Cloud Hosting

At around 8 p.m. Saturday, hackers breached and defaced the website of the U.S. Federal Depository Library (USFDL), posting a graphic image of President Trump being punched in the face and announcing, "This is a message from Islamic Republic of Iran."

U.S. officials have not confirmed that the attack on the website of USFDL, a program created to make federal government publications available to the public at no cost, came from Iran, but the hackers claim to be avenging the death of Qasem Soleimani, the brutal Iranian terrorist who was killed in a U.S. airstrike at the Bahrain Airport in Iraq early Friday morning.

About an hour after the attack on the little-known USFDL website, the Iranian propaganda had been removed and the website was offline, displaying a Cloudflare error message. (Cloudflare is an internet security and DDoS mitigation provider that protects websites from malicious attacks.)

Visitors to the fldp.gov site Saturday night were greeted by a black screen displaying the flag of Iran and the words "in the name of god," along with messages warning: We will not stop supporting our friends in the region: the oppressed people of Palestine, the oppressed people of Yemen, the people and the Syrian government, the people and government of Iraq, the oppressed people of Bahrain, the true mujahideen resistance in Lebanon and Palestine [they] always will be supported by us."

Below that was an image or President Trump being punched in the jaw by a fist displaying Iran's Revolutionary Guard insignia.

"Martyrdom was his (Shahid Soleymani) reward for years of implacable efforts. With his departure and with God's power, his work and path will not cease and severe revenge awaits those criminals who have tainted their filthy hands with his blood and the blood of the other martyrs of last night's incident," the message read. "Hacked By Iran Cyber Security Group HackerS... This is only small part of Iran's cyber ability! We're always ready... to be continues... We Are: Iranian Hackers... #Hard revenge... #ICG - #SpadSecurityGroup."

The attack on the federal website came two hours after President Trump warned on Twitter that Iran "WILL BE HIT VERY FAST AND VERY HARD" if they strike American assets or targets.

"Iran is talking very boldly about targeting certain USA assets as revenge for our ridding the world of their terrorist leader who had just killed an American, & badly wounded many others, not to mention all of the people he had killed over his lifetime, including recently hundreds of Iranian protesters," the president wrote on Twitter. "He was already attacking our Embassy, and preparing for additional hits in other locations. Iran has been nothing but problems for many years."

"Let this serve as a WARNING that if Iran strikes any Americans, or American assets, we have targeted 52 Iranian sites (representing the 52 American hostages taken by Iran many years ago), some at a very high level & important to Iran & the Iranian culture, and those targets, and Iran itself... The USA wants no more threats!"

A former senior U.S. government national security official told Fox News' Leland Vittert, "It has the feel of being pretty insignificant...they just hacked a website that most Washington insiders dont know existed...Honestly, this is not very hard...this website had very weak security." The source told Vitter that the attack likely did not come from the Iranian government directly, rather from sympathizers or a proxy group.

The chief public relations office for the U.S. Government Publishing Office told Fox News: An intrusion was detected on GPOs FDLP website, which has been taken down. GPOs other sites are fully operational. We are coordinating with the appropriate authorities to investigate further.

Security experts have warned that Iran could launch cyberattacks in response to the death of Soleimani. While Saturday's attack appears to be rather unsophisticated, the fear is that hackers with more advanced skills could inject malware into websites and cause major disruptions of U.S. infrastructure or the financial and energy sectors.

State-sponsored Iranian hackers have proven successful in the past. In 2016, seven Iranians "conducted a coordinated cyber attack on dozens of U.S. banks, causing millions of dollars in lost business, and tried to shut down a New York dam, the U.S. government said on Thursday in an indictment that for the first time accused individuals tied to another country of trying to disrupt critical infrastructure," according to a Reuters report.

Christopher C. Krebs, Director of the Cybersecurity and Infrastructure Security Agency (CISA), warned that Iran could target U.S. assets to avenge the death of Suleimani.

"Given recent developments, re-upping our statement from the summer," Krebs warned on Twitter."Bottom line: time to brush up on Iranian TTPs and pay close attention to your critical systems, particularly ICS.Make sure youre also watching third party accesses!"

In June, CISA warned that Iranian actors or proxies could attack U.S. targets utilizing destructive "wiper" tools.

CISA is aware of a recent rise in malicious cyber activity directed at United States industries and government agencies by Iranian regime actors and proxies," CISA said.Iranian regime actors and proxies are increasingly using destructive wiper attacks, looking to do much more than just steal data and money. These efforts are often enabled through common tactics like spear phishing, password spraying, and credential stuffing. What might start as an account compromise, where you think you might just lose data, can quickly become a situation where youve lost your whole network."

