TechLetters #45 - REvil returns. Cyberattack crippling business. Cyberpolitics the usual (disrupting elections). Wireless charging information leaks. Autonomous rifle
Security
New directions in traffic analysis. "This paper presents a method to automate many aspects of traffic analysis, making it easier to apply machine learning techniques to a wider variety of traffic analysis tasks.". Concerning network security. (paper)
REvil reappears. When REvil shut down operations, many wondered why. Now the reasons for the temporary disappearance of REvil ransomware group are more clear. Political reasons "It is not surprising that the community responsible for the high-profile attacks on American infrastructure took precautions after the conversation between the presidents of the United States and Russia," said the anonymous hacker. "Geopolitical factors are always taken into account in a business of this level, although this is the first time I come across a situation where a group is forced to curtail its activities relatively unexpectedly.", at least according to the person who worked with REvil in the past. Still, they seem to be rather conscious about their “business” and activities. For example, they know that what they do is impacting geopolitics.
Cyberattacks crippling business. "In September 2020, an Australian hedge fund was subject to BEC and forced to declare bankruptcy as a result … While the business recovered the majority of its funds, it suffered significant reputational damage and its main client withdrew. This forced the hedge fund to go into receivership and resulted in its bankruptcy. This was likely Australia’s first bankruptcy case as a direct result of a cybercrime incident". Watch out what you do with your finance in response to online requests!
Weaponizing Middleboxes. "we can see amplification factors between 1,000,000 and 100,000,000". This is huge! "nation-state censorship infrastructure for countries around the world can also be weaponized" (paper).
Thermal attack on password. Exploiting thermal residues left behind by a user (victim). who enters a password using a typical external keyboard. Watch out where you type :-) "any user with long acrylic fingernails is virtually immune". Sometimes possible, but cumbersome (and requires physical access). (paper)
Got AUKUS? Trilateral security pact between UK, US and Australia will focus on submarines, cybersecurity, and quantum technologies: “AUKUS will bring together sailors, scientists, and industries to maintain and expand our edge in military capabilities and critical technologies, such as cyber, artificial intelligence, quantum technologies, and undersea domains”.
Cyber gets political. Cyberattack on opposition primary elections in Hungary! Paralysis. Suspended. Opposition was supposed to unite, but a surprise. They accuse the government. Someone also points at China. Meanwhile, Prime Minister Victor Orban accuses them of incompetence. Cybersecurity influences politics. Conversely, politics has an impact on cybersecurity. An important topic (technical, political, diplomatic) for competences and the right people are needed. Otherwise it ends in humiliation.
Privacy
Wireless charging information leaks. It turns out that wireless charging leaks private information. For example, about websites visited by the user. " allows accurate website fingerprinting on a charging smartphone". Information leaked depends on the battery level. "Below approximately 80% state of charge, both wired and wireless charging side-channels observed in this experiment do not leak information. ... consistently classify traces with a battery state 90%". Privacy-preserving advice: have less than 80% battery charge..? Is it serious? Not really, unless someone decides to do this at a scale, for example build monitoring capabilities in chargers on a standard basis, for example to “monetise wireless charging”. But it’s certainly interesting. Still, this research reminds my privacy research work of privacy leakage via web browser battery information API.
TikTok GDPR case. Irish data protection authority is investigating TikTok. On two issues: processing children data, and data transfers to China. "compliance with the #GDPR’s data protection by design and default requirements"
TikTok tik-tock. Irish and Italian data protection authorities are investigating Facebook-Ray-Bay 'smart' voice-activated glasses. Specifically, they wonder if the LED light indicator sufficient to signal to the world "everything is being recored"? Privacy design choice. “it is generally the case that the camera or the phone is visible as the device by which recording is happening, thereby putting those captured in the recordings on notice. With the glasses, there is a very small indicator light that comes on when recording is occurring. It has not been demonstrated to the DPC and Garante that comprehensive testing in the field was done by Facebook or Ray-Ban to ensure the indicator LED light is an effective means of giving notice.”
Technology Policy
Huawei to lead in 6G. Or so they intend to do.
Other
History of hacking in Bulgaria/Soviet block. Well, virus writing.
AI-fueled remotely controlled rifle. “remote-controlled artificial intelligence operated sniper machine gun” reportedly in use. “debut test of a high-tech, computerized sharpshooter kitted out with artificial intelligence and multiple-camera eyes, operated via satellite and capable of firing 600 rounds a minute” The era of lethal autonomous weapons systems is upon us?
In case you feel it's worth it to forward this letter further, I leave this thingy below:
You may also share here: