The Department of Justice is proposing a set of voluntary principles that take aim at tech giants in an effort to combat online sexual abuse.

The principles are part of a fresh effort by the government to hold the tech companies accountable for the harm and abuse that happens on their platforms, amid the past two years of brewing hostilities between the government and Silicon Valley. But critics also see it as a renewed push to compel tech companies to weaken or undo their warrant-proof encryption efforts under the guise of preventing crime and terrorism.

U.S. Attorney General William Barr announced the proposals at the Justice Department on Thursday with international partners from the U.K., Canada, Australia and New Zealand.

The principles, built by the five countries and tech leaders including Facebook, Google, Microsoft and Twitter aim to incentivize internet companies and social media giants to do more to prevent child sexual abuse on their platforms.

Barr said he hopes that the principles set new norms across the tech industry to make sure theres no safe space on the internet for offenders to operate.

The principles come ahead of anticipated bipartisan legislation to Congress the so-called EARN IT Act, which reports say could effectively force the tech companies hands by threatening to pull their legal immunities for what their users post if the companies fail to aggressively clamp down on online child sexual abuse.

Sens. Lindsey Graham (R-SC) and Richard Blumenthal (D-CT) announced the legislation shortly after the Justice Department presser ended.

The bill got quick rebuke from Senate colleague, Ron Wyden (D-OR), calling the bill deeply flawed and counterproductive bill.

This bill is a transparent and deeply cynical effort by a few well-connected corporations and the Trump administration to use child sexual abuse to their political advantage, the impact to free speech and the security and privacy of every single American be damned, said Wyden.

Barr warned that the government is analyzing the impact of Section 230 of the Communications Decency Act, which protects tech platforms from legal liability for content created by their users.

Under Barr, the Justice Department has taken a particular interest in dismantling Section 230. Last month, the Justice Department hosted a workshop on Section 230, arguing that the immunity it provides interferes with law enforcement and needs to be reexamined.

We must also recognize the benefits that Section 230 and technology have brought to our society, and ensure that the proposed cure is not worse than the disease, Barr said last month.

Any change to Section 230, widely regarded as the legal underpinning of all online platforms, could radically alter the landscape of the modern internet and give the government more power to control online speech. Privacy advocates view the governments interest in wielding Section 230 as a cudgel and existential threat to the internet as we know it.

Last month, Wyden, one of Section 230s co-authors, condemned the Trump administrations scrutiny of the law and argued that repealing the law would not be a successful punishment for large tech companies. The biggest tech companies have enough lawyers and lobbyists to survive virtually any regulation Congress can concoct, Wyden wrote. Its the start-ups seeking to displace Big Tech that would be hammered by the constant threat of lawsuits.

U.K. Security Minister James Brokenshire lauded the initiatives existing six tech partners, encouraging the rest of the industry to fall in line. Its critical that others follow them by endorsing and acting on these principles. The minister claimed that plans to encrypt tech platforms are sending predators back into the darkness and away from artificial intelligence advances that can expose them.

Barr also questioned if disappearing messages or certain encryption tools appropriately balance the value of privacy against the risk of safe havens for exploitation?

But privacy groups remain wary of legislative action, fearing that any law could ultimately force the companies to weaken or break encryption, which government officials have for years claimed helps criminals and sexual predators evade prosecution.

End-to-end encryption has become largely the norm in the past few years since the Edward Snowden revelations into the vast surveillance efforts by the U.S. and its Five Eyes partners.

Apple, Google and Facebook have made encryption standard in its products and services, a frequent frustration for investigators and prosecutors.

But last year, the Five Eyes said it would contemplate forcing the matter of encryption if tech giants wouldnt acquiesce to the pacts demands.

The government has called for responsible encryption, a backdoor-like system that allows governments to access encrypted communications and devices with a key that only it possesses. But security experts have universally panned the idea, arguing that there is no way to create a secure backdoor without it somehow being vulnerable to hackers.

The bill has already received heavy opposition. Facebook said that child safety is a top priority, but warned that the EARN IT Act would roll back encryption, which protects everyones safety from hackers and criminals.

Its a similar anti-encryption bill to one that Sens. Dianne Feinstein (D-CA) and Richard Burr (R-NC) introduced in 2016, which would have forced tech companies to build backdoors in its systems. The bill failed.

The Electronic Frontier Foundation said the bill would undermine the law that undergirds free speech on the internet. Firefox browser maker Mozilla said the bill creates problems rather than offering a solution.

The law enforcement community has made it clear this law is another attempt to weaken the encryption that is the bedrock of digital security, said Heather West, Mozillas head of Americas policy. Encryption ensures our information from our sensitive financial and medical details to emails and text messages is protected.

Without it, the world is a far more dangerous place, said West.

Read more from the original source:
US threatens to pull big techs immunities if child abuse isnt curbed - TechCrunch

Let's Encrypt has halted its plans to cancel all three million flawed web security certificates after fearing the super-revocation may effectively break a chunk of the internet for netizens.

Earlier this week, the non-profit certificate authority, which issues HTTPS certs for free, announced a plan to disable some three million certificates tainted by a software bug.

The programming blunder, in Let's Encrypt's automated certificate management software, affects users who create a certificate for a domain and then, some days later, create more related certificates the code bungled the rechecking process that needed to take place.

Website owners were told to fix their certs as soon as possible because mass revocation would begin on March 4, at 16:00 PT (00:00 UTC). Failure to take action meant visitors to unamended websites would see warnings of insecure connections in their browsers. The culling process actually began March 4, 00:00 PT (20:00 UTC).

The short timeline is a consequence of the Baseline Requirements that Certificate Authorities agree to follow. Even so, Let's Encrypt only managed to make it halfway through the process before calling time.

In a forum post on Wednesday, Josh Aras, executive director of Let's Encrypt, announced a delay to avoid undue damage to the internet.

"Unfortunately, we believe its likely that more than one million certificates will not be replaced before the compliance deadline for revocation is upon us at March 5 19:00 PT (03:00 UTC, 21:00 US EST)," wrote Aras. "Rather than potentially break so many sites and cause concern for their visitors, we have determined that it is in the best interest of the health of the Internet for us to not revoke those certificates by the deadline."

By the compliance deadline this evening, Aras said 1,706,505 certificates that have been replaced would have been revoked. And 445 certificates that forbid issuance by Let's Encrypt were treated as high-priority targets for revocation.

As for the remaining 1.3 million or so, some of these will be revoked when Let's Encrypt is certain that doing so will not cause undue disruption. Other bad certs left untreated should die of old age. Aras said that since Let's Encrypt certificates only have 90 day lifetimes (they designed for auto-renewal), unfixed certs will expire on their own if not dealt with.

The Register asked Let's Encrypt whether the owners of the spared certs have been told they have extra time. Evidently, they haven't.

"The original set of affected subscribers for whom we have email addresses were sent an email letting them know of the error with their certificates," a spokesperson said.

"That email guided them to our forum to get help and the most updated information. The forum is the best place to interact with Let's Encrypt, so we aim to drive people there as much as possible."

Sponsored: Quit your addiction to storage

View post:
Let's Encrypt: OK, maybe nuking three million HTTPS certs at once was a tad ambitious. Let's take time out - The Register

The traditional threat landscape comprised of conventional IT assets is difficult enough to protect, detect and respond to, but the landscape seems to be quickly expanding beyond traditional IT. Those new domains are operational technology (OT), the internet of things (IoT) and the internet of medical things (IoMT).

Devices from non-traditional IT environments are finding their way onto corporate intranets, which can create a shadow IT environment. These devices are unmanaged and some managers dont have a full understanding of the risks associated with these devices. More visibility into these devices could help a chief information security officer (CISO) to understand whether they are acting appropriately. As the number of connected devices within an enterprise grows, so too does the attack surface if these connected and shadow devices do not have security built into them. This wave of digital transformation provides new attack vectors that could come with significant and far-reaching risk and liability.

Industrial organizations are adding many connected technologies into the manufacturing process, such as industrial control systems (ICS), supervisory control and data acquisition systems (SCADA), distributed control systems (DCS), programmable logical controllers (PLC) and smart sensors. Manufacturing environments have devices on the assembly line and robots, oil pipelines have pressure sensors, and food facilities have temperature sensors. With the addition of these numerous connected devices can come mounting security risks to critical infrastructure.

A yearly research study conducted by IBM shows that in 2019 there was a 2,000 percent increase in OT cybersecurity attacks. Yes, you read that correctly 2,000 percent. As operational organizations and industries experience innovation and connectivity, bad actors can take notice and execute security attacks. To help mitigate these risks, organizations can adopt an operational technology security strategy.

As businesses modernize their operational equipment and traditional IT systems rely on operational data to optimize and improve organizational metrics, the two environments are converging. Traditional IT infrastructure can control physical assets in the operational technology domain, and this overlap allows an IT breach to target OT devices. In 2019, IBM X-Force Incident Response and Intelligence Services (IRIS) responded to a breach where ransomware infected an IT system and moved laterally into OT infrastructure. The attack brought plant operations to a halt and caused a ripple effect in global markets. Research also shows that threats to industrial control systems and operational technology will likely continue to grow.