In times like these its important to make sure youve shored up your basic defenses, like using multi-factor authentication, and if you suspect an incident - take it seriously and act quickly," the statement concluded.

John Hultquist, director of intelligence analysis at cybersecurity firm FireEye warned, "We will probably see an uptick in espionage, primarily focused on government systems, as Iranian actors seek to gather intelligence and better understand the dynamic geopolitical environment. We also anticipate disruptive and destructive cyberattacks against the private sphere."

"Iran has leveraged wiper malware in destructive attacks on several occasions in recent years," he explained. "Though, for the most part, these incidents did not affect the most sensitive industrial control systems, they did result in serious disruptions to operations. We are concerned that attempts by Iranian actors to gain access to industrial control system software providers could be leveraged to gain widespread access to critical infrastructure simultaneously. In the past, subverting the supply chain has been the means to prolific deployment of destructive malware by Russian and North Korean actors.

While Saturday's attack on a minor federal agency seems insignificant, it could be a harbinger of more sophisticated Iranian cyber attacks in an effort to hurt the U.S. in response to the death of Iran's top terrorists.

"The Department of Homeland Security stands ready to confront and combat any and all threats facing our homeland," Acting Secretary Chad F. Wolf said on Friday. "While there are currently no specific, credible threats against our homeland, DHS continues to monitor the situation and work with our Federal, State, and local partners to ensure the safety of every American."

Read the original:
'This Is the Beginning': Hackers Claiming to Be from Iran Take Over U.S. Government Website - PJ Media

After going through The Wright State Guardians archives, several stories stuck out more than others. The university has seen many highs and lows in the last decade.

WebCT was a program that had been used by students and faculty since 2003. This article describes how Pilot was similar to WebCT but more capable and easier for students and faculty to use. Wright State has been using for Pilot for almost the whole decade.

The Wright State Research Institute was started in 2007. At the time of publication, only 47 people worked at The Wright State Research Institute. During the fiscal year 2010, The Wright State Research Institute generated $3.4 million, and for fiscal year 2011, $6 million was generated in just six months.

The $6.4 million in research money was spread between two contacts, one focused on neuroscience and medical imaging and one focused on intelligence technologies. The contracts were set to be worked on for the next five years. In 2018, The Wright State Research Institute employed 85 people.

Internet security bill sent to US Senate could affect the privacy of internet users alike if passed, 2012

The internet has changed and evolved so much in the past decade. 2012 was a year for big internet security debates. The internet security bill being discussed in this article was the Cyber Intelligence Sharing and Protection Act.

The Raiders have seen good and bad years for our Mens Basketball team.

2010-11: fifth in the Horizon League

2011-12: eighth in the Horizon League

2012-13: third in the Horizon League

2013-14: third in the Horizon League

2014-15: eighth in the Horizon League

2015-16: second in the Horizon League

2016-17: fifth in the Horizon League

2017-18: second in the Horizon League

2018-19: first in the Horizon League

Wright State has seen several different presidents and administrative changes throughout the decade. This article discusses the various plans and projects that were put in action to maintain affordability, quality of education, growth on campus, branding and accessibility.

The decade saw a drastic rise in gas prices and then a drop in prices.

This article details the story of the Chairman of the Board of Trustees at the time, Michael Bridges, participating in a vote which in turn lead to the hiring of his son, David Bridges, for a university position. Violation the state nepotism laws is considered a fourth-degree felony.

Wright State has seen many administrative changes and is about to see another as Susan Edwards will be taking the position of president in January.

2019 saw a faculty strike that made history in Ohio. For almost two years leading up to this, WSU-AAUP and Wright State Administration had been struggling to agree on contract negotiations. Starting in 2016, Wright State had been dealing with a financial crisis regarding a $30 million structural budget deficit. The strike lasted 20 days and left some students with no professors in the classroom.

Our new and current President Susan Edwards was named in 2019. Edwards was the executive vice president for academic affairs and provost of Wright State before being named as the new president.

WSU has experienced many changes throughout the decade. The university will continue to evolve and change in 2020 and the next decade.

Follow this link:
From the archives: Top ten WSU stories of the decade - - The Wright State Guardian

Written by Colin Wood Dec 30, 2019 | STATESCOOP

After months of escalating cyberattacks against state and local governments dotted around the United States, North Dakotas technology agency is setting out to build a shared infrastructure in hopes of rallying a unified defense.

