Newsflash vrijdag 19 oktober 2018
Bijna 40 procent grote bedrijven getroffen door cyberaanval
(nu.nl)

Van de grote Nederlandse bedrijven was 39 procent in 2016 slachtoffer van een cyberaanval van buitenaf.

Het gaat in deze categorie om bedrijven met meer dan 250 medewerkers, maakt het Centraal Bureau voor de Statistiek (CBS) vrijdag bekend op basis van de Cybersecuritymonitor 2018.

Onder een cyberaanval valt onder meer een DDoS-aanval, waarbij een server wordt bestookt met enorme hoeveelheden dataverkeer. Ook gijzelsoftware (malafide software die bestanden versleutelt en losgeld eist) en phishing (pogingen om via e-mail inloggegevens of andere informatie te verkrijgen) worden tot dit soort incidenten gerekend.

OM: zoeken naar lekken in andermans systeem niet zomaar toegestaan
(security.nl)

Het zoeken naar kwetsbaarheden in andermans systeem is niet zomaar toegestaan, zo stelt het Openbaar Ministerie in een artikel over Coordinated Vulnerability Disclosure of Responsible Disclosure beleid.

Organisaties laten via dergelijk beleid weten onder welke voorwaarden er naar kwetsbaarheden in hun systemen mag worden gezocht en hoe er met bugmeldingen wordt omgegaan.

Volgens het OM zal er tegen onderzoekers die zich aan het Coordinated Vulnerability Disclosure of Responsible Disclosure beleid houden in principe geen aangifte worden gedaan of andere juridische stappen worden ondernomen.

EU-Hof: wijzen naar huisgenoot pleit vermeende illegale downloaders niet vrij
(tweakers.net)

Het Europese Hof van Justitie heeft bepaald dat downloaders die zich schuldig maken aan piraterij niet de aansprakelijkheid voor auteursrechtinbreuk kunnen ontlopen door te stellen dat ook andere gezinsleden of huisgenoten toegang hebben tot dezelfde internetverbinding.

Het Hof neemt naar aanleiding van vragen van een rechter in een Duitse zaak, waarbij een uitgeverij een man aansprakelijk stelde voor het illegaal delen van een audioboek. De Duitse rechter bepaalde dat de man niet aansprakelijk was, omdat hij beweerde dat ook zijn ouders toegang hadden tot dezelfde internetverbinding waarmee het audioboek online kwam.

Dit argument was volgens de Duitse rechter voldoende om aansprakelijkheid te ontlopen, vanwege het recht op privacy. Het Europese Hof gaat hier echter niet in mee.

Cyber Espionage Campaign Reuses Code from China's APT1
(darkreading.com)

US, Canadian organizations in crosshairs of group with apparent links to a Chinese military hacking unit that wreaked havoc several years ago.

Several US organizations appear to be victims of a widespread data reconnaissance campaign involving malware last associated with Comment Crew aka APT1, a Chinese military-linked group that is believed responsible for stealing data from dozens of American companies between 2006 and 2010.

The attack group behind the latest campaign has carried out at least five separate waves of attacks against organizations in various sectors, the latest in June.

Facebook tentatively concludes spammers were behind recent data breach - WSJ
(itnews.com.au)

Facebook Inc has tentatively concluded that spammers looking to make money, and not a nation-state, were behind the largest-ever data theft at the social media company, the Wall Street Journal reported on Wednesday.

The people behind the attack were a group of Facebook and Instagram spammers that present themselves as a digital marketing company, and whose activities were previously known to Facebook’s security team, the Journal reported, citing people familiar with the company's internal investigation.

Last week, Facebook said that cyber attackers had stolen data from 29 million Facebook accounts using an automated program that moved from one friend to the next, adding that the data theft had hit fewer than the 50 million profiles it initially reported.

Flaws in telepresence robots allow hackers access to pictures, video feeds
(zdnet.com)

Telepresence robots from Vecna Technologies can be hacked using a suite of five vulnerabilities. The flaws can be combined to allow an attacker full control over a robot, giving an intruder the capability to alter firmware, steal chat logs, pictures, or even access live video streams.

Vecna has already patched two of the five vulnerabilities and is in the process of addressing the other three.

The flaws were discovered earlier this year by Dan Regalado, a security researcher with IoT cyber-security firm Zingbox.

Malwarebytes releases 2018 Q3 Cybercrime Tactics and Techniques Report
(pcworld.idg.com.au)

The Q3 Malwarebytes Labs Cybercrime Tactics and Techniques report is designed to uncover the full picture of what is going on in the cybercrime landscape, delivering a report that provides insights and statistics from July through September 2018.

The report found that cryptomining increased in both Australia and New Zealand in Q3, each reaching the highest rate of detection for the year. Australian cases of cryptomining increased by 36.37% to 194,282 cases, while New Zealand cases increased by 644.50% on Q2 results to reach 79,851 cases in Q3.

The Malwarebytes report found that Australian and New Zealand markets differ significantly in relation to Backdoor, Adware and Anomalous malware detections.

Hackers beware: passive biometrics is turning the tables on cybercrime
(biometricupdate.com)

Halloween or not, black-hat hackers don’t typically require clever costumes to hit their targets. That’s because most companies’ authentication systems rely on Personally Identifiable Information (PII) or usernames and passwords as a way to identify returning customers.

This method, which used to create a real barrier against fraud, is no longer good enough. Constant data breaches over the years have proven that almost everyone’s PII may have been exposed and is now available to fraudsters.

