December 2018 – Cyber Law Watch

So you plug your shiny Tesla in to charge…

Dec 20 2018

By Cameron Abbott and Wendy Mansell

…and suddenly you are at risk of starting fires.

We all know that these days the Internet of Things is a favourite for cyberattacks, with the latest target being home charging stations for electric cars.

Many home charging stations are controlled remotely by mobile apps, which seem to provide the perfect opportunity for hackers to cause harm.

Hackers cleverly can infiltrate an account and turn charging off or even worse, they may change the current to the extent it can start a fire.

Once again the industry needs to take security seriously for IoT and have the same diligence as IT networks now do.

Android users beware the 21st century Trojan horse

Dec 18 2018

By Cameron Abbott and Sara Zokaei Fard

Here’s one to keep and eye out for – research from ESET has discovered an Android Trojan that attempts to steal funds from PayPal accounts. The malware is distributed by third-party apps rather than the Google Playstore. Once the app is launched, no functionality is provided. Instead, the app terminates and the icon is hidden. When the victim launches their PayPal App, the malware attempts to steal funds.

The interesting thing about this malware is that unlike most, it does not focus on phishing. This malware attacks the victim and attempts to instantly transfer money to the attacker’s account, when the user launches their PayPal App. The malware is able to hijack the legitimate PayPal App through the malware downloaded through the third-party app. This raises concerns of what applications on Android mobile devices will be attacked next.

What do you need to know about the encryption killing legislation?

Dec 16 2018

By Cameron Abbott and Wendy Mansell

There are now three ways a government agency can gain access to encrypted information:

1. ask you to voluntarily help them
2. demand your help
3. force you build new functions in your systems to help them.

As a company if you don’t comply you could be hit with a fine of up to almost $10 million dollars.

You do have a defence though – if the requests will undermine your encryption systems, making them inherently less secure you do not have comply.

If you would like to know more about how the new legislation will affect you feel free to contact us for any assistance or information.

Cybersecurity: location, location, location

Dec 06 2018

Authors: Cameron Abbott and Sara Zokaei Fard

According to a report published by BitSight on 4 December 2018, “Are the New European Cybersecurity Regulations Working?”, Europe is one of the only exceptions to a global decline in security performance. There are regular occurrences of cybersecurity compromises around the world, with some sectors such as Technology consistently performing weaker than others. Companies in the Finance sector continue to be the world’s strongest cybersecurity performers, due to their high regulative overlay. While “continental cybersecurity performance continues to decline”, in Europe, cybersecurity performance is improving to an extent unlike any other continent in the world.

The General Data Protection Regulation (GDPR) officially went into effect in the European Union in May 2018. The GDPR is a landmark European Union law, that sets significant punitive fines at up to 4% of global revenue if organisations do not implement a broad set of cybersecurity requirements in certain circumstances. In the months following the implementation of the GDPR, European security performance has consistently improved and now significantly surpasses all other continents. In this same time frame, Oceania’s cybersecurity performance has spiralled downwards.

BitSight states “the chorus for GDPR-style regulation is growing internationally”. The statistics certainly support this. However others argue that countries like the US demonstrate significant competitive advantage in developing highly valuable big data and social media intellectual property because of the lower regulatory environment encouraging innovators. The value to economies of these industry segments is significant.

Encryption bill to give unprecedented power

Dec 04 2018

By Cameron Abbott and Wendy Mansell

The Coalition government is attempting to pass large-scale decryption reforms which will give sweeping powers to law enforcement agencies for overt and covert computer access.

The reforms have caused significant controversy as they may force tech companies and communications providers to modify their services, creating “systemic weaknesses” for intelligence agencies to exploit. However many point out these same vulnerabilities may be utilised by criminals.

Further the potential repercussions of these reforms may undermine consumers’ privacy, safety and trust through unprecedented access to private communications. This could have anti-competitive effects, as the reputations of Australian software developers and hardware manufacturers will suffer within international markets.

At the same time, the harsh reality that terrorists and organised crime increasingly utilise these technologies to evade surveillance highlights a very clear problem for law enforcement authorities.

We won’t seek to suggest where the balance between these interests should lie, but the debate rages on. Stay tuned.

Marriott Hotel – time to change your passwords!

Dec 03 2018

Authors: Cameron Abbott and Keely O’Dowd

On Friday, 30 November 2018 the Marriott Hotel announced that it had suffered a data breach, we are all getting a little numb to large breaches but this one is one of the biggest in recent times.

The Marriott revealed that over a four year period, up to approximately 500 million guests who made a reservation using the Starwood reservation system for a hotel within the Marriott umbrella on or before 10 September 2014 may have had their data compromised. For approximately 327 million guests, information that may have been comprised includes a combination of name, address, phone number, email address, password, Starwood Preferred Guest account information, date of birth, gender, payment card numbers, arrival and departure information, reservation date and communication preferences.

Most hotel booking/POS systems have been attacked in recent years and these attacks have proven difficult to detect and trace through to understand the impact, it takes time and significant resources. If you have used the Starwood reservation system – it is a good time to change the password and update passwords anywhere else you use those same or similar credentials.

Archive:December 2018