News of the Cyber World

[kyonides]

Tennessee Joins Wave of Statewide TikTok Bans Over Security Concerns

Tennessee is taking steps to ban video-sharing app TikTok from government devices alongside a wave of states banning the app due to growing concerns over cybersecurity.

In a statement to WKRN, Gov. Bill Lee’s office said the state “has also taken additional steps to block the access of TikTok” on any personal or state-owned device that connects to the state network.
...
Sen. Marsha Blackburn (R-Tenn.) praised the governor’s work to ban access to the app on government networks in the state.
...
Tennessee joins other Republican-led states, including Alabama, Utah, Texas, South Dakota, and Maryland, in taking steps to prohibit access to the app on government devices and networks. Nebraska banned TikTok from government devices in August 2020.
...
Wisconsin’s Republican congressional delegation called on Wisconsin Gov. Tony Evers, a Democrat, to ban the app (pdf), while New York state senators introduced legislation on Dec. 9 to prohibit use of the app on state-issued electronic devices. The New York legislation, if passed and signed into law by New York Gov. Kathy Hochul, a Democrat, would take effect immediately.
...
“We’re disappointed that so many states are jumping on the bandwagon to enact policies based on unfounded, politically charged falsehoods about TikTok,” a spokesperson for TikTok said in an email. “It is unfortunate that the many state agencies, offices, and universities on TikTok in those states will no longer be able to use it to build communities and connect with constituents.”

Iranian hacking group expands focus to US politicians, critical infrastructure

An Iranian hacking group previously thought to mainly focus on compromising academics, journalists and human rights workers now appears to have included U.S. politicians, critical infrastructure and medical researchers to its target list, according to the cybersecurity firm Proofpoint.

The group known as TA453 has quietly added “outlier” attacks to its portfolio over the past two years, seemingly working more closely with Iranian state actors to carry out their bidding.
...
“We believe that this activity reflects the group’s flexible mandate and possible ad hoc support to hostile operations by Iranian state actors, including the Islamic Revolutionary Guard Corps,” said Sherrod DeGrippo, VP of threat research and detection at Proofpoint.

The group has been quite busy over the past couple of years, she noted. “In 2022 alone, our researchers have observed this group using a social engineering technique we’ve dubbed Multi-Persona Impersonation, and now we’re sharing our observations on anomalous campaigns in which TA453 has deviated from its standard phishing techniques and target victimology.”
...
The “outlier” attacks that Proofpoint has attributed to TA453 include campaigns to target medical researchers, travel agencies, an aerospace engineer, and a realtor involved in the sale of multiple homes near the headquarters of U.S. Central Command in Tampa, Fla.

Proofpoint also tied malware exclusively used by TA453 to target an unnamed “close affiliate” of former National Security Adviser John Bolton, who was the subject of an Islamic Revolutionary Guard Corps death plot beginning in October 2021

Most apps used in US classrooms share students' personal data with advertisers

A whopping 96% of the apps used in U.S. K-12 schools share children’s personal information with third parties — including advertisers — often without the knowledge or consent of users or schools.
...
Researchers looked at 13 schools in every state, leading to a total of 663 schools representing nearly half a million students. They found that most schools had more than 150 approved technologies for classrooms, a dizzying number for parents and school administrators to monitor. One school had as many as 1,411.

The report follows previous research from the group, formerly known as the Me2B Alliance, finding hundreds of advertisers collected valuable student data from a website specializing in school sports data.
...
Nearly a quarter of the apps recommended or required by schools included ads and 13% included retargeting ads, which allow digital advertisers to pinpoint visitors based on previous website visits... Several states including California ban using student data for this kind of targeting.
...
One factor driving the data collection is that many of the technologies approved by schools for student use were not designed specifically for educational purposes — and in many cases not designed with children in mind. Such apps included The New York Times app, Duolingo and Amazon shopping.
...
Nearly 70% of all apps were observed sending data to Google and 70% included Google software developer kits, an internal software component. Some of this is driven in part by Google’s dominance as a hardware and software supplier for K-12 schools thanks to the ubiquity of Google Classroom.

I get the idea behind using DuoLingo but Amazon shopping!?  Are you kidding me?