Inflation, rising interest rates, tumbling stock prices, pandemic hangovers, changing consumer habits, the Great Resignation, and a pending recession all add to the pressure on IT to cut costs.

The UK's economy has been hit by a massive financial crisis.

De economie van het Verenigd Koninkrijk is getroffen door een enorme financiële crisis.

Er moeten minimaal 3 tekens in de zoekbalk worden getypt om een zoekopdracht uit te voeren.

A minimum of 3 characters are required to be typed in the search bar in order to perform a search.

Top Business Needs Driving Tech Spending

In deze jurisprudentieblog zetten we diverse privacy uitspraken van de maand juni 2022 op een rij.  

The Attorney General's High Court in New York has ordered the approval of AVG, the software company which runs the data protection service.

De Attorney General's High Court in New York heeft AVG, het softwarebedrijf dat de gegevensbeschermingsdienst exploiteert, laten goedkeuren.

Privacy haalt dagelijks het nieuws. Er is echter veel meer gaande op het gebied van privacy, wat niet altijd het nieuws haalt. In deze blog zetten we diverse uitspraken van de maand juni op een rij.

Privacy makes the news daily. However, there is much more going on in the area of privacy that does not always make the news. Through this case law, we learn a lot about how the AVG is ultimately applied.

Privacy haalt dagelijks het nieuws. Daarbij komen vanzelfsprekend vooral de grotere zaken aan bod. Denk aan gevoelige datalekken, grootschalige hacks of de inzet van (geheime) camera’s. Er is echter veel meer gaande op het gebied van privacy, wat niet altijd het nieuws haalt. Door deze jurisprudentie leren we veel over hoe de AVG uiteindelijk toegepast wordt. In deze blog zetten we diverse uitspraken van de maand juni op een rij.

Thompson (online alias “erratic”) werd in 2019 gearresteerd nadat zij persoonsgegevens van meer dan 100 miljoen mensen stal, en zichzelf toegang verschafte tot verschillende servers om cryptovaluta te delven (“mining”). Na tien uur overleg bevond de jury haar schuldig voor “wire fraud” en hacken.

Thompson was een ex-medewerker van Amazon en bouwde een tool om te scannen welke accounts van Amazon Web Services (cloud hosting provider) verkeerd waren geconfigureerd. Die verkeerde configuratie gebruikte ze om zichzelf toegang te verschaffen tot die accounts, zoals van de bank CapitalOne. Thompson had vervolgens toegang tot de in de cloud opgeslagen gegevens van (onder meer) klanten van CapitalOne. Deze techniek gebruikte ze ook om servers te hacken waarop ze software installeerde om cryptovaluta te delven.

Capital One ook een boete opgelegd van 80 miljoen dollar en is verplicht haar interne beleid op (cyber) security te verbeteren, in verband met hun eigen nalatigheid ten aanzien van dit enorme datalek.

De Belgische privacy waakhond, de Gegevensbeschermingsautoriteit (“GBA”) beboette de persgroep Rossel, een Belgische mediagroep, voor het onrechtmatig gebruiken van cookies.
• Toestemming voor het gebruik van cookies werd niet voorafgaand aan het plaatsen van de cookies gevraagd.
• Informatie over het gebruik van de cookies was onvolledig en lastig te vinden.
• Toestemming werd impliciet gegeven. Oftewel, door het verder “browsen” op de website, ging Rossel ervan uit dat de bezoeker akkoord ging met het gebruik van cookies.
• Er werd toestemming gevraagd voor het gebruik van cookies door derde partijen, maar het “vakje” dat daarvoor gebruikt werd, was al van tevoren aangevinkt. Dat is geen actieve handeling, die juist noodzakelijk is voor toestemming.

KLM mag kandidaat-vliegers (opgeleide vliegers van KLM) niet vragen of ze gevaccineerd zijn, aldus de Rechtbank Amsterdam. KLM nodigt kandidaat-vliegers uit voor een kennismakingsgesprek als er een plek als piloot vrijkomt.

Piloten mogen alleen vliegen als ze volledig gevaccineerd zijn in verband met mogelijke reisrestricties op basis van vaccinatiestatus van de piloot. Hoewel in geen enkel kennismakingsgesprek de vraag is gesteld of een kandidaat volledig gevaccineerd was, werd dit wel besproken omdat KLM graag wil dat de piloten overal kunnen vliegen. Het is echter wel duidelijk dat áls een kandidaat had aangegeven niet volledig gevaccineerd te zijn, dat dat de reden was geweest dat KLM hen geen plek zou aanbieden.

De Vereniging Nederlandse Verkeersvliegers(“VNV”) verzoekt de voorzieningenrechter om KLM te verbieden te informeren over de vaccinatiestatus tegen corona en/of om kandidaten af te wijzen omdat zij niet (volledig) gevaccineerd zijn. Dit handelen zou in strijd zijn met de AVG, de Wet Medische Keuringen (“WMK”) en artikel 11 Grondwet en Artikel 8 Europees Verdrag voor de Rechten van de Mens (recht op bescherming van de persoonlijke levenssfeer). Meer specifiek beschermen die laatste artikelen het zelfbeschikkingsrecht van ieder mens over de lichamelijke integriteit.

KLM maakt met het “verlangen van een vaccinatie tegen corona” inbreuk op de persoonlijke levenssfeer. De vraag is of die inbreuk gerechtvaardigd is, wat afhangt of het legitieme doel in lijn staat met het gebruikte middel: is het noodzakelijk om dit zo te doen, of kan het ook anders?

Het doel (het rondkrijgen van de planning van de vliegers) is legitiem volgens de rechter, en met dit middel (het verlangen van de coronavaccinatie) kán KLM ook dat doel bereiken. Maar, deze manier van werken voorkomt niet met zekerheid dat KLM in de toekomst de planning rond krijgt. Andere zaken zoals wijzigende coronamaatregelen, wijzigende persoonlijke visie op vaccinaties en een noodzakelijk aanvullende coronavaccinatie of andere medische redenen kunnen weer andere reisrestricties triggeren.

Het middel (verlangen van vaccinatie) is dus niet per se geschikt het doel (rondkrijgen van de planning) te bereiken. Het rondkrijgen van de planning kan best op een minder op de privacy-ingrijpende manier, aldus de voorzieningenrechter.

Wederom oordeelt de voorzieningenrechter dat Ziggo de waarschuwingsbrieven van BREIN niet hoeft door te sturen.

Via een IP-adres (dat Ziggo ter beschikking stelt) is een open directory (oftewel: een map met bestanden die ergens op een pagina is geüpload) met e-books openbaar gemaakt, zonder toestemming van de auteurs, aldus BREIN. Via dit IP-adres zijn illegaal boeken gedownload. Brein treedt op voor de auteursrechthebbenden en verzoekt ofwel dat Ziggo de waarschuwingsbrieven doorstuurt, ofwel BREIN de gegevens van de houder van het adres geeft.

