An anonymous reader quotes a report from IEEE Spectrum, written by Stacey Higginbotham: The IoT Cybersecurity Improvement Act of 2020 has given the nation an excellent framework that will influence IoT security across the world. So, what's to like about the law? Two things, as it turns out. First, the law isn't focused on securing individual devices by dictating password requirements or encryption standards, both of which will need to evolve. Instead, it relies on the National Institute of Standards and Technology (NIST) to set many of the requirements that government agencies have to follow when purchasing connected devices. These policies see overall security as the sum of several parts, requiring specific prescriptions for device, cloud, and communication security.

NIST's initial rules include today's best practices, such as having an over-the-air device update program, unique IDs for each device so it can be identified on a network, and a way for authorized users to change features related to access and security. The recommendations also include logging the actions taken by an IoT device or its related app, and clearly communicating the specifics of a device's security to the user. The other reason to like the law is that it remains adaptive and flexible by requiring NIST to assess the best practices for cybersecurity for connected devices every five years. Hacks, by their nature, are also adaptive and flexible, and so preventing them needs equally adaptable legislation. That means buying IoT devices that can receive over-the-air software updates, for example, to patch up any newly discovered exploits."Unfortunately, the law isn't airtight," writes Higginbotham. She worries that the waiver process for devices needed for national security or research could be abused. There's also a loophole that exempts devices that are secured using "alternative and effective methods." The law doesn't clarify what agency evaluates the efficacy of these alternative methods or how that evaluation is made.

According to The Intercept, conspiracy theorists and far-right white supremacist groups are increasingly targeting cellphone towers and other critical infrastructure "to incite fear, disrupt essential services, and cause economic damage with the United States and abroad." The Hill summarizes the findings: In more than one case, they've succeeded in interrupting resources for law enforcement and emergency services personnel, according to the report [by the New York Police Department], which lists several recent cases. One involved a neo-Nazi chat group whose "members strongly supported exploiting civil unrest in the United States by attacking the country's infrastructure," The Intercept reported, while another was tied to the 5G conspiracy theory, which claims without evidence that the electromagnetic waves put out by 5G towers are harming peoples' immune systems and are responsible for the coronavirus pandemic.

The NYPD has not publicly commented on the report, which mentions attacks in other states as well, including a bombing in Nashville in December. The Intercept also obtained a document from the Department of Homeland Security that revealed three intelligence reports about vandals targeting cell towers in New York, West Virginia and Tennessee on the day of and before the insurrection on the United States Capitol in January.

An anonymous reader quotes a report from Reuters: An engineer working for Elon Musk's SpaceX pleaded guilty on Thursday to conspiracy to commit securities fraud by selling insider tips on the "dark web," the U.S. Department of Justice and Securities and Exchange Commission (SEC) said on Thursday. The case was the first in which the SEC has brought an enforcement action alleging securities violations on the dark web, it said. James Roland Jones of Redondo Beach, California, faces a maximum penalty of five years in federal prison, the Department of Justice said. A sentencing date has not yet been set.

According to the agencies, from 2016 until at least 2017, Jones conspired with another unnamed person to access various dark web marketplaces, including a website claiming to be an insider trading forum, in search of material, non-public information to use for his own securities trading. Jones also devised a scheme to sell what he falsely claimed were insider tips on the dark web, the agencies said. Several users paying in bitcoin purchased these tips and ultimately traded based on the information Jones provided, they said.

An anonymous reader quotes a report from Motherboard: A surveillance contractor that has previously sold services to the U.S. military is advertising a product that it says can locate the real-time locations of specific cars in nearly any country on Earth. It says it does this by using data collected and sent by the cars and their components themselves, according to a document obtained by Motherboard. "Ulysses can provide our clients with the ability to remotely geolocate vehicles in nearly every country except for North Korea and Cuba on a near real time basis," the document, written by contractor The Ulysses Group, reads. "Currently, we can access over 15 billion vehicle locations around the world every month," the document adds.