North Dakota Chief Information Officer Shawn Riley told StateScoop the Information Technology Department he leads is developing a suite of technologies and meeting with top technology officials in other states with the goal of developing a shared security operations center that can adapt to threats wherever they occur, calling on those with security resources and intelligence to help those who need it.

Theres a lot of conversations going on with this, Riley said. Part of what we have to work through is as we look at the potential of states supporting each other, how can we make sure there are no political overtones? Were doing assessments of multiple states and how that applies to the ability of all of us to really truly to work together.

North Dakota may seem an unlikely origin of such a project its the fourth-smallest state by population, and hasnt endured many high-profile cyberattacks, like the Aug. 16 ransomware incident that struck 23 communities across Texas but North Dakotas unique organizational structure combined with Rileys affinity for collaboration make it a fitting launchpad.

North Dakotas technology agency earlier this year assumed cybersecurity operations for all government offices throughout the state more than 252,000 users riding on the state network who come from state agencies, schools, courts and the state legislature. This unique arrangement presented Rileys office with an unprecedented level of responsibility and drove officials to begin thinking more holistically about how they can secure not only their own networks, but everyones.

More than 125 public institutions are known to have been hit by ransomware in 2019 and they were organizations at all levels of government and of all sizes. When word got out that North Dakota was working on this problem, Riley said he started getting calls from all around the country. Small communities and K-12 districts have a notoriously difficult time defending against cyberattacks, but its going to be a challenge for organizations of all sizes and sophistication levels, he said.

I think a good example is on one hand weve got a community of 48 people, 48 humans in the entire town where the mayor, city auditor and bus driver are all the same person and then you have a school district with 35,000 kids in it, Riley said. This technology can scale across that entire environment.

Riley said hes not yet ready to reveal which states will participate only that assisting local government offices and K-12 districts is a challenge widely shared by state governments. Tim Bottenfield, the CIO in neighboring Montana, told StateScoop he is among those talking to North Dakota, but Riley said this effort wont be limited to a particular geographic region.

There are already organizations that help to widely distribute strategic advice and information on cyberthreats, such as the Multi-State Information Sharing and Analysis Center, or MS-ISAC, which is operated by the nonprofit Center for Internet Security and funded by the U.S. Department of Homeland Security. But North Dakota Chief Information Security Officer Kevin Ford said this project, rather, will focus more heavily on cybersecurity operations.

While we will obviously ingest ISAC information to help prioritize operational responses, we are also offering improved operational capabilities, Ford said. We will be able to provide members the availability to respond to their own security issues as well as, when desired, pool resources to help each other respond to security emergencies. Our tech stack is heavily automated, and the more data we have flowing into it, the better the efficiencies will be for everyone involved.

Details such as whether its appropriate for the governors office of one state to see the security logs for another state run by a governor of an opposing party still need to be answered, Riley said. There are also complex regulatory and technical hurdles to overcome. In North Dakota alone, there are more than 300 privacy laws that could potentially bear on the projects implementation. But Riley says these challenges are trivial compared to the threat government is now facing.

The reality is, individually, we are all screwed, Riley said.

Read the original post:
North Dakota's building a cybersecurity operations center and everyone's invited - StateScoop

By Rudra Srinivas

Most people in India have never accessed the Internet through a computer. In fact, their encounter with the Internet is only through smartphones. As Indias consumers lap up Internet services, social media and other apps, they gladly submit their personal details to service providers in exchange for free use of their services. And these details are usually stored on servers outside Indias boundaries. That got the Government of India worried about data privacy concerns.

So, in July 2017, the Government of India formed a committee of experts to study the issues related to data protection in the country. The committee was led by retired Supreme Court Justice BN Srikrishna. After working on it for a year, the committee submitted a draft of the Personal Data Protection (PDP) Bill in July 2018 and requested feedback from the public, Ministers, stakeholders, and other industry experts.

A revised draft of the Bill was submitted in the Parliaments lower house, the Lok Sabha, on December 11, 2019, and has been sent to a joint parliamentary committee (JPC) for further deliberations before being taken up for passing. There was widespread anticipation for the passing of the Bill in 2019, however that has now been deferred. The Bill is expected to become a law or an Act in 2020.

What the Bill could achieve

The Personal Data Protection Bill (PDP Bill) is Indias first attempt to domestically legislate the mechanisms for the protection of personal data and aims to set up a Data Protection Authority in the country. The Bill regulates the processing of citizens personal data by government, companies incorporated in India, and foreign companies that are dealing with personal data of customers in India. Through the proposed law, the Government of India is rooting for data sovereignty by mandating certain class of data to be stored within Indian borders.

