Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Attacks/Breaches

10 Biggest Information Security Stories Of 2012

From John McAfee's escape from Belize to the privacy debacle that compromised CIA director Petraeus' career, 2012 had no shortage of security shockers.

6. Privacy Bill Of Rights Lacks Force Of Law.

Earlier this year, the White House unveiled a pioneering Consumer Privacy Bill of Rights, building on FTC recommendations for increasing the transparency of how businesses use people's personal information. Unfortunately, because the bill of rights hasn't been passed by Congress and become law, the White House has to encourage businesses to say they'll voluntarily abide by the recommendations.

Also this year, California's attorney general began requiring that all mobile apps distributed to its residents -- and thus, really, any U.S. resident -- would need to contain clear privacy policies, or be in breach of California law. Later in the year, California carried through by warning and then suing Delta Airlines for failing to offer a privacy policy for its mobile apps.

Beyond the White House and California, however, the body that's most notably been absent from advancing consumer privacy protections has been Congress, which has so far failed to pass any laws aimed at protecting people's online privacy.

7. How Girlfriends Stop Hackers.

What stops hackers from hacking? Simple: Jobs, relationships, children and other adult responsibilities. Some readers, perhaps not making it past the related story headline --"One Secret That Stops Hackers: Girlfriends" -- took offense at the suggestion that more hackers need girlfriends. Others suggested that the actual cost of procuring girlfriends for hackers might prove exorbitant, while other respondents reported that yes, in fact they'd dropped hacking because they'd gotten a girlfriend.

Based on research conducted by online psychology expert Grainne Kirwan, who lectures at Ireland's Dun Laoghaire Institute of Art, Design and Technology, as do other criminals most law-breaking hackers simply "age out" of their life of crime after getting more responsibilities. But even with that knowledge, the next step toward preventing more teenagers from breaking the law by hacking remains an open question.

8. Revealed: Outsourced Brokerage Firm IT Meltdown.

Although the downfall of brokerage firm GunnAllen occurred in 2010, its demise arguably began a decade before, when one broker began running Ponzi schemes, followed by another concocting a "trade allocation scheme" that routed profits from profitable picks to his wife. But the firm's demise could also be glimpsed by the manner in which the firm's executives outsourced all IT responsibilities for at least several years to the Revere Group, and never looked back.

But former Revere employees revealed this year that numerous IT errors had remained unreported to regulators, and perhaps even GunnAllen management. Among other incidents, network traffic-handling trades were routed through a home network; unencrypted lost laptops remained unreported to regulators; and a rogue engineer apparently was sabotaging equipment and playing hero by fixing it. Also notable was the fact that the missteps remained undetected by regulators.

9. Designerware PC Rental Surveillance Tool Revealed.

Consumers who buy rent-to-own PCs, beware: A judge has ruled that it's okay to spy on you and your children. That fact emerged during a court case against software developer Designerware, as well as multiple rent-to-own businesses that used the company's software for "loss prevention" purposes. Although many of the businesses claimed they only used the software to recover laptops from people who missed payments, former employees told a court that rent-to-own managers and employees regularly used the software to remotely activate webcams and spy on people's "intimate activities."

Those revelations led to FTC charges, which in September both DesignerWare and seven rent-to-own businesses agreed to settle, although Florida's attorney general launched her own investigation. Meanwhile, Designerware's two principals declared bankruptcy after seeing their court costs mount -- so some related privacy justice, while delayed, does seem to finally have been served.

10. FBI Investigation Snares CIA Director Petraeus.

Consumer advocates have long maintained that the privacy protections afforded to Americans, and their personal data, remain sorely lacking. Perhaps the best illustration to date of people's poor privacy rights arrived in November via an FBI agent outing an affair between the director of the CIA, David Petraeus, and his biographer, Paula Broadwell.

Petraeus' career was undone by Broadwell sending anonymous emails of an allegedly threatening nature to Jill Kelly, a friend of Petraeus whom Broadwell viewed as a rival. Kelly showed the emails to an FBI agent, who alerted the bureau's cybercrime investigators, who traced them back to the sender, in part via a Gmail account Broadwell shared with Petraeus to coordinate their affair.

After the bureau found no evidence of wrongdoing that it wished to prosecute, the FBI agent friend of Kelly suspected that the White House was covering up the incident, and so leaked details to Rep. Dave Reichert (R-Wash.), who took it to Rep. Eric Cantor, the GOP majority leader, who -- not knowing that the FBI had dropped the investigation -- took the information to Petraeus' boss, James Clapper, the director of national intelligence. Clapper told Petraeus to resign. One upside from the case is that the ease with which Petraeus' affair was discovered and his career apparently wrecked has finally driven more members of Congress to weigh better consumer privacy protections for all.

Recent breaches have tarnished digital certificates, the Web security technology. The new, all-digital Digital Certificates issue of Dark Reading gives five reasons to keep it going. (Free registration required.)

 

Recommended Reading:

Previous
2 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/13/2020
Omdia Research Launches Page on Dark Reading
Tim Wilson, Editor in Chief, Dark Reading 7/9/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-14174
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to view titles of a private project via an Insecure Direct Object References (IDOR) vulnerability in the Administration Permission Helper. The affected versions are before version 7.13.6, from version 8.0.0 before 8.5....
CVE-2019-20901
PUBLISHED: 2020-07-13
The login.jsp resource in Jira before version 8.5.2, and from version 8.6.0 before version 8.6.1 allows remote attackers to redirect users to a different website which they may use as part of performing a phishing attack via an open redirect in the os_destination parameter.
CVE-2019-20898
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to access sensitive information without being authenticated in the Global permissions screen. The affected versions are before version 8.8.0.
CVE-2019-20899
PUBLISHED: 2020-07-13
The Gadget API in Atlassian Jira Server and Data Center in affected versions allows remote attackers to make Jira unresponsive via repeated requests to a certain endpoint in the Gadget API. The affected versions are before version 8.5.4, and from version 8.6.0 before 8.6.1.
CVE-2019-20900
PUBLISHED: 2020-07-13
Affected versions of Atlassian Jira Server and Data Center allow remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting (XSS) vulnerability in the Add Field module. The affected versions are before version 8.7.0.