This week’s essential cybersecurity and privacy news for the cyber-aware and the cyber-concerned. Designed to educate, support, and advocate.
Stan’s Top of the News
The scope and extent of encryption continues to be a major political challenge for nations. On the one hand, we the people want secure messaging apps that we can reliably use to secretly communicate with each other. On the other hand, law enforcement wants the ability to conduct surveillance on terrorists, child predators, cybercriminals, and other threats to society. Give this surveillance ability to law enforcement and you open the door to its abuse by autocrats against their political enemies and others. Prevent law enforcement from conducting surveillance and you make it harder for law enforcement to identify and stop another 9/11. As with most complex problems, there are no simple solutions. But wherever the solution lies, it must start with an understanding of the technology, both its capabilities and its limitations.
- Signal’s Meredith Whittaker: Breaking encryption while preserving privacy is ‘magical thinking’: The Signal president spoke with CyberScoop about AI, encryption and the growing threat to privacy. … With tens of millions of users around the globe, Signal is one of the leading messaging apps offering encryption to protect messages from snoops. As a result, it’s also become a target of lawmakers seeking to undermine the technology. … Tasked with overseeing a staff of a little over 40 at the small nonprofit that keeps the app running, Signal President Meredith Whittaker is the company’s voice when it comes to fighting against policies that threaten users’ privacy. And lately, there’s been no shortage of risks. Recently, Signal joined critics including Meta to call for changes to the U.K. Online Safety Bill, which is expected to soon reach a final vote. The bill would introduce client-side scanning, a technology that scans people’s private communications on their devices to match against a database of content considered objectionable. … A prominent artificial intelligence researcher who formerly worked at Google before helping co-found the AI Now research institute, Whittaker is also a leading voice in warning about the technology’s potential harms to civil liberties. CyberScoop spoke with Whittaker about global threats to encryption and how AI may be fueling “magical thinking” about how governments are trying to evade encrypted technologies.
New. Family Protection Newsletter: Did you know we created the Family Protection Newsletter, for non-cyber experts? For your parents, friends, those who need to protect themselves in a digital world. We feature info on how to freeze your credit and what ‘marriage scams’ are in Edition 1. Sign up or share with a friend! Click here to learn more and quickly add to your free subscription!
How Hackable Are You? Take our test. Find out how hackable you are and download our free 8-step guide.
- How Hackable Are You? Think your defenses are strong. Find out as SecureTheVillage tests you on five basics. Please take our short quiz as your answers will help you and guide us to improve community safety.
Upcoming events. Please join us.
- Los Angeles Cybersecurity Workforce Coalition: The monthly meeting of the workforce coalition, Tue, July 11, 1:00 pm – 2:00 pm PT. There is no meeting in June
Cyber Humor
Cybersecurity Nonprofit of the Week … Sightline Security
Our kudos this week to Sightline Security, a nonprofit that helps nonprofits secure and protect their critical information. Sightline’s mission is to equip, empower, and support nonprofits to navigate and embed cybersecurity into their organizations with confidence. Kudos to Sightline Security for their cyber support to the vital under-served nonprofit community. Like SecureTheVillage, Sightline Security is a fellow-member of Nonprofit Cyber. SecureTheVillage is proud to have Sightline Security founder and President Kelley Misata on our Board.
Live on Cyber with Dr. Stan Stahl – Live on LinkedIn and Your Favorite Podcast Platform
Shameful: (Video) (Podcast): Suffering the loss of personal information from a cyber breach is bad. It’s even worse when your information was stolen because someone had installed surveillance software on your phone, software that hid itself from you so you didn’t even know it was there. … As we described in last week’s Top of the News, that’s what happened to the innocent victims of a widely used phone surveillance app called LetMeSpy where a hacker stole victims’ messages, call logs and locations. LetMeSpy is specifically designed to stay hidden on a phone’s home screen, making it difficult to detect and remove. Shameful. … As always, Stan and Julie provide actionable tips and wisdom in a thoughtful conversation on the complexities of cybersecurity and privacy.
Section 2 – Let’s Be Careful Out There. And Let’s Help Others Who Aren’t Yet Cyber-Aware.
We must continue to warn people about dangers in cyberspace. We must teach “Don’t trust.”
