1 New flaws in 4G, 5G allow attackers to intercept calls and track phone locations
A group of academics have found three new security flaws in 4G and 5G, which they say can be used to intercept phone calls and track the locations of cell phone users. The findings are said to be the first time vulnerabilities have affected both 4G and the incoming 5G standard, which promises faster speeds and better security, particularly against law enforcement use of cell site simulators, known as “stingrays.” But the researchers say that their new attacks can defeat newer protections that were believed to make it more difficult to snoop on phone users. “Any person with a little knowledge of cellular paging protocols can carry out this attack,” said Syed Rafiul Hussain, one of the co-authors of the paper, told TechCrunch in an email.
2 Peyton Barber's tablet stolen, but Bucs say no concern over confidential information
Tampa Bay Buccaneers running back Peyton Barber's team-issued tablet was stolen in Atlanta early Saturday morning, team officials told ESPN. According to police, a group of men broke into Barber's Jeep Wrangler SUV around 5 a.m. ET Saturday outside a high-rise in the Atlanta neighborhood of Buckhead. Along with the tablet, the men stole Barber's passport, designer sunglasses and clothing, according to police. A team official told ESPN that the tablet was wiped clean remotely Saturday and that there was no playbook information on it — just scouting video — so there isn't concern about confidential info getting out. The Bucs do use their tablets as playbooks, however.
3 Payroll Provider Gives Extortionists a Payday
Payroll software provider Apex Human Capital Management suffered a ransomware attack this week that severed payroll management services for hundreds of the company’s customers for nearly three days. Faced with the threat of an extended outage, Apex chose to pay the ransom demand and begin the process of restoring service to customers. Roswell, Ga. based Apex HCM is a cloud-based payroll software company that serves some 350 payroll service bureaus that in turn provide payroll services to small and mid-sized businesses. At 4 a.m. on Tuesday, Feb. 19, Apex was alerted that its systems had been infected with a destructive strain of ransomware that encrypts computer files and demands payment for a digital key needed to unscramble the data.
4 4 Dickinson High students accused of hacking computer system, changing grades
Four Jersey City high school students have been charged after authorities say they accessed the public school district’s computer system and changed grades for some students, The Jersey Journal has learned. According to a source in the school district, board of education members were notified by email Friday afternoon that four Dickinson High School students had been arrested earlier in the day. Jersey City school officials and a spokeswoman for the police department did not return requests for more information.
5 EPIC Joins Coalition Calling on FTC to Investigate Facebook for Deception of Children
A coalition of consumer groups sent a complaint to the FTC, charging that Facebook engaged in unfair and deceptive practices and violated the Children's Online Privacy Protection Act after court documents from a 2012 class action lawsuit revealed that Facebook encouraged children to make credit card purchases on Facebook's platform. Parents and minors repeatedly complained about the credit card charges, but the documents indicate that the company refused to refund charges and set up a complex complaint system to deter refund requests. EPIC helped enact the children online privacy law and regularly submits comments to the FTC on children's privacy issues.
6 UCI, UCR scientists eavesdrop on DNA synthesizer to steal genetic blueprint
During the DNA synthesis process in a laboratory, recordings can be made of the subtle, telltale noises made by synthesis machines. And those captured sounds can be used to reverse-engineer valuable, custom-designed genetic materials used in pharmaceuticals, agriculture and other bioengineering fields. Researchers from the University of California, Irvine and the University of California, Riverside have uncovered the possibility of an acoustic side-channel attack on the DNA synthesis process, a vulnerability that could present a serious risk to biotechnology and pharmaceutical companies and academic research institutions.
7 Surveillance firm asks Mozilla to be included in Firefox's certificate whitelist
Mozilla's security team has been caught between a rock and a hard place in regards to a recent request to add a known surveillance vendor to Firefox's internal list of approved HTTPS certificate issuers. The vendor is named DarkMatter, a cyber-security firm based in the United Arab Emirates that has been known to sell surveillance and hacking services to oppressive regimes in the Middle East [1, 2, 3]. A few months back, DarkMatter filed a bug report asking that its own root certificates be added to the Firefox's certificate store –which is an internal list of Certificate Authorities (CAs).
8 Cybercriminals Promise Millions to Skilled Black Hats
Cybercriminals say they are willing to pay over a million dollars per year to individuals with network management, penetration testing, and programming skills willing to put on a black hat, a new Digital Shadows report reveals. Posts on Dark Web forums reveal that one threat actor is willing to pay in excess of $64,000 per month ($768,000 per year) to skilled individuals willing to help them conduct nefarious operations. The salary would go up to $90,000 per month ($1,080,000 per year) for the second year. Cybercrime groups looking for accomplices who can help them extort money from high-worth individuals, including company executives, lawyers and doctors, promise monthly pays starting at $30,000 per month ($360,000 per year), Digital Shadows notes in their report.
9 DNC unveils new security checklist to protect campaigns from cyberattacks
The Democratic National Committee (DNC) on Friday unveiled an updated security checklist aimed at helping campaigns protect themselves from cyberattacks. The list — the second version released by the DNC in recent months — calls for staff to keep their devices up to date to prevent hackers from exploiting any exposed vulnerabilities. It also calls for staffers to have long, random and unique passwords for their accounts and to use password managers to track those passwords. Staffers are also encouraged to have multifactor authentication set up for their accounts, which requires users to confirm their identities before being able to access their data.
10 Two US Committees Ready to Talk Privacy Regs
Two US House committees will hold hearings next week, each focusing on data privacy as public pressure continues to mount for regulations that address protecting American consumers. On Tuesday, February 26, the House Consumer Protection and Commerce subcommittee will hold its hearing, “Protecting Consumer Privacy in the Era of Big Data.” The following day the US Senate Committee on Commerce, Science and Transportation will hold a separate hearing, “Privacy Principles for a Federal Data Privacy Framework in the United States.” Focused on possible actions that can be taken to “address risks to consumers and implement data privacy protections for all Americans,” the Senate hearing is a step toward establishing legislation, according to a press release.
