Boy, 11, Hacks into Replica U.S. Vote Website in Minutes

(Reuters) – An 11-year-old boy managed to hack into a replica of Florida’s election results website in 10 minutes and change names and tallies during a hackers convention, organizers said, stoking concerns about security ahead of nationwide votes.

** 11-Year Old Emmett Brewer Hacks Into Replica US Vote ... photo

The boy was the quickest of 35 children, ages 6 to 17, who all eventually hacked into copies of the websites of six swing states during the three-day Def Con security convention over the weekend, the event said on Twitter on Tuesday.

The event was meant to test the strength of U.S. election infrastructure and details of the vulnerabilities would be passed onto the states, it added.

The National Association of Secretaries of State – who are responsible for tallying votes – said it welcomed the convention’s efforts. But it said the actual systems used by states would have additional protections.

“It would be extremely difficult to replicate these systems since many states utilize unique networks and custom-built databases with new and updated security protocols,” the association said.

The hacking demonstration came as concerns swirl about election system vulnerabilities before mid-term state and federal elections.

U.S President Donald Trump’s national security team warned two weeks ago that Russia had launched “pervasive” efforts to interfere in the November polls.

Participants at the convention changed party names and added as many as 12 billion votes to candidates, the event said.

“Candidate names were changed to ‘Bob Da Builder’ and ‘Richard Nixon’s head’,” the convention tweeted.

The convention linked to what it said was the Twitter account of the winning boy – named there as Emmett Brewer from Austin, Texas.

A screenshot posted on the account showed he had managed to change the name of the winning candidate on the replica Florida website to his own and gave himself billions of votes.

The convention’s “Voting Village” also aimed to expose security issues in other systems such as digital poll books and memory-card readers.

***

Mark Earley, the elections supervisor in Leon County who is a cybersecurity liaison between state and local officials, questioned how outsiders could obtain the security protocols used by Florida if they weren’t already behind the system’s firewalls. He said that all this “hacking noise” and “misinformation plays into the hands of the folks who are trying to undermine democracy.”

Jeff Kosseff, a lawyer and assistant professor at the United States Naval Academy Cyber Studies Department, said states are struggling with election security threats. He said they should work with outsiders in order to see if there are flaws in their systems.

“All states should look at this as a wake-up call,” Kosseff said. “What were the shortcomings identified and how they can fix it. I don’t think it should be an adversarial.”

Senator Menendez Hires Qatar Lobbyist?

Primer: It is Qatar that received the Taliban commanders previously in prison at Gitmo under Obama. It is Qatar that presently has a Taliban diplomatic post as the United States is in talks for some kind of peace in Afghanistan. It is al Thani whose son graduated from West Point. It is Qatar that many of the Gulf nations are at odds with due to Qatar’s support for the Muslim Brotherhood and jihad networks. It is Qatar that hosts a major U.S. military base, al Udeid.

The Trump administration hopes to restore a degree of normalcy to Qatar’s relationship with its neighbors after Saudi Arabia, the United Arab Emirates, Bahrain and Egypt instigated a month’s long blockade and embargo against the Gulf sheikhdom in June. Both Qatar and the UAE have spent millions of dollars in recent years on rival lobbying campaigns, according to a review of lobbying records.

So, what about Senator Menendez? Well….

Senator Bob Menendez (D., N.J.) hired a longtime aide and lobbyist for the Qatari government to chair his reelection campaign, the Philadelphia Inquirer reported Friday.

Michael Soliman has lobbied Menendez, the top Democrat on the Foreign Relations Committee, and other lawmakers on behalf of the Qatari government since 2015.

While the arrangement is strictly legal, ethics experts told the Inquirer that it might constitute a conflict of interest.

“There is a blurring of lines between responsibility to the candidate and responsibility to their client,” said Meredith McGehee of the Campaign Legal Center, a nonprofit watchdog in Washington. “Very little of that is a responsibility to the public.”

