British cybersecurity officials are warning that hacking groups linked to Russia and Iran are duping people into clicking malicious links by impersonating journalists and experts. From a report: The hackers, who have similar goals but are said to be working separately, have sought to steal emails from people working in academia, defense, the media and government, as well as from activists and non-governmental organizations, according to an advisory released on Thursday by the UK's National Cyber Security Centre. "These campaigns by threat actors based in Russia and Iran continue to ruthlessly pursue their targets in an attempt to steal online credentials and compromise potentially sensitive systems," said Paul Chichester, the center's director of operations. "We strongly encourage organizations and individuals to remain vigilant to potential approaches and follow the mitigation advice in the advisory to protect themselves online."

GoTo (formerly LogMeIn) is warning customers that threat actors who breached its development environment in November 2022 stole encrypted backups containing customer information and an encryption key for a portion of that data. From a report: GoTo provides a platform for cloud-based remote working, collaboration, and communication, as well as remote IT management and technical support solutions. In November 2022, the company disclosed a security breach on its development environment and a cloud storage service used by both them and its affiliate, LastPass. At the time, the impact on the client data had yet to become known as the company's investigation into the incident with the help of cybersecurity firm Mandiant had just begun.

The internal investigation so far has revealed that the incident had a significant impact on GoTo's customers. According to a GoTo's security incident notification a reader shared with BleepingComputer, the attack affected backups relating to the Central and Pro product tiers stored in a third-party cloud storage facility. "Our investigation to date has determined that a threat actor exfiltrated encrypted backups related to Central and Pro from a third-party cloud storage facility," reads the notice to customers.

"Thousands of people who use Norton password manager began receiving emailed notices this month alerting them that an unauthorized party may have gained access to their personal information," reports CNET, "along with the passwords they have stored in their vaults.

"Gen Digital, Norton's parent company, said the security incident was the result of a credential-stuffing attack rather than an actual breach of the company's internal systems." Gen's portfolio of cybersecurity services has a combined user base of 500 million users — of which about 925,000 active and inactive users, including approximately 8,000 password manager users, may have been targeted in the attack, a Gen spokesperson told CNET via email....

Norton's intrusion detection systems detected an unusual number of failed login attempts on Dec. 12, the company said in its notice. On further investigation, around Dec. 22, Norton was able to determine that the attack began around Dec. 1. "Norton promptly notified both regulators and customers as soon as the team was able to confirm that data was accessed in the attack," Gen's spokesperson said.

Personal data that may have been compromised includes Norton users' full names, phone numbers and mailing addresses. Norton also said it "cannot rule out" that password manager vault data including users' usernames and passwords were compromised in the attack....

Norton is also offering access to credit monitoring services for affected users, according to its letter to customers.

An anonymous reader quotes a report from the Associated Press: The European Union's digital policy chief warned TikTok's boss Thursday that the social media app will have to fall in line with tough new rules for online platforms set to take effect later this year. EU Commissioner Thierry Breton held a video call with Shou Zi Chew, the CEO of TikTok, the popular Chinese-owned video sharing app that's coming under increasing scrutiny from Western authorities over fears about data privacy, cybersecurity and misinformation. The two discussed the company's plans to comply with the bloc's Digital Services Act, which is set to take effect for the biggest online companies in September. The act is a set of sweeping rules that will require platforms to reduce harmful online content and combat online risks.

"With younger audiences comes greater responsibility," Breton said, according to a readout of the call. "It is not acceptable that behind seemingly fun and harmless features, it takes users seconds to access harmful and sometimes even life-threatening content." Breton added that, with millions of young users in Europe, TikTok has a "special responsibility" to ensure its content is safe. [...] Breton said he is also concerned about allegations TikTok is spying on journalists and transferring reams of personal user data outside of Europe, in violation of the 27-country bloc's strict privacy rules.

Bretaon said he "explicitly conveyed" to Shou that TikTok needs to "step up efforts to comply" with EU rules on data protection, copyright as well as the Digital Services At, which includes provisions for heavy fines or even a ban from the EU for repeat offenses that threaten the people's lives or safety. "We will not hesitate to adopt the full scope of sanctions to protect our citizens if audits do not show full compliance," he said.