De voorzieningenrechter zei in BREIN/Ziggo I dat Ziggo een vergunning nodig heeft van de Autoriteit Persoonsgegevens om de NAW-gegevens te koppelen aan de IP-adressen en de waarschuwingsbrieven door te sturen. Het gaat namelijk om strafrechtelijke persoonsgegevens gebruiken ten behoeve van iemand anders (auteursrechthebbende). Voor dat gebruik gelden strengere vereisten.

Artikel 10 AVG stelt dat strafrechtelijke gegevens alleen verwerkt mogen worden “onder toezicht van de overheid of indien de verwerking is toegestaan bij Unierechtelijke of lidstaatrechtelijke bepalingen”. Brein stelt dat dit in Nederland niet alleen kan op basis van onze nationale implementatiewet van de AVG, Uitvoeringswet AVG (“UAVG”), maar ook op basis van onrechtmatige daad (artikel 6:162 Burgerlijk Wetboek).

Als het niet doorsturen van de waarschuwingsbrieven door Ziggo onrechtmatig wordt geacht, vindt BREIN dus dat Ziggo een rechtmatige grond heeft om de gegevens te combineren en de brieven te sturen. Of het niet-doorsturen onrechtmatig is, is afhankelijk van of de IP-adres houder zelf inbreuk maakt. De voorzieningenrechter vindt het onduidelijk of de houder van het IP-adres zelf inbreuk maakt, of onbedoeld een derde inbreuk laat maken. Omdat dit onduidelijk is, falen de eerste verzoeken (op basis van onrechtmatigheid) van BREIN.

Bovendien verduidelijkt de voorzieningenrechter dat de onrechtmatige daad geen aanvullende verwerkingsgrond is voor strafrechtelijke gegevens. Dat kan echt uitsluitend op basis van artikelen 32 en 33 UAVG (behoudens verwerkingen onder toezicht van de overheid).

Ongeacht of Ziggo onrechtmatig handelt, moet er alsnog gekeken worden naar de vereisten van de AVG en de verplichting voor een vergunning die in de weg staat. Net zoals in BREIN/Ziggo I, is in dit geval een vergunning noodzakelijk. De argumenten van BREIN falen, en de IP-adres houders van Ziggo blijven beschermd.

Jurisprudentieblog juni 2022

CMA chief data officer Stefan Hunt on how the digital consumer champion has revolutionised data analytics to understand market distortion.

The Competition and Markets Authority (CMA) has been appointed as the chief data officer for the first time. Here, the BBC’s Chris Stokel-Walker explains how the organisation uses data to protect consumers.

De Competition and Markets Authority (CMA) is voor het eerst aangesteld als chief data officer. Chris Stokel-Walker van de BBC legt hier uit hoe de organisatie gegevens gebruikt om consumenten te beschermen.

Stefan Hunt joined the Competition and Markets Authority (CMA) as chief data and digital insights officer back in 2018 to better understand the impact that data, machine learning and other algorithms have on markets and people. His DaTA team of nearly 50 data scientists and engineers help the competition and consumer regulator decide when tech firms are treating digital customers unfairly. Information Age sat down with Stefan to better understand how the CMA uses data when it comes to investigating market distortion, whether it’s skewed results on search, or a planned merger such as the one between chip manufacturer ARM and Nvidia (subsequently called off) actually hurts the market, and manipulating consumers when it comes to digital advertising and pricing.

Tech leader-profiel: hoe het CMA gegevens gebruikt om ons te beschermenDe meeste consumenten zijn zich er niet van bewust hoe ze worden gemanipuleerd wanneer ze online dingen kopen, of het nu gaat om scheve resultaten bij zoekopdrachten of ondoorzichtige prijzen. Stefan Hunt kwam in 2018 bij de Competition and Markets Authority (CMA) als chief data and digital insights officer om beter te begrijpen welke impact data, machine learning en andere algoritmes hebben op markten en mensen. Zijn DaTA-team van bijna 50 datawetenschappers en -ingenieurs helpt de toezichthouder voor mededinging en consumenten om te bepalen wanneer techbedrijven digitale klanten oneerlijk behandelen.

Tech leader profile: how the CMA uses data to protect us

Most consumers are unaware of how they are being manipulated when they buy things online, whether that’s skewed results on search or opaque pricing. The CMA is the consumer champion when it comes to digital. Yet its work also extends to tech business mergers, investigating algorithms and, increasingly, how Web 3.0 will affect all of us.

Stefan Hunt joined the Competition and Markets Authority (CMA) as chief data and digital insights officer back in 2018 to better understand the impact that data, machine learning and other algorithms have on markets and people.

His DaTA team of nearly 50 data scientists and engineers help the competition and consumer regulator decide when tech firms are treating digital customers unfairly. It’s not an organisation without teeth: last October Facebook was fined £51m for breaching an order imposed by the CMA during its investigation into Facebook’s purchase of Giphy.

Information Age sat down with Stefan to better understand how the CMA uses data when it comes to investigating market distortion, whether it’s skewed results on search, or a planned merger such as the one between chip manufacturer ARM and Nvidia (subsequently called off) actually hurts the market, and manipulating consumers when it comes to digital advertising and pricing.

What is the role of the CMA chief data officer? And why was the data team set up back in 2018?

Our CEO and the executive team appreciated how firms had a much better grip on technology than the CMA did. This was an area we needed to improve.

Our first area of expertise is dealing with consumer challenges in digital markets. Right now we’re dealing with Google on their Google privacy sandbox, which is how they’re getting rid of third-party cookies. Another one is our fake and misleading online reviews case. Or maybe it might be a merger case.

Ultimately, there’s going to be a bunch of remedies or undertakings are going to get quite specific and quite technical. At the start of a case, it’s just trying to understand how firms operate internally. It’s really useful to have people with a data and technology background to know what questions to ask. And that just enables the CMA to deal better with challenges in markets.

So these are all dealing with challenges in markets. Oftentimes, firms may or may not want us to get involved, but we think there’s a problem in the market. And we think we need to solve that problem.

So your north star is, is the consumer and how the consumer is impacted?

Yes. Now that can often be through competition.

Are there any business sectors under particular scrutiny? You just mentioned advertising for example.

There are actually five things that the team does.