Although the company told Motherboard it has not sold the product to the U.S. government at this time, the news highlights the scale and reach of car-tracking technology, and the fact that car location data is of interest not just to insurance companies and the finance sector, but to government contractors who explicitly say they want to source the data for intelligence and surveillance purposes. [...] Included in the document is a map showing apparent vehicle locations spread across Russia, Ukraine, and Turkey, including along the border with Syria. A section of text next to the map says Ulysses' data access lets clients analyze targets "whether you want to geo-locate one vehicle or 25,000,000 as shown here." An image on the company's LinkedIn page appears to show data related to Bulgaria. [...] The document does not explain exactly how Ulysses sources its data, be that directly from automakers or OEMs, or via an aggregator company. But there are plenty of companies that could be contributing. Andrew Lewis, president of The Ulysses Group, told Motherboard in an email that "any proprietary promotional material we may have produced is aspirational and developed based on publicly available information about modern telematics equipment." Lewis added: "We do not have any contracts with the government or any of its agencies related to our work in the field and we have never received any funding whatsoever from the government related to telematics."

Mobile app developer Kosta Eleftheriou, who publicly called out Apple earlier this year for negligence with regard to policing iOS scams and copycat apps on the App Store, has filed a lawsuit against the iPhone maker in California. From a report: He's accusing the company of exploiting its monopoly power over iOS apps "to make billions of dollars in profits at the expense of small application developers and consumers." Eleftheriou's company KPAW LLC, which he co-owns with his partner Ashley Eleftheriou, filed its complaint in Santa Clara County on Wednesday. It details the development and release timeline of Eleftheriou's Apple Watch keyboard app FlickType. At the time he began accusing Apple of abetting App Store scams early last month, Eleftheriou revealed that his FlickType app had been targeted by competing software he says either didn't work well or didn't work at all, and yet nonetheless chipped away at this sales and App Store rankings through false advertising and the purchase of fake reviews. After he complained, he said Apple did not do enough to combat the scams, though Apple did later remove some of the apps he called attention to.

The FCC has slapped two Texas-based telemarketers for $225 million after making approximately 1 billion robocalls to people across the U.S. It marks the largest fine in its history. Engadget reports: They ran at least two businesses that illegally spoofed other companies to try and sell people on short-term insurance plans, claiming they were from well-known providers like Cigna. One of the people involved in the scheme admitted to making "millions" of robocalls per day, even going so far as to go out of his way to call numbers on the Do Not Call list because he believed it would be more profitable to do so. According to the FCC, "a large portion" of the more than 23.6 million health insurance robocalls that crossed US wireless networks in 2018 came from Rising Eagle, one of the companies the two telemarketers ran.

AmiMoJo shares a report from The Verge: State antitrust watchdogs are targeting Google's plans to phase out third-party tracking cookies, building on a major lawsuit filed last year. The group of 15 attorneys general, led by Texas, updated its complaint about Google yesterday to include a more detailed case against the search giant, including new claims about Google's strategic use of the Chrome browser. In particular, the new complaint takes aim at recent privacy updates to Chrome, which could better protect users' personal data while also entrenching Google's market position.

Like the original Texas complaint, Tuesday's updated filing primarily focuses on Google's technology for targeting ads across the web. The attorneys general argue that Google used its power in search, streaming video, and other markets to stamp out independent advertising platforms, forcing small businesses and media outlets to use its system. But in the updated complaint, the states apply this argument to Google's 'Privacy Sandbox' -- a tool that's supposed to replace invasive third-party tracking cookies with a more limited system devised by Google. "Google's new scheme is, in essence, to wall off the entire portion of the internet that consumers access through Google's Chrome browser," the complaint reads. "Google is trying to hide its true intentions behind a pretext of privacy," the suit continues. With Privacy Sandbox, "Google does not actually put a stop to user profiling or targeted advertising -- it puts Google's Chrome browser at the center of tracking and targeting."

In response, Google said the new allegations rested on a misunderstanding of Chrome's privacy features. "Attorney General Paxton's latest claims mischaracterize many aspects of our business, including the steps we are taking with the Privacy Sandbox initiative to protect people's privacy as they browse the web. These efforts have been welcomed by privacy advocates, advertisers and our own rivals as a step forward in preserving user privacy and protecting free content. We will strongly defend ourselves from AG Paxton's baseless claims in court."

