US dangles $10 million reward for information about Cl0p ransomware gang

The US Department of States national security rewards program, Rewards for Justice RFJ, is offering a reward of up to $10 million for information linking the Cl0p ransomware gang, or any other malicious cyber actors targeting US critical infrastructure, to a foreign government. Advisory from...

Google takes CryptBot to the wood shed

Google is in the midst of a legal campaign designed to take down the creators of a very persistent piece of malware called CryptBot. This malware, which Google claims compromised roughly 670k computers, set about infecting users of the Chrome browser. Unfortunately for the malware campaign...

WhatsApp lawsuit against NSO Group greenlit by Supreme Court

On Monday, the US Supreme Court denied the NSO Group's petition for a writ of certiorari, a request to the high court to review its case, signaling that Meta's WhatsApp can go ahead with its case against the Israeli-based company behind the Pegasus spyware. The court didn't explain why it refused...

4 times students compromised school cybersecurity

For many students school can be a tough time, and we've all heard stories about bored or frustrated kids compromising school cybersecurity to change grades. Sometimes the students are celebrated, and other times it ends in them being expelled from school, or even prosecuted. Of course, these acts...

What Counts as “Good Faith Security Research?”

The U.S. Department of Justice DOJ recently revised its policy on charging violations of the Computer Fraud and Abuse Act CFAA, a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging securit...

US offers huge reward in fight against state-sponsored cybercriminals

The US Department of State has announced that its Rewards for Justice RFJ program is now offering: …up to $10 million for information leading to the identification or location of any person who, while acting at the direction or under the control of a foreign government, participates in malicious...

The Supreme Court Narrowed the CFAA

In a 6-3 ruling, the Supreme Court just narrowed the scope of the Computer Fraud and Abuse Act: In a ruling delivered today, the court sided with Van Buren and overturned his 18-month conviction. In a 37-page opinion written and delivered by Justice Amy Coney Barrett, the court explained that the...

Security Vulnerabilities in Cellebrite

Moxie Marlinspike has an intriguing blog post about Cellebrite, a tool used by police and others to break into smartphones. Moxie got his hands on one of the devices, which seems to be a pair of Windows software packages and a whole lot of connecting cables. According to Moxie, the software is...

How one data scientist is pioneering techniques to detect security threats

Data science is an increasingly popular field of study that’s relevant to every industry. When Maria Puertas Calvo was a student, she never imagined that one day she would pioneer data science techniques to detect security threats. She started her Microsoft career on the Safety Platform team,...

Adversarial Machine Learning and the CFAA

I just co-authored a paper on the legal risks of doing machine learning research, given the current state of the Computer Fraud and Abuse Act: Abstract: Adversarial Machine Learning is booming with ML researchers increasingly targeting commercial ML systems such as those used in Facebook, Tesla,...

FBI Denies Service to 15 DDoS-for-Hire Sites, Charges Operators

The Justice Department has taken 15 internet domains associated with DDoS-for-hire services offline, and has filed charges against three defendants who allegedly ran them. DDoS for hire or DDoS-as-a-service operations make it simple for any layperson to carry out DDoS attacks, flooding targets wi...

Alleged ‘Satori’ IoT Botnet Operator Sought Media Spotlight, Got Indicted

A 20-year-old from Vancouver, Washington was indicted last week on federal hacking charges and for allegedly operating the "Satori" botnet, a malware strain unleashed last year that infected hundreds of thousands of wireless routers and other "Internet of Things" IoT devices. This outcome is hard...

New Bill Seeks Basic IoT Security Standards

Lawmakers in the U.S. Senate today introduced a bill that would set baseline security standards for the government's purchase and use of a broad range of Internet-connected devices, including computers, routers and security cameras. The legislation, which also seeks to remedy some widely-perceive...

Mirai Vulnerability Disclosed, But Exploits May Constitute Hacking Back

The Mirai botnet apparently has a weakness that could shut down its ability to flood targets with HTTP requests. But exploiting that vulnerability puts defenders in a gray area with regard to hacking back. Researchers at Invincea Labs discovered three vulnerabilities in Mirai, one of which is the...

Samy Kamkar's ProxyGambit Picks Up for Defunct ProxyHam

Without fail in the weeks leading up to Black Hat and DEF CON, there are inevitably talks that are either pulled by organizers, cancelled by presenters, or strong suggestions are made that the talks don’t happen. This year’s first casualty, Ben Caudill’s scheduled DEF CON demonstration of ProxyHa...

Researchers Wary of Wassenaar Arrangement Proposed Rules

Professional security researchers concerned about proposed changes to the Computer Fraud and Abuse Act CFAA that include stiff penalties for what today is considered legitimate offensive research, are worried about another impending punch to the gut. The Commerce Department’s Bureau of Industry a...

Legal Line Between Security Research, Cybercrime Murky

LAS VEGAS — In his keynote address at Black Hat Wednesday, Dan Geer, the CISO of In-Q-Tel and a respected security luminary noted that the industry has never been closer to the forefront of corporate and government policy decision making. Despite this, security research remains a dangerous busine...

Weaknesses in CFAA language exposed at Black Hat

The Computer Fraud and Abuse Act CFAA can be unsettling even to the most stalwart security researcher. The law, enacted in 1986 and revisited several times since, is still littered with loopholes and nuances that can be leveraged by a prosecutor in a criminal case, or turned against a white hat i...

LulzSec hacker Jeremy Hammond pleads guilty to Stratfor attack, could face 10 years in prison

A computer hacker linked to the group known as Anonymous and LulzSec pleaded guilty on Tuesday to breaking into Stratfor, a global intelligence company. Hammond, 28, was arrested last March and charged with hacking into the computers of Stratfor. Jeremy Hammond and other members of AntiSec, stole...

Reporters legally threatened after revealing vulnerability that exposes sensitive data of 170,000 customers

For millions of low income families, the federal government's Lifeline program offers affordable phone service. But an online security lapse has exposed tens of thousands of them to an increased risk of identity theft, after their Social Security numbers, birth dates and other pieces of highly...