From Sophos Naked Security:
Lawyers demand answers after artist forced to unlock his phone
"In February, artist Aaron Gach flew home to San Francisco after putting on a gallery installation in Brussels.
The show, titled Center for Tactical Magic, focused on “mass incarceration, government control, and political dissent”."
Showing posts with label Privacy Issues. Show all posts
Showing posts with label Privacy Issues. Show all posts
Thursday, May 11, 2017
Tuesday, May 9, 2017
Silverpush Quits Creeping World Out, Ceases Tracking TV Habits Via Inaudible 'Beacons'
A follow up to two (2) previous posts. From Forbes:
Silverpush Quits Creeping World Out, Ceases Tracking TV Habits Via Inaudible 'Beacons'
"Less than a week after the Federal Trade Commission warned app developers to stop using code that listened for inaudible sound to track mobile owners' TV watching habits, the Indian firm that marketed the product tells FORBES it's killing the software. But Silverpush product manager Piyush Bhatt says it's not ending the Unique Audio Beacon service because of that FTC action, or because of the many privacy concerns raised over the last year. It's simply a "business decision"."
Silverpush Quits Creeping World Out, Ceases Tracking TV Habits Via Inaudible 'Beacons'
"Less than a week after the Federal Trade Commission warned app developers to stop using code that listened for inaudible sound to track mobile owners' TV watching habits, the Indian firm that marketed the product tells FORBES it's killing the software. But Silverpush product manager Piyush Bhatt says it's not ending the Unique Audio Beacon service because of that FTC action, or because of the many privacy concerns raised over the last year. It's simply a "business decision"."
Are you encrypting your documents? Here’s what happens when you don’t
From Sophos Naked Security:
Are you encrypting your documents? Here’s what happens when you don’t
"In June 2015, someone connected to Plymouth University accidentally sent a spreadsheet containing the salaries, pensions and allowances of 245 senior staff to the wrong email address.
The error was reported to the UK’s Information Commissioner (ICO), and the file was said to have been deleted by the recipient. Until, that is, the same file turned up last week in the inbox of a local newspaper from an anonymous source."
Are you encrypting your documents? Here’s what happens when you don’t
"In June 2015, someone connected to Plymouth University accidentally sent a spreadsheet containing the salaries, pensions and allowances of 245 senior staff to the wrong email address.
The error was reported to the UK’s Information Commissioner (ICO), and the file was said to have been deleted by the recipient. Until, that is, the same file turned up last week in the inbox of a local newspaper from an anonymous source."
Dating site users spammed with smut after ‘third-party’ data leak
From Sophos Naked Security:
Dating site users spammed with smut after ‘third-party’ data leak
"Users of the Guardian’s Soulmates dating site have been getting spammed with smut after the site leaked their contact information.
The UK-based Guardian newspaper’s publisher, which runs the service, is blaming “human error” and a third-party technology provider for the leak, which has now been fixed. According to the BBC, the site — which charges users up to £32 ($41.50) per month — said that only email addresses and user IDs had been exposed directly. But that information can be used to dig out more from public profiles, said the company, including photos, relationship preferences and physical descriptions."
Dating site users spammed with smut after ‘third-party’ data leak
"Users of the Guardian’s Soulmates dating site have been getting spammed with smut after the site leaked their contact information.
The UK-based Guardian newspaper’s publisher, which runs the service, is blaming “human error” and a third-party technology provider for the leak, which has now been fixed. According to the BBC, the site — which charges users up to £32 ($41.50) per month — said that only email addresses and user IDs had been exposed directly. But that information can be used to dig out more from public profiles, said the company, including photos, relationship preferences and physical descriptions."
Android Apps Secretly Tracking Users By Listening To Inaudible Sound Hidden In Adverts
From The Independent:
Android Apps Secretly Tracking Users By Listening To Inaudible Sound Hidden In Adverts
"Researchers say the technique can even be used to de-anonymise Tor users
An increasing number of Android applications are attempting to track users without their knowledge, according to a new report.
Over recent years, companies have started hiding “beacons”, ultrasonic audio signals inaudible to humans, in their adverts, in order to track devices and learn more about their owners."
Android Apps Secretly Tracking Users By Listening To Inaudible Sound Hidden In Adverts
"Researchers say the technique can even be used to de-anonymise Tor users
An increasing number of Android applications are attempting to track users without their knowledge, according to a new report.
Over recent years, companies have started hiding “beacons”, ultrasonic audio signals inaudible to humans, in their adverts, in order to track devices and learn more about their owners."
SPY PHONE Secret messages hidden in TV adverts can order smartphones to spy on people, researchers warn
From The Sun:
SPY PHONE Secret messages hidden in TV adverts can order smartphones to spy on people, researchers warn
"Popular apps downloaded by millions of people are always on the look out for clandestine broadcasts which order them to begin snooping on citizens."
SPY PHONE Secret messages hidden in TV adverts can order smartphones to spy on people, researchers warn
"Popular apps downloaded by millions of people are always on the look out for clandestine broadcasts which order them to begin snooping on citizens."
US-CERT Alert: Security Tip (ST05-019) Preventing and Responding to Identity Theft
Privacy Week follow up from US-CERT:
Security Tip (ST05-019) Preventing and Responding to Identity Theft
Is identity theft just a problem for people who submit information online?
You can be a victim of identity theft even if you never use a computer. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans.
Security Tip (ST05-019) Preventing and Responding to Identity Theft
Is identity theft just a problem for people who submit information online?
You can be a victim of identity theft even if you never use a computer. Malicious people may be able to obtain personal information (such as credit card numbers, phone numbers, account numbers, and addresses) by stealing your wallet, overhearing a phone conversation, rummaging through your trash (a practice known as dumpster diving), or picking up a receipt at a restaurant that has your account number on it. If a thief has enough information, he or she may be able to impersonate you to purchase items, open new accounts, or apply for loans.
US-CERT Alert: Security Tip (ST04-014) Avoiding Social Engineering and Phishing Attacks
Privacy Week follow up from US-CERT:
Security Tip (ST04-014) Avoiding Social Engineering and Phishing Attacks
What is a social engineering attack?
In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.
Security Tip (ST04-014) Avoiding Social Engineering and Phishing Attacks
What is a social engineering attack?
In a social engineering attack, an attacker uses human interaction (social skills) to obtain or compromise information about an organization or its computer systems. An attacker may seem unassuming and respectable, possibly claiming to be a new employee, repair person, or researcher and even offering credentials to support that identity. However, by asking questions, he or she may be able to piece together enough information to infiltrate an organization's network. If an attacker is not able to gather enough information from one source, he or she may contact another source within the same organization and rely on the information from the first source to add to his or her credibility.
US-CERT Alert: Security Tip (ST04-013) Protecting Your Privacy
Privacy Week follow up from US-CERT:
Security Tip (ST04-013) Protecting Your Privacy
How do you know if your privacy is being protected?
Security Tip (ST04-013) Protecting Your Privacy
How do you know if your privacy is being protected?
- Privacy policy – Before submitting your name, email address, or other personal information on a website, look for the site's privacy policy. This policy should state how the information will be used and whether or not the information will be distributed to other organizations. Companies sometimes share information with partner vendors who offer related products or may offer options to subscribe to particular mailing lists. Look for indications that you are being added to mailing lists by default—failing to deselect those options may lead to unwanted spam. If you cannot find a privacy policy on a website, consider contacting the company to inquire about the policy before you submit personal information, or find an alternate site. Privacy policies sometimes change, so you may want to review them periodically.
US-CERT Alert: Security Tip (ST06-008) Safeguarding Your Data
Privacy Week follow up from US-CERT:
Security Tip (ST06-008) Safeguarding Your Data
"Why isn't "more" better?
Maybe there is an extra software program included with a program you bought. Or perhaps you found a free download online. You may be tempted to install the programs just because you can, or because you think you might use them later. However, even if the source and the software are legitimate, there may be hidden risks. And if other people use your computer, there are additional risks."
Security Tip (ST06-008) Safeguarding Your Data
"Why isn't "more" better?
Maybe there is an extra software program included with a program you bought. Or perhaps you found a free download online. You may be tempted to install the programs just because you can, or because you think you might use them later. However, even if the source and the software are legitimate, there may be hidden risks. And if other people use your computer, there are additional risks."
US-CERT Alert: FTC Promotes Privacy Awareness Week
From US-CERT:
FTC Promotes Privacy Awareness Week
FTC Promotes Privacy Awareness Week
Monday, May 8, 2017
French Cybersecurity Agency to Probe Macron Hacking Attack
From Newsmax:
French Cybersecurity Agency to Probe Macron Hacking Attack
"France's election campaign commission said Saturday "a significant amount of data" — and some fake information — has been leaked on social networks following a hacking attack on centrist Emmanuel Macron's presidential campaign. It urged citizens not to relay the data on social media to protect the integrity of the French vote."
French Cybersecurity Agency to Probe Macron Hacking Attack
"France's election campaign commission said Saturday "a significant amount of data" — and some fake information — has been leaked on social networks following a hacking attack on centrist Emmanuel Macron's presidential campaign. It urged citizens not to relay the data on social media to protect the integrity of the French vote."
Friday, May 5, 2017
Attackers Unleash OAuth Worm via 'Google Docs' App
From DataBreach Today:
Attackers Unleash OAuth Worm via 'Google Docs' App
"A malicious app named "Google Docs" by attackers has been making the rounds, attempting to trick Google users into logging in and giving the app access permissions to their account.
The phishing campaign began with an email to victims from an address they likely would have recognized, according to multiple analyses of the attack that have now been posted online by security researchers. But the campaign quickly turned into a worm, as users authorized the bogus app in droves, allowing it to spread to their own contacts."
Attackers Unleash OAuth Worm via 'Google Docs' App
"A malicious app named "Google Docs" by attackers has been making the rounds, attempting to trick Google users into logging in and giving the app access permissions to their account.
The phishing campaign began with an email to victims from an address they likely would have recognized, according to multiple analyses of the attack that have now been posted online by security researchers. But the campaign quickly turned into a worm, as users authorized the bogus app in droves, allowing it to spread to their own contacts."
Celebrity ‘extortion’: judge orders reality star to unlock her iPhone
From Sophos Naked Security:
Celebrity ‘extortion’: judge orders reality star to unlock her iPhone
"A Miami judge on Wednesday ordered a reality TV star to unlock her iPhone in a case that’s yet again firing up the legal debate around when we can be compelled to give up our passcodes.
The star, Hencha Voigt, has been charged with conspiracy to extort a social-media celebrity known as the “Queen of Snapchat”. The target of the alleged extortion was South Beach socialite YesJulz (pictured), whose real name is Julieanne Goddard. She’s a party promoter and online marketer who hangs with rappers and athletes and boasts hundreds of thousands of followers, according to her publicist."
Celebrity ‘extortion’: judge orders reality star to unlock her iPhone
"A Miami judge on Wednesday ordered a reality TV star to unlock her iPhone in a case that’s yet again firing up the legal debate around when we can be compelled to give up our passcodes.
The star, Hencha Voigt, has been charged with conspiracy to extort a social-media celebrity known as the “Queen of Snapchat”. The target of the alleged extortion was South Beach socialite YesJulz (pictured), whose real name is Julieanne Goddard. She’s a party promoter and online marketer who hangs with rappers and athletes and boasts hundreds of thousands of followers, according to her publicist."
Thursday, May 4, 2017
How does the boot mode vulnerability in Android work?
From SearchSecurity:
How does the boot mode vulnerability in Android work?
"Google recently shut down the boot mode vulnerability in Android that allowed hackers to eavesdrop on calls. Can you explain how this exploit works?
It takes a few steps for the boot mode vulnerability exploit to work. First, the attacker infects a PC with malware through the internet. Then, the attacker waits for the victim to enable Android Debug Bridge (ADB) after manually connecting his Nexus 6 or 6P phone to the infected PC."
How does the boot mode vulnerability in Android work?
"Google recently shut down the boot mode vulnerability in Android that allowed hackers to eavesdrop on calls. Can you explain how this exploit works?
It takes a few steps for the boot mode vulnerability exploit to work. First, the attacker infects a PC with malware through the internet. Then, the attacker waits for the victim to enable Android Debug Bridge (ADB) after manually connecting his Nexus 6 or 6P phone to the infected PC."
Tinder orders researcher to remove dataset of 40,000 profile pictures
From Sophos Naked Security:
Tinder orders researcher to remove dataset of 40,000 profile pictures
"Following a privacy kerfluffle, Tinder told a developer to remove a dataset of 40,000 of its users’ images that he had published in six downloadable zip files and released under a CC0: Public Domain License.
The dataset was called People of Tinder.
The developer, Stuart Colianni, who not-so-charmingly referred to the Tinder users as “hoes” in his source code, was using the images to train artificial intelligence."
Tinder orders researcher to remove dataset of 40,000 profile pictures
"Following a privacy kerfluffle, Tinder told a developer to remove a dataset of 40,000 of its users’ images that he had published in six downloadable zip files and released under a CC0: Public Domain License.
The dataset was called People of Tinder.
The developer, Stuart Colianni, who not-so-charmingly referred to the Tinder users as “hoes” in his source code, was using the images to train artificial intelligence."
Concern mounts at Indian ID scheme as portals ‘leak’ 100m people’s details
From Sophos Naked Security:
Concern mounts at Indian ID scheme as portals ‘leak’ 100m people’s details
"The details of more than 100m Indians’ Aadhaar ID cards have leaked from four government portals, according to a report from the Centre for Internet and Society (CIS).
Concern mounts at Indian ID scheme as portals ‘leak’ 100m people’s details
"The details of more than 100m Indians’ Aadhaar ID cards have leaked from four government portals, according to a report from the Centre for Internet and Society (CIS).
Based on the numbers available on the websites looked at, [the] estimated number of Aadhaar numbers leaked through these four portals could be around 130-135 million"
NSA collected records of 151m Americans – but wait, didn’t bulk collection stop three years ago?
From Sophos Naked Security:
NSA collected records of 151m Americans – but wait, didn’t bulk collection stop three years ago?
"You remember the NSA’s bulk phone data collection program, right?
As in, the one that Congress cut the funding for in 2014? The one that wasn’t authorized by Section 215 of the Patriot Act after all, as a court unanimously ruled in 2015? … but which got extended anyway?
Boy, did it get extended, and how. It’s still chugging along just fine."
NSA collected records of 151m Americans – but wait, didn’t bulk collection stop three years ago?
"You remember the NSA’s bulk phone data collection program, right?
As in, the one that Congress cut the funding for in 2014? The one that wasn’t authorized by Section 215 of the Patriot Act after all, as a court unanimously ruled in 2015? … but which got extended anyway?
Boy, did it get extended, and how. It’s still chugging along just fine."
Wednesday, May 3, 2017
Healthcare Breaches Hit All-Time High in 2016
From Dark Reading:
Healthcare Breaches Hit All-Time High in 2016
"More than 300 healthcare businesses reported data breaches in 2016, but a drop in leaked records put fewer Americans at risk.
A record-breaking 328 healthcare businesses reported data breaches in 2016, surpassing the record of 268 set one year prior. Healthcare records of about 16.6 million Americans were exposed due to hacks, lost or stolen devices, unauthorized disclosure, and other activity."
Healthcare Breaches Hit All-Time High in 2016
"More than 300 healthcare businesses reported data breaches in 2016, but a drop in leaked records put fewer Americans at risk.
A record-breaking 328 healthcare businesses reported data breaches in 2016, surpassing the record of 268 set one year prior. Healthcare records of about 16.6 million Americans were exposed due to hacks, lost or stolen devices, unauthorized disclosure, and other activity."
Monday, May 1, 2017
Microsoft Turns Off Wi-Fi Sense After Risk Revealed
From DataBreach Today:
Microsoft Turns Off Wi-Fi Sense After Risk Revealed
"Remember Microsoft's Wi-Fi Sense? The Windows 10 feature shared encrypted passwords to Wi-Fi networks with user's Skype and Outlook contacts. The idea was that friends could then easily connect to other networks without needing login details. But it raised privacy and security concerns."
Microsoft Turns Off Wi-Fi Sense After Risk Revealed
"Remember Microsoft's Wi-Fi Sense? The Windows 10 feature shared encrypted passwords to Wi-Fi networks with user's Skype and Outlook contacts. The idea was that friends could then easily connect to other networks without needing login details. But it raised privacy and security concerns."
Subscribe to:
Posts (Atom)