Episode 132 - The Dan Cuthbert Keynote Episode

This week in InfoSec (11:40)

With content liberated from the “today in infosec” twitter account and further afield

7th December 1999: RIAA Sues Napster

The Recording Industry Association of America sues the peer-to-peer file sharing service Napster alleging copyright infringement for allowing users to download copyrighted music for free. The RIAA would eventually win injunctions against Napster forcing the service to suspend operations and eventually file bankruptcy. In the end the RIAA and its members would settle with Napster’s financial backers for hundreds of millions of dollars.

While the case was ostensibly about copyright violations, the bigger picture for the RIAA was also about control. The recording industry in general was caught with its pants down when it came to digital music and the Internet. They were not prepared for the sudden popularity of digital music downloads that Napster introduced and were not ready with a model to monetise downloaded music. This lawsuit, along with future lawsuits targeting individuals, was intended to squash the practice of downloading music as much as it was to recover compensation. However, the practice of downloading music could not be stopped as other non-centralised peer-to-peer file sharing services popped up in place of Napster. 

4th December 2001: Goner Worm Hits the Internet

Disguised as a screen saver and spread through an infected user’s Microsoft Outlook e-mail software, the Goner worm spreads through the Internet at a pace second only to the Love Bug virus the previous year. Goner was estimated to cause about $80 million dollars in damage.

Rant of the Week (20:41)

Egad, did Apple do something right? End-to-end encryption for (most) iCloud services

Apple says it will provide end-to-end encryption for most iCloud services, having abandoned its previously announced – and then quietly shelved – plan to check the legality of on-device photos prior to cloud synchronisation.

Cupertino announced three security enhancements on Wednesday, one of which it calls Advanced Data Protection. "Advanced Data Protection is Apple's highest level of cloud data security, giving users the choice to protect the vast majority of their most sensitive iCloud data with end-to-end encryption so that it can only be decrypted on their trusted devices," explained Ivan Krstić, Apple’s head of security engineering and architecture, in a canned statement.

Apple already offers end-to-end (E2E) encryption by default for 14 iCloud services, including passwords in iCloud Keychain and Health data. But the iBiz has not made E2E encryption broadly available for iCloud, preferring instead to retain access to a significant amount of the customer data on company servers. That has suited law enforcement authorities, who continue to worry aloud about being left in the dark by encryption.

Billy Big balls of the Week (31:57)

Brief update on last week's story: San Francisco terminates explosive killer cop bots

San Francisco legislators this week changed course on their killer robot policy, banning the police from using remote-control bots fitted with explosives. For now.

On Tuesday, the city's Board of Supervisors voted unanimously to explicitly prohibit lethal force by police robots following a public backlash and worldwide media attention. Under a previously approved policy, SF police robots under human control could have used explosives to kill suspects. The droids were not allowed to use guns.

States label TikTok 'a malicious and menacing threat'

Two more US states have launched aggressive action against made-in-China social media app TikTok.

Texas on Wednesday banned the app from government devices, with governor Greg Abbott ordering [PDF] the ban "to protect sensitive information and critical infrastructure from TikTok."

"TikTok harvests vast amounts of data from its users' devices – including when, where, and how they conduct internet activity – and offers this trove of potentially sensitive information to the Chinese government," Abbott wrote.

Which is tame compared to the actions and language used by Indiana's attorney-general, who has decided to sue the Chinese social media platform – twice!

TikTok's Chinese analog, Douyin, contains many more safeguards – including required youth modes, real name authentications, bans on minors viewing live broadcasts, prevention of salacious material and restrictions on how long and when minors can access the app. 

Chinese users under the age of 14 are limited to 40 minutes of daily use, between 0600 and 2200. Users in the US have no limit and spend an average of 99 minutes per day on TikTok, according to the office of the AG.

"In short, TikTok poses known risks to young teens that TikTok's parent company itself finds inappropriate for Chinese users who are the same age," argues the complaint.

Industry News (38:41) 

Gen Z Internet Users "Normalize" Cybercrime - Report

Swiss Government Wants to Implement Mandatory Duty to Report Cyber-Attacks

Supply Chain Web Skimming Attacks Hit Dozens of Sites

Russia's VTB Bank Suffers its Biggest Ever DDoS

ICO Fines Rogue Nuisance Callers £500,000

UK Government Department Using Unsupported Applications, Reveals Watchdog

NZ Privacy Commissioner Investigates Mercury IT Ransomware Attack

Pet Dog Unmasks Drug Trafficker on Encrypted Chat

Apple Introduces New Data Protections to Increase Cloud Security

Tweet of the Week (46:07)   

https://twitter.com/_noid_/status/1600135215225053184

https://twitter.com/jomc/status/1600637738352627713

Come on! Like and bloody well subscribe!