200th episode!, White House cyber vacancies, AT&T SIM bribery, South Africa ultimatum, climate change power crash, Bahgdadi dead, RuNET, NYT insanity, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism…Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Stolen Cards Stolen, Autoclerk Hacked, TeamViewer Hacked, Russia Pretending to be Iranian, JackSpotting, Pixel4 Faces, FrenchFacRec, Samsung Fingerprints, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism…Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Eye reflection EXIF, WiFi gait, Russian Cyber Clusters, Russia African Americans, China Pressure, VPN drama, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism…Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Yahoo creep, DarkNet, E2E encryption, Cyber talent, RandomDeath, Private Data Property, Eyeballer, plus Technology News, Human News, Ideas Trends and Analysis, Updates, Discovery, Recommendations, and the Aphorism for the week!Become a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

New York is suing Dunkin (Donuts) for not revealing breaches in a timely manner (going all the way back to 2015), which is says jeopardized their customers. Good for New York. It's one thing to be breached: it's much worse to try to pretend it didn't happen. MoreNPR wrote an extraordinary piece on how the US penetrated ISIS' communications infrastructure and basically tore it down from the inside. It includes significant details on the operation, which made me cringe as I read them because they were so descriptive. But what we lost in operational surprise we likely gained in deterrence. MoreUyghurs are playing cat and mouse with the Chinese government on the TikTok platform, with the former using videos to show solidarity while the latter searches for and deletes the content. MoreBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Here's the new MITRE 2019 25 Most Dangerous Software Errors. Memory corruption bugs are huge right now. MoreThere's a ton of recent DDoS activity that's leveraging IoT devices for UDP amplification attacks. Specifically, the WS-Discovery service (WSD) is being used because the response to request ratio is so large (from 43% to 15,000%). MoreThere's a lot of chatter out there about Snowden due to his new book coming out, the NSA suing to keep him from making money off of it, him saying he'd like to come home, and him reiterating that he was just trying to do the right thing. Oh, and him saying he's never cooperated with the Russians. This whole situation makes me cautious of anyone with a singular and strong opinion about this, including myself. In 2016 I wrote a short piece about my opinion, and I am pretty much still in the same place with it. In short, if you think he's a hero you're probably wrong, and if you think he's a traitor you're probably wrong. He seems to be some combination of these two things, and from day to day, article to article, and book to book, I simply can't tell how much of which. BookBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Not sure how this isn't bigger news, but Saudi Arabia shut down half its oil production after a number of drones attacked the largest oil processing plant in the world. Yemeni rebels claimed credit, but the US blames Iran. MoreDNS over HTTPS is coming to Chrome as well, so it's not just Firefox. So this is basically where browsers have a preferred DNS server, which works over HTTPS, and ISPs therefore won't be able to see every DNS request that users make. This will be a good thing for reducing the risk of ISPs (and actors with access to their logs) seeing what people are requesting, but it raises questions around filtering, caching networks, and other major components of the status quo. MoreA couple of Coalfire Pentester's got arrested and are still in custody for trying to break into a courthouse that they were actually paid to break into. Evidently, it's not clear whether the physical part was in scope or not. So, no, the get out of jail free card wouldn't have helped. Everyone already knows they were doing it thinking it was ok; the question is next steps. And meanwhile they sit in jail, probably spending all their time mentally working on DEFCON slides. MoreBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

AIG says BEC has overtaken ransomware as the primary claim type against their cyber insurance policies in EMEA, accounting for 23% of claims. More PaperThe NSA Cyber Chief wants to share digital threat information early and often. I like the fact that they're opening up a bit, and I think it's only good for everyone (except bad guys). The more they share the higher the bar is for attackers, and the less time they have to use certain TTPs. This is exactly the type of Government-Industry interaction that we need to be doing more of to stay ahead of China. MoreNYU did a report on how social media is likely to be used for misinformation campaigns in 2020. They say Instagram will be a much bigger player this time around, which makes sense given that images are the dominant meme carrier. Article StudyBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Ring has already partnered with over 400 police departments. As you know, I'm torn on this kind of tech. Neighborhood watch can be a good thing, and it can also be a bad thing. Technology tends to magnify both weaknesses and strengths, so it can make neighborhood watch really great, or it can turn it into a nightmare. The problem is that you can easily start on the positive side, build it all the way up, and then in a few legal, policy, and tech changes have it turn into the oppressive form. Some say this is a reason not to do any of this stuff, but I disagree. We know someone is going to do it, so I think the best thing that can be done is to build a benign version and hope it wins in the market. More People are drawing comparisons between China's social credit system (which is actually multiple systems) and the Silicon Valley's various apps that have internal rating systems. They're saying that these ratings will eventually be used to make decisions about things that matter. Sure, but this has existed throughout human history. Word of mouth, blacklists, etc.: these are all ways of extending the reach of good or bad reputation. I think whenever someone points out the downside of a technology, we should ask ourselves whether that dynamic exists already in the real world, and adjust our opinions accordingly. MoreThe Pentagon is worried that China will beat the US in AI if we don't create a stronger link between the government and both academia and industry, which China is good at. We basically need to move faster from edge concepts to practical implementations, but it's damn hard to do this when we have all sorts of legal and ethical constraints that China doesn't have. Our caution and morality are a definite weakness in this case. MoreBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.

Protestors in Hong Kong are physically attacking and destroying facial recognition cameras. MorePalo Alto says 7 out of 10 new domain registrations (NDRs) are either malicious or not safe for work, and they encourage companies to block them. MoreLt. Gen. Fogarty is fighting to change the name of Army Cyber Command to Army Information Warfare Command, and to give the group a much larger scope in its mission. MoreWe continue to see attacks against open source supply chains, in packages like NPM, RubyGems, Webmin, and many others. It's about to become imperative for people to understand—and to be able to validate—the entire chain of trust that a given application sits upon before they use it. There have been many companies in this space in the past, but I expect to see them (and new players) get a lot more attention soon. MoreBecome a Member: https://danielmiessler.com/upgradeSee omnystudio.com/listener for privacy information.