Tag Archive for: obvious

Crypto Mining Hackers vs. Cloud Computing—Google States the Obvious

/in


Google’s new Cybersecurity Action Team (CAT) would like you to know that insecure cloud instances can be hijacked by hackers. And the #1 workload they use to steal your CPU time is cryptocurrency mining.

Stop the press. Did we really need to be told that? Seems pretty obvious. It’s hardly the first time we’ve heard about thieves creating imaginary money with stolen IaaS compute resources.

But let’s look closer. In today’s SB Blogwatch, we see if there’s a “there” there.

Your humble blogwatcher curated these bloggy bits for your entertainment. Not to mention: Seltsame Fakten zu Deutschland.

GCP CAT Fluff

What’s the craic? Simon Sharwood says—“Google advises passwords are good, spear phishing is bad, and free clouds get attacked”:

“Authentication and security are good ideas”
The report advises that analysis of 50 recently hijacked Google Cloud instances revealed 86 percent were put to work mining cryptocurrency. Crims got in because, in 48 percent of cases, operators didn’t have a password, had a weak password, or didn’t bother authenticating APIs.
…
Thanks, Google! We’re not sure [we] could have figured out that authentication and security are good ideas. … Perhaps future reports, which are promised to offer “Early Warning announcements about emerging threats requiring immediate action” will prove a little more exciting.

Is that snark entirely fair? Scott Chipolina clears away the turkey—“Hackers Are Breaking into Cloud Accounts to Mine Crypto”:

“Obtaining profit”
A Google Threat Horizon Report … published by the Google Cybersecurity Action Team … has raised concerns over hacked cloud accounts being used to mine cryptocurrency. … According to the report, the two common goals behind this activity involve “obtaining profit” and “traffic pumping.”

O RLY? Dan Milmo adds leftover cranberries—“Cryptocurrency miners using hacked cloud accounts, Google warns”:

“Poor customer security”
“Mining” is the name for the process by which blockchains such as those that underpin cryptocurrencies are regulated and verified, and requires a significant amount of computing power. … In the majority of cases the…

Source…

The U.S. Wants to Crack Down on Sales of Commercial Hacking Tools for Obvious Reasons

/in


After a slew of hacking scandals involving private surveillance companies, the U.S. is looking to impose new restrictions on the sale of commercial hacking tools—in the hopes of clamping down on abuse perpetuated by the industry.





© Photo: KIRILL KUDRYAVTSEV/AFP (Getty Images)


On Wednesday, the Commerce Department announced a rule change that will put new limitations on the resale or export of “certain items that can be used for malicious cyber activities.” This applies to tools used to infiltrate digital systems and conduct surveillance—such as the notorious commercial spyware, Pegasus—as well as other hacking and “intrusion” software, the Washington Post first reported. The rule, which has reportedly been in development for years, will be put into effect in 90 days.

Loading...

Load Error

While the intricacies of the new 65-page rule are somewhat thorny, the biggest result is a new license requirement for American companies that want to sell hacking tools to countries “of national security or weapons of mass destruction concern,” as well as to “countries subject to a U.S. arms embargo,” the Commerce Department’s announcement says. Roughly translated, this means that America’s biggest geopolitical rivals—namely, Russia and China—are on that list, along with a few others. Firms that wish to sell hacking tools to those countries will now have to acquire a special license from the Commerce Department’s Bureau of Industry and Security. Requests for such licenses will be reviewed on an individual basis to determine whether they are appropriate.

“The United States Government opposes the misuse of technology to abuse human rights or conduct other malicious cyber activities, and these new rules will help ensure that U.S. companies are not fueling authoritarian practices,” the announcement states.