The combination of digital transformation and the Internet of Everything can reshape the modern landscape of goods and services. Additionally, the new dawn of 5G could bring blazing connection speeds and have significant impacts on the number of connected devices. If we look across offices, factories, hospitals and transportation networks, we see numerous devices throughout the organization:

All of these devices are designed to connect and transmit information to other devices and systems. However, IoT devices can present a rapidly growing enterprise security risk. Why is that? IoT devices generally do not have security agents installed. Security agents are pieces of software that allow the collection of device data and enable protection of the device. However, there are connected and unmanaged smart devices that do not have this capability. These issues can make IoT devices easier for attackers to access remotely. IBMs Threat Intelligence Index reports widespread use of command injection (CMDi) attacks containing instructions to download malicious payloads targeting various types of IoT devices. Because many IoT devices do not have security agents to monitor these attacks, we need to take an agentless approach to help gain visibility into devices and their activity on a network.

How do you implement an agentless approach? Machine learning (ML) and artificial intelligence (AI) are a big part of it. Security providers first create an enterprise-scale knowledge base of an organizations devices and combine that with a device behavior crowdsourcing engine. This crowdsourcing engine uses ML and AI to determine when a device exhibits abnormal behavior. For example, an IP camera that is behaving differently than hundreds of others across a clients environment can be flagged as a possible threat.

Additionally, the internet of things is bringing its connectivity to all markets, including the medical industry. The internet of medical things generally refers to a group of medical devices, software applications and infrastructure all connected to the internet. These devices can include heart pumps, patient trackers, blood infusion pumps and more. Patient data captured from these connected devices helps to inform decisions by healthcare providers. Therefore, a cybersecurity threat to these devices could interfere with care and potentially cause physical harm to patients. IBMs Threat Intelligence Index reports that healthcare was the 10th most targeted industry for cybersecurity attacks in 2019.

In short, many organizations are on a journey of digital transformation that is increasing the number of devices and ultimately the variety of threat vectors as potential security targets. The security domain touches on every area of an organization including OT, IoT and IoMT areas.

So how do we provide threat management for all of these connected and unmanaged devices?

The convergence of the device landscape presents a new challenge for organizational security. Attacks against the IoT, for example, need to be analyzed to determine the IT assets the attacker may be ultimately after. In many cases, the IoT or OT device is being utilized as an attack vector only, which ties the security of connected devices to that of traditional IT assets.

Securing these domains requires an integrated approach to threat management and an understanding that threat management is a journey. The NIST Cybersecurity Framework provides a programmatic approach that addresses the entire life cycle of threats. NIST outlines the following five core tasks:

Using a standardized approach such as NISTs can help organize the activities of a security or incident team by outlining a logical, practical approach to incident management. A standards-based approach provides a reliable, repeatable framework for managing multiple types of security incidents and encourages transparency, a shared vocabulary and predictable outcomes in responding to threats.

Potential benefits of using this approach include:

Threat management is the heart and soul of any security organization. Using a standardized approach can help organizations integrate threat and incident life cycle management. Performing NIST functions across the new hybrid landscape can help security organizations manage cybersecurity risks.

IBMs X-Force Threat Management is an integrated program of services and technology designed to help your organization through the entire threat management journey. Our X-Force Threat Management solution helps implement the NIST framework for the OT, IoT and IoMT domains to bring visibility into unmanaged and connected devices. Our solution offers:

We leverage technology that discovers potential threats in your environment managed and unmanaged devices, both on and off your network as well as in your airspace. IBMs X-Force Threat Management integrates the capabilities of offensive security services, managed security services, artificial intelligence, incident response and continuous improvement. IBM X-Force Threat Management offers integrated threat and incident life cycle management.

Learn more about X-Force Threat Management

The rest is here:
Modernizing Threat Management for the Evolving Attack Surfaces of OT, IoT and IoMT - Security Intelligence

What's old is new again as infosec bods are sounding the alarm over a fresh wave of homoglyph characters being used to lure victims to malicious fake websites.

Researchers at Soluble today said they worked with Verisign to thwart the registration of domain names that use homoglyphs non-Latin characters that look just like letters of the Latin alphabet to masquerade as legit domains.