The U.S. Federal Communications Commission moved toward barring China Unicom (Hong Kong) and ComNet from the U.S., calling the Chinese telecommunications carriers a security risk controlled by the Beijing government. From a report: The action against two of China's three major telecommunications operators was decided by a 4-0 vote by agency. It continues a security crackdown that earlier touched Chinese gear makers Huawei Technologies and ZTE. In 2019, the FCC barred China Mobile Ltd. from the U.S. market over national security concerns. ComNet, a subsidiary of Pacific Networks, and the unit formally known as China Unicom (Americas) Operations Ltd. were told in April by the FCC to show they are independent from the Chinese government, or face a proceeding that could result in ejection from the U.S. market. With its vote Wednesday the FCC began those proceedings. China Unicom and Pacific Networks are indirectly and ultimately owned and controlled by the government of the People's Republic of China, the FCC said in news releases Wednesday. The companies may present evidence in proceedings set in motion, according to the news releases.

At a press conference today, the Japanese government said it was investigating the parent company behind the Line instant messaging app after a local newspaper reported that engineers at one of the app's Chinese contractors accessed the messages and personal details of Line users. From a report: According to Japanese newspaper The Asahi Shimbun, four Chinese engineers accessed Line's infrastructure and viewed messages and personal information of Line users, such as names, phone numbers, email addresses, and Line IDs. The four engineers worked for a yet-to-be-named Shanghai-based software firm that the LINE Corporation had subcontracted to develop artificial intelligence-based services for the Line application. The four engineers are said to have accessed Line user data on 32 different occasions since August 2018. Most of Line's 86 million userbase is made up of Japanese users, and the Asian country has very strict data and privacy protection regulations.

Teenage Twitter hacker Graham Ivan Clark has pleaded guilty to last summer's unprecedented bitcoin scam attack that involved the takeover of dozens of high-profile accounts on the social network, according to paperwork filed in Florida court on Tuesday. Clark, who was 17 when accused of leading the scam, will spend three years in prison as part of his plea deal. The Tampa Bay Times reported the news on Tuesday. From a report: Clark has already been credited with 229 days of time served since his arrest last summer. As part of the deal, Clark is also being sentenced as a "youthful offender," which lessened his prison time and also opens up the possibility that he can serve some of his sentence at a boot camp, according to the Tampa Bay Times. Clark will also be banned from using computers without permission and without supervision from law enforcement.

Conservative lawmakers in Utah have a passed a proposal this month requiring all cellphones and tablets sold in the state to automatically block pornography. It's unknown whether Gov. Spencer Cox, a Republican, will sign or veto the proposal. He has until March 25 to decide. The Associated Press reports: Supporters argue the restriction is a critical step to help parents keep explicit content away from kids -- especially as more children have their own electronic devices and have been forced to spend more time online during the pandemic. Combating porn is a perennial issue for Utah lawmakers who have previously mandated warning labels on print and online pornography and declared porn a "public health crisis."

Utah's generally conservative culture means racy mainstream magazines and lingerie catalogs can be considered risque. Leaders of the predominant Church of Jesus Christ of Latter-day Saints faith have also drawn attention to what they consider the harms of pornography. Even if Cox signs the measure, it wouldn't go into effect unless five other states also enacted similar laws, a provision added after manufacturers and retailers voiced concerns that it would be difficult to implement the filters for a single state. If Cox signs the bill, Utah appears poised to become the first state to mandate filters on devices, according to two prominent technology experts and the bill's sponsor, though federal internet restrictions aimed at preventing kids from accessing porn were passed in the late 1990s and later stuck down in the courts.

