A new trend is emerging among ransomware groups where they prioritize stealing data from workstations used by top executives and managers in order to obtain "juicy" information that they can later use to pressure and extort a company's top brass into approving large ransom payouts. From a report: ZDNet first learned of this new tactic last week during a phone call with a company that paid a multi-million dollar ransom to the Clop ransomware gang. Similar calls with other Clop victims and email interviews with cybersecurity firms later confirmed that this wasn't just a one-time fluke, but instead a technique that the Clop gang had fine-tuned across the past few months.

The technique is an evolution of what we've been seen from ransomware gangs lately. For the past two years, ransomware gangs have evolved from targeting home consumers in random attacks to going after large corporations in very targeted intrusions. These groups breach corporate networks, steal sensitive files they can get their hands on, encrypt files, and then leave ransom notes on the trashed computers. In some cases, the ransom note informs companies that they have to pay a ransom demand to receive a decryption key. In case data was stolen, some ransom notes also inform victims that if they don't pay the ransom fee, the stolen data will be published online on so-called "leak sites."

D-Link is trying to make it simple to give your computer a Wi-Fi upgrade. From a report: The networking company has announced what it's calling an "industry-first" Wi-Fi 6 adapter built into a USB stick. Plug it into your laptop or desktop computer, and you may be able to get better performance than from your older Wi-Fi chip. The adapter advertises speeds up to 1,200Mbps. It's not entirely clear who the target audience is for this upgrade. You'll need to be connected to a Wi-Fi 6 router to get the biggest benefits, and most people still don't own one of those (the Wi-Fi 6 standard only started rolling out two years ago). And if the laptop or desktop you're using was bought any time in recent memory, chances are it supports Wi-Fi 5, which isn't a huge step down from Wi-Fi 6.

Charlotte Web writes: With Linux 5.10 having shipped as the latest Long Term Support (LTS) release to be maintained for at least the next five years, a discussion has begun over dropping a number of old and obsolete CPU platform support currently found within the mainline kernel. For many of the architectures being considered for removal they haven't seen any new commits in years but as is the case once proposals are made for them to be removed there are often passionate users wanting the support to be kept.

A hacker took control of people's internet-connected chastity cages and demanded a ransom to be paid in Bitcoin to unlock it. From a report: "Your cock is mine now," the hacker told one of the victims, according to a screenshot of the conversation obtained by a security researcher that goes by the name Smelly and is the founder of vx-underground, a website that collects malware samples. In October of last year, security researchers found that the manufacturer of an Internet of Things chastity cage -- a sex toy that users put around their penis to prevent erections that is used in the BDSM community and can be unlocked remotely -- had left an API exposed, giving malicious hackers a chance to take control of the devices. That's exactly what happened, according to a security researcher who obtained screenshots of conversations between the hacker and several victims, and according to victims interviewed by Motherboard. A victim who asked to be identified only as Robert said that he received a message from a hacker demanding a payment of 0.02 Bitcoin (around $750 today) to unlock the device. He realized his cage was definitely "locked," and he "could not gain access to it."

Game streaming has been slowly growing in recent years with the launches of Nvidia's GeForce Now, Google's Stadia, Microsoft's xCloud and Amazon's Project Luna. This year, however, it looks to finally be picking up more steam. At CES 2021, LG announced that some of its 2021 TVs will support apps for playing games from Google Stadia and GeForce Now right on the TV. From a report: Those who subscribe to Stadia Pro, Google's subscription offering for Stadia that runs $10 per month that allows gamers to play an assortment of games for free, will be able to stream in 4K HDR, 60 FPS and 5.1 surround sound to their LG TVs. Stadia support is expected to arrive in the second half of the year in a handful of countries including the US, Canada, UK, France, Spain, Germany, Italy, Ireland, Sweden, Denmark, Norway the Netherlands and Belgium. At launch, the app will only work on LG TVs running the company's webOS 6.0 software though the company says it will come to webOS 5.0 TVs "later this year." Support for Nvidia's platform is slightly less vague, with LG only promising that it will be available in the fourth quarter. The company did not mention which countries would be able to access the service.

