Information Technology

Facebook parent company Meta has reached a $90 million settlement in a case that’s been ongoing since 2012. The legal fight was caused by Facebook’s use of cookies and a proprietary browser plug-in in 2010 and 2011 to track users after they had completely logged off the social network. Although users had to agree to being tracked while they were logged into Facebook, that tracking was supposed to end upon logout, according to the end-user licensing agreement. It did not. 

Per Variety, the settlement to the privacy-focused suit is now being considered by the US District Court for the Northern District of California, which will need to approve the agreement. The case has been simmering for nearly a decade thanks to a series of appeals from both sides, with Facebook having won out in several previous hearings. However, in 2020, the 9th Circuit Court ruled against the social network. This decision, followed by the US Supreme Court declining to hear the case, likely prompted its decision to finally settle the matter. As Variety notes, this settlement, if approved, would be one of the 10 largest penalties ever paid in the US for violating user privacy. Under the terms of Meta’s proposed settlement, Facebook will sequester and delete all of the data collected during this period. Facebook’s opponent in the case, the law firm of DiCello Levitt Gutzler, noted that the $90 million represents “at least 100% of any unjust profits earned on the data at issue.”

This is Facebook’s second entry on the top 10 list of privacy settlements in US history. Its other entry was the staggering $650 million in total penalties the site agreed to pay to settle a lawsuit surrounding its previous use of a facial recognition system as part of its photo tagging feature. That privacy violation settlement currently remains the most costly of its kind in US history. A Meta spokesperson told Variety, “Reaching a settlement in this case, which is more than a decade old, is in the best interest of our community and our shareholders and we’re glad to move past this issue.”Just as this case may finally be ending, Meta finds itself with another privacy suit joining the long list of those against it. This time, the company is in hot water with the Texas Attorney General claiming it violated user privacy through its use of biometric data. Facebook previously told ZDNet that the latest suit’s “claims are without merit and we will defend ourselves vigorously.”

Social Networking More

The unsweetness of love?
Shutterstock
In a week when so many profess their love, I profess confusion.

I was intently ignoring the tawdry spectacle of Valentine’s Day when a press release muscled its way onto my laptop, claiming to smell like a rose.The headline was joyous: “Seeking.com Cuts the Sugar and Rebrands for Success-Minded Individuals Looking to Date Up.”From ‘love doesn’t exist’ to ‘I’ll never divorce.’A tricky maneuver, rebranding. There’s always the suspicion that you’re running away from what you were before. Especially if you used to be called SeekingArrangement.com and your founder and CEO once declared that “love doesn’t exist.”The clue to the rebrand, however, seems to lie in cutting the sugar. Seeking.com, you see, was rather known for being the place for highly sweetened relationships.Or, in the company’s own words: “What started as an elite dating site for finding honest, authentic connections based on success-minded interests has become misrepresented over the years, with the phrase ‘sugar dating’ taking on a more negative, transactional connotation.”