First reported back in the 2000s, this technique allow miscreants to use characters that, when displayed in the browser bar, appear to show the URL of a valid site such as Apple.com or Google.com despite being a completely different domain name. These bogus sites are designed to look real while phishing credentials or distributing malware. You think you're logging into Google.com from an email or instant-chat link, but really you're handing over your password to a crook.

There have been a number of efforts over the years, most recently in 2017, we reckon, to rid the internet of homograph abuse once and for all.

In the most recent case, it was found that the Unicode Latin IPA Extension characters could and were being exploited to setup lookalike domains.

"Between 2017 and today, more than a dozen homograph domains have had active HTTPS certificates," noted Soluble researcher Matt Hamilton. "This included prominent financial, internet shopping, technology, and other Fortune 100 sites. There is no legitimate or non-fraudulent justification for this activity."

There is no legitimate or non-fraudulent justification for this activity

Normally, it would not be possible to register domains with mixed scripts, as Verisign put protections in place years ago. However, the researchers found that those protections did not extend to Unicode Latin IPA, meaning that prior to Verisign updating its filters after being tipped off by Soluble, the characters could be used to set up lookalike URLs.

"Safeguarding the stability, security and resiliency of the critical infrastructure we operate is our top priority," Verisign said in a statement. "While the underlying issue described by Mr Hamilton is well understood by the global Internet community and is the subject of active policy development by ICANN we appreciate him providing additional timely details about how this issue may be exploited.

"Although we understand that ICANN has been on a path to address these issues globally, we have also proactively updated our systems and obtained the necessary approval from ICANN to implement the changes to the .com and .net top-level domains required to prevent the specific types of confusable homograph registrations detailed in Mr Hamiltons report."

Fortunately, the domains are hard enough to register and set up that miscreants don't want to burn them on anything other than the highest-value of targets.

"While it is unlikely that you, the reader, were attacked with this technique," Hamilton notes, "it is likely that this technique was used in highly targeted social-engineering campaigns."

Sponsored: Quit your addiction to storage

View post:
It has been 15 years, and we're still reporting homograph attacks web domains that stealthily use non-Latin characters to appear legit - The Register

Owners of smart cameras, baby monitors and other Internet of Things products have been urged to help keep their devices safe by following three simple steps to boost cybersecurity and making it more difficult for hackers to compromise them.

The advice from the UK's National Cyber Security Centre (NCSC) the cyber arm of the GCHQ intelligence agency comes as IoT security cameras and other devices are gaining popularity in households and workplaces.

However, these devices can bring additional risks to users, as insecure settings can leave IoT cameras open to hackerswho could use them to snoop on what's going on, or even use the device as a stepping stone to hack into the rest of the network.

SEE:Cybersecurity in an IoT and mobile world(ZDNet special report) |Download the report as a PDF(TechRepublic)

But the NCSC's new guidance paper Smart security cameras: using them safely in your home sets out three things users can do to make it much harder for their IoT devices to be hacked or accessed without authorisation. They are:

1. Change the default password

Many IoT passwords come equipped with a default password that is either short and easy to guess, or the same default password is shipped with all the devices meaning if the password for one device is leaked, it's also leaked for everyone.

The NCSC recommends that users change the password on the device which is most commonly done by using the app used to monitor the device. The advice from the NCSC is to change the password to three random words and to avoid using anything in the list of the most commonly hacked passwords.

2. Apply software updates regularly

Users can go a long way to keeping the IoT camera secure by regularly applying the relevant software updates which often not only add new features, but boost the security of the device. If possible, users should set the device to automatically install these firmware updates, so that the device is protected in the most up-to-date way possible and without the user having to think about doing it by themselves.

SEE:Cybersecurity: Let's get tactical(ZDNet/TechRepublic special feature) |Download the free PDF version(TechRepublic)

3. Disable unnecessary alerts

If users don't need the feature that allows them to remotely view camera footage via the internet, the NCSC recommends disabling it; thus preventing hackers who might be able to gain access to the device from being able to snoop on the room the camera is in.

"Smart technology such as cameras and baby monitors are fantastic innovations with real benefits for people, but without the right security measures in place they can be vulnerable to cyber attackers," said Dr Ian Levy, technical director at the NCSC.

"These are practical measures which we can all take to help us get the most out of our home-based technology in a safe way," he added.

The advice from the NCSC comes shortly after the UK government proposed draft legislation for Internet of Things security that would mean device manufacturers would have to adhere to particular standards in order to sell products to consumers in the UK; however, it remains unclear how these rules will be enforced.

See the article here:
Do these three things to protect your web security camera from hackers - ZDNet