On Tuesday, former Maryland representative and 2020 presidential candidate John Delaney announced a plan to create a Department of Cybersecurity that "would be led by a cabinet-level secretary who would be in charge of implementing the United States' cybersecurity strategy," reports The Verge. "The proposal is the first major cybersecurity push from any presidential candidate so far this cycle." From the report: In a press release, Delaney argued that the U.S.'s cyber authorities are spread too thin across too many agencies. This new agency would work to streamline the country's current approach. "Securing our cyber-infrastructure is not only a national security priority, it is an economic one as well," Delaney said. "In light of the many recent and continued cyberattacks on our country, we need to establish a cabinet-level agency to focus on protecting our cyberspace."

Currently, the cybersecurity responsibility is scattered across a number of agencies, with Homeland Security handling threats to civilian agencies, US Cyber Command dealing with military cyberattacks, the FBI prosecuting federal and international cybercrime, and a string of ISACs coordinating private sector actors alongside government agencies. In the past, the White House has appointed a cybersecurity coordinator, or "czar," to work across those agencies, but President Trump eliminated the position in May 2018, leaving no single person or agency in charge of leading the country's cybersecurity efforts.

On April 6, something known as the GPS rollover, a cousin to the dreaded Y2K bug, mostly came and went, as businesses and government agencies around the world heeded warnings and made software or hardware updates in advance. But in New York, something went wrong -- and city officials seem to not want anyone to know. [Editor's note: the link may be paywalled; alternative source] New submitter RAYinNYC shares a report: At 7:59 p.m. E.D.T. on Saturday, the New York City Wireless Network, or NYCWiN, went dark, waylaying numerous city tasks and functions, including the collection and transmission of information from some Police Department license plate readers. The shutdown also interrupted the ability of the Department of Transportation to program traffic lights, and prevented agencies such as the sanitation and parks departments from staying connected with far-flung offices and work sites. The culprit was a long-anticipated calendar reset of the centralized Global Positioning System, which connects to devices and computer networks around the world. There has been no public disclosure that NYCWiN, a $500 million network built for the city by Northrop Grumman, was offline and remains so, even as workers are trying to restore it.

City officials tried to play down the shutdown when first asked about it on Monday, speaking of it as if it were a routine maintenance issue. "The city is in the process of upgrading some components of our private wireless network," Stephanie Raphael, a spokeswoman for the Department of Information Technology and Telecommunications, said in an email on Monday. She referred to the glitch as a "brief software installation period." By Tuesday, the agency acknowledged the network shutdown, but said in an emailed statement that "no critical public safety systems are affected." Ms. Raphael admitted that technicians have been unable to get the network back up and running, adding, "We're working overtime to update the network and bring all of it back online." The problem has raised questions about whether the city had taken appropriate measures to prepare the network for the GPS rollover.

A malware operation previously limited to China's borders has expanded over the past few months to infect users from all over the world, antivirus firm Bitdefender said in a report published today. From a report: Users who have the bad habit of downloading and installing cracked software applications are at the highest risk. According to Bitdefender experts, these apps are laced with a relatively new malware strain named Scranos. The most important piece of this malware is a rootkit driver that's hidden inside the tainted apps and which allows the malware to gain boot persistence and take full control over users' systems in the early stages of an infection. Although Bitdefender describes Scranos as "a work in progress, with many components in the early stage of development," the malware is still very dangerous as it is. That's because Scranos is a modular threat that once it infects a host computer, it can ping its command and control (C&C) server for additional instructions, and then download small modules to execute a fine set of operations.

Mozilla has launched a petition today to get Apple to rotate the IDFA unique identifier of iOS users every month. From a report: The purpose of this request is to prevent online advertisers from creating profiles that contain too much information about iOS users. IDFA stands for "IDentifier For Advertisers" and is a per-device unique ID. Apps running on a device can request access to this ID and relay the number to advertising SDKs/partners they use to show ads to their users. As experts from Singular, a mobile marketing firm explain, "IDFAs take the place of cookies in mobile advertising delivered to iOS devices because cookies are problematic in the mobile world." IDFAs are different from UDIDs, which stand for "unique device identifiers," which are permanent and unchangeable device identifiers. Apple added support for IDFAs specifically to replace UDIDs, which many apps were collecting for all sorts of shady reasons, enabling pervasive tracking of iOS users.

