A political activist and former star of the reality TV show 19 Kids and Counting has been convicted of two charges relating to the sexual abuse of children.

On Thursday, after a six-day trial that featured ten witnesses, a jury found Josh Duggar guilty of one count of receiving CSAM and one count of possessing CSAM. It took the jury just under seven hours of deliberation to reach its verdict.

The 33-year-old married father of seven now faces a maximum prison sentence of 40 years and a fine of up to $500,000.

Speaking outside the federal courthouse in Fayetteville, Arkansas, after the verdict was reached, Clay Fowlkes, the acting US attorney for the Western District of Arkansas, said: “First and foremost, this shows that no person is above the law.”

Fowlkes continued: “Regardless of wealth, social status, or fame, our office will continue to seek out all individuals who seek to abuse children and victimize them through the downloading, possession, and sharing of child pornography.”

Duggar’s defense attorney, Justin Gelfand, said that his client intends to launch an appeal against his conviction.

Federal authorities began an investigation into Duggar in 2019 after a Little Rock police detective discovered CSA files were being shared by a computer linked to the former reality tv star. The content was downloaded to a device located at a car dealership owned by Duggar. 

Agents from the Department of Homeland Security executed a search warrant at Duggar’s Wholesale Motorcars and seized a computer and two other electronic devices.

The three devices were analyzed by James Fottrell, the director of the Department of Justice’s High Technology Investigative Unit. In court, Fottrell described how a Linux partition, created on Duggar’s workplace computer, circumvented software that monitors internet use for inappropriate activity.

Fottrell found evidence that images and videos of minors being sexually abused could have been accessed and then deleted from Duggar’s work computer.

Duggar was arrested on April 29, 2021, and pleaded not guilty to receiving and possessing CSAM. He was later released from police custody on May 5, 2021, to await trial. 

Judge Timothy Brooks said that sentencing will take place in roughly four months’ time.

US military network-security researchers have launched a new program to discover more about the tactics of malicious hackers.

The Signature Management Using Operational Knowledge and Environments (SMOKE) program was announced on Tuesday in a broad agency statement put out by officials at the US Defense Advanced Research Projects Agency (DARPA) in Arlington, Virginia.

Signatures are patterns that describe the way in which an organization performs cyber operations.

SMOKE is asking the computer industry to develop methods to identify, model, and mitigate the typical behaviors of threat actors. The aim of the program is to develop technologies to generate evasive cyber infrastructure that accelerates red team cyber operations (CO).

The data-driven tools will achieve this goal through automated threat-informed planning, emulation, and attribution risk assessment.

DARPA stated: “In a complementary activity, SMOKE will develop data-driven tools to automate the discovery of distinguishable patterns of sophisticated cyber threat infrastructure (i.e., signatures).”

The agency outlined two key technical objectives of the project. The first is to include informing operators of adversary signatures as they prepare cyber infrastructure in real time, and the second is to find a way to provide attribution risk assessments for planning and surveillance of the cyber infrastructure that is in use. 

The program’s key research challenges include finding a way to automatically build and traverse associations in large-scale cyber datasets, expanding the use of attribution techniques to non-experts, and discovering latent associations between infrastructure elements.

Researchers will also be tasked with generating useful statistics for planners to predict how well infrastructure configurations will break from, or conform to, desired infrastructure signatures.

Possible approaches that the industry could apply to these challenges include using machine learning to model infrastructure associations through automated pattern recognition and graph-based inference.

The SMOKE program is being managed by Tejas Patel of the Information Innovation Office (I2O). It will be conducted at the unclassified level. 

The start date of the program is anticipated to be August of next year. Proposers are strongly encouraged to propose their own data sources and methods, and to offer up options for program-wide access to those sources.

The deadline to submit proposals to the program is January 31, 2022.

The lifespan of most phishing pages is as brief as that of an adult mayfly, according to new research by cybersecurity company Kaspersky.

Between July 19 and August 2, 2021, researchers analyzed 5,307 examples of phishing pages. They found that within 13 hours of monitoring commencing, a quarter of all pages had become inactive.

A sizable chunk of links (1,784) ceased functioning after the first day of monitoring, and half of the phishing pages included in the study survived no more than 94 hours. 

Researchers emphasized the importance of repelling spam attacks with fraudulent links within the first few hours, when the potency of a phishing page is at its highest. 

“It is important for users to remember that when they receive a link and have doubts about the legitimacy of the site, we recommend they wait for a few hours,” said Egor Bubnov, security researcher at Kaspersky. 

“During that time, not only will the likelihood of getting the link in the anti-phishing databases increase, but the phishing page itself can stop its activity.” 

Explaining why the lifecycle of phishing pages is so fleeting, researchers wrote: “With every hour of life of a new site, it appears in more anti-phishing databases, which means that fewer potential victims will visit it.”

