The CyberWire Pro Privacy Briefing for 12.13.19

Summary

By the CyberWire staff

Exploits obtaining access to Amazon's Ring camera have been in the news this week, and they seemed oddly pointless, at least as executed. Waking people in the middle of the night, frightening children, and so forth...these all seemed to be the sort of capers that were done out of motiveless malice. It's developed that in fact that's pretty close to the case. Many of the most repellent hacks were featured on the NulledCast podcast, livestreamed on Discord. Vice reports that NulledCast, once the mainstream media began to cover their antics, caught a sudden case of adult responsibility. "Nulled does not and will not tolerate the harassments [sic] of individuals over Ring cameras or similar." There's some evidence that they also hear the footsteps of law enforcement. Clickbait and the lulz: that's leetspeak for motiveless malice.

It's a sadly familiar story. As WIRED observes, new technologies attract creeps, and the IoT is drawing them like flies.

Apple's iOS 13.3 appeared this week with a new feature, "Communication Limits," that permits parents to place limits on the people with whom their children can communicate. By design minors working under parental Communication Limits should only be able to communicate with people in their contact list (presumably monitored and controlled by their parents). But the feature doesn't work as intended: a bug in the version, according to CNBC, enables children to communicate with anyone who contacts them. Apple is believed to be working on a fix.

If you've been waiting for the pro-encryption elephants to weigh in during the Crypto Wars current skirmishes, wait no longer. TechDirt reports that Representative Ro Khanna (Democrat of California, representing the 17th District which includes most of Silicon Valley) sent a letter to Senator Graham (Republican of South Carolina, who's running the Judiciary Committee's hearing on encryption) advocating strong encryption. Representative Khanna attached a letter from Pentagon CIO Dana Deasy that stressed the importance and value of strong, end-to-end encryption. Deasy noted that the Defense Department requires such encryption in all the mobile devices its employees use for official business. He's talking here about such devices as smartphones, not exotic "military-grade" gear. Thus the order of battle in the Crypto Wars is the long familiar one: on the anti-encryption side are law enforcement agencies; on the pro-encryption side are military organizations and the tech sector.

Selected Reading

Cybersecurity: This password-stealing hacking campaign is targeting governments around the world (ZDNet) Researchers uncover a phishing campaign attempting to steal login credentials from government departments across North America, Europe and Asia - and nobody knows who is behind it

Over 100 Fake Sites Spotted in Government Phishing Campaign (Infosecurity Magazine) Over 100 Fake Sites Spotted in Government Phishing Campaign. Anomali claims phishers are targeting contractors and suppliers

Anomali Threat Research Team Identifies Widespread Credential Theft Campaign Aimed at U.S. and International Government Agency Procurement Services (Anomali) Hidden Adversary Ran Short Term Campaign

Mystery Russian Telegram Hacks Intercept Secret Codes To Spy On Messages (Forbes) More than a dozen Telegram accounts of Russian entrepreneurs have been hacked, but there's something even more sinister than run-of-the-mill snooping going on, according to researchers.

Michigan family says hacker was talking to them through security system in their home (WWMT) Some people put security cameras outside and inside their homes to protect themselves, but if you're not careful, tech experts said those cameras can actually give hackers an inside look. Multiple families across the country including one in Freeland, Michigan, have reported their security cameras inside their home were hacked. These families said the hackers are speaking to them through the security cameras. Some people put security cameras outside and inside their homes to protect themselves.

Inside the Podcast that Hacks Ring Camera Owners Live on Air (Vice) In the NulledCast hackers livestream the harassment of Ring camera owners after accessing their devices. Hundreds of people can listen.

Why Ring Doorbells Perfectly Exemplify the IoT Security Crisis (Wired) A new wave of reports about the home surveillance cameras getting hijacked by creeps is painfully familiar.

Maze Ransomware Behind Pensacola Attack, Data Breach Looms (Threatpost) Maze exfiltrates data as well as locks down systems. Officials said they don't know yet whether any residents' personal information has been breached.

The dark side of biometric authentication: Hackers using malware to steal fingerprints & sensitive data (The Economic Times) Biometric data has eased the burden of remembering passwords, but is it truly safe?

Behind the One-Way Mirror: A Deep Dive Into the Technology of Corporate Surveillance (Electronic Frontier Foundation) It's time to shed light on the technical methods and business practices behind third-party tracking. For journalists, policy makers, and concerned consumers, this paper will demystify the fundamentals of third-party tracking, explain the scope of the problem, and suggest ways for users and legislation to fight back against the status quo.

The Defense Department Says It Needs the Encryption the FBI Wants to Break (Vice) A bipartisan coalition of lawmakers this week worked overtime to vilify encryption, oblivious to the fact that weakening encryption standards will put the public, and the internet, at risk.

Defense Department To Congress: 'No, Wait, Encryption Is Actually Good; Don't Break It' (Techdirt.) As Senate Judiciary Committee Chair Lindsey Graham has continued his latest quest to undermine encryption with a hearing whose sole purpose seemed to be to misleadingly argue that encryption represents a "risk to public safety." The Defense...

National Security Agency inspector general says some data not being deleted quickly enough (WGNO) The National Security Agency hasn't been deleting some of the material it collects as often as it should, according to an unclassified report summary from the agency's inspector general.