1 – Bitcoin-hungry hackers broke their own decryption tool, analysts warn
Cybersecurity researchers warn that paying Bitcoin $BTC▼2.23% to retrieve files locked by the prolific Ryuk ransomware may still result in data loss. This means that Ryuk‘s latest victims are stuck between a rock and a hard place. If they refuse to send their attackers Bitcoin, they’ll lose access to their data altogether, but if they pay, the hackers will provide them with a decryption tool that doesn’t work. Software company Emsisoft told Hard Fork that the attackers themselves are responsible for breaking their own encryption tool with an update. “Obviously, we’re hoping to get the word out about this as quickly and widely as possible so that affected organizations can avoid data loss,” said Emsisoft via email.
2 – Advertisers want exemption from web privacy rules that, you know, enforce privacy
Amid the final rulemaking before the California Consumer Privacy Act (CCPA) is scheduled to take effect next year, five ad industry groups have asked California Attorney General Xavier Becerra to remove a requirement that businesses honor the privacy choices internet users make through browser settings, extensions, or other controls. The wording of their request to Becerra appears to ask for a ban on browser and operating system-based privacy intervention, such as extensions that block ads and tracking scripts. However, the ad industry groups subsequently clarified that they only want to disallow meddling with cookies that that express privacy choices, such as those set by the digital ad industry’s AdChoices link.
3 – A social media influencer will serve 14 years in prison after his plot to take over a website at gunpoint backfired
A social media influencer was sentenced to 14 years in prison for plotting to hijack a website at gunpoint during a home invasion. Rossi Lorathio Adams II, 27, of Cedar Rapids, Iowa, received the sentence Monday after he was found guilty of one count of conspiracy to interfere with commerce by force, threats and violence, according to a statement from the US Attorney’s Office for the Northern District of Iowa. Adams, also known as “Polo,” founded a social media company called “State Snaps” in 2015 while he was enrolled as a student at Iowa State University. His social media accounts on platforms such as Snapchat, Instagram and Twitter had over a million followers at one point, the statement said.
4 – Government Withdraws Cash Prize From President’s Cup Cybersecurity Competition
The U.S. government has decided that at least some participants in the President’s Cup Cybersecurity Competition cannot be awarded cash prizes, and one participant says the entire contest has been poorly organized. The President’s Cup Cybersecurity Competition was announced earlier this year when President Donald Trump signed an executive order whose goal is to grow and strengthen the country’s cybersecurity workforce. The competition aims to “identify, challenge, and reward the government’s best personnel supporting cybersecurity and cyber excellence.” The challenge is open to all federal employees, including DoD and uniformed service members, and it consists of a series of contests.
5 – Congress warns tech companies: Take action on encryption, or we will
Congress sent a warning to tech giants on Tuesday, telling companies including Apple and Facebook that it intends to pass legislation to regulate encryption if Silicon Valley can’t reach an acceptable compromise with law enforcement agencies. Tech companies and privacy advocates have long supported encryption, noting that the privacy and security technology protects people from hackers, crooks and authoritarian governments. Law enforcement officials, however, argue that encryption blocks criminal investigations by preventing access to suspects’ devices and to their communications on messaging apps.
6 – Nuro’s driverless delivery robots will start serving Walmart customers in Houston
Nuro, the self-driving startup founded by two ex-Google engineers, is expanding its pilot robot delivery service in Houston, Texas, to include Walmart customers. The company has been making grocery deliveries in Houston with its fleet of autonomous Toyota Prius vehicles since March. Now the company plans to roll out its custom-built R2 prototype vehicle to help supplement its delivery duties. In the coming months, Houston residents who have opted into Nuro’s pilot service can get their groceries delivered from Walmart in either of the company’s two types of vehicles: a Toyota Prius equipped with self-driving hardware and software or the oversized lunchbox-looking R2. The service will expand to the general public late in 2020, the company says.
7 – Facebook rejects AG Barr’s request to stop encryption plans for messaging apps
Two Facebook executives have responded to an October letter from Attorney General William Barr asking the company to pause its plans for end-to-end encryption across its three messaging apps. In the letter, WhatsApp head Will Cathcart and Messenger head Stan Chudnovsky argue that the “backdoor” access Barr and other government officials are requesting would be a “gift to criminals, hackers and repressive regimes.” It comes as another Facebook executive is set to testify Tuesday at a hearing on encryption and lawful access.
8 – Windows 10 Mobile receives its last security patches
If you’re one of the tiny contingent still using Windows 10 Mobile, 10 December 2019 is probably a day you’ve been dreading for nearly a year. As announced by Microsoft in January 2019, it’s the end of life date for version 1709 of the OS, which means that November’s Build 15254.597 (KB4522811) was its last ever software update and therefore its last set of security patches. After this date, users are on their own, warming themselves in the fading heat of a dying star which began life with some fanfare what seems like a long time ago but was in fact only 2015.
9 – Thousands of iPR Software Users Exposed on Amazon S3 Bucket
A publicly accessible Amazon S3 storage bucket originating from iPR Software was found exposing information on thousands of users, UpGuard’s security researchers reveal. The data collection contained, among various other files, 477,000 email addresses, and hashed passwords for around 35,000 of them. Business entity account information, documents, and administrative system credentials were also discovered. The storage bucket contained a large number of files, some configured for public access (a total of over a terabyte in size), along with documentation from iPR developers, marketing materials for clients, and credentials for accounts on Google, Twitter, and a MongoDB hosting provider.
10 – FTC warns Christmas buyers that smart toys are a security risk
Thinking of giving a young person an internet-connected smart toy this Christmas? If so, the US Federal Trade Commission (FTC) wants you to think very carefully about the hidden and serious security risks you might be handing over with it. It would be easy to dismiss such advice as glaringly obvious, but the FTC puts its finger on three capabilities that often spell trouble. These are: If the toy has a camera or microphone, what control do owners have over how this operates and where any data is stored?; Does the toy send emails or connect to social media?; What control do adults have over the device’s management and security?
