Newsflash woensdag 2 december 2015
Overheid steekt 70 miljoen in intelligente transportsystemen
(nu.nl)

Het ministerie van Infrastructuur en Milieu gaat 70 miljoen euro steken om intelligente transportsystemen te ontwikkelen.

Het ministerie trekt het geld uit om tot 2017 in verschillende regio’s proeven uit te voeren met zulke intelligente transportsystemen.

Denk daarbij aan apps of navigatiesystemen die bijvoorbeeld waarschuwen voor regenbuien, te hard rijden of files. Verkeersminister Melanie Schultz van Haegen en regionale bestuurders hebben dinsdag de afspraken bekrachtigd.

VS wil biometrische controles op Schiphol uitvoeren
(security.nl)

Als het aan de Verenigde Staten liggen worden reizigers die vanaf Schiphol naar de VS vertrekken op de Nederlandse luchthaven al biometrisch gecontroleerd.

Dat liet het Witte Huis gisteren weten. Vanwege de aanslagen in Parijs hebben de Amerikaanse autoriteiten de toegangsregels voor reizigers verscherpt.

Reizigers van 38 landen die visumvrij naar de VS kunnen reizen moeten voortaan meer informatie van tevoren opgeven. Het gaat dan onder andere of er landen zijn bezocht die als terroristische schuilplaatsen bekendstaan.

CBP: winkels schenden privacywet met wifi-tracking
(security.nl)

Winkels die mensen via wifi-signalen van hun mobiele apparaten volgen zonder hen hierover te informeren schenden de Wet bescherming persoonsgegevens, zo heeft het College bescherming persoonsgegevens (CBP) bepaald na onderzoek bij het bedrijf Bluetrace.

Bluetrace verzamelt en analyseert meetgegevens die het bedrijf verkrijgt via wifi-tracking. Het bedrijf biedt winkeliers daarmee bedrijfseconomische informatie: hoeveel mensen passeren de winkel, hoeveel bezoekers gaan de winkel in en hoelang blijven zij op een bepaalde plaats in de winkel.

Dit soort gegevens is volgens het CBP gevoelig van aard. Het gaat om locatiegegevens die iets zeggen over iemands verblijfplaats en winkelgedrag. Bluetrace voldoet echter niet aan de wettelijke voorwaarden om dit te mogen doen.

Filmbedrijven willen met illegale downloaders schikken voor 150 euro
(tweakers.net)

Filmbedrijven gaan volgend jaar beginnen met het sturen van waarschuwingen naar illegale downloaders en proberen de zaak vervolgens te schikken voor ongeveer 150 euro. De bedrijven monitoren ip-adressen en vragen bij providers de adresgegevens van bijbehorende klanten op.

De start van de cease & desist-procedure in 2016 is door Willem Pruijssers, eigenaar van filmdistributeur Dutch FilmWorks, tegen BNR bevestigd. "We zullen eerst zeggen: meneer of mevrouw, u heeft een film illegaal bekeken, de volgende keer sturen we u een schikkingsvoorstel", verklaart hij.

Dat schikkingsvoorstel behelst een bedrag van ongeveer 150 euro. Gaat de downloader door met zijn gedrag dan loopt dit bedrag op en uiteindelijk zou de filmindustrie een civielrechtelijke zaak aanspannen.

Data breach at toymaker gets much worse
(theage.com.au)

A breach of almost five million parents and 200,000 kids' online accounts with digital toy maker VTech — which affects some 18,000 Australian parents and children — just got much worse.

The hacker has released to a news organisation select photos, audio recordings and text chats, created by the kids using high-tech internet-connected toys, that were meant only for the children and their parents.

It comes as US states said they would investigate the massive breach at the toy maker and as security experts warned that hackers were likely to target similar companies that handle customer data.

Cybersecurity Seen As Top Priority For Financial Risk Managers
(darkreading.com)

Risk managers at financial firms rate cyber risk as the number one concern across all risk management activities, not just IT risks.

Risk managers in the financial services industry are skittish about what they perceive as a heightened chance for high-impact event hitting the global financial system hard and they're naming potential cyber attacks as one of the biggest drivers for that increased risk.

A new survey out today by the Depository Trust & Clearing Corporation (DTCC) shows that 61% of risk managers believe that over the last six months, the probability of an event that turns over the entire global financial system's applecart just went up.

China, U.S. High-Level Cyber Crime Talks to Begin Tuesday
(nbcnews.com)

Top U.S. and Chinese officials will convene this week in Washington for the first round of cyber security talks following the signing of a bilateral anti-hacking accord in September.

