TechLetters #52 - cybercriminal regrets, military cyber, misinformation, FB micro targeting
Éditorial
Security
Military cyber. Cyberattacks in armed conflict will look completely different with respect to what we see nowadays. "Chinese cyberwarfare department’s are working towards the overall objective of instantly disrupting or weakening adversary’s computer networks to paralyse decision-making capability at the very commencement of hostilities" (link). "China has dedicated information warfare militia units in place" (link).
REvil catch. Europol arrested some individuals suspected of being members of the REvil ransomware group. "allegedly responsible for 5 000 infections, which in total pocketed half a million euros in ransom"
Regrets. Cybercriminals from Conti ransomware group “regret” that they leaked data of a Royal Saudi Arabia family. Fair.
Most Important Hardware Weakness. Indeed.
CWE-1189 Improper Isolation of Shared Resources on System-on-a-Chip (SoC)
CWE-1191 On-Chip Debug and Test Interface With Improper Access Control
CWE-1231 Improper Prevention of Lock Bit Modification
CWE-1233 Security-Sensitive Hardware Controls with Missing Lock Bit Protection
CWE-1240 Use of a Cryptographic Primitive with a Risky Implementation
CWE-1244 Internal Asset Exposed to Unsafe Debug Access Level or State
CWE-1256 Improper Restriction of Software Interfaces to Hardware Features
CWE-1260 Improper Handling of Overlap Between Protected Memory Ranges
CWE-1272 Sensitive Information Uncleared Before Debug/Power State Transition
CWE-1274 Improper Access Control for Volatile Memory Containing Boot Code
CWE-1277 Firmware Not Updateable
CWE-1300 Improper Protection of Physical Side Channels
Misinformation on misinformation. Some concerns over disinformation are overblown? Is it a problem? Well, yes. Stringent policy changes are being introduced to regulate speech/expression, in "response". If the premise is flawed, the solution is inappropriate.
Privacy
FB micro targeting. Facebook to limit microtargeting. Restricts targeting based on interests. It would be impressive if it happened in 2015, following an appropriate risk assessment. Today it's just due to societal, public, and political pressure. And no risk assessment.
Technology Policy
Other
In case you feel it's worth it to forward this letter further, I leave this thingy below:
You may also share here: