Cloud Hosting

The latest version of the highly controversial EARN IT Act that is in committee in the Senate right now may be a more serious threat to strong encryption than the previous versions and could force platform providers into the decision not to even offer encrypted services, lawmakers, civil liberties and technology policy advocates say.

The current iteration of the EARN IT Act is the third one and like the others, its main focus is on identifying and eliminating child exploitation material online. But as in the other versions, the current bill has language that would increase the liability for platform operators that use end-to-end encryption on their services. The bill currently is in the Senate Judiciary Committee, and experts worry that if it passes it will have a severe impact on the security of the services platform owners such as Google, Meta, and others can offer.

The crux of the issue is whether platform operators should know and be responsible for all of the content that passes through their systems.

As introduced, EARN IT dramatically increases the risk of liability for any service that offers end-to-end encryption. Under EARN IT, the use of encryption (or the failure to weaken that encryption) cannot serve as an independent basis for liability. But EARN IT expressly permits courts to consider the use of encryption as evidence to support other claims including under state laws with a lower mens rea requirement, TechFreedom officials said in a letter to Judiciary Committee leaders.

In other words, under the terms of the proposed bill, platform owners would almost certainly have to know whats on the platforms, which would essentially eliminate the use of strong encryption. A separate bill called the STOP CSAM Act has similar language,

Current law does not immunize platforms for criminal conduct. The new bills would drastically drop that requirement so that theyre liable for negligence in civil suits. Platforms would likely have to know whats on the platforms, so they might set up automated content analysis, which is bad, and undermine encryption, said Cody Venzke, senior policy counsel at the ACLU.

Wyden, one of the strongest advocates for encryption and privacy on Capitol Hill, said hes concerned that lawmakers are putting their efforts in the wrong place.

CSAM is a problem and this bill is not the answer. The focus ought to be to help prevent kids from becoming victims in the first place, not on undermining security and privacy, said Sen. Ron Wyden (D-Ore.), during an online event Wednesday.

We need to pass comprehensive privacy legislation in this country. This fight has been the longest running battle since the Trojan War. The root cause of so much bad corporate behavior really is the privacy issue. Tech companies hoover up so much private data and then they misuse it.

Other organizations worry that the EARN IT Acts language could lead to the use of client-side scanning, which allows services to scan users devices for illegal material rather than doing so on the platform side.

Notably, the bill leaves room to impose forms of client- side scanning, which violates user privacy by sending data to law enforcement straight from user devices, before a message is encrypted. EFF has long held that client-side scanning violates the privacy promise of end-to-end encryption, even though it allows the encryption process to proceed in a narrow, limited sense, the Electronic Frontier Foundation said in a letter to the Judiciary Committee leaders.

Read more:
New EARN IT Act Has Old Issues - Duo Security

European Union

Under proposed chat controls regulation, any encrypted service provider could be forced to screen for identifiers

An EU plan under which all WhatsApp, iMessage and Snapchat accounts could be screened for child abuse content has hit a significant obstacle after internal legal advice said it would probably be annulled by the courts for breaching users rights.

Under the proposed chat controls regulation, any encrypted service provider could be forced to survey billions of messages, videos and photos for identifiers of certain types of content where it was suspected a service was being used to disseminate harmful material.

The providers issued with a so-called detection order by national bodies would have to alert police if they found evidence of suspected harmful content being shared or the grooming of children.

Privacy campaigners and the service providers have already warned that the proposed EU regulation and a similar online safety bill in the UK risk end-to-end encryption services such as WhatsApp disappearing from Europe.

Now leaked internal EU legal advice, which was presented to diplomats from the blocs member states on 27 April and has been seen by the Guardian, raises significant doubts about the lawfulness of the regulation unveiled by the European Commission in May last year.

The legal service of the council of the EU, the decision-making body led by national ministers, has advised the proposed regulation poses a particularly serious limitation to the rights to privacy and personal data and that there is a serious risk of it falling foul of a judicial review on multiple grounds.

The EU lawyers write that the draft regulation would require the general and indiscriminate screening of the data processed by a specific service provider, and apply without distinction to all the persons using that specific service, without those persons being, even indirectly, in a situation liable to give rise to criminal prosecution.

The legal service goes on to warn that the European court of justice has previously judged the screening of communications metadata is proportionate only for the purpose of safeguarding national security and therefore it is rather unlikely that similar screening of content of communications for the purpose of combating crime of child sexual abuse would be found proportionate, let alone with regard to the conduct not constituting criminal offences.

The lawyers conclude the proposed regulation is at serious risk of exceeding the limits of what is appropriate and necessary in order to meet the legitimate objectives pursued, and therefore of failing to comply with the principle of proportionality.

The legal service also raises concerns that by seeking to clamp down on the solicitation of children, the providers would have to introduce age verification technology and processes to popular encrypted services.

The lawyers write that this would necessarily involve the mass profiling of users, or the biometric analysis of the users face or voice, or alternatively the use of a digital certification system they note would necessarily add another layer of interference with the rights and freedoms of the users.

Despite the advice, it is understood that 10 EU member states Belgium, Bulgaria, Cyprus, Hungary, Ireland, Italy, Latvia, Lithuania, Romania and Spain back continuing with the regulation without amendment.

Patrick Breyer, a German MEP who sits on the European parliaments civil liberties committee, said the EU should drop the plans, which he labelled as dystopian and claimed would tie up law enforcement and tech companies in chasing down false reports of harmful content.

He said: The council of the EUs services now confirm in crystal clear words what other legal experts, human rights defenders, law enforcement officials, abuse victims and child protection organisations have been warning about for a long time: obliging email, messaging and chat providers to search all private messages for allegedly illegal material and report to the police destroys and violates the right to confidentiality of correspondence.

{{topLeft}}

{{bottomLeft}}

{{topRight}}

{{bottomRight}}

{{.}}

Read the original:
EU lawyers say plan to scan private messages for child abuse may be unlawful - The Guardian

The new Akira ransomware operation has slowly been building a list of victims as they breach corporate networks worldwide, encrypt files, and then demand million-dollar ransoms.

Launched in March 2023, Akira claims to have already conducted attacks on sixteen companies. These companies are in various industries, including education, finance, real estate, manufacturing, and consulting.

While another ransomware named Akira wasreleased in 2017, it is not believed that these operations are related.

A sample of the Akira ransomware was discovered byMalwareHunterTeam, who shared a sample with BleepingComputer so we could analyze it.

When executed, Akira will delete Windows Shadow Volume Copies on the device by running the following PowerShell command:

The ransomware will then proceed to encrypt files that contain the following file extensions:

While encrypting, the encryptor will skip files found in the Recycle Bin, System Volume Information, Boot, ProgramData, and Windows folders. It will also avoid encrypting the Windows system files with.exe, .lnk, .dll, .msi, and .sys file extensions.

When encrypting files, the ransomware encrypts files and appends the.akiraextension will be appended to the file's name.

For example, a file named 1.doc would be encrypted and renamed to 1.doc.akira, as shown in the encrypted folder below.

Akira also uses theWindows Restart ManagerAPI to close processes or shut down Windows services that may be keeping a file open and preventing encryption.

Each computer folder will contain a ransom note namedakira_readme.txtthat includes information on what happened to a victim's files and links to the Akira data leak site and negotiation site.

"As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog," threatens the Akira ransom note.

Each victim has a unique negotiation password that is entered into the threat actor's Tor site. Unlike many other ransomware operations, this negotiation site just includes a chat system that the victim can use to negotiate with the ransomware gang.

Like other ransomware operations, Akira will breach a corporate network and spread laterally to other devices. Once the threat actors gain Windows domain admin credentials, they will deploy the ransomware throughout the network.

However, before encrypting files, the threat actors will steal corporate data for leverage in their extortion attempts, warning victims that it will be publicly released if a ransom is not paid.

The Akira gang put a lot of effort into their data leak site, giving it a retro look where visitors can navigate it by typing in commands, as shown below.

At the time of this writing, Akira has leaked the data for four victims on their data leak site, with the size of the leaked data ranging from5.9 GB for one companyto259 GB for another.

From negotiations seen by BleepingComputer, the ransomware gang demands ransoms ranging from a $200,000 to millions of dollars.

They are also willing to lower ransom demands for companies who do not need a decryptor, and just want to prevent the leaking of stolen data.

The ransomware is currently being analyzed for weaknesses, and BleepingComputer does not advise victims to pay the ransom until its determined if a free decryptor can recover files for free.

Read more from the original source:
Meet Akira A new ransomware operation targeting the enterprise - BleepingComputer

New Delhi: The Indian cyber security agency has issued a warning against the "Royal ransomware" virus that attacks critical sectors like communications, healthcare, education, and even individuals and seeks pay-off in Bitcoins for not leaking personal data in the public domain.

The Indian Computer Emergency Response Team or CERT-In has stated in the latest advisory that this Internet-spread ransomware sneaks in through phishing emails, malicious downloads, abusing RDP (remote desktop protocol) and other forms of social engineering.

"Royal ransomware is targeting multiple crucial infrastructure sectors, including manufacturing, communications, healthcare, education, etc. or individuals. The ransomware encrypts the files on a victim's system and attackers ask for ransom payment in bitcoin," the advisory said.

continued below

The CERT-In is the federal technology arm to combat cyber attacks and guard the cyber space against phishing and hacking assaults and similar online attacks.