An anonymous reader quotes a report from Motherboard: The U.S. government does not have any evidence that WikiLeaks founder Julian Assange succeeded in cracking a password for whistleblower Chelsea Manning, according to a newly unsealed affidavit written by an FBI agent. Last week, Assange was escorted out of the Ecuadorian embassy in London, and arrested for breaching bail in connection to allegations of sexual misconduct in Sweden. The day of Assange's arrest, the U.S. government unsealed an indictment against Assange with a hacking conspiracy charge. The Department of Justice accused WikiLeaks' founder of agreeing to help Manning crack a password that would have helped the former military analyst get into a classified computer system under a username that did not belong to her, making it harder for investigators to trace the eventual leak.

On Monday, the U.S. District Court for the Eastern District of Virginia unsealed the affidavit, which is dated December 21, 2017. The document contains more details on the interactions between Assange and Manning. And, most significantly, contains the admission that the U.S. government -- as of December of 2017 -- had no idea whether Assange actually cracked the password. Until now, we knew that the U.S. was aware that Assange attempted to crack a password for Manning once, but didn't know if it had more evidence of further attempts or whether it thought Assange was successful. "Investigators have not recovered a response by Manning to Assange's question, and there is no other evidence as to what Assange did, if anything, with respect to the password," FBI agent Megan Brown said in the affidavit. According to lawyers, the simple offer to help can be considered part of a conspiracy to violate the Computer Fraud and Abuse Act.

"For purposes of a conspiracy charge, it is not necessary for the action to be successful. All that is needed is an overt action in furtherance of the conspiracy, namely Assange's efforts to crack the password for Manning," Bradley, a lawyer at the Mark Zaid P.C law firm in Washington, DC, told Motherboard via email. "That he failed is irrelevant."

9to5Mac has learned of several new features expected to be included in iOS 13. From the report: Dark Mode: There will be a system-wide Dark Mode that can be enabled in Settings, including a high contrast version, similar to what's already available on macOS. Speaking of macOS, iPad apps that run on the Mac using Marzipan will finally take advantage of the Dark Mode support on both systems.
Multitasking: There are many changes coming to iPad with iOS 13, including the ability for apps to have multiple windows. Each window will also be able to contain sheets that are initially attached to a portion of the screen, but can be detached with a drag gesture, becoming a card that can be moved around freely, similar to what an open-source project called "PanelKit" could do. These cards can also be stacked on top of each other, and use a depth effect to indicate which cards are on top and which are on the bottom. Cards can be flung away to dismiss them.
Undo gesture: With iOS 13, Apple is introducing a new standard undo gesture for text input on the iPad. The gesture starts as a three-finger tap on the keyboard area, sliding left and right allows the user to undo and redo actions interactively.
Safari improvements: Safari on iOS 13 for the iPad will automatically ask for a desktop version of websites when necessary, preventing a common issue where websites will render their iPhone version even when running on an iPad with a big screen. YouTube is notorious for this behavior, forcing users to rely on a 'Request Desktop Site' button.
Font management: Font management is getting a major upgrade on iOS 13. It will not be necessary to install a profile to get new fonts into the system anymore. Instead there will be a new font management panel in Settings. A new standard font picker component will be available for developers and the system will notify the user when they open a document that has missing fonts.
Smarter Mail: The upgraded Mail app will be able to organize messages into categories such as marketing, purchases, travel, "not important" and more, with the categories being searchable. Users will also be able to add messages to a "read later" queue similar to third-party email apps. Improved multiple item selection: The focus on productivity on iOS continues with the inclusion of new gestures to allow for the selection of multiple items in table views and collection views, which make up for most of the user interfaces found in apps that list large amounts of data. Users will be able to drag with multiple fingers on a list or collection of items to draw a selection, similar to clicking and dragging in Finder on the Mac.
New Volume HUD and other changes: Other features to come with iOS 13 include a redesigned Reminders app, which is also coming to the Mac, a new volume HUD, better "Hey Siri" rejection for common mistaken noises such as laughter and crying babies, better multilingual support for keyboards and dictation, and expanded in-app printing controls. Apple is expected to officially unveil the next major iPhone and iPad OS at its annual Worldwide Developers Conference on June 3rd.