An anonymous reader quotes a report from TechCrunch: A government watchdog has published a scathing rebuke of the Department of the Interior's cybersecurity posture, finding it was able to crack thousands of employee user accounts because the department's security policies allow easily guessable passwords like 'Password1234'. The report by the Office of the Inspector General for the Department of the Interior, tasked with oversight of the U.S. executive agency that manages the country's federal land, national parks and a budget of billions of dollars, said that the department's reliance on passwords as the sole way of protecting some of its most important systems and employees' user accounts has bucked nearly two decades of the government's own cybersecurity guidance of mandating stronger two-factor authentication. It concludes that poor password policies puts the department at risk of a breach that could lead to a "high probability" of massive disruption to its operations.

The inspector general's office said it launched its investigation after a previous test of the agency's cybersecurity defenses found lax password policies and requirements across the Department of the Interior's dozen-plus agencies and bureaus. The aim this time around was to determine if the department's security defenses were enough to block the use of stolen and recovered passwords. [...] To make their point, the watchdog spent less than $15,000 on building a password-cracking rig -- a setup of a high-performance computer or several chained together -- with the computing power designed to take on complex mathematical tasks, like recovering hashed passwords. Within the first 90 minutes, the watchdog was able to recover nearly 14,000 employee passwords, or about 16% of all department accounts, including passwords like 'Polar_bear65' and 'Nationalparks2014!'. The watchdog also recovered hundreds of accounts belonging to senior government employees and other accounts with elevated security privileges for accessing sensitive data and systems. Another 4,200 hashed passwords were cracked over an additional eight weeks of testing. [...]

The watchdog said it curated its own custom wordlist for cracking the department's passwords from dictionaries in multiple languages, as well as U.S. government terminology, pop culture references, and other publicly available lists of hashed passwords collected from past data breaches. By doing so, the watchdog demonstrated that a well-resourced cybercriminal could have cracked the department's passwords at a similar rate, the report said. The watchdog found that close to 5% of all active user account passwords were based on some variation of the word "password" and that the department did not "timely" wind down inactive or unused user accounts, leaving at least 6,000 user accounts vulnerable to compromise. The report also criticized the Department of the Interior for "not consistently" implementing or enforcing two-factor authentication, where users are required to enter a code from a device that they physically own to prevent attackers from logging in using just a stolen password.

Two of the US government's leading security agencies are building a machine learning-based analytics environment to defend against rapidly evolving threats and create more resilient infrastructures for both government entities and private organizations. From a report: The Department of Homeland Security (DHS) -- in particular its Science and Technology Directorate research arm -- and Cybersecurity and Infrastructure Security Agency (CISA) picture a multicloud collaborative sandbox that will become a training ground for government boffins to test analytic methods and technologies that rely heavily on artificial intelligence and machine learning techniques. It also will include an automated machine learning "loop" through which workloads -- think exporting and tuning data -- will flow.

The CISA Advanced Analytics Platform for Machine Learning (CAP-M) -- previously known as CyLab -- will drive problem solving around cybersecurity that encompasses both on-premises and cloud environments, according to the agencies. "Fully realized, CAP-M will feature a multi-cloud environment and multiple data structures, a logical data warehouse to facilitate access across CISA data sets, and a production-like environment to enable realistic testing of vendor solutions," DHS and CISA wrote in a one-page description of the project. "While initially supporting cyber missions, this environment will be flexible and extensible to support data sets, tools, and collaboration for other infrastructure security missions."

An anonymous reader quotes a report from Motherboard: A team of security researchers managed to gain "super administrative access" into Reviver, the company behind California's new digital license plates which launched last year. That access allowed them to track the physical GPS location of all Reviver customers and change a section of text at the bottom of the license plate designed for personalized messages to whatever they wished, according to a blog post from the researchers. "An actual attacker could remotely update, track, or delete anyone's REVIVER plate," Sam Curry, a bug bounty hunter, wrote in the blog post. Curry wrote that he and a group of friends started finding vulnerabilities across the automotive industry. That included Reviver.