The advisory said the "threat actors have followed many tactics to mislead victims into installing the remote access software as a part of callback phishing, where they pretend to be various service providers."

"It will divide the content into two segments i.e. encrypted and unencrypted. The malware may choose a small amount of data from a large file to encrypt so as to increase the chances of avoiding caution or detection. It adds 532 bytes at the end of encrypted file for writing randomly generated encrypted key, file size of encrypted file and encryption percentages parameter," the CERT-In said.

The lethality of this virus can be gauged from the fact that before starting encryption of the data it attacks, the ransomware checks the state of targeted files and deletes shadow copies to "prevent recovery" through service.

After intruding into network, the malware tries to make persistence and lateral movement in the network. Even after getting access of domain controller, the ransomware disables anti-virus protocols. Moreover, the ransomware exfiltrates a large amount of data before encryption, the advisory said.

It has been observed, it said, that 'Royal ransomware' does not share information like the ransom amount, any instructions, etc. on a note like other ransomware, instead it connects with the victim directly via a .onion URL route (darkweb browser).

The agency has suggested some counter-measures and Internet hygiene protocols to guard from this ransomware attack and others like it.

Maintain offline backup of data, and regularly maintain backup and restoration as this practice will ensure the organisation will not be severely interrupted and have irretrievable data.

It is also recommended to have all backup data encrypted, immutable (i.e., cannot be altered or deleted) covering the entire organisation's data infrastructure, it said.

The users should enable protected files in the Windows Operating System to prevent unauthorised changes to critical files and they should disable remote desktop connections, employ least-privileged accounts and limit users who can log in using remote desktop part from setting an account lockout policy.

A number of other best practices have been suggested by the agency, including basic ones like having an updated anti-virus in the computer systems and not clicking on unsolicited emails from unknown links.

Join the community of 2M+ industry professionals Subscribe to our newsletter to get latest insights & analysis.

Read the original here:
Cyber alert issued against 'Royal' ransomware that attacks health, education sectors - ETCIO

This story was originally published on 5/5. It was updated at 12:40 p.m on 5/6.

Two days after the city of Dallas fell victim to a cyberattack, its Facebook account gave advice about securing devices by strengthening passwords. It is ironic, given that its Information and Technology Services department was in the middle of trying to contain a ransomware attack by the group that calls itself Royal, which also claimed responsibility for holding the appraisal districts information hostage last year. The punctuation on the problem was that the webpage the post directed people to was down, just like most city webpages, because of that attack.

The city is keeping quiet about specific details regarding the attack other than to say its tech employees are working to contain the damage and bring everything back online.

Since City of Dallas Information and Technology Services detected a cyber threat Wednesday morning, employees have been hard at work to contain the issue and ensure continued service to our residents, City Manager T.C. Broadnax said in a statement Thursday. While the source of the outage is still under investigation, I am optimistic that the risk is contained. For those departments affected, emergency plans prepared and practiced in advance are paying off.

The citys news portal, where updates are posted.

The public library website, but some things are not accessible.

Dallas city meeting calendars and agendas.

Videos of city meetings

The citys open records request portal (but requests may be processed slowly)

The webpage for the citys development services is down, and permits cannot be processed.

Dallas Water Utilities website (you can pay by mail, and disconnections have been put on hold, and late fees wont be assessed).

Websites for Zoning, Public Works, Dallas Police Department, and Dallas Fire Rescue.

Online services with the citys Development Services Department (but they will review paper plans in person).

Municipal court will remain closed Monday.

and pretty much everything else.

Dallas police Chief Eddie Garcia told the Dallas Morning News that the department had emergency plans in place and had deployed them but that its operations were significantly impacted by the outage the attack caused. Offense reports and jail intake forms are being filled out by hand, he said. The departments website, internal shared drives, and other software used for personnel matters were also affected. Even with all of that, dispatchers are still able to send officers where they are needed, he said.

The Dallas Fire Department has also been forced to manually dispatch over the radio because of the outage.

While a Friday update from the city lauded the heroic teamwork by our first responders, one group of officers spoke out on Twitter, indicating rank-and-file officers havent received an explanation from city leaders either.

Thank goodness for the leadership of the unnamed few that came up with a few workarounds. This is a serious issue for officer safety in patrol. We are flying blind out there, the Dallas Police Womens Association said Friday night. We have not heard a whisper from the chief of police, the mayor, or the city manager. This *should be* unacceptable, but here we are. The citizens of Dallas deserve better. The employees of Dallas deserve better.

Cybersecurity company TrendMicro said that Royal attacks were first reported last September. Since then, its data has detected a total of 764 attack attempts by the group across its customer base.