secwatcher shares a report from Threatpost: A popular smartwatch that allows parents to track their children's whereabouts, TicTocTrack, has been discovered to be riddled with security issues that could allow hackers to track and call children. Researchers at Pen Test Partners revealed vulnerabilities in the watch (sold in Australia) on Monday, which could enable hackers to track children's location, spoof the child's location or view personal data on the victims' accounts. The parent company of the TicTocTrack watch, iStaySafe Pty Ltd., has temporarily restricted access to the watch's service and app while it investigates further. Researchers found that the service's back end does not make any authorization attempt on any request -- besides the user having a valid username and password combination. That means that an attacker who is logged into the service could remotely compromise the app and track other accounts that are based in Australia.

The smartwatch, available in Australia for $149 (USD), is designed for children and uses GPS to track the movement of the wearer every six minutes, and offers voice calling and SMS features. The smartwatch's API can be attacked by changing the FamilyIdentifier number (which identifies the family that the user belongs to), which then could give a bad actor complete access to the user's data -- including the children's location, parent's full names, phone numbers and other personal identifiable information. Researchers with Pen Test Partners collaborated with security researcher Troy Hunt to test the attack. Hunt uploaded a video showing how the smartwatch vulnerability could be exploited to call his daughter -- and how her smartwatch would answer automatically without any interaction needed from her end.

The Defense and Advanced Research Projects Agency (DARPA) appears to be in the process of developing its own ultra secure communication platform. The program is called "Resilient Anonymous Communication for Everyone," or RACE, and it will be similar to WhatsApp in that it will be for everyone to use. Trusted Reviews reports: The objectives of the program are to create a distributed messaging system that can do three things: Exist completely within a network; Provide confidentiality, integrity and availability of messaging; and Preserve privacy to any participant in the system.

DARPA seem to be putting security front and center, and the description of the project claims that "compromised system data and associated networked communications should not be helpful for comprising any additional parts of the system," meaning that DARPA are keen that one breach shouldn't also give them a leg up on access to other parts of the system. So, will we soon be using a U.S government branded DARPA? Probably not, but the chances are that RACE will go some way to creating a messaging app that's resilient to attacks, with the protocol and security they find no doubt dripping through to consumer tech and features in the coming years.

A hacker who spoke with ZDNet in February about wanting to put up for sale the data of over one billion users is getting dangerously close to his goal after releasing another 65.5 million records last week and reaching a grand total of 932 million records overall. From a report: The hacker's name is Gnosticplayers, and he's responsible for the hacks of 44 companies, including last week's revelations. Since mid-February, the hacker has been putting batches of hacked data on Dream Market, a dark web marketplace for selling illegal products, such as guns, drugs, and hacking tools. He's released data from companies like 500px, UnderArmor, ShareThis, GfyCat, and MyHeritage, just to name the bigger names. Releases have been grouped in four rounds -- Round 1 (620 million user records), Round 2 (127 million user records), Round 3 (93 million user records), and Round 4 (26.5 million user records).

eatmorekix writes: On Saturday, Microsoft confirmed that some users of the company's email service had been targeted by hackers. A hacker or group of hackers had first broken into a customer support account for Microsoft, and then used that to gain access to information related to customers' email accounts such as the subject lines of their emails and who they've communicated with. But the issue is much worse than previously reported, with the hackers able to access email content from a large number of Outlook, MSN, and Hotmail email accounts, according to a source who witnessed the attack in action and described it before Microsoft's statement, as well as screenshots provided to Motherboard. Microsoft confirmed to Motherboard that hackers gained access to the content of some customers' emails.