The first thing we do is provide expert data and technology advice for different cases. So we mentioned the Google privacy sandbox and fake and misleading online reviews. Another really good example is the Meta/Giphy merger, where we’ve decided that there’s a number of really important ways that the market could be harmed. And that was a case where one of our talented data scientists got involved. And he really tried to understand how Giphy deals with data and Meta could use that data. Second thing that we do is so data acquisition and data science. So we’re dealing with sort of getting in big data, handling it and doing analysis on it

Another good example is the digital advertising market study we published July 2020. In order to really understand what was going on in search, we got one week of all Google searches in the UK and one week’s worth of all searches on Bing, which is the second biggest search engine in the UK. And then we were able to match across Google and Bing and understand the kind of data advantages that Google had. And that was some really important cutting-edge analysis.

But the CMA wouldn’t have been able to do that without our data team. We’re also building any data we’re using repeatedly into data pipelines, so that we can actually do things more efficiently there. We’re doing some scraping as well. So that makes sure that we’re just really informed as an agency.

The third thing that we do is data-driven tool development. That’s in our internal digital transformation bucket. We built what we call our evidence submission portal for firms. When it comes to a merger case, where sometimes we might have to get millions of documents. For instance, in the ARM/Nvidia merger case, we took in seven million documents, for example. And we built something that automatically accept those documents, check they were all in the right format, that they haven’t been submitted incorrectly, and if they have, it rejects them. It used to take four days in a merger case just to upload documents in a merger case. We’ve got that down to one day.

The fourth thing is behavioural science. Our mobile ecosystems market study digital advertising used it a lot. But we also did a whole load of work on auto renewals and subscription traps, really understanding how inflation was being presented to consumers.

Our fifth and last thing is research horizon scanning and case pipeline development. We did a lot of work about algorithms for the Digital Regulation Cooperation Forum (DRCF). We also did an algorithms paper in January last year. And we just came out with a bunch of work on online choice architecture.

Those are the five things that we do.

How does this affect business? We’re building our capability in cases to really help the CMA better understand firms and asking more probing questions. We’re building up our capability to just be informed through data.

In terms of business sectors under most scrutiny, sell, sustainability is an issue, as has been the cost of living crisis.

What are the areas or issues that the CMA is most concerned about when it comes to data and digital? Is it privacy or is it data misuse?

One of the concerns for firms of all sizes – from larger firms through to smaller firms as well – are things that firms may be doing intentionally or otherwise, maybe leading consumers to make choices which aren’t in the consumers’ best interests. So that’s something where we’re thinking quite a bit about at the moment, especially in the context of the cost of living crisis. We’re looking at drip pricing. Anything we can do that will decrease what consumers are having to spend at the moment is obviously going to be a positive.

And I mentioned online choice architecture work, which is obviously digitally focused, sometimes at small firms.

We certainly have a watching brief on algorithms and ticket pricing algorithms and firms’ uses of algorithms. We pay quite a bit of attention to that. If we see things that we are sufficiently concerned about, we will take it forward.

You investigate data from big tech firms such as Google and Meta. Basically, you’re asking to poke around the crown jewels. How responsive or helpful are they or do they say, that’s none of your business?

We have quite strong information gathering powers. So they can’t just say no. Meta got a £50 million fine from us when they refused to do a bunch of things. Firms vary a lot in their strategies for regulatory engagement.

What challenges does Web 3.0 hold from a consumer champion point of view?

It’s not the case that Web 3.0 is just allowing everything to be completely decentralised.

One of the issues is with smart contracts and that only the parties to the contract actually see details of the contract, which could enhance cartels. The perception is that Web 3.0 is all about decentralisation but in fact centralisation tends to go in different areas. Let’s say, you’ve got a digital wallet. You’re almost certainly not going to be someone who holds a primary copy of the distributed ledger. You’re going to have your own digital wallet that needs to be protected. There’s a bunch of firms that provide that to you. But those firms that offer that digital wallet protection are quite concentrated.

Tech is so fast moving and changes so quickly. As a watchdog, aren’t you always playing catch up?

We are very focused on being very pro innovation. Large firms that buy up smaller companies may actually stifle innovation, which is going to bad for consumers.

Or when it comes to mergers, we ask what is the effect on innovation if we allow two firms to merge? As an agency, we can get involved in markets we can make innovation better. Not through innovating ourselves, but by making sure market structures exist.

Our mission ultimately is about making things work better for UK citizens and that’s a really motivating thing.

Do you think that consumers are aware of how their digital experience, whether it’s search or what they buy, can be manipulated?

No. Vague awareness but not when it comes to the individual purchasing decisions they make when buying online. Look, I’ve spent years understanding behavioural psychology, both professionally and in detail over the past 10 years plus I’ve been thinking about it more broadly for the past 25 years, and even I’m not fully aware of how I’m being manipulated online. Yes, people have a vague awareness, which contributes to a lack of trust in markets and a sense that firms push and pull the rug out from under them. That’s why we’re doing online choice architecture work. Our work is partly to help consumers have more faith in markets.

What’s the one thing the CMA would like to get across to CTOs, maybe not the Facebooks or Googles, but the next level down, the unicorns or the soonicorns?

We would really welcome engaging with you to the extent that we can in cases going forward.

More on governance, risk and compliance

How the regulation of big tech can affect your business – The UK’s pending Online Safety Bill and the EU’s Digital Services Act are designed for the regulation of big tech, but there is the issue of legal but harmful and unintended consequences that can affect your business

IT risk management best practices for organisations – Dan Matthews identifies the IT risk management best practices that CTOs must implement to keep the organisation properly protected

The best IT compliance tools for your business – Antony Savvas looks at some of the best IT compliance tools and methods that are suitable for all types of business

Bank IT compliance: how financial services can stay compliant with regulations – Financial services compliance is a big area. Antony Savvas looks at strategies that can help organisations stay on the right side of the law, meeting regulations and industry-adopted standards

This article is tagged with:

Tech leader profile: how the CMA uses data to protect us

Attempts to bring Canadian truckers' 'freedom convoy' to the U.S. are mired in dysfunction.

The Super Bowl has become a huge threat to the US, according to reports from Canadian media. The BBC’s Stephanie Hegarty looks at what it means for the nation.

De Super Bowl is een enorme bedreiging geworden voor de VS, volgens berichten van Canadese media. De BBC's Stephanie Hegarty bekijkt wat dit betekent voor de natie.

Calls to stage a protest Sunday at the Super Bowl in Inglewood, California, for example, were met with mixed reactions throughout the week, as Americans hoping to siphon off momentum from their vaccine-mandate-opposed neighbors to the north clashed in a host of right-wing forums over, quite literally, which direction they should go. I feel something really big is going to happen and truckers are going to get the blame. Something is brewing up over there in Cali,” a user in the Freedom Convoy’s largest Telegram channel wrote Wednesday.