In March, the Federal Bureau of Investigation and the Cybersecurity and Infrastructure Security Agency issued a joint report warning that since September 2022, use of a new Royal ransomware variant had come to the forefront. This new variant has a new custom-made file encryption program that criminals use to encrypt vulnerable systems after extracting large amounts of data. That encryption basically locks down the users system until the ransomor royalty is paid. The agencies dont recommend paying those ransoms.

Royal actors have made ransom demands ranging from approximately $1 million to $11 million USD in Bitcoin, the agencies said. In observed incidents, Royal actors do not include ransom amounts and payment instructions as part of the initial ransom note. Instead, the note, which appears after encryption, requires victims to directly interact with the threat actor via a .onion URL.

The city isnt saying if this is true, but the site bleepingcomputer.com claims to have a copy of a note it says appeared on city printers Wednesday morning that directs the city to reach out to an .onion URL, which are Royals sites on the dark web.

It may seem complicated, but it is not, the note says. Most likely what happened was that you decided to save some money on your security infrastructure. The note then directs the city to pay a royalty to unencrypt the data and also to not release what was found by the hackers to the public.

Because of its fairly ordinary ways of obtaining cooperation and access, the group is often able to exploit the one vulnerability most difficult for IT personnel to patch up: the human part.

It is believed that hackers are able to access systems in several ways, but the most prevalent method seems to be through callback phishing emails, which impersonate some kind of service (meal delivery kits, software licensing, and the like), claiming that the recipient has had their service renewed. When the victim calls the telephone number in the email to dispute or cancel, they are led through a series of tasks that ultimately allow the person on the other end to remotely access their computer, unlocking the door to their company (or citys) network.

The group has also been known to use internet search advertising to deliver malicious software that will allow the user on the other end to have remote access to a system when someone clicks on the ad. Researchers have also reported that the group will also hijack an existing and innocent email thread and insert an HTML file that, when opened, will release a pop-up that tells the user that the file couldnt be correctly displayed, so they should download it to view it.

All of that means that its not hard to fall victim to ransomware. What is hard is getting it back.

Late last year, the Dallas Central Appraisal District was also hit by a Royal ransomware attack that left its website and other operations (including email) encrypted for more than two months. In that attack, the demand was for $1 million, but the Dallas Morning News reported that the district eventually paid $170,000 in bitcoin. In that case, it is believed that an employee clicked on a phishing email that appeared to have come from a vendor.

Why are local governments falling prey to ransomware? Experts say there are a variety of reasons, including a lack of investment in more robust cybersecurity, as well as city websites and systems that are often a cobbled-together collection of legacy programs and networks and newer elements.

Local governments may face higher rates of encryption during ransomware attacks due to a lack of financial and cybersecurity resources, StateTechs Mol Doak explained. Constrained budgets and small teams pressure organizations to divert funds away from cybersecurity, leaving gaps in their platform protection.

Its unlikely that well know anytime soon how the citys cybersecurity measures were breached. But we do know that the citys IT department has had a few high-profile incidents in the past two years. In March 2021, a massive amount of police data was accidentally deleted by an IT Services employee, and an audit into that deletion uncovered another accidental deletion, according to a report published in September 2021. That deletion happened when an employee attempted to migrate data from a cloud service to an on-site archive.

That report, authored by the citys IT Services department, explained problems its staff had with oversight and data governance and management.

Without proper, fully implemented Data Governance in place, the city is at risk of further loss of data, inability to recover from onsite failures causing loss of data, disaster recovery requiring recovery of data, liabilities from inappropriate exposure of data, and inability to fully realize the analytical value of the data due to a lack of quality or inability to aggregate across departments and data sets, the report said.

The report detailed a lack of scrutiny into how data was being handled and poor planning, scheduling, detail, and documentation. The report also noted that the employee was using an administrator account that gave them more access than they should have been allowed. The citys data management strategy had also not been in place at the time, or was out of date.

The department had 13 recommendations to improve these processes and had promised a plan of action with benchmarks to meet. The report said the city had picked a data management framework and a steering committee to create policies and standards, but its unclearthanks to the outagehow far along the city is in meeting those benchmarks.

In 2022, StateScoop named Dallas Chief Information Officer William Zielinski one of its City Executive of the Year. Zielinski has focused on optimizing the citys infrastructure to remove technological debt and improve the citys cybersecurity to best in class for the region, the organization said.

Dallas most important news stories of the week, delivered to your inbox each Sunday.

Bethany Erickson is the senior digital editor for D Magazine. She's written about real estate, education policy, the stock market, and crime throughout her career, and sometimes all at the same time. She hates lima beans and 5 a.m. and takes SAT practice tests for fun.

See original here:
Dallas City Hall Giving Few Details on Ransomware Attack - D Magazine