Mozilla developers plan to remove support for using the Backspace key as a Back button inside Firefox. From a report: The change is currently active in the Firefox Nightly version and is expected to go live in Firefox 86, scheduled to be released next month, in late February 2021. The removal of the Backspace key as a navigational element didn't come out of the blue. It was first proposed back in July 2014, in a bug report opened on Mozilla's bug tracker. At the time, Mozilla engineers argued that many users who press the Backspace key don't always mean to navigate to the previous page (the equivalent of pressing the Back button).

Joseph Cox, reporting at Vice's Motherboard: One user travelled through a park a few blocks south of an Islamic cultural center. Roughly every two minutes, their phone reported their physical location. Another was next to a bank two streets over from a different mosque. A third person was at a train station, again near a mosque. Perhaps unbeknownst to these people, Salaat First (Prayer Times), an app that reminds Muslims when to pray, was recording and selling their granular location information to a data broker, which in turn sells location data to other clients. Motherboard has obtained a large dataset of those raw, precise movements of users of the app from a source. The source who provided the dataset was concerned that such sensitive information, which could potentially track Muslims going about their day including visiting places of worship, could be abused by those who buy and make use of the data. The company collecting the location data, a French firm called Predicio, has previously been linked to a supply chain of data involving a U.S. government contractor that worked with ICE, Customs and Border Protection, and the FBI.

The news about Salaat First, which has been downloaded more than 10 million times on Android, highlights not only the use of religious apps to harvest location data, but also the ease at which this sensitive information is traded in the location data industry. Motherboard is withholding some specifics about the dataset such as its exact size in order to protect the source, but the significance is clear: users of a Muslim-focused app are being tracked likely without their informed consent. "Being tracked all day provides a lot of information, and it shouldn't be usable against you, especially if you are unaware of it," the source said. Motherboard granted them anonymity to avoid repercussions from their employer.

The Turkish Competition Board said on Monday it launched an investigation into WhatsApp and its owner Facebook after the messaging app asked users to agree to let Facebook collect user data including phone numbers and locations. From a report: In a written statement, the Competition Board said it ruled the data-collection requirement should be suspended until the probe is complete. "The Competition Board has opened an investigation into Facebook and WhatsApp and suspended the requirement to share Whatsapp data," it said. WhatsApp updated its terms of service last Wednesday, allowing Facebook and its subsidiaries to collect user data. The deadline for agreeing to the new terms is Feb. 8.

The Verge reports: The CEO of the conservative-friendly social app Parler said that all of its vendors have abandoned the company following recent bans from Google, Apple, and Amazon. "Every vendor, from text message services to email providers to our lawyers, all ditched us too, on the same day," Parler CEO John Matze said in an interview with Fox News on Sunday...

Matze said that it was having difficulties finding a new vendor to work with. "We're going to try our best to get back online as quickly as possible, but we're having a lot of trouble because every vendor we talk to says they won't work with us. Because if Apple doesn't approve and Google doesn't approve, then they won't."
But the app also has another problem, reports Mashable: The number two most downloaded free app in both Apple's App Store and the Google Play Store is an app called Parlor. That's Parlor with an "o," not an "e."

Coincidence? We think not.

Parlor is a "social talking app" in which people can get on and talk with strangers about different topics. It's been around for 10 years according to the app listing, and, Sensor Tower data indicates it had 40,000 downloads as of December 2020. Its reviews are not great to say the least, and it looks, well, pretty porn-y.

EFF special consultant/blogger/science fiction writer Cory Doctorow warns in Locus magazine about the dangers of what Bruce Schneier calls "feudal security": Here in the 21st century, we are beset by all manner of digital bandits, from identity thieves, to stalkers, to corporate and government spies, to harassers... To be safe, then, you have to ally yourself with a warlord. Apple, Google, Facebook, Microsoft, and a few others have built massive fortresses bristling with defenses, whose parapets are stalked by the most ferocious cybermercenaries money can buy, and they will defend you from every attacker — except for their employers. If the warlord turns on you, you're defenseless.