Het doel van een Super Bowl konvooi zou in plaats daarvan zijn het ware doel van de wedstrijd te onthullen: de aandacht van het publiek afleiden van het bestaan van die samenzwering, of dekking bieden voor een kinderhandeloperatie die ergens in de diepe krochten van het stadion aan de gang is. Oproepen om zondag te protesteren tijdens de Super Bowl in Inglewood, Californië, bijvoorbeeld, werden de hele week door met gemengde reacties ontvangen, omdat Amerikanen die hoopten het momentum over te hevelen van hun tegen de vaccinatieverplichting gekante noorderburen, op een groot aantal rechtse forums botsten over, letterlijk, welke kant ze op moesten gaan. Maar de protesten met trucker-thema lijken Carlson en de rest iets te bieden wat ze hard nodig hebben in een tijd waarin hun identiteit onverbiddelijk verbonden is geraakt met samenzweringsideëen en blank etnocentrisme, naast andere randgeloven - een kans om zichzelf weer op te werpen als kampioenen van de arbeidersklasse Joe.

A burgeoning effort to replicate Canada’s “Freedom Convoy” protest here in the United States shows every sign of becoming mired in dysfunction, as adherents of diverging conspiracy theories struggle to find common cause to ignite their own nationwide trucker-themed movement.

Calls to stage a protest Sunday at the Super Bowl in Inglewood, California, for example, were met with mixed reactions throughout the week, as Americans hoping to siphon off momentum from their vaccine-mandate-opposed neighbors to the north clashed in a host of right-wing forums over, quite literally, which direction they should go.

“I have a bad feeling about Super Bowl. I feel something really big is going to happen and truckers are going to get the blame. Something is brewing up over there in Cali,” a user in the Freedom Convoy’s largest Telegram channel wrote Wednesday.

Many others agreed: “What are you guys thinking? What’s the goal? Super Bowl is over in a week. So what does it accomplish? How do you prove anything? Who is running this show?”

But for practically every naysayer, there came another user strongly in favor of disrupting the country’s biggest sporting event—presumably with the help of what is so far a theoretical convoy of semi-tractor-trailers, blockading major roads around SoFi Stadium, where the Los Angeles Rams and Cincinnati Bengals face-off at 6:30 pm ET this Sunday.

What began as an uproar over the strict covid-19 protocols required to enter the stadium—proof of vaccination or a negative PCR or antigen test within 48 or 24 hours of the game, respectively—promptly took a series of wrong turns down the labyrinth of innumerable right-wing grievances. To the most conspiracy-addled denizens of the Telegram fever swamps, a ticket to the big game was practically a mark of the beast; evidence of obscene wealth or political clout that placed holders squarely in league with the sinister elites.

For a sizeable contingent of QAnon promoters, who believe Democrats and Hollywood celebrities are members of a planet-spanning cabal of pedophilic Satanists, the vaccine eventually took on secondary importance. The objective of a Super Bowl convoy would, instead, be unveiling the game’s true purpose: to distract the public’s attention from the existence of said conspiracy, or to provide cover for a child sex-trafficking operation underway somewhere in the deep bowels of the stadium. (The question of why, precisely, the pedophilic Satanists would host their unspeakable rites at the site of a massive public gathering is a logic pretzel best left twisted.)

“Trump said the Super Bowl would be a puppy bowl to what is coming,” wrote one user. “I have seen the evil acts of the deep state/satanic worship rituals. God will rescue us. Please pray for the children.”

“The Super Bowl is only a cover for little children to be sex trafficked,” wrote another. “Yes, shut it down! And save the children!”

Mentions of the Freedom Convoy have spiked by more than 8,600% in the past 30 days across a range of far-right digital conclaves catering to fringe and extremist beliefs, according to Pyrra, a threat detection company that uses natural language processing trained on hate speech and disinformation.

“These mentions were primarily on 8kun, but also appeared frequently on KiwiFarms, Minds, Gab, and GreatAwakening,” says a report shared with Gizmodo on Friday. (8kun, a site synonymous with child abuse content and flagrant neo-Nazism, was made infamous by a former user from Texas who gunned down 23 people in 2019.)

The location of people posting with these forums appears to be widespread, with Facebook groups ostensibly dedicated to the truckers’ cause drawing in tens of thousands of users. Among the most popular pages—some of which Facebook has removed—are several linked to a digital marketing firm in Bangladesh, according to an investigation by Grid.



Posts referencing the convoy across what the company calls “dark social media” came from more than 37,000 users. Of the more than 258,000 posts that Pyrra analyzed, roughly 2.6%—or more than 6,700 posts—were flagged as “highly violent.”

Comparatively, users interested in blockading the Super Bowl appear slightly less prone to violent speech. The same analysis ran against more than 4,300 posts related to both the convoy and the NFL—a trend which Pyrra says has spiked by more than 1,400% in the past month—found only 58 “highly violent” posts.

According to Welton Chang, Pyrra’s co-founder and CEO, it was the rapid growth of the “trucker” channels that initially piqued his company’s interest. Organizers, he says, relied on what is now a standard audience-building tactic, leveraging Facebook’s reach to gather followers for nascent channels; what Chang calls the “Facebook to Telegram highway.”

“We continued to track the conversations as different extremist elements, including some propagating QAnon content, 5G conspiracy and 9-11 hoax theories started to put their fingerprints on the trucker brand,” Chang said. “What alarmed us was the use of violent language and threats, which is what our AI is set up to detect. This, despite the best efforts of others in the channel who wanted nothing to do with violence.”

The trucker protests, which began in earnest on Jan. 29, have had a significant impact on daily life in the Canadian capital of Ottawa, where uninvolved residents have reported feeling trapped in a proverbial nightmare—“a never-ending tailgate party,” as one Toronto reporter put it.

On Friday morning, Ontario, Canada’s most populous province, declared a state of emergency, following Ottawa earlier this week. At a press conference, Premier Doug Ford said promised to “urgently enact orders” to prevent the protesters from blocking the movement of “goods, people, and services along critical infrastructure.”

“This will include protecting international border crossings, 400-series highways, airports, ports, bridges and railways. It will also include protecting the safe and essential movement of ambulatory and medical services, public transit, municipal and provincial roadways, as well as pedestrian walkways,” Ford said.

The decision follows announcements from several major automakers, including Ford, GM, and Toyota, which have reported parts shortages that the automakers say have led to shorter shifts, and may result in layoffs. By Wednesday, Ford had already halted production at an engine plant on the Canadian side of the border, citing a trucker blockade along the Billionaire-owned Ambassador Bridge, a key passage between Detroit and Windsor, Ontario, responsible for some 27% of all U.S.-Canadian trade.

The Ontario Superior Court of Justice on Friday afternoon heard a request for an injunction to remove the protesters from the Ambassador Bridge. The court order, considered by Chief Justice G.B. Morawetz, was sought by the Automotive Parts Manufacturers’ Association, with support by the City of Windsor and the attorney general of Ontario. If the injunction is granted, according to the Toronto Star, police could begin forcing protesters off the bridge as soon as later on Friday.

