Firstly, defining "social media" is tough. Different apps have very different properties and challenges. There's no clear line between "social media" and straight up communications or educational websites. (2/9)
Age verification is *hard*. Accounts are shared, borrowed and stolen. Validating government ID will inevitably result in personal data being stolen or misused. Many Australians have real reasons not to link govt id with their profile. (3/9)
The internet is global and Australia is small. Will the next great learning and education platform just decide that Australia's unclear laws aren't worth the risk and Australian kids end up just locked out? (4/9)
Circumvention will be common and routine. Circumvention tools and systems will push disrupt real moderation and controls and expose users to other risks. (5/9)
It's much easier to fight bullying, harassment and harmful content on major platforms than it will be if youth are inevitably pushed to underground forums. (6/9)
It's really tempting for some to think we can just pass a quick law and we go back to some golden age where kids just played outside, went to the library and watched well controlled and rated TV shows.
It's not that simple! (7/9)
So, we could end up disrupting the benefits of the modern internet, creating new privacy and security risks for all Australians, while our youth move on to more dangerous and unregulated spaces.
We deserve better than this and a more well thought out response. (8/9)
All of these thoughts are solely my own, based on my global experience with the Internet and cybersecurity and as an Australian parent.
(9/9)
• • •
Missing some Tweet in this thread? You can try to
force a refresh
Launching today our new report "Tool of First Resort: Israel-Hamas War in Cyber"
Cyber provides a lower-cost, lower-risk way for rivals to engage in conflict, gather information, disrupt daily life, and shape public perceptions. 🧵blog.google/technology/saf…
The full report is here:
It contains a wealth of details on what was observed both before and after the terrorist attack on October 7th.
1. Iran continues to aggressively target Israeli and US entities, often with mixed results. Hamas’ attack did not fundamentally shift Tehran’s strategy, but after the attack took place, we more focus effort, concentrated on undercutting public support for the war.
"Fog of War: How the Ukraine conflict Transformed the Cyber Threat Landscape"
TAG's biggest ever report. Along with @Mandiant and others from @Google we outline insights into changes in the cyber threat landscape triggered by the war.
The full 27 page report on government backed attacks, information operations and involvement of the cybercrime ecosystem in the Ukraine conflict is here: services.google.com/fh/files/blogs…
Some quick highlights though:
2/7
Russian government-backed attackers ramped up cyber operations beginning in 2021 during the run up to the invasion. In 2022, Russia increased targeting of users in Ukraine by 250% compared to 2020. Targeting of users in NATO countries increased over 300% in the same period. 3/7
The "English Coop" website was linked to what the Google knew as "Cold River," a Russia-based hacking group. We're able to see that through technical indicators.
COLDRIVER is a Russian-based threat actor sometimes referred to as Callisto, that @billyleonard reported previously as attempting credential phishing. This is the first time we've seen them step into the disinformation / hack & leak space.
In one part of the attack the actors would ask the targeted researcher if they wanted to collaborate on vulnerability research together, and then provide the researcher with a Visual Studio Project containing malware.
In addition to targeting users via social engineering, we have also observed several cases where researchers have been compromised after visiting the actors’ blog.
The victim systems were running fully patched and up-to-date Windows 10 and Chrome
2FA is super important but please, please stop telling people that by itself it will protect people from being phished by the Russians or governments. If attacker can trick users for a password, they can trick them for a 6 digit code.
2FA will protect you against you against other important attacks such as password being stolen from one site and used on another, or passwords databases being compromised. But any 2FA system that involves the user entering a code is phishable.
Attack Steps:
1. User enters password into attackers site
2. Attacker attempts to log in immediately and SMS code sent to user
3. Attacker sees code is required then returns page asking for code to user
4. User enters code
5. Attacker wins