What I'm Reading 4/3/2020

Hacker News - Why your IT department (if they're smart) doesn't want Zoom anywhere near their enterprise grade network. -

Zoom's deceptive marketing tactics, it's poor security record, the many known and recently published vulnerabilities in both its software and platform make this an application that is certainly not fit for purpose in any organisation that is required to be serious about its client's or its own information privacy, network security.

The Register - Boeing 787s must be turned off and on every 51 days to prevent 'misleading data' being shown to pilots -

The US Federal Aviation Administration has ordered Boeing 787 operators to switch their aircraft off and on every 51 days to prevent what it called "several potentially catastrophic failure scenarios" – including the crashing of onboard network switches.

The airworthiness directive, due to be enforced from later this month, orders airlines to power-cycle their B787s before the aircraft reaches the specified days of continuous power-on operation.

Vice - Leaked Amazon Memo Details Plan to Smear Fired Warehouse Organizer: ‘He’s Not Smart or Articulate’ -

Leaked notes from an internal meeting of Amazon leadership obtained by VICE News reveal company executives discussed a plan to smear fired warehouse employee Christian Smalls, calling him “not smart or articulate” as part of a PR strategy to make him “the face of the entire union/organizing movement.”

Security Boulevard - Guidance for CIP-013: Effective Date, Guidelines, and Enforcement -

This new CIP-013 supply chain risk management regulation serves to limit power and utilities’ expose to third party cyber risks as they expand business in a predominantly digital age. Thus, the standard and upcoming effective date impacts all entities in the power and utilities industry, requiring them to focus on assessments, risk measurement, risk management, and cybersecurity best practices across numerous vendors.

 Veracode - New Cyberspace Solarium Commission Report Offers Words of Warning for AppSec -

Section 4.2 of the report caught our eye as it pertains to the private sector and supply chains, both of which are lacking a stipulated working relationship with the government. Part of this sweeping initiative includes an effort to ensure that companies that are assembling and selling software, hardware, and firmware are ‘liable for damages from incidents that exploit vulnerabilities’ known at the time of shipping goods and not fixed in a reasonable period.”

This, the commission says, would establish a ‘duty of care’ in law to make final goods assemblers responsible for producing security patches that cover products for the duration of their life and support needs—or for a year after the most recent patch release.

Why did the commission feel this effort is important? According to the report, “To date, there has not been a clearly defined duty of care for final goods assemblers in their responsibilities for developing and issuing patches for known vulnerabilities in their products and services, the timeliness of those patches, and maintaining a vulnerability disclosure policy.”

NYTimes - C.I.A. Hunts for Authentic Virus Totals in China, Dismissing Government Tallies -

The C.I.A. has been warning the White House since at least early February that China has vastly understated its coronavirus infections and that its count could not be relied upon as the United States compiles predictive models to fight the virus, according to current and former intelligence officials.

MIT Technology Review - The Defense Department Has Produced the First Tools for Catching Deepfakes -

The first forensics tools for catching revenge porn and fake news created with AI have been developed through a program run by the US Defense Department.

...

"We've discovered subtle cues in current GAN-manipulated images and videos that allow us to detect the presence of alterations,” says Matthew Turek, who runs the Media Forensics program.

NYTimes - A Hoarder’s Huge Stockpile of Masks and Gloves Will Now Go to Doctors and Nurses, F.B.I. Says -

The man who was charged with lying to federal agents, Baruch Feldheim, 43, charged a doctor $12,000 last month for a large order of masks, gowns and hazmat gear at a 700 percent markup, according to the F.B.I. The agency called it a glaring example of hoarding of medical supplies that are designated as essential under a presidential executive order.

...

When the doctor went to pick up his order at an auto repair shop in Irvington, N.J., which was being used as a warehouse, he saw so many pallets of medical gear, Clorox wipes and hand sanitizer that it would have been enough to supply an entire hospital, a criminal complaint said.

I have to say I have a problem with this.  As far as I know, it's not illegal to own this material, and depending on when he bought it, it may not have been designated essential yet.  Do I think it is scummy that he would charge a 700% markup?  Yes.  But is it any scummier than Uber charging surges prices during a storm or hotels quadrupling their rates during big events?  No, not really.  He charged what the market would bear, which is the essence of capitalism.  I predict a dismissal of charges and a huge lawsuit.

The Register - UK judge gives Google a choice: Either let SEO expert read your ranking algos or withdraw High Court evidence -

Google must either show its "crown jewels" to a man it described to the High Court as a search engine optimisation expert or give up parts of its defence in a long-running competition lawsuit, the UK High Court has ruled.

In a case over whether Google wrongly demoted price comparison rival Foundem from its search results in favour of paid-for adverts, Google must now decide which it values more: the algorithms that rank its search results, or its stance that manually fiddling with those results to promote its own paid-for products over rivals' sites doesn't break competition laws.