An anonymous reader shares a report: Over the course of the last several weeks, Google has been adding App Privacy labels to its iOS apps in accordance with Apple's App Store rules, but it took Google multiple months to begin sharing the information. There was speculation that Google's delay meant that it had something to hide, which DuckDuckGo is leaning into with a blog that highlights Google's data collection and calls out the company for "spying" on users. [...] DuckDuckGo claims that Google "wanted to hide" the information that it collects, which is why Google took so long to roll out support for App Privacy labels. Most people are likely not surprised at the extent of the data that Google collects, but having it in one spot in the âOEApp StoreâOE is a stark reminder.

"Adobe doesn't want third-parties to pirate its software, so the company regularly sends out DMCA notices to remove infringing copies," reports TorrentFreak. In a recent tweet, F-Secure researcher Mikko Hypponen mentioned that the software company removed one of his tweets that linked to an old copy of Acrobat Reader for MS-DOS, which came out more than 27-years ago, shortly after the PDF was invented. From the report: The security researcher posted the tweet five years ago and at the time there were no issues. The message was copied a few weeks ago by his own Twitter bot, which reposts all his original tweets five years later. "They sent a DMCA notice to my bot (@mikko__2016) when it posted that tweet on the tweet's 5th anniversary. The original tweet is fine," Hypponen notes. While the original tweet is still up, the reposted message was swiftly removed by Twitter. Not just that, the bot's account was locked as well, which is standard practice nowadays.

Looking more closely at the takedown notice, we see that it was sent by the "brand protection analyst" at Incopro, which is one of Adobe's anti-piracy partners. It doesn't provide any further details on the reasons for taking it down, other than an alleged copyright infringement. Things get even more curious when we look at the full DMCA notice, posted by the Lumen database. This shows that the tweet was listed among other links, which all point to "infringing' copies of more recent software. Intriguingly, the notice also reveals that Hypponen's original tweet was targeted as well, albeit indirectly. The takedown notice lists t.co/tbAT0CH25o, which still points to the 2016 tweet today, so Twitter decided not to take action there.

We wonder if the DMCA notice is intentional at all. Over the years we have seen many bizarre takedown claims, which are often the result of automated filters. That may be a plausible explanation here as well. In that case, it shows that DMCA takedown process is far from perfect. However, if Adobe seriously has a problem with the fact that a 27-year-old copy of Acrobat Reader is being shared on an external site, it's more effective to target the site where it's hosted. Not the person who links to it in a tweet.

A lapsed domain registration tied to WeLeakInfo, a wildly popular service that sold access to more than 12 billion usernames and passwords from thousands of hacked websites, "let someone plunder and publish account data on 24,000 customers who paid to access the service with a credit card," reports Krebs on Security. This comes after the service was seized a little over a year ago by the FBI and law enforcement partners overseas. From the report: In a post on the database leaking forum Raidforums, a regular contributor using the handle "pompompurin" said he stole the WeLeakInfo payment logs and other data after noticing the domain wli[.]design was no longer listed as registered. "Long story short: FBI let one of weleakinfo's domains expire that they used for the emails/payments," pompompurin wrote. "I registered that domain, & was able to [password] reset the stripe.com account & get all the Data. [It's] only from people that used stripe.com to checkout. If you used paypal or [bitcoin] ur all good."

Cyber threat intelligence firm Flashpoint obtained a copy of the data leaked by pompompurin, and said it includes partial credit card data, email addresses, full names, IP addresses, browser user agent string data, physical addresses, phone numbers, and amount paid. One forum member commented that they found their own payment data in the logs.

An anonymous reader quotes a report from Motherboard, written by Joseph Cox: I didn't expect it to be that quick. While I was on a Google Hangouts call with a colleague, the hacker sent me screenshots of my Bumble and Postmates accounts, which he had broken into. Then he showed he had received texts that were meant for me that he had intercepted. Later he took over my WhatsApp account, too, and texted a friend pretending to be me. Looking down at my phone, there was no sign it had been hacked. I still had reception; the phone said I was still connected to the T-Mobile network. Nothing was unusual there. But the hacker had swiftly, stealthily, and largely effortlessly redirected my text messages to themselves. And all for just $16.