In a statement to the Inquirer, Soliman said his lobbying work had “always been fully transparent, above board and properly disclosed.” After receiving inquiries from other publications, Soliman said that “out of an overabundance of caution,” he would not “directly or indirectly lobby the senator or his staff on behalf of any client for the duration of the campaign.”

Menendez was indicted on corruption charges in 2015 in connection with his relationship to a wealthy Florida doctor who procured lavish gifts and vacations for the lawmaker in exchange for help navigating regulatory obstacles in his health-care business. Menendez was ultimately acquitted in January by a hung jury that found he did not perform any “official acts” for material benefit. But the Senate Ethics Committee reprimanded Menendez, writing that he “risked undermining the public’s confidence in the Senate,” in an April letter sent after the Department of Justice had dropped all charges.

Menendez has paid Soliman’s consulting firm $105,000 since 2015, but a spokesman for his campaign denied any allegations of impropriety.

Soliman has been a “trusted political advisor to the Senator for more than a decade, but neither he, nor any lobbyist, has influenced how the Senator speaks to representatives of any government in advocating for the foreign policy and national security interests of both the United States and our allies,” said Steve Sandberg, a spokesperson for the Menendez campaign.

 

 

Part of Michael’s resume includes:

Strategic advisor to Congressman-elect Josh Gottheimer’s successful campaign against a 14 year incumbent

Lead strategist for U.S. Senator Cory Booker’s successful 2014 Senate campaign

Served as Senator Robert Menendez’s State Director and New Jersey Chief of Staff since 2007

Managed Senator Menendez’s successful re-election campaign in 2012

District Director for U.S. Congressman Steve Rothman

Advised the campaigns of the late Senator Frank Lautenberg, former Governor Jon Corzine, and Congressman Bill Pascrell

Worked on campaigns of various Democratic officials, including Mayor Glenn Cunningham of Jersey City and State Senator Bob Gordon

Frequent guest lecturer at academic institutions including St. Peter’s University and the Rebovich Institute for New Jersey Politics

Appeared on the PolitickerNJ Power List for the past 9 years

Selected as an influencer by Campaigns & Elections Magazine

St. Peter’s University, Political Science (BA)

Bloustein School at Rutgers University (MPP)

Mercury, a high-stakes public strategy firm, continues to expand nationwide and across the globe, most recently through the addition of offices in London and Mexico City. In addition to Soliman, Mercury’s New Jersey office is led by DuHaime, Chris Christie’s top political adviser. Mo Butler, who served as chief of staff in New Jersey to U.S. Sen. Cory Booker, joined the firm.

Google Wont Stop Following You, Regardless of Settings

Even when you opt out. Even when you change the settings. Even without your knowledge. Next question that needs an answer…who is Google selling the data to?

Google is tracking your every move, apparently | Metro News photo

SAN FRANCISCO (AP) — Google wants to know where you go so badly that it records your movements even when you explicitly tell it not to.

An Associated Press investigation found that many Google services on Android devices and iPhones store your location data even if you’ve used a privacy setting that says it will prevent Google from doing so.

Computer-science researchers at Princeton confirmed these findings at the AP’s request.

For the most part, Google is upfront about asking permission to use your location information. An app like Google Maps will remind you to allow access to location if you use it for navigating. If you agree to let it record your location over time, Google Maps will display that history for you in a “timeline” that maps out your daily movements.

** In case you missed Tucker Carlson’s segment on Google:

 

Storing your minute-by-minute travels carries privacy risks. So Google will let you “pause” a setting called Location History.

Google says that prevents the company from remembering where you’ve been. Its support page states: “You can turn off Location History at any time. With Location History off, the places you go are no longer stored.”

But this isn’t true. Even with Location History paused, some Google apps automatically store time-stamped location data without asking.

For example, Google stores a snapshot of where you are when you merely open its Maps app. Automatic daily weather updates on Android phones note your location. So can searches that have nothing to do with location.

