NowSecure #MobSec5 - Week of Feb. 20

“A severe security vulnerability has been discovered in the CloudFlare content delivery network that has caused big-name websites to expose private session keys and other sensitive data.”

“Today, 10 years after of SHA-1 was first introduced, we are announcing the first practical technique for generating a collision.”

“A new Android banking trojan poses as a legitimate weather forecast app in an effort to steal users’ banking credentials.”

“Look for U.S. President Donald Trump’s administration to push for increased cybersecurity spending in government, but also for increased digital surveillance and encryption workarounds.”

There’s still no official word on when to expect the release of the Trump administration’s executive order on cybersecurity (though it may come prior to the president speaking to Congress on Tuesday). A purported draft of the order states, “Effective immediately, Agency Heads shall use The Framework for Improving Critical Infrastructure Cybersecurity (the Framework), or any successor document, developed by the National Institute of Standards and Technology to manage their agency’s cyber risk.” NIST will host webinars at the beginning of March discussing how to use the framework and explaining updates published in January. Unfortunately registration for the live events is already full, but recordings of the webinars will be published within two weeks.

“The next time you open your smartphone, be sure that you know what it’s doing behind the scenes.”

“For a relatively small fee, you can snoop on someone’s messages, call logs, photos, and location from across the planet.”

The reporter writes, “Within minutes, I had downloaded the malware, turned off an Android security setting that would allow it to install itself, entered my subscription key, and was ready to collect data.” So, to install the malware and compromise the device, physical access to the unlocked phone was necessary.

“A federal magistrate judge in Chicago recently denied the government’s attempt to force people in a particular building to depress their fingerprints in an attempt to open any seized Apple devices as part of a child pornography investigation.”

“Not long after the husband texted the stolen phone — offering to buy back the locked device — he soon began receiving text messages stating the phone had been found.”

“Palantir has never masked its ambitions, in particular the desire to sell its services to the U.S. government — the CIA itself was an early investor in the startup through In-Q-Tel, the agency’s venture capital branch.”