Defense in Brief #16: California's recently enacted GDPR-like law, new AWS security tools, how software engineers saved the Air Force millions, and more!

In June, California enacted the California Consumer Privacy Act of 2018 (AB 375), a GDPR-like consumer-protection law. Starting in January 2020, AB 375 gives consumers a number of new rights related to the personal information collected by businesses, including the right to request that a business disclose what information it collects. Interestingly, AB 375 also lets businesses offer consumers “financial incentives” in exchange for permission to collect and sell their data.

Just five days after the GDPR went into effect, a German court ruled that the data-collection requirements imposed by ICANN, a company that organizes Internet domain names, violated the GDPR. Specifically, the court held that ICANN’s requirement that registrars (the entities that sell second-level domains) collect information for more than one person for each registered domain name violated the GDPR’s purpose-limitation and data-minimization principles.

Google has confirmed that when you grant third-party app developers access to your Gmail account, your emails may be read by human staff (and not just by machines).

A seven-time “Jeopardy!” winner pleaded guilty to charges of unauthorized computer access for logging into the email accounts of professors, administrators, and students at the college she works at. She gained access to their emails after the college reset everyone’s passwords and assigned everyone the same temporary password.

The Air Force is trying something new to upgrade its dated software (and analog) systems: It’s hiring coders to work out of WeWork offices. Called the “Kessel Run” program, the Air Force hired its own coders and contracted with Pivotal Software to upgrade aerial-refueling-operations software. After its initial success, the Air Force is looking to grow the program into something that will help modernize other systems.

On July 12, an attacker was able to publish two malicious packages to the npm registry by using a compromised account of an ESLint maintainer. The account was compromised because its owner reused their npm password on several other websites and did not have 2FA enabled on their npm account. The malicious packages were removed the same day.

Since requiring all of its 85,000+ employees to use Universal 2nd Factor (U2F) Security Keys for two-step verification on their work accounts, no Google employee has been successfully phished.

Two new AWS tools are being rolled out to help users keep their data secure. The first, Tiros, analyzes network configurations and looks for unexpected access from the open Internet. The second, Zelkova, helps developers understand how permissive their setups are compared to their existing infrastructures.

A new Mac malware family has been advertised in cryptocurrency-focused Slack and Discord channels, with attackers encouraging users to run a specific command in their terminals. The malware gives an attacker a backdoor to the infected machine and stores the victim’s macOS root password in cleartext in a local file.

Nathan Fielder and election-security expert Carsten Schürmann demonstrate how someone could hack the Emmys voting system through phishing attacks.

Deploy your app. Design your security management program. Meet the requirements of HIPAA, ISO 27001, SOC 2, PCI, and more.