Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Netflix will air NFL’s Christmas games, a major step for streaming service

Sam Feist, longtime CNN executive, will become CEO of C-SPAN

Michael Cohen testimony ties Donald Trump to hush money payment

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

Best Places to Work in the Federal Government 2023

A hō’ike in Virginia celebrates Hawaiian life

Think you can build a gold-medal U.S. gymnastics team? Try it.

The 34 best things to do in D.C. this weekend and next week

Rating every game on the Commanders’ 2024 schedule

8 best things to do with kids in the D.C. area this weekend 

Look to the cloud to protect the life documents saved on your computer

Can you spot bad financial advice on TikTok? Take our quiz.

5 myths about Social Security as the program faces a funding crisis

Voters key to past Democratic wins are skeptical and undermotivated

Trump’s ‘they’re out to get me’ campaign and its enablers

Biden campaign accepts invite to a vice-presidential debate 

Senators studied AI for a year. Critics call the result ‘pathetic.’

Cruise settles with person dragged under one of its robotaxis

Google’s AI answers could come back to bite it

6 Airbnb red flags to spot before you make a booking mistake

Cruise ships to return to Baltimore two months after bridge collapse 

Some cruise prices are about to get a little more clear

Carolyn Hax: Fiancé plans to have a baby with someone else

Ask Amy: I’m scared of my adult stepson who keeps losing his temper

Ask Sahaj: I live with my parents and generational trauma ‘runs the house’

Who is Robert Fico? What to know about Slovakia’s leader who was shot.

Middle East conflict live updates: U.S.-built pier anchored in Gaza; ICJ hears Rafah is ‘endgame’ in Gaza destruction

Slovakia’s Fico in serious condition; suspect charged with attempted murder

The Post’s choices in Northern Virginia’s U.S. House primaries

States see legalized sports betting as a tax windfall — but at what cost?

Haiti’s plight is a case study in the ‘responsibility to protect’

President Joe Biden Joint Chiefs and Combatant Commanders 

See more coverage in your recommendations

Get the weekly Campaign Moment newsletter

Set alerts for major election developments

Election 2024

The Campaign Moment newsletter

Politics alerts

Welcome to The Cybersecurity 202! If you want to hear the funniest sequence of noises perhaps in the history of the world, <a href="https://youtu.be/UrNHQLtMwd8">watch this video</a>. Do not worry. No frog is actually harmed in the video so far as I can tell, despite its title. I daresay the frog is quite happy at the conclusion of the video.

Reading this online? <a href="https://www.washingtonpost.com/newsletters/the-cybersecurity-202/">Sign up for The Cybersecurity 202 to get scoops and sharp analysis in your inbox each morning.</a>

Below: The FBI says it contained a cyberattack, and GoDaddy reveals it was the target of a multiyear hacking operation. First:&nbsp;

Cyber pros have questions about paid security features at Twitter and Meta

Mary Altaffer

In recent days, Twitter — and to a lesser extent Facebook parent company Meta — has debuted features that gate off stronger security features for those who pay for them.

It’s a development that seemingly goes against a movement by some U.S. government officials and cyber pros for products to offer strong security to everyone at the outset without additional cost.

And while the Twitter Blue feature and the Meta Verified test initiative could improve security in certain ways, both developments sparked concern, to varying degrees, among cyber observers.

“The thing that strikes me is that security should be baked into everything we do, not a paid-for service,” Charles Henderson, global head of IBM’s X-Force threat management division, told me. “It should be on by default.”

Last week, Twitter <a href="https://blog.twitter.com/en_us/topics/product/2023/an-update-on-two-factor-authentication-using-sms-on-twitter">published a blog post</a> announcing that as of March 20, only Twitter Blue paid users will be able to use a form of two-factor authentication (2FA) that sends text message codes to users to verify their identities after they enter their passwords.&nbsp;

“While historically a popular form of 2FA, unfortunately we have seen phone-number based 2FA be used — and abused — by bad actors,” the blog post read.

Twitter owner Elon Musk later said that these text messages have <a href="https://twitter.com/elonmusk/status/1626996774820024321?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1626996774820024321%7Ctwgr%5Ee393e91db26ea52af33edfca64bd48b78c1ab698%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.buzzfeednews.com%2Farticle%2Fstefficao%2Ftwitter-blue-two-factor-authentication-elon-musk-reactions">cost Twitter $60 million a year</a>, although he didn’t elaborate on why or how it was costing them that much.