I hadn't been SIM swapped, where hackers trick or bribe telecom employees to port a target's phone number to their own SIM card. Instead, the hacker used a service by a company called Sakari, which helps businesses do SMS marketing and mass messaging, to reroute my messages to him. This overlooked attack vector shows not only how unregulated commercial SMS tools are but also how there are gaping holes in our telecommunications infrastructure, with a hacker sometimes just having to pinky swear they have the consent of the target. "I used a prepaid card to buy their $16 per month plan and then after that was done it let me steal numbers just by filling out LOA info with fake info," said Lucky225, the pseudonymous hacker who carried out the attack, referring to a Letter of Authorization, a document saying that the signer has authority to switch telephone numbers.

In a statement to Motherboard, Senator Ron Wyden said: "It's not hard to see the enormous threat to safety and security this kind of attack poses. The FCC must use its authority to force phone companies to secure their networks from hackers. Former Chairman Pai's approach of industry self-regulation clearly failed."

America is contemplating how to respond to breaches "pulled off by Russia and China against a broad array of government and industrial targets," reports the New York Times: Both hacks exploited the same gaping vulnerability in the existing system: They were launched from inside the United States — on servers run by Amazon, GoDaddy and smaller domestic providers — putting them out of reach of the early warning system run by the National Security Agency. The agency, like the C.I.A. and other American intelligence agencies, is prohibited by law from conducting surveillance inside the United States, to protect the privacy of American citizens. But the F.B.I. and Department of Homeland Security — the two agencies that can legally operate inside the United States — were also blind to what happened, raising additional concerns about the nation's capacity to defend itself from both rival governments and nonstate attackers like criminal and terrorist groups. In the end, the hacks were detected long after they had begun not by any government agency but by private computer security firms...

Biden administration officials said they would seek a deeper partnership with the private sector, tapping the knowledge of emerging hacking threats gathered by technology companies and cybersecurity firms. The hope, current and former officials say, is to set up a real-time threat sharing arrangement, whereby private companies would send threat data to a central repository where the government could pair it with intelligence from the National Security Agency, the C.I.A. and other spy shops, to provide a far earlier warning than is possible today.
A U.S. representative who co-chairs a cyberspace commission colorfully characterized both breaches to the TImes. "When not one but two cyberhacks have gone undetected by the federal government in such a short period of time, it's hard to say that we don't have a problem. The system is blinking red."

But then there's this: Last month, in the days before Microsoft released an emergency patch for vulnerable Exchange Servers, multiple state-backed Chinese groups were apparently tipped off that the company was testing a patch. They began gorging on vulnerable systems with a speed and aggression that some security experts said they had never seen before.

It is unclear how exactly these Chinese groups learned of Microsoft's patch, but the timing suggests they caught wind of the moves when Microsoft rolled out a test version of its patch to its security partners at cybersecurity firms in late February. Eighty companies participate in a longstanding partnership with Microsoft, known as the Microsoft Active Protections Program, including 10 Chinese firms. Microsoft confidentially alerts these companies to emerging cyberthreats and vulnerabilities ahead of its official patch cycle. The company is investigating whether one of its partners may have leaked to Chinese hackers or was itself hacked.

"Google failed to win dismissal of a lawsuit alleging it collects users' data on internet activity even when they browse in a browser's private incognito mode," reports CNET: The lawsuit, filed in June, alleges Google violates wiretapping and privacy laws by continuing to "intercept, track, and collect communications" even when people use Chrome's incognito mode and other private web browser modes. A federal judge on Friday denied the tech giant's request for dismissal of the lawsuit, which seeks class action status. "The court concludes that Google did not notify users that Google engages in the alleged data collection while the user is in private browsing mode," US District Judge Lucy Koh in San Jose, California, wrote in her ruling...

The lawsuit, which seeks at least $5 billion from Google and its parent company, Alphabet, alleges the company surreptitiously collects data through Google Analytics, Google Ad Manager, website plug-ins and other applications, including mobile apps.
Google "cannot continue to engage in the covert and unauthorized data collection from virtually every American with a computer or phone," the complaint said.