Coverage of the events in the U.S. by right-wing media personalities, firmly opposed to the public health measures aimed at curbing the spread of the virus, is largely aspirational.

“So far, that blockade has forced the Ford Motor Company to shut down one of its manufacturing plants and to operate another plant with a skeleton crew,” Fox News host Tucker Carlson said Thursday, framing the economic sabotage as “the single most successful human rights protest in a generation.”

Major blocks of airtime on the network have been dedicated to praising the truckers clogging the border, its hosts barely disguising their hopes that some iteration of the protests soon erupt in the U.S. An array of grifters and provocateurs have emerged as the convoy’s biggest proponents, among them Pizzagate promoter Jack Posobiec, far-right pundit Candace Owens, and Wendy Rogers, a state senator and Oath Keepers member from Arizona, who backed the hoax audit of votes out in Maricopa County.

Sen. Rand Paul, a Kentucky Republican, echoed support for the Ottawan truckers. “I hope the truckers do come to America,” he told the Daily Signal this week, adding: “I hope they clog up cities.” What purpose this would serve is unclear. American truckers whose routes do not cross the international boundaries face virtually no vaccine requirements. And despite the best efforts of some to ignite a similar protest inside the U.S., it’s unknown how many actual truck drivers would be interested in losing wages to join the effort.

But the trucker-themed protests do appear to offer Carlson and the rest something they sorely need at a time when their identities have become inexorably linked to conspiracist ideation and white ethnocentrism, among other fringe beliefs—an opportunity to once again rebrand themselves as champions of the working class Joe.

“Football has nothing to do w/ COVID, Trafficking, Slavery. You are going to ruin countless Superbowl Parties,” a member of the Freedom Convoy’s Telegram channel wrote Wednesday, one of many trying to divert focus away from the game.

“You’re gonna piss off the fans… You’re gonna piss off the players… You’re gonna piss off the entire league… You’re gonna get sued from the Sponsors… You’re gonna get sued by the NFL.... You’re gonna get NO LOVE from the media… You’re gonna tank the cause...It’ll be an EPIC BACKFIRE,” they continued.

Among the throngs of users in the now dozens of channels dedicated to the Freedom Convoy—one, at least, for every state in the union—discussions of where to stage the first protest on U.S. soil frequently cascade into a ceaseless chorus of disputes. Coalitions form suddenly to amass thousands of followers and vanish just as fast. One group that garnered thousands of users bent on sending a convoy of truckers from Ottawa to Washington, DC, seemingly folded on itself within a matter of days. “Big news is coming,” the admins promised, before rebranding the page with more generic goals and going radio silent.

“DC is dead. We are a republic. Head to Super Bowl first, then disperse to state capitals, targeting those with unlawful mandates & voter fraud first. We need our country back and fair elections,” another Telegram user wrote Thursday, part of a smaller contingent of MAGA followers working to inject 2020 election fraud conspiracies into the flailing movement’s repertoire.

“Here is what I think,” wrote another. “Shut it all down,” they said, referring to roughly 7,000 miles of the U.S. border. “Put 1,000-5,000 trucks at every single commercial crossing in the southern and northern states. Close Mexico and Canada.” Similarly, another individual or group, calling themselves Truckers for Christ, Children, and Country, made its pitch on Telegram, promising to position truckers at what it called “Strategic Locations,” welcoming anyone willing to serve on “our Border.”

A post Thursday by TruckersForFreedom, which has amassed an impressive 81,000 Telegram subscribers and more than 51,000 followers on Gettr, blasted its own U.S. followers for “lack[ing] the balls to descend on DC.” By Friday, the account had turned part of its focus to promoting 5G-coronavirus conspiracy theories, which claim cell towers are, somehow, responsible for propagating the virus.

“They’re micro-waving people’s brains,” one user wrote, responding to a TruckersForFreedom post promising a “very lucrative work from home partnership” with an Oregon-based company that sells “anti-radiation stickers” for cellphones.

News would break late Wednesday that the Department of Homeland Security had begun eyeing rumors online of U.S.-based activity connected to the convoy. The agency is “tracking reports,” an official told Gizmodo. Potential convoys headed not only to the Super Bowl, but “several U.S. cities,” they said, have piqued the agency’s interest.

“Tracking reports” is often code for “reading the news.” Where protests are concerned, the optics of even appearing to surveil Americans engaged in First Amendment activities often leads DHS to generate bulletins based solely on news articles and social media chatter. The bulletins are rushed out along a network of counterterrorism offices founded in the wake of 9/11 to enhance intelligence-sharing with state and local partners.

The reliance on publicly reported details often forms a kind of feedback loop in the media, wherein journalists end up reporting on DHS’s interest in information, for which the journalists themselves are the source.

But as the Super Bowl nears, it remains unclear who, if anyone, will show up to try and shut it down. For virtually every user promoting the idea, another stands adamantly opposed. “Shutting down the Super Bowl isn’t a good plan. When the Super Bowl is over there’s no reason to be there anymore,” one Telegram user argued Friday, believing it would only anger a majority of Americans, and sour them on the group’s multifarious cause. 



Few seem truly aware of the vast amount of military and law enforcement resources diverted to protect the event. DHS alone is sending 500 personnel. The FBI and its SWAT teams have been on the ground for over a week. Threats to the game, which generates billions upon billions of dollars each year, face the might of a literal army armed with machine guns and armored vehicles, K-9 units, snipers, and Black Hawk helicopters. Those are just the defense you see.

“The superbowl shut-down is very important, if you don’t know why, then ask why,” another user said, punctuated by the well-worn Qanon hashtag: #savethechildren.

The myth that the Super Bowl is the “largest sex trafficking event” in the world has persisted for years, but many of the organizations dedicated to working with sex-trafficking victims and survivors say the title is largely undeserved. “There is no evidence that a huge influx of traffickers descend on the host city or that human trafficking happens at greater rates during the Super Bowl,” writes Freedom Network USA, a human-rights group fighting human trafficking in the U.S. Despite this, there is an annual rush to muster law enforcement resources to hunt down the traffickers working the game, even though prosecutions are few and far between. This year, some of the nation’s largest banks have pledged their support to help and stamp out the scourge.

Sex workers, meanwhile, say the campaigns often lead to increased targeting of women who are not victims of trafficking but consensually offering sexual services by choice or financial need. “The media coverage and increased police presence certainly leads to more arrests, but few lead to human trafficking prosecutions,” Freedom Network USA adds, noting that resources would be better spent identifying survivors the rest of the year, and tackling the root causes that leave people vulnerable to trafficking in the first place.