Separately, over the weekend, Meta — which owns both Facebook and Instagram — said <a href="https://about.fb.com/news/2023/02/testing-meta-verified-to-help-creators/">it would begin testing Meta Verified</a>, a paid program that offers enhanced impersonation protections, access to account support and more.&nbsp;

“This new feature is about increased authenticity and security across our services,” <a href="https://www.facebook.com/zuck/posts/pfbid05ZW63zfac4DVbSpxVFwKmcurFrjRSQdbyDmeTh8F7GJtRUnBsmPLBRkZCRQ42c4fl">Meta CEO Mark Zuckerberg wrote</a>. The tests will begin in Australia and New Zealand.

Twitter last year allowed Twitter Blue subscribers to get blue check marks, which have historically represented “verified” users on the platform. However, the company didn’t require users to provide ID to verify that they were who they said they were, <a href="https://www.washingtonpost.com/technology/2022/11/14/twitter-fake-eli-lilly/">and users impersonated brands like Eli Lilly and Co.</a> The company briefly paused the feature, with Musk saying users would be authenticated. But <a href="https://www.washingtonpost.com/technology/2023/01/05/twitter-blue-verification/">our colleague Geoffrey A. Fowler was still able to get</a> an account impersonating Sen. Edward J. Markey (D-Mass.) verified.

The Twitter move, in particular, prompted a lot of worry that popped up on … well, Twitter, naturally.

Here’s Dakota Cary, a consultant with the Krebs Stamos Group, in one typical response:

Twitter’s announcement comes amid a push by federal cybersecurity officials for tech companies to offer security to customers from the start. Earlier this month, Cybersecurity and Infrastructure Security Agency Director Jen Easterly <a href="https://www.foreignaffairs.com/united-states/stop-passing-buck-cybersecurity">co-wrote an essay</a> with Eric Goldstein, her agency’s executive assistant director for cybersecurity, making their biggest plea to date about putting security features in the base product rather than charging extra for them.

“Secure-by-default products have strong security features — akin to seat belts and air bags — at the time of purchase, without additional costs. Strong security should be a standard feature of virtually every technology product, particularly those that underpin critical infrastructure such as energy, water, transportation, communications, and emergency services,” the pair wrote.

They continued: “Attributes of strong security by default will evolve over time, but at a minimum, software sellers must include in their basic pricing features that secure a user’s identity, gather evidence of potential intrusions, and control access to sensitive information rather than as added expensive options.”

Easterly herself tweeted out her concern on Twitter’s move, but said she was encouraged about the attention it gave to multifactor authentication (MFA), often an interchangeable term with two-factor authentication:

One of the most thorough breakdowns of the security worries triggered by the Twitter and Meta moves came from Rachel Tobac, a hacker and CEO of SocialProof Security.

Summarized, Tobac is concerned that forcing people to pay for text-based (also known as SMS) two-factor authentication will push them away from using multifactor authentication altogether. And she’s got questions about whether Meta expanding account support will give cybercriminals a venue to trick customer support employees, as well as how the enhanced impersonation protections will work.

Cybersecurity experts say text message-based forms of two-factor authentication are among the weakest forms, since hackers can intercept them with tactics like sim-swapping, where they trick mobile phone carriers into activating a SIM card in their possession that scammers can then use to take over a victim’s phone number.

But “SMS is vastly better than using a static password” with no two-factor authentication, Bill Malik, vice president of infrastructure strategies at cybersecurity firm Trend Micro, told me.

Still, if text-based two-factor authentication is costing Twitter so much money, one might ask why it’s offering it at all, especially to paying users. Henderson offered the theory that paying users who are using text-based two-factor authentication would be the ones reimbursing its costs.

For Meta, <a href="https://arstechnica.com/tech-policy/2023/02/meta-tests-12-monthly-subscription-for-extra-impersonation-protection/">some observers have pointed out</a> that the paid service also requires a government ID to verify a user’s identity, which could make Meta a more tempting hacker target and make a breach worse if criminals obtained those sensitive documents.

