn international condemnation.
Huawei's 5G is a threat to Brazil’s national security (Asia News) Brazilians are looking at legal ways to ban the use of China’s high-speed Internet technology. According to the son of the Brazilian president, Beijing wants to carry out cyber espionage operati
Germany sets high barriers for Huawei with new security bill (Light Reading) After years of wrangling, ministers agree on a bill that will not ban specific vendors but will make it much harder for them to meet security standards.
Germany all but says “Nein!” to Huawei (Telecoms.com) New IT security law proposed by Angela Merkel’s cabinet gives the country’s security authority more power to exclude suppliers it deems posing threat to Germany’s critical information systems.
U.S. Blacklists China’s Top Chip Maker, Escalating Tech Fight (Wall Street Journal) The Trump administration is adding SMIC, China’s largest manufacturer of computing chips, to an export blacklist, restricting the company’s access to high-end technology over its alleged links it to the Chinese military.
SolarWinds breach raises stakes for NDAA Trump still threatens to veto (Federal News Network) The Cyberspace Solarium Commission’s leadership said the SolarWinds breach has further raised the stakes for the National Defense Authorization Act that President Donald Trump has threatened to veto.
Trump repeats his vow to veto the defense budget bill, but won’t say when (Military Times) The $740.5 defense authorization bill contains thousands of Pentagon reforms, pay re-authorizations and new program starts for 2021.
Biden and lawmakers raise alarms over cybersecurity breach amid Trump’s silence (Washington Post) Democrats and some Republicans raised the alarm Thursday about a massive and growing cybersecurity breach that many experts blame on Russia, with President-elect Joe Biden implicitly criticizing the Trump administration for allowing the hacking attack to occur.
Joe Biden warns he will be tough on state sponsors of cyberattacks, as U.S. suffers massive hack (CNBC) President-elect Joe Biden says the U.S. will join with allies to impose “substantial costs” on adversaries who engage in cyberattacks.
Biden Could Use Obama-Era Tools To Counter Sprawling Hack (Law360) President-elect Joe Biden, who vowed Thursday to respond to a cyber espionage campaign that has breached U.S. federal agencies and that officials say poses a "grave" risk to businesses, may dip into a deterrence toolbox developed under President Barack Obama, former government attorneys say.
With Trump silent, reprisals for hacks may fall to Biden (AP NEWS) All fingers are pointing to Russia as the source of the worst-ever hack of U.S. government agencies. But President Donald Trump, long wary of blaming Moscow for cyberattacks, has...
Trump Takes Bipartisan Criticism For Silence On Massive Cyber Attack (Forbes) Sen. Mitt Romney slammed ‘inexcusable silence and inaction from the White House’ and compared the hack to ‘Russion bombers.’
Gray Areas Cloud NY's New Publicity And Digital Privacy Laws (Law360) Two new laws in New York that extend a post-mortem right of publicity to celebrities and prohibit dissemination of digitally manipulated pornographic videos are rife with various exceptions, potential procedural obstacles, and gray areas ripe for debate and future litigation, say attorneys at Davis Wright.
Litigation, Investigation, and Law Enforcement
Letter to the Honorable Charles P. Rettig, Commissioner, Internal Revenue Service (United States Senate) Dear Commissioner Rettig, We write to express our deep concern about recent reports that several federal government agencies have been compromised by sophisticated hackers.
Letter to the Honorable John Ratcliffe, Director of National Intelligence, the Honorable Christopher Wray, Director, Federal Bureau of Investigation, and Mr. Chad Wolf, Department of Homeland Security (Congress of the United States) Dear Director Ratcliffe, Director Wray, and Mr. Wolf: Our Committees are seeking information related to the apparent, widespread compromise of multiple federal government, critical infrastructure, and private sector information technology networks. While investigations and technical forensic analyses are still ongoing, based on preliminary reporting, it is evident that this latest cyber intrusion could have potentially devasting consequences for U.S. national security.
A ‘coordinated police’ action against the Joker’s Stash took a small domain offline (CyberScoop) An ongoing law enforcement operation has disrupted aspects of a leading website where internet scammers frequently buy and sell stolen data, according to the site’s administrators and multiple sources with visibility into the site.
Joker's Stash .bazar Site Allegedly Seized (Digital Shadows) In a very recent event, the Blockchain domains of Joker's Stash allegedly displayed a notification that the US Department of Justice and Interpol seized the site.
Memo to Blinken: Protect the brains of State Department employees | Federal News Network (Federal News Network) As new leadership arrives at the State and Commerce Departments, and the intelligence community, let’s hope they give real attention to weird and disturbing threats to certain career employees.
Texas Accuses Google and Facebook of an Illegal Conspiracy (Wired) A new antitrust case against Google alleges that the two companies made a deal to reduce competition in online advertising.
Google’s Legal Peril Grows in Face of Third Antitrust Suit (New York Times) More than 30 states said that the company downplayed websites that let users search for information in specialized areas.
9th Circ. OKs Dismissal Of PayPal Investors' Data Breach Suit (Law360) The Ninth Circuit affirmed a lower court's dismissal Thursday of a proposed class action brought by PayPal investors alleging that the company concealed information and attempted to mislead shareholders concerning a 2017 data breach.
Ritz-Carlton Hit With Class Suit Over Chicago Finger Scans (Law360) The Ritz-Carlton Hotel Co. got hit Wednesday with a proposed class state court suit claiming the company's luxury hotel and residence in Chicago uses a finger scanner to track and share employees' work time in violation of their biometric privacy rights.
American Bank Systems Sued Over Ransomware Data Breach (Law360) An Oklahoma-based document-management company for banks failed to protect private information from a ransomware attack, leading to exposure of bank customers' information online, according to a proposed class action filed in Pennsylvania federal court Wednesday.
