Apple Leak, McAfee, and National Guard – Hack Naked News #169
April 17, 2018
The FTC weighs in on whether you can actually tell somebody the warranty is void, Apple's leak memo leaks, then we got a whole bunch of statistics on cloud adoption security and businesses. Jason Wood gives expert commentary on Cyber Crime on Facebook!
FTC Says 'Warranty Void If Removed' Stickers Are Bullshit, Warns Manufacturers They're Breaking the Law
In response to the attempts on election-related systems in 2016
Elections are now part of the US Critical Infrastructure
Exciting opportunities for everyone
Cybercrime on Facebook? A Few Less Groups Now My feed of news articles and blog posts is full of Facebook and the impact that it has on data about us. In the midst of all this, I saw an article by Brian Krebs of KrebsOnSecurity about criminal groups using Facebook. Brian documents the results of 2 hours (that’s right only 2 hours) of searching Facebook for groups that engage in criminal activity. He netted 116 groups with over 300,000 members being part of them.
“Wait,” you might ask. “What kind of criminal activity?” I’m glad you asked. According to his spreadsheet, the groups sold SPAM services, malicious hacking, carding, 419 scams, account takeovers, DDoS, phishing, tax scams, botnet (access and building) and more! The average age of these groups appears to be about 2 years old. The oldest group had the name “Botnet & Source Bot & Trojan & Keylogger” and was 9 years old. According to Brian, these groups made no effort to hide detection by using even simple misspellings or slang. They were open about what was going on. Hence the reason he was able to catch 116 of these groups in only 2 hours of work.
Brian notified Facebook of the groups and received this response. "We thank Mr. Krebs for bringing these groups to our attention, we removed them as soon as we investigated," said Pete Voss, Facebook’s communications director. "We investigated these groups as soon as we were aware of the report, and once we confirmed that they violated our Community Standards, we disabled them and removed the group admins. We encourage our community to report anything they see that they don’t think should be in Facebook, so we can take swift action."
The meaning I get from this is that Facebook responded once they received the report, but hadn’t been looking for them on their own. While they have “Community Standards”, they don’t appear to work to enforce them systematically. Instead they depend on the users of Facebook to be their detection system.
I think it’s clear to anyone reading the news lately that Facebook is a business and their product is the data that we as the users (and even non-users) provide them. There is limited incentive for them to hunt down groups that violate their community standards, since then the users will stop providing data. There are obviously examples of exceptions to this, but in general they will respond when someone complains. The issue isn’t related just to Facebook, since there are plenty of other companies that make their income with similar services. However, I believe it would be worth some time for companies like Facebook to perform even cursory checks of the activities of groups like this. Brian didn’t work real hard to find the groups he reported. Facebook should be able to make it fairly easy for them to do something similar without depending on their users. Kudos to Brian for tracking this down, reporting the groups and getting them off of Facebook.
Full Show Notes
Visit http://hacknaked.tv to get all the latest episodes!
[audio src="http://traffic.libsyn.com/hntvaudio/Apple_Leak_McAfee_and_National_Guard_-_Hack_Naked_News_169_converted.mp3" ]
Security experts are saying that Missouri's governor is mischaracterizing the actions of a journalist who reported a data leak vulnerability in a state website, demonstrating a clear lack of understanding among some politicians about the inner workings of the cyber community.
The Department of Justice will more aggressively pursue contractors and grantees for misrepresenting their cybersecurity posture to the government. While few doubt there's a real problem to be solved, some in the legal and contracting community have raised questions about whether it could clash with other Justice and Biden administration cybersecurity priorities, and whether a good intentioned initiative could create a chilling effect among companies seeking government opportunities.