The privacy issue affects some two billion users of devices that run Google’s Android operating software and hundreds of millions of worldwide iPhone users who rely on Google for maps or search.

Storing location data in violation of a user’s preferences is wrong, said Jonathan Mayer, a Princeton computer scientist and former chief technologist for the Federal Communications Commission’s enforcement bureau. A researcher from Mayer’s lab confirmed the AP’s findings on multiple Android devices; the AP conducted its own tests on several iPhones and found the same behavior.

“If you’re going to allow users to turn off something called ‘Location History,’ then all the places where you maintain location history should be turned off,” Mayer said.

Google says it is being perfectly clear.

“There are a number of different ways that Google may use location to improve people’s experience, including: Location History, Web and App Activity, and through device-level Location Services,” Google said in a statement to the AP. “We provide clear descriptions of these tools, and robust controls so people can turn them on or off, and delete their histories at any time.”

To stop Google from saving these location markers, the company says, users can turn off another setting, though it doesn’t specifically reference location information. Called “Web and App Activity,” that setting stores a variety of information from Google apps and websites to your Google account.

When paused, it will prevent activity on any device from being saved to your account. But leaving “Web & App Activity” on and turning “Location History” off only prevents Google from adding your movements to the “timeline,” its visualization of your daily travels. It does not stop Google’s collection of other location markers.

You can see these stored location markers on a page in your Google account at myactivity.google.com. It’s possible, though laborious, to delete them.

To demonstrate how powerful these other markers can be, the AP created a visual map of the movements of Princeton postdoctoral researcher Gunes Acar, who carried an Android phone with Location history off and shared a record of his Google account.

The map includes Acar’s train commute on two trips to New York and visits to the High Line park, Chelsea Market, Hell’s Kitchen, Central Park and Harlem.

Huge tech companies are under increasing scrutiny over their data practices, following a series of privacy scandals at Facebook and new data-privacy rules recently adopted by the European Union.

Critics say Google’s insistence on tracking its users’ locations stems from its drive to boost advertising revenue.

“They build advertising information out of data,” said Peter Lenz, the senior geospatial analyst at Dstillery, a rival advertising technology company. “More data for them presumably means more profit.”

The AP learned of the issue from K. Shankari, a graduate researcher at UC Berkeley who studies the commuting patterns of volunteers in order to help urban planners. She noticed that her Android phone prompted her to rate a shopping trip to Kohl’s, even though she had turned Location History off.

“I am not opposed to background location tracking in principle,” she said. “It just really bothers me that it is not explicitly stated.”

Google offers a more accurate description of how Location History works in a popup when you pause the setting on your Google account webpage . It notes that “some location data may be saved as part of your activity on other Google services, like Search and Maps.”

There’s another obscure notice if you turn off and re-activate the “Web & App Activity” setting. It notes that the setting “saves the things you do on Google sites, apps, and services … and associated information, like location.”

The warnings offered when you turn Location History off via Android and iPhone device settings are more difficult to interpret.

Since 2014, Google has let advertisers track the effectiveness of online ads at driving foot traffic , a feature that Google has said relies on user location histories.

DNC Sues, Serves WikiLeaks via Twitter

Okay, so how does WikiLeaks confirm receipt? heh

The Democratic National Committee on Friday officially served its lawsuit to WikiLeaks via Twitter, employing a rare method to serve its suit to the elusive group that has thus far been unresponsive.

As CBS News first reported last month, the DNC filed a motion with a federal court in Manhattan requesting permission to serve its complaint to WikiLeaks on Twitter, a platform the DNC argued the website uses regularly. The DNC filed a lawsuit in April against the Trump campaign, Russian government and WikiLeaks, alleging a massive conspiracy to tilt the 2016 election in Donald Trump’s favor.

Another Senior DNC Staffer Gone Following Emails Leak by ...

