Normal view

There are new articles available, click to refresh the page.
Yesterday — 25 June 2024Main stream

Risk Framework Body Related Data (PD) Immersive Tech

The content you are trying to access is private only to member users of the site. You must have a free membership at CISO2CISO.COM to access this content. You can register for free.       Thank you. The CISO2CISO Advisors Team. Username or E-mail Password Remember Me     Forgot Password

La entrada Risk Framework Body Related Data (PD) Immersive Tech se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

Before yesterdayMain stream

Generative AI for Organizational Use:Internal Policy Checklist

As the use of generative AI increases, organizations are revisiting their internal policies and procedures to ensure responsible, legal, and ethical employee use of these novel tools. The Future of Privacy Forum consulted over 30 cross-sector practitioners and experts in law,technology, and policy to understand the most pressing issues and how experts are accounting for […]

La entrada Generative AI for Organizational Use:Internal Policy Checklist se publicó primero en CISO2CISO.COM & CYBER SECURITY GROUP.

BreachForums Returns With a New Owner After ShinyHunters Retires

BreachForums returns with new owner

The on-again, off-again saga of BreachForums took another twist in recent days with the news that the data leak forum apparently has a new owner. ShinyHunters – who had reportedly retired after tiring of the pressure of running a notorious hacker forum – returned on June 14 to announce that the forum is now under the ownership of a threat actor operating under the new handle name “Anastasia.” It’s not yet clear if the move will quell concerns that the forum has been taken over by law enforcement after a May 15 FBI-led takeover, but for now, BreachForums is up and running under its .st domain.

ShinyHunters Alludes to BreachForums Issues

ShinyHunters alluded to those issues in a post announcing the forum’s new owner (screenshot below). “It's hard to maintain motivation when you're constantly getting accused of being a honeypot and at this point I'm burned out, hollow is burned out and we just want to move on to bigger things rather than the constant onslaught of users complaining about how we ran our forum,” ShinyHunters wrote. “Baphomet has done an incredible job of building new features for everyone, keeping everything together and maintaining the forum. Couldn't have done it without him. We hope the forum can live on without us for a long time. Thank you all for your support. Goodbye.” [caption id="attachment_77484" align="alignnone" width="750"]BreachForums returns with new owner The announcement of a new BreachForums owner[/caption] While “User-Anastasia” is a new account, ShinyHunters referred to the new owner as “an OG some of you may remember.” Cyble threat researchers reported that Anastasia also goes by “Anastasia Belshaw.”

BreachForums Returns, Hackers Raise Suspicions

BreachForums was seized by the FBI and the U.S. Department of Justice in mid-May, with help from international law enforcement agencies, and Baphomet was allegedly arrested in that action. However, just two weeks later, the forum returned, leading to suspicion among some threat actors that the site was operating as a “honeypot” or a sting operation under the control of the FBI. To further complicate matters, the site went down again last week, possibly due to technical issues, and its associated Telegram channels disappeared too amid reports that ShinyHunters was retiring. A few days later came the announcement that Anastasia would take over the forum. It remains to be seen what direction the forum will take under new ownership, but given the site’s volatile history, whatever is in store is certain to be eventful.

Stronger Private Key Protection For Code Signing: Are You Compliant With The Latest CA/B Forum Requirements?

12 June 2024 at 06:50

Last year, on June 1, 2023, the CA/Browser (CA/B) Forum’s updated Code Signing Baseline Requirements went into effect, aiming to enforce stronger private key protection for code signing certificates. The updated mandate now requires both Extended Validation (EV) and Non-EV code signing certificate private keys to be generated and stored on hardware crypto modules that […]

The post Stronger Private Key Protection For Code Signing: Are You Compliant With The Latest CA/B Forum Requirements? appeared first on Security Boulevard.

Malaysia’s Railway Assets Corporation (RAC) Faces Alleged Data Breach

RAC data breach

A hack on Malaysia's Railway Assets Corporation (RAC) has been reported by a dark web actor. The key entity under Malaysia's Ministry of Transport was the target of the RAC data hack. The threat actor "billy100" carried out this breach and posted its allegations on the BreachForums platform.  The RAC data breach, which was made public on a dark web forum, refers to personnel records that have been allegedly leaked and connected to the Railway Assets Corporation (RAC). There are 481 lines of documents in the compromised database, according to billy100. As evidence, the threat actor provided samples from the CSV files "users_id" and "detail," which included hashed passwords, email addresses, and usernames.

RAC Data Breach Allegedly Exposes Sensitive Information

[caption id="attachment_75309" align="alignnone" width="1445"]RAC data breach Source: Dark Web[/caption] Established under the Railways Act of 1991, the Railway Assets Corporation (RAC) is a federal statutory entity tasked with supporting Malaysia's railway infrastructure. Since its founding in 1992, RAC has played a significant role in bringing the nation's railway industry up to par with other leading nations. Since the corporation is in charge of managing and growing railway assets, it is very important. Sensitive employee data is purportedly hidden in the RAC data breach exposed database. Information about several aspects of personnel records is one of the disclosed details. The two main files that make up the stolen data are users_id.csv, which contains vital user information like IDs, names, emails, passwords, and more, and detail.csv, which offers additional in-depth employee information such as personal identifiers, department information, salary, and dates of birth.