Twitter notably isn’t taking away the ability to use multifactor authentication entirely. Users will still be able to employ methods such as Google or Microsoft authentication apps. Here’s security journalist Kim Zetter:&nbsp;

Meta, for its part, isn’t taking away any existing security features for nonpaying users, like Twitter is doing. And it already has some capabilities for <a href="https://transparency.fb.com/data/community-standards-enforcement/fake-accounts/facebook/">taking down fake accounts</a> and <a href="https://about.fb.com/news/2022/12/designing-account-security-across-our-apps/">offering customer support chats</a>.

Meta also securely stores IDs for 30 days before deleting them, Meta spokesperson Gabby Curtis told me. And by better protecting creator accounts that have large followings against impersonation, Curtis explained, that could better protect users who might fall victim to scams from fraudsters pretending to be popular creators.

Twitter did not respond to a request for comment Monday.

The FBI says it contained breach on its computer network

Charlie Neibergall

The FBI has in recent days been working to contain a malicious cyber incident on part of its computer network that has been involved in investigations of child sexual exploitation material, according to people briefed on the matter, <a href="https://www.cnn.com/2023/02/17/politics/fbi-cyber-incident-computer-network">CNN’s Evan Perez and Sean Lyngaas report.&nbsp;</a>

“The FBI is aware of the incident and is working to gain additional information,” the bureau said in a statement to CNN. “This is an isolated incident that has been contained. As this is an ongoing investigation the FBI does not have further comment to provide at this time.”

The people said that the attack likely targeted the FBI’s New York field office — one of its largest and most prominent offices. The bureau has yet to name a suspect.&nbsp;

Hackers stole GoDaddy source code, installed malware in multiyear breach

Jenny Kane

Web hosting giant GoDaddy said last week that hackers had access to its computer software for at least the past three years, allowing them to steal company source code and customer and employee data, <a href="https://www.bleepingcomputer.com/news/security/godaddy-hackers-stole-source-code-installed-malware-in-multi-year-breach/">Sergiu Gatlan reports for Bleeping Computer.&nbsp;</a>

<a href="https://d18rn0p25nwr6d.cloudfront.net/CIK-0001609711/e4736ddb-b4c7-485b-a8fc-1827691692c9.pdf">In a filing Thursday</a> with the Securities and Exchange Commission, the firm also said that over that period the cybercriminals installed malware onto its systems that redirected customer websites to malicious ones.&nbsp;

GoDaddy, one of the largest domain registrars, first discovered the breach following customer reports early last December, but later linked it to previous incidents in November 2021 and March 2020.&nbsp;

In those cases, bad actors “gained access to the email addresses of all [1.2 million] impacted customers, their WordPress Admin passwords, sFTP and database credentials, and SSL private keys of a subset of active clients,” and “used their [28,000 customers] web hosting account credentials in October 2019 to connect to their hosting account via SSH,” Gatlan writes.&nbsp;

“Based on our investigation, we believe these incidents are part of a multiyear campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,” the hosting site said in the filing.&nbsp;

GoDaddy said it is working with law enforcement agencies and external cybersecurity experts to investigate the cause of the breach.&nbsp;

Spain to extradite British Twitter hacker to U.S.

Matt Rourke

Spain’s National Court on Friday agreed to a request to extradite a British citizen to the United States over the alleged July 2020 hack of more than 130 Twitter accounts, including those of President Biden, former president Barack Obama, Bill Gates and Elon Musk, <a href="https://www.bbc.com/news/technology-64705984">the BBC’s Shiona McCallum reports.&nbsp;</a>

Joseph James O’Connor is wanted by courts in the Northern District of California and the Southern District of New York on 14 charges, including illegal access to computer systems, internet fraud, money laundering and extortion.&nbsp;

U.S. officials have accused him of hijacking the high-profile Twitter accounts and asking their followers to send bitcoin to an account, promising to double their money.