The proposed Bill also allows processing of data by fiduciaries with the consent of the individual. A data fiduciary is an individual or entity that decides the purpose of processing personal data. However, the Bill also permits personal data processing without consent in some cases like, when the government providing benefits to the individual, for legal proceedings, and in medical emergencies.

Kinds of Personal Data, according to the proposal

The proposed Bill forces companies dealing with peoples personal data to reconsider their data management practices. The Bill regulates three categories of data Personal Data, Sensitive Personal Data, and Critical Personal Data.

The Bill defines Personal Data as any information thats collected online or offline which can be used to identify a person, like name, address, phone number, location, shopping history, photographs, telephone records, food preferences, movie preferences, online search history, messages, devices users own, and social media activity.

Sensitive Personal Data includes health care data (like private information you share with a doctor or healthcare apps), financial data (banking and payments information), sexual orientation, biometrics (facial images, fingerprints, iris scans), caste or tribe, religious and political beliefs.

Critical Personal Data has not yet defined by the government.

Advantages to Citizens

The proposed Bill gives high priority for individual rights on data protection. As per the Bill, citizens personal information cant be collected, processed, and shared without their consent. Only the necessary data will be collected and can be used for pre-defined purposes only.

The companies are required to be clear and concise on what data is collected, its purpose, how its used, and for how long the data will be retained. The Bill also permits customers to move their data from one provider to another and allows users to know the number of companies with whom the data is shared.

Impact on Private Organizations

Private entities are required to place limits on data collection, processing, and storage of their customers data. Theyre subjected to report any instances of security incidents to the regulator.

Additional responsibilities are also imposed on companies based on the volume of data they collect from customers. This includes periodic security audits, appointment of a data protection officer, and performing data protection assessments defined by the regulator. Social media platform providers will also be mandated to enable customers to verify their accounts.

Penalties

Tough penalties have been proposed for failing to comply with the data protection requirements. According to the Bill, any organization sharing customers data without their consent will entail a fine of INR 15 crores (around US$ 2.1M) or 4 percent of its global turnover. Data breach and delay to address/report the same will result in a fine of INR 5 crores (US$ 0.7M) or 2 percent of global turnover. Individuals representing the companies can also be sentenced to term in prison.

Data Localization Requirements

In terms of data localization, the Bill allows transfer of personal data across borders without any limitations. However, restrictions are placed on sensitive personal data which needs to be stored in India. Sensitive personal data can also be processed outside the country if the regulator approves it. For critical personal data, the government will notify on its own, which needs to be stored and processed within the country.

Criticism on the Revised Bill

The Bill landed in controversy for being different from what was proposed by the expert group in its first draft in July 2018. The Indian government, through the proposed law, wants to allow law enforcement agencies and authorized third parties to have access to citizen data, to investigate crimes faster. In other words, it will exempt any government agency from legal obligations. This, of course, has led to a resistance, and delayed the passing of the bill. Justice BN Srikrishna, the chief architect of the draft law, also has concerns and said the law can turn India into an Orwellian State.

Several industry experts have opined that unaccounted access to personal data of customers might lead to data -misuse. The Bill provides an exempt to any agency of government from the application of Act in the interest of sovereignty and integrity of India, the security of the state, friendly relations with foreign states, public order. The unrestricted government access is like a two-sided coin scenario. On one hand, the privacy bill is a part of the governments efforts to have more control of data and help it track unlawful activities by using digital footprints. On the other hand, the users access may give the government unaccounted access to personal data of customers in the country leading to data -misuse and unauthorized access, said Jaspreet Singh, cybersecurity leader at EY told CISO MAG.

Several privacy concerns have also been raised by experts over the revised draft Bill. The Bill states that personal and non-personal data may be processed without obtaining consent from the concerned user to help in the delivery of government services.

The changes that were made

Justice B.N. Srikrishna, who led the committee that drafted the 2018 PDP Bill, stated that there is no oversight on government agencies on accessing citizens data. Sharing his thoughts on the same, Pavan Duggal, the Advocate Supreme Court specialized in Cyberlaw and the Chairman of the International Commission on Cybersecurity law, said, The chapter on exemptions under the Data Protection Bill represents a massive dilution of the bill by giving these exemptions to governmental agencies. However, we also need to be mindful of the fact that governments would want certain access to personal data for sovereign and governance reasons. But the way the current exemptions came out is independent. It is the classical piece of legislation which is going two steps forward and six steps backward.