Also: Microsoft quietly released a little feature and suddenly it caused outrageOh, the tragedy of misrepresentation. The ghastly nuance of cynicism polluting true love.But now things have changed, says “the world’s largest upscale dating website.””Seeking will ditch the sugar,” proclaims the company. It will be “relaunching as the largest platform for like-minded individuals looking to date up and forge relationships on their own terms.”Dating up is a curious concept. Does it mean dating someone far more physically fetching than you are? Or does it merely mean dating someone who’s got more money than you do?I feared the latter; I really did. Somehow, money is a currency that embraces far more than numbers and things. It conveys, in too many minds, a desirability that really shouldn’t be there. And I’m not referring to any famous tech CEOs when I say that.But never let it be said that tech CEOs are egotistical, purely driven by their own self-involvement and self-regard. Then again, here are the thoughts of Seeking’s CEO, Brandon Wade: “When I started Seeking in 2006, my dating life flourished. I was arrogant and openly embraced non-monogamy. But everything changed when I met my soulmate Dana.””Oh, Dana,” I hear you wail. “How I hope you’re a lot richer than Brandon.”I also hear you wail: “So arrogance and openly embracing non-monogamy are the pillars of a flourishing dating life?”Please hold those thoughts, as Wade wants you to wade through more drama: “The evolution of Seeking now reflects my personal journey.” So much so that Wade says he’s giving up his legal right to divorce.Dating up or diving down?I can hear you moan: “What? Are you totally off your chump?”I can tell, though, that you want to be taken by this Damascene conversion. I can also tell that, as a committed ZDNet reader, you’re concerned about updating security. Headlines such as “Hacker leaks data of 2.28 million dating site users” are all too familiar.Our newly self-discovered, sugar-free CEO has thought of that. Also: Google’s new motto: Don’t be evil, be AppleSeeking declares: “The security team uses both AI and human-in-the-loop (humans using AI) technology, in addition to state-of-the-art protection and security monitoring of all profiles. Overseeing more than 2.5 million pieces of content daily, Seeking offers the most sophisticated dating bot detection on the market.”You’re desperate to believe, aren’t you?I was desperate to wonder what the difference is between sugar daddyism and dating up. So I asked Seeking for its definition.The company replied: “Dating up is the belief that one can do better on the dating scene than one currently is.”Doesn’t that cover just about everyone? Except for Wade, pre-conversion?But Seeking’s definition has only just begun. This is, as apparent British Prime Minister Boris Johnson might put it, all about leveling up.”Evaluating one’s self-esteem, worth, wants, life goals and judgment to at least one level up to live as they choose versus society dictating the terms, typically targeting a more exciting and fulfilling lifestyle,” the company says.At least one level up. Who’s measuring the levels? You are, I suppose. But wait, Seeking levels up further, with some hilariously taut philosophy.It adds an additional definition: “The act of being truthful in what one wants out of a relationship and elevating one’s status in the process.”The truth will not only set you free, but it will also elevate your status.I fear many feel they elevate their status when they go online and buy the latest MacBook. So, on hearing that Seeking intends to place its definition of dating up in the Urban Dictionary, I asked for a more, well, urban interpretation.This is what I received: “I can’t believe Matt was dating cheugy Karen. What a simp. She was so cringe. Natalie is the blueprint — hot, bougie and all sass. It’s about time bruh is finally dating up. Props to Matt for upscaling his options in the dating experience.”Seriously.Here, then, is your ultimate definition of dating success, should you wish to accept it: Hot, bougie and all sass. I suppose they call that a business model.

ZDNet Recommends More

The combination of Squirrelwaffle, ProxyLogon, and ProxyShell against Microsoft Exchange Servers is being used to conduct financial fraud through email hijacking. 

ZDNet Recommends

The best security key

While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.

Read More

On Tuesday, researchers from Sophos revealed a recent incident in which a Microsoft Exchange Server, which had not been patched to protect it against a set of critical vulnerabilities disclosed last year, was targeted to hijack email threads and spread malspam. Microsoft issued emergency patches on March 2, 2021, to resolve zero-day vulnerabilities exploitable to hijack servers. The advanced persistent threat (APT) group Hafnium was actively exploiting the bugs at this time, and other APTs quickly followed suit.  While the ProxyLogon/ProxyShell vulnerabilities are now well-known, some servers are still unpatched and open to attacks.  The recent case documented by Sophos combined the Microsoft Exchange Server flaws with Squirrelwaffle, a malware loader first documented last year in malicious spam campaigns. The loader is often distributed through malicious Microsoft Office documents or DocuSign content tacked on to phishing emails.  If an intended victim enables macros in the weaponized documents, Squirrelwaffle then is often used to pull and execute CobaltStrike beacons via a VBS script.  Also: FritzFrog botnet returns to attack healthcare, education, government sectors

Sophos says that in the recent campaign, the loader was deployed once the Microsoft Exchange Server had been compromised. The server, belonging to an unnamed organization, was used to “mass distribute” Squirrelwaffle to internal and external email addresses by hijacking existing email threads between employees. Email hijacking can take many forms. Communication threads can be compromised through social engineering and impersonation — such as by an attacker pretending to be an executive to fool accounting departments into signing off a fraudulent transaction — or by sending email blasts containing links leading to malware payloads.  In this case, the spam campaign was used to spread Squirrelwaffle, but in addition, attackers extracted an email thread and used the internal knowledge within to conduct financial fraud.  Customer data was taken, and a victim organization was selected. The attackers registered a domain with a name very close to the victim — a technique known as typo-squatting — and then created email accounts through this domain to reply to the email thread outside of the server. “To add further legitimacy to the conversation, the attackers copied additional email addresses to give the impression that they were requesting support from an internal department,” Sophos explained. “In fact, the additional addresses were also created by the attacker under the typo-squatted domain.”  Over six days, the attackers tried to direct a legitimate financial transaction to a bank account they owned. The payment was on its way to being processed, and it was only due to a bank involved in the transaction realizing the transfer was likely fraudulent that the victim did not fall prey to the attack.  “This is a good reminder that patching alone isn’t always enough for protection,” commented Matthew Everts, Sophos researcher. “In the case of vulnerable Exchange servers, for example, you also need to check the attackers haven’t left behind a web shell to maintain access. And when it comes to sophisticated social engineering attacks such as those used in email thread hijacking, educating employees about what to look out for and how to report it is critical for detection.” See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

