Read Time:8 Second
A North Carolina resident made over $10m in unlawful royalty payments by producing hundreds of thousands of fake songs listened to by bots using AI
Category Archives: News
Australia Threatens to Force Companies to Break Encryption
Read Time:2 Minute, 28 Second
In 2018, Australia passed the Assistance and Access Act, which—among other things—gave the government the power to force companies to break their own encryption.
The Assistance and Access Act includes key components that outline investigatory powers between government and industry. These components include:
Technical Assistance Requests (TARs): TARs are voluntary requests for assistance accessing encrypted data from law enforcement to teleco and technology companies. Companies are not legally obligated to comply with a TAR but law enforcement sends requests to solicit cooperation.
Technical Assistance Notices (TANs): TANS are compulsory notices (such as computer access warrants) that require companies to assist within their means with decrypting data or providing technical information that a law enforcement agency cannot access independently. Examples include certain source code, encryption, cryptography, and electronic hardware.
Technical Capability Notices (TCNs): TCNs are orders that require a company to build new capabilities that assist law enforcement agencies in accessing encrypted data. The Attorney-General must approve a TCN by confirming it is reasonable, proportionate, practical, and technically feasible.
It’s that final one that’s the real problem. The Australian government can force tech companies to build backdoors into their systems.
This is law, but near as anyone can tell the government has never used that third provision.
Now, the director of the Australian Security Intelligence Organisation (ASIO)—that’s basically their CIA—is threatening to do just that:
ASIO head, Mike Burgess, says he may soon use powers to compel tech companies to cooperate with warrants and unlock encrypted chats to aid in national security investigations.
[…]
But Mr Burgess says lawful access is all about targeted action against individuals under investigation.
“I understand there are people who really need it in some countries, but in this country, we’re subject to the rule of law, and if you’re doing nothing wrong, you’ve got privacy because no one’s looking at it,” Mr Burgess said.
“If there are suspicions, or we’ve got proof that we can justify you’re doing something wrong and you must be investigated, then actually we want lawful access to that data.”
Mr Burgess says tech companies could design apps in a way that allows law enforcement and security agencies access when they request it without comprising the integrity of encryption.
“I don’t accept that actually lawful access is a back door or systemic weakness, because that, in my mind, will be a bad design. I believe you can these are clever people design things that are secure, that give secure, lawful access,” he said.
We in the encryption space call that last one “nerd harder.” It, and the rest of his remarks, are the same tired talking points we’ve heard again and again.
It’s going to be an awfully big mess if Australia actually tries to make Apple, or Facebook’s WhatsApp, for that matter, break its own encryption for its “targeted actions” that put every other user at risk.
Car Giant Avis Reveals Breach Impacted 300,000 Customers
Read Time:4 Second
Rental hire company Avis has notified 300,000 customers of a data breach
TfL Admits Some Services Are Down Following Cyber-Attack
Read Time:5 Second
Transport for London has revealed several digital services are suspended after a cyber-attack last week
Live Video of Promachoteuthis Squid
Read Time:7 Second
The first live video of the Promachoteuthis squid, filmed at a newly discovered seamount off the coast of Chile.
YubiKey Side-Channel Attack
Read Time:15 Second
There is a side-channel attack against YubiKey access tokens that allows someone to clone a device. It’s a complicated attack, requiring the victim’s username and password, and physical access to their YubiKey—as well as some technical expertise and equipment.
Still, nice piece of security analysis.
Spyware Vendors’ Nebulous Ecosystem Helps Them Evade Sanctions
Read Time:8 Second
The secret web of at least 435 entities across 42 countries making up the spyware landscape facilitates unpunished security and human rights violations, the Atlantic Council found
US and Allies Accuse Russian Military of Destructive Cyber-Attacks
Read Time:6 Second
The joint government advisory highlighted the cyber activities of Unit 29155, which has launched destructive cyber-attacks against critical infrastructure globally
PyPI Revival Hijack Puts Thousands of Applications at Risk
Read Time:5 Second
Revival Hijack Python Package Index supply chain attack threatens 22,000 packages through malicious downloads
Security Budgets Come Under Pressure as “Hypergrowth” Ends
Read Time:6 Second
Despite rising threats researchers find a third of firms see flat or falling security budgets and hiring slows