- Wichita woman homeless after falling prey to IRS scam: A Wichita woman says she is now homeless after falling prey to scammers claiming to be from the Internal Revenue Service. … For 70-year-old Susan Ballinger, the last year and a half has been rife with personal struggles. In addition to having back surgery, her husband of 54 years passed away in January 2022. … Ballinger says that in April, she received a Facebook message from a family member claiming there was a way to receive money supposedly owed to her by the IRS. She then connected to someone she thought was an IRS agent via Facebook Messenger, a decision she says resulted in her losing everything. … “That was my rent money, my car payment money,” Ballinger said. “So, I got evicted. Never, ever been evicted.”
- Online romance scams are netting millions of dollars — and pushing some to self-harm: Scams that once bilked victims out of hundreds or even thousands of dollars are increasingly persuading them to move their investment and retirement accounts into phony investment schemes.
Section 3 – Cybersecurity News for the Cyber-Concerned.
People continue being harmed as cybercriminals release private information. State laws are tightening but can’t keep up with the extent of cybercrime. Federal privacy laws are at best in our distant future. Our businesses, schools, nonprofits, and others need help if they are to do a better job.
- Ransomware criminals are dumping kids’ private files online after school hacks: Ransomware gangs have been stealing confidential documents from schools and dumping them online. … The confidential documents stolen from schools and dumped online by ransomware gangs are raw, intimate and graphic. They describe student sexual assaults, psychiatric hospitalizations, abusive parents, truancy — even suicide attempts.
- New laws highlight state-level momentum for digital privacy rules: California’s new data protection agency is now fully operable, while Colorado and Connecticut are giving consumers more power over their data under laws that took effect recently. … The three states’ actions follow a slew of other state data privacy laws that have gone on the books lately. … States have been forced to take the lead on data privacy protection legislation in the absence of movement by Congress. The House Energy and Commerce Committee is now crafting a new version of its American Data and Privacy Protection Act (ADPPA) after last year’s version failed to advance to the House or Senate floor. … Industry has condemned the patchwork of state laws for creating costly compliance burdens and general confusion.
- Email Cyberattacks Spiked Nearly 500% in First Half of 2023, Acronis Reports: Cybercriminals are experimenting with the new generation of AI to optimize their attacks, which Acronis calls “no surprise.” … Malware only lasts a couple of days in the wild as cyberattackers use automation to create new and customized malicious code at “blazing speed,” and bypassing traditional signature-based detection, Acronis says in its newly released Mid-Year Cyberthreats Report 2023.
This week in cybercrime. Continued fallout from the MOVEit breaches. Ripple effects from a breach of Japan’s Port of Nagoya cause Toyota to shut down a packaging line. Dole & Pepsi shed light on recent breaches. And anti-anti-LGBTQ group SiegedSec continues its cyberattacks against states banning gender affirming care.
- MOVEit vulnerability snags almost 200 victims, more expected: The education sector has been hit particularly hard as many widely used vendors in the space confirm impacts linked to the mass exploited vulnerability…. The widely exploited vulnerability in Progress Software’s MOVEit file transfer service has impacted nearly 200 organizations, according to Brett Callow, threat analyst at Emsisoft.
- Pro-Russian hackers target Japan’s top port handling Toyota trade: A hacker group based in Russia has attacked the Port of Nagoya, Japan’s largest port by total cargo throughput and responsible for handling some of Toyota Motor Corp.’s exports and imports, the operator of the port’s computer system said Wednesday.
- Toyota to suspend packaging line after cyberattack on Japan port: Toyota Motor plans to suspend operations at a packaging line for export-bound components on Friday, the automaker said on Thursday, after a cyberattack at Japan’s biggest port triggered a system glitch and stalled work for more than two days.
- Dole, Pepsi bottler issue more info on recent cyberattacks: Multinational food processing giant Dole and the main U.S. bottler for Pepsi both revealed more information about separate cybersecurity incidents that affected both companies earlier this year.
- Hacking crew targeting states over transition bans claims cyberattack hitting global satellite systems: A group that previously hacked Fort Worth, Texas, claimed a cyberattack that affected Halliburton, Shell, Helix Energy and Oceaneering. … A hacking crew with a history of blending politics and criminal activities claimed on Saturday to have “targeted various satellite receivers and industrial control systems around the country, particularly in states banning gender affirming care.”
Meanwhile, cryptocurrency continues to bleed.
