SEC595: Applied Data Science and AI/Machine Learning for Cybersecurity Professionals
SEC595Cyber Defense
SANS Community Benefits
Connect, learn, and share with other cybersecurity professionals
Top of the News
Gabbard Investigates While UK Remains Silent on Reported Apple Backdoor Order
Director of National Intelligence Tulsi Gabbard has responded to the February 13 missive from Senator Ron Wyden (D-Ore.) and Representative Andy Biggs (R-Ariz.) that urged action and answers to inquiries in light of reports that the UK government ordered a backdoor into Apple users' encrypted cloud data. Gabbard states that such an order "would be a clear and egregious violation of AmericansÕ privacy and civil liberties, and open up a serious vulnerability for cyber exploitation by adversarial actors," also saying she was not aware of the order before media reported it. She has asked several US intelligence and defense agencies "to provide insights," and has requested investigation into the legal and intelligence implications of such an order. Under the Clarifying Lawful Overseas Use of Data (CLOUD) Act, the UK may not issue demands for data belonging to "US persons," and vice versa. Tim Stevens and Andrew Dwyer, "two of Britain's leading cybersecurity academics," say the UK government's silence on the order's existence is neither sustainable nor justifiable, urging responsible transparency. Apple withdrew their Advanced Data Protection (ADP) service from the UK on February 24, 2025, offering only Standard Data Protection for "iCloud Backup; iCloud Drive; Photos; Notes; Reminders; Safari Bookmarks; Siri Shortcuts; Voice Memos; Wallet Passes; and Freeform."
Editor's Notes
- Slide 1 of 3
Hang on, this could be an interesting ride. DNI is siding with Apple that providing that backdoor is unacceptable, and Apple is denying requests to create such a back door, now or ever, both of which are good for our privacy. In the meantime, see if enabling Apple's Advanced Data Protection will work for you, particularly for travelers in risky areas; VIP or otherwise.
- Slide 2 of 3
While DNI Gabbard is investigating, she should also look at proposed Swedish Riksdag legislation regarding encrypted data. While the company highlighted is different, the result is the same, building backdoor access to an E2EE application that can potentially be misused.
- Slide 3 of 3
What is really interesting about this situation is that Apple has to balance working and operating between all of these different legal systems, so they've had to modify some of their App Store rules for China, and it would appear that they're modifying their Advanced Data Protection rules for the UK at the moment. I suspect that we will see more and more of this in the future. The question is, what happens when a citizen from the EU stays in the UK for a prolonged period of time, and how does this rule apply to them?
Slide 1 of 0- Slide 1 of 3
Standardizing Memory Safety Practices and Principles
A paper authored by 21 security researchers and other experts 'explore[s] memory-safety standardization, which [they] argue is an essential step to promoting universal strong memory safety in government and industry, and, in turn, to ensure access to more secure software for all.' The paper 'propose[s] potential approaches to standardization - likely a task not limited to any one institution or standards body Ð and conclude[s] with an illustrative universal memory-safety adoption timeline proposing a realistic path to universal adoption given suitable incentivization.' (The first link (PDF) is the extended version of the paper posted by Communications of the Association for Computing Machinery.)
Editor's Notes
- Slide 1 of 3
Having a standardized approach, beyond 'move to a memory safe language,' is going to be more effective as changing languages is not always possible or practical. Having a framework that works with existing languages is definitely worth a deep dive to see where you can raise the bar.
- Slide 2 of 3
According to a PWC partner, formerly with the Carnegie-Mellon CERT, memory management failures are implicated in more than sixty percent of vulnerabilities. She asserted that part of the problem was rooted in training failures. However, a more fundamental issue is the vulnerable architectures, operating systems, and development tools that are so widely used.
- Slide 3 of 3
This is a good thing, because many languages just lack the guidance and design patterns for memory safe usage. In lieu of memory safety in the language that you're used to, many developers are trying to choose memory safe languages like Rust. So if you are a core C++ developer, you may want to start to look at this, as many governments are starting to ask for memory safe code inside their application development stacks.
Slide 1 of 0- Slide 1 of 3
California Privacy PCalifornia Privacy Protection Agency Orders Data Broker to Shut Down for Failing to Registerrotection Agency Orders Data Broker to Shut Down for Failing to Register
The California Privacy Protection Agency (CPPA) has ordered data broker Background Alert, Inc. to shut down for three years as a penalty for failing to register and pay annual fees as required by California's Delete Act. Failure to comply with the penalty will result in a fine. In October of last year, CPPA announced 'a public investigative sweep of data broker registration compliance under the Delete Act.' Businesses operating as data brokers in 2024 had until January 31, 2025 to register. CPPA also brought enforcement action against Jerico Pictures d.b.a National Public Data for failing to register in a timely manner last year.
Editor's Notes
- Slide 1 of 4
This may seem like a minor news item, but regulations need to be enforced to be meaningful, and failures to meet regulations intended to protect data and privacy need to escalate penalties in order to have an impact on the bottom line of companies who put customers at risk.