California launched the option to buy digital license plates in October. Reviver is the sole provider of these plates, and says that the plates are legal to drive nationwide, and "legal to purchase in a growing number of states." [...] In the blog post, Curry writes the researchers were interested in Reviver because the license plate's features meant it could be used to track vehicles. After digging around the app and then a Reviver website, the researchers found Reviver assigned different roles to user accounts. Those included "CONSUMER" and "CORPORATE." Eventually, the researchers identified a role called "REVIVER," managed to change their account to it, which in turn granted them access to all sorts of data and capabilities, which included tracking the location of vehicles. "We could take any of the normal API calls (viewing vehicle location, updating vehicle plates, adding new users to accounts) and perform the action using our super administrator account with full authorization," Curry writes. "We could additionally access any dealer (e.g. Mercedes-Benz dealerships will often package REVIVER plates) and update the default image used by the dealer when the newly purchased vehicle still had DEALER tags." Reviver told Motherboard in a statement that it patched the issues identified by the researchers. "We are proud of our team's quick response, which patched our application in under 24 hours and took further measures to prevent this from occurring in the future. Our investigation confirmed that this potential vulnerability has not been misused. Customer information has not been affected, and there is no evidence of ongoing risk related to this report. As part of our commitment to data security and privacy, we also used this opportunity to identify and implement additional safeguards to supplement our existing, significant protections," the statement read.

"Cybersecurity is central to our mission to modernize the driving experience and we will continue to work with industry-leading professionals, tools, and systems to build and monitor our secure platforms for connected vehicles," it added.

"We are seeing, across the gamut, products that impact our privacy, products that create cybersecurity risks, that have overarchingly long-term environmental impacts, disposable products, and flat-out just things that maybe should not exist."

That's the CEO of the how-to repair site iFixit, introducing their third annual "Worst in Show" ceremony for the products displayed at this year's CES. But the show's slogan promises it's also "calling out the most troubling trends in tech." For example, the EFF's executive director started with two warnings. First, "If it's communicating with your phone, it's generally communicating to the cloud too." But more importantly, if a product is gathering data about you and communicating with the cloud, "you have to ask yourself: is this company selling something to me, or are they selling me to other people? And this year, as in many past years at CES, it's almost impossible to tell from the products and the advertising copy around them! They're just not telling you what their actual business model is, and because of that — you don't know what's going on with your privacy."

After warning about the specific privacy implications of a urine-analyzing add-on for smart toilets, they noted there was a close runner-up for the worst privacy: the increasing number of scam products that "are basically based on the digital version of phrenology, like trying to predict your emotions based upon reading your face or other things like that. There's a whole other category of things that claim to do things that they cannot remotely do."

To judge the worst in show by environmental impact, Consumer Reports sent the Associate Director for their Product Sustainability, Research and Testing team, who chose the 55-inch portable "Displace TV" for being powered only by four lithium-ion batteries (rather than, say, a traditional power cord).

And the "worst in show" award for repairability went to the Ember Mug 2+ — a $200 travel mug "with electronics and a battery inside...designed to keep your coffee hot." Kyle Wiens, iFixit's CEO, first noted it was a product which "does not need to exist" in a world which already has equally effective double-insulated, vaccuum-insulated mugs and Thermoses. But even worse: it's battery powered, and (at least in earlier versions) that battery can't be easily removed! (If you email the company asking for support on replacing the battery, Wiens claims that "they will give you a coupon on a new, disposable coffee mug. So this is the kind of product that should not exist, doesn't need to exist, and is doing active harm to the world.

"The interesting thing is people care so much about their $200 coffee mug, the new feature is 'Find My iPhone' support. So not only is it harming the environment, it's also spying on where you're located!"

The founder of SecuRepairs.org first warned about "the vast ecosystem of smart, connected products that are running really low-quality, vulnerable software that make our persons and our homes and businesses easy targets for hackers." But for the worst in show for cybersecurity award, they then chose Roku's new Smart TV, partly because smart TVs in general "are a problematic category when it comes to cybersecurity, because they're basically surveillance devices, and they're not created with security in mind." And partly because to this day it's hard to tell if Roku has fixed or even acknowledged its past vulnerabilities — and hasn't implemented a prominent bug bounty program. "They're not alone in this. This is a problem that affects electronics makers of all different shapes and sizes at CES, and it's something that as a society, we just need to start paying a lot more attention to."