- Poly Network Hacked for $10M: A hacker pocketed more than $10 million worth of ETH in a Sunday attack on cross-chain bridge Poly Network, security company Beosin said. … The unknown hacker minted crypto tokens from 57 blockchains, putting more than $34 billion in the hacker’s wallet – but the lack of liquidity on the affected chains meant that the theft did not translate into actual gains for the attacker. The hacker was able to pocket a relatively smaller portion of the artificially minted tokens, totaling $10.1 million, Beosin said. … Poly Network, which was the subject of a $611 million hack in 2021, said it has suspended services after the latest incident and is working with law enforcement and centralized exchanges to identify the criminal and recover the stolen funds.
- $656,000,000 in Crypto Lost in Hacks, Scams and Rug Pulls In First Half of 2023: A new report from blockchain security firm Beosin reveals that the crypto market recorded losses of over half a trillion dollars in the first half of the year from hacks and other illicit schemes. … Newly released security data from the company shows that the web3 space sustained $655.61 million worth of losses from hacks, phishing scams and rug pulls in the first six months of 2023.
- $30B stolen from crypto ecosystem since 2012: The stolen amount represents nearly 3% of the current market cap of listed cryptocurrencies. … From 2012 to the present, over $30 billion in crypto has been hacked in 1,101 documented incidents, a July 7 report from SlowMist has revealed.
Law enforcement continues to do what it can even as the long-term solution is helping our organizations and our people do a better job of staying cyber-safe. The FBI – Hive story is long but worth a read.
- INTERPOL Nabs Hacking Crew OPERA1ER’s Leader Behind $11 Million Cybercrime: A suspected senior member of a French-speaking hacking crew known as OPERA1ER has been arrested as part of an international law enforcement operation codenamed Nervone, Interpol has announced. … “The group is believed to have stolen an estimated USD 11 million — potentially as much as 30 million — in more than 30 attacks across 15 countries in Africa, Asia, and Latin America,” the agency said.
- How the FBI hacked Hive: The bureau is trying to take the fight to foreign ransomware gangs, even if it means giving up on bringing some of them behind bars. … Hive was once one of the world’s most prolific criminal syndicates, notorious for shutting down the networks of American schools, businesses and health care facilities. … When the FBI took down a notorious cybercrime gang known as Hive earlier this year, it did so without arresting a single person. … It was a coup that reflects a notable change in the way the agency fights cybercrime — focusing on outwitting hackers and disrupting them from afar rather than detaining them. Most cybercriminals operate in countries that are beyond the reach of U.S. law enforcement.
- It would have been “heresy” by the old standards of the bureau to celebrate a major case like that without an arrest, deputy attorney general Lisa Monaco said at the RSA security conference in April. But now, she continued, “we’re not measuring our success only with courtroom actions.”
Section 4 – Managing Information Security and Privacy in Your Organization.
Leadership is vital to the strength of your cybersecurity culture. It starts with Tone at the Top.
- Cybersecurity experts have become targets for board seats: The need for strong cybersecurity programs is a vital part of doing business today, and a good reflection of that is adding security executives to boards. … Businesses are becoming more aware of cyber risk as a component of business risk “and need chief information security officers to be part of board-level governance conversations,” said Nick Kakolowski, research director at IANS Research. … Yet only 15% of CISOs have broader traits required for board level positions, such as a holistic understanding of the business, a global perspective, and ability to navigate a range of stakeholders.
Effective cybersecurity management means integrating cybersecurity into everything you do. Everyone needs to be involved. It takes a village …
- How to Safely Architect AI in Your Cybersecurity Programs: Guardrails need to be set in place to ensure confidentiality of sensitive information, while still leveraging AI as a force multiplier for productivity.
- Human Error the Leading Cause of Cloud Data Breaches: Around two in five (39%) businesses experienced a data breach in their cloud environment in 2022, a rise of 4% compared with 2021, a new report has found. … The 2023 Thales Global Cloud Security Study, which surveyed nearly 3000 IT and security professionals across 18 countries, also revealed a dramatic increase in sensitive data stored in the cloud in 2022 compared to the previous year. Three-quarters (75%) of respondents said that more than 40% of data stored in their organizations’ cloud environments was ‘sensitive.’ This compared to 39% of businesses in 2021. … Targeting the Human Factor: The leading cause of cloud data breaches was human error, at 55%, according to the report. This was significantly above the next highest factor identified by respondents (21%), which was exploitation of vulnerabilities.