- Slide 2 of 4
Is it likely that an enterprise can survive a three year suspension of business? The business practices of this industry are so pernicious that many, not to say most, would not be missed. As is often the case, California leads the way in privacy protection.
- Slide 3 of 4
Shutting down a business for three years is tantamount to killing it. That is, unless the business resurrects itself in the form of a new business and registers with the State under "new leadership." I wonder which path they'll take given that the business of data aggregation is so lucrative.
- Slide 4 of 4
From 2020 to 2023, the California Attorney General maintained the registry; the Delete Act shifted this responsibility to the CCPA Enforcement Division as of January 1st, 2024. Data Brokers who failed to register face a penalty of $200/day, which can increase. Data Brokers are also required to disclose the number of customer deletion requests and mean time to respond, report on specific data type collection, and include a link on their website to consumer rights under CCPA. In this case, Background Alert must shut down for three years or face a $50,000 fine. That fine seems insufficient to be motivating. Even at $200/day for three years, plus $50,000, you're only at $270,000. At that level of fine, it's likely cheaper to face the penalty than shut down.
Slide 1 of 0- Slide 1 of 4
The Rest of the Week's News
Mozilla Removes User Data Promises from Firefox TOU and Documentation
On Wednesday, February 26, 2025, Mozilla announced new terms of use (TOU) for the Firefox web browser, effective February 28, which elicited criticism from users over a now-modified clause perhaps implying Mozilla owns users' data: "When you upload or input information through Firefox, you hereby grant us a nonexclusive, royalty-free, worldwide license to use that information to help you navigate, experience, and interact with online content as you indicate with your use of Firefox." However, the company has since amended the text to specify the TOU "does not give Mozilla any ownership" in users' content, maintaining the same license "for the purpose of doing as [users] request" with input data. All former explicit promises to never sell user data, and to protect users from advertisers who do, have been removed from the browser's FAQ. Ajit Varma, Mozilla's VP of Product, states that the company can no longer make definitive statements due to certain local legal definitions of "sale," such as in the California Consumer Privacy Act (CCPA). Mozilla states "data that we share with our partners (which we need to do to make Firefox commercially viable) is stripped of any identifying information, or shared only in the aggregate, or is put through our privacy preserving technologies."
Editor's Notes
- Slide 1 of 4
Where privacy, AI, and revenue generation cross, it gets confusing. They are attempting to anonymize data where possible; they don't want to own your data, but they need to use it to drive AI as well as satisfy advertisers. This is a good time to review your browser privacy and security settings. Make sure that you've set them to minimize the amount of data shared under Firefox Data Collection and Use, as well as review which services the browser can access, e.g., location, camera, mic, VR, etc. Make sure that installing plugins or extensions requires explicit permission.
- Slide 2 of 4
Browsers leak. Both users and providers of them might as well admit it. Moreover, they are so complex that not even their authors can say with any certainty that they are not being used to systematically collect and disseminate sensitive traffic. Software only looks free; there is always a cost. One should prefer purpose built clients, "apps," for sensitive applications.
- Slide 3 of 4
It was bound to happen. Search partnerships and donations only go so far and there are salaries to pay and infrastructure to keep up. While the change in terms of use is subtle, it stands to provide additional revenue to the for-profit Mozilla Corporation.
- Slide 4 of 4
On the surface, this appears to be an issue where Mozilla is looking for ways of maybe funding their business. That is complete conjecture on my end, so take that with a grain of salt. It could also be a compliance issue where Mozilla needs to comply with some California privacy directives, some laws in that state would seem to indicate that. Whatever the case may be, many users that were the core fans of Mozilla Firefox for its privacy and independence are now moving elsewhere, and that is a problem for the Mozilla foundation.
Slide 1 of 0- Slide 1 of 4
Amnesty International Finds Cellebrite Exploit Chain Used to Compromise ActivistsÕ Phone
Amnesty International has uncovered evidence that a zero-day exploit sold by Cellebrite has been used to spy on an activist in Serbia. Amnesty's 'technical blog post provides a detailed analysis of how the Android phone of one student protester was exploited and unlocked by a sophisticated zero-day exploit chain targeting Android USB drivers, developed by Cellebrite.' In a December 2024 report, Amnesty 'documented widespread misuse of Cellebrite's technology by Serbian authorities.' In response, Cellebrite announced on February 25, 'We found it appropriate to stop the use of our products by the relevant customers at this time.'
Editor's Notes
- Slide 1 of 3
The zero-day, used by Serbian authorities, took advantage of a flaw in Android USB drivers. There is a patch for CVE-2024-53104, out-of-bounds write to USB Video Class Driver, in the February 2025 Android security bulletin. This comes down to using memory safe drivers. Future Android updates are expected to include Linux kernel updates which address this. Make sure you're keeping your Androids updated, particularly if traveling abroad.