Salon writes that Silicon Valley tech workers are "defying their overlords," arguing that recent unionization attempts by Kickstarter employees may be only the beginning: The workers' Kickstarter campaign is not the first attempt, though, or even the first time rumblings of unionization, have circulated among programmers. In 2018, software engineers at the startup Lanetix announced their intent to unionize -- and were promptly fired by management (It is illegal to fire employees for trying to unionize). The National Labor Relations Board intervened, and ultimately forced Lanetix to pay the 15 fired engineers a total of $775,000. The show of worker power at Lanetix may have paved the way for Kickstarter's workers. Similarly, workers across the video game industry -- generally among the most overworked, underpaid workers within the tech industry -- have been making steps towards unionization. Game Workers Unite, profiled by Salon last year, is building a grassroots movement to organize the ranks of video game makers.

Together, this suggests that a small but visible movement for white-collar software engineers unionizing has been gaining steam in the Valley over the past few years -- suggesting that the people who make up the tech industry, once a bastion of libertarianism, are starting to understand the often subtle ways that their employers exploit them... For decades, libertarianism was part and parcel to the tech industry. Despite a grueling work culture and a high-profile collusion scandal among major tech corporations to suppress software engineers' wages, tech workers were more likely to see themselves as future founders than an exploited underclass -- a point of view encouraged by employers through high wages and generous, often absurd office perks. Recent developments suggest such endearing tactics are no longer working.

Security researcher John Page has revealed a new zero-day exploit that allows remote attackers to exfiltrate Local files using Internet Explorer. "The craziest part: Windows users don't ever even have to open the now-obsolete web browser for malicious actors to use the exploit," reports Mashable. "It just needs to exist on their computer..." [H]ackers are taking advantage of a vulnerability using .MHT files, which is the file format used by Internet Explorer for its web archives. Current web browsers do not use the .MHT format, so when a PC user attempts to access this file Windows opens IE by default. To initiate the exploit, a user simply needs to open an attachment received by email, messenger, or other file transfer service...

Most worrisome, according to Page, is that Microsoft told him that it would just "consider" a fix in a future update. The security researcher says he contacted Microsoft in March before now going public with the issue. As ZDNet points out, while Internet Explorer usage makes up less than 10 percent of the web browser market, it doesn't particularly matter in this case as the exploit just requires a user to have the browser on their PC.

An anonymous reader quotes Reuters: Richard Liu, the founder of Chinese e-commerce giant JD.com Inc, has weighed in on an ongoing debate about the Chinese tech industry's grueling overtime work culture, lamenting that years of growth had increased the number of "slackers" in his firm who are not his "brothers...." Liu, who started the company that would become JD.com in 1998, in the note spoke about how in the firm's earliest days he would set his alarm clock to wake him up every two hours to ensure he could offer his customers 24-hour service -- a step he said was crucial to JD's success...

The '996' work schedule, which refers to a 9 a.m. to 9 p.m. workday, six days a week, has in particular become the target of online debate and protests on some coding platforms, where workers have swapped examples of excessive overtime demands at some firms. Liu said JD did not force its staff to work the "996" or even a "995" overtime schedule. "But every person must have the desire to push oneself to the limit!" he said.
JD disputed reports that the company would be cutting up to 8% of its workforce, but did say "We're getting back to those roots as we seek, develop and reward staff who share the same hunger and values... JD.com is a competitive workplace that rewards initiative and hard work, which is consistent with our entrepreneurial roots."

JD's investors include Walmart and Google.