Investigation and Cyberattacks on the Railway Sector

Inquiries on the RAC data loss and potential ransomware gang involvement have been made to the organization by The Cyber Express. However, as of the time of this writing, no formal response or statement had been made, so the allegations regarding the RAC data leak remain unsubstantiated.  Railroads, being essential infrastructure in the digital age, are increasingly vulnerable to cyber threats that endanger both their daily operations and public safety. Attacks on international railway networks in recent times have brought attention to the need for stronger cybersecurity protections. Vulnerabilities brought on by outdated systems, unsecured networking, and IoT devices raise the risks.  Rail operators need to prioritize asset visibility, implement strong authentication, encrypt communication networks, and keep a stockpile of up-to-date patches and upgrades to strengthen security. Ensuring that staff members receive comprehensive cybersecurity training is also essential. If transportation is to continue being reliable and secure in the future, cybersecurity must be fully integrated into railway operations. Media Disclaimer: This report is based on internal and external research obtained through various means. The information provided is for reference purposes only, and users bear full responsibility for their reliance on it. The Cyber Express assumes no liability for the accuracy or consequences of using this information.

NETMundial+10 Multistakeholder Statement Pushes for Greater Inclusiveness in Internet Governance Processes

23 May 2024 at 17:55

A new statement about strengthening internet governance processes emerged from the NETMundial +10 meeting in Brazil last month, strongly reaffirming the value of and need for a multistakeholder approach involving full and balanced participation of all parties affected by the internet—from users, governments, and private companies to civil society, technologists, and academics.

But the statement did more than reiterate commitments to more inclusive and fair governance processes. It offered recommendations and guidelines that, if implemented, can strengthen multistakeholder principles as the basis for global consensus-building and democratic governance, including in existing multilateral internet policymaking efforts.


The event and statement, to which EFF contributed with dialogue and recommendations, is a follow-up to the 2014 NETMundial meeting, which ambitiously sought to consolidate multistakeholder processes to internet governance and recommended
10 process principles. It’s fair to say that over the last decade, it’s been an uphill battle turning words into action.

Achieving truly fair and inclusive multistakeholder processes for internet governance and digital policy continues to face many hurdles.  Governments, intergovernmental organizations, international standards bodies, and large companies have continued to wield their resources and power. Civil society
  organizations, user groups, and vulnerable communities are too often sidelined or permitted only token participation.

Governments often tout multistakeholder participation, but in practice, it is a complex task to achieve. The current Ad Hoc Committee negotiations of the proposed
UN Cybercrime Treaty highlight the complexity and controversy of multistakeholder efforts. Although the treaty negotiation process was open to civil society and other nongovernmental organizations (NGOs), with positive steps like tracking changes to amendments, most real negotiations occur informally, excluding NGOs, behind closed doors.

This reality presents a stark contrast and practical challenge for truly inclusive multistakeholder participation, as the most important decisions are made without full transparency and broad input. This demonstrates that, despite the appearance of inclusivity, substantive negotiations are not open to all stakeholders.

Consensus building is another important multistakeholder goal but faces significant practical challenges because of the human rights divide among states in multilateral processes. For example, in the context of the Ad Hoc Committee, achieving consensus has remained largely unattainable because of stark differences in human rights standards among member States. Mechanisms for resolving conflicts and enabling decision-making should consider human rights laws to indicate redlines. In the UN Cybercrime Treaty negotiations, reaching consensus could potentially lead to a race to the bottom in human rights and privacy protections.

To be sure, seats at the policymaking table must be open to all to ensure fair representation. Multi-stakeholder participation in multilateral processes allows, for example, civil society to advocate for more human rights-compliant outcomes. But while inclusivity and legitimacy are essential, they alone do not validate the outcomes. An open policy process should always be assessed against the specific issue it addresses, as not all issues require global regulation or can be properly addressed in a specific policy or governance venue.

The
NETmundial+10 Multistakeholder Statement, released April 30 following a two-day gathering in São Paulo of 400 registered participants from 60 countries, addresses issues that have prevented stakeholders, especially the less powerful, from meaningful participation, and puts forth guidelines aimed at making internet governance processes more inclusive and accessible to diverse organizations and participants from diverse regions.

For example, the 18-page statement contains recommendations on how to strengthen inclusive and diverse participation in multilateral processes, which includes State-level policy making and international treaty negotiations. Such guidelines can benefit civil society participation in, for example, the UN Cybercrime Treaty negotiations. EFF’s work with international allies in the UN negotiating process is outlined here.

The NETmundial statement takes asymmetries of power head on, recommending that governance processes provide stakeholders with information and resources and offer capacity-building to make these processes more accessible to those from developing countries and underrepresented communities. It sets more concrete guidelines and process steps for multistakeholder collaboration, consensus-building, and decision-making, which can serve as a roadmap in the internet governance sphere.

The statement also recommends strengthening the UN-convened Internet Governance Forum (IGF), a predominant venue for the frank exchange of ideas and multistakeholder discussions about internet policy issues. The multitude of initiatives and pacts around the world dealing with internet policy can cause duplication, conflicting outcomes, and incompatible guidelines, making it hard for stakeholders, especially those from the Global South, to find their place. 


The IGF could strengthen its coordination and information sharing role and serve as a venue for follow up of multilateral digital policy agreements. The statement also recommended improvements in the dialogue and coordination between global, regional, and national IGFs to establish continuity between them and bring global attention to local perspectives.

We were encouraged to see the statement recommend that IGF’s process for selecting its host country be transparent and inclusive and take into account human rights practices to create equitable conditions for attendance.

EFF and 45 digital and human rights organizations last year called on the UN Secretary-General and other decision-makers to reverse their decision to grant host status for the 2024 IGF to Saudi Arabia, which has a long history of human rights violations, including the persecution of human and women’s rights defenders, journalists, and online activists. Saudi Arabia’s draconian cybercrime laws are a threat to the safety of civil society members who might consider attending an event there.  

❌
❌