Each week The Weekly SecuriTEA Report brings you the past week’s interesting Cybersecurity News. Here's what is new for this week:
Jaywalkers Not Included In Self-Driving Code That Killed A Woman. It has been revealed that the killing of a woman, last year, by a self-driving Uber car wasn't designed to detect jaywalking pedestrians, according to official documents published by the US National Safety Transportation Board. In March 2018, the first recorded death by a fully autonomous vehicle occurred with on-board video footage showing the victim, 49-year-old Elaine Herzberg, pushing her bike at night across a road in Tempe, Arizona, moments before she was struck by the AI-powered SUV at 39 MPH. Now, an investigation by the NTSB into the crash has pinpointed a likely major contributing factor: the code couldn't recognize her as a pedestrian, because she was not at an obvious designated crossing. Rather than correctly anticipating her movements as a person moving across the road, it ended up running right into her. “The system design did not include consideration for jaywalking pedestrians,” they stated in its write-up. “Instead, the system had initially classified her as an 'other' object which are not assigned goals.” The computer-vision systems in self-driving cars are trained to identify things, such as other vehicles, trees, signposts, bicycles, and so on, and make decisions on what to do next using that information. It appears Uber’s software wasn’t able to identify Herzberg since there was no classification label for a person not using a proper crossing point, and it wasn't able to make the right decisions.
Alexa, Siri, Google Smart Devices Able To Be Hacked By Laser Beams. Just when you thought things regarding your smart devices couldn't get any worst, researchers have discovered a new way to hack Alexa and Siri smart speakers merely by using a laser light beam. No human interaction or physical access is necessary to launch the attack that allows an attacker to send inaudible commands, such as opening your front door, to the voice assistants. This attack is being called "light commands" and are successful due to the way smart device microphones are designed; the microphones work by converting sound (so your voice commands after you say the "Alexa" trigger word) into electrical signals for the device to execute your command. It has been found that by aiming a light beam directly at these microphones, from as far as 360 feet, can trick the device to initiate inaudible commands without users knowing. This attack works on various popular voice assistants, including Amazon Alexa, Apple Siri, Facebook Portal, and Google Assistant.
Security Company Compromised By Rogue Employee. Trend Micro is a multinational cybersecurity and defense company headquartered in Tokyo, Japan who's reputation for securing its customers has been compromised by a rogue employee who sold customer data. Trend Micro said that a rogue employee, who has since been terminated, gained unauthorized access to a customer-support database and sold the data of 68,000 customers to a malicious third party, who then used that data to target customers with scam calls. The employee had accessed a database that contained customer names, email addresses, Trend Micro support ticket numbers, and in some instances telephone numbers. However, “there are no indications that any other information such as financial or credit payment information was involved, or that any data from our business or government customers were improperly accessed,” Trend Micro said in a Tuesday post. The company became aware of the incident in early August 2019, when some security customers reported receiving scam calls by criminals who were purporting to be Trend Micro support employees. The company launched an investigation and in October concluded that the incident had stemmed from an insider threat.
Got Served A Subpeona Via Email? A phishing campaign claiming to deliver emailed subpoenas is targeting insurance and retail companies by delivering malware to steal sensitive information. According to researchers, the phishing emails are spoofing the UK Ministry of Justice, aiming to capitalize on scare tactics to convince targets to click on an embedded link to “learn more about the case” by saying that the recipient has 14 days to comply with the subpoena notice. If the target clicks on the link, he or she will find themselves infected with Predator the Thief, a publicly available information-stealing malware that’s not often seen in phishing campaigns. “The emails can appear quite convincing upon initial inspection, but a closer look reveals obvious irregularities,” Mollie MacDougall, a researcher with the Cofense Intelligence, told Threatpost. “Masquerading as UK Ministry of Justice correspondence produces an increased potential for users to fall for the phish, even though some portions of the email contain misnomers such as ‘Department of Justice’ rather than the Ministry of Justice. Recipients that are not educated about the UK judicial system are likely to fear a potential consequence from this daunting email, thus falling victim to the threat actor’s trap.”
Ex-Twitter Employees Were Spies For Saudi Arabia. The Department of Justice has charged two former Twitter employees of working with the government of Saudi Arabia to snoop on political dissidents’ accounts. A complaint document outlines how two former Twitter employees, Ali Alzabarah, 35, and Ahmad Abouammo, 41, accessed Twitter account data that helped Saudi Arabia identify the accounts’ users and their locations. In 2015 Alzabarah allegedly accessed as many as 6,000 Twitter accounts, while Abouammo accessed three Twitter accounts, both doing so without authorization. Abouammo was arrested in Seattle, Wash., on Tuesday. Alzabarah meanwhile is believed to be in Saudi Arabia; federal warrants have been issued for his arrest. “Insider threats pose a critical threat to American businesses and our national security,” said FBI Special Agent in Charge John F. Bennett in a Wednesday statement. “The FBI will not stand by and allow foreign governments to illegally exploit private user information from U.S. companies. These individuals are charged with targeting and obtaining private data from dissidents and known critics, under the direction and control of the government of Saudi Arabia.”
And that's a wrap for your Weekly SecuriTea Report. Be sure to check out the latest every week for the latest in Information Security News. Follow us on social media for daily news.