Polaris, which operates the National Human Trafficking Hotline, notes that while the Super Bowl has been used “as the impetus” to raise awareness of the issue, traffickers of young children and others forced to sell sex are just as likely to be found “at motorcycle rallies in South Dakota, in the fields of Florida, in gangs in California, and in brothels in Washington, DC.” It goes on to note that the criminals operating within the multi-billion dollar underground industry are “savvy businessmen,” aware of the deluge of resources poured into policing the game.

It is in this light that some experts tend to cast a pall on the efforts, arguing that the enduring myth serves not so much the victims of trafficking, but the NFL itself and the cities that host it. It is invariably a fly-by-night operation, offering a veneer of social responsibility with fleeting resources no sooner there than gone.

More cynically, it is a perpetually lapsing cause of the week, ignoring countless other victims across the country. Their only failing? Having the misfortune not to be forced into sexual servitude within range of a football stadium.

Vaccines, the Super Bowl, and Microwaved Brains: How Americans Caught ‘Freedom Convoy’ Fever

There are a variety of roadblocks associated with moving to passwordless authentication, and here's a few ideas on how to overcome them.

Identity orchestration is one of the key ways to tackle cyber-security breaches, according to a report from Verizon.

Identity orchestration is een van de belangrijkste manieren om inbreuken op de cyberbeveiliging aan te pakken, zo blijkt uit een rapport van Verizon.

Not surprisingly, the root causes of most breaches are social engineering, default passwords, or sharing passwords, all of which can defeat even the most sophisticated security solutions. And moving away from passwords to passwordless solutions is an effective means of making it harder to steal credentials. A solid and maintainable identity infrastructure also helps because knowing who your users are is half the battle.

Het zal geen verbazing wekken dat de hoofdoorzaken van de meeste inbreuken social engineering, standaardwachtwoorden of het delen van wachtwoorden zijn, die allemaal zelfs de meest geavanceerde beveiligingsoplossingen kunnen omzeilen. Overschakelen van wachtwoorden op oplossingen zonder wachtwoorden is een doeltreffend middel om het moeilijker te maken om referenties te stelen. Een solide en onderhoudbare identiteitsinfrastructuur helpt ook, want weten wie je gebruikers zijn, is het halve werk.

It’s a well-known fact that humans are the weakest link in any security strategy. Verizon’s latest annual data breach report found that over 80% of breaches in the “Basic Web Application Attacks” incident pattern were due to stolen credentials. Not surprisingly, the root causes of most breaches are social engineering, default passwords, or sharing passwords, all of which can defeat even the most sophisticated security solutions.

Of course, defense-in-depth helps mitigate these weaknesses. And moving away from passwords to passwordless solutions is an effective means of making it harder to steal credentials. A solid and maintainable identity infrastructure also helps because knowing who your users are is half the battle.

Understanding behavioral patterns and reacting to anomalies is also important. These three components are critical to an effective defense-in-depth strategy in a hybrid, multi-cloud world where a typical enterprise will run many identity systems.

There are a variety of roadblocks associated with moving to passwordless authentication. Foremost is that people hate change. End users push back when you ask them to abandon the familiar password-based login page and go through the rigamarole of registering a factor or device required for typical passwordless flows. Further, the app owners will often resist changing them to support passwordless flows.

Overcoming these obstacles can be hard and expensive. It can also be exacerbated by the need to support more than one vendor’s passwordless solution. For example, most passwordless solutions pose app-level integration challenges that require implementing SDKs to support even simple flows. What happens if you want to support more than one solution? Or use your passwordless solution as both a primary identity and authentication provider and a step-up authentication provider? Or you want to layer in behavioral analytics?

There is a way to address these human and technical challenges standing in the way of passwordless adoption using orchestration. Although common in virtualized computing stacks, orchestration is a new concept in identity architectures. An identity orchestration layer makes it possible to modernize older apps without rewriting them so they can work with new identity protocols and support passwordless authentication.

For app owners, identity orchestration provides several tangible benefits including the ability for an app to consume any identity service, be protected with passwordless authentication, and be removed from the compliance exception list – all without making any code changes. Meanwhile, identity and security teams will be pleased because their project costs will be lower and timelines shorter.

Best practices for implementing an identity orchestration framework

First, start with a small test group that runs an isolated function and uses a legacy app unique to that function, e.g., the finance department and its accounting app.

Next, develop a rollout plan, including communications and feedback, so you can improve it before expanding the rollout. Ensure the initial group of users clearly understands what to expect and how they benefit from consuming the new passwordless services. Apply what you learn from your pilot group to make communication even more proactive and clearer. Your security team will thank you.

The most time-consuming part of nearly any identity project is working with app owners to integrate with their apps, so keeping them in the loop about how it makes their lives easier and showing them quick wins will make them more willing to cooperate with you as they juggle other business-driven priorities.

Identity orchestration can make a passwordless authentication rollout more palatable for both end users and app owners by minimizing disruption to the user experience and eliminating changes to apps. In the process, it infuses better security into applications and services. So maybe in next year’s Verizon’s DBIR, the stolen credentials attacks number will be closer to 50% than 80%.

Overcoming the roadblocks to passwordless authentication

This video illustrates the importance of regularly analyzing, controlling and adapting Active Directory permissions for increased security.

The terms and conditions of our e-mail service have been published.

De voorwaarden van onze e-maildienst zijn gepubliceerd.

Daily Newsletter - E-mail sent every business day with a recap of the last 24 hoursWeekly Newsletter - E-mail sent every Monday with a recap of the last 7 days(IN)SECURE Magazine - E-mail sent when a new issue is releasedI have read and agree to the terms & conditions

Dagelijkse nieuwsbrief - E-mail die elke werkdag wordt verstuurd met een samenvatting van de afgelopen 24 uurWekelijkse nieuwsbrief - E-mail wordt elke maandag verstuurd met een overzicht van de laatste 7 dagen(IN)SECURE Magazine - E-mail wordt verstuurd wanneer een nieuwe uitgave verschijntIk heb de algemene voorwaarden gelezen en ga ermee akkoord

Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours

Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days

(IN)SECURE Magazine - E-mail sent when a new issue is released

I have read and agree to the terms & conditions

Why organizations should control Active Directory permissions

This video talks about the Matter protocol, an effort to ensure that all devices, apps, and platforms work seamlessly together.

The world's biggest tech firms have agreed to a joint effort to improve the security of smart homes.

s Werelds grootste techbedrijven zijn overeengekomen een gezamenlijke inspanning te leveren om de beveiliging van slimme huizen te verbeteren.

The biggest names in smart home (Apple, Amazon, Google, Samsung and more) have come together to agree on a common set of standards that will allow for greater interoperability, security, and reliability in these devices. Led by the Connectivity Standards Alliance (CSA), is the combined effort to ensure that all devices, apps, and platforms work seamlessly together. Digital trust is an important factor of the protocol, and DigiCert has played a key role in developing the security-related aspects of it.