Image: isak55/Shutterstock
Google will pay between $20,000 and $91,337 to researchers who create exploits of vulnerabilities in the Linux kernel, the Kubernetes container management system, and Google Cloud’s Kubernetes Engine.This builds on the three-month bounty Google introduced in November, where it tripled rewards for exploits against new and previously unknown Linux kernel bugs. The idea was that the crowd would uncover new kernel exploitation techniques, for services running on Kubernetes in the cloud in particular. 

Researchers needed to show they could use the exploit for a given bug to compromise Google’s kCTF (Kubernetes Capture The Flag) cluster and obtain a ‘flag’ — a secret hidden in a program — within the context of a competition, which in this case was held on Google’s cluster.SEE: Cybersecurity: Let’s get tactical (ZDNet special report)Google considered the expanded program a success, and so it will extend it to at least the end of 2022. But it has also made a number of changes, covering rules, conditions and rewards.First, the updated and extended program increases the maximum reward for a single exploit from $50,337 to $91,377. On the success side of the existing trial, Google said it received nine submissions in the three months and paid out over $175,000 in rewards. The submissions included five zero-days or previously unknown flaws and two exploits for ‘1days’ or just discovered flaws. Three have been fixed and made public, including CVE-2021-4154, CVE-2021-22600 (patch) and CVE-2022-0185 (writeup), according to Google.  

Google is changing the reward structure “slightly”. It will now pay $31,337 “to the first valid exploit submission for a given vulnerability” and will pay nothing for duplicate exploits. However, it says some bonuses may still apply to duplicate exploits. These include: $20,000 for exploits for 0day vulnerabilities; $20,000 for exploits for vulnerabilities that do not require unprivileged user namespaces (CLONE_NEWUSER); and $20,000 for exploits using novel exploit techniques (previously it paid nothing for these). “These changes increase some 1day exploits to 71,337 USD (up from 31,337 USD), and makes it so that the maximum reward for a single exploit is 91,337 USD (up from 50,337 USD),” Google notes. On what it considers novel techniques, Google explains it’s for “powerful” offerings: “[N]ovel technique could be the exploitation of previously unknown objects to transform a limited primitive into a more powerful one, such as an arbitrary/out-of-bounds read/write or arbitrary free. For example, in all our submissions, researchers leveraged message queues to achieve kernel information leaks. “We are looking for similarly powerful techniques that allow heap exploits to be ‘plugged in’ and immediately allow kernel access. Another example is bypassing a common security mitigation or a technique for exploiting a class of vulnerabilities more reliably.”This Linux kernel exploitation bug bounty is a small part of Google’s overall Vulnerability Reward Programs covering Android, Chrome and other open-source projects. In 2021, Google paid out $8.7 million in rewards, $2.9 million of which was for Android bugs and $3.3 million for Chrome bugs. Last year’s total rewards rose from $6.7 million in 2020.  More

An unknown criminal hacking group is targeting organisations in the aviation, aerospace, defence, transportation and manufacturing industries with trojan malware, in attacks that researchers say have been going on for years.Dubbed TA2541 and detailed by cybersecurity researchers at Proofpoint, the persistent cyber-criminal operation has been active since 2017 and has compromised hundreds of organisations across North America, Europe, and the Middle East.

ZDNet Recommends

Despite running for years, the attacks have barely evolved, broadly following the same targeting and themes in which attackers remotely control compromised machines, conduct reconnaissance on networks and steal sensitive data. SEE: A winning strategy for cybersecurity (ZDNet special report)”What’s noteworthy about TA2541 is how little they’ve changed their approach to cybercrime over the past five years, repeatedly using the same themes, often related to aviation, aerospace, and transportation, to distribute remote access trojans,” said Sherrod DeGrippo, vice president of threat research and Detection at Proofpoint. “This group is a persistent threat to targets throughout the transportation, logistics, and travel industries.”Attacks begin with phishing emails designed to be relevant to individuals and businesses in the sectors being targeted. For example, one lure sent to targets in aviation and aerospace resembles requests for aircraft parts, while another is designed to look like an urgent request for air ambulance flight details. At one point, the attackers introduced COVID-19-themed lures, although these were soon dropped.

