Cybersecurity

The Earn It Act is a problem for end to end encryption. As security professionals we know that criminals have the option to use encryption just as ordinary people do and if a court cannot decrypt the digital data to obtain incriminating evidence against a crime sometimes otherwise obvious crimes go unpunished. If the The Earn It Act goes into effect companies like Signal would need to comply in order to be protected by Section 230 which is a law that says that companies that provide a communication platform are not liable for the content that is posted on their platforms. The compliance guidelines are said to be unlikely to include end-to-end encryption. "Riana Pfefferkorn, Associate Director of Surveillance and Cybersecurity at the Stanford Center for Internet and Society, wrote a detailed breakdown of some of the myriad problems with this bill. She also astutely points out that the bill would give unprecedented power to Attorney General William Barr, a vocal critic of end-to-...

This week I'd like to share the tale of when last year, this time, April 2019, I noticed that my XBOX Live profile page was either defaced or a bug caused my profile image to be replaced with the image at this URL . One can see in this screenshot of my profile page the defacement. The incorrect image is the Woody Allen portrait drawing. It was interesting to me so I dug around a little bit. I used the browser developer tools to examine the markup. That wasn't allot of help. I knew less about website security then. As much as I know it may have been a cross sight scripting attack (XSS). This was an example of a persistent website defacement attack. This W3Schools page  has a straight forward example of an implication of XSS. I found many users who's profiles had been defaced and when I contacted many of them they thought I was joking or hadn't realized that it had happened to them. Here is a link to a reddit discussion about it. https://www.reddit.com/r/xbox3...

Bluetooth is one of those protocols that is off most security professional's radar because an attacker usually needs to be in very close range to intercept a BT connection. BT vulnerabilities should be kept in mind however. There are a number of vulnerabilities in BT. BlueBorne is a vulnerability discovered in several Bluetooth implementations. Btlejacking relies on the jamming vulnerability tracked as CVE-2018-7252 and affects BLE devices with versions 4.0, 4.1, 4.2 and 5. https://cyware.com/news/latest-bluetooth-hacking-techniques-expose-new-attack-vectors-for-hackers-a16cfb5e Connecting to a Bluetooth low energy device (BLE) apparently can be done with JavaScript. https://evothings.com/doc/tutorials/how-to-connect-to-ble-devices.html