All of the DNC’s attempts to serve the lawsuit via email failed, the DNC said in last month’s motion to the judge, which was ultimately approved.

The lawsuit was served through a tweet from a Twitter account established Friday by Cohen Milstein, the law firm representing the DNC in the suit, with the intent of serving the lawsuit.

*** @wikileaks By Court order, you are being served with the following legal documents: https://t.co/ICg8qWnsUy, https://t.co/ZP2tTPJ4pb, https://t.co/RKue30s4hM, https://t.co/q5g0G1rQpQ.
All of these documents may be found here: https://t.co/NOCgvQhh2j.

The DNC argued the unusual method of serving a lawsuit over Twitter was feasible because WikiLeaks, founded by Julian Assange, frequently uses Twitter and had even suggested it had read the DNC’s lawsuit.

On April 21, the WikiLeaks Twitter account tweeted, “Democrats have gone all Scientology against @WikiLeaks. We read the DNC lawsuit. Its primary claim against @WikiLeaks is that we published their ‘trade secrets.’ Scientology infamously tried this trick when we published their secret bibles. Didn’t work out well for them.'”

The DNC also noted last month that there is some legal precedent for serving the lawsuit on Twitter. The U.S. District Court for the Northern District of California, the DNC notes, decided service by Twitter was a reasonable way to alert the defendant, who had an active Twitter account.

“WikiLeaks seems to tweet daily,” the DNC said in the motion made to the judge last month.

In the months before the 2016 election, WikiLeaks released nearly 20,000 internal DNC emails, many of which were related to Hillary Clinton. WikiLeaks later released thousands of emails belonging to John Podesta, who was Clinton’s 2016 presidential campaign chairman.

Mr. Trump and many in his administration have described questions of alleged conspiracy with Russia as an excuse for losing the election.

“Just won lawsuit filed by the DNC and a bunch of Democrat crazies trying to claim the Trump Campaign (and others), colluded with Russia. They haven’t figured out that this was an excuse for them losing the election!” the president tweeted in July, although the lawsuit is ongoing.

 

 

Trouble Ahead After DPRK’s FM Visit to Tehran

So, it appears there is more to the teaming up between Tehran and Pyongyang.

The Iranian President Rouhani told the North Korean Foreign Minister in a recent confab to NOT trust the United States.

Meanwhile, SecState, Mike Pompeo issued a proposal to North Korea calling for a timeline Pompeo that would mandate North Korea hand over 60 to 70 percent of its nuclear warheads to a third party within six to eight months, according to the report.

North Korea has reportedly rejected a formal timeline for its denuclearization proposed by Secretary of State Mike Pompeo.

Vox reported Wednesday that Pyongyang has rejected the timeline several times over the past two months amid continued negotiations over North Korea’s nuclear program.

The timeline Pompeo proposed would mandate North Korea hand over 60 to 70 percent of its nuclear warheads to a third party within six to eight months, according to the report.

However, it is unclear how many warheads North Korean leader Kim Jong Un has, making it difficult to verify that Pyongyang has actually turned over an agreed-upon percentage.

Trump administration officials in recent weeks have expressed frustration with North Korea’s efforts to denuclearize despite President Trump hailing his June summit with Kim in Singapore as a success.

“The ultimate timeline for denuclearization will be set by Chairman Kim, at least in part,” Pompeo told Channel NewsAsia in an interview last week.

“The decision is his. He made a commitment, and we’re very hopeful that over the coming weeks and months we can make substantial progress towards that and put the North Korean people on a trajectory towards a brighter future very quickly.”

White House national security adviser John Bolton told Fox News on Tuesday that “North Korea that has not taken the steps we feel are necessary to denuclearize.”

Iran fires attack on Trump as it tells North Korea: ‘US ... photo

Then we have yet another emerging hacking warning from CERT.