We see this dynamic playing out with all of our modern warlords. Google is tweaking Chrome, its dominant browser, to block commercial surveillance, but not Google's own commercial surveillance. Google will do its level best to block scumbag marketers from tracking you on the web, but if a marketer pays Google, and convinces Google's gatekeepers that it is not a scumbag, Google will allow them to spy on you. If you don't mind being spied on by Google, and if you trust Google to decide who's a scumbag and who isn't, this is great. But if you and Google disagree on what constitutes scumbaggery, you will lose, thanks, in part, to other changes to Chrome that make it much harder to block the ads that Chrome lets through.

Over in Facebook land, this dynamic is a little easier to see. After the Cambridge Analytica scandal, Facebook tightened up who could buy Facebook's surveillance data about you and what they could do with it. Then, in the runup to the 2020 US elections, Facebook went further, instituting policies intended to prevent paid political disinformation campaigns at a critical juncture. But Facebook isn't doing a very good job of defending its users from the bandits. It's a bad (or possibly inattentive, or indifferent, or overstretched) warlord, though...

Back to Apple. In 2017, Apple removed all effective privacy tools from the Chinese version of the iPhone/iPad App Store, at the behest of the Chinese government. The Chinese government wanted to spy on Apple customers in China, and so it ordered Apple to facilitate this surveillance... If Apple chose not to comply with the Chinese order, it would either have to risk fines against its Chinese subsidiary and possible criminal proceedings against its Chinese staff, or pull out of China and risk having its digital services blocked by China's Great Firewall, and its Chinese manufacturing subcontractors could be ordered to sever their relations with Apple. In other words, the cost of noncompliance with the order is high, so high that Apple decided that putting its customers at risk was an acceptable alternative.

Therein lies the problem with trusting warlords to keep you safe: they have priorities that aren't your priorities, and when there's a life-or-death crisis that requires them to choose between your survival and their own, they will throw you to the bandits...
"The fact that Apple devices are designed to prevent users from overriding the company's veto over their computing makes it inevitable that some government will demand that this veto be exercised in their favor..." Doctorow concludes. "As with feudal aristocrats, the state is happy to lend these warlords their legitimacy, in exchange for the power to militarize the aristocrat's holdings... "

His proposed solution? What if Google didn't collect or retain so much user data in the first place -- or gave its users the power to turn off data-collection and data-retention altogether? And "What if Apple — by design — made is possible for users to override its killswitches?"

On Friday, America's Cybersecurity and Infrastructure Security Agency revealed that the "threat actor" behind the massive breach of U.S. networks through compromised SolarWinds software also used password guessing and password spraying attacks, according to ZDNet.

And they may still be breaching federal networks, reports GCN: "Specifically, we are investigating incidents in which activity indicating abuse of Security Assertion Markup Language (SAML) tokens consistent with this adversary's behavior is present, yet where impacted SolarWinds instances have not been identified," according to updated guidance published Jan 6. "CISA is continuing to work to confirm initial access vectors and identify any changes to the tactics, techniques, and procedures (TTPs)." SAML tokens having a 24-hour validity period or not containing multi-factor authentication details where expected are examples of these red flags.

As more about the SolarWinds Orion breach has surfaced, analysts and lawmakers have repeatedly commented on how difficult it will be to remove hackers from the government's networks because their access is probably no longer predicated on flaws in SolarWinds Orion, an IT management software. CISA's new guidance appears to confirm that suspicion, stating Microsoft, which is helping the federal government investigate the hack, reported the hackers are tampering with the trust protocols in Azure/Microsoft 365.

"Microsoft reported that the actor has added new federation trusts to existing on premises infrastructure," according to the agency's guidance. "Where this technique is used, it is possible that authentication can occur outside of an organization's known infrastructure and may not be visible to the legitimate system owner." In cases where administrative level credentials were compromised, organizations should conduct a "full reconstruction of identity and trust services," CISA said.