While the lures aren’t highly customised and follow regular templates, the sheer number of messages sent over the years – hundreds of thousands in total – and their implied urgency will be enough to fool victims into downloading malware. The messages are nearly always in English.  TA2541 initially sent emails containing macro-laden Microsoft Word attachments that downloaded the Remote Access Trojan (RAT) payload, but the group has recently shifted to using Google Drive and Microsoft OneDrive URLs, which lead to an obfuscated Visual Basic Script (VBS) file.  Interacting with these files – the names of which follow similar themes to the initial lures – will leverage PowerShell functions to download malware onto compromised Windows machines. The cyber criminals have distributed over a dozen different trojan malware payloads since the campaigns began, all of which are available to buy on dark web forums or can be downloaded from open-source repositories.  Currently, the most commonly delivered malware in TA2541 campaigns is AsyncRAT, but other popular payloads include NetWire, WSH RAT and Parallax. No matter which malware is delivered, it’s used to gain remote control of infected machines and steal data, although researchers note that they still don’t know what the ultimate goal of the group is, or where they are operating from. The campaign is still active and it’s been warned that the attackers will continue to distribute phishing emails and deliver malware to victims around the world.  MORE ON CYBERSECURITY More

F5 has launched a new software-as-a-service (SaaS) platform aimed at simplifying the firm’s branching security solutions.

Over the past few years, F5 has expanded its services with software and cloud services designed to tackle the disparity between the enterprise push toward digital transformation and an existing reliance on legacy systems. According to an F5 survey, 88% of organizations say they operate both legacy and modern architectures today.  When these systems, as well as Internet of Things (IoT), edge devices, cloud, remote collaborative tools, and mobile all, have to be considered by IT teams when considering potential attack vectors, managing such complexity and risk can be a challenge.  On Tuesday, the application security company said the portfolio expansion, called F5 Distributed Cloud Services, will “provide security, multi-cloud networking, and edge-based computing solutions.” Also: Deloitte launches new SaaS cyber threat detection and response platformF5 Distributed Cloud is a merger of technologies obtained by F5 from Volterra and Shape security. Functionality includes multi-cloud networking (MCN) functionality, cloud load balancing, cloud-native computing capabilities for edge computing use cases, and a Kubernetes Gateway.

The service will also include a new offering launched today, called the F5 Distributed Cloud WAAP (Web Application and API Protection).  WAAP integrates F5’s web application firewall and protection (F5 Advanced WAF), bot mitigation (F5 Shape AI), distributed denial-of-service (DDoS) monitoring, and API defenses based on Volterra’s machine learning technologies. The SaaS suite will enable teams to deploy each solution automatically and collectively.  “Today’s applications and business models are adapting faster than ever, and that means app security and infrastructure need to be much more agile and effective,” commented Haiyan Song, GM of the Security & Distributed Cloud Product Group at F5. “We are rapidly integrating our portfolio of services onto a distributed cloud services platform and continually innovating new services, so our customers can have the capabilities they need at the pace they require to achieve their ongoing business transformation.”  See alsoHave a tip? Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0 More

The number of hostile nation-state hacking operations is rising as new countries invest in cyber-intrusion campaigns and existing state-backed attack groups take advantage of the rise in organisations adopting cloud applications.Crowdstrike’s 2022 Global Threat Report details how the cyber-threat landscape has evolved during the past year. One of those developments is the rise of new countries engaging in offensive cyber operations, including Turkey and Columbia.

ZDNet Recommends

In accordance with Crowdstrike’s naming conventions, attacks by Turkish-linked groups are detailed as attacks by ‘Wolf’ while attacks by Columbian operations have been Dubbed ‘Ocelot’ – in a similar way to how cybersecurity researchers name Russian government-backed activity ‘Bear’ or Chinese hacking groups ‘Panda’.SEE: Cloud security in 2021: A business guide to essential tools and best practicesActivity by one of these new groups is detailed in the report; a Turkish-based hacking group, dubbed Cosmic Wolf by researchers, targeted data of an unspecified victim stored within an Amazon Web Services (AWS) cloud environment in April 2021.The attackers were able to break into the AWS cloud environment using stolen usernames and passwords, which also provided the attackers with the privileges required to alter command lines. That means they were able to alter security settings to allow direct Secure Shell Protocol (SSH) access to AWS from their own infrastructure, enabling the theft of data.Ultimately, countries are seeing that cyber campaigns can be easier to conduct than traditional espionage and are investing in these techniques.