The Department of Homeland Security (DHS) and the Federal Bureau of Investigation (FBI) have identified a Trojan malware variant—referred to as KEYMARBLE—used by the North Korean government. The U.S. Government refers to malicious cyber activity by the North Korean government as HIDDEN COBRA.

US-CERT encourages users and administrators to review Malware Analysis Report (MAR) MAR-10135536-17 and the US-CERT page on HIDDEN COBRA – North Korean Malicious Cyber Activity for more information.

Not to leave out Iran’s cyber attack warnings.

Iranian hackers have laid the groundwork to carry out extensive cyber attacks against private U.S. and European companies, U.S. officials warn, according to NBC News. Although experts don’t believe any such attack is imminent, the preparations could enable denial-of-service attacks on infrastructure including electric grids and water plants, plus health care and technology companies across the U.S., Europe, and Middle East, say U.S. officials at the 2018 Aspen Security Forum.

A spokesperson for the Iranian mission to the United Nations, Alireza Miryousefi, told NBC News that the U.S. is more aggressive in terms of cyber attacks, and Iran’s moves are merely defensive.

***

As sanctions reimposed in response to its nuclear program begin to bite, Iran seems poised to follow the trail North Korea blazed in cyberspace: state-directed hacking that aims at direct theft to redress economic pain. Accenture researchers have been tracking ransomware strains, many of them requiring payment in Bitcoin or other cryptocurrencies, and they’ve concluded that they represent an incipient Iranian campaign against targets of opportunity that offer the prospect of quick financial gain. Tehran’s state-directed hackers have a reputation as being relatively less sophisticated than those run by Russia and China (and indeed those run by major Western powers, the Five Eyes and their closest friends) but they also have a reputation as determined fast-learners.

CCN: As the US gets ready to impose sanctions on Iran, hackers in that country are working on ransomware to secure bitcoin, according to cybersecurity experts interviewed by The Wall Street Journal.

Accenture PLC’s cybersecurity intelligence group has followed five Iranian built ransomware variations in the last two years. The hackers are hoping to secure payments in cryptocurrencies, according to Jim Guinn, who oversees the industrial cybersecurity business at Accenture.

Several clues link the ransomware to Iran. Samples include messages in Farsi that are connected to Iran based computers.

A recent Accenture report noted the ransomware could be driven by Iranian government supported parties, criminals, or both.

Scourge Continues

Ransomware has plagued both businesses and governments for years, having disabled payment systems at the San Francisco Municipal Transportation Agency, U.K hospitals and cargo shipments. Government supported hackers in some instances have obtained cryptocurrency payments from victims.

One variant of ransomware that iDefense discovered has been linked to Iran’s government, according to CrowdStrike Inc., another cybersecurity firm. The software, called Tyrant, was developed to discourage Iranian citizens from downloading software designed to discourage government snooping, CrowdStrike noted.

Palo Alto Networks Inc. and Symantec Corp. issued reports last month that described a pair of data stealing operations connected to Iran.

Crypto Mining Linked To Iran

Crypto mining software, which robs computers of their processing power to mine cryptocurrencies, has also been linked to Iran.

Accenture cited crypto mining software installed on Middle Eastern customer networks equipped with digital clues to Iran.

Crypto mining software has created problems in gas and oil facilities in the Middle East, Guinn said. He estimated millions of dollars of compute cycles have been stolen in the last year.

Iran Denies Culpability

Iran has claimed it has not been involved in cyber attacks, and that it has been a hacking victim.

A cyber attack called Stuxnet initiated by the U.S. and Israel about a decade ago disabled uranium-enrichment centrifuges for Iran’s nuclear program. Iran has since focused on enhancing its own cyber capabilities, according to government officials and security researchers.

Keith Alexander, chief executive of IronNet Cybersecurity Inc. and former director of the U.S. Cyber Command and the National Security Agency said crypto mining and theft is a way for cash-strapped countries to make fast profits.

Guinn said hackers have also stolen intellectual property.