In brief The notorious Russian-aligned Conti ransomware gang has upped the ante in its attack against Costa Rica, threatening to overthrow the government if it doesn’t pay a $20 million ransom.
Costa Rican president Rodrigo Chaves said that the country is effectively at war with the gang, who in April infiltrated the government’s computer systems, gaining a foothold in 27 agencies at various government levels. The US State Department has offered a $15 million reward leading to the capture of Conti’s leaders, who it said have made more than $150 million from 1,000+ victims.
Conti claimed this week that it has insiders in the Costa Rican government, the AP reported, warning that “We are determined to overthrow the government by means of a cyber attack, we have already shown you all the strength and power, you have introduced an emergency.”
Experts who spoke to the AP said they doubt actual regime change is likely, or the goal; Emsisoft analyst Brett Callow told the newswire that the threats are simply noise, and not to be taken seriously.
Callow may be right: News unfolding late this week suggests that Conti has gone offline, and may be breaking into several subsidiary groups. Its political ambitions in Costa Rica may just be a distraction, albeit one that could also turn a tidy profit.
NSA: Trust us, no post-quantum encryption backdoors
The NSA wants to ease everyone’s concerns now: Even though it’s been involved in the US government’s post-quantum encryption research, the spy agency won’t have a backdoor.
Speaking to Bloomberg while discussing the National Institute for Standards and Technology’s post-quantum encryption competition, NSA Director of Cybersecurity (and Christmas-tree hacker) Rob Joyce said the new standards being developed are so strong that “there are no backdoors.”
That would be a departure from previous encryption standards, which the NSA is believed to have had ready access to – until foreign spies acquired a copy of the backdoor software for their own use. The Biden administration recently announced additional funding for post-quantum encryption research, which aims to develop a form of protecting sensitive data so secure that even a quantum computer couldn’t crack it.
The US has been actively working to develop encryption standards able to stand up to quantum computers for some time; Joyce claimed to Bloomberg that the NSA has had its own post-quantum encryption algorithms for several years, but those aren’t part of the NIST competition or available to the public.
Despite spending tens of millions to address the security problems posed by quantum computers, the NSA also readily admits that it has no idea when, or even if, quantum computers able to crack modern public key cryptography will be realized.
Frustrated IT admin gets seven years for deleting company databases
A former database administrator from China who wiped out his employer’s financial records has been sentenced to seven years in prison as a result.
Han Bing, who managed databases for Chinese real estate brokerage Lianjia, allegedly used his administrator access and root privileges to log in to two of Lianjia’s database servers, and two application servers, where he wiped financial data and related applications that took the company’s entire finance system offline, said Chinese news sources.
Bing was reportedly disgruntled with his employer. He repeatedly warned them of security flaws in Lianjia’s finance system but felt ignored and undervalued, Lianjia’s ethics chief testified in court. Bing’s actions directly cost the company around $27,000 to recover data and rebuilt systems, but that doesn’t include the impact of lost business.
Bing was caught when Lianjia questioned everyone with access to the financial systems who had permissions to do what Bing did, of whom there were only five. The company claims that Bing acted suspiciously when asked to present his laptop for inspection, refusing to provide his password and claiming privacy privileges.
The company said it suspected none of the laptops would show traces of the attack, but wanted to see how those it questioned would react. Investigators were later able to recover logs that pointed to Bing’s laptop’s IP and MAC addresses, and crosschecking logs against security footage put Bing in the right place at the right time to be the guilty party.
Apple patches a whopping 98 separate vulnerabilities
Apple has had a busy week: In a series of security updates released Monday and Wednesday, the iMaker patched 98 separate vulnerabilities out of its various software platforms.
The updates in question cover most every bit of software Apple makes: WatchOS, iOS and iPad OS, macOS Monterey, Big Sur and Catalina, Xcode, tvOS, Safari and iTunes for Windows were all included. Most of the vulnerabilities are from the past few months, but one common vulnerability and exposure (CVE) number covered by the updates dates back to 2015.
A few of the vulnerabilities covered by this week’s glut of Apple patches were rolled out previously for one system, but not others, as was the case with CVE-2022-22674 and -22675, which were patched in macOS Monterey, but not older versions, in April. Those vulnerabilities were reportedly being actively exploited at the time.
Malicious applications executing arbitrary code with kernel privileges appears to be the most common type of hole being closed in this round of patches, though some do stand out, like Apple Watch bugs that could let apps capture the screen and bypass signature validation.
On iOS, vulnerabilities patched include websites being able to track users in Safari private browsing mode, while macOS users are being protected against apps being able to bypass Privacy preferences and access restricted portions of the filesystem.
Russian-backing Chaos ransomware variant is pure destruction
Cybersecurity firm Fortinet has discovered a variant of the Chaos ransomware that professes support for Russia’s invasion of Ukraine, but appears to have no decryption key to rescue victims in Putin’s regime.
The variant appears to have been compiled with Chaos’ GUI customization tool as recently as May 16, Fortinet said. The researchers said they’re unsure how the Chaos variant infects its victims, and said the variant doesn’t act any differently than typical Chaos ransomware.