China's Public Security Minister Guo Shengkun is in Washington through Sunday and will meet U.S. Secretary of Homeland Security Jeh Johnson, Chinese state media reported. U.S. Attorney General Loretta Lynch is also expected to take part in the discussions.

The talks on Tuesday and Wednesday are seen as potentially significant in establishing acceptable norms for cyber espionage. It also marks an ongoing effort to repair bilateral relations after China withdrew from a working group last year in response to the U.S. indictment of five members of its military on charges it hacked six U.S. companies.

China's Underground Cyber-Crime Economy Grows in Size, Sophistication
(eweek.com)

While state-sponsored online espionage is most often associated with China, freelance cyber-crime is alive and well in the country, according to a recent research report.

The tool is called Social Engineering Master. Anyone who pays the equivalent of $50 can search through a variety of stolen or leaked information and use it to create a convincing cyber-attack targeted at a specific victim or group of victims.

The online service is just one of the offerings that have cropped up as part of an online criminal ecosystem in China. While China is well known as a source of cyber-attacks targeting Western political and economic targets through operations called Darkhotel, Emissary Panda and Naikon that made headlines worldwide, online criminal marketplace activity has grown significantly over the past year.

How CISOs Can Change The Game of Cybersecurity
(darkreading.com)

In the modern enterprise, chief information security officers need a broad mandate over security and risk management across all operational silos, not just the datacenter.

As data breaches continue to escalate, organizations, regardless of size or industry, need a new mindset to rise to the pervasive challenge of cybercrime and cyber espionage. Despite the fact that the FBI claims that their number one criminal priority is cybercrime, less than five percent of computer intrusions are successfully prosecuted, according to the Department of Justice and FBI.

With jail time and other penalties few and far between, corporate decision makers are on their own when it comes to protecting corporate reputations, intellectual property, finances, and customers.

Security of UK net firms under scrutiny
(bbc.com)

The security of the UK's biggest internet service providers needs "major improvement", according to one expert.
Security consultant Paul Moore examined the publicly available information of the UK's six biggest ISPs.

He said he found plenty of bugs that could be exploited by hackers. But he said most ISPs had been in contact with him and had worked to tighten security once told of the issues.

The audit of TalkTalk, Sky, BT, Plusnet, EE and Virgin Media was kicked off in the wake of the TalkTalk hack, which saw the personal details of 157,000 of its customers exposed.
More than 15,600 bank account number and sort codes were stolen.

Feds don't need a warrant to read your emails. Congress wants that to change
(zdnet.com)

Don't be too surprised that the government can read your emails. What you might not know is that it can readily read most of your inbox without a warrant.

Because of a 1980's law that almost pre-dates email in its modern form, in most cases the government doesn't need a warrant to access your email if it's older than six months.

The Electronic Communications Privacy Act (ECPA), signed into law in 1986, permits this kind of access with a subpoena, which doesn't require a judge.

Revealed: What info the FBI can collect with a National Security Letter
(net-security.org)

On Monday, after winning an eleven-year legal battle, Nicholas Merrill can finally tell the public how the FBI has secretly construed its authority to issue National Security Letters (NSLs) to permit collection of vast amounts of private information on US citizens without a search warrant or any showing of probable cause.

The PATRIOT Act vastly expanded the domestic reach of the NSL program, which allows the FBI to compel disclosure of information from online companies and forbid recipients from disclosing they have received an NSL. The FBI has refused to detail publicly the kinds of private data it believes it can obtain with an NSL.

Merrill has been privy to this information since 2004, when the FBI served him with an NSL demanding that he turn over records about a customer of the Internet company he then owned, Calyx Internet Access.

UK intelligence service GCHQ is on trial for hacking
(cio.com)

GCHQ, the British signals intelligence service, is in the dock accused of hacking computers without individual warrants in order to tap communications.

The allegations, made by messaging providers and campaign groups GreenNet, RiseUp Networks, Chaos Computer Club and Privacy International, among others, concern the use by the U.K. Government Communications Headquarters of "thematic warrants" to hack computers. They began making their cases to the U.K.'s Investigatory Powers Tribunal in London on Tuesday, in hearings scheduled to run through Friday.

GCHQ first admitted to hacking in February following Privacy International's initial legal challenge.

ISIS Has 300 U.S. Ambassadors on Twitter, Report Says
(nbcnews.com)

At least 300 Americans, many of them women, are acting as ISIS ambassadors on social media — spreading propaganda and hunting for potential recruits, according to a new report.

Researchers at George Washington University's Program on Extremism said that Twitter is the platform of choice for U.S. based sympathizers, even though the service regularly suspends accounts that spew ISIS material.

As soon as they are taken down — which is seen as a "badge of honor" — new accounts replace them them within hours and are retweeted by others to bring them up to their previous follower level.

Pentagon gets green light for war ... of web propaganda against IS
(theregister.co.uk)

The Pentagon has been given formal approval to start an online propaganda campaign against the Islamic State following a recent push by the US Department of Defense (DoD).

Congress approved the National Defense Authorization Act for 2016 last week and included in it a whole section (1056) on "Information operations and engagement technology demonstrations."

The section states that the Secretary of Defense "should develop creative and agile concepts, technologies, and strategies across all available media to most effectively reach target audiences, and to counter and degrade the ability of adversaries and potential adversaries to persuade, inspire, and recruit inside areas of hostilities or in other areas in direct support of the objectives of commanders."

Ransomware and scammy tech support sites team up for a vicious one-two punch
(pcworld.com)

Symantec has seen a curious fusing of two pernicious online threats, which would cause a big headache if encountered by users.

Some websites offering questionable tech support services are also dishing up ransomware, which locks up a users files until they pay a fee to decrypt them.

The support scams involve trying to convince users they have a computer problem and then selling them overpriced software or support services to fix it. It's often done via a pop-up message that urges people to call a number or download software.

US retail websites go down under Cyber Monday traffic
(itnews.com.au)

Target US was one of a handful of US retailers to today struggle to keep its website alive under heavy traffic on Cyber Monday.

Shoppers looking for bargains on www.target.com were greeted with an error message early in the morning: "So sorry, but high traffic's causing delays. If you wouldn't mind holding, we'll refresh automatically & get things going ASAP."

"Both traffic and order volumes are exceeding Target's Thursday Black Friday event ... To help manage the volume, we have been metering traffic to the site," Target spokeswoman Jamie Bastian said.

Sued for using HTTPS: Big brands told to cough up in crypto patent fight
(theregister.co.uk)

Scores of big brands – from AT&T and Yahoo! to Netflix, GoPro and Macy's – are being sued because their HTTPS websites allegedly infringe an encryption patent.

It appears in May this year CryptoPeak Solutions, based in Longview, Texas, got its hands on US Patent 6,202,150, which describes "auto-escrowable and auto-certifiable cryptosystems."

CryptoPeak reckons TLS-secured websites that use elliptic curve cryptography are infringing the patent – so it's suing owners of HTTPS websites that use ECC. Top tip: loads of websites use ECC these days to securely encrypt their traffic.

Google accused of collecting data on school kids
(computerworld.com)

Google has been collecting information about schoolchildren's browsing habits despite signing a pledge saying it was committed to their privacy, the Electronic Frontier Foundation said in a complaint filed Tuesday.

The digital rights group said Google's use of the data, collected through its Google for Education program, puts the company in breach of Section 5 of the Federal Communications Act and asked the Federal Trade Commission to investigate.

“Despite publicly promising not to, Google mines students’ browsing data and other information, and uses it for the company’s own purposes," the EFF said.

Safe Harbor solution not coming any time soon, says Dutch minister
(theregister.co.uk)

A solution to the Safe Harbor data framework will not hit its January 2016 deadline, raising the possibility of large fines levied against companies like Facebook in the New Year.

That's according to Dutch justice minister Ard van der Steur, who has published a lengthy response to Parliamentary questions on the issue.

Van der Steur's response goes into some depth about the history of the framework, which covers data transfer across the Atlantic, and the decision and resulting impact of the European Court of Justice's ruling to effectively strike it down in October.

Automated essay marking on par with human teachers
(theregister.co.uk)

Software has emerged as the equal of humans when it comes to marking essays in an Australian study.

The test of test-marking software was conducted by the Australian Curriculum, Assessment and Reporting Authority, which administers standardised tests called the National Assessment Program – Literacy and Numeracy (NAPLAN).

NAPLAN tests include an essay-writing component, and in the 2012 edition of the tests sine students were asked to type those essays into computers.

Facebook's Mark Zuckerberg to give away 99% of shares
(bbc.com)

Facebook's Mark Zuckerberg and his wife Priscilla Chan say they will give away 99% of their shares in the company to good causes as they announce the birth of their daughter Max.

Mr Zuckerberg made the announcement in a letter to Max on his Facebook page. He said they are donating their fortune to the Chan Zuckerberg Initiative because they want to make the world a better place for Max to grow up in.

Mr Zuckerberg said the donation currently amounts to $45bn (£30bn). Max was born last week, but the couple only made the news of her birth public on Tuesday.