- Slide 2 of 3
It is almost in the nature of governments to feel threatened by the private communications of their citizens. It is naive to think that any technical measure can resist all government efforts to snoop. A nation state can access any information that it wants to. The limited refuge of the citizen is that it cannot access all the information that it wants to. One does not limit access to one's information because one necessarily has anything to hide but to limit the efficiency of widespread government surveillance.
- Slide 3 of 3
We have a specific view of the way that the laws should work, the way human rights should work, and the way that private property rights also work. Cellebrite is trying to sell their products for investigative purposes to the right governments and law-enforcement agencies. The game that will be played here is that groups like Amnesty International will find misuse of technology and then it's up to the companies to do something about it, and so Cellebrite has taken the opportunity to remove the licensing from the serving authorities. But that is just a cat and mouse game, isn't it?
Slide 1 of 0- Slide 1 of 3
MS-ISAC Report: Critical Infrastructure Protection Challenges Facing US SLTT Governments
A report from the US Multi-State Information Sharing and Analysis Center (MS-ISAC) describes the threats facing US state, local, tribal, and territorial (SLTT) governments in defending the country's critical infrastructure. The report urges SLTT to adopt a 'whole-of-state' cybersecurity practice to protect the country's critical infrastructure. The report notes that 'Adversaries attack SLTT organizations through cyber, physical, and foreign malign influence operations to reap financial rewards, disrupt operations, sow discord, and erode public trust,Ó and lists priorities and critical services for the future, including 'enhanc[ing] resilience of critical infrastructure through consolidated and coordinated information sharing; build[ing] trust in public institutions through communication, public engagement, and transparency; strengthen[ing] overall security with targeted resources and scalable solutions for small and rural communities; mitigat[ing] insider threats to reduce risk and enhance trust; and invest[ing] in drivers of workforce productivity, development, recruitment, and retention to address talent shortages.'
Editor's Notes
Two parts to this: first, if you're a SLTT struggling with resources for cyber, MS-ISAC is one part of CISA which remains un-cut, and may have bandwidth to help. Second, the idea is to aggregate across not just state agencies but across states to help in detection and response of trends/actions. Before throwing that out, have a conversation with your MS-ISAC POC to see what's possible and how it would impact you.
Windows and Cisco Router Flaws Added to KEV
The Cybersecurity and Infrastructure Security Agency (CISA) has added two high-severity flaws to the Known Exploited Vulnerabilities (KEV) catalog, one affecting Windows systems and the other affecting Cisco routers. CVE-2018-8639, CVSS score 7.8, allows an attacker logged on to a Windows system to run arbitrary code in kernel mode by exploiting the Win32k component's failure to properly handle objects in memory, leading to privilege elevation; this affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers. CVE-2023-20118, CVSS score 7.2, allows a remote attacker with administrative credentials to gain root-level privileges, access data, and execute arbitrary commands on Cisco routers by exploiting improper validation of user input within incoming HTTP packets, using a crafted HTTP request to the web-based management interface; this affects Cisco Small Business Router models RV016, RV042, RV042G, RV082, RV320, and RV325. Cisco's advisory recommends device migration, stating that they have not and will not release updates to address the flaw, and there are no workarounds. CISA has not provided details on the known exploitation of either flaw.
Editor's Notes
The affected Cisco RV series routers will not be getting an update for these flaws: you need to replace them, and you can mitigate the risk somewhat by disabling remote administration by blocking access to ports 443 and 60443. The Win32k flaw, when published in 2018, was not being actively exploited, and updates to address it were released in December of 2018. Make sure those are applied. Time to make sure you're migrating old/unsupported Windows versions, keeping in mind end-of-support for Windows 10 is October 14, 2025.
Rubrik Rotates Authentication Keys After Intruder Accessed Log Files on Server
After detecting anomalous activity on a server containing log files, the Rubrik Security team discovered than an intruder accessed an undisclosed number those files. Rubrik writes that 'Out of an abundance of caution, we have rotated keys to mitigate any residual risk.' Rubrik is a cybersecurity company that offers data protection, data threat analytics, data security posture services, and recovery.
Editor's Notes
- Slide 1 of 4
The only time companies should use the term 'an abundance of caution' is when they can say 'Due to an abundance of caution we prevented or mitigated all attacks with no impact to our business or our customers.' Caution, like wisdom, is most valuable when used in advance of challenges.
- Slide 2 of 4
Resetting authentication is standard procedure when credential compromise is suspected. What isn't known is how long the evildoer had access and what else the server was used for.
- Slide 3 of 4
"Keys" should be stored only in High Security Modules (HSMs) where they can be used but not seen.
- Slide 4 of 4
Rubrik is being proactive, seeking to avoid a repeat of the 2023 Forta GoAnywhere data theft attacks by the Clop ransomware gang.
Slide 1 of 0- Slide 1 of 4