IEEE Cipher --- Items from security-related news (E150)
Summary:
Last year the US military organization Cyber Command was
given new authorities through National Security Presidential Memoranda
13. That document is said to allow the Command more leeway on
conducting offensive cyber ops without presidential approval.
Recently, unnamed US officials said that the US planted computer code
in Russian power grid computers. The implication seems to be that the
US is establishing its ability to control those systems.
"It has gotten far, far more aggressive over the past years," said one
official, speaking of offensive capabilities.
Summary:
Following the New York Times story about US offsensive cyber
operations against Russia's power grid, Trump used Twitter to object
to the story, tweeting that the accusations were "not true", calling the media "corrupt" and journalists "the enemy of the people".
Nonetheless, the story apparently had the approval of the National Security Council. The release of the information may be intended as a warning to Moscow.
Summary:
US Congressional members have become concerned about the secrecy
surrounding US moves into offensive cyber operations.
Rep. Jim Langevin (D-R.I.) is concerned about the stability
of cyberspace, and is seeking to compel the administration to
release Presidential Memorandum 13 which addresses the operations.
"This is my first time in 19 years of Congress that a document this major has not been provided to Congress. I can't understand what the hold up is," Langevin said.
Summary:
These two article describe a flaw that existed in a popular, easy-to-use videoconferencing app.
The videoconferencing app Zoom opened a major security flaw when
installed on Apple MACs, one that was disturbingly difficult to
avoid until the Zoom developers took it seriously and pushed
an update to all users.
The Zoom app is characterized by one-click meeting join, and this feature requires a server process to be running all the time. The server could be forced to join a conference without any user intervention. More disturbingly, unless the user had thought to disable the "start with video on" option, the user's camera would start broadcasting to the conference, all without the user's direct intervention. As yet another security shock, even uninstalling the app would not get rid of the server, and other machines on the same local network could force the machine to reinstall the app.
Seeking to preserve the app's ease of use, the developers at first sought to inform users about changing their default video setting, but finally changed the server so that there is always a prompt requiring user confirmation before joining a conference. It also allows the server to be deleted from the system when uninstalling the app.
Summary:
The FTC will fine Facebook about 25% of its current yearly
profit for improperly disclosing user data to third parties such as
Cambridge Analytica. This caused Facebook share to rise, presumably
because the company had already planned for the payment, and its
yearly income continues to increase.
Although the company will have to work harder to assure the government that it stays within boundaries on privacy laws, there are no new restrictions on sharing data with third paries.
Summary:
Equifax is apparently going to face a fine of $700 million
for disclosing personal data of 150 million US customers (about half
the country's population). Despite the outrage about this two years
ago, Congress has failed to end act any new legislation protecting
user privacy.
See the FTC consumer information page for their plans to create a site for filing consumer claims to be paid from this settlement.
Summary:
Hal Martin worked for NSA. Being a hard worker, maybe even an obsessive
worker, he took his work home with him. NSA employees aren't supposed
to do that, but Mr. Martin loved his work. A little data here, a
thumb drive there, pretty soon he was holding onto a
boatload of bytes. Apparently his hoard was never divulged, stolen,
or hacked. Still, it was a crime for which he will serve time
in prison. Time already served will count.