And US Pirg's "Right to Repair" campaign director gave the "Who Asked For This" award to Neutrogena's "SkinStacks" 3D printer for edible skin-nutrient gummies — which are personalized after phone-based face scans. ("Why just sell vitamins when you could also add in proprietary refills and biometic data harvesting.")

The Biden administration is set to unveil a national strategy that for the first time calls for comprehensive cybersecurity regulation of the nation's critical infrastructure, explicitly recognizing that years of a voluntary approach have failed to secure the nation against cyberattacks, according to senior administration officials. From a report: The strategy builds on the first-ever oil and gas pipeline regulations imposed last year by the administration after a hack of one of the country's largest pipelines led to a temporary shutdown, causing long lines at gas stations and fears of a fuel shortage. The attack on Colonial Pipeline by Russian-speaking criminals elevated ransomware to an issue of national security. The strategy, drawn up by the White House Office of the National Cyber Director (ONCD), is moving through the final stages of interagency approval -- involving more than 20 departments and agencies -- and is expected to be signed by President Biden in the coming weeks, according to the officials, who spoke on the condition of anonymity because the document is not yet public.

"It's a break from the previous strategies, which focused on information sharing and public-private partnership as the solution," said James Lewis, a cybersecurity expert at the Center for Strategic and International Studies think tank. "This goes well beyond that. It says things that others have been afraid to say." For instance, according to a draft copy of the strategy, one of the stated goals is: "Use Regulation to support National Security and Public Safety." Under that, it says that regulation "can level the playing field" to meet the needs of national security, according to two individuals familiar with the draft. It also states that "while voluntary approaches to critical infrastructure cybersecurity have produced meaningful improvements, the lack of mandatory requirements has too often resulted in inconsistent and, in many cases inadequate, outcomes."

An anonymous reader quotes a report from KOMO: Ermenildo Castro, 28, of Tacoma, allegedly told detectives that he was inspired by the 90's movie "Office Space" when he devised a plan to divert customer fees from his employer, Zulily.com, into his own bank accounts. According to court documents, Castro wrote software code that manipulated the online retailer's checkout page to send the shipping fees into his own account. The charges allege Castro netted $260,000 in stolen shipping fees. Seattle police detectives said Castro also used his position as a software engineer to manipulate prices on Zulily to purchase approximately $41,000 in merchandise for 'pennies on the dollar'.

According to police, the company's cybersecurity staff found a document on Castro's laptop titled 'OfficeSpace project', which outlined Castro's scheme to 'cleanup evidence' by manipulating audit logs and disabling alarm logging. The theft began in February and by March the company had identified discrepancies in the shipping fees being charged to customers, an SPD report states. Castro was part of the team assigned to investigate the discrepancies in shipping fees, according to the report. Zulily investigators eventually caught on to Castro's scheme and went to his house in Tacoma where they found boxes of merchandise piled up outside the front door and driveway, the report states. In total, Zulily's team said Castro had sent over 1,000 items sent to his house. Seattle police detectives wrote a narrative explaining how Castro's alleged scheme related to the movie "Office Space," including the plot outline on IMDB.com.

"In the Initech office, the insecure Peter Gibbons hates his job. His best friends are two software engineers Michael Bolton and Samir Nagheenanajar, that also hate Initech. When he discovers that Michael and Samir will be downsized, they decide to plant a virus in the banking system to embezzle fraction of cents on each financial operation into Peter's account. However[,] Michael commits a mistake in the software on the decimal place and they siphon off over $300,000. The desperate trio tries to fix the problem, return the money and avoid going to prison."

