Happy weekend, Cyber Saturday readers. I am just returning from a trip to Mexico, so I’ll keep this dispatch brief.
This week the Justice Department indicted Park Jin Hyok, a North Korean programmer, for allegedly helping to hack companies such as Sony Pictures, the Bangladesh Bank, and many other businesses, including ones affected by last year’s crippling WannaCry ransomware worm.
The takeaway: Attribution has become an increasingly tractable problem online. When I helped former Fortune editor Peter Elkind investigate the cyberattack on Sony a few years ago, we were skeptical of the government’s ability to identify the culprit. At the time, the Feds basically pointed a finger at North Korea and said, “It was them. We’re certain. Trust us.” Now this acutely detailed, 179-page complaint dispels almost all doubt. It is chock full of damning forensic evidence.
This latest indictment comes just a couple months after the Justice Department charged a dozen Russian operatives for election meddling. A few months before that, the department indicted nine Iranians hackers for breaking into university systems. And in the fall of last year, it accused three Chinese nationals for infiltrating companies like Moody’s and Siemen’s. The message is clear: If you mess with America, you will be exposed.
Though it’s unlikely Park will ever face a courtroom hearing (you need extradition treaties in place for that), the U.S. has named and shamed him—and slapped on financial sanctions. Ideally, actions such as these will serve to deter future would-be assailants. So the thinking goes, at least.
And hey, you never know…the top story in the news section below notes that the U.S. finally got its hands on a bank hacker who many people doubted would ever come to justice. So, there’s always hope.
***
In past editions of this newsletter, we engaged in a dialogue about free speech and censorship, prompted by the antics of Alex Jones, an unsavory conspiracy theorist who created the website InfoWars. Twitter has finally booted Jones off its properties, and Apple too has permanently stricken the troublemaker’s app from its App Store. Thus spake Big Tech.
Feliz fin de semana.
Robert Hackett
@rhhackett
robert.hackett@fortune.com
Welcome to the Cyber Saturday edition of Data Sheet, Fortune’s daily tech newsletter. Fortune reporter Robert Hackett here. You may reach Robert Hackett via Twitter, Cryptocat, Jabber (see OTR fingerprint on my about.me), PGP encrypted email (see public key on my Keybase.io), Wickr, Signal, or however you (securely) prefer. Feedback welcome.
THREATS
JPMorgan hacker cuffed. Federal authorities have apprehended Andrei Tyurin, a Russian citizen who stands accused of having hacked companies such as JPMorgan Chase, Fidelity, Dow Jones, E*Trade, and Scottrade. The previously unnamed suspect's identity became public after he was extradited to New York from the Republic of Georgia on Friday. He plead not guilty to the charges.
Back to the drawing board. Republicans and Democrats could not agree on the terms of a pact that would have barred both sides from using hacked materials to aid campaign efforts. The proposed covenant was supposed to set guidelines prohibiting both sides from seeking out hacked materials and using them for their benefit. It also stipulated that all interactions with foreign actors would have to be reported to the FBI.
Happy anniversary, Equifax. A year after the Equifax breach, a new report out of the U.S. General Accounting Office lays out the many failures leading up to credit bureau's ransacking by hackers. The company failed to put basic security measures in place, including security reviews and other internal controls.
Doom and gloom. Homeland Security Secretary Kirstjen Nielsen said in a recent speech at George Washington University that the world has moved from the "epidemic" to the "pandemic" stage in terms of worldwide outbreaks of cyberattacks. Meanwhile, NSA Deputy Director George Barnes said at a different event in Maryland that the U.S. is getting "continuously pummeled" by groups stealing trade secrets and conducting corporate espionage.
Hyperlink makeover? Google is rethinking the humble URL, but the company says it is too early to share examples of alternative formats. Link addresses are commonly abused in phishing schemes, which are at the root of an overwhelming majority of cybersecurity failures. As Parisa Tabriz, director of engineering at Chrome, told Wired of URLs, "They kind of suck."
"You and your cyber!"
Share today's Data Sheet with a friend:
http://fortune.com/newsletter/datasheet/
Looking for previous Data Sheets? Click here.
ACCESS GRANTED
The echo signal can be used to profile user interaction with the device. For example, a victim’s finger movements can be inferred to steal Android unlock patterns. In our empirical study, the number of candidate unlock patterns that an attacker must try to authenticate herself to a Samsung S4 phone can be reduced by up to 70% using this novel acoustic side-channel. The attack is entirely unnoticeable to victims.
FORTUNE RECON
Less Than Half of Americans Trust Tech Companies to Prevent Election Interference by Natasha Bach
Drone Wars: Lockheed Martin Is Offering Millions in Prizes for AI That Can Beat Human Pilots by David Meyer
Forcepoint CEO: As Your Company Grows, Don't Lose Sight of Its Culture by Damanick Dantes
Here Are Some Highlights From Facebook and Twitter's Senate Testimony on Election Attacks by Aaron Pressman
Those Airport Security Bins Are Even Filthier Than You Thought by Lucas Laursen
Facebook's Former Security Head Says U.S. Elections Are Still at Risk by Renae Reints
Google's New AI Tool to Fight Child Sexual Abuse Will Help Reviewers Scan 700% More Material by Hallie Detrick
Mac App Store Still Seems to Have Malicious Apps by Lisa Marie Segarra
ONE MORE THING
Spice up your life. Chat app Slack uses two autonomous robots named Salt and Peppa to monitor its offices after employees have left for the night. The non-human guards come courtesy of Cobalt, a Sequoia-backed robotics company. We're not sure which is the good robocop and which is the bad one.
