Mozilla praises Apple anti-tracking privacy features in iOS 14

Mozilla, the organization that maintains Firefox and other open source projects, has launched a new campaign in support of a suite of privacy features that Apple is introducing in 2021.

Specifically, the internet company praised Apple’s iOS 14 anti-tracking feature, which makes a specific type of advertising tracking tag opt-in on a per-app basis.

The feature revolves around a new disclosure about Identifier for Advertiser (IDFA) tags. It lets users know that a specific app “would like permission” to track users across other apps and websites, and requires users to explicitly “allow tracking” or disallow it.

________

Why Secure Email Gateways Rewrite Links (and Why They Shouldn’t)

Redirecting a user to a trusted server buys a secure email gateway company some time to decide whether a URL is malicious – but there are avoidable drawbacks to this approach.

Many of today’s most widely used email gateways rely on link rewriting: encoding every URL sent over email into a link that redirects the user to the gateway’s own links. These servers contain unique tokens that track the user and perform later checks to determine whether the link is malicious.

___________

Law Enforcement Disrupts VPN Services Enabling Cybercrime

Global law enforcement agencies have shut down three virtual private network (VPN) services built to help criminals launch ransomware campaigns, phishing attacks, and other illicit activity.

“Operation Nova” was led by the German Reutlingen Police Headquarters, Europol, the FBI, and other agencies around the world. Together, they conducted a coordinated takedown of servers in at least five different countries in addition to seizing domains providing “bulletproof hosting.”

________

Hackers believed to have stolen Treasury Department’s encryption keys, says Sen. Ron Wyden

Hackers who broke into the US government’s computer systems appear to have stolen encryption keys, potentially giving them access to the email accounts of top officials, US Sen. Ron Wyden said Monday.

Following a briefing on the SolarWinds hack — a suspected state-sponsored act of espionage, with fingers pointed at Russia — Wyden issued a statement saying that the hack of the US Treasury Department, in particular, “appears to be significant.”

According to department staff, “the agency suffered a serious breach, beginning in July, the full depth of which isn’t known,” Wyden said. “Microsoft notified the agency that dozens of email accounts were compromised.” (Treasury Secretary Steven Mnuchin’s account was not among those compromised, The New York Times reported.)

____________

Let’s Encrypt comes up with workaround for abandonware Android devices

Things were touch-and-go for a while, but it looks like Let’s Encrypt’s transition to a standalone certificate authority (CA) isn’t going to break a ton of old Android phones. This was a serious concern earlier due to an expiring root certificate, but Let’s Encrypt has come up with a workaround.

Let’s Encrypt is a fairly new certificate authority, but it’s also one of the world’s leading. The service was a major player in the push to make the entire Web run over HTTPS, and as a free, open issuing authority, it went from zero certs to one billion certs in just four years. For regular users, the list of trusted CAs is usually issued by your operating system or browser vendor, so any new CA has a long rollout that involves getting added to the list of trusted CAs by every OS and browser on Earth as well as getting updates to every user. To get up and running quickly, Let’s Encrypt got a cross-signature from an established CA, IdenTrust, so any browser or OS that trusted IdenTrust could now trust Let’s Encrypt, and the service could start issuing useful certs.

____________

GoDaddy is accused of cruelty after it teased 500 employees into replying to email promising Christmas $650 bonus – only to then reveal it was phishing test they FAILED

Internet domain giant GoDaddy is in hot water after sending several employees an email claiming that they would get a holiday bonus, only for it to be a hoax that the company set up to test staff. 

A December 14 email was sent to employees of the Scottsdale, Arizona-based company after staff had already been notified that they would not be receiving bonuses for the holidays this year. 

‘Happy Holiday GoDaddy! 2020 has been a record year for GoDaddy, thanks to you,’ the email, obtained by 12 News, read. It was sent to roughly 500 employees.

________________

How to Understand the Russia Hack Fallout:Not all SolarWinds victims are created equal.

THIS WEEK NEWS broke that United States government agencies and corporations alike—as well as international targets—were victims of a massive nation-state espionage campaign. But as the revelations continue to pile up, and new targets are discovered by the day, it can be hard to get a handle on what exactly happened and what it all means.

The hackers, who have been widely reported as Russian, compromised high-profile targets like the US Commerce, Treasury, Homeland Security, and Energy Departments, as well as companies like the security firm FireEye. All of the attacks appear to stem from one initial compromise of the IT infrastructure and network-management firm SolarWinds. Hackers had breached the company as far back as October 2019, then planted malicious code in software updates to its network-monitoring tool, Orion. Any customer that installed an Orion patch released between March and June inadvertently planted a Russian backdoor on their own network.

______________

Joe Biden says US will hit Russia with cyberattacks in retaliation for data hack

Joe Biden last night suggested he would launch retaliatory cyber attacks against Russia in the wake of a recent massive data breach of the US government.

The hacking was apparently carried out by Russia and posed a “grave risk” to national security that cannot “go unanswered,” the president-elect said.

Mr Biden said: “They can be assured we will respond, probably respond in kind. There are many options I will not discuss now.”

Asked why he would not lay out the details of his response, he said: “We don’t sit here and say we’re going to strike you with a nuclear weapon and so on.