Like other forms of Chaos, it enumerates files on infected systems, and irrevocably damages any larger than around 2MB by filling it with random bytes. Anything smaller is encrypted, but recoverable with a key. Chaos also typically attacks commonly used directories like Desktop, Contacts, Downloads and Pictures, which are encrypted entirely.
Here’s where this Chaos variant differs: It’s overtly political, and instead of offering contact info and a ransom demand, the malware simply says “Stop Ukraine War! F**k Zelensky! Dont [sic] go die for f**king clown,” along with a pair of links to sites claiming to belong to the Information Coordination Center, but offering no information otherwise. Files are also encrypted with a “f**kazov” extension, likely referring to the Ukrainian Azov Battalion.
Fortinet said that this Chaos variant appears unique in the sense it appears designed to be file-destroying malware. “This particular variant provides no such avenue as the attacker has no intent on providing a decryption tool … clearly, the motive behind this malware is destruction,” Fortinet said.
The FortiGuard team behind the research warns that with its GUI, Chaos ransomware has become a commodity product, and it expects additional attacks of this variety to emerge. ®
Swansea City Council has been forced to extend an IT service provider contract to keep its unsupported and unpatched ERP system up and running because its replacement is running two years behind.
A procurement document published last week shows Infosys was awarded £2 million contract (c $2.40 million) extension, until 30 November 2023, to support the Welsh council’s Oracle eBusiness Suite ERP system while it waits for the replacement Oracle Fusion system to be ready. It takes Infosys’s total for supporting the old system to £6.7 million (c $8.1 million).
Council risked failing its Public Service Network accreditation: report
It said using unsupported software “increased the risk of cyber-attacks and potential data theft” while there was also “a risk payroll may not function, staff and pensioners may not be paid.” The report also said the council risked failing its Public Service Network (PSN) accreditation, which meant it could be prevented from sharing data with the health service, police, and the Department for Work and Pensions (DWP).
However, in March 2020, the council invoked a force majeure clause – which alters parties’ contractual obligations – with the support provider Infosys and began discussions to resume the program.
It opted to suspend the program and start back up in February 2021, with the aim to go live in October 2021. The plans said Infosys had agreed to absorb additional costs for this extension.
It said Oracle had agreed to extend support from November 2020 to 2022 so it could get regular updates and patches. “Although this risk still exists, it has been mitigated,” it said.
Given the council has awarded a contract well after the planned go-live of its replacement, it seems those assumptions are under threat. The council has so far failed to respond to The Register‘s request for comment.
Its Fusion project might provide some lessons for the London Borough of Waltham Forest, which plans to have its core solution – a move away from an ageing SAP ERP system – live within a year of the project’s start.
Sony aims to boost the ‘growth of gaming culture’ with two 27-inch monitors and three headsets, designed for both PC and Playstation gamers.
Sony has announced a batch of new monitors and headsets with a focus on PC gamers, as the company looks to reach out to more than its core Playstation audience.
The Inzone range consists of two 27-inch monitors and three headsets, which are all designed to enhance a gamer’s experience. While the main target appears to be PC gamers, the products have features that suit PS5 users.
Sony said its Inzone M9 monitor has 4K resolution and a high contrast with full array local dimming, designed to boost the detail of gaming scenes in deep black and brightness. The monitor also has a 144Hz refresh rate, an IPS display and a 1ms response time. Sony said the monitor will help lead to quicker reactions, which is a clear benefit for competitive PC gamers.
Meanwhile, the M3 monitor will have a 240Hz refresh rate, along with variable refresh rate technology to help gamers “capture movements of rivals in shooter games”.
To go with the monitors, Sony is releasing two wireless headsets, along with the wired Inzone H3 model. The Inzone H9 will have 32 hours of battery life, while the H7 model will have 40 hours.
Speaking on the products, Sony’s head of game business and marketing office Yukihiro Kitajima said there has been a higher interest in gaming with the spread of e-sports tournaments and the advancement of gaming entertainment.
“With Sony’s strong history of high-end audio and visual technology products, we believe this new line will offer even more options for those looking to upgrade their current gaming systems,” Kitajima said.
“We are committed to contributing to the growth of gaming culture by providing PC and PlayStation gamers with a wider range of options to enrich lives through gaming.”
The Inzone headsets range from €300 to €100 and are expected to launch in July, while the M9 monitor is due to launch in the Summer at a cost of €1099. Sony said the pricing and availability of the M3 monitor is expected to be revealed sometime this year.
10 things you need to know direct to your inbox every weekday. Sign up for the Daily Brief, Silicon Republic’s digest of essential sci-tech news.
Many American womenin recent days have deleted period tracking apps from their cellphones, amid fears the data collected by the apps could be used against them in future criminal cases in states where abortion has become illegal.
The trend already started last month when a draft supreme court opinion that suggested the court was set to overturn Roe v Wade was leaked, and has only intensified since the court on Friday revoked the federal right to abortion.