Last week, LastPass announced that attackers stole customer vault data after breaching its cloud storage earlier this year using information stolen during an August 2022 incident. "While the company insists that your login information is still secure, some cybersecurity experts are heavily criticizing its post, saying that it could make people feel more secure than they actually are and pointing out that this is just the latest in a series of incidents that make it hard to trust the password manager," reports The Verge. Here's an excerpt from the report: LastPass' December 22nd statement was "full of omissions, half-truths and outright lies," reads a blog post from Wladimir Palant, a security researcher known for helping originally develop AdBlock Pro, among other things. Some of his criticisms deal with how the company has framed the incident and how transparent it's being; he accuses the company of trying to portray the August incident where LastPass says "some source code and technical information were stolen" as a separate breach when he says that in reality the company "failed to contain" the breach. He also highlights LastPass' admission that the leaked data included "the IP addresses from which customers were accessing the LastPass service," saying that could let the threat actor "create a complete movement profile" of customers if LastPass was logging every IP address you used with its service.

Another security researcher, Jeremi Gosney, wrote a long post on Mastodon explaining his recommendation to move to another password manager. "LastPass's claim of 'zero knowledge' is a bald-faced lie," he says, alleging that the company has "about as much knowledge as a password manager can possibly get away with." LastPass claims its "zero knowledge" architecture keeps users safe because the company never has access to your master password, which is the thing that hackers would need to unlock the stolen vaults. While Gosney doesn't dispute that particular point, he does say that the phrase is misleading. "I think most people envision their vault as a sort of encrypted database where the entire file is protected, but no -- with LastPass, your vault is a plaintext file and only a few select fields are encrypted."

Palant also notes that the encryption only does you any good if the hackers can't crack your master password, which is LastPass' main defense in its post: if you use its defaults for password length and strengthening and haven't reused it on another site, "it would take millions of years to guess your master password using generally-available password-cracking technology" wrote Karim Toubba, the company's CEO. "This prepares the ground for blaming the customers," writes Palant, saying that "LastPass should be aware that passwords will be decrypted for at least some of their customers. And they have a convenient explanation already: these customers clearly didn't follow their best practices." However, he also points out that LastPass hasn't necessarily enforced those standards. Despite the fact that it made 12-character passwords the default in 2018, Palant says, "I can log in with my eight-character password without any warnings or prompts to change it."

An anonymous reader quotes a report from TechCrunch: A recent study finds that software engineers who use code-generating AI systems are more likely to cause security vulnerabilities in the apps they develop. The paper, co-authored by a team of researchers affiliated with Stanford, highlights the potential pitfalls of code-generating systems as vendors like GitHub start marketing them in earnest. The Stanford study looked specifically at Codex, the AI code-generating system developed by San Francisco-based research lab OpenAI. (Codex powers Copilot.) The researchers recruited 47 developers -- ranging from undergraduate students to industry professionals with decades of programming experience -- to use Codex to complete security-related problems across programming languages including Python, JavaScript and C.

Codex was trained on billions of lines of public code to suggest additional lines of code and functions given the context of existing code. The system surfaces a programming approach or solution in response to a description of what a developer wants to accomplish (e.g. "Say hello world"), drawing on both its knowledge base and the current context. According to the researchers, the study participants who had access to Codex were more likely to write incorrect and "insecure" (in the cybersecurity sense) solutions to programming problems compared to a control group. Even more concerningly, they were more likely to say that their insecure answers were secure compared to the people in the control.

Megha Srivastava, a postgraduate student at Stanford and the second co-author on the study, stressed that the findings aren't a complete condemnation of Codex and other code-generating systems. The study participants didn't have security expertise that might've enabled them to better spot code vulnerabilities, for one. That aside, Srivastava believes that code-generating systems are reliably helpful for tasks that aren't high risk, like exploratory research code, and could with fine-tuning improve in their coding suggestions. "Companies that develop their own [systems], perhaps further trained on their in-house source code, may be better off as the model may be encouraged to generate outputs more in-line with their coding and security practices," Srivastava said. The co-authors suggest vendors use a mechanism to "refine" users' prompts to be more secure -- "akin to a supervisor looking over and revising rough drafts of code," reports TechCrunch. "They also suggest that developers of cryptography libraries ensure their default settings are secure, as code-generating systems tend to stick to default values that aren't always free of exploits."