Microsoft published a query to help identify this type of activity.

Today MSN published an article listing "Every social media platform Donald Trump is banned from using (so far)."

Some excerpts: - Trump was suspended from Snapchat amid the riots on January 6, a spokesperson confirmed to The Hill...

- On January 7, Twitch, the Amazon-owned video live-streaming platform made popular by gamers, disabled Trump's account indefinitely...

- Though Trump does not have a Pinterest account, the image-sharing app has reportedly been limiting pro-Trump related topics since around November. For example, if you search "StoptheSteal," you will see the following message: "Pins about this topic often violate our community guidelines, so we're currently unable to show search results...."

- Oh, how the tables have turned. Remember when Trump tried to ban TikTok? Well, even though Trump does not have an account of his own, the video platform still found a way to limit his reach. On January 7, TikTok confirmed it would be removing videos of Trump's speeches believed to have incited violence at the Capitol. Furthermore, it is redirecting hashtags used by rioters like #stormthecapitol and #patriotparty to its community guidelines.

However, the company has not specified that it would ban Trump should he try to join the platform.

"Apple has suspended Parler until the makers of the app solve its content moderation challenges," reports Forbes, citing a statement from Apple saying "there is no place on our platform for threats of violence and illegal activity. Parler has not taken adequate measures to address the proliferation of these threats..."

Meanwhile, BuzzFeed News reports: Amazon notified Parler that it would be cutting off the social network favored by conservatives and extremists from its cloud hosting service Amazon Web Services, according to an email obtained by BuzzFeed News. The suspension, which will go into effect on Sunday just before midnight, means that Parler will be unable to operate and will go offline unless it can find another hosting service...

In an email obtained by BuzzFeed News, an AWS Trust and Safety team told Parler Chief Policy Officer Amy Peikoff that the calls for violence propagating across the social network violated its terms of service. Amazon said it was unconvinced that the service's plan to use volunteers to moderate calls for violence and hate speech would be effective. "Recently, we've seen a steady increase in this violent content on your website, all of which violates our terms," the email reads. "It's clear that Parler does not have an effective process to comply with the AWS terms of service."
Earlier in the day, Bloomberg supplied some context: A group representing some Amazon.com Inc. employees has called for the company's cloud unit to cut ties with Parler after reports that the social media network was used by those who planned Wednesday's riot at the U.S. Capitol...

It's unclear how many employees the group represents. Participation in rallies, social media statements and open letters has ranged from dozens of workers to thousands at events held before the Covid-19 pandemic. Amazon last year fired two of the group's leaders for what it said was violation of company policy. The employees say they were terminated for their activism.

Bleeping Computer reports: NVIDIA has released security updates to address six security vulnerabilities found in Windows and Linux GPU display drivers, as well as ten additional flaws affecting the NVIDIA Virtual GPU (vGPU) management software. The vulnerabilities expose Windows and Linux machines to attacks leading to denial of service, escalation of privileges, data tampering, or information disclosure.

All these security bugs require local user access, which means that potential attackers will first have to gain access to vulnerable devices using an additional attack vector. Following successful exploitation of one of the vulnerabilities patched today, attackers can easily escalate privileges to gain permissions above the default ones granted by the OS.

On Thursday Axios tried to assess QAnon's role in the mob that stormed America's Capitol building: Adherents of the QAnon conspiracy theory, who imagine a vast deep-state cabal of pedophiles arrayed against Trump, have for years insisted that a moment of reckoning for their enemies is imminent. QAnon believers have largely accepted that Trump is waiting for the right time to bring a hammer down on his enemies (or already has, in secret). But time is running out. Because Congress was slated to officially certify Biden's victory on Jan. 6, the day became the focal point of a new conspiracy theory — that Trump would, on that date, reveal mountains of evidence of electoral fraud, somehow invalidate Biden's win, and secure a second term.