Digitaal vertrouwen is een belangrijke factor van het protocol, en DigiCert heeft een sleutelrol gespeeld bij de ontwikkeling van de veiligheidsaspecten ervan. Dagelijkse Nieuwsbrief - E-mail wordt elke werkdag verstuurd met een samenvatting van de afgelopen 24 uur. Wekelijkse Nieuwsbrief - E-mail wordt elke maandag verstuurd met een samenvatting van de afgelopen 7 dagen.

The biggest names in smart home (Apple, Amazon, Google, Samsung and more) have come together to agree on a common set of standards that will allow for greater interoperability, security, and reliability in these devices.

In this Help Net Security video, Mike Nelson, VP of IoT Security at DigiCert, talks about the Matter protocol. Led by the Connectivity Standards Alliance (CSA), is the combined effort to ensure that all devices, apps, and platforms work seamlessly together.

Digital trust is an important factor of the protocol, and DigiCert has played a key role in developing the security-related aspects of it.



 Daily Newsletter - E-mail sent every business day with a recap of the last 24 hours Weekly Newsletter - E-mail sent every Monday with a recap of the last 7 days (IN)SECURE Magazine - E-mail sent when a new issue is released I have read and agree to the terms & conditions

Matter protocol: Secure, reliable interoperability for smart home devices

49% of respondents to an Osirium poll describe endpoint management security within their organization as non-existent.

The majority of businesses in the UK say they are struggling to protect their data from cyber-attacks, a survey suggests.

De meerderheid van de bedrijven in het Verenigd Koninkrijk zegt moeite te hebben om hun gegevens te beschermen tegen cyberaanvallen, zo blijkt uit een enquête.

49% of respondents to a recent Twitter poll carried out by Osirium Technologies describe endpoint management security within their organization as non-existent. Of those that have implemented or are in the process of implementing an endpoint security strategy, 16% describe themselves as ‘all over it’ while 24% say it’s a work in progress. When asked about the main factors driving their organization’s need for endpoint security, protecting business data (35%) and avoiding employee error (25%) came out on top.

49% van de respondenten in een recente Twitter poll, uitgevoerd door Osirium Technologies, omschrijft de beveiliging van endpoint management binnen hun organisatie als niet-bestaand. Van degenen die een endpoint security strategie hebben geïmplementeerd of aan het implementeren zijn, beschrijft 16% zichzelf als 'all over it' terwijl 24% zegt dat het een werk in uitvoering is. Gevraagd naar de belangrijkste factoren die de behoefte van hun organisatie aan endpointbeveiliging bepalen, kwamen de bescherming van bedrijfsgegevens (35%) en het voorkomen van fouten van werknemers (25%) als hoogste uit de bus.

49% of respondents to a recent Twitter poll carried out by Osirium Technologies describe endpoint management security within their organization as non-existent. 11% admit that it’s their lowest priority.

Of those that have implemented or are in the process of implementing an endpoint security strategy, 16% describe themselves as ‘all over it’ while 24% say it’s a work in progress. When asked about the main factors driving their organization’s need for endpoint security, protecting business data (35%) and avoiding employee error (25%) came out on top. However, for 21% of respondents it’s simply ‘a tick-box exercise’.

Endpoint management allows IT teams to identify, monitor and control end-users’ access to corporate networks and systems. This protects data from being exposed to a breach through employee mistakes that allow malware or ransomware to be installed, for example, and the abuse of local admin accounts by cyber-attackers. It also adds a layer of protection if devices lack the necessary security tools or configurations to defend against attacks.

A key part of endpoint security is the removal of local administrator rights from users, controlling how they connect to systems. However, many respondents are concerned about the impact this will have on the business.

36% say the biggest challenge with removing local admin permissions is that it would upset users. 25% believe it would increase workloads, and a further 21% are worried that it would hinder productivity, with employees finding themselves unable to carry out tasks, and the IT helpdesk inundated with requests for simple actions such as software installations. Only 18% are worried about the technology side of things, citing complexity of endpoint security solutions as the biggest challenge.

41% of respondents don’t know how their organization tracks local admin accounts. The majority of those that do so use manual systems – 21% paper-based logs and 23% spreadsheets – which can be laborious and unreliable. Only 15% have an endpoint management system (EPM).

It appears that respondents are under no illusion that their existing endpoint security approach is suboptimal. 49% are confident that it will present abuse of local admin access, with 35% having no confidence at all.

David Guyatt, CEO of Osirium said: “A lack of awareness of the importance of securing endpoints, and how best to do it, is leaving organizations open to attack. The responses to our poll suggest that for a significant proportion endpoint management is not even on their radar. This appears largely to boil down to worries over the impact that removing local admin rights will have on the business, and this reflects what we’re hearing from our customers.

“The solution is endpoint privilege management, which switches focus from elevating users’ access privileges to allowing elevated privileges for specific processes and applications, and only for as long as the user needs them. This reduces the attack surface without employees having to change the way they work, or getting frustrated waiting for permissions to be granted.”

How aware are organizations of the importance of endpoint management security?

The hacker "Sick Codes" managed to jailbreak the display/control unit of one of the John Deere Tractor models during DefCon hacking conference.

The Consumer Electronics Show (DefCon) has been hacked by a hacker.

De Consumer Electronics Show (DefCon) is gehackt door een hacker.

Zoals atypisch, was de database zonder wachtwoord opengesteld in een poging om in overeenstemming te zijn met slechte beveiligingspraktijken.

As atypical, the database was exposed without a password in a bid to be consistent with bad security practices.

White Hat Hacker at DefCon Jaikbreaks Tractor to Play Doom

Your data is at risk. Are you equipped to combat the risks posed by BlackGuard?

Blackguard Infostealer, a sophisticated cybersecurity tool designed to steal personal data from users, is being used by cybercriminals.

Blackguard Infostealer, een geavanceerd cyberbeveiligingsinstrument dat is ontworpen om persoonlijke gegevens van gebruikers te stelen, wordt door cybercriminelen gebruikt.

Blackguard Infostealer is a malware strain that was first discovered infecting Windows devices at the start of 2022. By understanding what types of data attackers want, we can better understand the value Blackguard offers its authors and writers, and therefore how malware fits into the broader cybercrime ecosystem. Once Blackguard Infostealer has infected a victim’s device, it initiates techniques such as system Application Programming Interface (API) hooking, Dynamic Link Library (DLL ) injection and resource hijacking to steal credentials from browsers, messenger clients, and other client-side software.