TikTok will no longer be allowed on any device managed by the US House of Representatives. Ars Technica reports: On Tuesday, the House's Chief Administrative Office announced the ban of the popular video-sharing app, a move that comes just a week after legislation that would bar TikTok from all federal devices was introduced. Congresspersons and their staffers will not be able to download the app on managed devices, the CAO's Office of Cybersecurity said in an email seen by Reuters. The mobile app is a "high risk to users due to a number of security risks," the email said. "If you have the TikTok app on your House mobile device, you will be contacted to remove it," the email continued.

Potential federal bans aside, TikTok is already at least partially banned from government-owned devices in 19 states. And the federal omnibus spending bill passed last week will put the kibosh on TikTok when it comes to all federally managed smartphones and devices.

National Cyber Director Chris Inglis is leaving the government in the next few months, Politico reports, citing a former U.S. official and a second person familiar with the matter. From the report: For 17 months, Inglis has served as the inaugural holder of a new position as President Joe Biden's top adviser on a range of cybersecurity issues, including the protection of vital U.S. infrastructure from hackers and efforts to improve the government's own digital defenses. "He's done what he came to do -- build an office that's going to stand the test of time," said the former U.S. official, who requested anonymity to discuss an internal personnel matter.

Inglis plans to leave sometime in January, the former official said. Inglis declined to comment on the record. Inglis never said how long he expected to say, and it was unclear if he had moved up his departure timeline. Inglis took office in July 2021 following unanimous Senate confirmation, and since then, he has steadily built up his new team by hiring outside experts and recruiting cybersecurity officials from other agencies. Inglis, a former National Security Agency deputy director, repeatedly described his job as a coordinator of the government's often disparate cybersecurity activities, someone who measured his success by whether the government was increasingly speaking with one voice on cyber issues.

Slashdot reader lowvisioncomputing shares a story from the CBC about an elaborate heist discovered "when the chief administrative officer of a southwestern Manitoba rural municipality [population: 3,300] noticed the series of unusual cash withdrawals from its bank account...." It began with a job advertisement. A seemingly legitimate company, with a professional website and a Nova Scotia address, claimed it was looking for cash processors. The contract was for one month. Employees could work from home.

They were told they would receive payments to their credit cards, which they would be expected to move to their bank accounts. They would then withdraw the payments, convert them into bitcoin, and send that to another account.... The majority of the 18 people hired were young and lived in various communities across the country.... Anyone who did an internet search for the company would find a professional website, with information matching what was provided in the employment agreement.

In early December 2019, the cybercriminals sent a phishing email to multiple people at the municipal office of WestLake-Gladsone, a municipality about 150 kilometres west of Winnipeg, on the southwestern shore of Lake Manitoba. At least one person clicked on the link, which allowed the hackers to get into the municipality's computers and bank accounts. But weeks went by and nothing happened, so the municipality didn't report it to the police. It was only after the money disappeared that the municipality discovered the two incidents were connected, said Kate Halashewski, who at the time was the assistant chief administrative officer for the Municipality of WestLake-Gladstone....

Court documents say that on Dec. 19, 2019, a person logged into the municipality's bank account and changed the password, along with the personal verification questions. Over the next 17 days, the cyberattackers added the 18 "employees" hired as payees and began systematically making withdrawals, transferring the money to the employees' credit cards. Dozens of withdrawals were made, totalling $472,377, according to court documents — a considerable amount for a municipality with an entire annual budget of $7 million.

Those withdrawals weren't discovered until Jan. 6, when Halashewski saw 48 bank transfers — each less than $10,000 — going to unfamiliar accounts.... Once they'd completed the initial transfers and conversion, the bitcoin was then sent to the private account of the scammers — who cybersecurity experts say likely aren't in Canada....

The municipality finally announced it had lost nearly half a million dollars in an Oct. 12, 2020, news release.... No arrests have been made in connection with the WestLake-Gladstone cyberattack and RCMP say it is no longer under active investigation.

