CyberBakery Chronicles

Your Weekly Cybersecurity Update (10 Jan 2025)

• The European Commission has been fined for illegal …

• India has proposed new digital data regulations th …

• Apple reaffirms its commitment to Siri's privacy a …

• The U.S. government has introduced a cybersecurity …

• The new EAGERBEE variant ISPs and governments usin …

The European Commission has been fined for illegally transferring user data to Meta.

In a landmark decision, the European General Court has fined the European Commission €400 for violating the EU’s own data protection laws. This marks the first instance of the Commission being held liable for such an infringement.

Summary of the Incident:

• Data Transfer Details: In March 2022, a German citizen registered for an event on the now-defunct futureu.europa.eu website using the “Sign in with Facebook” option. This action led to the transmission of the individual’s IP address and browser metadata to Meta’s servers in the United States.

• Legal Findings: The court determined that this data transfer occurred without adequate safeguards, constituting a “sufficiently serious breach” of EU data protection regulations. At the time, there was no Commission decision affirming that the U.S. ensured an adequate level of protection for EU citizens’ personal data.

Analysis:

This ruling underscores the imperative for all entities, including EU institutions, to adhere strictly to data protection laws. The General Data Protection Regulation (GDPR) mandates that personal data transfers to non-EU countries must be underpinned by appropriate safeguards, such as standard contractual clauses or adequacy decisions. The absence of such measures in this case highlights a significant compliance lapse.

The decision also reflects the evolving landscape of data transfer mechanisms between the EU and the U.S. Following the invalidation of the Privacy Shield Framework; the EU adopted the E.U.-U.S. Data Privacy Framework in July 2023 to facilitate transatlantic data flows. This case predates that framework, emphasizing the challenges organizations faced during the interim period.

In conclusion, this ruling highlights the critical importance of compliance with data protection laws, even for governing bodies like the European Commission. It reinforces the need for vigilance and adherence to legal standards in all data processing activities, particularly those involving cross-border data transfers.

India has proposed new digital data regulations that include strict penalties and requirements for cybersecurity.

The Indian government has released draft rules under the Digital Personal Data Protection (DPDP) Act, 2023, aiming to enhance data privacy and cybersecurity measures.

Key Provisions of the Draft Rules:

• Informed Consent: Data fiduciaries must provide clear information about data processing practices, enabling individuals to give informed consent.

• Data Subject Rights: Individuals can request data erasure, appoint digital nominees, and access mechanisms to manage their data.

• Security Measures: Organizations are required to implement safeguards such as encryption, access controls, and data backups to protect personal data’s confidentiality, integrity, and availability.

• Breach Notification: In the event of a data breach, companies must inform the Data Protection Board (DPB) within 72 hours, providing details of the incident and mitigation steps.

• Data Retention and Deletion: Personal data should be deleted after three years if no longer needed, with individuals notified 48 hours before erasure.

• Data Protection Officer (DPO): Companies must designate a DPO and display their contact details for addressing user queries regarding data processing.

• Processing of Minors’ Data: Verifiable consent from parents or legal guardians is required before processing data of children under 18 or persons with disabilities, with certain exemptions for specific activities.

• Data Protection Impact Assessment (DPIA): Significant data fiduciaries are mandated to conduct annual DPIAs and comprehensive audits, reporting results to the DPB.

• Cross-Border Data Transfers: Compliance with government-set requirements for transferring personal data outside India is necessary, with specific categories to be determined by a specialized committee.

Organisations failing to protect personal data or notify the DPB of breaches may face fines up to ₹250 crore (approximately $30 million).

The Ministry of Electronics and Information Technology (MeitY) is accepting public feedback on the draft rules until February 18, 2025.

These draft rules signify India’s commitment to strengthening data protection and cybersecurity frameworks. By enforcing stringent consent requirements, robust security measures, and clear guidelines for data processing, the regulations align with global data protection standards.

The emphasis on Data Protection Impact Assessments and the appointment of Data Protection Officers indicates a proactive approach to identifying and mitigating data privacy risks. Additionally, the substantial penalties for non-compliance underscore the seriousness with which data protection is being treated.

Organizations operating in India should prepare to align their data processing activities with these forthcoming regulations, ensuring compliance to avoid significant financial penalties and to build trust with consumers regarding the handling of their personal data.

Apple reaffirms its commitment to Siri's privacy after a $95 million class action settlement.

Apple has recently addressed concerns regarding Siri’s data privacy following a $95 million settlement in a class-action lawsuit. Some of the key points of the settlement and their commitment to privacy include:

• Privacy Assurance: Apple emphasises that it has never used Siri data to build marketing profiles, made it available for advertising, or sold it to any entity.