Impact on International Trade

Data protection discussions often revolve around discussions of transfer of data. In this regard, the proposed Bill has received a lot attention from global tech tycoons as well as Indian firms that work for international companies.

Theres no denying that this bill, if becomes a law, will have a significant impact on foreign companies as well as trade between India and other nations. He stressed that the bill takes a U-turn from the stance the Reserve Bank of India (RBI) took in April 2018. The RBI in its notifications stated that all data relating to banking must be physically in India and cannot leave Indian soil and that continues to be the position till today. However, the proposed Bill is a complete walk down on the RBI stance as it allows sensitive data to be stored outside India, Pavan Duggal told CISO MAG.

The bill is a ground-breaking step for the nation towards building the significant base of trusted digital India. It will change the way privacy is perceived and practiced by various businesses. Global organizations based in India and/or providing services will be particularly impacted. Considering the data transfer mandates, as most global firms which process personal data of Indians store their data at remote locations will face challenges in-terms of increased compliance costs, suggested Jaspreet Singh.

Where the Bill Stands Today

The much-awaited Bill, which was expected to be passed by the end of 2019, has been put on hold for now following severe concerns raised about changes in the proposal. The proposed Bill was recently referred to a JPC in consultation with various groups for further analysis. The joint committee, with 20 members from the Lok Sabha or lower house, and 10 from the Rajya Sabha (upper house), will be headed by Meenakshi Lekhi, Member of Parliament. The committee is expected to submit their views before the end of the upcoming budget session.

The PDP Bill lays down provisions for thwarting misuse of personal data in the country. It mandates data processing activities like data protection, storage, and management. On the flipside, the Bill, if passed, could bring major implications for national security, foreign investment, and international trade.

Rudra Srinivas is part of the editorial team at CISO MAG and writes on cybersecurity trends and news features.

Originally posted here:
All You Need to Know About Indias First Data Protection Bill - CISO MAG

Happy New Year! Well, it was for a day or two, anyway. But after the US assassinated Iranian military leader Qasem Soleimani in a drone strike, experts warned that the likely retaliation could include disruptive cyberattacks, along with more traditional strikes. It's an alarming start to the year, especially as tensions continue to escalate.

Elsewhere in the world, TikTok released its first transparency report this week, including the surprising and perhaps unlikely assertion that the Chinese government hadn't requested any user information from the viral app in the first half of 2019. A similar-sounding app called ToTok turned out to be an alleged spy app from the United Arab Emirates. And we took a look at the military lessons of Star Wars: The Rise of Skywalker. Chaos is king!

We also got retrospective, cataloging decade's most dangerous people on the internet and its worst hacks. It was also the decade that email scams leveled up, turning into a multibillion dollar industry.

And that's not all! Every Saturday we round up the security and privacy stories that we didnt break or report on in-depth but think you should know about nonetheless. Click on the headlines to read them, and stay safe out there.

Speaking of TikTok! The US Army closed out the year by banning TikTok on government phones, citing it as a "cyber threat." The Navy has taken the same step, following Pentagon guidance to "uninstall TikTok to circumvent any exposure of personal information." This doesn't mean that TikTok is actively spying on its users, or that you should also purge it. But it's always healthy to be aware of what data apps are collecting from you and where they send it. In the case of TikTok, that means China, which means government employees are probably right to take extra precautions.

A 2018 indictment detailed how China's elite APT10 hackers used access to so-called managed service providers to steal intellectual properly from dozens of companies. As bad as it seemed at the time, the Wall Street Journal has shared fresh details that make clear how much worse things actually got. Companies like Hewlett Packard Enterprise were "so overrun that the cloud company didnt see the hackers re-enter their clients networks," the report says. By breaking into one company that provides services over the internet to several clients, APT10's hacking spree was brutally efficient, even by China's high standards.

You literally hate to see it. When a Reddit user tried to stream images from his Xiaomi camera to his Google Nest Hub, the display instead showed what appeared to be still photos from other people's homes. It appears to be an isolated incident, and Google has suspended its Google Home and Assistant integraton with Xiaomi until it figures out what happened. Starting to feel like "smart home" was a pretty serious misnomer.

Remember that thing about email scamming becoming a big business over the last few years? Still is! Fraudsters tricked officials in the town of Erie, Colorado to send $1.01 million of payments intended for a construction company to an unauthorized bank account instead. From there, the funds were wired out of the country. It's not the biggest so-called BEC score in recent memory, but every one of them hurts.

More Great WIRED Stories

Go here to read the rest:
The Army Bans TikTok - WIRED