Weekly Axis Of Easy #31
In this issue:
- Iran cuts off Internet and shuts down social networks
- Kansas man killed in “Swatting” prank
- UK to Google & Facebook: Hand over customer data or face higher taxes
- New US border rules limit scope of searches on your mobile device
- Review: Intel Meltdown / Spectre chip flaws
Just before the New Year it seemed as if mass protests were breaking out in Iran. The government moved to quell unrest by shutting down Internet access in certain cities and began blocking privacy enhanced apps like Telegram within the country.
Brian Krebs, himself a victim of “swatting” in 2013, reports on the inevitable tragedy that the practice was bound to produce. “Swatting”, or calling in a hoax hostage situation to 9/11 in order to deploy tactical police units to an unsuspecting victim’s address culminated in the death of a 28-year old father of two in Kansas. The prankster, known as “SWauTistic”, was unrepentant and boasted of carrying out serial swat attacks and of making bogus bomb threats in the past. 25-year old Tyler Barriss was arrested in Los Angeles and will be extradited to Kansas to face charges of making a false alarm, a felony in that state.
U.K Security Minister Ben Wallace lamented that companies such as Google and Facebook are “being happy to sell people’s data but not to give it to the government which was being forced to spend vast sums on de-radicalization programs, surveillance and other counter-terrorism measures”. He posits the idea of levying additional taxes on such companies to incentive their cooperation with the government.
A new CBP directive provided guidance and set limits on when border guards can conduct “advanced” searches of your mobile device when crossing the border. Agents can still search data stored on your device but cannot search anything in your remote data stores (a.k.a “the cloud”) unless they have reasonable grounds or suspicion.
This is still considered by advocacy groups such as the ACLU as a warrantless search.
If you missed our special update last week about the the Intel chip flaws, you may want to check it out. Since we issued that I’ve seen at least one Proof-of-Concept javascript exploit for this circulated on a security lists. Malicious exploits can’t be far behind.