Short Takes – 6-16-23

Shutdown odds grow amid GOP infighting. TheHill.com article. Pull quote: “That legislation, dubbed the Financial Responsibility Act (FRA), included an incentive to Congress to pass all 12 regular appropriations bills in a timely manner. If the appropriations are not made by Jan. 1, then any continuing resolution (CR) would have to cap spending at 99 percent of current levels — a 1 percent across-the-board cut that would affect even military spending.”

House blocks Republican effort to censure Rep. Adam Schiff. NBCNews.com article. Pull quote: “Twenty Republicans joined Democrats in tabling Luna's measure, effectively blocking a vote on the censure resolution itself. Two Republicans and five Democrats voted present.”

Food Producers Band Together in Face of Cyber Threats. WSJ.com article. Pull quote: “Information-sharing on threats within the industry has been patchy. A specialist group within the Information Technology-Information Sharing and Analysis Center, which tracks threats across multiple industries, served as the primary avenue for intercompany intelligence since 2013. Last month, the IT-ISAC announced that the food and agriculture sector would finally be getting its own, dedicated platform. Similar groups already exist to enable companies in the financial services, retail, automobile and other sectors to exchange details about threats their peers should watch out for.”

Four Takeaways From the Department of Justice Audit on Countering Domestic Terrorism. JustSecurity.org article. Pull quote: “The U.S. Department of Justice Office of the Inspector General (OIG) released an audit addressing DOJ’s work to track, prosecute, and disrupt domestic violent extremism. The audit provides examples of divisions within the department not being on the same page, as well as recommendations for how the department could build a unified strategy to fight the rising threat of domestic terrorism.”

Freaky Leaky SMS: Extracting User Locations by Analyzing SMS Timings. ARXIV.org paper. Abstract: “Short Message Service (SMS) remains one of the most popular communication channels since its introduction in 2G cellular networks. In this paper, we demonstrate that merely receiving silent SMS messages regularly opens a stealthy side-channel that allows other regular network users to infer the whereabouts of the SMS recipient. The core idea is that receiving an SMS inevitably generates Delivery Reports whose reception bestows a timing attack vector at the sender. We conducted experiments across various countries, operators, and devices to show that an attacker can deduce the location of an SMS recipient by analyzing timing measurements from typical receiver locations. Our results show that, after training an ML model, the SMS sender can accurately determine multiple locations of the recipient. For example, our model achieves up to 96% accuracy for locations across different countries, and 86% for two locations within Belgium. Due to the way cellular networks are designed, it is difficult to prevent Delivery Reports from being returned to the originator making it challenging to thwart this covert attack without making fundamental changes to the network architecture.”

Seizure of Khartoum’s laboratory triggers upscaling of biosecurity. BusinessLive.co.za article. Pull quote: “The World Health Organisation’s (WHO's) representative in Sudan, Dr Nima Saeed Abid, who was evacuated from Khartoum, said that the main concern is that lab technicians could not get into to the lab to “safely contain the biological material and substances available”. In other words, without laboratory staff ensuring proper safety protocols people were likely to be exposed to infectious samples in a volatile environment made worse by lack of access to food, clean water and sanitation.”

Securing the Information and Communications Technology and Services Supply Chain; Connected Software Applications. Federal Register DOC final rule. Summary: “This final rule responds to, and adopts changes based on, the comments received to the NPRM. Consistent with the factors enumerated in E.O. 14034, the final rule amends the Securing the Information and Communications Technology Supply Chain regulations to provide additional criteria that the Secretary may consider when determining whether ICTS transactions involving connected software applications present undue or unacceptable risks (as those terms are defined in the regulations). The final rule also adds definitions for “end-point computing devices” and “via the internet” for the purposes of this rule to clarify the definition of connected software applications provided in E.O. 14034.” Effective Date: July 17^th, 2023.

6 big questions ahead on Trump’s indictment. WashingtonPost.com article. Pull quote: “Should she [Judge Aileen M. Cannon] remain on the case, she could exercise considerable control through procedural matters like pretrial motions on evidence (such as the Corcoran evidence) and even a potential dismissal. Her decisions on such matters could influence how the case is perceived publicly. Her decisions will also bear upon when the trial takes place and whether it will be resolved before voters vote. She would also be in charge of a potential sentence if Trump is convicted.