“There are a lot of countries out there that look at this and realise it’s cheaper, it’s easier and it’s got plausible deniability built into it,” Adam Meyers, senior vice president of Intelligence at Crowdstrike, told ZDNet.”That’s what’s happening – we’re seeing more countries have developed these programmes and they’re going to get better at it over time.”One of the reasons countries are increasing their offensive cyber capabilities is due to the impact of the global pandemic. Lockdowns and stringent travel checks made it harder for traditional espionage techniques to be effective, leading towards investment in cyber operations.”It’s created a little bit more demand or accelerated planning around developing cyber capabilities for some of these countries that would have perhaps relied on other means previously,” said Meyers.The shift towards cloud applications and cloud IT services has also played an unwitting role in making cyberattacks easier. The rise of hybrid working means many employees aren’t based in an office, instead connecting remotely via collaborative applications, VPNs and other services – using a username and password.SEE: A winning strategy for cybersecurity (ZDNet special report)That makes being productive while working remotely simpler for employees – but it’s also made things simpler for hacking groups, who can secretly access networks with a stolen – or guessed – username and password. Some of the biggest cybersecurity incidents of recent years, like the SolarWinds and Microsoft Exchange attacks, have demonstrated how an attack targeting cloud services and cloud supply chains could be powerful, particularly if cloud is misconfigured or poorly monitored. “As organisations are moving to the cloud and looking to develop better capabilities, threat actors are moving there as well,” said Meyers.There are, however, steps that organisations can take to help make their networks and their cloud infrastructure more resistant to cyberattacks, including the adoption of a zero-trust strategy of not trusting devices connecting to the network by default. The research paper also recommends that organisations work towards eliminating misconfigurations in their cloud applications and services by setting up default patterns for setting up cloud, so when new accounts are set up, it’s done in a predictable manner, minimising the possibility of human error going undetected. Cloud architecture should also be monitored and maintained with security updates, like any other software.  MORE ON CYBERSECURITY More

Images: Sopa Images/Getty Images
Canada Deputy Prime Minister and Minister for Finance Chrystia Freeland has announced the government is broadening the scope of the country’s anti-money laundering monitoring and terrorist financing laws to cover crowdfunding platforms and the payment service providers they use. “These changes cover all forms of transactions, including digital assets such as crypto currencies,” she announced during a press conference on Monday night.   “The illegal blockades have highlighted the fact that crowdfunding platforms and some of the payment service providers they use are not fully captured under the proceeds of crime and terrorist financing act. “Our banks and financial institutions are already obligated to report the Financial Transactions and Reports Analysis Centre of Canada or FINTRAC. As of today, all crowdfunding platforms and the payment service providers they use must register with FINTRAC, and they must report large and suspicious transactions to FINTRAC.” The expanded rules are in response to ongoing “Freedom Convoy” protests, started by Canadian truck drivers opposing COVID-19 vaccination and quarantine mandates for cross-border drivers, that have shut down border crossings and halted downtown Ottawa. The protests, which have now entered their third week, have been partly funded by donors to self-described crowdfunding platform GiveSendGo. The platform was hacked on Sunday night, however, resulting in thousands of donor details being stolen. According to nonprofit leak site Distributed Denial of Secrets, it has obtained donor information for the Freedom Convoy campaign from the GiveSendGo platform as of Sunday, including self-reported names, email addresses, and ZIP codes.

Distributed Denial of Secrets said it would only provide the data to researchers and journalists. At the same time, Prime Minister Justin Trudeau invoked rarely used emergency powers under the Emergencies Act in an attempt to quell protests. The Emergencies Act gives government powers for 30 days to ban people from gathering in certain locations, allow officials to tow private vehicles blocking roads, and give power to financial institutions to block funds used to support illegal blockades.”The Emergencies Act will be used to strengthen and support law enforcement agencies at all levels across the country. This is about keeping Canadians safe, protecting people’s jobs and restoring confidence in our institutions,” Trudeau said. “We cannot and will not allow illegal and dangerous activities to continue,” he continued, assuring that the government will not use the Emergencies Act to call in the military. “We’re not suspending fundamental rights or overriding the Charter of Rights freedoms. We are not limiting people’s freedom of speech. We are not limiting freedom of peaceful assembly. We are not preventing people from exercising their right to protest legally,” Trudeau added.  Related Coverage More