Amid an Embarrassment of Riches, Ransom Gangs Increasingly Outsource Their Work
There’s an old adage in information security: “Every company gets penetration tested, whether or not they pay someone for the pleasure.” Many organizations that do hire professionals to test their network security posture unfortunately tend to focus on fixing vulnerabilities hackers could use to break in. But judging from the proliferation of help-wanted ads for offensive pentesters in the cybercrime underground, today’s attackers have exactly zero trouble gaining that initial intrusion: The real challenge seems to be hiring enough people to help everyone profit from the access already gained.
An AI Pioneer Wants His Algorithms to Understand the ‘Why’
IN MARCH, YOSHUA Bengio received a share of the Turing Award, the highest accolade in computer science, for contributions to the development of deep learning—the technique that triggered a renaissance in artificial intelligence, leading to advances in self-driving cars, real-time speech translation, and facial recognition. Now, Bengio says deep learning needs to be fixed. He believes it won’t realize its full potential, and won’t deliver a true AI revolution, until it can go beyond pattern recognition and learn more about cause and effect. In other words, he says, deep learning needs to start asking why things happen. The 55-year-old professor at the University of Montreal, who sports bushy gray hair and eyebrows, says deep learning works well in idealized situations but won’t come close to replicating human intelligence without being able to reason about causal relationships. “It’s a big thing to integrate [causality] into AI,” Bengio says. “Current approaches to machine learning assume that the trained AI system will be applied on the same kind of data as the training data. In real life it is often not the case.”
Former eBay workers plead guilty to cyberstalking campaign against couple
Two former eBay Inc workers pleaded guilty on Thursday to participating in an extensive cyberstalking campaign against a Massachusetts couple whose online newsletter was viewed by top executives as critical of the e-commerce company. Federal prosecutors in Boston said former eBay global intelligence team members Stephanie Popp and Veronica Zea along with other employees harassed the couple through Twitter and sent them disturbing packages like a bloody Halloween pig mask. Popp, eBay’s former senior manager of global intelligence, and Zea, a contractor who worked as an intelligence analyst, pleaded guilty to conspiring to commit cyberstalking and conspiring to tamper with a witness. Prosecutors plan to recommend prison terms of 41 months for Popp, 33, and 30 months for Zea, 26, when they are later sentenced.
TikTok passes Instagram as second-most popular social app for U.S. teens
TikTok has surpassed Instagram as U.S. teenagers’ second-favorite social media app, according to a report published Tuesday. The short-video app is now favored among teens second only to Snap’s Snapchat, according to Piper Sandler. The report found that 34% of teens list Snapchat as their favorite social app followed with 29% picking TikTok. Trailing Snapchat and TikTok was Facebook’s Instagram, with only 25% of teens picking it as their favorite social app. TikTok placed No. 3 in the spring 2020 version of the Piper Sandler report. Usage was a different story, according to the report. In that regard, Instagram remains in first place with 84% engagement, followed by Snapchat at 80% and TikTok at 69%, up from 62% in the spring.
New action to combat ransomware ahead of U.S. elections
Today we took action to disrupt a botnet called Trickbot, one of the world’s most infamous botnets and prolific distributors of ransomware. As the United States government and independent experts have warned, ransomware is one of the largest threats to the upcoming elections. Adversaries can use ransomware to infect a computer system used to maintain voter rolls or report on election-night results, seizing those systems at a prescribed hour optimized to sow chaos and distrust. We disrupted Trickbot through a court order we obtained as well as technical action we executed in partnership with telecommunications providers around the world. We have now cut off key infrastructure so those operating Trickbot will no longer be able to initiate new infections or activate ransomware already dropped into computer systems. In addition to protecting election infrastructure from ransomware attacks, today’s action will protect a wide range of organizations including financial services institutions, government agencies, healthcare facilities, businesses and universities from the various malware infections Trickbot enabled.
Sam’s Club customer accounts hacked in credential stuffing attacks
Over the past two weeks, Sam’s Club has started sending automated password reset emails and security notifications to customers who were hacked in credential stuffing attacks. Sam’s Club, owned by Walmart, is an American chain of membership-only retail warehouse clubs operating since 1983. The brand is frequently listed alongside Costco and BJ’s Wholesale Club. Over the past two weeks, Sam’s Club has started sending automated password reset emails and security notifications to customers who were hacked in credential stuffing attacks. Sam’s Club, owned by Walmart, is an American chain of membership-only retail warehouse clubs operating since 1983. The brand is frequently listed alongside Costco and BJ’s Wholesale Club.
Five Eyes governments, India, and Japan make new call for encryption backdoors
Members of the intelligence-sharing alliance Five Eyes, along with government representatives for Japan and India, have published a statement over the weekend calling on tech companies to come up with a solution for law enforcement to access end-to-end encrypted communications. The statement is the alliance’s latest effort to get tech companies to agree to encryption backdoors. The Five Eyes alliance, comprised of the US, the UK, Canada, Australia, and New Zealand, have made similar calls to tech giants in 2018 and 2019, respectively. Just like before, government officials claim tech companies have put themselves in a corner by incorporating end-to-end encryption (E2EE) into their products. If properly implemented, E2EE lets users have secure conversations — may them be chat, audio, or video — without sharing the encryption key with the tech companies.
The US military is trialing augmented reality goggles for dogs
Dogs working in the United States military could in the future wear augmented reality (AR) goggles that enable soldiers to give them remote commands during operations. The goggles are being developed by Command Sight, a Seattle-based company, with US Army research funding, and would allow military dogs to assist in rescue operations and scout potentially dangerous areas for hazards and explosives while their handlers remain at a safe distance. The technology, which the US Army says is the first of its kind, works by letting a handler see everything the dog can see and then provide specific commands using visual cues that show up in the dog’s line of vision. Currently, military dogs are most commonly directed with hand signals or laser pointers, which require the handler to be in close proximity. Handlers can also use audio communication, with a camera and radio attached to the dog, but the commands can be confusing for the dog.