These concerns are not baseless. As with various other apps, cycle trackers collect, retain and at times share some of their users’ data.In a state where abortion is a crime, prosecutors could request information collected bythese apps when building a case against someone. “If they are trying to prosecute a woman for getting an illegal abortion, they can subpoena any app on their device, including period trackers,” said Sara Spector, a Texas-based criminal defense attorney, and ex-prosecutor.
Cycle trackers are popular for a reason. Nearly a third of American women have been using them, according to a 2019 survey published by the Kaiser Family Foundation. They have helped make women’s lives easier in many ways, from family planning and detecting early signs of health issues to choosing the perfect time for a holiday.
A 2019 study published in the British Medical Journal (BMJ) found that 79% of health apps available through the Google Play storethat were related to medicine, including apps that help manage drugs, adherence, medicines, or prescribing information, regularly shared user data and were “far from transparent”. But many of the big players have made progress over the past years.
Two of the most popular period trackers in the US, Flo and Clue, have more than 55 million users combined. The Berlin-based app Clue said it was “committed to protecting” users’ private health data and that it was operating under strict European GDPR laws. The company’s website says the app collects device data, event and usage data, in addition to a user’s IP address, health and sensitive data it may use for the purpose of improving the app, the services, and preventing abusive use of its service. But Clue does not track users’ precise location, and says it does not store sensitive personal data without a user’s explicit permission. The company also tweeted that it would have a “primary legal duty under European law” not to disclose any private health data and it would “not respond to any disclosure request or attempted subpoena of their users’ health data by US authorities”.
But just because data is being processed by a European company, doesn’t mean that it is entirely immune from US prosecution, said Lucie Audibert, a lawyer at Privacy International, a global NGO that researches, litigates and advocates against abuses of technology and data by governments and corporations.
“The fact that GDPR applies is not that relevant in this case. When it comes to a legitimate legal request from US authorities European companies usually comply. Also, a European company may be hosting data outside the EU, making it subject to different legal frameworks and cross-border agreements,” Audibert added. She also stressed that using a Europe-based app won’t protect women from the courts requesting data from them directly. But it can be a slightly better option than using a US-based one because US companies are more easily compelled to comply with American authorities and courts’ requests. Enforcement is more difficult against European ones.
On Friday, Flo announced that it will soon be launching an “Anonymous mode” that can help keep users’ data safe in any circumstances.
The company did not respond to a request for comment.
Stardust did not immediately respond to a request for comment.
Planned Parenthood encourages people to use their app Spot On. “People who want to track their periods and birth control always have the option to remain anonymous by using the Spot On app without creating an account,” the organization said in a statement.“This way, period or birth control data is only saved locally to a person’s phone and can be deleted at any time by deleting the app.”
Third-party apps are not the only option when it comes to period trackers. Apple has a built-in cycle tracker in its Health app that offers more privacy than most external apps. With just a few steps, one can turn off the storing of their health data in iCloud, and it also has the option to store the encrypted data on their computer or phone.
Evan Greer, deputy director of the non-profit advocacy group Fight for the Future, saidthe best way to protect sensitive health data was to only use apps that store data locally rather than in the cloud. “Because any app where a company [that could receive a subpoena] has access to their users’ data could make it vulnerable for a legal request.”
Eva Blum-Dumontet, a tech policy consultant, said, “It is normal that in times of concern, people are looking differently at technology and apps that we trusted.
“I think when there is a discourse around whether women should delete these apps, we have to think about why they use them in the first place,” Blum-Dumontet said. “These trackers help them manage menstrual cycle when they are experiencing pain.”
Blum-Dumontet stressed that instead of asking users to change their behaviors, “it is period trackers that should change their practices”.
“They should never have owned so much data in the first place. If they adopted practices like storing data locally and minimizing the data to what’s strictly necessary we wouldn’t be having this debate now. It’s not too late for them to do the right thing,” she said.
Melissa, a 27-year-old mother from Texas who is goingby only her first name to not jeopardize her employment, said she deleted the app because she fears that when she travels, her state could use her missed period data against her.
“I will miss using the app so much. I have used it for so many things, like tracking my ovulation or predicting my mood changes. Sometimes I wake up feeling irritable, and I don’t know why until my app tells me that this could be normal at this point of my cycle,” she added. Melissa also says she would have loved to use it for future conceptions, but now she can’t.
Although much of the warnings on Friday were focused on just period trackers these are not the only apps that can be used against users when it comes to criminal prosecution,experts warned.
“Google Maps or a random game on your phone could just as easily be weaponized against someone as a menstrual tracking app,” Greer said. “While we need to educate each other and take precautions, it’s not OK to put the responsibility solely on individuals. Companies and lawmakers need to act immediately to protect people.”
The concerns over period tracking data are part of a broader conversation about the amount of personal information smartphones collect. Women’s rights organizations all over the world are warning users to be more mindful of their digital presence, not just when it comes to period trackers.
Cycle tracking apps can be hugely useful for many women, said Jonathan Lord, UK medical director for MSI Reproductive Choices. “But all data can be used against you.”
According to Lord, this danger will remain until “we treat abortion like all other healthcare – regulated like all other medical procedures, but not criminalized”.