Today, application security provider Promon released the results of a survey of 311 cybersecurity professionals taken at this year's Black Hat Europe expo earlier this month. Sixty-six percent of the respondents claim to have experienced burnout this year. The survey also found that 51% reported working more than four hours per week over their contracted hours. VentureBeat reports: Over 50% responded that workload was the biggest source of stress in their positions, followed by 19% who cited management issues, 12% pointing to difficult relationships with colleagues, and 11% suggesting it was due to inadequate access to the required tools. Just 7% attributed stress to being underpaid. Above all, the research highlights that cybersecurity analysts are expected to manage an unmanageable workload to keep up with threat actors, which forces them to work overtime and adversely effects their mental health.

This research comes not only as the cyber skills gap continues to grow, but also as organizations continue to single out individuals and teams as responsible for breaches. Most (88%) security professionals report they believe a blame culture exists somewhat in the industry, with 38% in the U.S. seeing such a culture as "heavily prevalent." With so many security professionals being held responsible for breaches, it's no surprise that many resort to working overtime to try and keep their organizations safe -- at great cost to their own mental health.

The US seized dozens of internet domains and charged six people in a sting intended to bring down a network of cyberattack-for-hire services, the Department of Justice announced on Wednesday. Bloomberg reports: In all, the US obtained a court order to seize 48 websites, and six people were criminally charged in relation to the takedowns, according to federal prosecutors. The FBI was in the process of seizing the websites, officials said Wednesday. The websites were used to launch, or attempt to launch, millions of so-called DDoS attacks around the world, the DOJ said in a statement. Short for distributed-denial-of- service, DDoS attacks direct huge amounts of junk internet traffic at a website or computer network to knock it offline.

DDoS-for-hire services often refer to themselves as "stresser" or "booter" tools that purport to offer a way for individuals to test the resilience of websites and services they operate, according to cybersecurity experts. In reality, the services are often used for harassment, extortion and criminal mischief, they say. The sites seized by the FBI include royalstresser, securityteam and dragonstresser, among others.

A press release from the office of U.S. Senator Marco Rubio: TikTok's Chinese parent company, ByteDance, is required by Chinese law to make the app's data available to the Chinese Communist Party (CCP). From the FBI Director to FCC Commissioners to cybersecurity experts, everyone has made clear the risk of TikTok being used to spy on Americans. U.S. Senator Marco Rubio (R-FL) introduced bipartisan legislation to ban TikTok from operating in the United States.

The Averting the National Threat of Internet Surveillance, Oppressive Censorship and Influence, and Algorithmic Learning by the Chinese Communist Party Act (ANTI-SOCIAL CCP Act) would protect Americans by blocking and prohibiting all transactions from any social media company in, or under the influence of, China, Russia, and several other foreign countries of concern. U.S. Representatives Mike Gallagher (R-WI) and Raja Krishnamoorthi (D-IL) introduced companion legislation in the U.S. House of Representatives.

schwit1 shares a report from Popular Science: [T]wo women filed a potential class action lawsuit against Apple, alleging the company has ignored critics' and security experts' repeated warnings that the company's AirTag devices are being repeatedly used to stalk and harass people. Both individuals were targets of past abuse from ex-partners and argued in the filing that Apple's subsequent safeguard solutions remain wholly inadequate for consumers. "With a price point of just $29, it has become the weapon of choice of stalkers and abusers," reads a portion of the lawsuit, as The New York Times reported [...].

Apple first debuted AirTags in April 2021. Within the ensuing eight months, at least 150 police reports from just eight precincts reviewed by Motherboard explicitly mentioned abusers utilizing the tracking devices to stalk and harass women. In the new lawsuit, plaintiffs allege that one woman's abuser hid the location devices within her car's wheel well. At the same time, the other woman's abuser placed one in their child's backpack following a contentious divorce, according to the suit. Security experts have since cautioned that hundreds more similar situations likely remain unreported or even undetected.

The lawsuit (PDF), published by Ars Technica, cites them as "one of the products that has revolutionized the scope, breadth, and ease of location-based stalking," arguing that "what separates the AirTag from any competitor product is its unparalleled accuracy, ease of use (it fits seamlessly into Apple's existing suite of products), and affordability." The proposed class action lawsuit seeks unspecified damages for owners of iOS or Android devices which have been tracked with an AirTag or are at risk of being stalked. Since AirTags' introduction last year, at least two murders have occurred directly involving using Apple's surveillance gadget, according to the lawsuit.