Blackguard Infostealer is een malware-stam die begin 2022 voor het eerst werd ontdekt bij het infecteren van Windows-apparaten. Door te begrijpen welke soorten gegevens aanvallers willen, kunnen we beter begrijpen welke waarde Blackguard zijn auteurs en schrijvers biedt, en dus hoe malware in het bredere ecosysteem van cybercriminaliteit past. Zodra Blackguard Infostealer het apparaat van een slachtoffer heeft geïnfecteerd, initieert het technieken zoals API (Application Programming Interface) hooking, DLL (Dynamic Link Library) injectie en resource hijacking om referenties te stelen van browsers, messenger clients en andere client-side software.

Blackguard Infostealer is a malware strain that was first discovered infecting Windows devices at the start of 2022. Other security researchers have already documented how the malware operates and its dissemination via underground Russian crimeware forums.1, 2 This article aims to expand on existing research by exploring its data exfiltration capabilities in greater detail. Blackguard is designed to steal a wide range of personal data, including credentials, cookies, messaging history, browsing history, cryptocurrency wallet information, and screenshots from the infected machine. By understanding what types of data attackers want, we can better understand the value Blackguard offers its authors and writers, and therefore how malware fits into the broader cybercrime ecosystem. Attackers distribute Blackguard using a variety of techniques, including drive-by downloads and phishing emails containing malicious attachments. Once Blackguard Infostealer has infected a victim’s device, it initiates techniques such as system Application Programming Interface (API) hooking, Dynamic Link Library (DLL ) injection and resource hijacking to steal credentials from browsers, messenger clients, and other client-side software. The stolen data is compressed and exfiltrated in the same HTTP-based communication channel that the attackers use for command and control (C&C). The exfiltrated credentials are stored on the C&C server and then used to conduct additional attacks such as credential stuffing, account creation, and online fraud. In our research of BlackGuard Infostealer we identified an exposed command and control (C&C) administrator panel (Figure 1) and analyzed the stolen data stored within.

The rest of the article will detail each of the major types of stolen data to examine what is stolen, how it is collected, and the impact of the theft. Stolen credentials, obtained by malware infections or website hacks, are often used by attackers for a number of purposes. These may include:
• Being sold in the underground community as part of crimeware services to earn money and enable additional adversaries to use the exfiltrated data.
• Using the stolen credentials to target applications using credential stuffing attacks to gain access as the compromised users.
• Conducting online fraud by impersonating victims and purchasing gift cards or performing financial transfers. Figure 4 shows the variety of credentials stolen by BlackGuard, including usernames and passwords from online ecommerce sites, email services, and even internal/intranet sites.

The stolen credentials are stored in a “password.txt” file on the C&C server which contains the usernames, passwords, and associated URLs. Web servers often use cookies to store session state; that is to say, they signal to the server that a user has already successful authenticated to the system. Stealing session cookies allows attackers to conduct session hijacking, allowing them to interact with the web server as the victim without ever having to provide credentials. Once that is accomplished, the attackers can inject malicious code into various web resources specific to the user account and injected code can be distributed to large sets of users by sharing tampered resources. BlackGuard Infostealer exfiltrates web session cookies from browsers such as Google Chrome, Microsoft Edge, Mozilla Firefox, and Apple’s Safari. Figure 5, shows how Blackguard Infostealer stores stolen cookies from the Chrome browser. The log file “Cookies_Chrome2.txt” contains the session cookie details along with the session key and the associated website.

As you can see in Figure 6, the browsing history reveals a lot about the user's preferences. Blackguard Infostealer logs the history data from the browser and stores the collected data in the “History.txt” file. The file also contains a counter highlighting the number of times the user has visited a specific website. BlackGuard Infostealer also captures screenshots from compromised systems at regular intervals. Screenshots of a user interacting with the system is common tactic used by attackers since they can reveal sensitive information about the user and present state of the system. This can result in personal information leakage, including addresses, credit card numbers, passwords, and more. One such example is presented in Figure 7 highlighting the user’s actions and their installed applications.

In Figure 8, we can see that BlackGuard Infostealer stole information about an Exodus crypto wallet and a Google Chrome wallet from the compromised system. Exodus provides desktop, mobile, and hardware-specific wallets that secure and manage cryptocurrency for the user. 1 BlackGuard Infostealer steals crypto information from all the active wallets on the compromised system. In the example, the “passphrase.json” file was extracted from the compromised system which reveals the passphrase that can be used to recover the Exodus wallet. In addition, the associated log files contain configuration-related information and other files containing transaction-specific details. Blackguard can also steal information from various messaging applications on the compromised system. Targeted applications include Telegram and Discord. The malware creates associated directories with the same name as the messaging application to hold the stolen data and then exfiltrates this data. Figure 9 highlights a directory structure of the stolen Discord data.

Note that the “Tokens.txt” file contains a long string of alphanumeric characters. Discord generates this token when the user logs into the Discord server and uses it as an authorization code which is passed by the Discord client application to the server. BlackGuard Infostealer steals the authorization token which is then used to log into the victim’s Discord account. In addition, the malware acquires all many other Discord files from the system, including logs, and local application database entries. Similarly, Figure 10 shows how the Telegram messaging application data is exfiltrated and stored on the C&C server.

BlackGuard Infostealer is a powerful crimeware tool designed to steal the widest possible variety of personal data from a victim’s device. The combination of stolen account credentials, cryptocurrency wallet information, session cookies, screenshots and messaging history indicates that the authors probably want to keep their options open in terms of monetizing the stolen data. In mid-June F5 Labs published Dor Nizar’s analysis of the Malibot Android malware, which also had the capability to exfiltrate a wide range of options and data types. These new malware strains stand in contrast to more specific forms of malware such as banking trojans, which tend to focus not just on a specific type of data, but on a specific set of banks (see, for example, the list of targets for Qbot). This raises questions about changing dynamics in the market for stolen data and monetization options for attackers. In the meantime, however, there can be no question that Blackguard Infostealer is not just a potent tool for cybercriminals, but also a quite versatile one. The implication is that defenders of all types need to understand its capabilities and how to detect it in order to manage the risk it presents.

Top bedrijfsbehoeften drijven uitgaven voor technologie aan

Vergelijkbare publicaties

Het overwinnen van de wegversperringen voor wachtwoordloze authenticatie

Waarom organisaties Active Directory-machtigingen moeten beheren

Matter protocol: Veilige, betrouwbare interoperabiliteit voor slimme huishoudelijke apparaten

Hoe bewust zijn organisaties zich van het belang van endpoint management beveiliging?

White Hat Hacker op DefCon Jaik breekt trekker om Doom te spelen

BlackGuard Infostealer Malware: Ontleden van de status van ge-exfiltreerde gegevens

Gevonden topics

Jurisprudentieblog juni 2022

Tech leader-profiel: hoe het CMA gegevens gebruikt om ons te beschermen

Vaccins, de Super Bowl, en Microwaved Hersenen: Hoe Amerikanen de 'Freedom Convoy' koorts kregen