Do You Use 2-Factor Authenitcation Yet? Well, it’s already under attack!
A Drone Tried to Disrupt the Power Grid. It Won’t Be the Last
https://www.wired.com/story/drone-attack-power-substation-threat/
In July of last year, a DJI Mavic 2 drone approached a Pennsylvania power substation. Two 4-foot nylon ropes dangled from its rotors, a thick copper wire connected to the ends with electrical tape. The device had been stripped of any identifiable markings, as well as its onboard camera and memory card, in an apparent effort by its owner to avoid detection. Its likely goal, according to a joint security bulletin released by DHS, the FBI, and the National Counterterrorism Center, was to “disrupt operations by creating a short circuit.”
The drone crashed on the roof of an adjacent building before it reached its ostensible target, damaging a rotor in the process. Its operator still hasn’t been found. According to the bulletin, the incident, which was first reported by ABC, constitutes the first known instance of a modified, unmanned aircraft system being used to “specifically target” US energy infrastructure. It seems unlikely to be the last, however.
++++++++
The Booming Underground Market for Bots That Steal Your 2FA Codes
The call came from PayPal’s fraud prevention system. Someone had tried to use my PayPal account to spend $58.82, according to the automated voice on the line. PayPal needed to verify my identity to block the transfer.
“In order to secure your account, please enter the code we have sent your mobile device now,” the voice said. PayPal sometimes texts users a code in order to protect their account. After entering a string of six digits, the voice said, “Thank you, your account has been secured and this request has been blocked.”
“Don’t worry if any payment has been charged to your account: we will refund it within 24 to 48 hours. Your reference ID is 1549926. You may now hang up,” the voice said.
But this call was actually from a hacker. The fraudster used a type of bot that drastically streamlines the process for hackers to trick victims into giving up their multi-factor authentication codes or one-time passwords (OTPs) for all sorts of services, letting them log in or authorize cash transfers.
++++++++
So what is “the metaverse,” exactly?
These days it seems like everybody and their corporate parent company is talking about “the metaverse” as the next big thing that’s going to revolutionize our online lives. But everyone seems to have their own idea of what “the metaverse” means—that is, if they have any real idea what it means at all.
Meta (formerly Facebook) CEO Mark Zuckerberg and his colleagues mentioned the word “metaverse” 80+ times in under 90 minutes during last week’s Facebook Connect keynote presentation, where the company announced its new name.
Zuckerberg described a grandiose vision of the metaverse as an “even more immersive and embodied internet” where “you’re gonna be able to do almost anything you can imagine—get together with friends and family, work, learn, play, shop, create—as well as entirely new categories that don’t really fit how we think about computers or phones today.” That helps a bit, but any description that includes the words “almost anything you can imagine” is so broad as to be almost meaningless.
A shared universe of IP from multiple major companies
This element of the metaverse idea was heavily popularized by Ready Player One, the 2011 novel and 2018 movie featuring a virtual world that combined elements of countless nostalgic media properties, from Joust and Dungeons and Dragons to WarGames and Monty Python and the Holy Grail.
Or, as Take-Two’s Zelnick put it, “If you define metaverse as ‘everything we do in the world physically will become digital,’ then you’re talking to a skeptic.”
++++++++
How Is Zero Trust Different From Traditional Security?
A good example of a traditional security approach is if you’re in the office, you can access the full network even though you only need access to a specific portal. Or imagine getting into a multifloor club; in a traditional security approach, the bouncer checks your ID and you can go anywhere. But in a zero-trust approach, getting into the club is only the first check. The bartender or waitress must also check your ID before you could be served regardless of where you are in the club.
++++++++
Facebook, Citing Societal Concerns, Plans to Shut Down Facial Recognition System
https://www.nytimes.com/2021/11/02/technology/facebook-facial-recognition.html
Facebook plans to shut down its decade-old facial recognition system this month, deleting the face scan data of more than one billion users and effectively eliminating a feature that has fueled privacy concerns, government investigations, a class-action lawsuit and regulatory woes.
Facebook is not the first large technology company to pull back on facial recognition software. Amazon, Microsoft and IBM have paused or ceased selling their facial recognition products to law enforcement in recent years, while expressing concerns about privacy and algorithmic bias and calling for clearer regulation.
In China, authorities use the capabilities to track and control the Uighurs, a largely Muslim minority. In the United States, law enforcement has turned to the software to aid policing, leading to fears of overreach and mistaken arrests. Some cities and states have banned or limited the technology to prevent potential abuse.
++++++++
Tagalong robots follow you to learn where you go
https://arstechnica.com/gadgets/2021/11/tagalong-robots-follow-you-to-learn-where-you-go/
It’s a simple idea that has captured people’s imaginations with depictions in science fiction, like R2-D2 and BB-8 from Star Wars, and in reality, with research projects like DARPA’s robotic pack mule.
In farm fields, Burro offers what looks like an autonomous driving pallet on the body of a four-wheel ATV that can move freely between the rows of California fruit orchards.
To train a Burro robot, you simply press a Follow button and start walking; at the end of the path, you press the button again. Using up to 20 cameras, computer vision, and GPS, Burro follows you and memorizes the route. It can then ferry goods unassisted and communicate the path to other Burro robots.
++++++++
Finally, a list of Known Exploited Vulnerabilities
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
The Federal Cybersecurity & Infrastructure Agency has published a list of all major vulnerabilities that are currently being exploited by the bad guys. And now it’s available to anyone who wants to try and protect their systems via updates. (And if you’re a Federal Agency, they even have specified dates to have each of them completed.)
++++++++
Mitre Publishes the Definitive Guide to How Attacks Happen. Here are the 5 MITRE ATT&CK Tactics Most Frequently Detected by Cisco Secure Firewalls
The MITRE ATT&CK framework describes attacker behavior as tactics and includes the actions attackers take to accomplish that behavior as techniques. Many common firewall rules can be mapped to MITRE ATT&CK; the above chart lists the tactics and associated techniques firewalls frequently encounter.
++++++++