A court statement said the “necessary conditions” were met for Spain to hand over O’Connor, 23, who was arrested in 2021 in Estepona. The Spanish court also said that he is suspected of hacking the Snapchat account of an anonymous public figure and threatening to publish their nude photos unless he was paid a ransom.&nbsp;

Spain’s cabinet must first approve the extradition before it is finalized, and his defense team will also have the opportunity to appeal the decision.&nbsp;

<a href="https://www.reuters.com/world/europe/russian-state-tv-website-goes-down-during-putin-speech-2023-02-21/" target="_blank">Russian state TV website goes down during Putin speech (Reuters)</a>

<a href="https://www.techradar.com/news/researching-north-korea-online-you-could-be-victim-of-a-malware-attack" target="_blank">Researching North Korea online? You could be victim of a malware attack (Tech Radar)</a>

<a href="https://www.reuters.com/world/europe/russia-targets-netherlands-north-sea-infrastructure-says-dutch-intelligence-2023-02-20/" target="_blank">Russia targets Netherlands' North Sea infrastructure, says Dutch intelligence agency (Reuters)</a>

<a href="https://thehackernews.com/2023/02/norway-seizes-584-million-in.html" target="_blank">Norway seizes $5.84 million in cryptocurrency stolen by Lazarus hackers (The Hacker News)</a>

<a href="https://www.telegraph.co.uk/business/2023/02/19/guardian-staff-forced-work-former-brewery-ransomware-attack/" target="_blank">Guardian staff forced to work out of former brewery after ransomware attack (The Telegraph )</a>

<a href="https://www.mcall.com/2023/02/20/lehigh-valley-health-network-reports-cyberattack-from-suspected-russian-ransomware-group/" target="_blank">Lehigh Valley Health Network reports cyberattack from suspected Russian ransomware group (The Morning Call)</a>

<a href="https://www.independent.co.uk/news/uk/ireland-national-cyber-security-centre-rebecca-black-b2286095.html" target="_blank">Major hack at Virgin Media Television in Ireland ‘contained and terminated’ (The Independent)</a>

<a href="https://therecord.media/applied-materials-supply-chain-mks-ransomware-attack/" target="_blank">Semiconductor industry giant says ransomware attack on supplier will cost it $250 million (The Record )</a>

<a href="https://www.washingtonpost.com/technology/2023/02/20/layoff-algorithms/" target="_blank">AI is starting to pick who gets laid off ( Pranshu Verma)</a>

The Atlantic Council <a href="https://www.atlanticcouncil.org/event/kremlin-information-operations-before-and-after-the-february-2022-invasion/">holds a discussion</a> with the authors of two new reports on Russian narratives to justify the war in Ukraine on Wednesday at 9 a.m.&nbsp;

The R Street Institute<a href="https://www.rstreet.org/events/the-state-of-cybersecurity-careers-for-black-professionals-2/"> holds a webinar</a> on the state of cybersecurity careers for Black professionals on Thursday at noon.&nbsp;

Former U.S. national security adviser John Bolton will<a href="https://www.washingtonpost.com/washington-post-live/2023/02/24/john-bolton-us-china-relationship-war-ukraine/?itid=lk_inline_manual_96"> join The Washington Post </a>for a conversation about the war in Ukraine and rising tensions with China on Friday at 11 a.m.&nbsp;

Thanks for reading. See you tomorrow.

2022 American Society of Business Publication Editors, Bronze National Award, Government Coverage

2022 American Society of Business Publication Editors, Silver Regional Award, Government Coverage

2022 American Society of Business Publication Editors, Bronze Regional Award, Single Topic Coverage by a Team

2022 Society of Professional Journalists Washington, D.C., Chapter, Finalist, Staff

2021 Best in Business Awards, Honorable Mention, Technology, Small Division (for editing role)

2009 National Press Club Sandy Hume Memorial Ward for Excellence in Political Journalism

2001 Indiana Associated Press Managing Editors, 1st Place, Non-Deadline News Reporting (with another reporter)

2001 Hoosier State Press Association, 3rd Place, Business Writing (team project)

University of Southern Indiana, BA in Print Journalism

Tim Starks is the author of the Cybersecurity 202 newsletter at The Washington Post. He previously served as senior editor at CyberScoop and ran Politico's cybersecurity newsletter. The Evansville, Ind., native also has held reporting roles for CQ Roll Call, the New York Sun and the Evansville Courier & Press.

Tim Starks

American University, BA in Journalism and Sociology 

American University, MA in Journalism and Public Affairs, Investigative Specialty 

Vanessa Montalbano is a researcher for The Climate 202, a daily morning newsletter at The Washington Post that keeps readers up to date on climate news and policy.