An anonymous reader quotes a report from BuzzFeed News: Joe Bowser is a computer scientist based in Port Moody, British Columbia, who has long loved Raspberry Pis. He uses the low-cost, single-board computers, which were launched in February 2012 by a UK-based company of the same name, for many of his tech projects. Those include linking the Raspberry Pi up to a 3D printer, and using the Pi to run a machine-learning demo. There's one use case that Bowser described as "the most important": using a Raspberry Pi to identify the use of IMSI catchers -- telephone eavesdropping devices that snoop on phone calls and text messages -- by law enforcement. Protesters opposing new oil pipelines happen to pass by Bowser's house regularly. He thinks cops shouldn't spy on them. So he's trying to help out the protesters using his tech knowledge. To do that, he uses Raspberry Pis. Or more accurately, he did. Bowser has forsworn using the computers ever again. He and many others are expressing their displeasure with the company on social media.

The controversy began yesterday when Raspberry Pi posted an announcement on Twitter and Mastodon: "We hired a policeman and it's going really great." The company linked to a laudatory blog post on its website announcing it had hired an ex-police officer, Toby Roberts, as its maker-in-residence. "I was a Technical Surveillance Officer for 15 years, so I built stuff to hide video, audio, and other covert gear," Roberts is quoted as saying in the post. "You really don't want your sensitive police equipment discovered, so I'd disguise it as something else, like a piece of street furniture or a household item. The variety of tools and equipment I used then really shaped what I do today." A subsection of the Raspberry Pi community expressed concern about the blase way the company presented intrusive covert surveillance. (The news caused particular ire on Mastodon, leading some to describe Roberts as the burgeoning social media platform's first "main character.") [...]

Liz Upton, Raspberry Pi's cofounder and chief marketing officer, told BuzzFeed she believes that much of the issue stems not from the hiring of the former police officer who admitted to using Raspberry Pis for covert surveillance, but instead from a picture the account posted to Mastodon a day earlier showing pigs in blankets. "We didn't put a content warning on it, because we don't put a content warning on meat," Upton said. "There were quite a few people who tried to start dogpiling on that." She also claimed that part of the vitriolic response could be because Raspberry Pi is struggling with supply chain difficulties at present, and people "were already cross." "I think what we're looking at is a dogpile that's being organized somewhere," Upton said. "There's obviously a Discord or a forum somewhere." She did not provide evidence to support that claim. "I don't think this is organic, but it's very unpleasant, and extraordinarily unpleasant for the people involved," she said. Upton claimed both Roberts and Raspberry Pi's social media manager have been doxxed and received death threats. "I am disgusted that [Raspberry Pi's] official post on Toby Roberts' hiring promotes his use of their products to surveil individuals without their consent," Matt Lewis, a Denver-based site reliability engineer, wrote via Twitter DM. "In my eyes, this behavior is completely unethical and the work Toby has done for 15 years is indefensible. I'm also upset that they have chosen to double down on this position against the community outrage."

"I think this event will mark a turning point in the organization's reputation," added Wikipedia consultant Pete Forsyth in a Twitter DM. "It's hard to see how they can recover the trust they seem to have almost willfully dismantled today."

Not everyone is downbeat about the future of the company. University of Surrey cybersecurity professor Alan Woodward called Roberts an "interesting hire" for Raspberry Pi. "His previous uses of the Pi shows just what a versatile device it is: I'm sure he's not the only one using the smallest variants to make covert devices," Woodward said. "You find that you have to be very creative to build these types of covert devices, so hopefully he can now bring that to his new role, for a wider variety of applications."

"It's not as if he is going to corrupt any of the Pis -- like all technology, it has some uses some people will object to," he said. Rather, Woodward believes "the loudest objectors are taking it a bit far. Maybe they could look at it as a glass-half-full situation: Think of the unusual innovations he might bring."