Skip to content Skip to navigation

Friday Cyber News, February 23 2018

Cyber technology-related news and links from around the web, for the week of 2/17 - 2/23:

1. The recent Mueller indictment of Russian social media influence operations sidesteps the homegrown nature of the tools the Russians used--developed by US digital marketers, that is, and rewarded by the tech platforms on which they are monetized. In some cases, the platforms are a step behind in identifying malicious accounts and their algorithm-gaming techniques, making it unlikely that disinformation will be removed from the platforms by the midterm elections. The operatives employed by the Internet Research Agency have spent years honing the craft of sounding like Americans online, taking tests on 'tweeting about Hillary Clinton and vegetarianism' and performing elaborate role-playing scenarios in public comment sections (and it's not that hard; the 'savviness gap' means that the average internet content creator knows much more about what's possible to fake online than the average content consumer). Turning from identifying the perpetrators of influence operations to identifying their targets, the Wall Street Journal has revealed that its paywall analyzes data about each visitor to tune access based on that visitor's propensity to subscribe, calculated based on prior visits, demographic data, browsing history, and other indicators. That's a great tool for a sales team, and a missed opportunity for a company with a mission to inform the public--similar visitor data could be used to instead tune the paywall to allow access to those most in need of unbiased information, such as those targeted by disinformation campaigns, those who have recently viewed hoax videos or articles, or those whose browsing history reveals an attempt to research a controversial issue. [The Atlantic; WSJ; Washington Post; The Outline; Nieman Lab]

2. A new report by New America analyzes the legal, political, and diplomatic challenges posed by cross-border data flows and proposes regulation around data flow control points that are geography-agnostic. A counterpoint: as seen in United States v. Microsoft, tech companies' design choices could address these problems directly, by setting geographic rules about data storage or allowing users to choose where their data are stored. ("Borders? I have never seen one. But I have heard they exist in the minds of some people...”). Another report out this week by the East West Institute engages again with the encryption debate around law enforcement access to plaintext; as Stanford's Herb Lin notes, the report's proposals ask more of device and software manufacturers than they do of law enforcement. [New America; Just Security; EWI; Lawfare]

3. Reversing its previous position hinting at a ban on cryptocurrency exchanges, South Korea now actively supports "normal" cryptocurrency trading, after the former South Korean cryptocurrency regulator was found dead in his home over the weekend (probably from a heart attack while sleeping; far be it from this newsletter to spread suspicion). After recent large thefts from other exchanges, 16 Japanese cryptocurrency exchanges are banding together to form a self-regulating body with the intent of better safeguarding customer deposits. After briefly spiking transaction fees caused Valve and Stripe to stop supporting bitcoin payments, transaction fees have sunk back to under $1, partially due to the roll-out of Segregated Witness. The US government wants to sell its seized bitcoins--from the Silk Road and other busts--but often can't move fast enough to keep up with market volatility and sell at local maxima. New York City does not need its own cryptocurrency pegged to property values (so...a municipal bond?); Venezuela claims that its Petro cryptocurrency raised $735 million, but does not release details on the code behind the token, equivocates on how the oil peg would work, and doesn't allow the petro to be bought for bolivars, leading many to call it a scam (or...an unsecured debt offering?) [Bloomberg; WSJ; Reuters; Ars Technica; Fortune; Nautilus; Reuters; The Hill]

4. Senators Ron Wyden and Claire McCaskill urge US Customs and Border Protection to properly authenticate e-passports, required for the past three years despite CBP lacking the equipment necessary to verify the digital signatures used in the documents. Wyden and others are also concerned about the increasingly lifelike capabilities of software used to produce fake audio and video, calling on Congress to provide a regulatory framework for the authentication of content online. (Elsewhere: is a self-imposed panopticon the only way to protect against deepfakes-style kompromat?) [Senate.gov; The Hill; Lawfare] 

5. Cyber Command's FY19 budget request isn't terribly detailed, but some programs it's working on include continued support for offensive cyber efforts against the Islamic State, "the implementation of a signature diversity capability that will enable the manipulation of tools code so a single tool can look like multiple tools providing a means to minimize risk of discovery", and continued development of a malware triage platform and a tool for identifying anomalous behavior within the DoD network. Another program they might be continuing: short comic books illustrating cyber threat scenarios (framed in a tidy football analogy, and using a cyber weapon of last resort code-named "dark hammer", respectively) [Defense News; Sofrep]

6.​ The SEC updated its disclosure guidelines to note that companies' officers should not sell stock prior to the public disclosure of a breach that has been privately discovered within the company. (E.g., Equifax, Intel) [Cyberscoop; Reuters; Ars Technica]

7. In an attempt to disrupt bot networks, Twitter is removing the ability to tweet or like tweets from multiple accounts simultaneously. A profile of Twitter's vice president of trust and safety is scathing in its critique of the company's approach to weeding out harassment, concluding that leadership's indecisiveness and the technical limitations of the platform's underlying software architecture are both major problems. [The Hill; Vanity Fair]

8. A chart-heavy dive into questions of interest to future-of-work prognosticators: when will technological unemployment happen, and why hasn't it happened already? [Slatestarcodex]

9. Hackers broke into Tesla's Amazon Cloud account and used it to mine cryptocurrency, one-upping the proof-of-concept Ethereum mining rig in the trunk of a Tesla. The cloud: it's just other people's Teslas. (The breach also exposed some of Tesla's proprietary data, but that's not the fun part). [Fortune; Motherboard]

10. Apple released a new version of iOS this week in response to a bug that would cause an app to crash, requiring reinstallation, upon rendering any two consonants and a vowel in the Telugu, Bengali, or Devanagari languages. So, it's not exactly the case that your apps operate like a golem that can be deactivated with the right inscription, but it's not exactly wrong, either. [Cyberscoop]

Thanks for reading,

Allison
Stanford Cyber Initiative

(To suggest an item for this list, please email aberke@stanford.edu. You can view news from past weeks, subscribe, and unsubscribe at https://tinyletter.com/CyberNewsBytes)