Microsoft and FireEye push for breach reporting rules
The companies pushed for a new breach reporting requirement to the US Senate Intelligence Committee in written testimony regarding the SolarWinds supply chain attack. Microsoft President Brad Smith said, “We need to replace this silence with a clear, consistent obligation for private sector organizations to disclose when they’re impacted by confirmed significant incidents.” FireEye CEO Kevin Mandia reiterated the sentiment with more specific language, saying, “The U.S. government should consider a federal disclosure program for not only sharing threat indicators but for also providing notification of a breach or incident.” While many US states have laws requiring notification to victims of a data breach, no federal law is currently on the books.
(The Hill)
US Federal Reserve hit with massive IT outage
The outage impacted the ability to make wire transfers, ACH transactions, and almost every other electronic service they process. The Fed’s FedMail electronic messaging system used to transmit information to other organizations remained operational. The Federal Reserve characterized the outage as an “operational error.” Access to FedCash and Central bank services was restored after roughly two hours on February 24th, although many Fed services remain down as of this recording.
Path cleared for California’s net neutrality law
Judge John Mendez declined to grant a preliminary injunction requested by the telecom industry that would have prevented enforcement of California’s Internet Consumer Protection and Net Neutrality Act of 2018. This clears the way for the law to go into effect in California. The US Department of Justice had previously sued to stop the law, but dropped its lawsuit earlier this month. While a preliminary injunction will not stop the law from now being enforced, the lawsuit from the industry group is still ongoing.
Google sponsors developers to improve Linux security
Google and the Linux Foundation announced they were prioritizing funds to underwrite the work of two long-time Linux kernel maintainers, to work full time on maintaining and improving Linux security. Developer Nathan Chancellor will work on fixing all bugs found with Clang/LLVM compilers and developing a continuous integration system to support these efforts long term. Gustavo Silva’s work is currently dedicated to eliminating several classes of buffer overflows. Silva is an active member of the Kernel Self Protection Project and one of the top five most active kernel developers since 2017, while Chancellor has contributed to kernel development for almost five years and a member of the ClangBuiltLinux project.
(El Reg)
Thanks to our episode sponsor, PlexTrac
Five Eyes members issue security warning related to Accellion
Four member states of Five Eyes, Australia, New Zealand, the United Kingdom, and the United States in collaboration with Singapore, issued a warning regarding ongoing attacks and extortion attempts targeting organizations using the Accellion File Transfer Appliance. We’ve reported over the past weeks about the growing number of organizations impacted by vulnerabilities in the FTA software. The security advisory recommends blocking internet access to systems hosting FTA software, obtaining disk images and other system data to use for forensic analysis, update to the most recent version of FTA, and reset any security tokens if malicious activity is suspected.
Ransomware attacks double against universities
This finding comes from BlueVoyant’s Cybersecurity in Higher Education report, which documents the attacks doubling in 2020. Ransomware was the number one cyberthreat against higher education organizations last year, with ransom payouts averaging $450,000. The switch to remote learning in 2020 seems to have exacerbated existing security issues, with 22% of organizations in the report using open or unsecured remote desktop ports, with 66% lacking protocols like SPF, DKIM and DMARC to help guard against phishing. Data breaches were the second biggest threat to these organizations, with about a third of leaks linked to apps like Zoom, Chegg and ProctorU.
TikTok releases transparency report on election misinformation
According to TikTok’s latest transparency report, the platform removed 340,000 videos in the US for breaking the platform’s rules on election misinformation in H2 2020. 441,000 videos were removed from its For You recommendations for spreading misinformation, with 1,750,000 accounts that used “automation” removed during the election cycle. The social network also rolled out an election guide powered by the voting information tool BallotReady on its Discovery page, which was viewed over 18 million times prior to the election.
Google’s Password Checkup rolling out to Android
Password Checkup was originally released by Google as a Chrome extension, designed to alert users when saved credentials are detected in compromised datasets. The feature has since been rolled into stable Chrome builds, and now will be rolled out to Android 9 and newer releases through the “Autofill with Google” feature. Like passwords stored in Chrome, passwords on Android are hashed and encrypted locally, and compromised credential detection is only determined on-device.