Stolen data is not only easy for bad actors to access, but also straightforward to leverage; using it is as simple as snagging infected candy in October. This certainly isn’t comforting for companies, who must flank their user accounts while allowing transactions and purchases to happen seamlessly.

New Security Woes for Popular IoT Protocols
(darkreading.com)

Researchers at Black Hat Europe will detail denial-of-service and other flaws in MQTT, CoAP machine-to-machine communications protocols that imperil industrial and other IoT networks online.

Security researcher Federico Maggi had been collecting data – some of it sensitive in nature – from hundreds of thousands of Message Queuing Telemetry Transport (MQTT) servers he found sitting wide open on the public Internet via Shodan. "I would probe them and listen for 10 seconds or so, and just collect data from them," he says.

He found data on sensors and other devices sitting in manufacturing and automotive networks, for instance, as well as typical consumer Internet of Things (IoT) gadgets.

My Health Record inquiry backs away from return to opt-in
(itnews.com.au)

Australia’s grinding, decade-long and always controversial journey towards national adoption of electronic health and medical records is set to maintain its current ‘opt-out’ stance after a key parliamentary committee backed away from a return to voluntary adoption.

The Senate’s Community Affairs References Committee on Thursday delivered its final report into the My Health Record system, recommending a slew of improvements but pulling up short of flipping the roll-out back to the previous opt-in model.

The report represents a crucial truce in the ongoing political and social debate surrounding privacy and access elements of the troubled scheme because it stipulates far tougher default access controls over the presumption that citizens should only get an eHealth record if they proactively ask for one.

Brace yourself, Britain: Health minister shares 'vision' for NHS 'tech revolution'
(theregister.co.uk)

Given the track record of project failures in NHS IT, some might say that Matt Hancock - former Minister for Fun who now runs the Department of Health - is marching with ill-founded confidence towards what he describes as a “tech revolution”.

A little bit of knowledge - Hancock once coded an app criticised for flouting data privacy regs he used to tout in his day job - in the wrong hands can be a dangerous thing.

“The tech revolution is coming to the NHS,” he boldly claimed yesterday, as he outlined his “vision” to erect a modern tech architecture that will provide the basis for a new generation of digital services.

Oz to turn pirates into vampires: You won't see their images in mirrors
(theregister.co.uk)

Australia's federal government hopes to expand the piracy-blocking regime it introduced in 2015 to include injunctions against search engines, include file drop-sites in bans, and catch so-called “alternative pathways” to pirated content that emerge after a primary site has been blocked.

Under Australia's latest regime, copyright owners have to seek court injunctions against individual websites (say, The Pirate Bay) if they suspect the site is infringing their copyright, and if successful, telcos block access to those sites through the domain name system.

Thus, if a website is pirating or being used to pirate material, it can be blocked by killing off DNS lookups, meaning web browsers and their users can't find the site from its domain name. If someone knows the IP address of the site, they're still quids in, of course.

Next-Generation Trends in Identity and Access Management
(gartner.com)

Gartner analysts explore the IAM trends for which IT leaders should be prepared.

The growing scope and complexity of modern identity environments is becoming too difficult to manage in the usual ways, requiring IT leaders to evolve their identity and access management (IAM) environments.

Ahead of Gartner Identity and Access Management Summit 2018, Smarter With Gartner reached out to experts presenting at the event to ask them what the upcoming IAM trends are and how IT leaders should prepare.

Ding ding! Round Two: Second annual review for transatlantic data flow deal Privacy Shield
(theregister.co.uk)

The deal governing transatlantic data flows – branded not fit for purpose by privacy watchdogs – enters its second annual review today.

The Privacy Shield agreement was rushed through in the summer of 2016 after its predecessor Safe Harbor was scrapped following a legal challenge by activist and then-PhD student Max Schrems.

Despite offering more protections for personal data transferred from the EU to the US than its predecessor, progress to properly implement Privacy Shield has been slow, and most critics believe it is not even close to being up to scratch.

Why internet access is a human right
(theweek.co.uk)

The growth of global internet access has slowed dramatically over the past decade, meaning opportunities afforded by the digital revolution will remain out of reach for billions of the world’s poorest and most isolated people.

Analysis of UN data to be published in a report next month but shared with The Guardian, shows the rate at which the world is getting online has fall sharply since 2015.

Looking further back over the past ten years, the Web Foundation, established by world wide web inventor Tim Berners-Lee, found growth in global internet access has dropped from 19% in 2007 to less than 6% last year.

Facebook in fresh video metrics row
(bbc.com)

Facebook was aware of inaccuracies in the way it measured how many people viewed video on its site for a year longer than it has previously admitted, court documents have claimed.

Newly released papers that are part of a US legal action against the social network, claim that it knew about the problems in 2015.

Facebook described the case against it as "without merit". It said suggestions it had tried to hide the issue were "false". In September 2016, Facebook admitted that it had overestimated how much video people had watched for the previous two years.

Anki Vector review: cute home robot's a good pet, not a great help
(theage.com.au)

Designed as a robot sidekick for your home, Vector can't do any housework but it can entertain you with some tricks, and does a surprisingly good job of coercing you into forming an emotional bond.

The first thing that strikes me when I see Vector is how small it is, fitting neatly into the palm of my hand. It has big eyes, gets around on tank tracks, chirps and makes R2D2 type noises. Instead of arms, this little bot has a bulldozer-like attachment used to express itself or play with the supplied cube.

Saying “Hey Vector” makes it look at you as it waits for an instruction, such as "come here", or "fist bump". I like that Vector comes to you when called (take note, robot vacuum cleaner designers).