A "limited" number of users of Microsoft's webmail services -- which include Hotmail, Outlook.com, and MSN -- "had their accounts compromised, TechCrunch reports. "We addressed this scheme, which affected a limited subset of consumer accounts, by disabling the compromised credentials and blocking the perpetrators' access," said a Microsoft spokesperson in an email. According to an email Microsoft has sent out to affected users, malicious hackers were potentially able to access an affected user's e-mail address, folder names, the subject lines of e-mails, and the names of other e-mail addresses the user communicates with -- "but not the content of any e-mails or attachments," nor -- it seems -- login credentials like passwords. Microsoft is still recommending that affected users change their passwords regardless.

The breach occurred between January 1 and March 28, Microsoft's letter to users said. The hackers got into the system by compromising a customer support agent's credentials, according to the letter. Once identified, those credentials were disabled. Microsoft told users that it didn't know what data was viewed by the hackers or why, but cautioned that users might as a result see more phishing or spam emails as a result.

An anonymous reader quotes a report from TechCrunch: A hacker group has breached several FBI-affiliated websites and uploaded their contents to the web, including dozens of files containing the personal information of thousands of federal agents and law enforcement officers, TechCrunch has learned. The hackers breached three sites associated with the FBI National Academy Association, a coalition of different chapters across the U.S. promoting federal and law enforcement leadership and training located at the FBI training academy in Quantico, VA. The hackers exploited flaws on at least three of the organization's chapter websites -- which we're not naming -- and downloaded the contents of each web server. The hackers then put the data up for download on their own website, which we're also not naming nor linking to given the sensitivity of the data. The spreadsheets contained about 4,000 unique records after duplicates were removed, including member names, a mix of personal and government email addresses, job titles, phone numbers and their postal addresses. The FBINAA could not be reached for comment outside of business hours. If we hear back, we'll update. "We hacked more than 1,000 sites," said the hacker. "Now we are structuring all the data, and soon they will be sold. I think something else will publish from the list of hacked government sites." When asked if they were worried that the files they put up for download would put federal agents and law enforcement at risk, the hacker said: "Probably, yes." The hacker claimed to have "over a million data" [sic] on employees across several U.S. federal agencies and public service organizations.

An anonymous reader quotes a report from Motherboard: Tens of thousands of perfectly usable iPhones are scrapped each year by electronics recyclers because of the iPhone's "activation lock," according to a new analysis paper published Thursday. Earlier this year, we published a lengthy feature about the iPhone's activation lock (also called iCloud lock informally), an anti-theft feature that prevents new accounts from logging into iOS without the original user's iCloud password. This means that stolen phones can't be used by the person who stole it without the original owner's iCloud password (this lock can also be remotely enabled using Find My iPhone.) The feature makes the iPhone a less valuable theft target, but it has had unintended consequences, as well. iCloud lock has led to the proliferation of an underground community of hackers who use phishing and other techniques to steal iCloud passwords from the original owner and unlock phones. It's also impacted the iPhone repair, refurbishing, and recycling industry, because phones that are legitimately obtained often still have iCloud enabled, making that phone useless except for parts.

Between 2015 and 2018, the Wireless Alliance, the recycling company in question, collected roughly 6 million cell phones in donation boxes it set up around the country. Of those, 333,519 of them were iPhones deemed by the company to be "reusable." And of those, 33,000 of them were iCloud locked and had to be stripped for parts and scrap metal. Last year, a quarter of all reusable iPhones it collected were activation locked. Allison Conwell, a coauthor of the CoPIRG report, told me in a phone call that the Wireless Alliance's findings show that many people donate their devices intending for them to be reused, but they're scrapped instead. In her paper, Conwell suggests that Apple should work with certified recyclers to unlock phones that have been legitimately donated (a survey of random devices conducted by the Wireless Alliance found that more than 90 percent of them had not been reported lost or stolen.) The paper suggests that Apple could either unlock phones that have not been reported lost or stolen for 30 days, or affirmatively ask users whether they had donated their previous phone and unlock it that way.

