CYBERSECURITY

Cisco/Talos Researchers Find Attackers Using Slack and Discord to Distribute Malware

Another example of the resiliency and creativity of cyber-attackers is outlined in a new blog by Cisco/Talos researchers, which outlines how, over the past year, and in particular as a result of the migration from work at the office to work from home during the pandemic, cyber-attackers are using collaboration platforms like Slack and Discord to distribute malware to unsuspecting victims. Read more

Q Link Wireless Exposes Information through My Mobile Account App

Dan Goodin, a senior editor at Ars Technica recently reported that Q Link Wireless (Q Link), which buys services in bulk from other wireless carriers and resells them, and provides government-subsidized telephones and services through the FCC’s Lifeline Program to two million customers, has provided “sensitive account data available to anyone who knows a valid phone number on the carrier’s network.” Read more

DATA SECURITY

Maine and North Dakota Are Latest States to Adopt the NAIC Data Security Model Law

Two more state governors, those of Maine and North Dakota, have signed bills into law that adopt the National Association of Insurance Commissioners (NAIC) data security model law (Model Law). Maine and North Dakota join several other states that have already passed similar laws. Hawaii, Idaho, Illinois, Iowa, Minnesota, Rhode Island, and Wisconsin have similar bills pending. Read more

ENFORCEMENT + LITIGATION

Toll Penalties Forgiven After Alleged Illegal Disclosure of License Plate Numbers

I once drove over the Golden Gate Bridge in a rental car, not knowing that it was a toll bridge and that no cash payment options were available. I slowly and stressfully tried to figure out what to do, but realized I had no option but to drive through without paying. It was an awful feeling, but then I saw a sign that said if you didn’t pay the toll, you would be billed for it. I felt better already. Then I saw what the rental company charged on my credit card for the toll: $75.00. Ouch. I wondered how the entity collecting the tolls knew I was in a rental car, and it became obvious to me that there were cameras logging the license plate numbers as vehicles passed through the open toll booths to identify those vehicles and owners who did not pay the toll. I paid the exorbitant bill and learned a valuable lesson. Read more

Presidio Employee Files Class Action Over Data Breach

North American IT company Presidio faces a proposed data breach class action by an employee for an incident involving employee data. Eric LaPrairie, a former Presidio employee, received a notice of a data breach from Presidio, and about a month later found out that he was the victim of a SIM swap (a technique in which a hacker uses personal information to swap someone’s telephone number onto a new phone). After the SIM swap, LaPrairie claims the hacker was able to reset some of LaPrairie’s online passwords and attempted to gain access to his bank accounts and other accounts storing personal documents. Read more

NEW + NOW

CISA Releases Free Tool to Detect Potential Compromised Microsoft Accounts

The Department of Homeland Security Cybersecurity and Infrastructure Security Agency (CISA) recently released a free tool that will assist organizations with identifying indicators of compromise following threat activity in Microsoft 365 and Azure environments. Read more

DRONES

The Endless Frontier Act: Shifting the Focus from Defense to Offense

For the past few years, the main mechanism used by the U.S. against China in the U.S.-Chinese tech war has been Executive Orders limiting (or even banning) certain software and drones manufactured and/or owned by Chinese companies from use by government agencies. Now, instead of only playing defense against Chinese technology, Senators Chuck Schumer (D-NY) and Todd Young (R-IN) have teamed up to support the Endless Frontier Act (Act). Originally introduced in 2020, S. 3832 will be revamped and made a keystone of this new Act. Read more

PRIVACY TIP #280

Using Biometric Information for Payments and Services

Many individuals already use facial recognition technology to authorize payment through their smartphone. This week's privacy tip reviews some areas of concern for those interested in the privacy risks of using these features. Read more