The catch: That evidence does not exist. Instead, Trump Wednesday addressed the followers who came to Washington by reeling off a familiar list of grievances... Determined to play their part in the foreordained events of Jan. 6, the mob descended on the Capitol... The bottom line: The pro-Trump internet willed into being a siege on the Capitol that successfully delayed the certification of Biden's victory.
But Tuesday, KrebsOnSecurity was already arguing that QAnon's infrastructure might have a legal vulnerability (according to this article shared by Slashdot reader aaltmann): In October 2020, KrebsOnSecurity looked at how a web of sites connected to conspiracy theory movements QAnon and 8chan were being kept online by DDoS-Guard, a dodgy Russian firm that also hosts the official site for the terrorist group Hamas. New research shows DDoS-Guard relies on data centers provided by a U.S.-based publicly traded company, which experts say could be exposed to civil and criminal liabilities as a result of DDoS-Guard's business with Hamas...

A review of the several thousand websites hosted by DDoS-Guard is revelatory, as it includes a vast number of phishing sites and domains tied to cybercrime services or forums online. Replying to requests for comment from a CBSNews reporter following up on my Oct. 2020 story, DDoS-Guard issued a statement saying, "We observe network neutrality and are convinced that any activity not prohibited by law in our country has the right to exist." But experts say DDoS-Guard's business arrangement with a Denver-based publicly traded data center firm could create legal headaches for the latter thanks to the Russian company's support of Hamas... Hamas has long been named by the U.S. Treasury and State departments as a Specially Designated Global Terrorist (SDGT) organization. Under such a designation, any U.S. person or organization that provides money, goods or services to an SDGT entity could face civil and/or criminal prosecution and hefty fines ranging from $250,000 to $1 million per violation.

Sean Buckley, a former Justice Department prosecutor with the law firm Kobre & Kim... said companies can incur fines and prosecution for violating SDGT sanctions even when they don't know that they are doing so.

What's the world's richest man up to? Digital Trends reports: Tech CEO Elon Musk has urged his almost 42 million Twitter followers to use secure messaging app Signal instead of Facebook products. In a series of tweets, Musk shared a meme referencing Facebook's role in the spread of misinformation leading to the attack on Congress this week and suggested people should use the Signal app.

The tweets seem to have been prompted by a recent change to Facebook's privacy policy. As reported by The Hacker News, the new updates allow more sharing of data between Facebook and its partner company WhatsApp, including the sharing of phone numbers, interactions on the platform, information about mobile devices used to access the service, and IP addresses. If WhatsApp users do not agree to the data sharing, their accounts are disabled.

Musk has been vocally critical of Facebook in the past, saying that he chose to delete Facebook accounts for SpaceX and Tesla in the wake of the Cambridge Analytica scandal in 2018. He has also had spats with Facebook CEO Mark Zuckerberg personally, the two of them having sniped at each other over Twitter and other social media platforms several times in the past.

Mashable reports: We're all judged by the company we keep.

With that adage seemingly in mind, Discord moved Friday to ban a pro-Donald Trump server from its platform. TheDonald, as the server was titled, allowed likeminded individuals to digitally gather and was directly linked to the recently banned r/DonaldTrump subreddit and a separate discussion forum...

"While there is no evidence of that server being used to organize the Jan 6 riots, Discord decided to ban the server called TheDonald yesterday due to its overt connection to an online forum used to incite violence, plan an armed insurrection in the United States, and spread harmful misinformation related to 2020 U.S. election fraud," a Discord spokesperson confirmed over email.
Mashable even notes one comment they'd spotted about shooting politicians.

And the forum's reaction to Discord's ban included "calling Discord 'pedos' and saying 'these CEOs need to be dragged out into the street.'"

Writing in the Atlantic, programmer/economics commentator Steve Randy Waldman explains "Why I changed my mind" about the Communication Decency Act's Section 230: In the United States, you are free to speak, but you are not free of responsibility for what you say. If your speech is defamatory, you can be sued. If you are a publisher, you can be sued for the speech you pass along. But online services such as Facebook and Twitter can pass along almost anything, with almost no legal accountability, thanks to a law known as Section 230.