What determines the lifespan of a page is how long it takes for site administrators to detect the threat and remove it. 

“Even if phishers have deployed their own server on a purchased domain, if they are suspected of fraudulent activity, the registrars may deprive the phishers of the right to host the data on it,” noted researchers.

When a phisher’s page is identified by site administrators, the cyber-criminal typically prefers to create a new page instead of modifying an existing one. 

“In addition, very rarely phishers may change the page in order to avoid being blocked,” wrote researchers. “For example, if phishers use a brand as bait, they might alter it to another one. However, most pages are simply blocked by the time phishers decide to change the form of activity.”

The internet is becoming more secure overall, but slightly more than half of websites’ digital keys are still generated via legacy encryption algorithms, according to new research.

Security firm Venafi enlisted the help of noted researcher Scott Helme to analyze the world’s top one million sites over the past 18 months.

The resulting TLS Crawler Report revealed some progress in a few areas.

Nearly three-quarters (72%) of sites now actively redirect traffic to use HTTPS, an increase of 15% since March 2020. Even better, more than half of the sites studied that use HTTPS are on the latest version of TLS: TLSv1.3. It has now overtaken TLSv1.2 to become the most popular protocol version.

In addition, almost one in five of the top one million sites now use the more secure HSTS (HTTP Strict Transport Security) — a 44% increase since March 2020.

Better still, the number of top one million sites using EV certificates is at its lowest point ever in the last six years of analysis. These are noted for slow, manual approval processes which drive too much friction for end users.

Conversely, the much more user-friendly Let’s Encrypt is now the leading Certificate Authority for TLS certificates, with 28% of sites using it.

However, there is also some work to be done. The report found that nearly 51% of sites still use legacy RSA encryption algorithms to generate authentication keys.

Alongside TLS, these form the “machine identities” which help to validate and secure connections between physical, virtual and IoT devices, APIs, applications and clusters.

RSA is significantly less secure than modern alternative ECDSA, a public key cryptography encryption algorithm which boasts greater computational complexity and smaller authorization keys. The latter means they require less bandwidth to set up an SSL/TLS connection, making them ideal for mobile apps and support for IoT and embedded devices, according to Venafi.

Helme branded the RSA findings “a shame and somewhat surprising.”

“I would have expected that the rise in adoption of TLSv1.3 usage would have driving the ECDSA numbers up much more. One of the main reasons to keep RSA around for authentication is legacy clients that don’t support ECDSA yet, but that seems at odds with the huge rise in TLSv1.3 which isn’t supported by legacy clients. We also continue to see use of RSA 3072 and RSA 4096 in numbers that are concerning,” explained Helme.

“If you’re using larger RSA keys for security reasons then you should absolutely be on ECDSA already which is a stronger key algorithm and offers better performance. My gut feeling here is that there’s a lot of legacy stuff out there or site operators just haven’t realized the advantages of switching over to ECDSA.”

The US-CERT has recorded more vulnerabilities so far in 2021 than any year previously, the fifth year in a row this has happened.

At the time of writing, 18,376 vulnerabilities in production code were recorded in the US National Vulnerability Database (NVD), exceeding the 2020 record of 18,351.

However, there were fewer high severity bugs in the NVD than last year. In 2020 the figure reached an all-time-high of 4381, falling to 3630 so far in 2021.

Pravin Madhani, CEO of K2 Cyber Security, argued that this could be due to improved coding practices and the growing popularity of DevSecOps. However, while organizations are coding better, they’re not testing as thoroughly as they should, allowing bugs to slip through into production, he added.

“The ongoing COVID-19 pandemic has continued to push many organizations to rush getting their applications to production, as part of their digital transformation and cloud journeys,” Madhani said.

“This means the code may have been through fewer QA cycles, and there may have been more use of third party, legacy, and open source code, another risk factor for more vulnerabilities.”

Casey Ellis, CTO at Bugcrowd, argued that the record number of software flaws this year is a reflection of the pace of technological development.

“It’s a probability game, and the more software that is produced, the more vulnerabilities will exist,” he added.

Yaniv Bar-Dayan, CEO at Vulcan Cyber, claimed that more concerning than this year’s NVD list is the “security debt” that continues to pile up year after year.

“If IT security teams are leaving 2020’s vulnerabilities unaddressed, the real 2021 number is cumulative and becoming harder and harder to defend against,” he argued.

“Cybersecurity teams need to do more than just scan for vulnerabilities. We need to work together as an industry to better measure, manage and mitigate cyber risk, or we will be crushed by this growing mountain of vulnerability debt.”

The news comes after bug bounty platform HackerOne revealed its researchers found 66,000 valid vulnerabilities this year, a 20% increase on the 2020 figure.