Reuters reported in June that the proposed class action likely includes "millions" of Chrome users who had tried browsing the internet in a private mode — and seeks $5,000 damages per user "or three times actual damages, whichever is greater, for violations of federal wiretapping and California privacy laws."

"A federal judge in Washington blocked the Defense Department from restricting U.S. investment in the Chinese smartphone manufacturer Xiaomi Corp," reports Bloomberg: In the final days of the Trump administration, the Defense Department placed Xiaomi on a list of companies with alleged links to the Chinese military, triggering financial restrictions that were scheduled to go into effect next week. But on Friday, U.S. District Judge Rudolph Contreras put a temporary halt to the ban, siding with Xiaomi in a lawsuit that argued that the move was "arbitrary and capricious" and deprived the company of its due process rights. Contreras said Xiaomi was likely to win a full reversal of the ban as the litigation unfolds and issued an initial injunction to prevent the company from suffering "irreparable harm." After the ban was announced, the smartphone manufacturer faced the prospect of being de-listed from U.S. exchanges and deleted from global benchmark indexes.

Xiaomi is the third-largest smartphone manufacturer in the world by volume. In the third quarter, it surpassed Apple Inc. in smartphone sales, according to the International Data Corporation.

"The Spanish government on Thursday announced legislation that classifies food delivery riders as employees of the digital platforms they work for, not self-employed," reports the Associated Press: The Minister for Labor, Yolanda Díaz, said the new law is "pioneering" and is part of "a modernization of the labor market" in Spain, updating regulations in accordance with technological developments to ensure workers' rights are upheld...

The legal changes are the latest affecting companies and workers in the gig economy. Last month, Britain's top court ruled that Uber drivers should be classed as "workers" and not self-employed, in what was seen as a major setback for the ride-hailing giant. The Spanish government agreed on the new law with the country's main business groups and trade union confederations.

But the law, which is expected to come into force within months, was quickly contested by an association of digital platforms providing food delivery services and by some riders who prefer the flexibility of being self-employed.
The Association of Service Platforms calls the rule "an assault on the most basic principles of the freedom to do business..."

Today much of the world honors an annual tradition: setting their clocks backwards by one hour. "I hope you enjoy it," writes Boston Globe Jeff Jacoby.

In an essay titled "Heed the science and abolish daylight saving time," Jacoby writes "I also hope this is the last year we have to go through this business of shifting our clocks ahead, and that by this time next year we'll be back on standard time for good." I am not a fan of daylight saving time, and if the polls are accurate, neither are most Americans. According to a 2019 survey by the Associated Press and the National Opinion Research Center, 71 percent of the public wants to put an end to the twice-yearly practice of changing clocks... Most of the rest of the world doesn't want it either. In Asia, Africa, and South America, it's virtually nonexistent. Most of Australia and many of the nations of the South Pacific eschew it, as do Russia and most of the former Soviet republics. The European Parliament voted by a large margin to end daylight saving time across the European Union, though whether to implement that change is left up to each EU member state...

The point of "saving" daylight was to save fuel: Congress believed that by shifting the clock so daylight extended later into the evening, the law would reduce demand for electricity and thereby conserve oil. But researchers attempting to measure the effects of clock-changing on energy savings have found them pretty elusive... But daylight saving time doesn't just fail to deliver the single most important benefit expected of it. It also generates a slew of harms. In the days following the onset of daylight time each March, there is a measurable increase in suicides, atrial fibrillation, strokes, and heart attacks. Workplace injuries climb. So do fatal car crashes and emergency room visits. There is even evidence that judges hand down harsher sentences. All of which helps explain the growing chorus of scientists calling for an end to daylight saving time. The public-health problems stem not just from the loss of an hour of sleep once a year but from the ongoing disruption to the human circadian clock...

We should no longer be thinking about "springing forward" and "falling back" in terms of personal preference or convenience but should be focusing instead on the proven degradation to human well-being. Scientists now understand vastly more about the workings and importance of circadian rhythm than they did when clock-shifting was instituted decades ago. There is a growing medical consensus that what we've been doing with our clocks each spring is unhealthy.

It's time to stop doing it.