Security News for the Week Ending November 22, 2019
Huawei Ban – Is It A National Security Issue or Bargaining Chip?
Back in May, President Trump issued a ban on US companies buying from or selling to Huawei (see here). Since then, the government has issued an extension to the ban 90 days at a time and the government just issued another extension. They are doing this at the same time that they are trying to get US allies to not use Huawei products in the rollout of those country’s 5G networks. This tells China that we are not serious about this and don’t really think Huawei is a security risk – whether it is or not.
There are two problems with the ban. The first is that US telecom carriers currently use lots of Huawei gear and it will cost billions to replace it. Second, US companies and likely Republican donors make billions selling parts to Huawei, so the administration is reluctant to stop that flow of money into the country.
Congress is considering a bill to fund $1 billion over TEN YEARS as a down payment on removing Huawei gear from US networks. If the US actually implements the Huawei ban, then those companies will no longer get software patches, The Chinese might even announce the holes so hackers can attack US networks. In addition, if the equipment breaks, carriers won’t be able to get it fixed. Life is never simple.
Carriers that have to spend money replacing Huawei will have to delay their 5G rollouts, turning the US into even more of a third-world cellular network than we already are. Source: ITPro
Phineas Fisher Offers $100,000 Bounty to Hack Banks and Oil Companies
The hacker or hacker group Phineas Fisher has offered up a bounty of $100,000 for other hackers who break into “capitalist institutions” and leak the data. The group said that hacking into corporations and leaking documents in the “public interest” is the best way for hackers to use their skills for social good. That is not a great message for businesses who are trying to defend themselves.
Phineas Fisher has a long track record of breaking into companies and publishing embarrassing data, so this is not just an idle threat. Source: Vice
Russian Hacker Extradited to the United States May Be High Value Asset
We see from time to time that hackers are not too bright or act in not so bright ways. In this case, a Russian hacker, wanted by the US was arrested when he entered Israel in 2015. The US says that he ran the underground credit card mart CARDPLANET which sold over a hundred thousand stolen cards. Why a Russian hacker would think that visiting Israel would be safe seems like he thought, maybe, no one knew who he was or that he is not very smart.
After Israel arrested him at the request of the US, the Russians tried to bargain him back to Russia under the guise of trying him there. When the Israelis told them thanks, but we will handle this ourselves, Russia convicted a young Israeli woman on trumped up drug charges and she is serving a 7 year sentence in Russia. Even that did not sway Israel to return him. In the mean time, the Israelis have turned him over to us and he waiting trial here.
Some people say that Russia wants him back because he has first hand knowledge of Russian interference in the 2016 US elections, but the White House doesn’t even admit that Russia hacked the elections, so I am guessing they are not going to press on that issue, but who knows – stay tuned. Source: Brian Krebs
When It Affects the Boss, Well, Just Fix It
A few weeks ago Jack Dorsey, Twitter’s CEO, had his Twitter account hacked.
Up until yesterday, you had to provide Twitter with a phone number for two factor authentication and they would send you a text message. You could change the method later, but you had to initially give them a phone number. HIS account was hit by a SIMJacking account (so apparently he did not change his authentication method).
As of November 21, you can now set up a Twitter account WITHOUT SMS as the second factor. I strongly recommend that you change your Twitter 2FA method. Source: Tech Crunch
Apple Tells Congress That You’ll Hurt Yourself if You Try to Fix Your iPhone
Congress pressed Apple on why you or a repair center (that doesn’t pay Apple a licensing fee) should not be allowed to repair your iPhone because, they say, doing such repairs could be dangerous.
They also said it costs them more money to repair iPhones at Apple stores than they charge, which is probably the best reason ever to let other people repair them. Of course, that is not the way Apple sees it. They said that you might leave a screw out or something. Of course, if they provided manuals, that wouldn’t be a problem.
Apple would like you and Congress to believe that their repair monopoly is good for you as a consumer. Apple also said that they don’t stop consumers from getting repairs from a shop of their choice, even though they modified the iPhone software to disable the phone’s touchscreen if they do get their phone repaired outside the Apple ecosystem. Read more details here.
by 