That's just the beginning of the software-defined dream car, however. It's also about personalization.

Unlike their boomer parents or grandparents, who customized their ride with souped-up engines and aftermarket accessories, younger buyers seek to personalize their cars with individual apps and conveniences.

Cybercriminals who launch attacks on critical U.S. companies are going to be targeted by the branch of the military known as Cyber Command, and everyone has been put on notice.

Gen. Paul Nakasone, who heads up Cyber Command, told the New York Times this weekend that his team isn’t just going after state actors, but that they’re taking on any cybercriminals who attack American infrastructure.

In a blog post published Wednesday, JFrog security researchers Andrey Polkovnychenko and Shachar Menashe detailed how the malicious NPM packages took aim at the popular communications platform with malware and infostealers, including Discord token grabbers; stealing a user's token would give a threat actor complete control over a user's account.

JFrog hypothesized in its blog post that threat actors could use Discord tokens -- and by extension, the attached account -- for botnets, spreading malware and to resell stolen accounts if the users have Discord's premium Nitro service.

Menashe told SearchSecurity the packages were found during routine scanning of the NPM repository.

Manifest V3, or Mv3 for short, is outright harmful to privacy efforts. It will restrict the capabilities of web extensions—especially those that are designed to monitor, modify, and compute alongside the conversation your browser has with the websites you visit. Under the new specifications, extensions like these– like some privacy-protective tracker blockers– will have greatly reduced capabilities. Google’s efforts to limit that access is concerning, especially considering that Google has trackers installed on 75% of the top one million websites.

It’s also doubtful Mv3 will do much for security. Firefox maintains the largest extension market that’s not based on Chrome, and the company has said it will adopt Mv3 in the interest of cross-browser compatibility. Yet, at the 2020 AdBlocker Dev Summit, Firefox’s Add-On Operations Manager said about the extensions security review process: “For malicious add-ons, we feel that for Firefox it has been at a manageable level....since the add-ons are mostly interested in grabbing bad data, they can still do that with the current webRequest API that is not blocking.” In plain English, this means that when a malicious extension sneaks through the security review process, it is usually interested in simply observing the conversation between your browser and whatever websites you visit. The malicious activity happens elsewhere, after the data has already been read. A more thorough review process could improve security, but Chrome hasn’t said they’ll do that. Instead, their solution is to restrict capabilities for all extensions.

As for Chrome’s other justification for Mv3– performance– a 2020 study by researchers at Princeton and the University of Chicago revealed that privacy extensions, the very ones that will be hindered by Mv3, actually improve browser performance.

CERT-In responded to our representation about the issues with their Responsible Vulnerability Disclosure and Coordination Policy, explaining that the Policy is an executive decision and so must follow the existing provisions of the law. In light of this, we have written to MeitY, asking them to amend the Information Technology Act, 2000 to provide a safe harbour for genuine security researchers.

[...]

On 3rd September 2021, the Indian Computer Emergency Response Team (CERT-In) released its new ‘Responsible Vulnerability Disclosure and Coordination Policy’ with the aim of strengthening trust in the ‘Digital India’ and ‘Make in India’ campaigns, and encouraging responsible vulnerability research. The Policy provides information about where cybersecurity vulnerabilities in products and services can be reported, the details expected in vulnerability reporting, the procedure by which CERT-In will examine and act upon such reports, and the timelines for resolving issues.

However, the Policy effectively discourages the reporting of vulnerabilities! Clause 7 of the Policy states that: “The reporting party must ensure to comply with all the extant laws and regulations while discovering the vulnerabilities. Reporting a vulnerability to CERT-In does not imply being exempt from compliance. Discloser shall be responsible for any action performed by her/him for discovering the vulnerability whatsoever”.

In response to this, we wrote to CERT-In on 13th October 2021 indicating our concerns about this provision. In our representation, we highlighted that such a policy may lead to a regulatory regime in which genuine security researchers may be penalised for disclosures. We also stated that Clause 7 of the Policy may also be in conflict with the Information Technology (The Indian Computer Emergency Response Team and Manner of Performing Functions and Duties) Rules, 2013 which adopt a more cooperative and collaborative approach to vulnerability disclosures.

Loujain Alhathloul Lawsuit Statement“Never have I envisioned myself being recognized for standing up for what I believed was right. My early realization of my privilege to speak up and out for women and myself drove me to engage in the sphere of human rights defenders.“In a 2018 article titled Kidnapped Freedoms, I expressed my understanding of freedom to be safety and peace:

‘safety to express, to feel protected, to live and to love.[And] peace to reveal the purest and most sincere humanity implanted deep within our souls and minds without experiencing unforgivable consequences.Deprived of safety and peace, I have lost my freedom. Forever?’“Previously, I had limited consideration of all aspects of harm a human rights defender, or any individual for that matter, could face, especially in the online world. Today, I incorporate online safety as well as protection from misuse of power by cyber companies to my understanding of safety. The latter should be considered a basic and natural right in our digital reality.“No government or individual should tolerate the misuse of spy malware to deter human rights or endanger the voice of the human conscious. This is why I have chosen to stand up for our collective right to remain safe online and limit government-backed cyber abuses of power. I continue to realize my privilege to possibly act upon my beliefs.“I hope this case inspires others to confront all sorts of cybercrimes while creating a safer space for all of us to grow, share, and learn from one another without the threat of power abuses.”For the complaint:https://www.eff.org/document/alhathloul-v-darkmatter

For more on state-sponsored malware:https://www.eff.org/issues/state-sponsored-malware

EdgeX Foundry, the open source, vendor-neutral IoT/edge platform hosted by the Linux Foundation as part of the LF Edge project umbrella, is pleased to announce the EdgeX Smart * Challenge – a virtual global hackathon – to begin in early 2022.

In this blog entry, we share the findings of an investigation on theinternet of things (IoT)Linux malware and analyzed how these malware families have been evolving. We relied on the tactics, techniques, and procedures (TTPs) of MITRE ATT&CKto define the malware capabilities and characteristics that we saw.

Our study showed that IoT Linux malware has been steadily evolving, particularly those that are used to createIoT botnets. Capabilities were both added and removed over time. Notably, neither data exfiltration nor lateral movement has been successful for the authors, and they have pivoted instead to centralized infection.