The new changes, while apparently long percolating, come on the heels of multiple, high-profile hacking scandals that have threatened human rights and involve malicious cyber activities. Most prominently, the spyware firm NSO Group has been at the center of ongoing controversy, spurred by the publication of a large journalistic investigation detailing

Source…

T-Mobile Still Pretending That Staying At Trump’s DC Hotel Isn’t An Obvious Ploy To Gain Merger Approval

/in

In a letter responding to Congressional inquiry, T-Mobile has confirmed that the company dramatically ramped up its patronage of Trump’s hotel in DC as it sought regulatory approval of its $ 26 billion merger with Sprint. A copy of the letter, obtained by the Washington Post, makes it clear that the company spent upwards of $ 195,000 at the property since it originally announced the telecom industry’s latest megadeal last April. That was a dramatic shift from the period of time before the deal was announced:

“T-Mobile’s patronage of President Trump’s Washington hotel increased sharply after the announcement of its merger with its Sprint last April, with executives spending about $ 195,000 at the property since then, the company told congressional Democrats in a letter last month. Before news of the megadeal between rival companies broke on April 29, 2018, the company said, only two top officials from T-Mobile had ever stayed at Trump’s hotel, with one overnight stay each in August 2017.

T-Mobile has also hired former Trump ally Corey Lewandowski and former FCC Commissioners Robert McDowell and Mignon Clyburn to “consult” on the deal and grease the wheels of approval. T-Mobile CEO John Legere has consistently tried to play this obvious attempt at pandering to Trump as just unrelated happenstance:

Amusingly, Legere built his entire brand on being a “no bullshit” alternative to AT&T and Verizon. Yet here we are.

As Legere has attempted to sell the press, public, and regulators on the deal, he’s adopted many of his competitors’ worst habits. It’s been clearly documented in countries like Canada or Ireland that when you reduce the total number of major wireless competitors from four to three, it results in dramatically higher rates as the incentive to compete on price is proportionally reduced. Such telecom mergers almost always result in significant layoffs as redundant positions are eliminated. Wall Street predicts T-Mobile’s merger will be no different, eliminating anywhere between 10,000 and 30,000 jobs.

This is not alien territory. In US telecom, these megadeals almost uniformly make the sector worse, as your wallet can attest. Yet both Sprint and T-Mobile execs have engaged in the same old game of Charlie Brown and Lucy football, breathlessly insisting that this deal will somehow be different. At the same time, execs continue to pretend that kissing Trump’s ass by staying at his DC hotel isn’t an obvious lobbying strategy for the company:

“While we understand that staying at Trump properties might be viewed positively by some and negatively by others, we are confident that the relevant agencies address the questions before them on the merits,” (T-Mobile) wrote.

That makes one of you. The Trump FCC has been a glorified rubber stamp for absolutely every pipe dream telecom lobbyists can cook up, be it killing popular net neutrality rules (something Legere supported) or literally weakening the definition of the word “competitive” to make life easier on the sector’s biggest players. While the DOJ is less certain (though still sounding likely from what I’ve heard), there’s zero doubt that the FCC will rubber stamp this merger, likely piggybacking on T-Mobile’s (false) tailor-made claims that the deal is essential if the United States doesn’t want to “fall behind” in the “race to 5G.”

Once Legere gets done bullshitting his way to merger approval, he’ll have to quickly pivot back again to pretending he’s the “no bullshit” alternative to the other major wireless carriers. But of course as just one of three remaining competitors, history has shown us time and time again how T-Mobile will have less incentive than ever to seriously compete on price, and will, sooner or later, come to resemble AT&T and Verizon in all the wrong ways.

Permalink | Comments | Email This Story

Techdirt.

Need for ‘smart’ regulation of IoT security is as obvious as is it unlikely

/in

Security expert Bruce Schneier has a new essay out that makes this case: The only way to prevent the exploitation of insecure internet of things devices from causing catastrophic damage is government regulation, noting “our choice is between smarter government involvement and stupider government involvement.”

His premise would appear unassailable. The problem is we don’t necessarily get to choose; sometimes the difference between smarter and stupider is foisted upon us.

Schneier writes of the growing IoT threat:

It’s a form of invisible pollution. … And, like pollution, the only solution is to regulate. The government could impose minimum security standards on IoT manufacturers, forcing them to make their devices secure even though their customers don’t care. They could impose liabilities on manufacturers, allowing companies like Dyn to sue them if their devices are used in DDoS attacks. The details would need to be carefully scoped, but either of these options would raise the cost of insecurity and give companies incentives to spend money making their devices secure. …

To read this article in full or to leave a comment, please click here

Network World Paul McNamara