• Data Handling Practices: Siri processes data on-device whenever possible, minimising data transfer. For certain features requiring real-time input, minimal data is sent to Apple servers to ensure accurate results. Audio recordings of Siri interactions are not retained unless users explicitly opt-in to help improve Siri, and even then, the recordings are used solely for that purpose. Users can opt-out at any time.

• Settlement Details: The $95 million settlement addresses allegations that Siri inadvertently recorded private conversations and disclosed them to third parties, such as advertisers. Apple denied these claims and did not admit to any wrongdoing in the settlement. Affected users may receive up to $20 per Siri-enabled device, including iPhones and Apple Watches.

This situation underscores the importance of transparency in data collection and usage practices, especially for companies handling vast amounts of personal information. While Apple maintains a strong stance on user privacy, the settlement indicates the complexities and challenges in ensuring that voice-activated assistants like Siri operate without unintended data capture.

For users concerned about privacy, it’s advisable to review device settings to manage data sharing preferences actively. Regularly updating devices and staying informed about a company’s data practices can help maintain control over personal information.

In the broader context of cybersecurity, this case highlights the need for continuous evaluation and improvement of data protection measures, even among companies reputed for prioritising user privacy. As technology evolves, so do the methods by which data can be inadvertently or maliciously accessed, necessitating vigilance from both providers and users.

The U.S. government has introduced a cybersecurity safety label for smart devices.

The U.S. government has introduced the U.S. Cyber Trust Mark, a voluntary labelling initiative to help consumers identify smart devices that meet federal cybersecurity standards.

• Scope: Applies to a range of internet-connected devices, including baby monitors, home security cameras, fitness trackers, and smart appliances.

• Label Design: Features a distinctive shield logo and a QR code that consumers can scan to access detailed security information about the device.

• Implementation Timeline: Labeled products are expected to be available to consumers later this year as manufacturers begin submitting their devices for approval.

• Industry Participation: Companies such as Amazon, Best Buy, Google, LG Electronics USA, Logitech, and Samsung are among the participants supporting this initiative.

This initiative is comparable to the Energy Star program, which rates appliances’ energy efficiency, aiming to provide consumers with clear information about the cybersecurity of smart devices. By enabling consumers to make informed choices, it encourages manufacturers to enhance their cybersecurity measures, thereby reducing the risk of cyber intrusions through vulnerable devices.

In December 2024, the FCC took a significant step by approving 11 companies as Cybersecurity Label Administrators. These administrators are charged with the essential task of managing the program daily and certifying the use of the U.S. Cyber Trust Mark label. With the average American household equipped with numerous internet-connected devices—each posing a potential entry point for cybercriminals—this labelling system empowers consumers to confidently assess the cybersecurity of the products they choose to bring into their homes.

In conclusion, the U.S. Cyber Trust Mark represents a significant step toward improving cybersecurity awareness and standards in consumer electronics, fostering a safer digital environment for all. Other countries will soon start looking to ape this marking regime.

The new EAGERBEE variant ISPs and governments using backdoor capabilities

A new variant of the EAGERBEE malware framework is actively targeting internet service providers (ISPs) and government entities in the Middle East, exhibiting advanced backdoor capabilities. Some of the key features of EAGERBEE variant include:

• Modular Architecture: The malware employs a plugin-based system, allowing it to load specific modules into memory as needed, enhancing its adaptability and stealth.

• Advanced Backdoor Capabilities: It facilitates remote command execution, file system manipulation, process exploration, network connection listing, and service management, providing attackers with comprehensive control over compromised systems.

• Stealth Techniques: By maintaining core functionalities in memory and minimising on-disk presence, EAGERBEE reduces the likelihood of detection by traditional security measures.

Attack Vectors and Targets:

• Exploitation of Known Vulnerabilities: In some instances, attackers have leveraged vulnerabilities like ProxyLogon (CVE-2021-26855) to gain initial access, deploying web shells for command execution.

• Geopolitical Focus: The malware primarily targets ISPs and government organisations in the Middle East, aligning with espionage objectives to gather sensitive information.

The evolution of EAGERBEE underscores a significant advancement in malware sophistication, particularly in its modular design and in-memory execution strategies. These characteristics enable attackers to tailor functionalities to specific targets and evade detection mechanisms effectively.

Organisations, especially those in critical infrastructure sectors, should prioritise the following measures:

• Patch Management: Regularly update systems to address known vulnerabilities, such as ProxyLogon, to prevent exploitation.

• Advanced Threat Detection: Implement security solutions capable of identifying in-memory threats and unusual network behaviours indicative of modular malware activity.

• Incident Response Preparedness: Develop and maintain robust incident response plans to swiftly address potential breaches and mitigate damage.

The emergence of this EAGERBEE variant highlights the persistent and evolving nature of cyber threats targeting critical infrastructure. Proactive defence strategies and continuous monitoring are essential to safeguard against such sophisticated attacks.

Let’s make 2025 the year of shared knowledge and community growth.