An anonymous reader writes: Microsoft published today a generic "security configuration framework" that contains guidance for systems administrators about the basic security settings they should be applying in order to secure Windows 10 devices. The SECCON framework, the name Microsoft gave this framework, is are five different recommendations for securing a Windows 10 device, depending on its role inside an organization (Enterprise security, Enterprise high-security, Enterprise VIP security, DevOps, Administrator). [Note: last two docs are empty and don't include any info just yet].

For each of these security levels, Microsoft has published default templates for Windows policies that sysadmins can apply to desired PCs, based on the access levels those workstations have. Microsoft hopes this will automate a system administrator's job in deploying a basic minimum of security features to Windows 10 systems, on which custom modifications can then be made, depending on each enterprise's needs.

Two security researchers disclosed details this week about a group of vulnerabilities collectively referred to as Dragonblood that impact the Wi-Fi Alliance's recently launched WPA3 Wi-Fi security and authentication standard. From a report: If ever exploited, the vulnerabilities would allow an attacker within the range of a victim's network to recover the Wi-Fi password and infiltrate the target's network. In total, five vulnerabilities are part of the Dragonblood ensemble -- a denial of service attack, two downgrade attacks, and two side-channel information leaks.

While the denial of service attack is somewhat unimportant as it only leads to crashing WPA3-compatible access points, the other four are the ones that can be used to recover user passwords. Both the two downgrade attacks and two side-channel leaks exploit design flaws in the WPA3 standard's Dragonfly key exchange -- the mechanism through which clients authenticate on a WPA3 router or access point. In a downgrade attack, Wi-Fi WPA3-capable networks can be coerced in using an older and more insecure password exchange systems, which can allow attackers to retrieve the network passwords using older flaws.

An anonymous reader quotes a report from The Register: An American company is to build a series of undersea cables linking Australia to China after the Aussie government put its foot down and kicked Huawei off the contract. Building on our reports from last year that Australia had blocked Huawei from building a 4,000km cable between Australia, Papua New Guinea and the Solomon Islands, U.S. company TE Subcom has reportedly won the deal to build the link.

"All options for meshing the Pacific Islands are good for the development of the economies of these countries," Keir Preedy, chief executive of the Solomon Island Submarine Cable Company, told Reuters. The company is developing the Solomons' new cable. In addition to the Aus-PNG-Solomons route previously announced, TE Subcom will build a cable spur to Hong Kong -- Chinese territory. "It is due for completion in 2022 and also includes a possible trans-Pacific branch to Los Angeles," the newswire stated.

An anonymous reader quotes a report from Ars Technica: Sixteen months ago, researchers reported an unsettling escalation in hacks targeting power plants, gas refineries, and other types of critical infrastructure. Attackers who may have been working on behalf of a nation caused an operational outage at a critical-infrastructure site after deliberately targeting a system that prevented health- and life-threatening accidents. What was unprecedented in this attack -- and of considerable concern to some researchers and critical infrastructure operators -- was the use of an advanced piece of malware that targeted the unidentified site's safety processes. The malware was named Triton and Trisis, because it targeted the Triconex product line made by Schneider Electric. Its development was ultimately linked to a Russian government-backed research institute.

Now, researchers at FireEye -- the same security firm that discovered Triton and its ties to Russia -- say they have uncovered an additional intrusion that used the same malicious software framework against a different critical infrastructure site. As was the case in the first intrusion, the attackers focused most of their resources on the facility's OT, or operational technology, which are systems for monitoring and managing physical processes and devices. The discovery has unearthed a new set of never-before-seen custom tools that shows the attackers have been operational since as early as 2014. The existence of these tools, and the attackers' demonstrated interest in operational security, lead FireEye researchers to believe there may be other sites beyond the two already known where the Triton attackers were or still are present. "After establishing an initial foothold on the corporate network, the Triton actor focused most of their effort on gaining access to the OT network," FireEye researchers wrote in a report published Wednesday. "They did not exhibit activities commonly associated with espionage, such as using key loggers and screenshot grabbers, browsing files, and/or exfiltrating large amounts of information. Most of the attack tools they used were focused on network reconnaissance, lateral movement, and maintaining presence in the target environment."