President Donald Trump has been pressuring Congress to repeal the law, which he blames for allowing Twitter to put warning labels on his tweets. But the real problem with Section 230, which I used to strongly support, is the kind of internet it has enabled. The law lets large sites benefit from network effects (I'm on Facebook because my friends are on Facebook) while shifting the costs of scale, like shoddy moderation and homogenized communities, to users and society at large. That's a bad deal. Congress should revise Section 230 — just not for the reasons the president and his supporters have identified.

When the law was enacted in 1996, the possibility that monopolies could emerge on the internet seemed ludicrous. But the facts have changed, and now so must our minds... By creating the conditions under which we are all herded into the same virtual space, Section 230 helped turn the internet into a conformity machine. We regulate one another's speech through shame or abuse, but we have nowhere to go where our own expression might be more tolerable. And while Section 230 immunizes providers from legal liability, it turns those providers into agents of such concentrated influence that they are objects of constant political concern. When the Facebook founder Mark Zuckerberg and the Twitter founder Jack Dorsey are routinely (and justifiably!) browbeaten before Congress, it's hard to claim that Section 230 has insulated the public sphere from government interference...

If made liable for posts flagged as defamatory or unlawful, mass-market platforms including Facebook and Twitter would likely switch to a policy of taking down those posts automatically.... Vigorous argument and provocative content would migrate to sites where people take responsibility for their own speech, or to forums whose operators devote attention and judgment to the conversations they host. The result would be a higher-quality, less consolidated, and ultimately freer public square.

Equifax said Friday that it has signed a deal to acquire Kount, providers of digital identity and fraud prevention software, for $640 million. Equifax said it plans to use Kount's technology to bolster its footprint in digital identity and fraud prevention market. ZDNet reports: Kount's software relies on artificial intelligence to link trust and fraud data signals from billions of digital interactions, devices, and annual transactions. The signals are collected and combined with Kount's AI-driven predictive insights to help businesses prevent digital fraud and protect against account takeovers in real time. Applied to business transactions, Equifax posits that Kount's technology can help facilitate faster and more accurate identity trust decisions, including payments, account creations and login, while also reducing fraud, chargebacks, false positives, and manual reviews. The full suite of Kount products will be integrated into the Equifax Luminate fraud platform, which aims to help manage fraud decisions across the consumer account lifecycle.

Google is planning to release a new Nest Hub in 2021 that will feature sleeping tracking powered by the company's Soli radar technology. 9to5Google reports: Google's Advanced Technology and Projects group first unveiled Soli in 2015, but it did not launch on a consumer device until 2019. The sensor lets you perform air gestures over the Pixel 4 to play/pause and skip/rewind tracks, as well as snooze alarms and silence phone calls. It's also used to speed up face unlock by detecting when users reach for their phone and turning on the components needed for recognition. Third-party Android developers can incorporate the tech, which emits radar waves, into games and other interactive experiences. Meanwhile, the new Nest Thermostat also leverages it for improved motion sensing to wake the screen when you walk by.

Soli will soon be used to track sleep. Embedded into this upcoming Nest Hub, Google is embracing how Smart Displays are often placed on bedside tables as alarm clocks and speakers. The original Nest Hub is more likely to be used in sensitive areas since it lacks a camera, with sleep tracking serving as another incentive to place this device on your nightstand. The FCC filing at the start of this week revealed that the Soli sensor placed in the Nest Hub will have technical capabilities identical to the Pixel 4. Google has long touted precise and fine gesture recognition, like spinning a virtual dial or adjusting a slider. This should translate to detecting any body movements you make at night. For comparison, the Nest Thermostat uses a more limited version of Soli to detect general motion. It's possible that Google will also use Soli on this Nest Hub for gestures to control content. The Nest Hub Max today already uses its camera to play/pause tracks when you hold up a hand.